Exercise 3: Why Confronting a Suspected Wrongdoer Directly Is a Mistake — Possible Solution ==================================================================== WHAT THIS CHAPTER SAYS ------------------------------ Per this chapter's comparison table, confronting who you suspect is responsible directly "risks tipping them off to cover their tracks before anything is confirmed." WHY "SUSPECTED" IS THE OPERATIVE WORD ------------------------------ At the point a technician has a suspicion, nothing has actually been confirmed yet - it's a lead, not an established fact. Confronting someone based on an unconfirmed suspicion assumes a conclusion that the proper investigation process (the one this chapter hands off to at the escalation step) hasn't reached yet. If the suspicion turns out to be wrong, a direct confrontation has already caused unnecessary harm; if it turns out to be right, it has warned exactly the person who shouldn't be warned. WHAT "COVERING TRACKS" MEANS IN PRACTICE ------------------------------ If the suspected person is genuinely responsible and is tipped off, they now have advance notice to delete evidence, change their own behavior, or otherwise interfere with whatever the actual investigation would have found - directly undermining the entire "evidence over guesswork" discipline this chapter has been building. This is the same category of harm as deleting logs or resetting an account without documenting it first: something irreplaceable is lost because of an action taken before the proper process had a chance to work. WHY THIS IS A DECISION THAT BELONGS TO THE ESCALATION PROCESS, NOT ONE TECHNICIAN ------------------------------ Determining who is actually responsible, and how to handle that person, requires authority and process (often HR, security, or legal involvement) well beyond a single support technician's own role. Acting on a suspicion alone - even with good intentions - substitutes one person's guess for a process specifically designed to get this right. WHY THIS WORKS AS AN ANSWER ------------------------------ It explains why acting on an unconfirmed suspicion is premature either way it turns out, explains concretely what "covering tracks" would let a genuinely responsible person do, and connects this to why the decision belongs to the broader investigation process rather than to one technician's own judgment in the moment.