Turning on a dime

When a case takes an unanticipated turn, these fraud examiners regroup and refocus their examination to discover evidence that eventually helped obtain a felony conviction on a corrupt city official.

When a client retains you to investigate a particular crime, you might discover another fraud. We saw a fraud examination morph from what appeared to be a straightforward case into something completely different. We adapted, changed our investigative focus and helped find evidence that local police and prosecutors used to obtain an Alford plea from a corrupt city official. (An Alford plea is a defendant's guilty plea in connection with a plea bargain without the defendant actually admitting guilt, i.e. a "no contest" plea.) Along the way, we helped form a strong team with city officials and law enforcement, which helped show that outside fraud examiners could be helpful.

Embezzlement or destroyed documents?

In April 2012, Bob Noe, the city attorney for Selah, Washington, contacted Ken Wilson about a potential fraud case involving the former city manager. Wilson's workload was heavy, so he brought in James Peet, a local fraud examiner, to assist. We both have prior law enforcement experience and are state-licensed private investigators.

The first meeting, which was in the city's council chambers, included Noe, the two of us, Mayor John Gawlik and the city's only detective for the 14-officer police department, Rich Brumley.

Those at the meeting suspected that the former city manager, Frank Sweet, might have embezzled approximately $24,000 from a city-managed grant fund. The city had later written the amount off as bad debt. As an aside, it was mentioned that several city employees had seen Sweet destroy numerous documents during his last days with the city, which might hinder the fraud examination.

City officials alleged that Sweet, who had been the city manager for 16 years, had abused his position, accepted favors from city vendors, created positions for family members and removed personnel files. Also, the city couldn't account for profits from the sale of some city-owned real estate.

In the time between Gawlik's election to mayor in 2011 and Sweet's termination at the end of January 2012, witnesses saw Sweet take documents from city files into his office. The witnesses said that he made multiple trips with large bags — possibly containing shredded documents — from his office to a large recycling dumpster behind city hall.

Sweet also had asked the city's contracted IT support technician to delete all of Sweet's files on the city's network server. However, before he complied, the technician saved all the city manager's files and made copies. The technician, at Sweet's request, also wiped clean all of Sweet's files on his desktop computer in his office. When the technician opened the operating system, he noticed many files had already been deleted.

When Sweet left his position, he reported that his city-issued laptop had been stolen, which raised more red flags.

The IT technician told Brumley about Sweet's requests. Brumley obtained a search warrant and immediately seized the city servers' hard drives and Sweet's desktop computer.

At our first meeting, Brumley gave us a flash drive of the data the technician had copied from one of the city's three servers prior to wiping them clean. The city gave us permission to retain the services of a computer forensics expert, so we added Dr. Gordon Mitchell with Future Focus Inc., in Woodinville, Washington, to the fraud examination team. Mitchell and Wilson had collaborated in the past, so we knew he possessed the talents necessary for this case.

A shift in focus

The city meant to focus the original investigation on the missing $24,000; however, it became clear to us the more obvious crime was the destruction of public documents. First, we reviewed Washington state law and verified that the crime of "injury to and misappropriation of record" by a public officer is a class B felony, punishable by up to 10 years in prison. (See the Washington State Legislature.) We then immersed ourselves in the statute and Washington State's Public Records Retention Schedules to better familiarize ourselves with the required elements of the law.

Next, we interviewed various city employees. Few of them knew anything about the missing funds, but practically all knew Sweet had been shredding documents. One employee said Sweet had a "shred-fest." Another witness said he had seen Sweet place a stack of personnel files in the personnel department area and walk away. One of the files belonged to the witness, who opened it and discovered numerous documents related to the witness' complaint against Sweet were missing.

While we interviewed employees, Mitchell made forensic images of the hard drives and analyzed them. He identified 42 documents as last being accessed on an external storage device. We reviewed the digital copies and determined 21 of the documents had been removed from the city's computers and possibly stored on a portable storage device.

We then reviewed two Outlook email files: the covert backup that the IT technician made and the files from the seized city computer. The covert backup contained emails in the Inbox, Sent Mail and Deleted files, while the seized computer only contained Deleted files. More than 1,000 files missing from the seized computer were found in the covert backup.

The diagram at left simplifies our discoveries when comparing the email files. The covert backup contained emails in Sent, Inbox and Deleted categories. The seized computer had only deleted emails.

When we compared the deleted emails, we made a further refinement to distinguish emails that involved official business and those that other city employees didn't send or receive. These are represented by the light blue areas in the diagram. A total of 154 "missing" emails were discovered when we compared the contents of light blue areas between the covert backup and the seized computer.

To meet legal and retention requirements, Sweet and the city should have retained all official city emails. The 154 official documents had been removed or destroyed, contrary to Washington state law. Each document destroyed constituted a separate felony.

In May, we met with Brumley, Noe and the elected Yakima County prosecuting attorney to discuss the case. Brumley felt he had a strong enough case to arrest Sweet, but wanted to confirm the prosecutor would follow through. The prosecutor only had minimal information and wanted to know more. He initially was guarded, but after we discussed the case and presented the evidence, he believed he had sufficient grounds to charge Sweet. He assured us he'd pursue prosecution, despite the state's historical lack of prosecutions for this type of case.

We continued the investigation into the missing $24,000, but there was insufficient evidence to incriminate Sweet. Ironically, this was mostly because of the missing documents.

The warrant

In early August, the team provided affidavits to Brumley about the missing documents. He used these affidavits to obtain a warrant to search Sweet's residence and his personal vehicle. On the night of Aug. 23, 2012, Brumley served the warrant on Sweet at his residence. The subsequent search uncovered two flash drives, the city's missing portable drive, the city's missing laptop computer and hundreds of city documents. Sweet was arrested and charged with theft and injury to public records.

Brumley sent several documents to the Washington State Patrol's crime lab, which identified them as original documents. He sent the flash drives to Mitchell for analysis and also requested we review copies of them along with several boxes containing hundreds of documents seized during the search warrant. Our examination identified 200 official city documents that the city should have retained.

Gordon extracted nine of the missing documents — suspected of originally being stored on the city's portable storage device — on one of the seized flash drives, and we identified them. Gordon also found an additional 45 documents on the same flash drive that weren't on the city servers. Brumley instructed city employees to attempt to locate the documents and originals of many of the seized documents, but they couldn't find them.

The end of the case

After several trial continuances, Sweet finally agreed to a felony Alford plea for one count of Injury to and Misappropriation of Record, RCW 40.16.020, with the prosecutor's recommendation of no additional jail time other than time served — just one evening in jail before he made bail. The court also ordered Sweet to pay restitution to the city for the cost of the investigation but dropped two counts of theft as part of the plea bargain. This is one of only a handful of times in the state's history the courts have convicted defendants of this charge.

On July 1, 2014, Wilson testified in a restitution hearing in Yakima County Superior. The court ordered Sweet to pay the City of Selah more than $65,000 for the cost of the investigation, which included not only the expense of the contracted investigation team but also for Brumley's time investigating the case. After the hearing, Brumley told Wilson that he "could never, in a million years, have done this case without all of you."

Lessons learned

If the case is strong, there's little wiggle room for the defendant

• Even with a crime that's normally extremely difficult to prosecute, Brumley was able to develop a case so strong that the defendant, Sweet, was left with little option but to take a plea deal. Even Sweet recognized he'd most likely be found guilty by a jury.

Don't waste time and money

• A conviction is sometimes all that's needed to right a wrong and send a clear message. While Sweet could have been charged with hundreds, or even thousands, of counts of Injury to and Misappropriation of Record, the single count was sufficient. The prosecutor indicated he was prepared to add more counts had Sweet not pleaded. The team recovered many documents, and the guilty plea meant Sweet would never work in public office in Washington again.

Don't let your ego get in the way of the fraud examination

• Fraud examiners are in a unique position when they join an investigative team. As outsiders, CFEs should remember that although they bring a distinct set of skills to the table, they are there to assist. Brumley sought our assistance after the FBI and the Washington State Patrol turned him down. In our first meeting, he mentioned that "sharing of evidence would have to be a one-way street," that is, information would flow only from us to him. We learned that Brumley's instruction was based on the prosecutor's directive to him because we weren't commissioned law enforcement officers. However, within days of the initial meeting, we established a significant level of trust, and Brumley felt comfortable sharing evidence with us.

Each part of the team plays an equally important role

• While we brought our fraud examination skills to the case, Brumley and the rest of the investigative team were equally important pieces to the puzzle. His quick reaction to remove the hard drives from the servers with a search warrant made this case possible.

Be sure all parties are familiar with the law

• It was obvious we all knew about the law, but some didn't know the law. Some picked up on it immediately, but we had to explain specific components of the law to others.

Make sure the client understands its insurance might cover the cost of an investigation

• Otherwise, work with the prosecution to ensure part of any deal includes restitution. In this case, the city's insurance carrier paid a small amount. Making a client whole for their loss is a goal worth pursuing whenever possible.

Finally, make sure you're up to the task

• As the ACFE Code of Ethics points out, "A Certified Fraud Examiner shall, at all times, exhibit the highest level of integrity in the performance of all professional assignments and will accept only assignments for which there's reasonable expectation that the assignment will be completed with professional competence." While we were well-versed in the principles of a fraud examination, it was our understanding of other unique provisions of Washington state criminal law that allowed us to help Brumley bring this examination to a successful conclusion.

At the time of publication, Frank Sweet had appealed his restitution amount.

James S. Peet, Ph.D., CFE, is principal manager at Peet & Associates LLC.

Kenneth J. Wilson, CFE, CSAR, is owner of Wilson Investigative Services.

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.