Case Collaboration

Overview#

A detective working a money laundering case discovers a property link that connects to a separate fraud investigation being handled by a colleague in another unit. Under traditional working practices, that connection might take days to surface: an email here, a phone call there, a document emailed back and forth with no clear version history. Case Collaboration closes that gap by putting both investigators in the same digital workspace the moment it matters.

The module delivers a multi-user investigation workspace that enables teams to coordinate complex investigations through simultaneous evidence review, secure messaging, role-based task assignment, version-controlled document editing, and investigation-wide activity feeds. It transforms fragmented communication across email, messaging apps, and spreadsheets into unified, auditable, and compliant collaboration workflows that support both small teams and large multi-agency operations.

Key Features#

• Real-Time Multi-User Editing: Multiple investigators can simultaneously view, annotate, and edit case materials with automatic conflict resolution, presence awareness, and cursor tracking
• Investigation-Specific Messaging: Encrypted communication channels tied directly to cases, entities, transactions, and evidence items, keeping all conversations in context and fully auditable
• Task Assignment and Tracking: Role-based workflows with supervisor approval, deadline management, priority levels, and automatic escalation for stalled tasks
• @Mentions and Smart Notifications: Tag team members, reference evidence, link entities, and trigger alerts without leaving the investigation workspace, ensuring nothing is overlooked
• Version Control and Rollback: Complete history of every edit, comment, and decision with instant restoration to any previous state and side-by-side version comparison
• Activity Feed and Timeline: Real-time investigation progress visibility with filtered views by user, date, case, action type, or priority for comprehensive situational awareness
• Secure Document Collaboration: Simultaneous PDF annotation, spreadsheet analysis, and report drafting with change tracking, commenting, and approval workflows
• Complete Audit Trail: Immutable logs of every collaboration action, message, edit, and access event for compliance, accountability, and courtroom presentation
• Presence Awareness: Real-time indicators showing which team members are currently active in the workspace and what they are working on
• File Sharing and Attachments: Share documents, images, and other files within the workspace with access controls and version tracking

Use Cases#

Multi-Agency Task Forces#

Joint investigation teams spanning multiple agencies coordinate securely within a shared workspace, maintaining clear boundaries between what each agency can access while enabling seamless collaboration on shared evidence and findings. The workspace provides a single source of truth for the investigation.

Complex Financial Investigations#

Teams of financial analysts, forensic accountants, and investigators collaborate on large-scale fraud cases, simultaneously reviewing transaction data, annotating evidence, and building timelines without version conflicts. Threaded discussions attached to specific evidence items maintain analytical context.

Supervisor Oversight#

Supervisors monitor investigation progress through activity feeds and dashboards, provide guidance through in-context comments and task assignments, and approve key investigative steps without disrupting the investigation workflow. Quality review and sign-off are integrated into the collaboration flow.

Cross-Timezone Coordination#

Distributed teams working across time zones maintain investigation continuity through persistent conversation threads, detailed activity logs, and automated handoff notifications that keep every team member informed of progress regardless of when they are online.

Rapid Response Coordination#

Time-critical investigations use real-time collaboration features to coordinate immediate responses, share findings as they emerge, and make collective decisions quickly through the shared workspace.

Workflows#

Collaborative Evidence Review#

1. An investigator uploads or links evidence to the case workspace with initial observations
2. Team members receive notifications and begin reviewing the material simultaneously
3. Annotations, comments, and observations are added in real time with full attribution
4. Discussion threads form around specific evidence items for focused analytical conversations
5. A supervisor reviews the collective findings and approves or requests further analysis

Task-Based Investigation Coordination#

1. A lead investigator creates and assigns tasks to team members based on expertise and availability
2. Each team member works on their assigned tasks, updating progress within the workspace
3. Completed work products are shared in the workspace for team review and feedback
4. Automated alerts notify the lead when tasks are completed or if deadlines are at risk
5. The lead reviews completed work, provides feedback, and coordinates next steps through the activity feed

Investigation Handoff#

1. An outgoing team member documents the current state of their work within the workspace
2. The lead assigns the work to a new team member with a handoff note
3. The incoming team member reviews the activity history, evidence annotations, and discussion threads
4. The handoff is recorded in the audit trail with complete continuity of the investigation record

Integration#

• Programmable API Access: Integrate collaboration capabilities with external investigation tools, case management systems, and workflow platforms
• Notification Channels: Connect with email, SMS, and push notification services for timely alerts across all devices and platforms
• Document Management Systems: Link with enterprise document repositories for seamless file access and version control
• Identity and Access Management: Synchronise user roles, permissions, and organisational hierarchies from directory services for accurate access control

Open Standards#

• RFC 6455 (WebSocket): Real-time multi-user presence, live message broadcasting, cursor tracking, and conflict-resolution notifications all run over persistent WebSocket connections.
• GraphQL (June 2018 specification): Every collaboration interaction, including task assignment, notes, @mentions, activity feeds, and document locking, is served through a typed GraphQL schema with queries, mutations, and subscriptions.
• RFC 3161 (Internet X.509 PKI Time-Stamp Protocol): Case export packages carry RFC 3161 TSA tokens that provide cryptographically trusted timestamps, supporting courtroom admissibility and chain-of-custody verification.
• ArcSight Common Event Format (CEF): The audit trail SIEM export service emits CEF-formatted log lines consumable by Splunk, Elastic, Microsoft Sentinel, and IBM QRadar for compliance monitoring.
• EDRM (Electronic Discovery Reference Model): Collaborative case packages can be exported in the EDRM profile, ensuring legal and regulatory compatibility with electronic discovery workflows.
• OASIS STIX 2.1: Case collaboration exports support a STIX 2.1 output type, enabling threat-intelligence sharing with external agencies and fusion centres via a standardised object model.
• RFC 7519 / OAuth 2.0 (JWT Bearer, RS256): All API and WebSocket access is authorised through RS256-signed JSON Web Tokens issued by the platform identity service, with role-based permissions enforced at every resolver.
• RFC 4511 (LDAP): Tenant directory integration synchronises investigator roles, team membership, and organisational hierarchies from LDAP or LDAPs directory services to maintain accurate access control across agencies.

Last Reviewed: 2026-02-05 Last Updated: 2026-04-14