Banner background texture

Case Study - Undercover Infiltration

White curve graphic
Wednesday 14th November, 2018 | Author: Peter Farrington [Member (F/1297)] | Filed under: Case studies

“Expect the unexpected”

Over the years I have planned and implemented many undercover infiltration operations. The background to them is usually the same – that there is dishonesty and malpractice taking place inside a workplace to such an extent that significant losses are occurring or serious disruption is taking place to the business operation and, more often than not, reputations are at risk because of it.

Recently, while discussing a particular problem, a fellow ABI member said to me that as investigators we should also expect the unexpected. The wild card so to speak.

This is never truer than in proactive work. I have encountered many surprises in covert surveillance operations during my careers in law enforcement and latterly in the private sector but the biggest and most significant have occurred in the course of undercover infiltration operations.

I clearly cannot enlarge on the operational strategies of such operations and their day-to-day tactics but clearly, they work to a plan that has, in itself, sub plans and options. That plan, naturally, is devised from information available and a degree of suspicion. Following and exploring theories.

Undercover investigations, in my opinion, are the hardest of all to conduct and are highly unpredictable. Experience and training have helped me enormously in this field but there is no getting away from it – there is always a surprise in store.

I will now detail a small handful of the surprises that I have encountered and how that influenced the cases, we were investigating.


Our operative was experienced and skilled in this line of work. He had been inserted into a workforce dealing with aspects of logistics. In order to sustain a presence there for the duration of the operation I had carefully considered all aspects of his introduction to cover all bases. Tried and tested routines had been implemented. This included a detailed briefing with the client that covered the essential need to be covert.

Around day three or four our operative was aggressively confronted by some of the workforce and directly accused of being ‘a plant’. This was astonishing as we had never had this occur in any previous investigation and there was no reason to believe that we had made an error of some kind. The operative was able to resist the accusations and remain on site a few days longer but by then he was effectively lame.

Again, without disclosing our techniques, we managed to extract our operative without, as far as we were concerned, giving rise to any further suspicion.

I was concerned by the way, a particular manager had handled this situation so I chose to exclude him from further dialogue with far more senior officers of the company. This led to establishing another means of infiltrating the workforce and we rapidly deployed a second undercover operative.

The work force were quite buoyant about uncovering ‘a plant’ and were very willing to boast about it … to our operative. This is how we discovered that the general manager was having an affair with the lady clerk in the site office and how he had told her all about ‘his’ great plan to insert an undercover man. However, what he did not know was that her cousin was one of the workforce. He was something of a scoundrel and she knew it. The clerk chose to tip her cousin off and in doing so, placed our operative in serious danger.

It all ended well from our point of view because our second operative secured sufficient evidence against the scoundrel cousin and his pals to enable the company to dispense with their services without fear of any form of recourse or publicity, which was their preference at the outset.

The tail wags the dog

We were called in to a warehousing environment because theft was taking place and performance was poor during certain times. When a particular shift was working.

In this case, we knew that the workforce was very tightly knit and militant in some respects. We devised a strategy to launch our operative without any suspicion and this worked well.

At an earlier stage of the investigation, the shift manager had reported a number of incidents in which he had indicated there were squabbles among his team and that he wanted to break it up and separate particular individuals that he felt were troublemakers at work and would perform better if they were not together. His ideas conflicted with other information and would have led to disruption across other shifts that seemed to function well. The manager, himself, was well regarded by senior managers.

Our operative went on to witness stealing taking place openly. Staff would go off site for long periods unchallenged; some would sleep, some would fool around. The work was carried out by a handful of diligent people and the manager.

This, however, was not just poor management. Our operative discovered that some months earlier, the manager had allowed a card school to take place on site. This snowballed into a nightly event and then, in no time at all, the manager became indebted through gambling to his subordinates. They simply began to disobey him and each time he attempted to enforce his rank upon them they simply referred to his debt. He knew that he could not raise this with senior managers as would face serious disciplinary action. Instead, he hoped he could repay the debts or win his money back. He had failed to see that he would never get there as he was being cheated.

In that case, I had to carefully explain to the senior management that the manager was trapped and that he would be a powerful witness if they could allow him to fall on his sword and provide a route to recovery. Between us, by creating an illusion, we carefully devised a way to protect the manager while we tackled the serious offenders.

The thieves and shirkers were dealt with and eventually the manager was reintroduced to the workforce.

Danger at work

We had infiltrated another huge warehouse operation exploring significant theft and an element of political activism, which stood to potentially embarrass the company. One particular individual was heavily involved with an extreme group and was known by local press to be employed at the company site. The first surprise, a mere aside in this case, was that the individual resigned on the very day we began the operation and all the careful planning and research we had carried out in respect of that person was redundant.

We then concentrated on the thefts, working alongside the thieves in the warehouse.

After a couple of days we were astonished to find a race taking place around a circuit set out by the staff.

The race concerned forklift trucks, going as fast as the drivers could make them with their forks raised. They were cheered on by everyone present.

In that case, we had to ask the management to intervene at our first opportunity. The investigation was suspended because numerous staff members were suspended because of their involvement in the race. While this was not ideal in terms of the investigation, we explained to the management that we had a duty to alert them to the dangerous practice and that we could not withhold the information to a more convenient moment because the risk of serious injury or fatality was real. Similarly, once we had reported the matter (which was clearly a regular event) then the company had to act.

As it happens, some staff were dismissed because of this event and it became noticeable that their departure signalled the end of ‘shrinkage’ at the warehouse.

Information is power – guard it

Another warehouse deployment brought us to a huge site with a mezzanine floor. On that floor were the ‘bosses’ offices from which management could view the warehouse activity in daytime. During the night they were empty and the night shift worked on.

In accordance with our strategy, the undercover operative had befriended a particular suspect who, in the dead of night, invited him to the mezzanine floor. For the purpose of the story, I’ll call him Billy. Once there, outside the office of a very senior manager, Billy produced a key from his pocket and opened the door before stepping in and beckoning our man to follow. In they went. Billy rummaged about in the office, reading papers, examining diaries and rotas. Then, he fired up the personal computer on the desk. He entered the password, which he had discovered another time because it was in a little book labelled ‘passwords’ in the unlocked drawer of the desk.

To the great amusement of Billy, he set about reading confidential emails and altering various documents. This included records of stock on site.

Once again, we had to act fast. To keep the investigation going we had to stage the long term sickness of the red faced manager whose office it was and replace him with a temporary manager drafted in from a sister site. That enabled the natural change of lock and password which Billy accepted as bad luck.

As the information contained on the system had been compromised and it was known to be unreliable, an immediate audit was necessary to determine the extent of the problem.

A number of thieves were identified and dismissed from the business and the initial objective was met. The problem of information security had never been considered and was, in the end, a far greater issue than the original concerns.

Two problems in one

We deployed to a major warehousing facility with a direct home delivery sales facility. Many of the items offered were high value and it was clearly being stolen by various means. Our brief was review the procedures within the operation and to identify any offenders with evidence.

The senior management consulted with their counterparts in the security company which was, itself, a major name and advised them that they would terminate their contract unless they allowed me to deploy an operative into their workforce. Reluctantly, they agreed and accepted they would need to contribute towards the cost.

On that occasion, despite having two operatives within the site we did not succeed in establishing the precise identity of the thieves beyond hearsay evidence. We did, however, establish the loopholes in the security arrangements and identify shoddy practices and poor performances. Altogether, this was sufficient to allow our client to take steps to stop thefts recurring. One of the unexpected things I have come to expect is that we will not always succeed on every aspect of every case.

Eggs in one basket

Our operative spotted a manager loading a 7.5 tonne lorry with a pallet of high value goods and driving off with it. He returned later without the pallet and hung up the lorry keys in the office.

There was no record of the pallet being moved, there was no record made of the driver of the lorry and no reason for the manager to have touched the lorry or the pallet.

I was able to examine the vehicle’s tachograph and establish where the lorry had been to. To the site of our client’s customer. It later transpired that this had been a ‘cash deal’ between the manager and the customer although the customer’s position as far as mens rea was never established.

During the course of that operation, around 7 / 8 thieves were identified with evidence. My client accepted that this was probably the tip of the iceberg but wanted to conclude the operation at that stage. My client opted that the suspects all be interviewed by my colleague and me, on tape and under caution. Although none of the suspects was arrested and we were clearly no longer police officers, we set out to follow police practice and invite the suspects to have a representative with them during the interview. A trade union was consulted.

I set out a ‘batting order’ of suspects to tackle and was then stunned by my client that insisted we did not interview his manager. I explained very carefully that we had ample evidence to secure a conviction against him and that, as a manager, he was arguably a more serious offender. My client was adamant that he was not to face action and then confessed that the reason for this was “ He’s the only one that can work the computer system “.

It was clear that if this man left the company, it would suffer in the absence of his skills and knowledge. My client, knowing their man was a thief, was prepared to accept that within the ‘bigger picture’. I bowed to their wishes.

What really grated on me though was the same man became the observer / advisor in each of the suspect interviews.

A lot more risky than we thought

We deployed an operative into a busy warehousing operation. Very quickly, the operative became part of a group of workmates and began to socialise outside work. This led to us gathering information about the criminality at work very quickly. Theft was taking place with stock stolen to order.

The bunch of workmates invited our operative to watch their local semi-professional football team one Saturday afternoon. It was at that point that he discovered he was actually among a group of organised football hooligans. Some of them were already subject to football banning orders and bail conditions. Nevertheless, they were planning to travel into Europe to watch a series of England football matches and do battle, by prior arrangement with other hooligans.

While this presented a serious risk, it also helped us dealing with police, as we were able to present quality intelligence to them and work with them behind the scenes. That was certainly a big help at the later stages of the operation when arrests were made in connection with the thefts.

And finally …

The operative in the above case used the pseudonym ‘Kev’. At the time of the arrests, ‘Kev’ appeared to slip the net. The thieves were arrested and later charged.

During one of the interviews one of them was very cocky towards the interviewing police officer and adopted a mocking tone in which he unexpectedly said “ You’ll never get Kev – he is way too clever for you lot “

Article submitted by Peter Farrington – Full Member F/1297 of Farrington Legal Services. See here for further info: