Field Evidence, Not Field Analysis

When a desk investigation reaches the limit of what filings can tell you, the next step is the physical world. Somebody goes and looks. A facility either exists at the address or it does not; a registry either holds a document or it does not.

The instruction that goes out with that task is narrower than people expect, and the narrowness is the design:

Collect the evidence. Do not analyse it.

The person in the field is told what to obtain and where. They are not told what the case is about, what the hypothesis is, or what a given finding would mean. Analysis and collection are kept mutually exclusive — not as a workflow preference, but as a structural rule about who is allowed to know what.

Why the collector must not know the thesis #

Two reasons, and the second is the one that matters legally.

The first is contamination. A collector who knows the hypothesis is a collector with an expectation, and expectations shape what gets photographed, which questions get asked, and — most damagingly — what gets judged not worth recording. An observation that undercuts the thesis is exactly the observation most likely to be quietly dropped by someone who knows the thesis. If they don’t know it, they can’t shade the record toward it. The absence of context is the control.

The second: an evidence collector who is not analysing is not forming an opinion on a public company. That distinction is not cosmetic. Someone who visits a site and records what they see is documenting facts. Someone who visits a site and concludes what it means about a listed issuer has done something categorically different, with a different set of obligations attached. Keeping the roles separate keeps the activity on the right side of that line, for everybody involved.

So the dispatch instruction contains a location, a list of items, and a standard of capture. It does not contain the company’s role in the investigation.

The evidence store is a different building #

Material coming back from the field goes into a repository that is physically separate from everything else we run. Not a schema, not a permissions boundary within the main system — a separate store, with its own access path and its own retention regime.

There are two independent reasons, and either alone would justify it.

Immutability has to be enforced by the storage layer. Evidence whose integrity depends on nobody having write access is evidence whose integrity depends on a configuration. We use write-once retention: for the retention period, the object cannot be modified or deleted by anyone, including the account that created it, including an administrator. Not “we don’t overwrite it” — the delete does not succeed. That property has to live in the storage layer, because any layer above it is a layer that can be reconfigured.

Contamination runs both ways. A single store holding both operational data and evidence has two failure modes. Evidence could be altered by a process that had no business touching it — the obvious one. But the reverse is worse and less discussed: routine operational material drifting into a repository that is under legal-hold rules, where it will sit for years because it cannot be deleted. Both failures come from proximity. Separate buildings solve both.

There is a rule we enforce in the data layer as a consequence: any path that writes evidence has its destination prefix constrained by a check on the write itself. A misdirected write fails at insert rather than landing somewhere it will never come out of. We wrote that after noticing that the only thing preventing an application-layer bug from putting an ordinary document into permanent legal-hold storage was that nobody had written the bug yet.

Custody is a record, not a claim #

Each item carries a chain: who collected it, when, where, under what dispatch, who handled it after, and a content hash computed at the moment of intake. The hash is the anchor — an item whose hash no longer matches is not “possibly modified,” it is out of the chain, and that is a determination the system makes rather than a person.

The chain is append-only in the same sense as the evidence: entries are added, never edited. When a handling record is wrong, the correction is a new entry that says so. The original stays visible with its correction attached.

This is the same discipline we apply to our own published record — nothing is silently rewritten — and it costs the same thing here that it costs there. A mistake is permanently visible. That is the point. An evidence log that can be tidied is an evidence log whose current state proves nothing about what was actually recorded at the time.

What this buys, and what it costs #

The cost is real and worth stating. Collectors work without context, which means they occasionally miss something that a briefed observer would have caught. Separate storage means separate operations, separate access review, separate everything. Write-once retention means storage we cannot reclaim, including for material that turned out to be uninteresting.

What it buys is that when a finding is challenged, the answer is not our word. It is a record that shows the thing was collected before anyone had formed a view, by someone who did not know what it would be used to argue, into a store where it could not have been adjusted afterwards.

Evidence that can be edited is testimony. We would rather have evidence.

All figures are system-level results current as of publication date; methodology parameters are intentionally omitted.