Evidence Over Intuition: Highlights from the Lecture at SB Club

On September 8, Ethicontrol co-founder Oleg Lagodienko delivered a lecture titled “Collection and Analysis of Evidence” at an SB Club training session on ISO 37008. We would like to draw your attention to the key points.

1. An Investigation Is About Building an Evidence-Based Case, Not Merely Finding the Truth

A fact, a hypothesis, and a judgment are three different things, and only the first should appear in the final report.

A fact is something that has already been established and does not require further proof: the date a company was registered, the amount of a payment, or the time a user logged into a system.

A hypothesis is a reasoned assumption that still needs to be verified: “They colluded because they studied together.”

A judgment (or assessment) is a subjective conclusion made by an observer: “He appeared to be drunk,” “the price was inflated,” or “she was aggressive.” Only facts should be included in the final investigation report; judgments and unverified hypotheses have no place there.

The distinction may seem obvious on paper, but in practice it is regularly blurred even by experienced professionals. “The test showed a blood alcohol concentration of 0.2‰” is a fact. “He came to work drunk” is a judgment unless that condition has been confirmed by a test. “Petrenko raised his voice and hit the table with his hand, and there are three witnesses” is a fact. “He is an aggressive person” is a judgment.

This distinction matters because courts and regulators assess facts supported by evidence, not the investigator’s impressions.

2. The standard of proof is chosen at the outset, rather than tailored to fit a predetermined conclusion

3. The right to search is no less important than what is found

Reading an employee’s corporate email is lawful if all seven of the following conditions are met: prior and clear notification of monitoring, understanding of its scope (traffic or the content of correspondence), a legitimate basis, minimal intrusion, proportionality of consequences, procedural safeguards (limited circle of individuals, access log), and the employee’s right to appeal.

The safest point of entry for any investigation is access logs, access control systems, ERP systems, and VPNs: this data pertains to the performance of work duties, not to private life.

Video surveillance is permissible if the camera records an area rather than specifically targeting a particular person (Supreme Court ruling in Case No. 759/4191/19).

An employee’s personal phone may be monitored only with voluntary written consent for a specific scope or through law enforcement agencies.

A hidden keylogger, screen-monitoring software, webcam, or microphone is not an investigative tool but a way to create a problem for yourself rather than gather evidence.

4. The most valuable evidence is lost in the first few days

A legal hold order specifies the basis, the subject matter (data, mailboxes, time period), the recipients by name, a specific action (stop rotation, prohibit reinstallation of equipment), and the duration.

Two common mistakes: a verbal order, after which IT says, “No one told me,” and a hold that is not lifted after the case is closed, causing the company to retain unnecessary personal data for years in violation of data protection laws.

5. Evidence has seven requirements and five levels of reliability

Before admitting evidence into the case, the following is verified:

• whether it pertains specifically to the fact under investigation (relevance);

• whether there is sufficient evidence to support a conclusion (sufficiency);

• whether the source is trustworthy and whether the data has been altered (reliability);

• whether it is truly what it appears to be and has remained unchanged since it was collected (authenticity and integrity);

• whether the fact is corroborated by independent sources (triangulation);

• whether another expert could replicate the analysis (reproducibility);

• whether there was a legal basis for collecting the data and whether any unnecessary data was collected (legality and proportionality).

An example of the last point: when investigating a complaint about a specific tender, correspondence is retrieved based on the tender dates and participants—not all email correspondence from the entire year.

There are five levels of evidence reliability:

• unverified statements and anonymous reports—the lowest;

• verbal explanations from employees without corroboration—low;

• documents created internally but corroborated by external evidence (a contract with a bank payment)—medium;

• documents from independent external sources—high;

• evidence obtained directly from a third party independent of the company (bank balance confirmation, external expert opinion)—the highest.

Conclusions should not be based solely on low-level evidence—cross-verification with evidence of another type is required.

When Expert Analysis Is Needed and Why a Polygraph Is Not Evidence

Even reliable evidence can be called into question if it is not backed by an expert assessment—such as an evaluation of a document’s authenticity, an examination of a digital medium, or an analytical or ethical compliance review (an assessment of an employee’s actions against the code of ethics must be conducted by someone not involved in the investigation itself).

Practical guideline: Expert analysis is needed first and foremost when a case may go to court—such as the termination of a top manager, reputational risk, or a report to a regulator. It’s also important to remember: a polygraph test is not evidence.

A person with the right skills can easily pass it without “triggering” the machine, so at best it is a supplementary tool for the process owner, not a basis for a conclusion.

6. Real-Life Ukrainian Cases

Case 1. Case No. 536/1109/19. The Supreme Court ruled that the dismissal of a manager was unlawful because the employer failed to specify the misconduct and, in effect, had the employee on the payroll without a clear description of the violation. An investigation was conducted—but without proper documentation of the facts, the court’s decision was overturned (sud.ua).

Case 2. Case No. 538/1991/23. An employee was terminated for absenteeism while working remotely. The Supreme Court defined the limits of evidence evaluation: a mere record of absence from the workplace is a document of moderate reliability (created internally by the company, not corroborated by external sources), and it is insufficient. Evidence of absenteeism should consist of connection logs to corporate systems that record the location of the connection—that is, precisely the “mix of evidence” mentioned above (sud.ua).

Case 3. A Viber screenshot as evidence. A Supreme Court ruling dated January 9, 2026 (Case No. 751/4083/24) recognized a Viber screenshot as valid evidence of an employee’s notification regarding the suspension of the employment contract. However, the decision was not based on the screenshot alone: the court evaluated it in conjunction with information regarding salary calculations, the prolonged absence of payments, and the employee’s inaction in defending their rights during that time. A single screenshot constitutes evidence of low or moderate reliability; when combined with other evidence, it is a different story (sud.ua).

What all three cases have in common is that the court never evaluates evidence in isolation. It looks at the totality—the triangulation of facts from various sources. That is precisely why a single piece of evidence, o

7. A screenshot is a statement. It is validated by its hash and the chain of custody.

The problem with most internal investigations is not a lack of evidence, but a lack of properly collected and documented evidence.

The classic chain: discovery → seizure → transfer → storage → use.

For each piece of evidence, it is important to record a unique identifier, who handled it, under what conditions it was copied or seized, and who had access to it.

This can be tracked in a simple spreadsheet—the key is that a specific person is responsible for maintaining the record, and access is restricted.

Five Takeaways for a Security Team Checklist

1. Only facts are included in the final report—there is no place for opinions or unverified hypotheses.
2. Set the standard of proof at the outset: if there is a risk that a top manager could be fired or that the case could be referred to law enforcement, raise the bar for proof immediately.
3. The legality of the evidence is just as important as the substance of the evidence—especially in the case of unpopular disciplinary decisions.
4. The most valuable evidence is lost in the first few days: digital traces last only a matter of hours, not weeks.
5. The absence of a conclusion is also a legitimate outcome of an investigation. A commission that always finds someone to blame is no longer about justice.

Frequently Asked Questions

How does a fact differ from a hypothesis?

A fact has already been established and is easy to verify (the date of the company’s registration, the payment amount). A hypothesis is an assumption that requires further verification and may be confirmed or refuted by new facts.

Is a screenshot of a conversation considered evidence in an internal investigation?

A screenshot alone is evidence of low or moderate reliability. Courts (in particular, the Supreme Court in Case No. 751/4083/24) recognize such evidence as admissible only in conjunction with other supporting evidence—such as server logs, payment data, and the parties’ conduct.

How long must digital evidence be preserved after an incident is detected?

The first 24–48 hours are critical: RAM data lasts only minutes, CCTV recordings are often overwritten within a few days, and firewall logs are frequently retained for only 3–10 days. Decisions regarding a legal hold and the preservation of logs should be made immediately during the planning stage of the investigation.

Is a polygraph result admissible as evidence?

No. A polygraph is not admissible as evidence in an internal investigation; a skilled individual can pass it without triggering an “alert.” It is, at most, a supplementary tool, and any conclusions drawn from it must be corroborated by other reliable evidence.