What is going on with this "Outside Investigative Firm"?

The most shocking thing about yesterday's Washington Post article was the casual revelation that an "outside firm" accessed internal UM servers and then reported that material to the NCAA.

I have seen some speculation that this firm was working on behalf of Michigan. That makes absolutely no sense to me: first, a vendor hired by the University would be bound by multiple confidentiality and disclsoure provisions. There could be certain contractual stipulations that, upon subpoena, the vendor would be required to disclose its materials, but again that obligation would have to be legally compelled and to a law enforcement agency (not a organization like the NCAA). And if the vendor was hired by Michigan for an internal audit, Michigan would be the party turning over the materials in exchange for leniency and self-reporting mitigation. 

Assuming that the firm is thus not a UM-affiliated vendor, this becomes a very troubling starting point for the entire bruhaha. Either someone at UM, with requisite access, provided the firm with access in a deliberate attempt to sabotage, or the investigative firm received that access either through false pretense or possible criminal intrusion. Law firms often times use "investigative firms" (some big ones are Nardello, Kroll) to take actions that you don't want to trace back to yourself, or to provide some degree of anonymity. But I am not aware of any reputable firm green-lighting access another institution's email servers without their explicit consent. That steps into federal privacy and computer crimes which very few reputable firms would want to risk violating (and most likely their liability insurance wouldn't even cover). 

Which brings me back to Matt Weiss. Did the community ever reach any sense of what happened there? Could he have been downloading the materials from servers without requisite permission and the investigative firm got it from him?

If I'm Michigan (and clearly the U approaches everything it feels different than I would), I would focus in like a laser on this. It's one thing for us to have scouted live games which 100,000 attendees are also witnessing. It's another for an interested party to retain a firm and traffic in materials that were obtained through either an unlawful breach of contract, corporate espionage, or hacking. And need as much pressure as possible on the press to dig into exactly who this is.