Capturing information

Information, such as an incident, report of suspicious activity, or a single piece of data, can be manually or automatically captured in Clue from a wide range of sources, including directly by the user, via API-connected web forms, or dynamically from external databases.

Once in Clue, information is ready to be triaged. You’ll assess new information and determine whether it requires further evaluation, assessment or immediate development into an investigation. Clue can proactively detect connections between related records or alert you of Watchlist terms when new information is added.

Recording Referrals: Referrals are typically recorded in the Information Register, which is a permanent log of all received information.

Initial Evaluation: During the Refer phase, you conduct initial searches and connect information to new or existing records to see whether details of the incident link to existing intelligence or investigations. The identity of the referral source can be protected and managed through Access Control and dedicated Source management.

Develop and evaluate

Next, you’ll conduct a more in-depth evaluation of the referral, to determine the best way forward. It involves several key steps:

Creating Incidents: You can initiate the Develop phase by creating an Incident and connecting related information.

Research and Insights: You can perform further research using functions to identify existing connections in Clue. The Connect function allows you to create a link between connected entities and add context with Link Reasons. You can also expand investigations by searching datasets beyond Clue, e.g. athlete databases or fraud risk data.

The Insights function offers Charting to visualise data connections and Mapping to pinpoint geographical locations.

Recording Information: You will document your findings in Investigator Notes and record decisions on the course of action in the Decision Register. Tasks are assigned using Workflow as needed.

Determining Next Steps: You will decide on and log your course of action, including opening a formal investigation, determining that no further action is required, or referring the case to relevant third parties.

Investigate

The Investigate phase commences when a decision is made to initiate a formal investigation. This phase involves:

Setting up Investigations: Investigations can be created from scratch or promoted from Incidents. All connected records are automatically brought into the Investigation to enhance security, focus, and structure. The Access Control function assigns members to the investigation team and provides each team member appropriate access to the investigation.

Recording Investigative Activities: Tasks and Investigator Notes help you document the progress of the investigation. New records are added, and links to existing records are created, including other related Incidents.

Specialised Registers: The Investigation Register offers a structured way to record Inputs, using the Material and Statement Registers. The Events Register can store evidential events such as ANPR, bank transactions, and communications data.

Tracking Lines of Enquiry: Search and Insights functionals are utilised to identify lines of enquiry from data gathered during the investigation and data held more broadly in Clue.

The Decision Register records new lines of enquiry or excluded ones to ensure compliance and provide a detailed, auditable view of investigative decisions.

Administrative Activities: Investigation reviews, as well as administrative activities like arrests, court dates, and surveillance, are recorded in Investigator Notes or dedicated Lists.

Supervision and Reporting: Workflow, Insights, and Reporting functions help managers and supervisors oversee and manage investigations. For smaller, less complex investigations, completing the process using an Incident without creating a separate Investigation record may be possible.

Presenting findings

When the investigation reaches the threshold for presenting a case to the relevant authority, sharing information with third parties or taking preventative measures, the user has several options:

Case File: For presenting a case, Clue provides tools to manage material classification and disclosure, creating a structured output in compliance with the relevant authority’s requirements.

Shared Intelligence: Intelligence can be shared with partners, such as law enforcement agencies, following the UK’s National Intelligence Model. This process allows you to sanitise intelligence, add handling instructions, and disseminate information externally, by creating a PDF for sending or by sending it directly to another Clue system using the Clue API.

Custom Reports: You can create customised report templates to generate structured outputs using registered data for specific presentation purposes, such as HR hearings or information sharing.