OMH 2021: Online i offline, czyli jak gromadzić dowody po incydencie (...)

This presentation emphasizes the critical importance of combining online and offline investigation methods when gathering evidence after corporate incidents, particularly data theft by departing employees. The speaker, a lawyer specializing in criminal and competition law, argues against the growing trend of limiting investigations solely to digital sources.

The context begins with COVID-19's acceleration of digitalization and remote work, which has led investigative practices to focus increasingly on internet-based activities. However, the speaker warns this is insufficient. Traditional intelligence sources—physical documents, media, specialized literature, and administrative databases—remain essential. A concrete example is Poland's National Court Registry (Krajowy Rejestr Sądowy), where physical courthouse records contain far more detailed information than online versions, including shareholder correspondence and management challenges unavailable digitally.

The central case involved a high-level employee departing with sensitive company data. This represents a common problem in Polish corporate environments: departing senior employees often leave "with the benefits of inventory"—removing client databases, product information, business solutions, and strategic plans. Contributing factors included poorly drafted non-compete clauses difficult to enforce in labor court, inadequate equipment tracking, and insufficient system access controls.

The investigation employed three integrated methods. Standard detective work involved interviews and field observations to document office layouts, access points, and the employee's activities. Forensic IT analysis examined devices, networks, logs, and mobile devices, revealing significant data access activity preceding departure. Active OSINT gathered information through pretext contact with interested parties.

A crucial discovery emerged when comparing online and offline sources: the competing company's court registry records revealed the employee's new employment before this information appeared online—a lag of weeks to months between actual events and digital availability. Physical courthouse visits proved essential, as investigators found evidence that would have been missed relying solely on internet sources.

Through targeted OSINT, investigators confirmed the employee had already provided proprietary information to the competitor. When the client reviewed findings, he inadvertently disclosed data only he should possess, effectively confirming the planned and intentional nature of the departure.

The investigation revealed systemic organizational weaknesses: poor equipment control, unclear IT asset responsibility, and indicators that multiple employees were preparing departures, suggesting cultural issues beyond the single incident.

The speaker emphasizes continuous coordination between investigators and clients—requiring direct phone contact with decision-makers, not email-only communication. Data from all three investigation channels must be analyzed and verified in real-time to avoid wasteful dead-end pursuits.

The final report synthesized evidence from physical fieldwork, digital forensics, and OSINT, providing comprehensive assessment. While the legal team could evaluate whether materials indicated probable criminal activity under unfair competition laws, they presented only data, analysis, and suggestions—never imposing judgment or influencing client decisions on further legal action. In many cases clients pursue court proceedings; others do not.

The conclusion stresses that cyber security professionals must not limit work exclusively to digital sources. Complete investigative pictures require understanding the physical world: even individuals with minimal internet presence have footprints in physical space, financial records, and administrative systems. Holistic approaches combining online and offline methods produce superior results to isolated methodologies.