The surveillance standard we work to, and why

There is one question worth asking a firm before you hire it for surveillance work, and almost nobody asks it: can you send me the standard you work to, before I engage you?

Not a brochure. Not a list of case types. The internal rules the investigator is held to on your file — how the method is chosen, what gets written down and when, how the record is kept intact, what goes in the report, and what the firm will refuse to do even if you ask.

A firm that can send you that document in an email has told you something about how the work will be done. A firm that has to write one for you, or answers with reassurance instead, has told you something as well. This article is ours, with the reason each rule exists.

Why a written standard is worth more than experience claims

Surveillance evidence is rarely accepted on the strength of the investigator's word. It stands or falls on the record around it — when the observation was made, by whom, what was recorded at the time rather than reconstructed afterwards, and whether the material you hold is demonstrably the material that came out of the field.

That record does not happen by instinct on the day. It happens because rules were set before the work started and followed when nothing interesting was occurring, which is most of the time. An investigator who takes notes only when something happens produces a record with gaps in exactly the places opposing counsel will ask about.

There is also a legal reason the standard has to be written, specific to British Columbia. Under BC's Privacy Act, s.1(2) measures privacy by what is "reasonable in the circumstances, giving due regard to the lawful interests of others", and s.1(4) confirms that "privacy may be violated by eavesdropping or surveillance, whether or not accomplished by trespass." That is a proportionality test written into the statute — and proportionality cannot be demonstrated after the fact by recalling that you were being careful. It is demonstrated by showing which less intrusive option was considered first, and why it was insufficient. That is a document, or it is nothing.

One: proportionality — the least intrusive method that answers the question

We start every file by writing down the question, then choosing the least intrusive method capable of answering it. Records and enquiry work first; open sources and public registries before observation; observation before anything more sustained. If a records search answers the question, no observation is conducted, even where the client has authorized and budgeted for it.

Where observation is required, its intensity is matched to the question rather than to the budget. A question about whether an activity occurs on a specific day does not justify indefinite coverage. When a method is chosen, the file records what was considered and rejected, and why.

This has a commercial consequence we accept: it regularly makes a file smaller than the client expected to pay for. It is also the rule most likely to keep the resulting evidence usable, because the Privacy Act standard is applied by a court looking backwards at what you did, not at what you intended.

Two: a defined scope, in writing, agreed before work starts

Before any fieldwork, the file has a written scope containing: the question to be answered, the decision that answer will support, the methods authorized, the locations and hours contemplated, the duration and the review point, who may receive the report, and the retention period.

Nothing outside that document is done without a written variation agreed with the client. If field circumstances suggest a change is warranted, work stops and the scope is revisited. It is not extended in the moment by an investigator making a judgment call alone at eleven at night.

The scope is also where BC privacy law is satisfied at the front end rather than defended at the back end. Investigation is personal-information handling, and where the subject is an employee, the Personal Information Protection Act provisions on collection (s.13), use (s.16) and disclosure (s.19) of employee personal information each carry obligations around what is being handled and why. Those obligations turn on the purpose. Where the purpose is not written down before collection begins, there is nothing to measure the collection against.

We ask, at intake, what decision the file is meant to support, for exactly this reason. Our companion article on what a BC investigator can and cannot legally do sets out the statutory limits that bound any scope we will agree to, and our article on employer investigations under PIPA covers the workplace case in more detail.

Three: contemporaneous notes

Notes are made in the field, at the time, in sequence, and they are not rewritten afterwards. Times are recorded continuously, including periods in which nothing was observed. Corrections are made as additions, dated, never by amending the original entry.

The reason is narrow and practical. A note made at the time is evidence of what was perceived at the time. A note assembled that evening from memory is a recollection of a perception, and it is attacked as one. The difference is invisible in the finished report and decisive when the report is challenged.

Field notes on our files are part of the evidentiary record from the moment they are made — which means they are disclosable, and are written as though someone whose job is to find the inconsistency will read them.

Four: continuity of the record

Every item of material — notes, still images, video, documents obtained — is identified when it is created, transferred by a documented route, and stored so that the original is preserved unaltered. Working copies are used for review and reporting. Original material is not edited, cropped, enhanced or reduced in quality. Where a compiled or excerpted version is produced for convenience, it is labelled as such and the full original remains available. A chain of handling is recorded from creation to delivery: who held the material, when, and what was done to it.

Under PIPA, s.34 requires an organization to protect personal information in its custody or under its control with reasonable security arrangements against unauthorized access, collection, use, disclosure, copying, modification or disposal. Continuity and security are the same discipline approached from two directions: material that cannot be shown to be intact is both an evidentiary problem and a compliance problem.

Retention runs on the same record. PIPA s.35 sets obligations in both directions — information used to make a decision that directly affects an individual must be kept for a minimum period so the individual has a reasonable opportunity to obtain access to it, and documents containing personal information must be destroyed or de-identified once the collection purpose is no longer served and retention is no longer necessary for legal or business purposes. Both dates are set in the scope document at the start.

Five: report what was observed, including the absence of observation

The report states what was observed and what was not. Periods of coverage during which nothing relevant occurred are reported as findings, with their times, not omitted as unproductive.

This is the rule clients find hardest to hear and the one that most often protects them. A day of coverage that produced no observation of the activity in question is a real result: on this date, during these hours, at this location, the subject was not observed doing the thing. That is evidence. Suppressing it in favour of the two hours that looked useful produces a report that is technically true, materially misleading, and fragile the moment anyone asks what happened during the rest of the deployment.

The report separates observation from inference and marks which is which. Where a conclusion is drawn, the observations it rests on are identified. Where the evidence does not support the conclusion the client hoped for, the report says so — in the report, not in a phone call afterwards. Our article on surveillance evidence in BC covers what makes that record hold up when it is tested.

Six: the things we will not do

A standard that contains no refusals is not a standard. Ours states them, and they hold regardless of what the client is willing to pay:

• We do not conduct surveillance without a written, agreed scope.
• We do not observe places where a person is entitled to expect privacy, whatever vantage point makes it possible.
• We do not intercept private communications we are not party to, and we do not possess equipment designed for it.
• We do not obtain access to accounts, devices or credentials, and we do not accept credentials a client already holds.
• We do not impersonate a real, identifiable person.
• We do not place tracking equipment on a vehicle a client does not own and control, and where a client does own it, its use is disclosed and documented.
• We do not represent ourselves as having any authority beyond that of any other member of the public, because we do not have any.
• We do not edit, enhance or selectively withhold source material.
• We do not guarantee an outcome, and we do not report an inference as an observation.

Several of these are statutory limits rather than house preferences, and our article on the legal limits of investigative work in BC sets them out with their section numbers. The rest are ours, and we would rather lose the file than move them.

The benchmark question, answered honestly

Public bodies and regulators in British Columbia conduct surveillance and investigative activity under published policies. That this is normal practice in the public sector is a reasonable benchmark for private engagements: a client is entitled to ask a private firm for the same kind of document a public body is expected to publish.

We stop short of the comparison most articles on this subject would make here. We have not read and registered any particular public-sector surveillance policy under the citation process this site uses, which requires a human to read a primary source before its contents are described. So we will not tell you what any published policy says, summarize it, or imply that our standard mirrors it. That reading is staged as a documented gap; when it is closed, a future version of this article will make the comparison properly and cite it.

That is itself an application of the standard above: report what was observed, and report the absence of observation as an absence.

How to test any firm's standard in one call

• Ask for the written standard before engagement. Note whether it arrives as a document or as reassurance.
• Ask what less intrusive method was considered for your question, and why it was rejected.
• Ask what the report will contain if nothing is observed.
• Ask how original material is preserved, and what you receive versus what is retained.
• Ask what they will not do. A firm that cannot name limits immediately has not thought about them.
• Ask for the security business licence number. Investigative work in BC is licensed under the Security Services Act — a licence is required to perform security work or hold yourself out as performing it (s.2), and to carry on a security business (s.11). Ours is in the footer of this page.

If you have a file where the evidence may have to survive challenge, start with the question it is meant to answer, and ask us for our standard before you ask us for a price. Both are available before you commit to anything.

Sources

• Privacy Act, RSBC 1996, c. 373, s.1 (violation of privacy actionable), s.1(2) (reasonableness standard), s.1(4) (surveillance with or without trespass) — https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/96373_01
• Personal Information Protection Act, SBC 2003, c. 63, s.13 (collection of employee personal information), s.16 (use), s.19 (disclosure), s.34 (protection of personal information), s.35 (retention and destruction) — https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/03063_01
• Security Services Act, SBC 2007, c. 30, s.2 (licence required to perform security work), s.11 (security business licence required) — https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/07030_01
• WorkSafeBC — https://www.worksafebc.com/ — identified as a source to be read and registered in a future revision of this article. Nothing in this article reports, summarizes or characterizes the contents of any WorkSafeBC policy, and this link is not offered as evidence that we have read one.