Sub-Rosa Surveillance for Insurance Defense

Sub-rosa surveillance is covert, lawfully obtained video documentation of a claimant’s activities, used across auto liability, general liability, disability, and workers’ compensation claims to compare observed conduct against what the claim file and testimony represent. It only carries weight in insurance defense when it is recorded from a public vantage without trespass or audio, logged contemporaneously, preserved with an unbroken chain of custody, and deployed by a program that treats it as one input among several, not a substitute for claim strategy.

Carriers, third-party administrators, and defense counsel do not run one kind of sub-rosa program; they run several, because a soft-tissue auto claim, a premises-liability slip-and-fall, a long-term disability file, and a workers’ compensation claim each carry different red flags, different timing windows, and different evidentiary demands. Treating them identically is how surveillance budgets get wasted on the wrong claims and how defensible footage gets undermined by an investigator who did not understand what the specific claim type required. This guide is written for the claims executive, SIU manager, and defense counsel building or auditing a surveillance program across claim types, and for the vendor-selection decision that determines whether that program produces evidence or exposure. It is general information for decision-makers, not legal advice; surveillance and consent law vary by state and should be confirmed with counsel before deployment.

How does sub-rosa surveillance differ across insurance claim types?

The mechanics of lawful observation, public vantage, no trespass, no audio, are constant across every line of coverage. What changes is the trigger, the timing, and what the footage needs to prove. The table below reflects how a disciplined program calibrates surveillance to the claim type rather than running a single generic playbook.

Claim type	Typical deployment trigger	Evidentiary focus	Highest-value timing
Auto liability / bodily injury	Soft-tissue injury with disproportionate treatment; social-media activity inconsistent with claim	Range of motion, driving, lifting, athletic activity	Shortly before mediation or an independent medical exam
General liability / premises	Slip-and-fall or product claim with subjective pain complaints and thin objective findings	Mobility, gait, activities of daily living	Before an examination under oath or deposition
Long-term / short-term disability	Occupational-duty mismatch between claimed limitations and observed capability	Sustained activity over time, not a single moment	Periodic, tied to policy review dates and duty-related milestones
Workers’ compensation	Delayed or unwitnessed injury report; treatment escalation without objective findings	Compliance with stated lifting, standing, or duty restrictions	Before an independent medical exam or scheduled hearing

The common thread is that surveillance is most persuasive when it is contrasted against a specific, documented representation, a stated restriction, a sworn deposition answer, a duty description, rather than deployed as a general fishing expedition. Programs that skip the step of identifying exactly what claim-file statement the footage needs to test tend to produce video that is technically lawful but strategically useless.

What legal guardrails govern every deployment, regardless of claim type?

Every claim type above operates inside the same legal envelope, and it is narrower than many adjusters assume. Lawful sub-rosa work stays within what a person knowingly exposes to public view: observation from a public street, sidewalk, or other place the investigator is legally entitled to be. Recording into the interior of a residence, over a privacy fence, or into an area where a reasonable expectation of privacy exists can expose the carrier to a claim for intrusion upon seclusion. Audio capture is a separate and stricter problem: the moment a device picks up a private conversation, the federal Wiretap Act and a patchwork of state statutes, many requiring all-party consent, attach, which is why professional sub-rosa surveillance is silent by design. Trespass, harassment or conduct that alarms the subject, and impersonation of law enforcement or government officials are absolute lines that void the value of any footage obtained and can create liability that dwarfs the value of the claim under investigation. Vehicle location tracking deserves particular caution given how restricted or outright criminalized covert GPS placement on a claimant’s personal vehicle is in many states, an area shaped by the constitutional concerns the U.S. Supreme Court raised about prolonged location monitoring under the Fourth Amendment.

None of this is exotic legal theory; it is the operating discipline any competent investigator should already carry into the field. The program-level failure is not usually an investigator who does not know the rules. It is a carrier or firm that never confirmed the vendor’s rules matched the jurisdiction before authorizing the assignment.

What separates an elite surveillance vendor from one that creates exposure?

The quality gap between investigative vendors is rarely visible until a case is contested, and by then it is expensive to discover. Elite vendors document methodology as rigorously as findings: continuous, unedited recording rather than curated highlight clips, a contemporaneous log of every observation period including the unproductive stretches, and native-format preservation with hash verification so integrity can be proven rather than asserted. Mediocre vendors produce edited highlight reels with gaps that invite the argument that exculpatory footage was cut, informal notes reconstructed after the fact, and no clear answer when asked what tool captured or preserved the file. The difference shows up hardest under cross-examination, where an investigator who cannot explain the equipment, vantage point, and preservation method in specific terms hands the claimant’s counsel an opening no amount of compelling footage can close.

Technology adds another layer worth qualifying carefully. Drone-based observation and enhanced optics can extend legitimate public-vantage surveillance, but they raise their own airspace, privacy, and state-specific regulatory questions that a vendor should be able to answer before a carrier authorizes their use, not after footage is already in hand.

How should a carrier or firm qualify a surveillance vendor before assigning claims?

Vendor qualification should happen once, rigorously, before the first assignment, not claim by claim. Use the following checklist to build or audit an approved-vendor list.

1. Verify licensing in every state where surveillance will occur, and confirm the vendor knows that state’s specific consent, pretext, and privacy rules.
2. Require proof of insurance, including errors-and-omissions and general liability coverage sufficient for the exposure surveillance can create.
3. Ask for a sample surveillance log and native video file to evaluate documentation discipline before any live assignment.
4. Confirm hashing and chain-of-custody practice in specific, technical terms, not a general assurance of “professional standards.”
5. Ask whether investigators have testified at deposition, examination under oath, or trial, and request litigator references.
6. Clarify what is genuinely in-house versus subcontracted in each state, since an unnamed subcontractor complicates both accountability and chain of custody.
7. Set a standard reporting format across the vendor panel so SIU and defense counsel can evaluate footage consistently regardless of which investigator handled a given file.
8. Require a written assignment sheet per claim naming the specific representation being tested, the authorized methods, and the budget, so nothing drifts into an unauthorized scope.

A panel built this way lets SIU managers move fast on individual assignments because the diligence was done once, at the vendor level, rather than re-litigated on every file.

Where does surveillance fit across the life of a claim?

Surveillance is rarely a single event; it is a tool deployed at specific decision points across a claim’s life, and coordinating it with SIU and defense counsel at each stage is what converts a good clip into a resolved file. At intake, red flags identified by the adjuster, an unwitnessed injury, a delayed report, disproportionate treatment, trigger an initial activity check and a review of public social-media content to establish whether full surveillance is likely to be productive. Before an independent medical exam or examination under oath, current footage can be shared with the examining physician or used to shape questioning, sharpening an assessment that would otherwise rely only on the claimant’s self-report. Around a deposition or hearing, footage held in reserve and disclosed at the right moment can directly contradict sworn testimony, which is typically more damaging to a claimant’s credibility than surveillance shared too early. Near mediation, a defensible surveillance package changes settlement leverage the same way a strong demand letter changes it for a claimant, because opposing counsel can see the carrier is prepared to litigate the point rather than simply pay to avoid the cost of proving it.

The decision of when to disclose surveillance, immediately, at the IME, or reserved for deposition, belongs to defense counsel and SIU, not the investigator. The investigator’s job is to produce footage and documentation solid enough that counsel has real options at each of those decision points.

What does chain of custody require for surveillance video and OSINT to survive a challenge?

Authentication is the foundation every surveillance package must clear before a fact-finder ever weighs the content. Video must be shown to be a fair and accurate depiction, recorded continuously and without deceptive editing, so the professional standard is unbroken, real-time-stamped footage including the mundane stretches, because gaps invite the argument that exculpatory moments were cut. Every original file is preserved in native format, hash-verified so its integrity can be proven mathematically rather than asserted, and logged in a contemporaneous record noting date, time, location, equipment, and observed activity. Publicly available social-media content used to corroborate surveillance carries the same demand: full-page and metadata capture, timestamps, and source URLs, because a bare screenshot is easily attacked as undated or fabricated, and claimants frequently delete posts once litigation intensifies. Federal wiretap exposure is governed by 18 U.S.C. § 2511, and the professional standard for handling the resulting digital evidence tracks the same integrity principles codified in ISO/IEC 27037. A carrier that requires this discipline of its entire vendor panel, not just its best investigator, is the carrier whose surveillance survives a motion to exclude across the whole book of business, not just on the file where someone happened to be careful.

What drives the cost of a surveillance program, and how should it be budgeted?

Surveillance is a targeted response to specific red flags, not a default applied to every claim, and budgeting should reflect that discipline rather than a flat per-file allowance. Cost is driven primarily by the number of field hours and days authorized, the number of investigators required for a given location or activity pattern, the geographic distance to the claimant, and any technology add-ons such as enhanced optics or drone observation where legally appropriate. A second, less visible driver is production quality: the editing, logging, and chain-of-custody documentation that turn raw footage into a court-ready package cost more than raw recording alone, and skimping on that step is the single most common way carriers end up with footage that cannot survive a foundation challenge. The most cost-efficient programs scout with lower-cost activity checks and open-source research before committing to multi-day surveillance blocks, so full field hours are spent only where a pattern already suggests they will be productive, and they track vendor-level outcomes over time so budget flows toward the investigators whose footage actually holds up rather than the ones who simply bill the most hours.

Representative scenario: the premises claim and the marathon photo

Consider a representative general-liability matter. A claimant alleged a disabling knee injury from a store slip-and-fall, reporting an inability to stand for more than a few minutes and citing constant pain in a recorded statement. The file showed thin objective imaging findings relative to the subjective complaints, a common red flag. An OSINT review of public social-media accounts surfaced a photo, posted under a public tag, of the claimant finishing a half-marathon roughly six weeks after the alleged injury. That single lead reframed the investigation: rather than open-ended surveillance, the assignment sheet specifically directed the vendor to document current activity level and gait over a defined window ahead of the scheduled examination under oath. The resulting footage, continuous, logged, and hash-verified, was shared with defense counsel before the examination, and the claim was resolved on a materially different basis than the original demand. This is an illustrative scenario, not a named client or a guaranteed outcome, but it illustrates the pattern: corroborated, well-timed, forensically documented surveillance changes leverage far more than volume of hours ever does.

How does Honeybadger Solutions support sub-rosa programs across claim types?

Honeybadger Solutions supports carriers, third-party administrators, self-insured employers, and defense counsel across auto liability, general liability, disability, and workers’ compensation lines with a single accountable command structure rather than a patchwork of disconnected vendors. In Arizona, our own AZ-licensed investigators conduct surveillance directly. For claims outside Arizona, field deployment is coordinated through a commanded network of vetted, licensed partner investigators, with established coverage in California, Texas, and Florida and expanding reach elsewhere, while records research, open-source intelligence, financial investigation, and digital-forensic preservation of surveillance and social-media evidence are handled in-house nationwide regardless of where a claim is venued. Every assignment runs on a written assignment sheet naming the specific claim-file representation being tested, continuous and lawfully obtained recording, contemporaneous logging, and hash-verified native-file preservation, so the resulting package is built to withstand a motion to exclude before it is ever filed.

Our investigations team routes findings through SIU and defense counsel at the moments that matter, an independent medical exam, an examination under oath, a mediation, or a hearing, with reporting standardized across every claim type so adjusters and counsel can evaluate footage consistently. From Arizona home command, with offices in Casa Grande, Phoenix, and Oro Valley, we support claims programs across every Arizona venue, nationwide, and internationally.

Frequently asked questions

Does sub-rosa surveillance work the same way for auto, general liability, disability, and workers’ comp claims?

The legal mechanics, public vantage only, no trespass, no audio, are the same across every claim type, but the trigger and timing differ. Auto and general-liability surveillance typically targets a soft-tissue or premises injury with thin objective findings, disability surveillance looks for sustained activity inconsistent with occupational limitations over time, and workers’ compensation surveillance focuses on compliance with stated duty restrictions. A program that treats every claim type identically usually deploys at the wrong moment for at least some of its files.

Can a carrier use drone footage or enhanced optics for sub-rosa surveillance?

Sometimes, but only within airspace and privacy rules that vary by state and can be stricter than ground-based public-vantage observation. Any vendor proposing drone or enhanced-optics surveillance should be able to explain the specific regulatory basis for that method in the relevant state before it is authorized, not after footage has already been captured.

How long does a typical sub-rosa surveillance assignment take?

It depends on the claim type and what is being tested rather than a fixed formula. Programs that scout first with lower-cost activity checks and open-source research, then commit to a defined, consecutive-day surveillance window timed to a specific milestone such as an IME or examination under oath, generally get more usable footage per dollar than open-ended, unscoped assignments.

What happens after surveillance confirms suspected fraud?

Findings route to the carrier’s SIU and defense counsel, who decide how and when to use the footage, whether to share it with an IME physician, hold it for deposition, or bring it to mediation, and whether the evidence supports a referral to a state insurance fraud bureau or the National Insurance Crime Bureau. Because workers’ compensation and insurance fraud are felonies in most states, that referral decision belongs to counsel and SIU, informed by, but separate from, the investigator’s factual report.