INTELLIGENCE EXCHANGE TRAINING

MAORCA's Comprehensive Approach to Combatting ORC

This training is designed to provide you with essential knowledge on the roles, responsibilities, and legal boundaries when private investigators work alongside law enforcement agencies.

By the end of this training, you'll have a clearer understanding of best practices, legal considerations, and strategies to maintain the integrity of investigations while respecting legal and ethical boundaries. Let's get started!

Section 1: What is the Intelligence Exchange?

  • ✔ Facilitate Intelligence Sharing – Serve as a centralized hub for real-time data exchange, trend analysis, and suspect tracking between private sector investigators and law enforcement.

    ✔ Coordinate Investigations – Assist in multi-jurisdictional investigations by aligning private sector investigators with law enforcement to develop actionable leads and build stronger cases.

    ✔ Identify & Disrupt ORC Networks – Utilize data-driven analysis to map ORC groups, track fencing operations, and connect cases across agencies and retailers.

    ✔ Support Surveillance & Evidence Collection – Private sector investigators provide crucial intelligence, including video evidence, data,, and pattern analysis, to assist law enforcement operations.

    ✔ Enhance Public-Private Partnerships – Strengthen collaboration between private sector investigators and law enforcement agencies to ensure a unified approach to ORC.

    ✔ Organize Training & Information Sessions – Provide continuous education on evolving ORC tactics, fraud schemes, and investigative best practices through conferences, webinars, and in-person training.

    ✔ Engage in Legislative & Policy Advocacy – Work with stakeholders to improve ORC laws, increase penalties, and advocate for better enforcement strategies.

    • ❌ Grant Law Enforcement Cross-Jurisdictional Authority – The Intel. Exchange will not provide formal cross-designation for law enforcement officers to operate outside their respective jurisdictions. All investigative activities must comply with local, state, and federal legal boundaries. The Intel. Exchange will be designed to be made up of critical law enforcement members who if not are already granted jurisdictional power, will have a network within other jurisdictions to partner with.

      ❌ Operate Under Formal Intergovernmental Agreements (IGAs) or MOUs – Unlike traditional law enforcement task forces, this initiative will function as an informal but structured collaboration. There will be no binding agreements dictating agency participation.

      ❌ Conduct Arrests or Execute Warrants – While the Intel. Exchange will assist with intelligence gathering and coordination, only sworn law enforcement officers will have the authority to make arrests, conduct interviews, or execute search warrants.

      ❌ Replace Law Enforcement Investigations – The Intel. Exchange will support and enhance existing law enforcement investigations but will not assume the primary role of conducting them. Each participating agency will maintain full control over its investigations and case management.

      ❌ Share Proprietary Retail Data Without Proper Authorization – All data-sharing activities will comply with corporate policies, legal requirements, and law enforcement protocols. No confidential retail information will be disclosed without proper authorization.

Section 2: Sharing Private Information

  • Understand the legal and ethical considerations surrounding the sharing of confidential investigative information between private investigators and law enforcement.

    • Investigative reports, surveillance footage, case data, suspect information, and more.

    • Information obtained from law enforcement or other private investigators.

    • Victim Status: When a private investigator is the victim of a crime, limited disclosure may be allowed.

    • Need-to-Know Basis: Only share with high-level individuals directly involved in the case.

    • Publicly Available Information: If the details are already in the public domain, discussion is allowed.

    • Approval Requirements: Investigators should seek consensus from those involved in the investigation before sharing with those not involved, while also seek approval from the original source before sharing sensitive material or have the original source conduct the sharing (preferred).

    • Privacy Laws: Adhering to all federal and state privacy laws

      • Stored Communications Act (SCA) – Limits access to electronic communications held by third-party providers (e.g., social media messages, emails).

      • Electronic Communications Privacy Act (ECPA) – Prohibits unauthorized interception of electronic communications.

      • Health Insurance Portability and Accountability Act (HIPAA) – Regulates the sharing of medical information.

      • Fair Credit Reporting Act (FCRA) – Governs the collection and use of consumer credit information.

      • State Wiretapping Laws – Some states require all parties to consent to audio recording, while others require only one-party consent.

    • Confidentiality Agreements: The importance of NDAs and internal security policies.

      • Confidentiality agreements, such as Non-Disclosure Agreements (NDAs), are essential for protecting sensitive investigative information. These agreements prevent unauthorized sharing of case details, ensuring that intelligence remains secure and is only used for legitimate investigative purposes.

      • Why NDAs Matter:

        • Prevents unauthorized leaks that could compromise an investigation.

        • Protects trade secrets, client information, and investigative techniques.

        • Reduces legal liability if sensitive data is mishandled.

    • Internal Security Policies:

      • Restrict access to case files on a need-to-know basis.

      • Require encryption for electronic case files and secure storage for physical evidence.

    • Liability Risks: The consequences of improperly disclosing private information.

      • Sharing confidential details inappropriately can have severe legal and operational consequences, including:

        • Compromising an Investigation – If sensitive details become public, suspects may destroy evidence, flee, or change behavior to avoid detection.

        • Legal Liability – Unauthorized disclosure may violate privacy laws, NDAs, or company policies, leading to lawsuits or criminal charges.

        • Reputational Damage – Companies or investigators that mishandle information may lose credibility and face professional consequences.

    • Example: Misuse of Confidential Information
      A private investigator working for a retailer shares details of an organized retail crime investigation with a colleague in the same company. The colleague later interrogates a detained shoplifter and, in an attempt to gain credibility, references confidential details about the larger investigation. The shoplifter, realizing the company has deeper intelligence, alerts the crime ring leader. This leads to:

      • Destruction of evidence before law enforcement can act.

      • Retaliation against the investigator or company by the criminal group.

      • The case being dismissed due to compromised intelligence.

  • Use encrypted communication channels.

    • Why Encryption Matters:

      • Encryption converts data into a format that only authorized parties can read, which prevents hackers, criminals, or unauthorized individuals from accessing sensitive information, including case details, suspect data, or personal communications. This is especially important when sharing confidential investigative materials like emails, surveillance footage, or reports.

    • Types of Encrypted Channels:

      • Email Encryption: Use services like PGP (Pretty Good Privacy) or secure email platforms that automatically encrypt content.

      • Messaging Apps: Use encrypted messaging apps (e.g., Signal, WhatsApp) that provide end-to-end encryption to prevent anyone from intercepting the message.

      • File Sharing Platforms: Use secure file-sharing platforms that employ encryption, such as Google Drive with encryption, Dropbox Business or Auror, with access controlled by secure authentication methods.

    • Maintain documentation of all information shared and received.

  • When sharing information with private sector investigators, law enforcement personnel should follow these minimum guidelines:

    1. Departmental Compliance:

      • Officers should consult and comply with their agency’s policies on information sharing before disclosing any details to private sector investigators.

      • If unsure about what can be shared, officers should seek guidance from their supervisor or legal counsel.

    2. Publicly Accessible Information:

      • Only information that is publicly available or that can be legally obtained through a Freedom of Information Act (FOIA) or similar public records request should be shared.

      • Examples of public information include press releases, court filings, and publicly posted agency reports.

    3. Restrictions on Confidential and Investigative Materials:

      • Information obtained via a search warrant, subpoena, or other court order generally should not be shared unless it is already publicly accessible through court records or official agency disclosures.

      • Active investigative records, including suspect information, witness statements, and surveillance reports, should not be disclosed unless expressly permitted by law.

      • Internal law enforcement intelligence reports, classified or sensitive law enforcement bulletins, and inter-agency communications should remain confidential.

    4. Protection of Personally Identifiable Information (PII):

      • Officers should ensure that any shared information does not contain personally identifiable information (PII) such as Social Security numbers, dates of birth, driver’s license numbers, home addresses, or non-public criminal history.

      • If information is provided by or known by private sector investigators, sharing is generally permitted.

      • Exceptions should only be made in accordance with established legal processes and agency guidelines.

    5. Best Practices:

      • Before disclosing any information, assess whether sharing serves a legitimate investigative or public safety purpose and does not create unnecessary risk.

      • When sharing permissible information, it should be done through official and approved channels rather than personal communication methods (e.g., private email or messaging apps).

      • Have a case number available when making searches and providing information.

      • Often times sharing of information in a non-digital form can be permitted (orally, visually showing, etc.) – consult your department policy.

Section 3: Avoiding "State Actor" Status as a Private Investigator

  • Ensure private investigators and law enforcement understand the legal boundary between private investigations and state action to prevent constitutional violations.

    • Courts generally consider a private party to be a state actor if they:

      1. Act at the Direction or Under the Control of Law Enforcement

        • If law enforcement officers direct, instruct, or compel a private investigator to take certain actions, courts may find that the investigator was acting as an agent of the state.

      2. Perform Functions That Are Normally the Role of Law Enforcement

        • If a private investigator engages in activities that are typically reserved for police, such as detaining suspects at the sole direction of law enforcement, conducting interrogations for law enforcement, or executing searches without consent, courts may consider them a government actor.

        • Note: Private investigators may conduct lawfully allowed activities based on their company policies, such as detaining or interviewing a subject of an investigation where the company they represent is the victim

      3. Use Law Enforcement to Circumvent Legal Restrictions

        • If law enforcement asks a private investigator to do something they legally cannot do themselves (such as conducting a warrantless search), courts may see it as an attempt to evade constitutional protections.

        • Example: A police officer cannot lawfully search a suspect’s home without a warrant, so they tell a private investigator to do it instead. If the investigator does so, they may be considered a state actor.

  • 1. Maintain Independence from Law Enforcement

    • ✔ Conduct investigations based on company policies and business interests, not at the direct instruction of law enforcement.
      ✔ Never act on behalf of law enforcement—always operate within the normal course of private sector duties.

    2. Do Not Conduct Searches at Law Enforcement’s Request

    • ✔ Any search (e.g., bag checks, locker searches, or security footage reviews) should be conducted based on company policy, not because law enforcement asked for it.
      ✔ If law enforcement requests a search, direct them to obtain a warrant or subpoena.

    3. Avoid Detaining Individuals for Law Enforcement

    • ✔ Private security and retail investigators should only detain individuals when they have independent justification, such as observing a theft in progress.
      ✔ If law enforcement asks for help detaining someone, it is best to decline and let them handle it.
      ✔ Do not hold someone solely because law enforcement tells you to—this could create liability.

    4. Do Not Conduct Interviews or Interrogations for Law Enforcement

    • ✔ If a suspect is in custody by law enforcement, law enforcement should conduct interviews or interrogations. Retailers may be involved as long as law enforcement follows proper Miranda warning and department guidelines.
      ✔ Retail Investigators may interview a subject independent of law enforcement given they are doing so within the purview of their duties representing themselves as the investigator on behalf of the retailer

    • ✔ Do not give Miranda warnings—this can imply you are acting as law enforcement.

    5. Use Proper Channels for Information Sharing

    • ✔ Provide law enforcement with security footage, transaction logs, or case reports only as part of normal corporate policy, not at their request without proper documentation.
      ✔ Require subpoenas or legal requests when necessary to protect company and customer privacy.

    6. Clearly Document Investigative Justifications

    • ✔ Maintain detailed records explaining why an investigation was conducted.
      ✔ Document that any searches, detentions, or evidence collection were done independently, based on company policy—not law enforcement instructions.
      ✔ If an investigation started before law enforcement became involved, clearly establish the timeline to show no state-directed actions occurred.

    • Skinner v. Railway Labor Executives’ Association (1989) – Highlighted private entities acting under government compulsion.

    • United States v. Jacobsen (1984) – Allowed private searches if conducted independently.

Section 4: How Law Enforcement Can Use Private Sector Intel

  • Explain how law enforcement can properly use intelligence gathered by private investigators while ensuring admissibility and constitutional compliance.

  • Evidence must be lawfully obtained under standard investigative procedures.

    • Must not violate privacy laws (e.g., wiretapping laws, trespassing laws).

    • Should be handled with a proper chain of custody.

    Best Practices for Lawful Evidence Collection:
    ✔ Conduct surveillance only in public areas where there is no expectation of privacy.
    ✔ Obtain video footage through legitimate means (e.g., store security cameras).
    ✔ Collect statements from witnesses without coercion.
    ✔ Document all evidence collection processes to ensure transparency.

    Example:
    A private investigator legally records a suspect in a public parking lot using a long-range camera. Since there was no expectation of privacy, this video evidence is admissible in court. However, if the investigator had trespassed onto private property to capture the footage, it could be deemed illegally obtained and inadmissible.

    • Private investigators can serve as witnesses in court.

    • Certain investigative techniques are prohibited without proper authorization.

    Wiretapping Laws: Many states require two-party consent for recording phone conversations.
    Trespassing Laws: Investigators cannot enter private property without permission.
    Pretexting: Lying to obtain private records (e.g., pretending to be a customer to get financial data) is often illegal.

    Example:
    A private investigator records a suspect’s phone call without consent in a two-party consent state (e.g., California). Since this violates wiretapping laws, the recording is inadmissible and could lead to criminal charges.

    • Intelligence must be vetted for reliability and legality before being acted upon.

    • To maintain evidence integrity, private investigators must establish a clear chain of custody.

    ✔ Document Every Transfer – Record when evidence is collected, by whom, and how it is stored.
    ✔ Secure Storage – Use locked containers or tamper-proof digital logs.
    ✔ Limit Access – Only authorized personnel should handle evidence.

    Example:
    An Associate at a retail store recovers a laptop that was fraudulently returned. The Associate photographs the item, records the serial number, and secures it in a locked cabinet.

    Later, the ORC Investigator retrieves the laptop for further examination, noting the details in report of the investigation. The investigator inspects the item, confirms it matches known fraud patterns, and re-secures it.

    When law enforcement takes over the case, the ORC Investigator hands the laptop to a police detective, documenting the transfer in their reporting.

    Each step—collection, examination, and transfer—is logged, ensuring the evidence remains admissible in court.

  • ✔ Accept only information gathered legally and through independent private-sector investigations.
    ✔ Ensure the investigator did not act under law enforcement direction.
    ✔ Verify the chain of custody for any evidence provided.
    ✔ When in doubt, obtain proper warrants or subpoenas when necessary before acting on the intelligence.

    Understanding Private Investigators’ Job Duties

    Law enforcement can use private-sector intelligence if the investigator was acting within their normal job duties and collected the information lawfully.

    • Allowed: Surveillance in public spaces, background checks, interviews with consenting individuals.

    • Not Allowed: Conducting warrantless searches, impersonating law enforcement, coercing confessions.

     

    Example: Surveillance Within Job Duties
    A private investigator conducting surveillance for a corporate client follows a fraud suspect from the company’s property to a public street. Since this is within standard investigative duties, any evidence (photos, videos) gathered during this pursuit is admissible.

     

    When Obtaining Evidence from Private Investigators, Go to the Source

    Law enforcement should validate private investigator evidence by obtaining it directly from the original source whenever possible.

    Why?

    • Ensures authenticity and prevents tampering.

    • Strengthens admissibility in court.

    • Provides a complete record of the evidence.

    Example: Social Media Evidence
    A private investigator screenshots incriminating posts from a suspect’s private social media account. Instead of relying solely on the screenshots, law enforcement should:

    1. Obtain a warrant or subpoena for the social media platform.

    2. Retrieve official records directly from the provider.

    3. Cross-check the timestamps and metadata to confirm authenticity.

    This process ensures the evidence meets legal standards and is not dismissed in court due to authenticity concerns.

    • United States v. Payner (1980) – Addressed third-party evidence collection.

    • Burdeau v. McDowell (1921) – Established that law enforcement can use evidence collected by private actors without government involvement.

Section 5: General Intelligence Exchange Group Operations

  • The Intelligence Exchange Group will hold a monthly virtual meeting where investigators will present cases at different stages:

    1. Scoping Cases:

      • Investigators will provide an overview of known details and seek collaborators.

      • Discussions will focus on gathering additional intelligence and identifying interested parties for joint efforts.

    2. Open Cases:

      • Investigators will provide brief updates on active cases.

      • The objective is to expand the investigation and collect insights from the group regarding potential strategies and resources.

    3. Completed Cases:

      • Investigators will share strategies used and lessons learned from completed investigations.

      • This stage aims to improve collective knowledge and refine best practices for future cases.

    Guidelines for Monthly Calls:

    • Participants must come prepared and are encouraged to use the provided case template.

    • If not using the provided case template, case presentations must include at minimum:

      • Geographic scope

      • Financial impact

      • Modus operandi

      • Current developments and collaboration opportunities (completed and pending)

      • Known and unknown subject information

      • Corresponding documents

    • Case presentations must be submitted to the director organizing the meeting at least three days in advance.

    • The monthly meeting is not a forum for discussing all details of a case; in-depth discussions will be reserved for follow-up calls focused on individual investigations.

    • After the monthly meeting, separate investigation-specific calls will be scheduled as needed.

    • These follow-ups allow for deeper analysis and collaboration on particular cases.

  • To facilitate intelligence-sharing and collaboration, the following communication tools will be utilized:

    • Google Group: All members will be added to a Google Group to communicate with the entire network.

    • Email Communication: Investigators should expect general email communication among those involved in specific investigations.

    • Auror: This platform will be used for evidence sharing.

    • Telegram: This app will be used for general messaging within the group and is a good source for case specific text threads between investigators.

Acknowledgement