Begin with a question that changes a decision
Define what the business needs to decide. Is a website connected to the organisation it claims to represent? Does a proposed counterparty’s public history match its presentation? Which statements in an online allegation can be independently checked? Set a time period and a stopping point, so the work does not become an endless search for interesting associations.
The Berkeley Protocol provides a structured approach to gathering, preserving, verifying and analysing public digital information. It was developed for international criminal and human-rights investigations. Its methodological discipline is useful here, but citing it does not confer investigative powers or certify a corporate report. [1]
Write down the claim, the evidence that would support it and what would contradict it. For an impersonation concern, ownership of a genuine company and control of a suspicious website are separate questions. Resolving the first does not automatically resolve the second.
Set lawful boundaries for the work
Agree the purpose, authorised sources, people involved and intended recipients before collecting material. The European Commission identifies lawfulness, purpose limitation, data minimisation, accuracy, storage limitation and security as core principles for processing personal data. Public visibility does not remove the need to assess how personal information may be collected and used. [2]
For business research, collect information relevant to the stated question. Family photographs, private contact details and unrelated personal interests seldom help establish whether a company’s claim is accurate. Restrict access to sensitive findings and agree when the material will be reviewed or deleted.
Keep public-source research within its scope. Accessing a private account, bypassing a restriction or obtaining non-public records requires a separate assessment of authority; it is not simply another search technique. Involve appropriate legal advice where the purpose or jurisdiction makes those boundaries uncertain.
Resolve the identity before drawing connections
Start with stable identifiers wherever available: company registration number, jurisdiction and legal name. Compare these with addresses, dates and the specific entity named in the business relationship. A similar trading name or shared surname is an invitation to verify, not a sufficient match.
For example, the UK Companies House register makes company information, officers and people with significant control publicly searchable. Read the underlying filings and their dates rather than relying only on a search snippet or copied profile. Know which details the register publishes and which are protected. [3]
GLEIF provides another useful reference: an LEI identifies a legal entity, and its relationship data describes direct and ultimate accounting-consolidating parents. That is a particular type of relationship, not a complete register of every beneficial owner. Preserve the relationship’s meaning when explaining it to a reader. [4]
Keep unresolved matches separate. A diagram that merges two similarly named companies can make an unsupported connection look authoritative.
Check whether the sources are truly independent
Trace a significant claim back to its earliest identifiable source. Five articles repeating one press release provide different distribution, not five independent confirmations. Likewise, a directory that copies a company’s website cannot independently verify the same company’s assertion.
The Berkeley Protocol emphasises verification and the risk of bias. Apply that discipline by recording how a source could know what it claims and actively considering explanations that would weaken the initial theory. Preserve material that challenges the allegation as well as material that supports it. [1]
For a corporate review, separate registered facts, a company’s own statements, third-party reporting and unverified allegations. A reported dispute may justify further questions; it does not establish the outcome. An old appointment may explain historical contact; it does not establish a current business relationship. Keep the date attached to the finding.
Preserve the material and verify visual context
Record the source address, publisher or account, capture time and the content actually reviewed. Preserve accessible original files alongside explanatory captures where appropriate. NIST recommends protecting digital evidence and its integrity records; controlled originals and documented handling make later review more dependable. A hash can help demonstrate that a saved file has not changed, not that its claim was true. [5]
Images require their own checks. Berkeley’s guide for judges and fact-finders identifies authenticity, metadata, source, location and time as relevant to evaluating public imagery. A genuine photograph may still be presented with a misleading caption or date. Treat those propositions separately. [6]
For a suspicious corporate website, distinguish what the page displayed from who operated it. A copied office photograph or logo can support an impersonation hypothesis without identifying the operator. Label uncertain attribution clearly instead of letting a polished presentation imply certainty.
Ask these questions before relying on a finding
A concise review checklist is more useful than the number of pages collected. Before a finding influences a contract, escalation or public statement, ask whether the evidence answers the actual business question.
- Have the person, company or website been identified without merging uncertain matches?
- Is the claim supported by an original source with a relevant date?
- Does any apparent corroboration come from genuinely independent information?
- Have contradictions and reasonable alternative explanations been recorded?
- Can an authorised reviewer locate the preserved material and understand its context?
- Does the proposed conclusion stay within what the information establishes?
Deliver an assessment with clear limits
Organise the report around findings, supporting sources and open questions. Give each relationship a plain description: a declared directorship, a shared registered address or an accounting parent. Avoid a generic line between two names when the underlying relationship is narrower or uncertain.
State what the search did not cover. A quiet public footprint does not prove that a business is safe, and an absence of search results does not prove that an event never occurred. Some questions require authorised internal records, interviews or other evidence beyond public sources.
End with proportionate next steps: verify a document through its issuer, seek clarification from a counterparty, preserve a disputed page or commission a more focused investigation. The most useful result is a decision supported by traceable facts, with uncertainty visible enough for the business to manage.
