Legal Issues in Covert Operations

Overview
Covert operations are among the most powerful tools available to a fraud examiner, but they are also among the most legally hazardous. In the ACFE Fraud Examiners Manual, this topic sits within the Investigation section under Covert Operations, alongside undercover operations, surveillance, and the use of sources and informants. The CFE exam tests whether you understand not just how to conduct a covert operation, but when it is lawful and justified to do so, how to protect the organization from liability, and how to avoid destroying the evidentiary value of what you collect.

Why This Topic Is Important
A covert operation, by definition, is conducted without the knowledge of the subject. That secrecy creates a collision between the investigator's need for information and the subject's legal rights, including privacy, protection from entrapment, freedom from trespass and unlawful recording, and labor-law protections. If a fraud examiner gets the legal issues wrong, several bad outcomes follow:
- Evidence may be suppressed or rendered useless in court.
- The organization and the examiner personally may face civil suits for invasion of privacy, defamation, false imprisonment, intentional infliction of emotional distress, or wrongful termination.
- Criminal liability can attach to the examiner for illegal interception of communications, impersonation of officials, or pretexting prohibited by statute.
- The subject may successfully assert an entrapment defense.
- The operation may be exposed, endangering operatives and damaging the organization's reputation.
For these reasons, the Fraud Examiners Manual stresses that covert techniques should be used only after other investigative methods have been considered and only when properly authorized, documented, and legally reviewed. The exam repeatedly tests this cautious, last-resort posture.

What Covert Operations Are
Covert operations fall into two principal categories:
1. Undercover operations: an operative (often posing as an employee, vendor, or customer) gathers information while concealing his or her true identity and purpose.
2. Surveillance: the secretive, continuous, and sometimes periodic observation of persons, places, and things to obtain information about the identities or activities of subjects. Surveillance may be fixed (stationary, often called a stakeout), moving (tailing on foot or by vehicle), or electronic (video, audio, GPS, computer monitoring).
Both techniques raise overlapping legal concerns, but each also has its own specific traps that the exam likes to probe.

The Core Legal Issues You Must Know

1. Justification and the Written Authorization Memorandum
Before any covert operation begins, the fraud examiner should prepare a memorandum that documents the basis for the operation. The Fraud Examiners Manual lists what this memorandum should contain:
- The information upon which the investigation is predicated (the reasons the operation is necessary).
- The information expected to be gained from the operation.
- The identities of suspects, if known.
- The operatives who will be under the examiner's direction.
The memorandum should be reviewed and approved by management and legal counsel. Its purpose is twofold: to show that there was a legitimate business reason and a reasonable, good-faith basis for the operation (which defends against later claims of harassment or discrimination), and to create a record demonstrating that the operation was controlled and lawful from the outset. Exam questions frequently ask what belongs in this memorandum or why it is needed.

2. Entrapment
Entrapment occurs when a person is induced by a government agent to commit a crime that he or she was not otherwise predisposed to commit. Two elements matter: (a) inducement by the agent, and (b) lack of predisposition in the subject. Merely providing an opportunity to commit a crime that the subject was already inclined to commit is not entrapment.
Key exam nuance: In most jurisdictions, entrapment is a defense against government action. A purely private investigator who is not acting at the direction of law enforcement generally cannot be the basis of an entrapment defense. However, if the private examiner is working at the direction of, or jointly with, law enforcement, the examiner may be treated as a government agent, and entrapment (and constitutional search restrictions) can apply. Even where entrapment is not technically available, an undercover operative who encourages or instigates misconduct undermines the credibility of the case, exposes the organization to civil claims, and may violate professional ethics. The safe rule: operatives observe and record; they do not suggest, encourage, or facilitate wrongdoing.

3. Operatives Must Not Participate in Illegal Acts
Undercover operatives should never commit crimes to maintain their cover. If they do, the examiner and the organization may share liability, and the operative's testimony loses credibility. Operatives should also be instructed on how to handle situations where they witness crimes in progress or threats of harm, and they should have a clear line of communication to the examiner. The manual also warns that operatives should not be given latitude to improvise beyond their instructions; the examiner must maintain control.

4. Privacy and the Reasonable Expectation of Privacy
Surveillance is lawful when it occurs in places where the subject has no reasonable expectation of privacy, such as public streets, parking lots, open work areas, and public portions of a business. It becomes unlawful and tortious when it intrudes into areas where privacy is expected: homes, restrooms, locker rooms, changing areas, and private offices in some circumstances. The relevant civil torts include intrusion upon seclusion, public disclosure of private facts, and false light. Employers can reduce privacy expectations in the workplace through clear written policies and notices stating that premises, systems, and communications may be monitored, but even then certain areas remain off limits.

5. Trespass
Investigators may not enter private property without authorization to conduct surveillance. Observing from a public vantage point is acceptable; entering a fenced yard, a private building, or a vehicle is not. Peering into a residence with enhancement devices from a location where the naked eye could not see may also be treated as an intrusion.

6. Interception and Recording of Communications
This is one of the most heavily tested areas. Video surveillance without audio is generally far less legally restricted than audio recording. Audio interception is governed by wiretap and electronic communications statutes. In the United States, federal law (Title III and the Electronic Communications Privacy Act) follows a one-party consent rule: a conversation may be recorded if at least one participant consents. A number of states, however, require all-party (sometimes called two-party) consent. Secretly recording a conversation to which the investigator is not a party, with no participant's consent, is generally a crime. Interception of emails and stored electronic communications is governed by additional rules, with exceptions for employer-owned systems where employees have been given notice and have consented, and for the ordinary course of business. Because the CFE exam is international, remember the principle rather than a single country's statute: always determine the consent and notice requirements of the applicable jurisdiction before recording any communication.

7. Labor and Employment Law
Surveillance of employees engaged in protected union or collective activity is an unfair labor practice under laws such as the U.S. National Labor Relations Act. Covert operations should never be aimed at, or give the appearance of targeting, lawful organizing or protected concerted activity. Also consider anti-discrimination laws: if a covert operation singles out employees of a protected class without a documented, legitimate basis, the memorandum of justification becomes the organization's primary defense.

8. Pretexting and Misrepresentation
Covert work often involves pretexts (assumed identities or false reasons for a contact). Pretexting is not automatically unlawful, but it is prohibited in specific contexts: impersonating a law enforcement officer or government official is a crime; using false pretenses to obtain customer financial information from a financial institution is prohibited (for example, under the Gramm-Leach-Bliley Act in the United States); and obtaining telephone records by pretext is similarly prohibited in many jurisdictions. Pretexts that cause the subject to disclose privileged information (such as communications with an attorney) create additional problems. The examiner should never use a pretext that involves posing as a licensed professional, a government agent, or a representative of the subject's bank, and should never use pretext to obtain information that is legally protected.

9. Defamation, False Imprisonment, and Emotional Distress
Information gathered covertly must be handled with care. Sharing unproven accusations with people who have no need to know can constitute defamation. Detaining a subject at the conclusion of an operation without legal authority can constitute false imprisonment. Extreme or outrageous conduct by operatives, such as prolonged harassment under cover, can support a claim of intentional infliction of emotional distress. Confining disclosures to those with a legitimate need to know and avoiding any physical restraint of the subject are standard safeguards.

10. Sources and Informants
When covert operations rely on confidential sources or informants, legal issues include confidentiality promises (which the examiner may not be able to keep if litigation ensues), payments to informants (which must be documented and should never be contingent on the outcome of the case), and the informant's own exposure to liability. Informant information should be independently corroborated, and informants should be identified in internal records by a code or symbol with the true identity kept in a secure, limited-access file.

11. Operatives in the Workplace: Termination Risk
If an undercover operative is placed as an employee, the organization should consider how the operative will be removed at the end of the operation and whether the operative's employment status creates any obligations. Operatives should keep contemporaneous, detailed notes of everything observed, because their notes and reports may become evidence and will be scrutinized for signs of inducement or bias.

How a Legally Sound Covert Operation Works in Practice
Step 1: Determine that conventional methods (document review, interviews, data analysis) cannot reasonably obtain the needed information.
Step 2: Prepare the authorization memorandum covering predication, expected information, known suspects, and operatives.
Step 3: Obtain approval from management and legal counsel; confirm the laws on recording, privacy, labor relations, and pretexting in the relevant jurisdiction.
Step 4: Select and brief operatives; prohibit participation in crimes and any encouragement of wrongdoing; establish reporting and emergency procedures.
Step 5: Conduct the operation with contemporaneous documentation, preserving chain of custody for any evidence obtained.
Step 6: Terminate the operation when objectives are met, when cover is compromised, when legal problems arise, or when continuing would require unlawful conduct.
Step 7: Restrict dissemination of results to those with a need to know; coordinate with counsel before any confrontation, termination, or referral to law enforcement.

Exam Tips: Answering Questions on Legal Issues in Covert Operations

Tip 1 - Remember the last-resort principle. If a question asks when covert operations are appropriate, the best answer almost always reflects that they should be used only when other investigative techniques are impractical or have failed, and only with a legitimate reason and proper authorization. Options suggesting covert methods as a routine first step are wrong.

Tip 2 - Memorize the four elements of the authorization memorandum. Predication (the information the investigation is based on), expected information to be gained, identities of suspects if known, and the operatives under the examiner's direction. Questions may ask which item does NOT belong; the distractor is often something like a budget estimate or a list of charges to be filed.

Tip 3 - Entrapment requires inducement plus lack of predisposition. Simply offering an opportunity is not entrapment. Also remember that entrapment is generally a defense only against government agents, but a private examiner working with law enforcement can become a government agent. If a question describes an operative who suggests, pressures, or supplies the means for a crime, the issue being tested is entrapment or improper inducement.

Tip 4 - Video is safer than audio. When a question contrasts recording methods, silent video surveillance in non-private areas is the least legally risky; audio recording triggers wiretap and consent laws. Know the difference between one-party and all-party consent rules and that the stricter rule applies when parties are in different jurisdictions.

Tip 5 - Location determines privacy. Public areas and open workplaces generally carry no reasonable expectation of privacy; restrooms, locker rooms, changing areas, and homes do. Any answer choice that places a camera in a restroom or locker room is wrong, regardless of the justification offered.

Tip 6 - Operatives never commit crimes. If an answer choice allows an undercover operative to participate in illegal activity to preserve cover, eliminate it.

Tip 7 - Watch for labor-law traps. A scenario involving employees discussing a union, wages, or working conditions signals an unfair labor practice issue; surveillance of that activity is prohibited.

Tip 8 - Pretexting has bright lines. Never impersonate law enforcement or a government official, and never use false pretenses to obtain financial account information or phone records. If a pretext targets a bank or telephone carrier, the answer is that it is unlawful.

Tip 9 - Think about civil liability, not just criminal law. Many questions are really asking you to identify a tort: intrusion into a private place (invasion of privacy), spreading unproven accusations (defamation), holding someone against their will (false imprisonment). Match the facts to the tort.

Tip 10 - Beware absolute language. Answer choices containing words like always, never, or in all cases are usually distractors in this area, because the manual repeatedly emphasizes that laws vary by jurisdiction and that counsel should be consulted. The best answer typically involves documentation, authorization, legal review, and restraint.

Tip 11 - Know when to stop. Questions on terminating an operation test whether you recognize that compromise of cover, legal problems, or achievement of objectives are each valid reasons to end it, and that continuing an operation that now requires unlawful conduct is never acceptable.

Quick Review Checklist
- Covert operations are a last resort, supported by a written, approved memorandum.
- Entrapment: inducement plus no predisposition; chiefly a government-agent issue, but private examiners acting with police can be swept in.
- Operatives observe; they do not instigate or participate in crimes.
- Privacy depends on the reasonable expectation of privacy in the location.
- Audio recording and electronic interception are governed by consent laws; video without audio is lower risk.
- Never trespass, impersonate officials, or pretext for financial or telephone records.
- Do not surveil protected labor activity.
- Limit disclosure of results to those with a need to know to avoid defamation.
- Document everything contemporaneously and involve legal counsel throughout.

Master these principles and you will be able to handle virtually any CFE exam question on the legal issues surrounding covert operations, whether it is framed as a definition, a best-practice scenario, or an identify-the-violation fact pattern.