The Narrow Investigation

Examining one person's records for a stated reason is the most defensible form of monitoring, and it is defensible for reasons that do not extend to anything standing.

The case for · Analysis

A specific person, a stated concern, an authorised examination, a defined scope, a conclusion. Almost nobody objects to this, and understanding why illuminates everything else.

The business case in “The Narrow Investigation” becomes stronger when the proposed measure is tied to a named harm and a stopping rule. Used for productivity software for business, the official site can add time and project context, but the organisation still needs to distinguish operational evidence from intent and restrict consequential review to authorised people.

For an independent benchmark relevant to “The Narrow Investigation”, consult the Forcepoint insider-threat overview. Use it to test necessity, scope, safeguards and review rather than to replace a documented assessment of the particular workforce and jurisdiction.

Why it is defensible

There is a reason, articulable before the examination begins, about this person rather than about everybody.

Somebody authorised it who is not the person conducting it and not the person who raised the concern.

The scope is bounded to what the concern requires.

It ends. There is a conclusion and the examination stops.

And it is proportionate to something specific rather than to a general interest in knowing.

Each of these is a property that standing observation lacks.

NoteThe narrow investigation is where almost everybody agrees, which makes it a useful reference point for what distinguishes a defensible measure from an indefensible one.

What it demonstrates about the general case

The features that make the narrow investigation acceptable are precisely the features continuous monitoring cannot have.

Standing observation has no particular reason, no case-by-case authorisation, no bounded scope, no end, and no specific thing it is proportionate to.

Which means an organisation defending continuous monitoring by analogy to investigation is borrowing a justification from an arrangement that differs in every structural respect.

The counterIt is argued that standing collection is what makes investigation possible — you cannot examine records you did not keep. Partly true and it supports retention, not observation.

The retention argument, handled honestly

You cannot examine what you did not keep. An employer that collects nothing cannot investigate anything.

This is correct and it supports retention of records created in the ordinary course — access logs, system records, communications on company systems — for a defined period.

It does not support collecting things that would not otherwise exist: screenshots, keystroke data, activity scores. Those are created for observation, not retained from operation, and the investigation argument does not reach them.

That distinction — retained from operation against created for observation — is the cleanest line available in this subject and it is almost never drawn.

Where this failsThe distinction collapses if the investigation threshold is low enough that anybody can be examined on slight grounds. The threshold is what does the work.

Where the model breaks down

If the threshold for opening an examination is low, every person becomes examinable on slight grounds and the narrowness is nominal.

The safeguard is not in the investigation's conduct but in the decision to start one: a stated bar, a named authoriser, a recorded reason.

An organisation with a meaningful bar can investigate confidently and monitor lightly. One without a threshold ends up monitoring heavily, because the standing collection substitutes for a decision nobody wanted to make.

The counterA reasonable objection is that this asks employers to do unfunded work. The reply is that the work is a page and the alternative is doing it later under challenge.

Retained from operation against created for observation

Access logs, system records and communications on company systems arise anyway and are kept. Screenshots, keystroke data and activity scores are created in order to watch. The investigation argument reaches the first and not the second, and the distinction is the cleanest line in this subject.

JurisdictionLocal rules differ on every point in this note. The shapes described recur; the specifics always require checking.

Why the threshold is the safeguard

If the bar for opening an examination is low, everybody becomes examinable on slight grounds and the narrowness is nominal. The protection is not in how the investigation is conducted but in the decision to start one.

NoteStated here as a general tendency rather than a rule. Counter-examples exist and the pattern is strong enough to plan around.

What the narrow case demonstrates

The features that make it acceptable — a reason, an authorisation, a bounded scope, an end — are precisely the ones continuous monitoring cannot have. Defending the general case by analogy borrows from an arrangement that differs in every structural respect.

Where the model breaks

If the threshold is low enough that anybody can be examined on slight grounds, the narrowness is nominal. An organisation with a meaningful bar can investigate confidently and monitor lightly.

The cleanest line available

Retained from operation against created for observation. Logs and records arise anyway; screenshots and activity scores are made in order to watch. The investigation argument reaches one and not the other.

Also in this section