What the Police should have done

The Police Complaints Authority is investigating the adequacy of the Police investigation into the Don Brash e-mails. As far as one can tell from the released file, the Police did nothing beyond chatting to half a dozen people.

From what I can tell, there was no forensic examination of the evidence – something that should have been the first step taken by the Police. What do I mean by this – I mean an investigation of what actual documents Nicky Hager gained a copy of.

Hager helpfully supplied around 1,000 references in his 350 page book. The very first step of a semi-competent investigation would be to examine the documents referenced. Here is what I would have done:

1. Compile a masterlist of every document referenced in Hager’s book
2. Sort them into groups – e-mails, faxes, etc
3. For the e-mails record down when each e-mail was received, and when it was deleted if it was. This will provide a window of time as to when the theft occured.
4. Also for each e-mail record who has access to it. Who was cc’d or bcc’d it. Who had access to a printed copy.
5. Look for common patterns in access, to try and narrow down which e-mail account or accounts were probably accessed
6. Look at the date of the final document used in the book. It is likely the theft took place soon after that.
7. Obtain staff lists for National during that period. Look especially at anyone who joined just before the thefts occurred.
8. Obtain swipe card records for the Leader’s Office for the period just after the final documents cited.

I’m not saying this would work out who did it. I’m saying this is the minimum first steps you would expect in a competent investigation – work out what documents were stolen, work out who had access to them, work out whether they were in electronic form or also existed in hard copy, and work out when they were probably stolen. This is basic stuff.

By failing to do this the investigation was, in my opinion, doomed to fail, Asking half a dozen people whether or not they will tell them who gave them the e-mails was never going to find anything. A proper detailed forensic approach to the investigation could well have led somewhere, or even provided clarity as to whether the theft came about from a one off access to someone’s inbox, or whether it was more systematic than that.

I am going to be very interested in the report and findings of the Police Complaints Authority.