How should preservation and safeguarding be balanced?¶

Preservation and safeguarding should be balanced by identifying the real harm, the evidential risk and the least destructive effective response.

Why this matters¶

The dangerous assumption is that one must always take priority over the other. In practice, both matter, and the correct decision depends on the urgency and consequences of delay.

What to record and do¶

Start by defining the immediate risk. Is a victim being monitored, threatened, defrauded, locked out or exposed to continuing harm?

Then identify what evidence may be lost if the account, device or session is changed.

Preserve the original state first where this can be done without unacceptable delay. Capture account identifiers, active sessions, recovery details, visible content, security alerts and current connectivity.

Use the narrowest protective action that addresses the harm. It may be possible to revoke one session, block one contact, preserve one device or contact the provider without resetting everything.

Where time allows, seek safeguarding, legal, provider and specialist advice.

Record who made the decision, what information was available, what alternatives were considered and why the chosen action was proportionate.

Do not conceal the evidential cost of intervention. If a session ended, a password changed or content disappeared, document it directly.

Likewise, do not delay urgent protection merely to preserve a technically perfect record.

Continue to review the risk after the first action. The victim may need a safe communication route, new credentials, device support or provider preservation.

Operational takeaway¶

Protect the victim using the least destructive effective action, preserve the original state where practicable and document every evidential consequence.