Internal and Corporate Investigations for General Counsel

E3 Legacy Intel runs internal and corporate investigations for general counsel, in-house legal teams, compliance officers and outside law firms nationwide. When something has gone wrong inside a company, or someone outside is attacking it, we identify who is behind it and preserve the proof. Counsel receives the findings as a written report and, where the matter needs one, a sworn declaration from a named, licensed examiner. E3 is a division of Southern Recon Agency, LLC, Florida licensed investigative agency A-1400197.

Most Cases Start as a Suspicion Inside the Company

Most matters reach the legal department as a feeling before they arrive as a fact. A payment that should not have left. An executive whose numbers stopped adding up. A file that walked out the door with a departing employee. An anonymous account attacking the company or its leadership. A vendor whose bank details changed the week a large invoice came due.

Each of these lands on counsel with the same problem attached. Suspicion proves nothing, and the people closest to the problem are often the wrong people to investigate it. Security tools report that something happened. Naming the person who did it takes an investigator. Internal teams know the organization too well to look at it without fear or favor. And whatever is found may end up in front of a board, an insurer, a regulator or a judge.

A licensed outside investigator closes that gap. We establish what happened and identify the people responsible where lawful means can establish identity. Every step is documented to the standard a court expects, so counsel decides the next move on evidence.

Counsel Directs the Work and Receives the Findings

When privilege matters, the usual structure is an attorney retained engagement. We work at the direction of counsel, in-house or outside, and our findings go to counsel. They are not circulated to the business at large. Whether privilege attaches in a particular matter is counsel's determination to make, and we build the engagement around the structure counsel chooses.

The work is quiet by design. Licensed investigators carry it out through lawful means, and only the people who engaged us see the results. When a matter could lead to an employment decision, the rules that govern that decision are built into the scope at the start, so nothing found becomes unusable later.

E3 is a licensed investigative firm. We are not a law firm and we give no legal advice. We deliver the facts and the evidence. Discipline, litigation, an insurance claim or a referral to law enforcement remain counsel's decisions.

Legal Departments Bring Us Seven Kinds of Matter

Insider Fraud and Sabotage Start With Someone Already Trusted

The person who does the most damage is usually the one already trusted with the keys. We follow the money and the messages wherever they lead, up the org chart or down it, and we document how the activity connects to a specific person. Data theft, intellectual property theft and insider misuse are worked the same way, preserved first and proven second. See our cyber crime investigations.

Payment Diversion and Business Email Compromise Leave a Trail to the Money

A vendor's bank details change and a large payment lands in a criminal account, or a payroll deposit is redirected. In some of these matters the mailbox was read for weeks before the fraudulent invoice arrived. These matters need a complete, detailed forensic review from an expert. There are no magic buttons. We reconstruct the compromise and establish whose account was breached. Then we work the two paths that produce results: identify the people responsible, and trace the money to where an attorney can move to freeze it. The loss is documented for the insurance carrier and for counsel. See business email compromise investigation, vendor invoice fraud investigation and payroll diversion fraud investigation. Where a matter turns to recovering the stolen funds themselves, that work sits with Southern Recon Agency, the licensed agency E3 is a division of, and we say so on the first call.

The Person Across the Table Gets Verified Before Anything Is Signed

Before a senior hire, an acquisition or a new counterparty, the legal department needs the truth about the person or company on the other side, verified by an investigator. We verify history, litigation and regulatory exposure, undisclosed interests and real ownership. See executive background investigations, due diligence investigations, M&A due diligence and investor and counterparty due diligence.

Behind Every Anonymous Attack Is a Real Person

Fake accounts, smear campaigns, impersonation of executives, extortion and fabricated media get aimed at the company or its leadership. We connect the anonymous activity to a real person and document the identification to a standard that supports a lawsuit, an injunction or a referral to law enforcement. See anonymous defendant identification, deepfake verification and digital executive protection.

Competitor Interference Gets Proven Back to Its Source

When a competitor's conduct is costing the company money it cannot explain, the question becomes who and how, proven. In one published matter, a coordinated click fraud campaign was draining more than $10,000 a week from a group of international travel agencies, routed through hundreds of IP addresses hidden behind international proxies. We traced a single click back to the browser behind it, and that browser tied directly to a competitor's system. Read it in $10,000 a Week in Click Fraud, Traced to a Competitor.

Leaked Product and Counterfeits Lead Back to the People Moving Them

Diverted product enters through someone with legitimate access. Counterfeits and organized retail crime are solved by following the goods back to the people moving them. See brand protection investigations and organized retail crime investigations.

Litigation Already Underway Needs Evidence That Holds Up

Once a matter is in suit, counsel needs witnesses found and vetted, the opposing party and its experts investigated, social media captured and authenticated, and an honest read on whether a win can be collected. See litigation intelligence, social media investigations for attorneys, OSINT investigations, asset intelligence and pre-litigation asset investigation.

Every Finding Is Built to Hold Up Under Oath

A finding that cannot survive cross examination is an opinion. Every engagement is built toward a record counsel can put in front of a board, a carrier, a regulator or a court.

• Named people, where lawful means establish identity, with the evidence that ties each one to the conduct.
• A dated timeline of what happened and how it was carried out.
• Preserved digital evidence, logs, accounts and communications, with chain of custody.
• A written report that states what the evidence shows and how it was obtained.
• A sworn declaration by a named, licensed investigator when the matter needs one.
• Testimony on the methodology where required.

Six Steps Carry a Matter From the First Call to Court Ready Evidence

1. Confidential consultation. A licensed examiner reads every inquiry. We say plainly whether investigation can help.
2. Written scope. Before any work starts, counsel receives a written scope stating exactly what will be examined and what will be delivered.
3. Preserve first. Digital evidence, logs, devices, accounts and communications are preserved before they are lost or altered.
4. Investigate. A proprietary intelligence platform collects at machine scale. Licensed investigators verify every material claim against source records and apply the tradecraft no software replaces.
5. Report to counsel. Findings are delivered to the people who engaged us, in the format the legal department uses, with a declaration where the matter needs one.
6. Stand behind it. Where a matter goes to court, we testify to how the evidence was gathered and what it shows.

The Sabotage Came From the Head of Global IT

A multinational tobacco company had been placed in receivership, and the court appointed chief executive believed senior people inside the company were working against it. He could not prove it, and the people under suspicion held some of the most trusted positions in the organization.

We started with the money. Financial activity tied to one executive did not originate where it should have. The transactions and the emails behind them traced to an IP address that did not belong to the person whose name was on the record. Then the company's age verification software, required for federal regulatory compliance, went dark. The sabotage traced to the same originating address. Both the money movement and the shutdown led to one person, the head of global IT operations.

That is the pattern in insider matters. The answer is rarely the outsider everyone fears. Read the full matter in The Sabotage Came From Inside the Company, and more in our case studies.

Law Firms Keep One Investigative Team on Every Matter

Outside counsel running an investigation for a corporate client can engage us on a single matter or through the Evidence Desk, a standing investigative desk with a monthly block of investigator hours, a named examiner who already knows the firm's matters, and sworn declarations as the standard deliverable. The engagement exists before the next matter arrives, so the next matter starts with a phone call.

For litigation teams, our litigation intelligence practice puts witness location, opposing party investigation, authenticated evidence and collectibility under one licensed team that knows the case. The firm has one team to call.

A Named, Licensed Examiner Stands Behind Every Matter

Every matter is worked under a named, licensed examiner. Matt Aubin, Managing Partner, brings seventeen years in cybercrime and open source intelligence. He is a Certified Digital Forensics Examiner (CDFE), a Florida Board Certified Investigator (FBCI) and a Certified AI Agent Developer. He has investigated cases jointly with the FBI, the SEC, the U.S. Secret Service and the U.S. Marshals, and has been qualified in court as an expert witness in cyber forensics and cyber investigations. He serves on the Board of Directors of the Florida Association of Licensed Investigators, holds a DOD Secret Clearance, and is a member of the U.S. Secret Service Miami Electronic Crimes Task Force and FBI InfraGard Tampa. His work has been featured by ABC News, Fox News and The Daily Beast.

E3's advisory board includes former CIA senior intelligence officers. E3 is a division of Southern Recon Agency, LLC, #1 every year since 2015. Coverage is nationwide, investigated from Florida. We work matters in every state for corporations, law firms, family offices and government. Read more about E3 and Matt Aubin.

General Counsel Ask These Questions Before They Call

What is a corporate internal investigation?

An internal investigation is a fact finding inquiry a company runs, usually at the direction of its general counsel, when it suspects wrongdoing involving its own people, money, data or systems. An outside licensed investigator establishes what happened and who was involved, and preserves the evidence so counsel can decide on discipline, litigation, an insurance claim or a law enforcement referral.

When should general counsel bring in an outside investigator?

Bring one in when the people closest to the problem are too close to investigate it, or when the answer depends on identifying someone who is hiding. If the findings may end up in court, an outside licensed examiner brings independence and a documented chain of custody, and can testify to the method.

Can an outside investigation stay under attorney client privilege?

It can be structured for that. The usual structure is attorney retained. We work at the direction of counsel and deliver findings to counsel, and the business at large does not receive them. Whether privilege applies in a given matter is counsel's determination. E3 is a licensed investigative firm. We are not a law firm and we give no legal advice.

What does counsel receive at the end of an investigation?

A written report of what was found and how it was found, named individuals where lawful means establish identity, preserved evidence with chain of custody, and a sworn declaration by a named licensed investigator when the matter needs one. We can testify to the methodology where required.

Will the person under investigation know?

Not from us. Licensed investigators do the work quietly and through lawful means, and only the people who engaged us see the results. When a matter could lead to an employment decision, the rules that govern that decision are built into the scope at the start.

How is an investigator different from a cybersecurity incident response firm?

Security and incident response teams find the intrusion and shut it down. When a crime has already happened and the company needs to know who did it and prove it, that is investigation. We identify the person behind the activity and build evidence a court, law enforcement or an insurer can act on.

Do you work for law firms as well as companies?

Yes. Outside counsel engages us per matter or through the Evidence Desk, a standing investigative desk with a monthly block of investigator hours and sworn declarations as the standard deliverable. Corporate legal departments managing outside litigation can use the same team.

Do you handle matters outside Florida?

Yes. Coverage is nationwide, investigated from Florida. We work matters in every state for corporations, law firms, family offices and government, licensed in Florida as Southern Recon Agency, LLC (A-1400197).

Counsel Gets a Straight Answer Before Any Work Begins

Bring us the problem. A licensed examiner reads every inquiry, and we will tell counsel plainly whether investigation can help before any work begins.

Related: Straight answers on corporate investigations · Case studies · About E3