Sometimes a data distributor gives sensitive data to one or more third parties. Sometime later, some of the data is found in an unauthorized place (e.g., on the web or on a user's laptop). The distributor must then investigate the source of the leak.