I believe you’re trying to articulate the act of witnessing from the act of investigating, and where the boundary between the two is. To me it seems like the boundary should be “does the general public have access to this information?”. If so, it’s allowable. If not, then a justification should be required for starting an investigation.