Advanced Criminal Investigations and Intelligence Operations Read online

  Intelligence Files and Analytical Investigative Methods

  205

  SECRET. Any additional designations are adjectives referring to the type of information accessed, such as CRYPTO and SCI (specially compartmented

  information). Terms such as EYES ONLY are used in other countries, such as Great Britain (MI5 and MI6 SIS).

  Strategic intel igence supports long-range planning or policy. Tactical intel igence is for immediate operational use. Reactive intel igence refers to a response to a situation after the fact. Proactive intel igence refers to anticipation of needs and/or preemptive action before an incident.

  Intelligence files were once literally paper files that were indexed by

  names and subjects, with file numbers. They were cross-referenced by pri-

  mary categories and subcategories (primary, secondary, and tertiary). Source documents were indexed and filed (documenting the source of raw data or

  information). Source documents were rated for reliability, content, and classification. Folder logs and dissemination control forms were used to control information. Such manual systems can be of value in areas where technology is scarce but the need for intelligence files is great. Primarily, however, today, intelligence files are automated and computers are programmed to process

  massive amounts of stored data, information, and intelligence.

  Intelligence Analysis

  The analysis of intelligence can be conducted by two nearly identical processes, which were developed from scientific and engineering practices: analytical investigation methods (AIMs) and visual investigative analysis (VIA).

  Other methods of intelligence analysis are available, but AIM and VIA are commonly used by law enforcement, intelligence, and military analysts to

  present complex information with presentation media.

  Analytical Investigative Methods

  AIMs analyze large amounts of information using scientific concepts of investigation, data collection, and evaluation techniques, including the following:

  • Construction of association matrices and link analysis

  • Use of inductive and deductive logic from sources of information

  • Flow charting and construction of charts for analysis

  • The analytical process

  • Development of inferences from analysis

  • The delivery of clear and concise briefings and presentation media

  AIMs, like VIA, emerged from using tools and techniques borrowed from

  science and engineering project management. Two such tools, critical path

  206

  Advanced Criminal Investigations and Intelligence Operations

  method (CPM) and program evaluation and review technique (PERT), are

  discussed further under section “Visual Investigative Analysis.”

  CPM is used for scheduling, planning, and control ing projects with deadlines. Users decide which path in a network will take the most time. This path then becomes a critical path.

  PERT is a scientific management information system for scheduling, planning, and control ing complex research and development projects. It is oriented to events and uses a network to display graphically the sequence of events, dependent relationships, and estimated duration of times for all the activities.

  A network is a series of interconnected and interrelated symbols that graphically displays the sequence of occurrences and dependent relationships. Link network analysis shows associations, while time flow analysis shows sequential events.

  Visual Investigative Analysis

  VIA was developed in the 1960s by the Los Angeles Police Department and

  named VIA by the California Department of Justice in the 1970s (Morris, 1982, p. iv). It was first used in trial support in Los Angeles in 1968 in the trial of Sirhan Sirhan for the murder of U.S. Senator (and former Attorney General) Robert F. Kennedy (Morris, 1982, p. 5).

  VIA, or crime analysis charting if used in criminal cases, makes complex

  investigations more controllable and makes it easier for supervisors and managers to monitor the hour-by-hour use of resources to avoid duplication. It also helps trial attorneys to quickly understand complex cases and large amounts of information by providing a sort of roadmap of critical events and essential elements. It also helps judges and juries to understand cases by allowing them to see and hear the progress of the events presented. Such analysis saves time, often reducing trial time by half, and clearly states essential facts.

  VIA developed from concepts borrowed from engineering, construc-

  tion, and ship building that used techniques such as CPM and PERT . CPM

  is similar to PERT and is geared toward scheduling and controlling projects.

  PERT is geared toward facilitating control of research activity in scientific tasks. The two can be integrated into one system. VIA is such an integration, with modifications that are responsive to the law enforcement or intelligence functions. VIA is a network approach to displaying graphically the sequences of events and the relationships of each element of an incident

  (Morris, 1982, pp. 3–4).

  VIA can be performed manually or by use of computer graphics and

  tools. While computers are more practical today, understanding the manual system can aid in practice or be used in more remote or primitive environments. To perform VIA manually, the analyst needs a few tools and supplies:

  Intelligence Files and Analytical Investigative Methods

  207

  1.

  Index cards—3 × 5, using only one side, to tape or affix to the layout.

  2.

  Binders—a case library for copies of all documentation supporting the VIA chart. Each binder is numbered and each page in each binder

  is numbered for quick reference (e.g., a document or information in

  Binder 2 and on page 25 would be noted on an index card as 2-25).

  3.

  Highlighter pens—during the reading phase of the documentation,

  the analyst highlights items or information for transfer to the index

  cards. This can simply be in yellow highlight or various colors can be

  used to color-code specific aspects of information.

  4.

  Template—symbols can be drawn using a template that includes cir-

  cles, rectangles, arrows, triangles, and other symbols.

  5.

  Paper—durable drafting paper can be used for the chart and tracing paper can be used for final drafts.

  6.

  Tape and pins—pins can hold index cards on the drafting paper during layout and tape can be used to affix them when finalized. Here, the

  index cards are taped down after the lines, circles, arrows, and triangles are added and the chart takes the shape and appearance of a storyboard.

  7.

  Pens and pencils—for compiling the index cards and drawing the

  chart. The final draft, of course, should be in ink.

  8.

  Copies of reports and documentation—all materials for the case

  should be copied (never the originals) because they will be hole

  punched, page numbered, and highlighted.

  The same process can be performed with a computer, using various com-

  puter-aided design (CAD) tools and programs (such as Visio®, IntelliVIEW®, and other commercially available programs). The important points of developing a VIA chart and library are as follows:

  1. Determine the important elements and data in reports, documents,

  and other information from the case library:

  a. Does this information relate to the incident in question?

  b. Does this information provide a who, what, when, where, why, or how?

  c. Does this information build upon another known or suspected

  key element?

  2. Summarize information into 50 words or less (for each element or

  key point):

&nbs
p; a. The index card’s upper line might show who gave the data

  (W = Witness, I = Informant, V = Victim, O = Officer, etc., fol-

  lowed by the name).

  b. The bottom line might show when—day, date, time, and binder

  and page numbers.

  3. Link the nexus between activities when dates, times, and other ele-

  mental details are unclear, ambiguous, or missing.

  208

  Advanced Criminal Investigations and Intelligence Operations

  The VIA process should not be viewed as individual steps, but as a continuous process like the intel igence cycle itself. However, the tasks in the VIA process include the following:

  • Confer with the client/consumer for planning and direction (trial attorney or intelligence consumer) on the EEIs.

  • Collect source documents; collection.

  • Develop the case library (documentation).

  • Conduct first reading of source documents.

  • Conduct second reading of source documents.

  • Create index cards ( processing) (Figure 12.6).

  • Compare and edit materials.

  • Conduct index card analysis ( analysis).

  • Take the information from the reading and rereading of the

  source documents of the case library and write each activity on

  an individual index card.

  • Study the index cards to determine which event and card most

  likely starts the network and which one is the logical conclusion.

  • Arrange the remaining cards in a logical chain of activity

  (sequential, if possible).

  − Activity flow (sequential and logical)

  − Parallel activity (simultaneous)

  − Activity display— nodes

  W = witness

  I = informant

  V = victim

  O = officer

  Source name

  Activity description

  Date

  Time

  Page

  Binder number

  number

  Figure 12.6 VIA index cards.

  Intelligence Files and Analytical Investigative Methods

  209

  • Create chart (attaching information from index cards) ( analysis and production).

  • Use Network Logic to show each nexus.

  • What activities precede the next one (logical sequence)?

  • What activities are concurrent with this one (simultaneous)?

  • What activities follow this one (continuing logical sequence)?

  (Morris, 1982, p. 16)

  • Create arrows and nodes (arranged to show the logical sequence of activities and their relationship) and assign reference numbers

  (to source binders and pages from the case library) ( analysis and production).

  • Use symbols to represent information in the network and on the

  chart.

  • Each arrow represents one activity (any portion of the case analysis that consumes time and/or resources and has a definable

  beginning and end).

  • A circle or node, between the arrows, denotes the start and stop of an activity. These event nodes consume no time or

  resources.

  • Every activity in a network must be preceded and succeeded by

  an event node (except the conclusion of the chart); there can only

  be one activity between every two nodes.

  • A burst (depicted by vertical sets of event nodes) is the initiation of two or more activities.

  • A merge depicts the completion of two or more activities.

  • The end of a VIA chart is signified by a triangle (the termination symbol) (Figure 12.7) (Morris, 1282, pp. 19–20, 22).

  • Create activity and dummy lines (analysis and production).

  • An activity arrow (mentioned earlier) represents one activity.

  • A dummy line is represented by a dotted arrow and represents an activity that consumes no time.

  − It maintains network continuity and logic by indicating that,

  while a relationship exists between two activities, it does not

  warrant the strength of a solid line arrow.

  − The dotted dummy line completes a straggler line by attach-

  ing it to something—a continuing solid line (Figure 12.8)

  (Morris, 1982, pp. 20–22).

  • Confer (again) with the client/consumer on the progress from

  the planning and direction phase (trial attorney or intelligence consumer).

  210

  Advanced Criminal Investigations and Intelligence Operations

  Event 1

  Event 2

  Event 3

  Event 4

  Event 5

  5

  10

  15

  20

  25

  12/07

  12/14

  12/24

  12/26

  01/01

  Activity

  Dummy

  21 Node

  Flowchart or link diagram

  71

  Terminal

  Legend

  Figure 12.7 Flowchart or link diagram.

  Node

  Node

  Termination

  Node

  Figure 12.8 Nodes, activity lines, dummy lines, and termination.

  • Finish drafting and finalizing (inking, if manual y constructed) the

  chart.

  • Number each node or circle (in increments of five or more along the main line to allow for upgrades) for reference to points of

  interest.

  • No two nodes should have the same number except fragnets and

  subnets (Figure 12.9) (Morris, 1982, p. 22).

  • Attach information from index cards (with tape, if manually

  constructed).

  • Create a legend (of symbols), title, and credits (of who drafted the chart).

  Intelligence Files and Analytical Investigative Methods

  211

  5

  1 Event#2

  Event#3

  11/16/2013

  11/17/2013

  2

  Individuals

  Event#1

  involved

  Decision

  11/14/2013

  point

  4

  6

  Start

  Event#2

  Event#4

  Finish

  11/16/2013

  11/17/2013

  11/14/2013

  02/23/2014

  3

  7

  Event#1

  Event#3

  Decision

  11/14/2013

  11/17/2013

  point

  Individuals

  Individuals

  involved

  involved

  Video

  Video

  Documents:

  1. Receipt

  4. Cash deposit slip

  7. Video tape and cash

  2. Credit card payment 5. Receipt

  receipts

  3. Video tape

  6. Credit card payment

  Figure 12.9 Network diagram.

  • Develop fragnets and subnets, used to expand a complex chart.

  • Fragnets are an expansion that occurs as an appendage (for smal er amounts of information) on the face or surface of the original chart.

  − It is usual y small (one to five activities) and always relates

  directly to one activity between two nodes on the original chart.

  − It is depicted by dotted lines, without arrow heads, attached to

  each end of the fragnet and to the nodes on the original chart.

  − Node numbering in the fragnet begins with the first node

  number to be fragneted on the original chart and ends with

  the next node number to the right (Morris, 1982, p. 23).

 
; • Subnets resemble a fragnet but are displayed on an independent chart and usually represent large amounts of information or

  numbers of activities.

  − It is usually represented as a separate chart of its own, often

  after the completion of the original (main) chart. (When

  created on a computer, it may be embedded and brought up,

  opened, or enlarged with a click.)

  − It follows the numbering of the original chart. (It begins with

  the first node number to be subnetted on the original chart

  and ends with the next node number to the right.) (Morris,

  1982, p. 23).

  212

  Advanced Criminal Investigations and Intelligence Operations

  • Conduct a final review with the client/consumer for planning and

  direction (trial attorney or intelligence consumer) ( dissemination and feedback).

  The use of computers can greatly simplify this process, especially the use of fragnets and subnets. The final draft of the chart can be copied using the trace paper or saved as a computer document, using overlays. Charts may then be present using presentation software, such as PowerPoint®.

  Financial Information

  Single-entry bookkeeping refers to the entry of information from all sources in one place without making an effort to balance the records. Double-entry bookkeeping refers to a system in which every transaction affects two or more accounts (with equal debits or credits) and is recorded in these accounts.

  Two or more adjustments must be made (never only one) and, in summary

  form, shows the results of many transactions and the force affecting the

  organization.

  Fundamental Equation

  Assets (items of value) = claims assets = Liabilities and Capital

  A − L = C

  Accounting Cycle

  1.

  Journalizing—analyzing and recording transactions in a journal 2.

  Posting—copying the debits and credits of journal entries into the ledger accounts

  3.

  Preparing a trial balance—summarizing the ledger accounts and

  testing the recording accuracy

  4. Constructing a work sheet:

  a. Affecting the adjustments without making entries in the account

  b. Sorting the account balances into

  i. Balance sheet