Leaks to the press abetted by employees and other insiders have proved extremely embarrassing and detrimental to many commercial and government organisations. Last month, the former chairwoman of Hewlett Packard, Patricia Dunn, was charged in California over alleged wrongdoing in the investigation of boardroom press leaks.

Press leaks can originate at the highest levels. There are many motives to leak information to the press, some of which could be considered noble, others not so. Reasons for leaks can range from 'whistleblowing' (aimed at disseminating confidential information that the informant considers to be in the public interest), the disclosure of fraud, corruption or malpractice, through to attempts to extort, embarrass or aggravate the victim.

When investigating a press leak, two key questions are germane – what is the motive for the leak, and who benefits from it? Some fundamental rules apply. Hunting a mole within an organisation is a sizeable and complex task that demands careful coordination and management; all of which must be conducted in strict secrecy. The objective is to confront the mole in an ambush, with compelling and probative evidence, from which he or she cannot recover. If the suspect is forewarned of an investigation, he, she or they will take precautionary measures and destroy or conceal evidence.

For this reason, the investigation should commence in secrecy with all actions conducted covertly. The 'need to know' rule applies. How many people need to know about an investigation? Keep those in the know to the absolute minimum. Managing partners should take personal responsibility for over-seeing the investigation process. They should not discuss the investigation electronically on any computers accessible to the suspect. All related meetings should take place off-site and should not be scheduled in any appointment system accessible to the suspect.

The managing partner should resist involving in-house IT staff. They are trained in devising and administering day-to-day IT solutions, but do not always have the specialist procedural and forensic knowledge required for this level of investigation. They could corrupt potential evidence irrevocably through ill-advised and incorrect processing. Worse still, they themselves could be implicated in the leak being investigated. The processing and interpretation of computer evidence is a specialist discipline. Once the suspect has been confronted with evidence of wrongdoing, the IT department should be notified so that the employee's computer resources can be deactivated immediately, including remote access email or database accounts.

When investigating a press leak or any suspected malpractice it is always necessary to obtain professional advice to ensure proposed tactics and techniques are legal. Evidence obtained using illegal methods may be inadmissible and may expose the victim organisation to litigation, prosecution, regulatory censure and adverse publicity.

Investigators have a distinct advantage when investigating a press leak – the journalist or newspaper that has published or broadcast a story will often reveal significant clues as to its sources.

Trained investigators will break down the offending report into its constituent paragraphs or components. The investigator would then analyse the text to examine various aspects of the story, for instance, whether the statements made are substantively correct or inaccurate, or whether restricted information known only to a few has been revealed (thus narrowing the number of potential sources).

The investigator would then construct an information set, showing the entirety of the information that the journalist used to construct his story. This would be cross-referenced against all of the internal documents, memoranda, emails and other information necessary to compile the story.

At this point, a distribution matrix is prepared. By using such a matrix, it possible to identify the employees most likely to possess, or have access to, the information set.

Contextual analysis, information and distribution matrices help to sharpen the focus of the enquiry, but they should not dictate our actions to the exclusion of other possible explanations. The possession of, or access to, confidential information which has leaked does not automatically infer guilt. Instead, the methods shown identify where leaked information may originate or currently reside, so as to expedite the forensic analysis of specific data storage devices to determine whether there is any indication of unauthorised access, disclosure or transmission of confidential information.

In the UK, companies must comply with the Regulation of Investigatory Powers Act and the directives of the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 (RIPA).

RIPA provides a framework with which companies must comply when monitoring electronic data processing equipment and telecommunications. This legislation entitles an organisation to monitor systems owned and operated by the company, such as computers, networks and telephones. Data collated may then be produced as evidence in disciplinary hearings, civil proceedings, criminal prosecutions or to resolve disputes. Recordings and monitoring may also be made for regulatory purposes, in arbitration, for quality control, for training and other purposes that an organisation deems necessary.

RIPA imposes a number of expectations and stipulations, summarised briefly here:

. monitoring may only take place on privately-operated data or telecommunications networks. It is necessary, therefore, clearly to delineate the boundary between the public telephone system and any private network that interfaces with it;

. monitoring may only take place with the express authority of the lawful owner and operator of the private network;

. reasonable steps must be made to inform employees and users that the organisation's communication systems and networks are subject to monitoring. Preferably, this should be stipulated in the employment contract; and

. monitoring should take place for a specified purpose: to establish facts necessary for the conduct of the business; to prevent or detect crime; or to detect unauthorised use (or misuse) of a system.

Broad brush monitoring of the workforce for no specific purpose clearly constitutes a transgression. There is also an expectation that monitoring should be proportionate to the intensity and gravity of the misdemeanour being investigated. It is important, therefore, that a company policy permitting the monitoring of company data processing and communications systems is in place prior to any investigation commencing.

Data protection, privacy law and human rights statutes will all affect any proposed investigative methods. In the European Union, a host of rules and regulations apply in the areas of data protection, personal privacy and workplace monitoring and surveillance, all of which need to be accounted for and reflected in the employment policy. Article eight of the Human Rights Act 1998, for example, governs the employ-ee's expectation of privacy, including his correspondence, while article 10 provides a "right to receive and impart ideas without interference". This is a complex area of law with relatively little precedent yet set – expert legal guidance is clearly a must.

All evidence must be gathered and preserved in accordance with best practice. Evidence should be processed according to criminal prosecution standards to ensure its admissibility. In the UK, computer evidence will accord with the Association of Chief Police Officers Guidelines on Rules of Evidence for Computer Based Crime. If no local expertise is available, computer forensic special-ists should be retained immediately.

The victims of damaging leaks often seek overly complex and contrived technical explanations for them. Victims often suspect that they are being bugged, that their telephones are tapped or that their firewalls have been subjected to sophisticated computer hacking, when, in fact, the leak has occurred due to prosaic failures in the control of documentation, waste disposal, fax machines, electronic mail or employee vetting procedures. The simplest explanation is often the correct one. However, as the story of Hewlett Packard illustrates, the investigation of press leaks can be a hazardous business, and invariably is so where the techniques and methods deployed are ill-considered, or transgress ethical or legal boundaries.

Edward Wilding is a co-director at DGI (Data Genetics International).