Protecting an Identity in an Investigation File: Child Victims, Whistleblowers and Anonymous Sources

Why this matters more than almost anything else in the file

A contradiction you missed costs you a lead. A name you failed to protect can cost a person their safety, their job or, for a child, a second harm laid on top of the first. It is the one mistake in an investigation that cannot be corrected afterwards: once a report naming a protected witness has been emailed, printed or filed, there is no version of events in which that person is unknown again.

The obligation is also legal in most places you will work. Child-protection statutes, whistleblower legislation, source-protection rules and data-protection law each say, in their own words, that certain people's identities are to be withheld from anyone who does not need them. A report that names a child victim is not just careless; in many jurisdictions it is an offence in itself, and it hands the other side a reason to attack the whole file.

And there is the practical point that experienced investigators know in their bones: people talk when they believe they are safe. The moment one protected source is exposed, the next ten stop coming forward. Protecting identities is how you keep the supply of truth open.

Where a name actually lives in a case file

The first mistake is to think of a name as one thing in one place. In a real file the same person appears in at least five different ways, and each one has to be dealt with separately.

• The people list. The party record: name, role, contact details. This is the obvious one, and it is the least of your problems, because it is structured and easy to find.
• The statement headers. Who wrote each statement. This is what a report prints in its exhibit schedule, its annexures and its list of contradictions, and it is the rail most redaction efforts forget.
• The prose. The words inside every statement, in every spelling anyone used: the full name, the surname alone, a nickname, an initial, a misspelling. A quote lifted into the report carries the name with it.
• The case title and summary. The title sits on the cover, in the browser tab, in the PDF filename and in the subject line of every email that mentions the case. Nobody thinks of it as a place a name can leak, which is exactly why it does.
• Anything generated from the file. Summaries, briefs, advice and AI-produced text are built from the words above, so whatever those words contain, the generated text will contain too.

Protection that covers the first of these and not the other four looks finished and is not. That is worse than no protection, because everyone stops checking.

Choose a designation and use it everywhere

Replace the name with a fixed designation and use it consistently across every document: Child A, Parent A, Source 1, Witness B. The designation should say what the person is to the case without saying who they are. It should never be an initial, a shortened name or anything derived from the real name, because those are guessable, and it should never change between documents, because a reader who meets Child A in the report and the minor in the annexure will assume two people.

Write the designation down, with the real name beside it, in a register that stays inside the case and never travels with the report. That register is the key. Whoever legitimately needs the name later, a judge, a prosecutor, an internal reviewer, gets it from the register, not from a report they happened to receive.

List every spelling before you start, longest first

Before substituting anything, read the statements and list every way the person is referred to: Thandi Nxumalo, Thandi, Ms Nxumalo, T. Nxumalo, the misspelling one witness used. Then substitute the longest spelling first. This is not pedantry. If you replace Thandi before Thandi Nxumalo, you are left with Child A Nxumalo in the report, which reveals the surname while looking like it has been dealt with.

Very short spellings, an initial or a two-letter nickname, should not be replaced automatically at all. T. appears in far too many words to substitute safely. Note them in the register and check them by hand.

The near misses you must not rewrite

Some references identify a person without using their name: my daughter, the boy in room 4, the manager's PA, the only Black officer on shift. These cannot be found by matching text, and they should not be rewritten mechanically either, because whether my daughter gives the game away depends on who is reading and what else they know. That is a judgement about a sentence, and the investigator makes it.

The working method is to have every near miss listed for you, then decide each one: leave it, reword the sentence, or withhold the passage. A tool that silently rewrites my daughter to Child A has removed evidence and probably produced nonsense; a tool that lists it and leaves it alone has done its job.

Say in the report that an identity is withheld

A report that quietly uses Parent A invites the reader to assume it is a real name they do not recognise. State it. The first paragraph of the report should say that the identity of one or more people in the case is protected, why in general terms, and that a designation is printed in place of the name throughout. This protects the report's credibility, and it protects you: nobody can later say the substitution was hidden.

The same notice belongs on the exhibit schedule, so that Statement #4, Parent A is understood as a withheld name and not a clerical gap.

The honest check: what was replaced, what was left alone

Before any protected report leaves you, produce a check that answers two questions in writing: exactly which words were replaced, how many times, and exactly which near misses were found and left alone. Keep that check with the register, never in the report itself. Then search the finished document, and the PDF you are about to send, for every spelling in your list. Not read it. Search it. A four-hundred-paragraph report cannot be proofread for one surname, and this is the step that catches the case title nobody thought to change.

If a search finds the name anywhere in the outgoing file, the report is not finished. The correction is never to remove one instance; it is to find out which of the five places above let it through and fix that, because the same route will let it through next time.

What protection like this does not do, and what to do instead

Be clear with yourself and your team about the boundary. Withholding a name from reports is about what leaves the file. It does not hide the person from colleagues who can open the case; they will see the real name in the statements and the people list, and they should, because they need it to do the work. If the real name must be hidden from some of your own people, that is an access decision, made by restricting who can open the case, and it is a separate thing from protecting the report.

Some documents are deliberately not protected, and should not be. A sworn statement in court format must name the deponent: a jurat that names nobody is not a statement. A full case export kept as a backup must carry the real names, and should say so on its face. Know which documents these are, keep them inside, and treat their existence as one more reason the register must be kept safe.

Finally, an anonymous source is a different case again. If a person's account was given on the condition of anonymity, there should be no name anywhere in the file to protect, only the designation and the record of who received the account and when. If you find yourself adding an anonymous source's real name to a system "just so we have it", you have already broken the promise.