Article: The Psychology of a Business Owner’s Self-Incrimination: Searches, Questioning and ‘Wiretapping’

In criminal proceedings against a business, the conduct of the person involved may be an important source of evidence. Transcripts of telephone conversations, behaviour during a search and during questioning at the initial stage of the pre-trial investigation carry significant weight in determining the future course of the case.

The behavioural patterns and habitual managerial reflexes of a company director, when brought within the scope of criminal proceedings, become additional information which the investigation records and uses in conjunction with other evidence.

In the practice of corporate defence, the three classic points of contact with the investigation — covert investigative (surveillance) activities, searches and questioning — constitute three acts of a single psychological drama. In each of them, the same cognitive shift comes into play: a top manager or owner, accustomed to being ‘the smartest person in the room’, systematically underestimates the law enforcement system and overestimates their own control over the situation or their own emotions.

Act One: The Trap of the Illusion of Privacy

The term ‘white-collar crime’ was introduced into academic discourse by the American criminologist Edwin Sutherland. In December 1939, he delivered his famous presidential address, ‘The White-Collar Criminal’, the proceedings of which were published the following year in the *American Sociological Review*.

Subsequently, his follower Donald Cressey developed this tradition of crime research and became one of the authors of the conceptual framework for what is today known as the ‘fraud triangle’: pressure/motive, opportunity and rationalisation.

It is precisely rationalisation — the inner need to explain to oneself that an unlawful act is acceptable, temporary, compelled or ‘in line with market rules’ — that explains why the materials in the files on covert investigative (search) actions almost never contain an outright confession to a crime. Instead, they almost always contain euphemisms and Aesopian language. For the suspect, this is a psychological defence mechanism and an attempt at concealment; for the investigator and prosecutor, it may be one of the circumstances indicating that the individual was aware of the unlawful nature of their actions.

In other words, rationalisation helps to understand why, in the suspect’s statements, unlawful behaviour is often described not as a crime, but through euphemisms, justifications and neutral phrasing.

Pre-trial investigation measures (in particular, the seizure of information from electronic communications networks, and audio and video surveillance of the individual) constitute the most dangerous stage. At the time these measures are carried out, the individual is usually completely unaware that criminal proceedings are even underway.

Typical habits that give the game away during covert investigative (search) actions:

• Pseudo-conspiracy. Phrases such as ‘you know who I’m talking about’, ‘let’s sort this out as usual’, ‘just don’t ring here – ring the other number’ do not protect against prosecution. When taken together with other evidence in the case (funds transfer records, seized documents), the investigation often establishes the true meaning of such communications. The sudden appearance in one’s vocabulary of vague phrases that are unnatural in everyday conversation may be a direct indicator that the topic under discussion is ‘sensitive’.  Moreover, euphemisms and veiled language may take on evidential significance when considered alongside other materials in the proceedings, provided that their meaning and intent can be reasonably established from the context.
• Trust in ‘secure’ communication channels. A telephone conversation via a closed messaging app, an encrypted chat or internal corporate email is perceived as a private space. The scheme is discussed in the same businesslike tone as the supply of raw materials. It is precisely this matter-of-fact tone that may be one of the circumstances the court takes into account when assessing whether the defendant’s actions were systematic rather than random.
• A particularly risky mistake is discussing rumours of possible interest from the police, the Security Service of Ukraine (SBU) or the National Anti-Corruption Bureau of Ukraine (NABU) via those very same communication channels: ‘It seems they’re onto us; we need to wipe the servers.’ This is a circumstance that the pre-trial investigation authority may use as an argument to substantiate the intent to destroy evidence, and subsequently as a basis for the investigating judge when deciding on the imposition of a preventive measure.
• Discussing sensitive matters in the presence of staff (drivers, secretaries, personal security guards). The procedural status of these individuals is not considered in advance, although they are the most accessible source of evidence for the investigator: there are no procedural restrictions on their questioning. They recount the details of conversations directly and candidly, as they may not have realised their significance at the time of observation.

Act Two: the search as a stress test of self-control

A search differs from a covert (or covert-like) operation in that it involves real-time stress, in full view of investigators, witnesses and the suspect’s own staff. In forensic science and legal psychology, tell-tale signs during a search are divided into physical and behavioural.

Physical tell-tale signs are what are known as ‘negative circumstances’. An investigator is not simply looking for an object or a document — they pay attention to any disruption in the uniformity of the environment. These may include freshly painted surfaces, a mismatch in the wallpaper pattern, the absence of dust on individual folders in a dusty archive, the presence of a safe not recorded in the documents, or fresh marks where screws have been unscrewed on computer towers.

A telling modern example of this very logic is the discovery of an empty box from a newer model of smartphone, whilst the temporarily seized property contains only the previous model, and the newer device itself is not found either in the office or in the possession of other parties to the proceedings. This is not evidence of the concealment or destruction of information, but a classic negative circumstance: the documentary trail – the box, serial number, warranty card – indicates the existence of an item that is not, in fact, where it ought to be. The explanation may be entirely mundane—the gadget was sold, sent for repair or given away as a present. However, when questions about its whereabouts are asked suddenly during a search, this forces a person to improvise on the spot, which may reveal to the investigator their true knowledge of the matter or an attempt to conceal the device.

Such behavioural signs are described in legal psychology through the concept of ‘protective zones’. The owner of the property may subconsciously create a space of heightened internal anxiety around the hiding place of important items. When an investigator approaches this zone, it sometimes triggers physiological reactions that are virtually beyond conscious control: changes in skin colour, increased sweating, trembling hands, a dry mouth and selective reactions: calm behaviour throughout the three-hour search suddenly gives way to acute anxiety when the operative approaches a specific cabinet or safe.

This list also includes outwardly visible reactions, such as an involuntary glance towards a hiding place or a bag containing ‘sensitive’ documents precisely at the moment when the investigator’s attention is focused elsewhere.

It should be noted at the outset that this is a forensic observation, not a verified psychophysiological method. Such reactions may attract the investigator’s attention and influence the direction of the search, but do not in themselves establish any fact and cannot have independent evidential or legal significance.

Typical psychological errors during a search:

• Manipulation of equipment. Attempts, in the first few minutes of the search, to switch off a mobile phone, reset it to factory settings, hide a USB stick or hand it over to a secretary. From a forensic perspective, this is not a means of saving data, but a clear indication of the direction of the search. The very fact of such actions is recorded in the search report or on video and is regarded as an incriminating act.
• Underestimating the digital footprint. Attempts to break or hide a physical storage device are pointless in the age of cloud technology. Seized devices are sent for computer forensic analysis: the mere deletion of files does not guarantee the destruction of the digital trail, and the possibility and completeness of their recovery depend on specific technical conditions — the type of storage medium, the file system, the method of deletion, encryption, and the presence of cloud synchronisation.
• ‘Active assistance’ and demonstrative openness. The business owner begins to open ‘unnecessary’ cupboards of their own accord and produce documents that are not relevant to the investigating judge’s search warrant. This narrows the scope of the search and hints to the investigators exactly where the critically important materials are located.
• Excessive willingness to hand over ‘part’ of the evidence. A casual and hasty response such as: ‘Here, these are all the documents relating to the contractor; there’s nothing else’ is often a signal to an experienced investigator that the most critical part of the information remains undiscovered.

Another telling example of behavioural tell-tale signs is the striking ‘sterility’ of the workplace. Investigators enter the office: in most offices, everything looks ordinary — documents on desks, coffee cups, open browser tabs, but one particular employee is sitting at an almost empty desk, their laptop switched off or freshly restarted, the screen locked, and no paper notes in sight.

In itself, a tidy workplace does not prove anything — for some people, it is simply a habit. But the stark contrast with the usual working clutter of colleagues, especially when combined with the device having been freshly restarted just as the investigation team entered, may attract attention as a circumstance warranting further clarification. Again, this is not evidence in itself, but a reason to ask a specific question during questioning — and here, as in other cases, the cost of an improvised answer is considerably higher than that of silence.

I would note that, generally speaking, the safest and most procedurally sound approach is one of passive observation. The manager and staff must act according to a pre-rehearsed script: verifying the investigating judge’s order, recording the details provided by the investigation team and witnesses, immediately engaging an attorney, and refusing to give any oral explanations or comments whilst the search is taking place.

Act Three: Interrogation, or why improvisation is more costly than silence

Interrogation is the only one of the three stages where a person consciously chooses what to say. Legal psychology describes two categories of tell-tale signs of false testimony — paralinguistic and non-verbal. Although none of these signs is an independent and reliable indicator of a lie, an experienced investigator may take note of them as grounds for further verification of the account.

Paralinguistic signs include: a noticeable change in the pace and volume of speech (people who are lying often involuntarily switch to a softer and higher-pitched voice), mumbling, changes in the tone and rhythm of breathing, excessive friendliness or exaggerated, unnatural deference towards the investigator. Also indicative are tangential remarks that appear unrelated to the case: complaints about discomfort, stuffiness or the temperature in the room; claims of a lack of time; as well as sudden accusations or outbursts directed at the investigator — a typical tactic for changing the subject.

Non-verbal signs include involuntary physiological reactions — twitching of the facial muscles, sweating on the forehead, blushing, irregular breathing, a dry mouth, as well as body language: a gaze directed to the side or downwards, unconsciously touching the eyelid or ear, crossed arms, and a discrepancy between facial expressions and words (a smile appearing only after a statement has been made). Researchers specialising in polygraph methods add to this list prolonged pauses or, conversely, suspiciously quick responses, and an overly prolonged display of emotion, which is rarely genuine.

However, inconsistencies in the content of a person’s testimony can be far more revealing than a single glance, gesture or change in tone. During questioning, attention should be paid first and foremost to how the very structure of the answer changes: avoidance of specifics where they are objectively possible; a sudden shift from brief answers to excessive detail; the introduction of new circumstances not present in the previous account; contradictions between answers to the same questions posed in different ways; and changes in the chronological sequence of events. It is precisely this dynamic that can be far more revealing than a nervous gesture or the direction of a person’s gaze, as it provides the investigator with material to verify a specific version of events and to cross-check the testimony against other evidence.

So what tactical techniques, designed to exploit the psychological vulnerabilities of the person being questioned, might an investigator employ?

First and foremost, this involves creating the illusion of being fully informed. The investigator asks questions as if they already know everything down to the smallest detail, asking the person being questioned merely to ‘confirm the formalities’.

Secondly — going into detail and re-questioning. Returning to seemingly neutral, minor details after a certain period of time. If the story is fabricated, the person being questioned becomes confused about details that were not previously established in their imagined narrative.

And, of course, the presentation of decisive evidence at the moment of exhaustion. The investigator allows the person being questioned to set out their version of events in detail, after which they present substantial evidence (for example, a police report, an outgoing email or a signed document) that contradicts what has been said. This makes it significantly more difficult for the person being questioned to present a coherent account of their version of events and increases the risk of contradictions in subsequent statements.

Business owners are accustomed to resolving problems through negotiation. During questioning, they often perceive the investigator as a partner or opponent in negotiations who can be persuaded. This is a fundamental mistake, as the investigator’s role within criminal proceedings is to establish the circumstances of the criminal offence and record them properly, not to understand your business model.

The well-known constitutional right not to incriminate oneself is often perceived by entrepreneurs as an admission of guilt or a sign of weakness. This is a psychological barrier that must be overcome even before the first interview.

The safest approach during an interview is structured restraint: exercising the right not to incriminate oneself until having consulted an attorney; providing explanations strictly within the limits of a pre-agreed position; refraining from improvising even when a question seems simple; and presenting information concisely.

It is worth recalling a quote popularised by Dave Grossman in his book *On Combat* and often cited at US Navy SEALs training centres: ‘Under stress, you do not rise to the level of your expectations — you fall to the level of your training.’

If one strips away the procedural formalities from emergency response, search and interrogation, what remains at the core is one and the same psychological mechanism: rationalising one’s actions and overestimating one’s own influence can lead to self-incrimination. This is not a question of ‘reading’ a person, but of what their behaviour actually leaves behind in the case file.

At the initial search and seizure stage, the habit of treating working communication channels as private and using veiled hints is a pitfall. During a search, the desire to direct the process and control the investigative team is counterproductive. During questioning, the habit of trying to persuade and explain, rather than maintaining procedural silence, proves fatal.

The main practical conclusion for senior management and business owners is not to study a list of ‘tips for during a search’. It is about building a system of legal security long before the first official contact with the investigation: communication etiquette, cybersecurity, having clear, well-rehearsed instructions for staff, and the realisation that, in the context of criminal proceedings, the only way to safeguard one’s position is not through personal charisma, but through strict adherence to a procedural protocol agreed with an attorney.

Read the article on the Yurydychna Gazeta website: here.