A bad investigation does not stay with the investigator. The liability travels. When an investigator cuts corners, lets confirmation bias drive conclusions, misidentifies a subject, or overstates what the evidence actually supports, the legal exposure attaches to every person and institution that acted on those findings: the organization that commissioned the work, the attorney who filed the motion grounded in it, the HR department that terminated someone based on it, the nonprofit that published it. Bad investigation methodology is not just an embarrassment. It is a liability event with a long chain of recipients — and the people at the end of that chain rarely knew the investigation was defective until someone challenged it in court.
Failure Mode One: Confirmation Bias and the Investigation That Was Over Before It Started
Confirmation bias is the most common way investigations fail, and the hardest to catch from inside the investigation because it feels like rigor. The investigator has a strong hypothesis. They are thorough. They document extensively. They produce a findings memo that is dense with evidence. The problem is that every piece of evidence in the memo points in the same direction — because that was the direction the investigator was looking.
What is missing from a confirmation-biased investigation is never visible in the findings memo itself. The missing material is what was not pursued, what was found and set aside, what was characterized in a way that obscured its actual evidentiary weight. The investigator does not write “I found this contradicting evidence and chose not to include it.” They simply do not include it. The findings look complete. They are not complete.
When every piece of evidence in an investigation report points toward the same conclusion, that uniformity is itself a signal that the investigation may be biased. Real situations generate mixed evidence — some that supports a hypothesis, some that complicates it, some that points in a different direction entirely. An investigation that produces zero contradicting evidence should be treated as a methodology concern, not a confirmation of the conclusion. Adversarial review of that investigation will find what was not included. It always does.
The liability risk materializes the moment the organization acts on the biased findings. The employee who is terminated, the vendor whose contract is cancelled, the individual whose complaint is filed — each of those actions is a decision point that will be tested against the quality of the investigation that supported it. When the investigation is tested and found to be confirmation-biased, the action does not stand on its own merits. It stands on the merits of a process that was defective from the start.
Every investigation conducted for litigation purposes, employment action, regulatory complaint, or institutional decision will eventually be reviewed by someone whose job is to find its weaknesses. That person is paid to find what the investigator excluded, mischaracterized, or overweighted. If the investigator did not do that review themselves — before the findings were finalized — they left it for the opposing side to do. The opposing side is not going to be gentle about it.
Failure Mode Two: Misidentification and the Wrong Target
Misidentification is not primarily a digital problem. It is a methodology problem that digital research environments make catastrophically easy to trigger. Similar names, shared usernames, recycled profile images, account name changes, and impersonation accounts are common features of online research environments. An investigator who does not apply rigorous identity verification at every step of the research process will, at some point, attribute conduct to the wrong person.
The consequences of that error do not scale with the severity of the underlying conduct alleged. A misidentification that results in a filed complaint, a published report, an employment action, or a court filing against the wrong person creates the same liability regardless of how serious the wrongly attributed conduct was. The wrong person is the wrong person. The investigation failed. Everyone who acted on it owns that failure.
An investigation that attributes conduct to an incorrectly identified subject, and on which an organization acts, creates simultaneous exposure for defamation, wrongful termination, malicious prosecution, and — if the findings were incorporated into sworn filings — perjury or fraud. None of those exposure categories require the organization to have known the identification was wrong. Negligent misidentification carries liability. The standard is not whether the investigator intended to identify the wrong person. It is whether a reasonable investigator applying a defensible methodology would have caught the error before acting on it.
Digital identity verification requires more than a name match or a profile image match. It requires corroboration from at least two independent authoritative sources that confirm the subject’s identity with specificity — legal name, verifiable employment, documented physical location, government record. A social media profile, a username match, or a screenshot is not identity verification. It is a data point that requires verification. The investigator who treats it as a conclusion has skipped the most critical step in the process.
The identity verification requirement does not disappear because a target appears repeatedly in a set of search results, or because their name is distinctive, or because the investigator is confident. Confidence is not a methodology. Corroboration from independent authoritative sources is a methodology. Every identity attribution in a findings memo should be traceable to those corroborating sources. If it is not, the identification is not established — it is asserted.
Failure Mode Three: Overstating Conclusions and the Sworn Filing Problem
Every investigation eventually produces language that describes what the evidence shows. That language is either precise or it is not. The difference between “the records indicate a pattern consistent with” and “the records establish that” is not a stylistic preference — it is an evidentiary claim that will be tested. When investigation findings are incorporated into sworn filings, every word in those findings becomes a sworn statement. A conclusion that exceeds what the evidence supports is a false statement in the context of a sworn filing, regardless of the investigator’s confidence or intent.
Investigators and the attorneys who rely on their work frequently face pressure — from clients, from timelines, from the adversarial context itself — to state conclusions more forcefully than the evidence warrants. “Suggests” becomes “demonstrates.” “Consistent with” becomes “proves.” “We found no evidence that” becomes an affirmative claim about the absence of something the investigation did not comprehensively search for. Each of these formulation choices is a risk decision. In a sworn filing, each of them is a potential false statement claim waiting for the opposing side to find the gap between the language and the record.
The evidentiary overreach problem is compounded when the findings memo passes through multiple hands before reaching a sworn filing. The investigator writes findings. An analyst summarizes them. An attorney incorporates the summary into a declaration. Each step in that chain is an opportunity for the language to drift further from what the underlying evidence actually supports. By the time a judge reviews the sworn filing, the original investigative record and the sworn statement describing it may bear only a family resemblance to each other.
A sworn filing that overstates what the underlying investigation supports is not just a weak filing. It is a sanctions exposure under MCR 2.114 in Michigan state court and Rule 11 in federal practice. Courts are not required to assume good faith when a party files sworn claims that a cursory review of the underlying record would have shown were unsupported. The attorney who signed the filing has personal sanctions exposure. The client who authorized it has cost exposure. The investigator whose findings were used to build the overreaching claim has professional exposure. Everyone in the chain gets a share of the problem.
Failure Mode Four: OSINT Without Methodology Is Not Investigation
Open source intelligence has transformed investigative practice. The volume of publicly available information — court records, social media, corporate filings, property records, campaign finance disclosures, professional license databases — that can be assembled about any individual or institution in a short period of time is genuinely significant. The tools available to research that information are powerful and accessible. The result is that a great deal of “investigation” is being conducted that is actually something else: systematic collection of unverified data points that is then presented as investigative findings.
OSINT collection is research. It is a valuable and legitimate starting point. It is not the investigation. The investigation is what happens after the collection: independent verification of every material claim against an authoritative source, corroboration from records that are not themselves derived from the same primary source, documentation of what was searched and not found alongside what was found, and explicit scoping of every conclusion to what the verified evidence actually supports.
An organization that receives an OSINT research report and treats it as a completed investigation has not received an investigation. It has received a research memo that may or may not be accurate, that has not been verified against authoritative sources, and that may attribute information to a misidentified subject. Every decision made in reliance on that memo carries the full liability of a decision made without adequate investigation — because that is exactly what it is. The sophistication of the collection tools used to produce the memo does not change the verification gap. It may actually make it worse, because the volume and apparent comprehensiveness of the data creates a false sense of evidentiary sufficiency.
Independent verification means confirmation from a source that did not produce the original data point and is not derived from the same primary record. A social media post verified against another social media post from the same account is not independent verification — it is the same source appearing twice. Verification requires a different record type: a government database, an employment record, a court filing, a professional license, a financial disclosure. If an OSINT data point cannot be independently verified from an authoritative source, it is not a finding. It is a hypothesis that requires further investigation.
A defensible investigation documents the negative space as well as the positive findings. What databases were queried and returned no relevant results. What time periods were outside the scope of the search. What categories of records were unavailable. What questions the investigation could not answer with the evidence available. This documentation is not a weakness in the findings — it is proof that the investigator understood the evidentiary limits of their own work. An investigation that claims comprehensive findings without documenting any evidentiary limits is claiming more than any real investigation can deliver. Courts notice that.
Every conclusion in a findings memo should include an explicit statement of the evidentiary basis: the specific records that support it, the specific time period they cover, and the specific claim they support. “The evidence shows X” should be written as “Records A, B, and C, covering the period from [date] to [date], are consistent with X. The investigation did not locate records that would independently establish Y.” That formulation is less rhetorically powerful than an unqualified assertion. It is also the formulation that survives adversarial review without creating perjury exposure for whoever signs a sworn filing that incorporates it.
Case Study: When the Investigation Became the Problem
The subject of this case study is a coordinated effort to investigate and discredit a journalist through simultaneous proceedings in multiple legal forums. The investigators and their institutional backers had access to a significant volume of digital data about the target. They had attorney involvement from the early stages. They had organizational resources. By every surface measure, this looked like a serious investigation with serious backing.
It failed every standard that determines whether an investigation is defensible. And everyone who acted on it ended up holding liability they did not anticipate.
The cumulative result of these four failures was a set of sworn filings in multiple forums that could be comprehensively contradicted by public records obtainable in a single afternoon. The investigation had not just failed — it had created a documented, source-cited liability record for every institutional actor who had authorized, funded, or relied on it. The target did not have to prove anything was false. She had to document what was already in the record. The record did the work.
The lesson is not that the investigators were uniquely incompetent. The lesson is that each of these failures is a predictable consequence of skipping the verification steps that defensible investigation requires. Each one could have been caught before any sworn filing was made. None of them were caught, because no one ran the adversarial review that would have found them — before the target did.
What Defensible Investigation Actually Requires
Defensible investigation is not a higher standard than what most investigators claim to apply. It is a documented standard — one where the process is as auditable as the findings. The difference between an investigation that holds up and one that doesn’t is rarely the quality of the underlying data. It is whether the methodology was explicit, whether verification was independent, whether the conclusions were scoped precisely, and whether the investigator ran the adversarial review themselves before the other side did.
A findings memo without a documented methodology is not an investigation report. It is a conclusions document. What databases were queried, in what sequence, covering what time periods, using what search parameters — that is the investigation. It needs to be in the record. If the methodology cannot be reconstructed from the documentation, the findings cannot be defended. An opposing attorney who asks “how did you reach this conclusion” and gets “I searched and found it” has already found the weakness they need.
Before any findings are finalized for use in a sworn filing, employment action, or institutional decision, run the review that an opposing attorney would run. Ask: what is the strongest argument against each of these conclusions? What evidence that I found complicates the conclusion? What evidence that I did not find would, if it existed, undermine the conclusion? What would happen to this finding if the identity attribution were wrong? That review — conducted internally, before the findings are acted upon — is the single most effective way to catch the failures that create liability downstream.
No conduct should be attributed to any individual in a findings memo without independent verification of identity from at least two authoritative sources that are not derived from the same primary record. This standard is not optional when the findings will be used in any context that could result in adverse action against the named individual. The verification documentation — the specific records used to confirm identity, with access dates and source citations — should appear in the findings memo alongside the identity attribution. If it is not there, the identification is not established.
I have been on the receiving end of every failure mode described in this piece. I have had sworn service affidavits contradicted by my own payroll records. I have had a witness presented against me who does not exist in any verifiable public record. I have had sworn representations about the status of formal complaints that a two-minute database search disproved. I have had a proceeding filed against me in apparent violation of a federal automatic stay that rendered every order entered in it void before the first hearing was held.
None of it held up. Not because I had superior legal resources — I was pro se, under financial duress, managing a doctoral program and a bankruptcy plan simultaneously. It held up because I know how to pull records, compare them against sworn statements, and build a documented contradiction map that no one can dismiss as opinion.
What I also know, from having been through this, is that the investigation failures that targeted me were not unique. They are the predictable output of investigators and institutional actors who skipped the verification steps, let confirmation bias drive the process, and bet that the target would not know what to look for. That bet fails every time someone actually looks. The question for your organization — or your opposing party’s organization — is whether you find the failures before or after they become a liability event in your docket.
I can help you find them first.
Sources and Documentation
Rita Williams, How Investigations Go Wrong and Create Liability: The Methodology Failures That Expose Investigators, Organizations, and Their Clients, Clutch Justice (May 6, 2026), https://clutchjustice.com/2026/05/06/how-investigations-go-wrong-create-liability/.
Williams, R. (2026, May 6). How investigations go wrong and create liability: The methodology failures that expose investigators, organizations, and their clients. Clutch Justice. https://clutchjustice.com/2026/05/06/how-investigations-go-wrong-create-liability/
Williams, Rita. “How Investigations Go Wrong and Create Liability: The Methodology Failures That Expose Investigators, Organizations, and Their Clients.” Clutch Justice, 6 May 2026, clutchjustice.com/2026/05/06/how-investigations-go-wrong-create-liability/.
Williams, Rita. “How Investigations Go Wrong and Create Liability: The Methodology Failures That Expose Investigators, Organizations, and Their Clients.” Clutch Justice, May 6, 2026. https://clutchjustice.com/2026/05/06/how-investigations-go-wrong-create-liability/.
