Law Enforcement Executive FORUM
The Impact of Emerging Science and Technology on Law Enforcement Agencies
August 2002 Illinois Law Enforcement Executive Forum Illinois Law Enforcement Training and Standards Board in cooperation with Western Illinois University Macomb, IL 61455
Senior Editor Thomas J. Jurkanin, PhD
Editor Vladimir A. Sergevnin, PhD
Associate Editors Steven Allendorf Sheriff, Jo Daviess County Barry Anderson, JD Department of Law Enforcement and Justice Administration Western Illinois University Dennis Bowman Department of Law Enforcement and Justice Administration Western Illinois University Thomas Ellsworth Chair, Department of Criminal Justice Sciences Illinois State University Oliver Clark Chief of Police, University of Illinois Police Department Steven Cox, PhD Department of Law Enforcement and Justice Administration Western Illinois University John Millner Chief of Police, Elmhurst Police Department Gene Scaramella, EdD Department of Law Enforcement and Justice Administration Western Illinois University
Editorial Production Curriculum Publications Clearinghouse, Macomb, Illinois
Production Assistant Linda Brines
The Illinois Law Enforcement Executive Forum is published five times a year by the Illinois Law Enforcement Training and Standards Board’s Executive Institute. The journal is sponsored by Western Illinois University in Macomb, Illinois.
Institutional Subscription: $40 Personal Subscription: $25
No part of this publication may be reproduced without written permission of the publisher.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) Disclaimer Reasonable effort has been made to make the articles herein accurate and consistent. Please address questions about individual articles to their respective author(s).
Illinois Law Enforcement Executive Forum • 2002 • 2(3) Table of Contents
Editorial ...... i Thomas J. Jurkanin
DNA Forensic Analysis DNA Technology: Development, Applications and Potential, Current Reality ...... 1 R.E. Gaensslen
Forensic DNA Profiling – Beyond Identification ...... 13 Simon J. Walsh Claude Roux Alastair Ross Olivier Ribaux John S. Buckleton
Technology and Training Hold Hands . . . Almost ...... 23 Clydell Morgan
Cyber-Crimes Law Enforcement Response to Computer Crimes – St. Louis Regional Response ...... 27 Detective Kenneth Nix
Components of a Successful Forensic Computer Exam ...... 35 Ron Weiss, Jr.
Vision for Cyber-Crime Investigations ...... 41 Allen E. Jones
Cyber Child Sex Offender Typology ...... 53 James F. McLaughlin
Technophilia: A Modern Day Paraphilia ...... 61 James F. McLaughlin
Steganography: New High-Tech Tool for the Perfect Cyber-Crime ...... 71 Mark Edmead
Digital Imaging Applying Digital Imaging Technology to Domestic Violence and No-Drop Policies ...... 75 Leigha Stroud
Language and Voice Analyzing Language as Clue: Authorship Identification in an Electronic Society ...... 83 Carole E. Chaski
Illinois Law Enforcement Executive Forum • 2002 • 2(3) Policy Review: CVSA Is a Valid Law Enforcement Tool ...... 95 Hugh Wilson Ridelhuber Patrick Flood
Emerging Technologies and Training Emerging Technologies and Law Enforcement Training: Building a Technology-Competent Police Force ...... 101 Thomas J. Jurkanin Vladimir A. Sergevnin
Internet-Based Distance Learning: Implications of Emerging Technologies for Public Safety Training ...... 109 Rob Miller
Formal Training Is Only Part of the Solution ...... 121 Richard Pigeon
Bang-Bang You’re Dead: A Case for Using Simulation in 911 Training ...... 125 Sue Pivetta
Electronic and Video Surveillance Communication Assistance for Law Enforcement Act (CALEA) ...... 129 Michael P. Clifford
Surveillance Videos ...... 137 Jack Jacobia
Courts Making Technology Work for the State Courts ...... 143 Hugh Collins Robert Wessels Tom Henderson
Expert Testimony Seeing Is Believing - Exhibits from the Perspective of the Forensic Document Examiner ...... 151 Emily J. Will
Strategic Planning and Technology Viewing Technology as an Obstacle to Law Enforcement Strategic Planning ...... 159 Michael A. Blazek
Chemical Analysis Liquid Phase Chemiluminescence: Potential for Forensic Analysis ...... 167 Simon W. Lewis
Illinois Law Enforcement Executive Forum • 2002 • 2(3) Anthrax Insider Diversion: Profiling the Anthrax Attacks ...... 181 Paul De Armond
Police Tactical Models A Tactical Model for High-Risk Warrant Service ...... 189 Homer C. Hawkins Catherine L. Montsinger
Materials/publications are available through the Illinois Law Enforcement Executive Institute.
Illinois Law Enforcement Executive Forum • 2002 • 2(3)
Editorial
Technological innovation has dramatically impacted police operations and methods used to combat crime. DNA, digital imaging, and electronic and video surveillance have improved the capacity of police, while cyber and electronic crime have offered new challenges. It is critical that law enforcement continues to assess how new science and technology might be employed within the work environment to enhance and promote public safety.
Employment of technology is expensive and demands proper training for agency personnel. The majority of law enforcement agencies in the United States are small and often lack the financial resources necessary to employ the latest technology. Sharing of technological resources among a number of agencies is a viable alternative.
This edition of the Forum focuses on crime and technology. The authors of this edition provide thought, expertise, and guidance useful in understanding the application potential of new and emerging technologies. Technological change is occurring at an ever-increasing rate, and it is our hope that this edition provides the law enforcement administrator with a broad-based understanding of technology application and potential.
Thomas J. Jurkanin, PhD Executive Director Illinois Law Enforcement Training and Standards Board
Illinois Law Enforcement Executive Forum • 2002 • 2(3) i ii Illinois Law Enforcement Executive Forum • 2002 • 2(3) DNA Technology: Development, Applications and Potential, Current Reality
R. E. Gaensslen, PhD Professor; Director of Graduate Studies; Head of Forensic Science Program University of Illinois at Chicago
Forensic Science – Forensic Biology We should look at DNA technology in the overall context of forensic sciences. Often defined as the “application of natural sciences to matters of law,” forensic science includes medicine, dentistry, toxicology, physical anthropology, psychiatry, questioned documents, firearms, tool marks, fingerprints, engineering, criminalistics, and some other subspecialties. “Criminalistics” can be thought of as encompassing the activities that go on in a modern forensic science laboratory. Generally, this means the scientific analysis and evaluation of physical evidence. Full-service forensic science laboratories usually provide analyses in the areas of chemistry (drug identification), toxicology, pattern evidence (firearms and tool mark identification, fingerprints, documents), trace evidence (glass, soil, paint, gunshot residue, etc.) and forensic biology. Forensic biology is the subject of this article.
It has always been the objective of forensic scientists to identify, then to individualize biological evidence like blood and semen. Identification tests are still part of the examination. That is, the analyst uses various tests to identify that a specimen is blood, semen, saliva, and so on. These tests are commonly done in connection with a thorough search of the evidence. The location of biological evidence on clothing or other items is not always obvious, and locating and identifying biological stains and traces on evidentiary items comprises the initial part of any forensic examination.
The next part is to try to “individualize” the specimen. Strictly speaking, individualization means being able to say something like “This bloodstain represents the blood of John Smith, and no one else,” or “The semen found on the vaginal swab in this case can only be from John Jones and no one else.” Individualization in that strict sense has never been achieved, but DNA typing comes close. Before DNA typing, forensic scientists used blood types and other blood and physiological fluid components to help narrow down the pool of possible depositors, but even in the best circumstances, there were still many possible sources of the evidence. The only “individualizing” analysis used on biological evidence in forensic laboratories today is DNA typing. It had replaced all of the older methods by the late 1980s.
Development of DNA Typing – Three “Generations” of Technology Scientists knew that DNA was the essential genetic material of living organisms for most of the 20th century. The chemical structure of DNA was worked out
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 1 in the 1950s by Watson and Crick. It was clear that every organism, including every person, had a different, unique DNA base sequence, and that all the genetic differences between individuals were the result of variations in DNA sequence. The laboratory tools for studying and easily exploiting these differences for various research and clinical and forensic purposes, however, were not widely available until the 1980s. Four different bases that we can call A, T, C, and G make up DNA. The bases are linked together in linear order in very long strands. Human beings have about 3 1/2 billion bases in their DNA.
In the 1980s, Sir Alec Jeffreys in the U.K. and others first published papers showing that certain regions of the human DNA complement differed from person to person in a way that could be detected fairly easily (Jeffreys, Wilson, & Thein, 1985a; Jeffreys, Wilson, & Thein, 1985b). The British group used the technique to help authorities sort out an immigration case (Jeffreys, Brookfield, & Semeonoff, 1985). They also helped British police solve a double sexual assault-murder case in a village called Narborough, firmly establishing DNA typing as a valuable forensic technique. This case was also the first instance of what today would be called a “DNA dragnet,” in which police collect known biological specimens from a large number of potential suspects and compare DNA types with those of the crime evidence (Wambaugh, 1989). In the United States, there would be search and seizure issues to resolve in connection with such a procedure. In the Narborough case, the British police did not compel anyone to provide a specimen. They did feel free to draw appropriate inferences concerning those who would not though. The case was actually solved because the perpetrator paid someone to show up and provide his known specimen, and the surrogate told the police.
DNA typing has gone through several big changes in technology since it first came into use in forensic science. There have been three “generations” of DNA typing technology. We can call these RFLP, PCR-dot-blot, and STR.
Forensic DNA typing was and is based on the discovery that a substantial portion of human DNA contains repetitive sequences. Some of these repetitive sequences are head-to-tail and in linear order. The repeating “unit” can be as short as two bases and as long as 50 or 60. Different people have different numbers of these repeat sequence “cassettes.” Each person has inherited half of his or her DNA from the mother and half from the father, so each person has two of the repeat sequences at every region of DNA where they exist. The first forensic DNA typing procedure, RFLP, allowed scientists to estimate the sizes of the repeat sequence pieces in five or six regions of human DNA. Each of the repeat sequence regions of human DNA is independently inherited; that is to say what we inherit at the first region has no influence on what we inherit at the second region and so on. If we know the frequencies of DNA types in the different regions from doing population typing studies, we can figure out the approximate frequency of a whole DNA profile (a set of types from one person at the different regions). Because of the independent inheritance, the overall frequency can be figured out by multiplying together the individual type frequencies. It is similar to throwing several dice independently. The chances of one die coming up 6 is 1/6. The chances of three dice all coming up 6 is 1/6 x 1/6 x 1/6 or 1/216. The more dice that are thrown, the smaller the chance they’ll all come up 6. With DNA, the type in one region might have a frequency of 10%, but if the DNA profile consisted of types at six regions, each of which had a frequency of 10%, the overall chances of a chance
2 Illinois Law Enforcement Executive Forum • 2002 • 2(3) duplicate are only one in a million. DNA scientists call the different regions loci (Latin for place). Many of the individual types at the loci used for RFLP typing had frequencies of well under 10%. So the overall chances of duplication of the DNA profiles were usually less than one in a million. We will come back to the “numbers” issue and how DNA individualizes biological evidence later.
The second “generation” of forensic DNA typing was different from the first. First, it detected sequence differences in DNA rather than differences in repeat sequence segment sizes, but perhaps more significantly, it was based on a procedure called “PCR.” First worked out by scientists at the Cetus Corporation in California (that later became Roche Molecular Systems), PCR is a technique for making huge numbers of copies of a small segment of DNA. Being able to incorporate PCR into DNA typing revolutionized forensic DNA typing. Where RFLP required the DNA to be pretty much intact, PCR can be used on DNA specimens that are significantly degraded (as forensic evidence specimens often are). Furthermore, PCR techniques are routinely successful on quantities of DNA 1/200 to 1/300 of those usually required for success with RFLP procedures. Finally, PCR techniques are much faster than RFLP ones. All of these features are desirable in the context of forensic work. Cetus designed and marketed typing kits based on “dot blot” methods for the testing laboratories. The end result of this typing technique was a nylon strip several inches long with a series of bluish “dots” developed on it. The dot pattern provided the DNA type. One strip was used to type a single DNA region (locus) called HLA-DQA1. Later, another strip was developed to type five more regions. Most people called the second strip “polymarker.” These procedures were widely used for several years because they were based on PCR and were thus applicable to smaller quantities of and more degraded biological evidence specimens. The HLA-DQA1-Polymarker typing combination usually gives a profile with a much lower probability of chance duplication than does RFLP, that is, many more people typically share a HLA-DQA1-Polymarker profile than share a RFLP profile. In the late 1980s and early 1990s, labs often ran RFLP tests first and then did HLA-DQA1-Polymarker if the RFLP was unsatisfactory because of too little DNA or degradation. The reason for this was, first, that RFLP profiles provided better individualization, and second, that DNA databases and databanks were originally built with RFLP profiles (more about databases later).
The third (and current) “generation” of DNA typing technologies took shape in the early 1990s and essentially all forensic DNA typing laboratories use it now. It was clear by 1990 that RFLP typing, though robust and highly individualizing, did not have the appropriate characteristics for widespread forensic DNA typing. It was way too slow. It required too much of a biological specimen (more than was available in some cases), and, it didn’t work if a specimen’s DNA was degraded, as it can be in biological evidence. A group of forensic laboratories involved in DNA typing, led by the FBI Laboratory and with the cooperation of the primary technology-producing companies (primarily Perkin-Elmer and Applied Biosystems, which later became Applera Corp., and Promega Corp.), developed a consensus profiling system. The system is based on typing 13 separate regions (loci) within DNA and on PCR and is designed to be amenable to automation and high-throughput specimen handling. As we will discuss shortly, speed and specimen processing without sacrificing accuracy are the principal features currently important in forensic DNA typing.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 3 The 13 regions (loci) selected for this current technology are called “STR” regions. “STR” stands for “short tandem repeat.” Above, we noted that the regions of DNA used for forensic DNA typing (i.e., for human identification applications) are head-to-tail tandemly repeated sequences. People differ in the number of times the sequence is repeated. There are huge numbers of these “variable number of tandem repeat” regions in human DNA. The ones picked for the current DNA profiling method are “short” (i.e., the repeat unit is four or five bases). “Why 13?” you could reasonably ask. Below, we will further develop how multiple locus DNA typing leads to profiles that are increasingly “individual” as you type more and more loci. Thirteen is not a magic number, but it represents a large enough number of repeat regions so that there should be very few or no duplicates in the databases, even when the number of profiles in those databases grows into the millions, as it inevitably will. We will say more about databanks and databases and why duplicates are undesirable below.
Applications and Potential of DNA Typing
How Does Typing Multiple DNA Regions (loci) “Individualize” a Specimen? Table 1 illustrates the way this process works. The table is intended to be illustrative, so we have oversimplified it. Real DNA loci have more arcane names, such as THO1, D7S820, and D8S1179. Also, “types” are often two numbers separated by a comma; “8,12” for example indicates that the person has 8 repeats on one chromosome and 12 on the other. This person inherited one of these chromosomes from his or her mother and the other from his or her father. You can inherit the same number of repeats at a locus from each parent.
You can see from Table 1 that typing eight loci gives a probability of chance duplication about five times greater than the U.S. population. Accordingly, an argument can be made for “individuality” at this level. These numbers are estimates based on samples of the population. They are not actual measurements based on typing the entire population. Thus, even though there is a very small chance of a duplicate in the population, there could still be one. Because true individuality cannot be demonstrated, DNA scientists usually quote the probabilities of chance duplication of a profile in a “match” case. That is, lab reports typically have numbers like those shown in Table 1. There has been discussion about reporting and testifying as to individuality when the reciprocal probabilities of chance match greatly exceed the size of the population. So far, however, only the FBI Laboratory reports and testifies as to “origin” (the specimen originated from John Smith to a reasonable degree of scientific certainty) if certain statistical genetic criteria are met by a particular profile.
It is worth noting here that major racial/ethnic subdivisions within the population typically exhibit different type frequencies at the same loci. From a genetic standpoint, these differences are not surprising. Forensic laboratories have routinely collected separate specimens from these major groups (such as Caucasian, African-American, Chinese, etc.) and set up separate population databases for them. Labs then generally report the probabilities of a chance match for all the major groups in their population database. It should be clear that the racial or ethnic origin of the true depositor is unknown.
4 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Table 1 How Multiple Locus DNA Typing Leads to Increasing “Individuality” Cumulative Cumulative Individual Frequency Frequency Frequency in the in the Locus Type Population Population Frequency (1 in.)
1 4 0.10 0.1 10 2 10 0.05 0.005 200 3 12 0.10 0.0005 2,000 4 7 0.05 0.000025 40,000 5 3 0.10 0.0000025 400,000 6 6 0.05 0.000000125 8,000,000 7 9 0.10 0.0000000125 80,000,000 8 1 0.05 0.000000000625 1,600,000,000 9 8 0.10 0.0000000000625 16,000,000,000 10 2 0.05 0.000000000003125 320,000,000,000
The table shows how using ten different and independent DNA regions to develop a profile leads to greater and greater individualization as the number of loci increases. The DNA loci are arbitrarily called 1 through 10. At each locus, the specimen has a “type.” Here, we have arbitrarily designated these as numbers from 1 up to 12. In this illustration, suppose that the types have frequencies in the population of either 5% or 10%. Thus, for example, “type 4” at the first locus is seen in 10% of the population. The other 90% of the population shows other types. Similarly, 5% of the population show “type 10” at locus 2, etc.
DNA loci used in forensic testing are independent. As a result, the individual frequencies can be multiplied together to get the cumulative frequency. Thus, if only locus 1 had been typed, the specimen would occur in about 0.1 or 1 in 10 people. Typing locus 1 and locus 2 brings the universe of possible donors down to 0.005 or 1 in 200 and so forth. By the time all 10 loci have been typed, the profile is expected to occur in only 1 in 320 billion people. There are around 5-6 billion people on earth, so this profile is not expected to be found in anyone else.
Where DNA Is Found in the Body – the Kinds of Evidence for Which DNA Is Useful DNA is found in the nucleus of cells, and almost every kind of cell in the body has a nucleus. So, DNA can come from almost any tissue or organ and from fluids that contain cells. The most commonly encountered types of biological evidence are blood and semen. Blood is commonly shed in violent crimes, and semen is commonly seen in sexual assault cases. DNA can also be recovered from saliva, sometimes from urine, and from any internal organ or tissue. Successful DNA typing has been reported in finger- and toenails, hair roots, fingerprint residues on sticky tapes, and dandruff particles. There is often enough cellular debris on a person’s tooth brush to yield his or her DNA profile.
One of the reasons DNA typing has achieved such a high profile with law enforcement in the last few years is because biological evidence or biological traces may be encountered in many types of cases not just the obvious ones.
Databases, Databanks, and CODIS DNA types and combinations of types (DNA profiles) can be expressed as a series of numbers of letters and are thus easily amenable to electronic storage and retrieval.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 5 Just as fingerprint records are kept on various persons, DNA profile records can also be valuable to law enforcement and for other human identification applications. In the U.S., there is considerable concern about privacy in the context of collecting and/or storing any information about a person’s DNA. This concern has to do primarily with knowledge about appearance, health status, risk for disease, and other such information that might be gained from a person’s DNA. Because forensic DNA typing takes advantage of tandemly repeated sequences in DNA that do not have any known function, privacy concerns about forensic databanks are lessened.
State and federal legislation in the U.S. permits the collection and storage of DNA profiles from convicted offenders. Every state controls through its laws which offenses warrant putting someone’s DNA profile into the known offender file. It is generally fair to say that every state databanks felony sexual assault offenders. Some states databank all felony offenders. States vary as to how far back the conviction can go before the person’s profile is data banked. There are also differences concerning juvenile offenders. It is probably fair to say that the trend in recent years has been to expand rather than to limit the universe of offenders whose DNA profiles are data banked.
The name given to this interconnected (local, state, and federal) system of databanks is CODIS—the Combined DNA Indexing System. The acronyms SDIS (for a statewide system) and LDIS (for a local file) are also used. CODIS was conceived almost as soon as DNA typing became a reality. A group of forensic scientists, representing the main DNA typing laboratories, was organized by the FBI Laboratory early in the development of forensic DNA typing. Known as the Technical Working Group on DNA Analysis Methods (TWGDAM), this body reached agreements on procedures and quality control guidelines and on the DNA typing technology that all of them would use to make data sharing through CODIS possible. In the late 1980s when RFLP was the routine technology, there was a small number of laboratories involved in the design and testing of CODIS, and all the data in the files came from RFLP typing. The Illinois State Police Forensic Science Command was an original member of TWGDAM and of the CODIS network. Because it was clear that a much higher throughput typing technology, based on PCR but highly individualizing, would soon be developed, the dot-blot technologies (described above as the second generation of technology) were never used for databanks. Once the current STR technology was developed and validated, laboratories had to go through the laborious and expensive process of redoing all the databank specimens. In order to use the databanks to search for profiles, they must have been developed with the same DNA technology that was used to get the unknown profile type. That is, you can’t search an RFLP databank for a profile developed with STRs, and you can’t “convert” an RFLP databank to a STR databank. You have to go back and retype every specimen using the STR technology. Thus, DNA technology changes are very costly and time-consuming to implement, not only because of training and validation for casework, but because the databanks must be redone.
To some extent, you can plan ahead when you plan a data bank as to how much duplication you will have in the file. Given some upper limit on the number of profiles that will be entered into the databank, you can select the number of DNA regions (loci) that will be typed such that you end up with quite a few duplicates, some duplicates, or almost none. The choice represents a cost trade off of sorts. On one hand, it is cheaper to type fewer loci, but with fewer loci, you will eventually have duplicates in the data bank. When an unknown profile from a case matches
6 Illinois Law Enforcement Executive Forum • 2002 • 2(3) one of these duplicated profiles, investigators must then sort through the people identified from the databank to find the most logical suspect. On the other hand, using more loci minimizes or eliminates duplicate profiles in the databank but is more expensive to set up, and more loci must be typed in casework to enable searching. Under these conditions, however, when you do get a databank match, there is a very high probability it is the same person. In the United States, the choice was made to use more loci and minimize the duplicate profiles. Calculations from preliminary population type data indicated that the 13 loci ultimately chosen would provide a good balance between nonduplication in the databases and reasonable cost structure. Further, cooperation with the commercial vendors resulted in their being able to market two PCR systems for all the loci. Using one kit, nine regions (loci) are typed simultaneously, so the labs need two typing “kits” to do all 13 regions. The 13 loci used in the U.S. forensic labs are often called the “core CODIS loci.”
The ability to set up databanks and databases is one of the major attractions of DNA technology. “Databanks” often refer to the convicted offender file, while “databases” often refer to the profiles from unsolved cases. We should look at DNA databases as a specific example of the more general practice of setting up known and unsolved-case files for forensic and law enforcement purposes. Figure 1 illustrates the general principles. There are currently three major classes of evidence in these electronic files: DNA profiles (CODIS), fingerprint files (AFIS), and bullet and cartridge case image files (IBIS).
Figure 1 Forensic Evidence Electronic Storage and Retrieval Systems
New Unknown Pattern or Profile
QUERY for match QUERY for match with a pattern or profile with a known from an unsolved case
KNOWNS FILE FORENSIC FILE
Patterns or Profiles Patterns or Profiles from Known Sources from Unsolved Cases
Reference List
There are currently three categories of evidence for which large electronic databases are maintained: (1) DNA profiles, (2) fingerprints, and (3) bullets/cartridge case images. They are all used essentially the same way. The “Knowns” file is populated with profiles or images from known persons or firearms. The “Forensic” file consists of profiles or images from casework for which no suspect (or source firearm) has been developed and which have no match in the “knowns” file. Any new profile or image can be searched
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 7 in the “knowns” file. If it is found, the person or firearm from which it came is identified. If no match is found, the profile or image can be searched in the “forensic” file to see whether it has come up in any unsolved cases. The system used for DNA profiles is called CODIS.
As the size of the databanks have grown and as more and more labs have gotten into DNA typing and joined the CODIS system, so-called “cold hits” have become fairly routine. A cold hit describes a situation when a lab searches the convicted offender databanks for a profile it has developed in an unsolved case and finds a match. Although most hits are local, as would be expected, there are occasional cross-state matches. In addition, the “forensic” files—the ones that contain profiles from unsolved cases—are becoming more and more useful to investigators. Using these files, unsolved cases can be linked even if investigators did not previously suspect one. They can also show that cases thought to be linked are not.
As noted, the trend has been for legislatures to pass laws expanding the convicted offender databank programs. Here in Illinois, for example, the legislature passed a bill in the just-completed session that would expand databanking to all convicted felons. Sometimes, legislatures pass laws expanding the databank program without providing any additional resources to the forensic science labs. That can add to the backlog problem (discussed further below).
In the U.K., unlike in the U.S., arrestees and even suspects are DNA profiled and entered into databanks. That experience indicates that the hit rate is considerably higher than it is here, where only convicted offenders are entered into the “known” files. Expanding the laws to enable databanking arrestees and/or suspects has been suggested by various public and law enforcement officials, including the Chicago Police Superintendent (DNA tests urged, 2002), but there remains significant resistance to this practice in the U.S.
Inclusions/Exclusions When the DNA profile of a specimen from casework is compared with that of a known person, the profiles either match or do not match. We have so far made reference to situations in which there was a DNA match; however, exclusions are just as important to the criminal justice system as inclusions. The current technology approximates individuality in a match case, but by the same token, the chances of a true nondepositor being excluded are likewise nearly guaranteed.
In Illinois, there have been a number of examples of convicted offenders, some on death row, being excluded by DNA typing when their DNA profiles failed to match those of the evidence specimen profile(s). Exclusions of suspects in sexual assault cases, even when the person is a good suspect by other criteria, are now fairly routine (DNA test frees, 2002). Nationally, dozens of convicted persons have been released following DNA exclusions.
Applicability to Many Types of Cases Another factor in the growth of DNA typing is its applicability to several types of cases and situations outside the criminal context. DNA typing is now used exclusively in parentage testing, and the results are considered definitive. Most of the time, parentage cases are civil, but occasionally, a sexual assault can result
8 Illinois Law Enforcement Executive Forum • 2002 • 2(3) in a pregnancy, and parentage testing may be attempted to support the criminal charge. In mass disasters, DNA typing can be used to help identify victims. DNA typing has been extensively used recently in helping identify remains in the Oklahoma City bombing, the crashes of TWA 800 in Long Island sound, the Swiss Air jet near Newfoundland, and of Egypt Air 990. Most recently, DNA typing is being used to help identify over 17,000 body parts recovered from the World Trade Center attacks (Pieces, 2002). It cannot be too strongly emphasized that DNA typing should be seen as a last resort method of human identification in mass disasters and that it is exceedingly slow and expensive. In the World Trade Center case, 350 identifications had been made as of May 31, 2002 by DNA alone (out of 1,102 total victims identified).
DNA typing is also potentially applicable in criminal cases outside the traditional bloodshed and sexual assault categories. Any kind of biological evidence can in theory be used to associate or dissociate a person with an evidence item or a place. As labs begin to catch up with their casework and databanking demands, more of these kinds of cases will be submitted and analyzed.
New and Developing Methods of Forensic DNA Typing Two newer and developing DNA technologies should be mentioned. The first is mitochondrial DNA (mt-DNA) typing or mitotyping. Mitochondria are small structures in human cells that have their own complement of DNA (different from the nuclear DNA). Many mitochondria are present in each cell. Thus, mt-DNA is present in each cell in many copies. This multiple copy feature of mt-DNA sequences has advantages for forensic testing. Since there are many copies of a sequence, there is a greater chance of detecting a mitotype in a limited specimen. Total mt-DNA is much lower than nuclear DNA. Where there are about 3.5 billion bases in the nuclear genome, there are only about 16,000 bases in mt-DNA. Mt-DNA does show variation in certain regions among different people, and these differences can be helpful in human identification, but nowhere near the degree of individualization is possible with mt-DNA as is possible using nuclear DNA. One of the greatest current uses of mitotyping is the identification of human remains. Mt-DNA is inherited in a strict mother-to-child manner, and comparisons can be made between an unknown specimen and any available relative of the suspected person who is in a maternal lineage. This technique is routinely used by the Department of Defense DNA Laboratory (that is associated with the Armed Forces Institute of Pathology). Their primary mission is identification of remains of U.S. military personnel recovered from war theaters.
Another potentially useful application of mt-DNA typing is in hair comparisons. For years, forensic hair comparisons were based on microscopic structure. Most forensic scientists now agree that the microscopical method leaves much to be desired in terms of its value. A recent report in the print news indicated that of a little more than 100 post-conviction DNA exclusions nationwide, more than a quarter of the original convictions were based at least in part on hair comparison matches (Hair-matching, 2002). Mt-DNA can be isolated from hair shafts, however (where nuclear DNA cannot—it can only be isolated from hair roots). In some cases, mitotyping may thus be possible in hairs without roots, and these are the most commonly encountered ones in criminal investigations.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 9 It should be noted that mitotyping is by no means a routine forensic laboratory technique. The majority of labs do not even attempt it. It is done in a few highly specialized laboratories at present. Mt-DNA typing is actually base sequencing, a technology somewhat different than the forensic DNA typing techniques we have described thus far. Furthermore, mt-DNA typing is extraordinarily subject to contamination problems, requiring laboratories that do mitotyping to take extreme measures to avoid them.
Another DNA typing technique that is perhaps “just around the corner” is Y-chromosome typing. In humans, every cell has 46 chromosomes, and 44 of them represent pairs. The remaining two are the sex chromosomes. Women have two X, and men have one X and one Y. One problem that can come up in the DNA typing of sexual assault evidence is ending up with a mixture of the male and the female DNA. When that happens, interpretation of the typing results is more complicated. Y-chromosomes have a number of STR regions that can be typed using methods exactly like those used for the 13 core CODIS regions. In case specimens from sexual assaults, Y-chromosome typing can be used to discern only the male’s types, thus getting around the mixture problem that can occur using present techniques. It will be a while before Y-typing is routine or common, but a number of labs are active in its development.
The Current Situation The rapidly changing landscape of DNA database laws was discussed briefly above. Generally, the trend is to expand the universe of convicted offenders who are subject to databasing. Legislatures are grappling with the effect their actions may have on backlogs. They must also decide whether to include juvenile offenders, those who serve only jail time, or those who are placed on probation in lieu of jail or prison time. In addition, legislatures are also trying to decide what to do about compelling convicted offenders who are legally required to provide a specimen to do so when they refuse to cooperate.
Many DNA cases are sexual assaults. At one time, most states had statutes of limitation on the prosecution of sexual assaults, but DNA technology has changed the way states look at this matter too. There are many examples of DNA profile matches of a convicted offender (or a newly arrested suspect in a current case) and an old, unsolved sexual assault case or cases. A number of states including Illinois have taken steps to lengthen or remove the statute of limitation on sexual assaults. Another strategy that has been used by prosecutors to get around the statute of limitation problem—though it has not been thoroughly tested in the courts as yet—is indictment of a “John Doe” who is the owner of a specified DNA profile (the one developed in the evidence that must come from the male).
The biggest issue currently facing all the government forensic laboratories is databanking and casework backlogs. The labs have been faced in the past decade with an unprecedented deluge of convicted offender specimens to be profiled for the databank and of biological evidence from cases for DNA typing. As legislatures have expanded the convicted offender programs, the volume of specimens has increased. In the midst of this, the technology has undergone two major changes. Each change has required investment in new instruments, new kinds of testing kits, new validations, and considerable analyst training. In addition, the convicted
10 Illinois Law Enforcement Executive Forum • 2002 • 2(3) offender data banks had to be retyped in the switchover from RFLP to STR technology. Another factor in some jurisdictions has been the initiative to go back and screen stored sexual assault evidence kits using DNA typing. Many of these kits had never been submitted to the forensic lab, and many of the kits that had been submitted to a forensic lab had not been subjected to any analysis. Before DNA typing, labs could not provide convincing inclusions in sexual assault cases, even when all the genetic factors tested at the time matched. As a result, in many places, the kits were not analyzed by the lab unless the case was being readied for trial (a relatively uncommon event). If the case had not led to an arrest or was not otherwise active, investigators sometimes never submitted the kits. With DNA technology, people realized that profiling all these old kits and searching for matches in both convicted offender and forensic files could result in a lot of cases being solved.
To help them cope with these demands, labs have received additional resources from their legislatures in some cases, and a considerable amount of federal money has been pumped into the state labs to enhance their DNA programs and reduce backlogs. Labs have also entered into contracts with private-sector testing labs to help reduce their databanking backlogs. More recently, they have also contracted with those labs for the screening of older sexual assault evidence kits. All these efforts and strategies have helped, but backlogs remain in many jurisdictions. It will probably take several more years before the government labs finally get their arms completely around the backlog. As the labs catch up, the hit rate will no doubt increase, and many older cases will be solved.
DNA typing is among the most revolutionary technologies that forensic science has seen, but its full promise will not be realized until the resources catch up with the demands. DNA has been somewhat over-hyped in the popular media as well. It is well to keep in mind that it can only associate or dissociate biological evidence with persons, evidence items, and/or places. It does not establish innocence or guilt. In many criminal cases, there is no recoverable biological evidence, and as a result, DNA typing is not useful.
It is fair to say that many of the quality control and quality assurance features that have been introduced into forensic science laboratories as a result of DNA programs have now extended into other areas and specialties. The development of DNA technologies has thus been indirectly responsible for improvements in laboratory practices and products across the board.
Bibliography DNA test frees rape suspect. (2002, February 16). Chicago Tribune.
DNA tests urged for all arrestees. (2002, February 16). Chicago Tribune.
Hair-matching flawed as a forensic science. (2002, March 31). The Dallas Morning News.
Jeffreys, A. J., Brookfield, J. F. Y., & Semeonoff, R. (1985). Positive identification of an immigration test case using human DNA fingerprints. Nature, 317: 818-819.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 11 Jeffreys, A. J., Wilson, V., & Thein, S. L. (1985a). Hypervariable “minisatellite” regions in human DNA. Nature, 314: 67-73.
Jeffreys, A. J., Wilson, V., & Thein, S. L. (1985b). Individual-specific “fingerprints” of human DNA. Nature, 316: 76-79.
Pieces of bone hold families’ hopes. (2002, March 25). New York Daily News.
Wambaugh, J. (1989). The Blooding. New York: Bantam Books.
R. E. Gaensslen earned his PhD in biochemistry, Cornell University (Ithaca, NY) in 1971. He is a professor and head of the Forensic Science Program at the University of Illinois at Chicago. Formerly, he has been a professor and the director of Forensic Science at the University of New Haven, Visiting Fellow at the National Institute of Law Enforcement and Criminal Justice, and Associate Professor at the John Jay College of Criminal Justice, City University of New York.
Professor Gaensslen has authored or coauthored seven books, edited or coedited four books, authored or coauthored nine chapters in edited volumes, and published over 60 papers in scientific literature. He has given over 120 presentations at scientific meetings and to general audiences. He has also organized, coordinated, and participated in dozens of workshops and training courses for forensic science laboratories as well as law enforcement personnel.
Gaensslen is a Fellow of the Criminalistics Section, American Academy of Forensic Sciences. He has received the Paul L. Kirk Distinguished Criminalist award from the Criminalistics section and was made a Distinguished Fellow by the Academy in 2000. He is a Life Member of the Northeastern Association of Forensic Scientists. He was editor of the Journal of Forensic Sciences from 1992-2000. He has been project director/principal investigator on numerous grants and contracts for training and research.
12 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Forensic DNA Profiling – Beyond Identification
Simon J. Walsh, Centre for Forensic Science, University of Technology, Sydney, Australia Claude Roux, PhD Alastair Ross, Director of the National Institute for Forensic Science Olivier Ribaux, Institut de Police Scientifique et de Criminologie, University of Lausanne, Switzerland John S. Buckleton, Forensic Business Group of the Institute of Environmental Science and Research Ltd.
Introduction The environment within which DNA profiling operates as a tool of the law- enforcement community is now starkly different than that of the mid-1980s when its role in this context first began1 (Gill, Jeffreys, & Werrett, 1985). This is not surprising, as the technology underpinning its use is at the forefront of scientific development and is still evolving. Continual improvements in sensitivity and accuracy have increased the discriminating potential of DNA and expanded its application across more and more areas of criminal activity. It is now possible to retrieve DNA profiles from trace amounts of biological material associated with a given offence (Snabes, Chong, Subramanian, Kristjansson, DiSepio, & Hughes, 1994; Oorschot & Jones, 1997; Whitaker, Cotton, & Gill, 2001; Gill, 2001) and then compare the resultant profile to DNA databases at a provincial, state, national, or international level, as such databases exist in most major centres (Werrett, 1997; Schneider & Martin, 2001; Harbison, Hamilton, & Walsh, 2001; Hoyle, 1998). Automated laboratory techniques can now facilitate the high-throughput analysis of thousands of forensic samples in a matter of days or weeks, allowing DNA databases to grow at increasing rates (Gill, 2002).
Despite this impressive technological expansion, however, the focus of the forensic community has remained, until recently, relatively unaltered from a traditional operational standpoint. This focus involves the scientist attempting to retrospectively obtain results for a given case to assist in the investigation of a crime; therefore, the primary focus of forensic science is towards crime solving rather than crime reduction or crime prevention.
For some years now, policing strategy has evolved from the traditional focus of capturing or incarcerating offenders towards a more holistic understanding of crimes and criminals and a prevention-based approach to law enforcement. The emergence of problem-oriented policing in the late 1970s embodied this approach, and it led to the implementation of practical community-based policing strategies (Golstein, 1990). In summary, this strategy concentrates on the identification of “problems,” or underlying conditions that favour the emergence of criminal behaviour such as unemployment and problems within families. A more global consideration of these types of events and the context in which they happen, helps to understand the dynamics of crimes and allows for the design of more appropriate preventative responses. Community-based policing relies on a
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 13 relationship between the police and the community and is one means of responding to the causes and consequences of crime. The field of “crime analysis” has recently re-emerged as an effective means to identify such “problems,” understand them, and utilise them in the context of effective policing (Crime Analysis Booklet, 2000; Ribaux & Margot, 2000).
Forensic science has not contributed greatly to the evolution of policing and crime management strategies, although lately, there has been a move among law enforcement agencies to embrace scientific advances under the concept of intelligence-led policing. The relationship between police and research, however, tends to be more oriented toward general concepts (such as those explained above) or to the implementation of specific technology in areas such as geographical surveying (Murray, McGuffog, Western, & Mullins, 2001) and the use of trace evidence (Ribaux, 1997; Taroni, 1997). Recently, research emerging from the concept of crime analysis has proposed frameworks to address this gap by understanding where and when forensic science data can be useful and by designing information technology systems to implement the findings in a “real-time” operational environment (Ribaux & Margot, 1999). This approach forges a more meaningful link between forensic intelligence and crime analysis.
This article discusses two projects that utilise forensic case data obtained specifically from the widespread use of DNA profiling in order to provide both operational intelligence for law enforcement agencies (Walsh, Moss, Kleim, & Vintiner, in press) and information for consideration in relation to broader issues of criminal justice (Walsh, Roux, Ross, Ribaux, & Buckleton, 2002).
The power of DNA evidence coupled with the reliance put upon it by courts and the investment made in databases places extra responsibilities on the forensic scientist and forensic institutions. Challenges to the recent emphasis placed on forensic DNA profiling as a law enforcement tool must be satisfactorily addressed. For instance, can the forensic community quantitatively demonstrate the social benefit of DNA databases and show conclusively that this social benefit outweighs any loss of privacy rights for the individual? Alternatively, can we illustrate the cost-effectiveness of DNA-based investigations over other potential claimants of the limited social justice funding? In more practical terms, there is undoubtedly value in considering issues such as DNA database submission ratios, the existence of the deterrent effect of DNA databases, and whether adjustment of sampling or policing strategies can produce an optimal social benefit.
The DNA Intelligence Project The New Zealand (NZ) DNA Databank was established in 1996, making New Zealand the second country to launch a national DNA database system (Harbison, Hamilton, & Walsh, 2001). The functional success of the NZ DNA Databank has been impressive (Walsh & Moss, 2001); however, once the primary application of the database became routine, a question was raised as to whether examination of other data held on the database could yield intelligence information relevant to the ongoing management and use of this technology. The “DNA Intelligence Project” (DIP), a collaboration involving the Institute of Environmental Science and Research Ltd. (known as ESR) and the New Zealand Police, was initiated in 1999 to address this question. Its aim was to create a repository of data from DNA-based
14 Illinois Law Enforcement Executive Forum • 2002 • 2(3) cases that could be regularly examined, with the key outcomes distributed to the NZ law enforcement community. This process has now become an additional routine function of the DNA database with customised reports generated monthly. These reports are made available to relevant sections of the NZ Police Service, including station commanders and National Crime Management.
To achieve the aims of the DIP, relevant information from over 4,500 cases stored on the crime sample database (CSD) was entered into an independent database, built on a MS Access™ platform. Along with the case data, details of over 2,000 crime-to-person and crime-to-crime “hits” were entered and linked, and the database itself was customised to analyse trends and report key findings. The case data was subsequently examined at the level of submissions, laboratory analysis, and “hits.” Customisation of the DNA database management software or Forensic Evidence Database System (FoRED), which was designed and built by ESR, allows the data to be refreshed intuitively upon entry.
Preliminary findings of the DIP have shown that significant variation in the use of DNA in criminal investigations across police districts can have a bearing on the resultant level of success subsequently returned via the DNA database (Walsh, Moss, Kleim, & Vintiner, in press). Data has also been retrieved regarding the relative submissions and successes of analysis of the various types of crime scene samples. This serves to inform police of the potential for DNA evidence to be obtained and the likelihood of success of given evidence types, thus allowing them to make more informed investigative decisions. Analytical outcomes have also allowed new technologies to be assessed in terms of their forecast impact on outcomes from the DNA database. Subsequent phases of the DIP aim to further interrogate the geographical distribution of crimes in New Zealand and the demographic composition of the individuals being linked to unsolved offences (Jelena Abaz, personal communication, July 2002).
Several areas in which the overall effectiveness of the DNA Databank could be enhanced by alteration to existing policy or improvements in aspects of the overall process were identified through this project. For example, outcomes from the DNA database were compared with established criminal justice predictors such as the recidivism rates for burglary offenders given by Speir (2001) to evaluate the system-wide effect of the use of DNA profiling in specific areas. Importantly, this function provides a means for forensic science to participate in debate existing at this more general level.
The preliminary outcomes of the DIP indicate that valuable intelligence is able to be contributed through quantitative analysis of forensic DNA case data. This approach has broadened the dimensions of the information offered through the NZ DNA Databank and has furthered the understanding and investigative capability of both police and forensic scientists.
DNA and the Criminal Justice System Although DNA profiling is arguably the most powerful and rapidly developing forensic investigative tool, its use is not without controversy. This is due largely to its enormous potential to implicate individuals in a crime and the risk of its deliberate or accidental misuse. The present and future uses of forensic DNA
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 15 profiling are a worrying prospect for some members of the international criminal justice community (Kirby, 2001; Redmayne, 1998) and for members of the public as well (Samuel, 2001). The development of large-scale DNA databases has almost always been preceded by the alteration of existing legislation or the creation of entirely new laws. In some cases, observers feel that these new laws have been enacted too hastily (Meagher, 2000), lacked suitable public and legal scrutiny, and have been justified under a misleading guise of populist “law and order” politicking (Saul, 2001; Scutt, 1990). Others worry that extending police powers to allow the collection of DNA samples represents an encroachment into previously sacred territory of criminal law and a diminution of basic individual rights, in particular the right to silence and the right against self-incrimination (Gans, 2001; Hocking, McCallum, Smith, & Butler, 1992; Sasser-Peterson, 2000). Other observers are concerned by the storage of human genetic information and the potential for future misuse (Stevens, 2001). In addition to these present sources of conjecture, there are proposed technological developments bound for a controversial reception such as DNA-based methods for assigning race (Jobling, 1999) or physical features (Grimes, Noakes, Dixon, & Urquhart, 2001).
Furthermore, the social and economic cost of criminal investigation, prevention, and detention continues to increase. This results in an increasing onus on forensic institutions to justify the significance of their work in the broader context of the criminal justice system. This is particularly true for DNA profiling, which can become an expensive and elaborate pursuit for a forensic or police organisation.
Despite these concerns, the technology underlying the use of forensic DNA profiling continues to develop. With each passing year, the landscape of forensic DNA profiling changes to some degree. Many of these changes will have significant bearing on the use of DNA profiling in criminal investigations and therefore its potential impact on outcomes of the criminal justice system. For example, it is now possible to obtain DNA profiles from car steering wheels or areas that have been tampered with such as the ignition. This opens the possibility of a major shift in police investigative methods with respect to vehicle crime. As an example, we could envisage the total police effort in the investigation of a “dumped” car being to swab the ignition cowling and submit the sample for DNA profiling and comparison with the national DNA database. In fact in 1999, the UK Forensic Science Service and the West Midlands Constabulary launched “Operation Pathfinder,” a pilot study specifically targeting the investigation of volume crime using low copy number DNA profiling techniques. It is estimated that application of these methods across the United Kingdom could reduce the overall crime rate by up to 5% (Wernett & Sullivan, 1999). Other developments include a hand-held DNA-chip which would effectively take DNA profiling to the crime scene (Gill, 2001a). The progress in this field is rapid, and with it, one can expect the investigative and intelligence capabilities of forensic DNA techniques to increase.
To balance the ongoing and increasing use of such technology, which has such significant cost and privacy and human rights concerns, the public must be assured that the benefits are worthwhile. A means of achieving this is to quantify the value of the use of DNA profiling in terms of key outcomes of the criminal justice system such as crime rate, crime reduction potential and reduction of the fear of crime. Presently, it is not possible to do this other than through anecdotal reference or association to individual cases.
16 Illinois Law Enforcement Executive Forum • 2002 • 2(3) A project is underway that aims to undertake a comprehensive examination of the role and impact of forensic DNA profiling on key components of the criminal justice system, comparing it when possible to other investigative and intelligence tools (Walsh et al., 2002). Following these specific considerations incorporating both the investigative and legal phases, the aim is to combine the data into a computerised model that will simulate the overall use and impact of forensic DNA profiling in the criminal justice system. Such a “DNA model” will be able to evaluate the use and benefits of forensic DNA profiling as well as making the purpose of its applications more transparent. Perhaps more importantly, the model will further integrate forensic, police, and justice system data with the view of guiding strategy in these areas towards the most efficient use of this technology.
The development of DNA profiling has certainly been impressive, but has it had a positive effect on clearance rates, prosecution rates, conviction rates, or indeed the crime rate? At present, we are unable to satisfactorily address these questions. A predictive model could assess this type of question pragmatically and contribute empirical data to the debate surrounding the uses of DNA—something which has so far been lacking.
Conclusion Forensic science occupies a unique position in the criminal justice process, evidenced particularly by the increasing use of tools such as DNA profiling. To date, the forensic community has rarely sought to capitalise on this providential position. This review has highlighted an example in which forensic DNA case data has contributed to the overall body of law enforcement intelligence data. It has also proposed a means of providing pragmatic, empirical information for the purpose of advancing debate surrounding the use of forensic DNA profiling and securing a more meaningful position for forensic science within such debate. Through the amalgamation of forensic science data with reasoning-based approaches of crime analysis and criminology, it is possible to take the science of forensic DNA profiling beyond laboratory identification and into challenging new areas such as intelligence-led law enforcement and criminal justice ideology.
Notes 1 The first DNA case was processed by Professor Alec Jeffreys, Leicester University, UK. This case involved the DNA analysis of semen contaminated vaginal swabs from two murder victims, Linda Mann and Dawn Ashworth who had been raped and murdered in 1983 and 1986 respectively in a rural village in Leicestershire, UK. The analysis confirmed that the same person had murdered the two girls. In 1987, a suspect, who had confessed, was arrested and charged with both murders; however, DNA profiling subsequently exonerated him. The characteristics and location of the murders convinced the police that the perpetrator was a local man. Consequently, blood samples were collected from 5000 males within the area. These samples were analysed using a combination of classical blood-typing techniques and multi-locus probe DNA profiling. The techniques used were very labour intensive and expensive, taking at least 1-2 weeks to analyse each sample. Eventually, the police captured the perpetrator, and the DNA evidence was instrumental in his conviction.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 17 This first case demonstrated the potential of DNA profiling and firmly pointed towards its future development as the most important forensic investigative tool to be developed in the 20th century. In particular, it was demonstrated that . . .
• Innocent men can be eliminated from enquiries. • Crimes can be linked and shown to have been committed by one individual. • DNA profiling was effective as an investigative tool by screening selected populations (precursor of national DNA databases). • An incalculable social benefit was achievable, since a serial killer was captured. • The use of DNA profiling was shown to be a cost effective method, relative to policing, to investigate crime.
Bibliography Crime analysis booklet (2nd ed.). (1997). Lyon: Crime Analysis Working Group Interpol.
Gans, J. Something to hide: DNA, surveillance and self-incrimination. Current Issues in Criminal Justice, 13, 168-184.
Gill, P. (2001a). An assessment of the utility of single nucleotide polymorphisms (SNPs) for forensic purposes. International Journal of Legal Medicine, 114, 204-210.
Gill, P. (2001b). Application of low copy number DNA profiling. Croatian Medical Journal, 42, 229-232.
Gill, P. (2002). Role of short tandem repeat DNA in forensic casework in the UK - past, present and future perspectives. BioTechniques, 32, 366-385.
Gill, P., Jeffreys, A., & Werrett, D. (1985). Forensic application of DNA “fingerprints.” Nature, 318, 577-579.
Golstein, H. (1990). Problem oriented policing. Philadelphia: Temple University Press.
Grimes, E. A., Noakes, P. J., Dixon, L., & Urquhart, A. (2001). Sequence polymorphism in the human melanocortin 1 receptor gene as an indicator of the red hair phenotype. Forensic Science International, 122, 124-129.
Harbison, S. A., Hamilton, J. F., & Walsh, S. J. (2001). The New Zealand DNA databank: Its development and significance as a crime solving tool. Science and Justice, 41, 33-37.
Hocking, B. A., McCallum, H., Smith, A., & Butler, C. (1997). DNA, human rights, and the criminal justice system. Australian Journal of Human Rights, 3, 208-237.
Hoyle, R. (1998). The FBI’s national DNA database. Nature Biotech, 16, 987.
18 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Jobling, M. A. (1999). The Y chromosome as a forensic tool: Progress and prospects for the new millennium. In proceedings of First International Conference on Forensic Human Identification in the Millennium, London.
Kirby, M. (2001). DNA evidence: Proceed with care. Australian Journal of Forensic Science, 33, 9-13.
Meagher, D. (2000). The quiet revolution - a brief history and analysis of the growth of forensic police powers in Victoria. Criminal Law Journal, 24, 76-88.
Murray, A. T., McGuffog, I., Western, J. S., & Mullins, P. (2001). Exploratory spatial data analysis techniques for examining urban crime. British Journal of Criminology, 41, 309-329.
Redmayne, M. (1998). The DNA database: Civil liberty and evidentiary issues. Criminal Law Review, 437-454.
Ribaux, O. (1997). La recherché et la gestion des liens dans l’investigation criminelle: le cas particulier du cambriolage. Doctoral dissertation, Institut de Police Scientifique et de Ciminologie, University of Lausanne.
Ribaux, O., & Margot, P. (1999). Inference structures for crime analysis and intelligence: The example of burglary using forensic science data. Forensic Science International, 100, 193-210.
Ribaux, O., & Margot, P. (2000). Criminal analysis. In J. Siegal (Ed.), Encyclopedia of forensic sciences (pp. 416-422). New York: Academic Press.
Samuel, E. (2001, May 5). We’re all suspects now. New Scientist, 3-9.
Sasser-Peterson, R. (2000). DNA databases: When fear goes too far. American Criminal Law Review, 37, 1219-1238.
Saul, B. (2001). Genetic policing: Forensic DNA testing in New South Wales. Current Issues in Criminal Justice, 13, 74-109.
Schneider, P. M., & Martin, P. D. (2001). Criminal DNA databases: The European situation. Forensic Science International, 119, 232-238.
Scutt, J. (1990). Beware of new technologies. Legal Service Bulletin, 15, 9-12.
Snabes, M. C., Chong, S. S., Subramanian, S. B., Kristjansson, K., DiSepio, D., & Hughes, M. R. (1994). Preimplantation single-cell analysis of multiple genetic loci by whole-genome amplification. Proceedings of the National Academy of Science, 91, 6181-6185.
Spier, P. (2001). Recidivism patterns for people convicted in 1995. Wellington: New Zealand Ministry of Justice.
Stevens, A. P. (2001). Arresting crime: Expanding the scope of DNA databases in America. Texas Law Review, 79, 921-960.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 19 Taroni, F. (1997). La recherché et la gestion des liens dans l’investigation criminelle: une etape vers l’exploitationsystematique des donnees de police. Doctoral dissertation, Institut de Police Scientifique et de Ciminologie, University of Lausanne.
Van Oorschot, R. A., & Jones, M. (1997). DNA fingerprints from fingerprints. Nature, 387, 767.
Walsh, S. J., & Moss, D. S. (2001, July). Forensic DNA databasing - solving crime in New Zealand. Australasian Science, 34-36.
Walsh, S. J., Moss, D. S., Kleim, C., & Vintiner, G. M. (in press). The utilisation of forensic DNA case data as a source of multi-dimentional intelligence. Science and Justice.
Walsh, S. J., Roux, C., Ross, A., Ribaux, O., & Buckleton, J. S. (2002). Examining the role and impact of forensic DNA profiling on key areas of the criminal justice system. In proceedings of 16th Australian and New Zealand Forensic Science Society International Symposium for the Forensic Sciences. Canberra, Australia.
Werrett, D. J. (1997). The national DNA database. Forensic Science International, 88, 33-42.
Werrett, D. J., & Sullivan, K. (1999). The national DNA database of England and Wales and the strategic use of DNA profiling. In proceedings of The First International Conference on Forensic Human Identification in the Millennium, London.
Whitaker, J. P., Cotton, E. A., & Gill, P. (2001). A comparison of the characteristics of profiles produced with the AMPFlSTR®SGM Plus™ multiplex system for both standard and low copy number (LCN) STR DNA analysis. Forensic Science International, 123, 215-223.
Simon J. Walsh is doctoral candidate at the Centre for Forensic Science, University of Technology, Sydney, Australia. He has had over eight years experience as a practicing forensic biologist in Australia and New Zealand. He has worked extensively with the implementation and operation of DNA database technology. Via this casework background, he has developed additional interests in the fields of criminology and criminal justice studies. This has recently led to a PhD project that aimed at evaluating the role and impact of forensic DNA technology in terms of key outcomes of the criminal justice system such as crime rate and crime reduction potential.
Claude Roux obtained a BSc and then a PhD in forensic science from the University of Lausanne, Switzerland. His PhD topic focused on determining the evidential value of textile fibres in criminal investigation. His research activities cover a broad spectrum of disciplines, which are aimed at understanding and solving analytical and interpretative problems encountered in forensic science. These include trace evidence (fibres, paint, glass, etc.), document examination (inks and toners), fingerprints, and other forms of physical evidence. He has already supervised more than 30 completed
20 Illinois Law Enforcement Executive Forum • 2002 • 2(3) forensic research projects since his arrival at UTS in 1996, including three University medals. He is involved in a number of European, American, and Australian forensic working groups. In particular, he is a member of the Code of Best Practice subcommittee of the European Fibres Group and an invited member of the “Tapes” subgroup of the U.S. Scientific Working Group for Materials Analysis. Roux is also the chair of the newly formed Australian and New Zealand Association of Forensic Science Educators and an executive member of the NSW Branch of the Australian and New Zealand Forensic Science Society. He is the director designate of the new UTS Centre for Forensic Science. He received a “Young Investigator’s Award” at the 1996 Meeting of the International Association of Forensic Sciences in Tokyo. He has attracted more than $2 million in competitive research grants in the last four years.
Alastair Ross is the director of the National Institute of Forensic Science, based in Melbourne, Australia. This organisation is responsible for overseeing the operations and development of forensic science in Australia and provides specialist training and resources for professionals from all forensic disciplines.
Olivier Ribaux is an associate professor of the Institut de Police Scientifique et de Criminologie, University of Lausanne, Switzerland. An expert in forensic science and crime analysis, Ribaux works in both an academic capacity at the University of Lausanne and with intelligence staff of the Swiss Police. Much of his research has been implemented in an operational policing environment with considerable success.
John S. Buckleton is the principal scientist of the Forensic Business Group of the Institute of Environmental Science and Research Ltd., Auckland, New Zealand. Dr Buckleton has been a forensic scientist for over 20 years with broad international experience. He specialises in the statistical interpretation of forensic evidence, particularly physical evidence and DNA.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 21 22 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Technology and Training Hold Hands . . . Almost
Clydell Morgan, ABD, Mississippi Crime Laboratory, Jackson, Mississippi
Items involved in the commission of crime become evidence when they are declared so by the police officers arriving at the crime scene. From that time forward until released to the court, physical evidence items must be protected. That protection involves proper crime scene documentation, proper collection/preservation, and solid custody chain techniques (crime scene analysis). After crime scene analysis, the evidence must be analyzed scientifically and reported, prosecuted at a trial by jury, defended at a trial by jury, and ruled admissible/nonadmissible by a seated judge. Those four separate but conjoined arena players should receive specific role training.
When a crime is committed, criminal justice individuals engaged in the ripple- effect circle—forensic scientists, police officers, prosecutors, defense attorneys, and judges—have separate, but conjunctive tasks in bringing an offender to justice. The one key element that ties the roles together is forensic analyses of crime scene evidence that could indicate innocence or guilt. The questions addressed here are not about the method and operation of each key contribution in the ripple-effect circle; what it does ask is whether these criminal justice players possess a thorough, interactive knowledge of new technology—DNA forensic analyses. Those roles, which are specific to each player, are often not learned in the training arena; they, unfortunately, are learned the hard way.
Paramount to physical evidence, forensic analysis is proper crime scene collection (which is usually accomplished by a police officer). As a general rule, training in crime scene analysis for law enforcement personnel is provided in special blocks of learning for the experienced officer; however, true to most small, under-staffed, under-funded law enforcement agencies, little crime scene training is provided. Currently, with advancing DNA technology, training is receiving more attention.
In conducting research for this article, limited national data sets were searched in order to quote training statistics for the four-specific criminal justice role players: (1) police officers, (2) forensic scientists, (3) attorneys, and (4) judges. Reiterating that all in the circle must be able to understand and apply DNA protocols in their particular role, each will be addressed in the usual evidence order.
The United States Attorney General directed the National Institute of Justice to establish and administer a commission that would provide recommendations on the use of DNA. The following are inclusive in the duties of the National Commission on the Future of DNA:
Evidence • The use of DNA in post-conviction relief cases • Legal concerns including Daubert challenges and the scope of discovery in DNA cases
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 23 • Criteria for training and technical assistance for criminal justice professionals involved in the identification, collection, and preservation of DNA evidence at the crime scene • Essential laboratory capabilities in the face of emerging technologies • The impact of future technological development on the use of DNA in the criminal justice system
Separate committee working groups are to research these topics and report the results back to the Commission (see http://www.oip.usdoj.gov/nii/dna/ backg.htm).
Committee activities have produced comprehensive articles that address the five-commission-mandated DNA topics. One article, What Every Law Enforcement Officer Should Know About DNA Evidence,1 provides information relating to DNA crime scene analysis. This article aids DNA understanding for all criminal justice personnel involved in DNA evidence collection.
In a special report, Police Departments in Large Cities, 1990-2000,2 the Bureau of Justice Statistics (BJS), revealed statistics obtained from 62 large American cities (serving a population of at least 250,000). During a ten-year period (1990-2000), the median number of classroom training hours required of new officers in large city police departments increased from 760 hours to 880. As this data is not curricula-specific, an assumption is made that general, basic forensic-service instruction is provided. Please note that this procedure is not being criticized, as most new officers are not given crime scene evidence collection duties.
Data is not available that address nation-wide crime scene analytical training received by law enforcement agencies. BJS data only reveals nonspecific statistics: “In 2000, police departments in large cities had a median annual inservice training requirement for officers of 40 hours (data were not collected in 1990)” (2002, p. 3). Again, data is not curricula specific, nor does it delineate any subject-specific training hours used in the calculation of the median. Again, one must assume what the 40-hour training block addressed. Do not misunderstand; this is not a criticism of training in large police departments, nor is it addressing those who gather statistical data. It is addressing specific training for a specific player in a specific technological procedure.
Duty-specific, basic education and training is mandated for police officers, attorneys, and judges; it is required of forensic scientists. When technology opened the forensic DNA door, scientists could expect forensic serological procedures to be complimented by the addition of a DNA-specific identification. The specificity of DNA forensic laboratory analytical techniques requires concentrated training. William Tilstone (2000), executive director, National Forensic Science Technology Center, Largo, FL, noted necessary components for forensic science training and education:
• Education should be learning-oriented in an institution that also conducts research; programs should be longer with examinations and transportable qualifications.
24 Illinois Law Enforcement Executive Forum • 2002 • 2(3) • Training often can be delivered at the workplace and should be outcome- oriented. It must always be available to integrate new technology and should be situation-specific, especially regarding DNA. • Professional codes of ethics, the guiding beliefs that define a group, should regulate conduct, protect the public interest, be specific and honest in content, and be enforceable and enforced (see the code of ethics used by the American Society of Crime Laboratory Directors).3
The legal officials in the criminal justice arena must also possess specific DNA training in order to prosecute, defend, and rule on evidence admissibility. The Second Annual National Conference on Science and the Law held in San Diego, California, October 10-14, 2000 brought together legal and science professionals in order to promote learning applications of the law with those of science. Meetings were sponsored by the National Institute of Justice; the American Bar Association, Criminal Justice Section; the American Academy of Forensic Sciences; and the National Center for State Courts in collaboration with the National Academy of Sciences and the Federal Judicial Center. The fluctuating admissibility standards reflected in the Frye test and the Daubert ruling were discussed. “In view of these changing standards, participants held that judges, experts, and lawyers must work together to maintain effective courtrooms and protect the constitutional rights of defendants.”4
As new and more sensitive analyses (e.g., Mitochondrial DNA analysis, a powerful analytical tool that can be applied to samples of hair, bone, and teeth) are introduced, training and technology must align in a coexisting environment. Everyone associated in the arena of justice—law enforcement, forensic scientists, attorneys, and judges—must be experienced in the perimeters of DNA technology. The scientists applying the technology must be specifically trained; so must those individuals who collect, prosecute, defend, and rule. Criminal justice training in technology is inextricably bound; they simply must hold hands in a parallel venture, which is that of truth searching aimed at justice.
Notes 1 Department of Justice, National Institute of Justice. (2002). What every law enforcement officer should know about DNA evidence. National Commission on the Future of DNA Evidence, BC000614
2 Reaves, B. A., & Hickman, M. J. (2002). Police departments in large cities, 1990-2000. U.S. Department of Justice, Office of Justice Programs, NCJ 175703.
3 Second Annual National Conference on Science and the Law: Summary of Proceedings. (2000). U.S. Department of Justice, Office of Justice Programs, NCJ 191717.
4 Ibid, p. 6.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 25 Clydell Morgan, presently in dissertation writing (PhD, University of Southern Mississippi, Adult Education), is a Forensic Scientist V at the Mississippi Crime Laboratory in Jackson, MS. With a 25-year experiential base in field and lab analyses as a certified Senior Crime Scene Analyst (IAI) and a Certified Latent Print Examiner (IAI), the author writes, instructs, and implements career-track forensic and law enforcement workforce training programs.
26 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Law Enforcement Response to Computer Crimes – St. Louis Regional Response
Detective Kenneth Nix, Clayton, Missouri Police Department
This article is a description of the process undertaken to put together a regional computer forensic laboratory in the St. Louis, Missouri area. The St. Louis area is unique in law enforcement terms because of a high number of police jurisdictions and the relatively small size of many of these departments. A positive cooperative nature exists between departments, which is necessary to fulfill our responsibility to our communities. It would be difficult to perform our duties well, if we were as fragmented in our use of available resources and abilities as we are in our jurisdictional structure. The Regional Computer Education and Enforcement Group of Greater St. Louis (RCEEG) was established to assist police agencies with computer crime in a four-county area, including the City of St. Louis. This is our story.
In a time when computer crimes and illegal activity via the Internet was beginning to come to the forefront in the situations confronting police agencies throughout the United States, most local police departments found it difficult to enforce these laws because of limited knowledge, funding, and jurisdictional problems. To address these problems, many police departments sought assistance from Federal agencies such as the Secret Service, Federal Bureau of Investigation, United States Customs Service, United States Postal Inspection Service, and United States Attorney General’s Office. Because of the volume of cases needing investigation, however, the federal agencies mentioned have a backlog of several months, thus forcing local police departments to find other means to address computer crime in their region.
With the compounding increase every year in criminal activity involving computers, the Illinois Attorney General’s Office created the Regional Computer Crime Enforcement Group (RCCEG) concept about 1999. The idea was to form groups of local law enforcement officers in various regions; provide training for search, seizure, and computer forensics; and allow the local groups to begin the initial steps in the investigation of computer crimes. Each region was required to have a designated team leader. The team leader’s duties included coordination of training and teams’ response to criminal assignments. The following mission statement for the Illinois groups, is found in an article contained on the St. Clair County, Illinois Sheriff’s Department website (www.sheriff.co.st-clair.il.us):
The Regional Computer Crimes Enforcement Group program, or RCCEG (pronounced “AR-seg”), was established in Illinois to create a network of regional task forces equipped with the knowledge, expertise, and resources to assist the Illinois law enforcement community in investigation/prosecution of cases requiring seizure and forensic examination of digital evidence. Each RCCEG is staffed by law enforcement and private-sector team members from within each region along with a designated team leader. RCCEG team
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 27 members are volunteers who possess a demonstrated ability to pursue these complex cases and who have completed an intensive training program through the Illinois Computer Crime Institute. Additionally, all RCCEG team members are given access to ICCI’s Regional Computer Forensics Lab (RCFL) located in Springfield, Illinois at the Office of the Attorney General’s main facility.
Currently, there are six RCCEG Teams in the Illinois region, and they can be located through the following website:
The St. Louis region was introduced to the RCCEG concept through a training seminar for the Greater St. Louis Major Case Squad. The Greater St. Louis Major Case Squad is an organization of police detectives from the St. Louis (Missouri) and the Metro East (Illinois) region, who work in unison to investigate high profile crimes, usually homicides. The investigators are loaned to the Major Case Squad when the unit is activated, and all salaries are paid by the investigator’s agency. The Illinois High Tech Crimes Unit made a presentation at the Greater St. Louis Major Case training session in March of 2000, describing the resources the RCCEG groups had to offer in Illinois. From this presentation, discussion began to form a similar unit in the St. Louis, Missouri area including the necessary training.
With the assistance of the Illinois Attorney General’s Office, I was able to get a group of investigators trained at the Attorney General’s Office in Springfield, Illinois and then later in St. Louis. From the beginning, I brought together personnel from various agencies, not only local police, but federal agencies as well to plan and organize our task force. When I made inquiries into how assistance could be obtained from the federal level of law enforcement, the St. Louis Division of the United States Secret Service volunteered to introduce me to key members of other agencies. At about the same time, the United States Attorney General’s Office was initiating a Computer Crime Task Force in the St. Louis Region. Through their assistance, I received help from several St. Louis Federal Agents to form a local computer forensic task force.
The initial problem our region faced was putting together a local forensic lab. The lab was needed to perform forensic examinations and to allow new task force members the opportunity to learn computer forensics. Through networking, the group was able to find individuals and departments who agreed to provide space for the labs to be built and housed. Our initial goal to have three satellite labs began to materialize. The first lab was located at the Hazelwood Police Department. That agency already had a forensic examiner, and the hardware and software able to perform computer examinations. The second lab was to be housed at the St. Charles County Sheriff’s Department, where that agency was in the process of building a lab and training their personnel to perform examinations. The location of the third lab had not been determined, but with the regional concept, a southern site was being sought.
The progress of the group, which contained approximately 25 members, was moving forward, but the pace of the training and recognition by local police was very slow. At this time, the idea of changing the groups informal status to that of a formal task force was introduced. The St. Louis Area Police Chief’s Association
28 Illinois Law Enforcement Executive Forum • 2002 • 2(3) helped give the concept credibility. With the cooperation of the technology committee of the Chief’s Association, a Board of Managers was formed. The Board is comprised of five area police chiefs, and two local assistant prosecuting attorneys. The Board of Managers also brought a formal leadership counsel for the organization.
After the Board of Managers was in place, an organization system or chart was created. This structure led to the creation of policies and procedures. As these steps were being taken to create the regional lab, the Internet Crimes Against Children Task Force of Greater St. Louis was being formed by Sergeant Joe Laramie, of the Glendale Police Department. Because of the similar directions the ICAC Task Force was moving, the Board of Managers asked Sergeant Laramie to become part of the regional computer crime group. The concept made perfect sense, and the two groups merged.
With the St. Louis Regional Computer Crime Enforcement Group and the Internet Crimes Against Children working as one, a recommendation was made to create an online investigation unit to respond to situations both proactively and reactively. Training was also added to the organizational chart (see Figure 1).
Figure 1
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 29 Chief Wolf of the Hazelwood Police Department was designated as chairman of the board of managers and director of the organization. Chief Keller of the Shrewsbury Police Department handles public relations, which entails contacts with the media and private organizations. Chief Copeland of the Town and Country Police Department manages the Logistics Division, which covers the lab locations and equipment. Chief Greer of the Crestwood Police Department was assigned the Personnel Division, overseeing training and personnel files. The Liaison Division was assigned to Becky Shafer of the St. Charles County Prosecuting Attorney’s Office and J. B. Lasater of the St. Louis County Prosecuting Attorney’s Office. Their position is essential for legal assistance and direction in the preparation of organizational and investigative documents. The final division, integrity, is being handled by Chief Talbott of the O’Fallon Police Department. This division makes policies and procedures and covers the ethics and review section for the group.
The three main components of the group, Internet Crimes Against Children, Forensics, and Investigations were assigned unit supervisors. Members of the organization would be available, according to their training and abilities, to work on assignments in the appropriate areas.
Now that the general makeup of the group was in place, membership had grown to approximately 50 members. This included local police officers and federal law enforcement agents. Due to the quick growth and general acceptance of the program, Chief Copeland decided to seek external support to keep the group moving forward. He asked Solutia Inc., a specialty chemical company with its headquarters in St. Louis, for a donation. After the request was made, the management of Solutia Inc. came forward with a proposal to supply a facility for the group’s main forensic laboratory. Arrangements were made for the mid-level management of the group to meet with representatives of Solutia Inc. to determine our needs. From that meeting, Solutia Inc. agreed to provide approximately 750 square feet of secure office space, along with office furniture, work-stations, phones, printers, and five computers. Additionally, a secure network server was installed for the laboratory and an independent DSL Internet line.
For security purposes, a card swipe entry system was installed, restricting access to the lab. Solutia Security monitors entry into the laboratory and maintains a log recording the date and time of entry. Only members of the group who have attained the training level necessary to work in the laboratory and board members have pass cards enabling entry. All other members of the group must register at the main desk of Solutia Inc. and be accompanied by a member of the group who possesses a pass card.
As the forensic laboratory was being built, board members and heads of each unit decided that the group would work to bring training to the organization, and the fourth unit in the organization was formed. All members are required to receive training in search and seizure, and in order to remain a member of the group, they shall provide similar training to their departments or other agencies. Additionally, Sergeant Laramie has prepared presentations, covering search and seizure or bag and tag for police agencies, Internet Safety for officers and the community, and organizational information for police and general public. Because of the direction
30 Illinois Law Enforcement Executive Forum • 2002 • 2(3) of the goals of the group, the new name was adopted: Regional Computer Crime Education and Enforcement Group (RCCEEG) of Greater St. Louis.
Due to the fact that the organization does not receive local or federal funding, we decided to obtain tax-exempt status. The board of managers and unit supervisors created a charter, Articles of Incorporation and By-Laws, and RCCEEG Task Force has become incorporated.
After the organizational papers were completed and filed with the appropriate state and federal agencies, attention was turned towards policies and regulations. Since the Internet Crimes Against Children Task Force already had written policies in place, these were accepted for RCCEEG. Attention now focused on lab procedures and online investigations.
At this point, the actual operations began, and personnel were assigned to various divisions. From the organizational chart, there is the position of operational manager, who has the duty of overseeing the four unit supervisors and laboratory manager. Team leaders are assigned a group of officers who are able to respond for an RCCEEG investigation. Each of the four team leaders rotate on-call status. Each is on call 24-hours-a-day for a seven-day period. The on-call team leader is responsible for providing an appropriate response to a request for assistance from a local police agency.
If an agency requests RCCEEG services, they would follow this procedure. The requesting agency contacts the dispatch center of the Hazelwood Police Department and makes a request for RCCEEG assistance. An initial report is logged into the record system, and an RCCEEG team leader is paged. When the team leader returns the page to Hazelwood dispatch, he is given contact and case information for the requesting agency and an RCCEEG Report Number for this case. The team leader then contacts the requesting agency to determine the level of response needed to properly handle the assignment. The response by the team leader may entail just speaking with the investigator, advising how to secure and properly package the system, or activating a response team. In the instance of an actual call out, the team leader will need to know the basis and authority for the search, how many computers are involved, the type of systems, and if the scene is a business or residence. When RCCEEG responds to a crime scene, it is the responsibility of the requesting agency to secure the scene and the suspect. RCCEEG members will photograph the scene and seize the digital equipment, along with any appropriate hardware or manuals.
Once the seizure is complete, the RCCEEG team will return to the requesting agency and provide completed evidence logs for all RCCEEG-seized items. It is the requesting agency’s responsibility to transport the seized items to the RCCEEG laboratory for forensic examination. The requesting agency must contact the lab technician or team leader at the RCCEEG laboratory to properly log into evidence the digital equipment that needs analysis. Only the lab technician and team leaders have the combination required to enter the evidence locker. After the items are received, the lab technician or team leader will assign a team member to perform the actual imaging and examination of the seized items.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 31 RCCEEG will assist a requesting agency with the formation of search warrant affidavits. Due to our group’s familiarity with the requirements of a search warrant for digital media, we have developed basic templates to assure the proper items can be seized. Having two local assistant prosecuting attorneys on our Board of Managers has been invaluable. They are available to provide the needed legal advice and direction to assist with our investigations.
At present, EnCase is the main forensic software utilized by RCCEEG. Other utilities are available, such as DriveSpy and Ghost, but most examinations are performed using Encase. In the future, the forensic software I-Look will be available to our examiners.
RCCEEG is working diligently to provide training to our members, and particularly to bring the training to the St. Louis area. Recently, both the Missouri and Illinois groups have been successful in obtaining training through the National White Collar Crime Center for the St. Louis region. In March of 2002, the RCCEG unit at the St. Clair County, Illinois Sheriff’s Office hosted the Basic Data Recovery and Analysis course presented by NW3C. From that event, the St. Louis region’s RCCEEG group was picked to host the Internet Trace Evidence Recovery and Analysis class. Because of being able to host events such as this, we are able to bring free training from a federally recognized group to our members without expending dollars which can be used for the purchase of needed hardware and software. In addition to the training offered by the NW3C, this organization also seeks other classes and sends members to symposiums across the United States to keep abreast of the current trends.
Don’t overlook the IT specialists from your local area. Although you wouldn’t want to have non-law-enforcement employees working on a criminal case, they can be a resource for technical issues. The Information Technicians at Solutia Inc. were instrumental in setting up the network at the forensic lab and were willing to assist with any system problems we encountered. We have received quality help from their staff.
A local television news station conducted a special report on the creation of the RCCEEG Task Force. During this report, it was mentioned that RCCEEG had received office space from Solutia. Since that aired, our group has been contacted by several local businesses, inquiring as to how they could become involved with the organization. Additionally, because of the exposure, law enforcement agencies from outside the region have made inquiries as to either becoming members or seeking assistance in starting their own organization.
With the media attention and the service RCCEEG has already provided, we have received many invitations to participate in local business symposiums to help corporations become more aware of the possibility of criminal activity through the computer network systems. Additionally, this exposure is making the local law enforcement community more aware of how to handle criminal activity when a computer is used. Local police departments don’t fear computer crime because of the resources RCCEEG has brought to our area.
The main reason for this article is to help law enforcement agencies become aware that even with limited funding from the local or state governments, there is an untapped area, which if worked properly can help create a viable organization.
32 Illinois Law Enforcement Executive Forum • 2002 • 2(3) The group must be determined to work together and contact the corporate world for assistance. We have discovered that the business community wants to step forward and help.
We have a strong willingness to publicize our organization without damaging or compromising our investigations. We will make presentations regarding Internet safety and other types of computer crime prevention. As we have found, the general public is fascinated with the police using computers to solve crimes and in particular, removing child predators from the Internet. This has brought a new type of support for the local police. Additionally, we believe that you can not request financial assistance from the community and be secret about your organization at the same time, as witnessed by the wonderful support Solutia, Inc. has provided to RCCEEG. As always, however, we will not compromise our investigative position when making presentations to the general public.
This project has been difficult, but most of all, it has been very rewarding. Individual officers and their agencies must be willing to make a significant sacrifice of time away from their regular duties. Sergeant Laramie, Glen Robinson (Hazelwood Police Department), and I have invested many hours to create this task force. There never was a project that started itself or functioned from the start without hard work. This task force has provided a valuable resource to law enforcement in St. Louis, and we are proud of our organization.
More information about RCCEEG can be found on our website at
If any agency or department would like to confer on how we were able to make the program work, please feel free to contact me or Sergeant Joe Laramie.
Detective Kenneth Nix Operations Manager for RCCEEG Clayton Police Department 227 S. Central, Clayton, MO 63105 (314) 290-8417 fax (314) 863-0285 e-mail: [email protected]
Sergeant Joe Laramie Operations Supervisor for RCCEEG Glendale Police Department 424 N. Sappington Rd., Glendale, MO 63122 (314) 965-0000 e-mail: [email protected]
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 33 Kenneth Nix of the Clayton Police Department is a 23-year veteran. He is a member of the Greater St. Louis Major Case Squad, the U.S. Attorney General’s Computer Crime Task Force, and the Anti-Terrorism Task Force in St. Louis. He is also the founder and operations manager of the St. Louis Regional Computer Crime Education and Enforcement Group.
34 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Components of a Successful Forensic Computer Exam
Ron Weiss, Jr., CFCE, Illinois Attorney General’s Office, High-Tech Crimes Bureau
Recent reports indicate that the incidence of computer crime has continued to grow at a rapid pace. The CERT® Coordination Center (A computer security group originally called the Emergency Response Team) has had 26,829 incidents reported to it in the first quarter of 2002. The previous year, there were 52,658 incidents reported for the entire year. The FBI and Computer Security Institute’s seventh Computer Crime and Security Survey, released in the spring of 2002, describes the growth in computer crime as “unabated.”
This has created a problem for law enforcement agencies in not only investigating the actual crimes, but also in collecting and examining the evidence obtained during these cases. According to a research report by the National Institute of Justice, law enforcement agencies have been struggling to obtain the skills and equipment necessary to successfully manage cyber investigations. There are several components that lay the foundation for a successful forensic exam of a computer or other electronic device. The investigating officer can manage these components and should do everything he or she can to ensure that they exist prior to submitting a case for examination to a forensic examiner. This article will provide readers with a general overview of the process involved in the forensic analysis of computers so that they can understand the components of a successful forensic exam.
Building a Proper Case Foundation Investigators and patrol officers will be the first responders to reports of computer crime and will be the people that steer a case towards examination and prosecution. The officers will identify where the crime took place in the world and on the Internet. They will interview the parties that have direct or indirect information about the crime. The officers will draft the warrants for computer network records and the seizure of computer systems for examination. This is all done before the computer system ever arrives in the hands of the forensic examiner. Officers can take steps to properly handle these crimes, which will assist in obtaining a better forensic exam of a computer and ultimately the prosecution of those responsible for the reported incidents.
Training and Education The first component is to teach officers and investigators what to look for when a computer crime becomes their responsibility. Agencies would not send officers out on the streets if they did not know what a burglary is or how to handle their weapon properly. Officers need to understand a wide range of technical and legal information to successfully handle computer-related crimes. Failure to provide this sort of training can damage computer cases in many different ways.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 35 Investigators must be able to identify any devices that may contain evidence related to the type of crime they are investigating. They must know what to look for when they arrive on the scene of a search warrant and how to handle those items when the time to do so arrives. Investigators must know how to trace back transactions and suspect actions on the Internet. They must also understand that time is of the essence when they need to preserve Internet traffic logs or e-mail messages and how to go through the proper legal channels to preserve and obtain those records. Many officers are unsure of how to handle a computer when they encounter one as evidence in a case. Few know that that evidence is altered or destroyed by turning on a machine and conducting a search with the native operating system. When a computer is improperly searched, the date and time stamps on hundreds of files could be changed, and some files could be destroyed depending on the type and configuration of its operating system.
Besides all of the technical issues that investigators need to grasp, there are a wide range of legal issues to comprehend. A recent article in the Federal Public Defender has suggested using an officer’s lack of knowledge of the procedures in the Department of Justice’s Manual on Searching and Seizing Computers as grounds for suppression hearings/challenges. In some situations, officers can also be held personably liable when the wrong computers are seized or privileged information is searched.
The way to prepare officers for this new area of crime is to train them how to handle computer-related crime investigations. One state’s response to this need is seen in the five-day basic computer crime investigation course that is offered to California police officers by the California Commission on Police Officer Standards and Training. This course covers computer hardware, operating systems, malicious computer software, data encryption, data communications and telecommunications fraud, basic data recovery, an overview of state and federal Computer Crime Statutes, a how-to on computer search warrants, and a simulated computer crime investigation. This is an entry-level course that prepares officers to handle computer-related crimes on a first responder basis. With this sort of training, an investigator would be more comfortable navigating the Internet or tracking down fraudulent Internet credit card transactions. Once investigators understand the various facets of a computer-related case, they will also be able to articulate what they are looking for on a computer and why they expect that evidence to be on that computer system.
Similar classes are offered through the private sector, various state agencies, and the federal government. The National Cybercrime Training Partnership (www.nctp.org) offers a variety of classes, which are free to law enforcement agencies. The International Association of Computer Investigative Specialists (www.cops.org) offers various levels of training from collecting electronic evidence to advanced forensic analysis topics. These are just a few examples of organizations that can assist in training members of law enforcement agencies in this subject.
A Proper Interview and Case Summary A forensic examiner needs to understand the entire case prior to beginning the exam. The type of case will dictate where and how the examiner will examine the
36 Illinois Law Enforcement Executive Forum • 2002 • 2(3) computer, and a lack of details might cause valuable evidence to be overlooked or missed. These details can also be harder to obtain after a suspect has elected to speak with counsel or if the victims and witness are not readily available to the investigator. A case summary developed by the investigator and a copy of the report will assist the examiner in focusing the approach taken towards a system brought in for analysis.
The case summary/synopsis should provide information obtained from interviews with the suspect(s), the victim(s), the family, and friends of those involved in the incident. These interviews should identify e-mail accounts, system user IDs, screen names and software for Internet chat accounts, passwords or phrases, Internet providers used by the suspect, any problems the suspect or victims have noticed with their computers, and the level of the suspect’s technical expertise. This type of summary will help provide the examiner with a roadmap to find areas of potentially useful data. This summary will assist in the creation of search terms that could be useful in the location of valuable evidence.
Documenting the Scene Officers should carefully document the scene of any computer search warrant. This documentation provides a reference point for the examiner of how the system was set up and a timeline with which to compare system dates and times. Officers should do everything they can to minimize any actions they perform on the computer. Merely viewing files in a directory on a system can change access dates and times associated with those files. The primary goal is to prevent the alteration of the data on the computer.
Document whether the machine’s power is off or on at the time of arrival. Document the time of any actions taken if programs are shut down or files are saved. Take pictures of any activity on the screen. If a machine is powered on at the time of arrival, the method of shut down should be documented also. Take pictures of each system prior to removing it from the scene. Take pictures of the cables and connections for all components. Label both ends of any cables and their connection point on the machine. Note whether the system was hooked up to the phone line or a network. This sort of documentation will assist an examiner in recreating the scene and preserving the integrity of the evidence.
A common discussion in the field of computer forensics is how to power down a machine that is running when officers arrive on the scene of a search warrant. This is a complicated issue that requires educated decisions to be made by the officer on the scene. The general consensus is to simply pull the plug on stand-alone home systems and stop the system at that point in time; however, there are circumstances that may require an investigator to determine what is currently active on the machine at that time to save a crucial piece of evidence (i.e., a murder confession written in a word processor document or maybe an active intruder on the system that is attempting to steal information from the computer). If an officer encounters a network or is required to go to a business to obtain computers, the complexity of the systems and the task of identifying evidence becomes more difficult. At this point, it is wise to enlist the help of experts and to obtain more training for the people who will be handling these situations.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 37 The Collection and Handling of Evidence The integrity of digital evidence is very important because the data on a computer is fragile. Critical information can be lost or tainted by improper handling procedures. It is not comfortable for anyone in court when the examiner has to testify that the last accessed dates and times for a computer game or pornography images located on the suspect system occurred after the system was seized by the police. Not only does this look unprofessional, but it opens the door for the defense to suggest that evidence may have been altered.
Common practice in the field suggests taking a careful approach to handling digital evidence. Many labs prefer that the investigator seal the computer case and drive bays with evidence tape. Once the computer is off, it should remain powered off, and any officers who may have access to the system should be advised of this. Placing a blank floppy disk into the floppy disk drive before sealing it with evidence tape will typically prevent the computer from booting off of the system hard drive. This method is not a foolproof method for securing a computer system, but it can provide some measure of security if someone should try and turn the machine on. Avoid radio transmitters or any magnetic devices that could damage the system. Store the system and its components in a dry and secure facility. These suggestions can help guide the creation of a policy for an agency that is distributed to all officers.
The Proper Legal Foundation Working with the forensic lab and the prosecutor prior to drafting the search warrant to seize a system can minimize any problems for the exam process. A wide range of state and federal laws and case law will be needed to guide the creation of a proper warrant. Improperly worded documents may limit the scope of the search or expose the officer to liability. Miscommunication between the officer and the prosecutor can also create delays. This article is not intended to provide legal guidance but to suggest that officers seek experienced legal advice from those working in this arena.
The forensic examiner needs as much time as possible to examine a system. A search warrant that does not allow for seizure and later examination of a suspect computer system creates a small window of time for an examiner to do an immense amount of work within. Several factors can compound this problem:
• When older or newer systems come in for examination, the examiner may need to obtain different equipment. Older systems can contain out-of-date equipment that needs to be located and purchased before the evidence can be examined. Newer systems will require larger and faster equipment that the lab may have to acquire before examiners can proceed.
• Encrypted files can take time to decrypt. Encryption would require the examiner to find a way to technically defeat the encryption technology or wait for the investigator to locate the suspect’s password or pass phrase after he or she has spoken with his or her defense lawyer. Both of these approaches could take a significant amount of time. A proper interview at the first contact with the suspect may help obtain the needed information earlier.
38 Illinois Law Enforcement Executive Forum • 2002 • 2(3) • The sheer quantity of information located within a computer could take days to search, sort, and verify. With entry-level computers being outfitted with 30 and 40 gigabyte hard drives, the time required to image and search these large drives is increasing. Maxtor has recently released a 160 Gigabyte hard drive. The University of Maryland notes in their October of 2001 Techtalk publication that 93 copies of Tolstoy’s War and Peace could fit into one gigabyte with room left over to fit about a dozen copies of Anna Karenina.
• Dropping current work to work on a new case can create problems for the active cases at the lab. If examiners are already working on cases that involve suspects in custody or a pending court deadline, they may be unable to drop what they are doing to work on a new case.
Agencies should seek the guidance of their local prosecutor and any high-tech crime units located within their region. A good starting point is the computer crime point of contact list maintained by the National Association of Attorneys Generals. This list has contacts for all 50 States and Washington, DC that can provide assistance in this area (http://www.naag.org/issues/20010724-cc_list.cfm).
Summary There are many elements that go into successfully preparing a case for the forensic exam of a computer. The officer involved in the handling of the case must be prepared to handle a wide array of issues to obtain the best results. By taking an approach that incorporates the careful and educated handling of the technological, investigative, and legal issues that confront a case prior to the exam of any digital evidence, the chance for success will be greatly increased.
Bibliography Casey, E. (2000). Digital evidence and computer crime. San Diego: Academic Press.
CERT/CC Statistics. 1988-2002. [online]. Available:
Federal Public Defender, 11(1). (2002, March). Western District of New York. [online]. Available:
Heiser, J. G., & Kruse II, W. G. (2002). Computer forensics: Incident response essentials. Boston, MA: Addison-Wesley.
Power, R. (2002). 2002 CSI/FBI Computer Crime and Security Survey. [online]. Available:
Stambaugh, H., Beaupre, D., Icove, D., Baker, R., Coessaday, W., & Williams, W. (2001, March). Electronic Crime Needs Assessment for State and Local Law Enforcement. National Institute of Justice. [online]. Available:
Techtalk Update, 21(2). (2001, October). [online]. Available:
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 39 U.S. Department of Justice, Office of Justice Programs, National Institute of Justice. (2001). Electronic crime scene investigation: A guide for first responders. [online]. Available:
Ron Weiss, Jr. has been involved in law enforcement for over six years. He started his career as a police officer at the University of Illinois and eventually became an investigator. While in investigations, he focused on computer-related crimes ranging from harassment, fraud, and minor computer intrusion cases. Weiss is currently employed by the Illinois Attorney General in the High-Tech Crimes Bureau. Mr. Weiss is a Certified Forensic Computer Examiner by the International Association of Computer Investigative Specialists (IACIS).
40 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Vision for Cyber-Crime Investigations Allen E. Jones, Deputy Sheriff, Investigator, Champaign County Sheriff’s Office With the rapid changes in computer/Internet technology, law enforcement must adapt practices and procedures to properly investigate the constantly rising level of cyber-crime. The practices and procedures must be rooted in the proper use of technology in accordance with the rule of law, and the officers must have the ability to recognize the various forms of computer crime and technology. As will be demonstrated by a discussion of the history of cyber-crime, including scope and numbers as well as the technological barriers that face law enforcement, agencies as a whole must commit to a vision for the future of cyber investigations. This vision must include seeking and making use of specialized computer training and procedures with an endeavor to continually update that training with testing and revisions as necessary. The officers must familiarize themselves with the various types of software/hardware on the market that will facilitate a sound investigation and preserve the fruits of the investigation for later presentation in a court of law. Without sound investigative and forensic techniques, the evidence obtained would be of no value.
Background of Cyber-Crime Scope/Numbers There will be an estimated 741 million users on the Internet by the end of 2002, and the number continues to rise (www.intergov.org/public_information/ general_information/latest_web_stats.html). According to InterGOV International, the number of Internet users has grown from just under 70 million in 1996 to the current projections of 741 million by the end of 2002.
Figure 1. Internet Users
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 41 The Internet, made up of numerous online communities, provides many victims for opportunistic criminals to pursue. Families are finding more uses for the Internet and the personal computer daily, including such things as communication, shopping, and record keeping. Some find the Internet to be an enormous place full of worthwhile information and resources, while others consider it a playground full of victims and pleasure.
Top uses of the Internet, categorized by interest, include news/information, adult content, chat room/discussion groups, and games. One of the most appealing aspects of the Internet is the supposed anonymity that comes with surfing “the net” from the luxury of the home or office.
As can be imagined with the rise in the number of Internet users, there was a rise in reported crime, albeit slowly. Internet crime victims were either slow to report, or failed to report, their victimization because “. . . the victim of computer crime often remains unaware that an offense has even taken place” (Goldman) or “Victims may have serious doubts about the capacity of the police to handle computer crime incidents in an efficient, timely, and confidential manner” (Goldman).
As demonstrated in Figure 2, the levels of criminal and civil complaints filed as a result of computer crime did not rise as equally as the number of Internet users from 1996 through 2001, including projections for 2002 and as depicted in Figure 1.
Figure 2. Criminal and Civil Complaints Filed
According to the Internet Fraud Complaint Center (IFCC), there were 49,711 complaints filed on their website in 2001, and from those complaints, the total dollar loss from all referred cases of fraud was $17.8 million (Internet Fraud, 2001).
42 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Further information about computer-related crime includes the following facts:
• Approximately $5.5 billion worth of software was stolen over the Internet last year, which is only a small portion of the total loss that the Software Publishers Association believes was lost to piracy. • The cost to credit card companies from the theft of or posting of stolen card numbers to the Internet has been estimated to be over $3 billion. • No more than 10% of computer crime gets reported, and of all computer crime cases reported, fewer than 2% result in convictions. • Around 80% of computer crime is committed by “insiders” or those who work for the company they victimize. The other 20%, results in losses estimated from $100 million by some estimates to $1 billion by others (www.intergov.org/ public_information/general_information/latest_web_stats.html).
For those with criminal intentions, initially the cost of purchasing and using a computer for illegal purposes outweighed the gain, but as time went by and the number of Internet users increased, the number of available victims increased, and the “profitability” of criminal activity saw a rise as well.
Investigation Barriers/Cautions As noted, Internet crime was producing staggering profitability for those inclined towards that activity, and an interesting aspect of computer crime was that a person who wanted to use the computer to facilitate a crime did not necessarily have to be a “computer expert.” When a computer savvy criminal did make use of the available technology, however, detection became more difficult. Certain types of technology present challenges to law enforcement and as such must be addressed. Examples of technology that continue to challenge law enforcement personnel are networks (home and business), wireless, encryption, and steganography.
A primary goal of a law enforcement investigation is to gather all of the relevant data possible to make a determination as to the likelihood that any individual(s) committed an offense. When faced with technology and computer crimes, the investigator may be forced to conduct an investigation of a crime in which the suspect was using networked computers, and determining which user committed the crime becomes more challenging. A network is a group of two of more computer systems linked together (www.onlinedictionary.com). Several different types of networks exist, including the Internet, but for the purposes of this article, the following will be presented and the practical application of each discussed. Local-area networks (LAN) are networks in which the computers are geographically close together, that is, in the same building, connected via network hardware. Each computer will be identified on the LAN by its own unique IP number, and all transactions conducted at that computer will be linked to that number. In order to determine who used that machine on the LAN, the network administrator and associated computer-generated logs must be contacted for assistance. In a LAN, the suspect may store the data (fruits of the crime) in one network volume while working from a specific machine. Specific training in network topology and terminology is required in these types of investigations.
Wide-area networks (WAN) are computer networks in which the computers are farther apart and are connected by telephone lines or radio waves, such as wireless
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 43 technology. A common application of the WAN is the home-area network (HAN), which is a network contained within a user’s home that connects a person’s digital devices. With the proliferation of home-area networks, the challenge to law enforcement is similar to that of the LAN, which is to determine which user of the network committed the offense and then to identify where (which computer) the evidence of that crime will be located.
Take, for example, an apartment building with numerous apartments and occupants. The multiple occupants decide that it would be more cost-efficient to purchase Internet access as a group as opposed to individually subscribing to that service. With the common availability of broadband Internet, the occupants choose between DSL and cable Internet service, pay a monthly fee, and have constant, (always on) Internet access. Once the service is purchased, the occupants purchase the appropriate networking hardware, (e.g., wireless router) at minimal cost and share the Internet connection over a maximum of 254 computers.
The challenge for law enforcement comes in determining which user and which apartment committed the crime, since all activity via the Internet will appear to have been committed by the one person that registered his or her name as subscriber of the Internet service. The use of wireless technology and laptop computers makes this determination more difficult as well because wireless technology allows for connectivity ranges of a couple hundred feet, thereby allowing the suspect to access the Internet via their own or someone else’s account while not actually being on site or even being authorized to do so.
Encryption presents additional challenges to officers when conducting investigations or examining computers after seizure. Encryption is the translation of data into a secret code that allows for transmission to another person. Encryption is the most effective way to achieve data security. To read an encrypted file, you must have access to a secret key or password that enables you to decrypt or open the message/data. Communication via e-mail may be encrypted preventing interception and reading of content. Additionally, portions of hard drives may be encrypted, making them inaccessible to any person that does not have the key (i.e., forensic examiners attempting to gather the necessary information for case prosecution).
Finally, steganography allows the ability to hide data within data and conceals the fact that such confidential information is present. To accomplish this, data is first encrypted and then encoded into the “background noise” of other files. These files containing hidden data are called carrier files. These carrier files can be sound or graphic files. Using steganography, a person can place a file containing contraband or data of a criminal nature into what appears to be an innocuous file and transmit that to a cohort without raising suspicion. The carrier file can then be opened by the cohort using the same steganography program used to create the carrier and the appropriate pass phrase, or key, required to open the carrier.
Investigators Need Specialized Computer Crime Training and Procedures to Follow The most appropriate way to address these technological issues is to ensure that investigators receive specialized computer crime training relating to locating and preserving the volatile nature of computer crime evidence. Using appropriate
44 Illinois Law Enforcement Executive Forum • 2002 • 2(3) techniques and procedures, an investigator can make a determination as to what is required as evidence, collect it, and then present the evidence to a computer evidence recovery technician for forensic analysis. As noted, a law enforcement investigator does not need to be a “computer expert” to investigate computer crime, but “specialized training” relating directly to the use of computers in computer crime investigations and the best practices for seizing computer evidence is important. This training is widely available throughout Illinois and the United States from institutions such as the Illinois Computer Crime Institute (www.hightechcrimes.net), an entity funded through a grant by the Illinois Law Enforcement Training and Standards Board and administered by the Office of the Illinois Attorney General and the High Tech Crime Institute (www.hightechcrimeinstitute.com), a private company specializing in computer crime training for law enforcement officers of all jurisdictions across the United States. The training presented by these institutes familiarizes officers with the various forms of technology, including input/output devices, modems, network interface cards, and what the future holds for computer technology.
Investigators are introduced into the make up of the Internet and the transmission control protocols that are required in order for the Internet to exist. Fundamental to that introduction is the understanding of how computers communicate via the Internet and the fact that there is a trail left behind for every action on the computer such as e-mail tracing. Once investigators have mastered the techniques and procedures for identifying the required information for tracing an e-mail and conducting the “trace,” they will have mastered the majority of concepts that are required in cyber investigations.
Additionally, officers are required to understand that when a computer contains evidence that needs to be preserved for forensic examination and/or future court presentation, some evidence may be in a volatile state that may be lost if certain procedures are not adhered to. For example, a text suicide document created by a user who ultimately commits suicide will likely be resident only in random access memory (RAM) at the time that officers are called on scene to investigate. If conventional “power down” or seizure protocols are followed without consideration for potential loss of data, the text suicide document may be lost.
Conversely, if officers sit down at a running machine and begin conducting searches (Start + Search for file or folders + .jpg for example), then the officer is changing file access date and time stamps that may be relevant to the investigation/prosecution upon completion of the forensic exam. Additionally, if the seized computer system is powered on after seizure, then there will be changes made to the original best evidence in relation to file access dates and times and/or any other data on the system. Needless to say, the integrity of the evidence is compromised. Examinations of suspect machines should be conducted by trained computer forensic examiners.
The U.S. Department of Justice’s (DOJ) January 2001 Guide to Search and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations manual (the Manual) (www.cybercrime.gov/searchmanual.htm) was created as a guide to offer guidance and authority to local, state, and federal law enforcement agents when searching and seizing computers. Training in the applications discussed in this manual is important for any agency coming into contact with computers
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 45 in an investigative capacity. The Manual also provides guidance and suggestive language in regards to warrant affidavits and subpoena information.
Beyond the fact that investigators should be familiar with the proper seizure procedures for computers, there is a great likelihood that their failure to be familiar with the Manual could be used as leverage against them in court. Defense counsel across the country has been forced to address the issues of computers in criminal offenses, just as the entire criminal justice system has. In accordance with the requirement that the defense counsel be the champion of the accused, the following paragraph taken from a defense counsel’s training document should be noted:
Armed with the Manual, and despite very little (and generally unfavorable) case authority on computer searches, defense counsel may be able to make serious challenges to warrant affidavits and computer searches. Exposing a case agent’s lack of familiarity with the Manual (and its predecessors) on the stand at a suppression hearing will permit strong challenges to the Government’s invocation of the good faith exception to save unconstitutional general searches (Hoover, 2002).
Recovery of computer evidence such as images of child pornography must be treated as contraband and secured just as any seizure of drugs or narcotics would. Specific computer evidence handling policy and procedure must be in place to serve as a guide for investigators and evidence technicians when in contact with that material.
Additionally, while most, if not all state and federal statutes, authorize possession of contraband images by law enforcement personnel in conjunction with the official discharge of their duties [Illinois Compiled Statutes 720-5/11-20.1(b)3]. The charge of child pornography shall not apply to the performance of official duties by law enforcement or prosecuting officers, court personnel or attorneys, nor to bonafide treatment or professional education programs conducted by licensed physicians, psychologists, or social workers having a specific departmental policy/agreement as to the nature of those investigations, who is authorized to conduct those investigations, who will that investigator report to, and how the investigations are to be conducted is fundamental.
Police Need to Make Use of Appropriate Investigative Hardware and Software In regards to the hardware necessary for conducting Internet or online investigations, the name brand or type (laptop or desktop) is not set in stone, but there are a few details that must be covered.
First, what is the purpose of the investigation hardware? Some investigations allow the use of any computer that has access to the Internet and the information collected is just information, not evidence. An example of this would be when the machine is only used to research complaints regarding websites or that are used to communicate with other law enforcement resources. There is no intention to use the machine as an evidentiary item, and any data on the machine contains no evidentiary value.
46 Illinois Law Enforcement Executive Forum • 2002 • 2(3) When the issue of evidence enters into the equation, an investigator must consider how to limit access to the machine by third parties that are not part of the investigative process as well as create an appropriate chain of custody to assert that no evidence downloaded and present on the computer system was altered, or “planted” by anyone, including the investigator. Lack of proper evidence custody will present difficulties at trial.
Second, will the machine only be used to conduct reactive investigations that do not require the use of “undercover personas” or will the machine be used for proactive solicitation investigations? If a machine is simply going to be used for identifying illicit websites, resolving domain name service (DNS) information or communication with other investigative resources, there is no reason to worry about the type of Internet connectivity.
If the system is intended for use as an undercover machine, however, possibly involved in sexual exploitation of minors or software piracy investigations, then it is imperative that the system be a “stand alone” system not connected in any way to the local department network. During the course of the undercover investigations, the officer may pose as a trader of pirated software or child seeking companionship and in doing so exchange instant messages or e-mail with the suspect(s). The techniques and tactics taught to law enforcement relating to the determination of the “true identity” of the suspect are freely available to the general public as well (most commonly relating to spamming). It would be possible for a suspect to identify the Internet host for the officer and determine that the officer was connected to the Internet via the network at the local police department. The recommendation in relation to Internet connectivity is to purchase the service through a local cable, DSL, or dial-up service. The first two options provide the greatest speed and efficiency while some dial-up services provide great flexibility in work locations.
The remaining issues relating the hardware need tend to lend themselves to the efficiency of the investigator. There will be a need for archiving hardware such as CD Read-Write drives or DVD Read-Write drives. The investigator is likely to require a machine that is capable of handling a large number of simultaneously running applications and therefore requires the maximization of the random access memory (RAM) in the machine. Output devices must be able to handle the volumes of data, information, and evidence that are required in these investigations. Monitors must be of sufficient size and clarity as to not hinder the investigator, and printers will be required for printing “hard” copies of all images and/or chat logs.
In regards to the software requirements, a large part of the need for software is determined by the type of Internet investigations to be conducted. Investigations can take place in various online environments such as America Online (AOL), Microsoft Network (MSN), Internet Relay Chat (IRC), as well as bulletin boards or newsgroups. In regards to sexual exploitation of children or dissemination of child pornography, an investigator is free to choose the venue they are most comfortable or familiar with when initiating the investigation; however, irregardless of the venue or application used for the investigations, there must be logging capabilities associated with the software. Logging is simply the process of creating a text copy of the instant message chat or chat room conversations that take place during
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 47 the course of the contact with the suspect. Ideally, tested applications will be employed that automate the logging features so that the investigator has no need to address the preservation by cut and paste activities at the conclusion of the chat. Additionally, automated logging features prove effective in the often encountered computer crash, where as that data would be lost without the specific application. The logging feature serves as a complete and accurate depiction of the chat through the eyes of the investigator and will be used to demonstrate the predisposition of the suspect. Examples of logging applications that I have used and tested are Power Tools 1010, Trillian11, and the logging features associated with mIRC12.
Other tried and tested software applications include screen capture utilities for capturing graphic images and data/text or web cam images sent during the investigation. Internet Protocol (IP) addresses resolution tools whether automated or available via the World Wide Web. Graphics editing/managing applications that provide the investigator with the tools to view any file type and preserve/manage those files for evidentiary purposes are a necessity.
Investigative Procedures Must Be Legally and Forensically Sound Once the training is received, the computer system purchased and the software applications tested, the next vision for the law enforcement investigator is to use procedures that are both legal and forensically sound. In regards to legal issues, especially when dealing with solicitation, unlawful dissemination of contraband, and pirating investigations, the officers must employ tactics that meet the rule of law for that jurisdiction. It is not common, nor endorsed, for a police officer to enter a chat room posing as a child and declare that they are a child of certain age and specify that if any person wants to engage in “cyber sex,” instant message immediately. This behavior, albeit not uncommon, is not the endorsed procedure for Internet crime investigations. Instead, the officer will enter a chat room using the undercover persona, complete with user profile information, and wait for an interested party to initiate the conversation. Once the conversation is initiated and there is reason to believe that the suspect is inclined to commit an offense, in this case sexual exploitation of a child, then the officer can proceed with identification of the suspect.
Obtaining the true identity of the offender depends on the ability of the officer to identify the Internet Service Provider (ISP) of the suspect via identification of the IP address associated with the account. Once that is done, the subscriber information may be requested via appropriate legal channels with the ultimate goal being determination of the identity of the suspect.
The Electronic Communications Privacy Act (ECPA) is a federal statute that governs what information must be recorded by the ISP and how that information may be revealed to law enforcement officials. Generally, officers are after two types of information: (1) subscriber and (2) content. The ECPA allows ISPs to provide subscriber information to law enforcement pursuant only to service of a court order/subpoena. Additionally, content information such as the content of e-mail can be turned over only pursuant to issuance of a search warrant. Finally, the ECPA does provide a provision to obtain an “electronic wire tap” (18 U.S.C. §§ 2510-22), which would allow the interception of content in “real time” with federal court approval for the purposes of the investigation.
48 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Subscriber information as defined by the ECPA includes subscriber’s name, subscriber’s address, subscriber’s local and long distance telephone toll billing records, subscriber’s telephone number or other subscriber number or identity, length of service, types of services utilized by subscriber, means and source of payment (credit card/bank account numbers) records of session times and duration, and any temporarily assigned network address. The accepted practice in regards to obtaining subscriber information is to obtain the court order/subpoena through the appropriate processes then fax a copy of the subpoena to the custodian of records and await the return of the information.
Content as stated is the data contained within the e-mail message, and the accepted practice for obtaining content is to obtain a search warrant in the jurisdiction in which the data resides and serve upon the ISP via personal service. For example, when requesting to serve a search warrant upon AOL, the accepted practice involves the requesting officer writing an Affidavit and Complaint for a Search Warrant in their own jurisdiction then having that document notarized. Once that sworn affidavit is notarized, the officer will fax it to the local jurisdiction, again with AOL, Loudoun County, Virginia. The Loudoun County officer completes a Complaint and Affidavit for Search Warrant in Virginia using the provided affidavit as the foundation of the probable cause and obtains a search warrant in that jurisdiction. The warrant is then served on AOL, and the evidence is returned to Loudoun County and ultimately copied to the original requesting agency.
The above processes can at times be complicated and confusing, further emphasizing the need for law enforcement officers to receive constantly updated training in relations to cyber investigations. In addition to what the ECPA allows, the ECPA also has provisions that state that if a law enforcement officer violates those provisions and obtains the information outside the scope of the ECPA authority, then that officer shall be held personally liable for any actions. The personal liability warrants the demand that officers be legally sound in their investigative processes.
In regards to officers using forensically sound procedures, it should be noted that a portion of this topic was covered previously when the issue of search and seizure was discussed, but this issue should not be minimized. The ultimate goal of an investigation is preparation of the case for prosecution thereby requiring that the “best evidence,” be recovered, preserved, and presented for trial. In order to obtain the “best evidence,” the investigator must seek out forensic examiners and/or forensic laboratories that follow sound forensic protocol and that have adequately trained evidence recovery technicians. Items of concern for the investigator when dealing with a forensic computer evidence recovery involve the training and certification of the examiner as well as forensic procedure.
At minimum, the forensic examiner should have received specialized training from an industry-accepted and/or accredited organization such as the International Association of Computer Investigative Specialists (IACIS) (www.cops.org) or the National White Collar Crime Center (NW3C) (www.cybercrime.org). There are additional training institutions, but the training from these two organizations certainly merits mention and qualifies as appropriate training. Certainly once trained, the forensic examiner must continue the process through testing and research and development.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 49 IACIS maintains the following forensic examination standards to ensure that competent, professional forensic examinations are conducted by IACIS members:
It is acknowledged that almost all forensic examinations of computer media are different and that each cannot be conducted in the exact same manner for numerous reasons; however, there are three essential requirements of a competent forensic examination. These are . . .
1. Forensically sterile examination media must be used. 2. The examination must maintain the integrity of the original media. 3. Printouts, copies of data, and exhibits resulting from the examination must be properly marked, controlled, and transmitted (www.cops.org/ forensic_examination_procedures.htm#Forensic%20Examination %20Procedures).
The High Tech Crime Bureau within the Office of the Illinois Attorney General operates three Regional Computer Forensic Labs (RCFL), Chicago, Belleville, and Springfield. These labs not only meet the above mentioned standards, but are also staffed by evidence recovery technicians that have attended the trainings mentioned above as well as several who have been recognized as Certified Forensic Computer Examiner’s (CFCE) by IACIS. The use of the RCFL for forensic evidence recovery is available to every law enforcement agency in the State of Illinois free of charge.
The use of technology for criminal actions will not cease, nor will law enforcement as a whole be able to stop cyber-crime. Law enforcement can, however, resolve to a vision of training officers in the use of technology for the purposes of recognizing, apprehending, and prosecuting cyber criminals. Application of such training requires a constant update of the software, hardware, and practices used during the course of these investigations as well as a working knowledge of the case law relating to computer crime investigations. Finally, officers must commit themselves to using investigative procedures that are in accordance with the rule of law and that are forensically sound to facilitate the presentation of the best evidence in court.
Bibliography www.intergov.org/public_information/general_information/latest_web_stats.html
Goldman, M. Making computer crime count. FBI Law Enforcement Bulletin.
The Internet Fraud Complaint Center. (2001). Internet Fraud Report. [online]. Available:
50 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Hoover, T. W. (2002). An introduction to the DOJ’S manual on searching and seizing computers. [online]. Available:
Illinois Compiled Statutes 720-5/11-20.1(b)3 www.bpssoft.com, BPS Software www.trillian.cc, Cerulean Studios www.mirc.com, mIRC Co. Ltd
Electronic Communications Privacy Act. 18 U.S.C. §§ 2701-11
18 U.S.C §§ 2510-22 (“Title III”) www.cops.org www.cybercrime.org www.cops.org/forensic_examination_procedures.htm#Forensic%20Examination %20Procedures
Allen Jones has been a deputy sheriff with the Champaign County Sheriff’s Office in Illinois since 1989. He has been assigned to the Investigation Unit since 1999 where he has specialized in Internet and computer-related investigations and is a member of the Illinois Internet Child Exploitation Task Force. Investigator Jones is currently detailed to the Illinois Office of the Attorney General where he serves as the Director of the Regional Computer Forensic Lab in Springfield and works as a Computer Evidence Recovery Technician.
Allen Jones is a high-technology crime instructor for High-Tech Crime Institute, where he trains law enforcement officers across the country in the proper procedures and techniques used in numerous online/computer- related offenses including fraud/identity theft, cyber stalking, intrusion, and child pornography. Jones has a great deal of teaching experience and is certified by the Illinois Law Enforcement Training and Standards Board for instruction of Internet-related investigations.
Investigator Allen Jones is the team leader of the Mid-State Illinois Regional Computer Crimes Enforcement Group (RCCEG) and a member of the International Association of Computer Investigative Specialists (IACIS), where he is certified as an Electronic Evidence Collection Specialist (EECS) and as a Certified Forensic Computer Examiner (CFCE) by IACIS. Other memberships include the Mid-Western chapter of the High Technology Crime Investigation Association (HTCIA), Professionals Against Confidence Crimes (PAC-C), American Society of Law Enforcement Trainers (ASLET), and the University of Illinois PTI Alumni Association. Allen Jones has a BS degree in criminal justice from Illinois State University.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 51 52 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Cyber Child Sex Offender Typology
James F. McLaughlin, Keene, New Hampshire Police Department
January 13, 2000 marked the end of a three-year Internet Law Enforcement project conducted by the Keene Police Department. Over 200 offenders from 40 different states and 12 foreign countries were arrested, and over 2,000,000 child pornographic images were seized. This article will attempt to catalog the characteristics of cybersex offenders who were arrested during this initiative.
At the outset, the reader should be aware that this project targeted “fixated” (Groth, 1978) or “preferential” (Dietz, 1983) sex offenders who target male child victims.
We selected this target group for the following reasons:
• Those preferential sex offenders who select male children as victims are more apt to collect child pornography (Lanning, 1992). • Those preferential sex offenders who exclusively target male children tend to, on average, have more victims than other child sex offenders (Abel et al., 1987). • Male victims are less likely to report sexual victimization (Pescosolido, 1989). • Male victims are more vulnerable to extra-familial preferential sex offenders. • A cursory check with law enforcement agencies involved with Internet sex crime investigation showed more attention being paid to adult male offender/female child victimization.
It should also be noted that, due to certain case circumstances, a system of investigation prioritization was developed. Although this continuum was initially followed, in the final analysis, it wasn’t always correlated with the most dangerous offenders being apprehended. Computer cases start off with limited suspect information about who is behind the keyboard during undercover operations. Some of the most dangerous offenders were initially viewed as simple collectors, and it was only after they were searched that their true motives were realized.
Some offenders (n = 13) intended to travel for illegal sex but were arrested before they could do so because of ethical considerations. An offender who is already molesting children and saying he plans to travel in the months ahead would be prioritized for immediate arrest. These offenders were categorized as “travelers” nevertheless, although they were only charged with possession/distribution of child pornography. Travelers also included those arranging to have the child travel to them and who were arrested at airports or bus terminals.
The factors used for investigation prioritization were as follows:
• When the suspect is a parent or has children living in the residence • When the suspect has a prior arrest or has been investigated for crimes committed against children or any crime of violence
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 53 • When the suspect demonstrates an eagerness to travel for the purpose of engaging in illegal sexual contact with children and/or encourages or facilitates children to travel for said purpose • When the suspect is involved directly in the manufacture of child pornography • When the suspect demonstrates an interest in dangerous sexuality, including but not limited to necrophilia, sadism, bondage, and erotic suffocation • When the suspect admits to past sexual contact with children • When the suspect holds an occupation or vocation that allows direct access to children, including but not limited to teachers, childcare workers, and athletic coaches • When the suspect holds a position of trust and/or authority, including but not limited to law enforcement officers, attorneys, medical personnel, and religious leaders • When the suspect holds an occupation or vocation that allows for indirect contact with children, including but not limited to school bus drivers, crossing guards, and school janitors • When the suspect is engaging in behavior on the Internet suggesting he possesses, and is involved in, the distribution of a large volume of child pornographic images • When the suspect is involved in collecting child pornography and uses/ distributes child pornography as currency for trading purposes
As a group, these offenders (n = 200) ranged in age from 13 to 65, with a mean average of 35.7 and median age of 45. More importantly, the modes showed an equal distribution for those in their 20s (25%), 30s (23.5%), and 40s (26%), with those under 18 (10.5%) and those older than 60 (2.5%) with less representation.
Occupations for these offenders broke down as follows: students – 22%, laborers – 22%, computer field – 13%, white collar – 13%, retired/unknown – 11%, youth workers – 4%, educators – 3%, legal profession – 3%, medical profession – 3%, disabled – 3%, military – 1%, church officials – 1%, and unemployed – 1%.
A characteristic of offenders gaining access to children through volunteer positions or engaging in activity that children are attracted to has been extensively written about (Groth, 1978; Lanning, 1992; and Tower, 1993). Those with no access to children represented 41%, and those with a prior arrest for a sex crime represented 12%. Two offenders had two prior convictions and resided in states with three- strike felony laws that resulted in life sentences. All but two pairs operated independently; this is not to say that online networks of offenders don’t exist. In fact, many offenders unknowingly made online introductions to other offenders who were ultimately arrested. The two pairs who acted in concert lived together—one pair met online and moved in together as a result of their common interest. This population has two female offenders (1%), which is statistically consistent with noncomputer-using sexual offender rates on gender (Finkelhor & Russell, 1984). Excluding the two female subjects (who were both married), 12.5% of the male offenders were married; 1.5% were divorced; and 86% were single.
During this project, suspects were encountered in real-time chat rooms, newsgroups, and other static posting sites. Differences in the way these offenders operated were observed. The following typology based on behavior was developed.
54 Illinois Law Enforcement Executive Forum • 2002 • 2(3) “Collectors” (n = 143) Those involved in child pornography collecting ranged in age from 13 to 65 years old. This group consisted of many “entry-level” offenders. Most of these offenders did not have any prior contact with law enforcement or any known illegal contact with children. Because computer users feel they are anonymous and falsely believe they are untraceable, it is believed that there may be more people engaging in the collection/trading of child pornography who would have never have done so had it not been for the Internet.
Finkelhor (1984) found four preconditions that must be met before an offender can molest a child. We can extrapolate that these same four preconditions must be overcome to engage in the collection of child pornography since there is ample social stigma against engaging in such behavior. One of these preconditions is to overcome external inhibitions. The Internet eases overcoming this precondition, allowing for more marginally deviant, driven offenders to engage in this illegal behavior. The majority of these offenders were single, living alone, and would be regarded as socially isolated. Still another group (21%) involved themselves in occupations and/or vocations involving contact with children. Their collection of child pornography mixed with their access to children is a dangerous combination and thus of keen interest to law enforcement.
Many offenders in this group start off collecting photographs of children from static locations on the Internet such as newsgroups and web pages, which do not involve real-time online interaction with other computer users. Literally thousands of photographs can be collected in this manner. It is unknown why most collectors escalate from these static locations to dynamic locations, involving real-time interaction with others on web-based chat rooms and Internet Relay Chat. It is when they go to these dynamic locations that they start to distribute child pornography. These dynamic locations use child pornography as currency for trading. Prior to the Internet, the majority of collectors did not involve themselves in distribution. Technology was not realistically available to make quality copies of magazines, photographs, slides, and 8MM movies. At present, making copies of image files involves a few clicks of any computer mouse, allowing for effortless distribution.
Chat rooms number in the thousands. Child pornography chat rooms vary and often are divided into very specific subgroups, depending on what type of human physical attributions the collector is attracted to including preteens, pubes, teens, and “twinks” (older teens/college age). Once in these rooms, offenders trade photographs by using categories, describing what type of pictures they are interested in, which include poses, nudes, action, bareback, and others. Some offenders seek specific photographs of children by ethnic groups such as Euros, Indians, Asians, and boys of color. Specific sexual acts involving boys with boys, boys with adults, and even as specific as whether the child is circumcised or not (cut versus uncut) are traded. It may be when an offender wants to collect specific photographs, like those of blond-haired, blue-eyed boys in saunas that he needs to interact with others in order to secure these specific photographs to meet these specific deviant needs. These offenders typically set up the directories in their computer-to-file photographs so they can be retrieved readily and quickly during online interactions.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 55 Real-time trading also involves some users setting up their computers as file transfer stations (FTP/F-servers). Users connect to these traders over the Internet and can see a directory of files that can be traded for. The user uploads a child pornographic image file and receives credit to download the specific files he wants. Users as young as 14-years-old were found operating large trading centers from the safety and security of their bedrooms.
The number of photographs seized from these offenders ranged from a few hundred to tens of thousands. (One New Hampshire offender had 43,000 image files.) The need for additional computer storage is the rule because image files take up a lot of computer space. Extra hard drives, zip and jaz® drives, as well as storage in cyberspace is used, especially by those on parole/probation or who share their computers. One high school teacher arrested in Indiana stored his photographs on the high school’s mainframe. Offenders who live alone will frequently make hard copies of their favorite photographs. These printouts are typically found in the offender’s bedroom and are used for fantasy during masturbation. Many offenders become aware of and learn the names of hundreds of file names and photographic series. They can quickly recognize if they have seen a photograph before and if it has been renamed. Given the immense number of series and photographs on the Internet, this ability demonstrates the gross amount of time and effort collectors invest in this behavior.
Mixed in with this group are subjects who would probably never have engaged in this illegal behavior if they did not have access to the Internet. Discerning those subjects from those who may have past child victims or who might have future child victims is difficult given the low reporting rate for child sexual abuse crimes (Russell, 1983). Many states (including New Hampshire) consider the possession of child pornography a felony crime, and federal sentencing guidelines call for felony level terms of imprisonment.
Occupations of collectors arrested included college professor; social worker; camp director; attorney; high, middle, and elementary school teachers; youth counselor; and law enforcement officer.
“Travelers” (n = 48) Travelers are offenders who engage in online chat with children and use their skills of manipulation and coercion to meet the child in person for sexual purposes. These offenders (n = 48) ranged in age from 17 to 56, with a mean average of 34.7, and medium average of 34. The mode data showed the following: between 17 and 29 years old (38%), 30s (25%), 40s (27%), and 50s (10%). Most, but not all, travelers also collect child pornography. These offenders may not have any criminal history of sex offenses.
The distance these offenders were willing to travel after only a few minutes of chat online is at times unbelievable. Four traveled internationally (Canada, Holland, and Norway), and the others traveled to New Hampshire from ten different states. Over half of these offenders represented their age falsely as being in their teens, and after having built some rapport, revealed a more realistic, although still false, age. Over half of these offenders sent actual self-photographs; many were nudes.
56 Illinois Law Enforcement Executive Forum • 2002 • 2(3) These offenders show many of the same traits as listed in Lanning’s typology for “preferential/seduction” offenders.
Conversations with these offenders were very similar, involving the offender extracting personal information, developing trust, engaging in sexual chat, and sending pornographic images. Many of these offenders falsely assure themselves that they always empower the child and never coerce them to engage in sexual behavior that is not mutually desired by both parties. One offender’s computer illustrated how successful these offenders can be. Recovered were over 25 transcripts of conversations the offender had with boys ranging in age from 12 to 15 in five different states who gave their names, gave directions to their homes, and established safeguards (cover stories) to ensure that the offender would not be caught. These offenders would show up at appointed places with instrumentalities (e.g., condoms, lubricants, photo equipment, blankets, even Viagra®) to engage in the sexual behavior they articulated in their online chats. Other offenders opted to have the child travel and would send money or bus or airline tickets facilitating the child to then runaway.
Some of these offenders are the most dangerous persons a child can meet online. Although sadistic pedophiles represent a small fraction of child offenders (believed to be 1% or less), they can be lethal. Three offenders encountered during this operation would be considered sadistic pedophiles. One would operate concurrently in teen sex rooms and child torture rooms. He eventually sent money in the mail to get a male child to run away. He went to a large city bus station to meet the child and was arrested. During his chats, he stated the child would be able to live with him. A search of his home showed no such accommodations. One other offender’s home was searched, and photographs of dead children in shallow graves were seized. Still another was already in custody for child homicide. The subpoena had been complied with and the account owner/suspect identified, but it was too late. Occupations of travelers arrested included military officer, attorney, athletic director, priest, college professor, high school teacher, and civil engineer.
“Manufacturers” (n = 8) Not all collectors are manufacturers, but all manufactures are collectors. These offenders (n = 8) ranged in age from 26 to 53, with a mean average of 41.3 and median age of 40. It is safe to say that the number of manufacturers has increased over the years with the availability of new media. Home development of black and white 35MM film, self-developing Polaroid film, video cameras, camcorders, computer scanners, “CUseeme” technology, and now computer cameras (including video) have made child pornography easier and easier to produce and reproduce. It is estimated that over half of the child pornography and video clips are scanned (or video captured) images from child pornographic films and magazines produced originally in the 1960s and 1970s.
The Internet has turned the child pornography industry financially upside down. Most of what is available is free or available for trading with like materials. Child pornography is still available for sale. One such business, discovered during this operation and located in Russia, sells standard videotapes or CD-ROMs of child pornography. They funnel their order requests through e-mail by way of
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 57 a European country, and the money for the product goes through international banks. Since computer image files can be copied so easily, however, the product becomes available quickly, as soon as one person makes a purchase and shares the images electronically across the Internet.
There are locations on the Internet called “reflector sites,” in which computer users can connect and using an attached peripheral computer camera, broadcast their image as they sit in front of their computer, and view others who have also connected. Many of these reflector sites are available, and teens use them to connect with others in order to engage in cybersex. This also involves a live broadcast of them as they masturbate to an audience. Any person connected to the reflector site can record what he sees on his screen. These images can then be easily distributed to others. Sex offenders have been caught numerous times sending computer cameras to under-aged persons, so they could connect and view real-time sexual acts. There have also been criminal cases brought when an offender arranged with others to view himself engaging in real-time sex with a child victim on camera for others around the globe to view.
Many offenders go into public places like water parks and beaches to photograph children and then post the photographs on the Internet for all to view. There have also been photographs posted that involve the secret photographing of children in changing rooms and public bathrooms and of sleeping (exposed) children. This ease of manufacture can pose ethical issues. In one case, a 17-year-old male was photographing himself and distributing the photographs for free. The legislative intent of the statute is to protect children from the exploitation of others; it’s clear that lawmakers would not have anticipated situations like this.
More manufacturers were found to be sexually involved with children or to have criminal histories of sex offending. Investigations revealed many offenders in this group had photographed children they’d molested years ago, were actively molesting, or were in the process of seducing. On at least four occasions, runaway children were found being harbored in the homes of these offenders when search warrants were executed. Only one subject in this group had any financial gain as a result of distributing child pornography over the Internet, and that gain was clearly under $1,000.
Occupations of collectors arrested included professional nanny, photographer, airport worker, building superintendent, and youth music teacher.
“Chatters” (n = 1) These offenders usually do not involve themselves in child pornography, but some do collect child erotica. Most do not come to the attention of law enforcement because they ride the legal fence. Sometimes they are not clear on what is erotica and what is illegal material, often confusing “naturist” material with images involving the lewd exhibition of genitals. They often refuse to send any materials over the Internet and warn underage persons not to do so and not to trust others who send them image files. These subjects present themselves as the only person children can trust on the Internet. Chatters spend inordinate amounts of time online (as much as 12 hours a day or more). They also present themselves as “teachers” and offer and at times insist to be asked questions on any subject,
58 Illinois Law Enforcement Executive Forum • 2002 • 2(3) preferably sex. They draw behavioral lines while in chat rooms and stay within those parameters and expect others to follow. Most will engage in cybersex, and after some rapport is built up over time, they attempt to escalate the contact to phone contact. After some normal telephone conversation, they attempt to escalate it into phone sex. They are typically satisfied with this amount of contact and do not want to meet the child in person. These offenders are very ritualistic; once they develop a successful style to engage children online, they stick to what works.
Typologies of sex offenders are crude constructs drawn to aid in the understanding of the differences in behaviors. They typically paint with a broad brush, especially when dealing with behavior as complicated as sexual offending. Abel et al. (1987) has shown how it is rare for a subject to be involved in just one paraphilia such as pedophilia; multiple paraphilias appear to be the rule. The majority of subjects in this population validated this theory. Besides being involved in technophilia (McLaughlin, 1998), many offenders were also found to be involved in, but not limited to pedophilia, hebephilia, klismaphilia, partialism, urophilia, axilphilia, fetishes (especially the collection of soiled underwear), infantism, sado-maschism, and transvestite behavior. These searches also inadvertently revealed other criminal conduct, which included homicide, possession of explosives, controlled substance distribution and possession, firearm violations, and the harboring of runaways.
It is still safe to say that less than 1% of those committing crimes on the Internet are being apprehended. There are presently more and more local, state, and federal law enforcement agencies getting involved in this new arena. This has resulted in new operating policies being drawn based on what little is known to date about investigating these complicated crimes or on speculation alone. Sparse legal decisions exist to date, so a more conservative approach is being adopted to fight a problem with an immeasurable prevalence. Law enforcement needs to re-examine its approach and methods as this effort continues in order to keep pace with both changing technology and criminal cyber behaviors.
References Abel, G. G., Becker, J. V., Mittelman, M. S., Cunningham-Rathner, J., Rouleau, J. L., & Murphy, W. D. (1987). Self-reported sex crimes of non-incarcerated paraphilics. Journal of Interpersonal Violence, 2, 3-25.
Dietz, Park E. (1983). Sex offenses: Behavioral Aspects. In S. H. Kadish, et al. (Eds.), Encyclopedia of crime and justice. New York: Free Press.
Finkelhor, D. (1984). Child sexual abuse. New York: Free Press.
Finkelhor, D., & Russell, D. (1984). Women as perpetrators: Review of the evidence. In D. Finkelhor (Eds.), Child abuses: New theory and research (pp. 171-187). New York: Free Press.
Groth. A. N. (1978). Adult sexual orientation and attraction to underage persons. Archives of sexual behavior, 7(3), 175-181.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 59 Lanning, K. V. (1992). Child molesters: A behavioral analysis. Washington, DC: National Center for Missing & Exploited Children.
McLaughlin, J. (1998). Technophilia: A modern day paraphilia. Knight Stick: Publication of the New Hampshire Police Association, 51, 47-51.
Pescosolido, F. J. (1989). Sexual abuse of boys by males: Theoretical and treatment implications. In Suzanne Sgroi (Ed.), Vulnerable Populations, 2, (pp. 85-109). Lexington, MA: Lexington Books.
Russell, D. (1983). The incidence and prevalence of interfamilial and extrafamilial sexual abuse of female children. Child Abuse and Neglect, 7, 133-146.
Tower, C. (1993). Understanding child abuse and neglect. Boston, MA: Allyn and Bacon.
James F. McLaughlin has been a Keene, NH, police officer since 1981, after having served as a military policeman in the U.S. Marine Corps. He has earned an AA degree in police science from Mount Wachusett Community College, a BA degree in psychology from Keene State College, a certificate degree in child sexual abuse intervention from the University of Alabama, and a MS degree in criminal justice from Fitchburg State College. He is presently assigned as a detective with the investigation division. He also serves on the Attorney General’s Task Force on Child Abuse and Neglect. Send comments or questions to
The Regional Task Force on Internet Crimes Against Children for Northern New England web pages are maintained by the Keene Police Department web team. Send comments or questions to
60 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Technophilia: A Modern Day Paraphilia
James F. McLaughlin, Keene, New Hampshire Police Department
A 35-year-old man anxiously watches the clock on his office wall in anticipation of ending his workday. His coworkers would describe him as a person who tends to isolate himself from others. He really doesn’t have a friend, just acquaintances, and these relationships are shallow at best. He has withdrawn over the years from his extended family and often turns down social invitations. He spends considerable time alone. He leaves work as soon as the clock strikes four. Without any delays, he heads straight home. If waylaid in any manner, he experiences anxiety. He has a compulsion to follow through with his daily routine of leaving work at the same time and going straight home to his computer. He arrives home and doesn’t even take his coat off before turning on his computer. After a few keystrokes, he has his modem logging on to the Internet. Around his computer is evidence of his long hours in front of the monitor. The last microwave meals he has eaten are stacked nearby. The rest of the apartment appears unlived in. The computer, which he has set up in his bedroom, is the central feature of the residence. He double-clicks on a special icon he has set up as a shortcut to his favorite chat system. He selects one of his many fictional characters, deciding on this day to be a 14-year-old boy, “Donny14.” He enters a chat room called “#littleboysex” and joins a cyber community of persons of similar interests. The hunt begins.
This 35-year-old man may or may not be married; he may or may not have children. He might work as a teacher at the junior high school, a member of our armed services, a computer programmer, or be unemployed. He may or may not have been sexually abused as a child. He may or may not have a substance abuse problem. He may or may not have sexually abused any children or have any criminal record. Presently, there is no profile for people who go onto the Internet and seek out child pornography and sexual contacts with children or who want to engage in “cybersex”* with children. At this time, there is not enough data collected to determine if there is any difference between those who engage in the sexual abuse/exploitation of children in traditional ways as compared to those who employ computer technology to do so. Even at this early juncture, however, some insight can be gained from looking at a sample of those arrested for these crimes.
I have coined the term “technophilia” to describe the behavior of persons using the computer to engage in forms of sexual deviance. This is a relatively new phenomenon. Technological advances have just recently made computers available and useable for a wide range of persons. It stands to reason that a small portion of computer users would exploit this situation to facilitate their deviant goals. It has been reported that nearly one out of every four adults in North America (Weise, 1997) is currently connected to the Internet with a growth of 2,000,000 new users each month (Pyra, 1995). Our schools and libraries are joining the information highway at a quick pace. More and more children are logging on everyday. The Internet can open up a world of information, opportunities, and fun for all. It can also be a place where anyone, especially a child, can be placed at great personal risk.
*Cybersex: A role-play between two or more persons who type out a sexual scenario in live-time chat.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 61 Donny14 has been on the net for over two hours now. The regulars are on today as well as a few newcomers. He recognizes Rory16 from California, Hot4U from England, and Jafo, a boy-lover from Toronto. Suddenly, a new person enters the room, Billy14, with whom he immediately initiates chat. The conversation goes as follows:
Donny14: Hi what’s up Billy14: Notin yet! Donny14: :) Maybe i can help with that, where ya from Billy14: NH, u? Donny14: NY, near Albany. What ya look like Billy14: 5’6”, 128, brn, blue, 5.5 cut, u? Donny14: wow u sound hot, i am 5’7”, 132, blond, blue 6 cut got a self-pic Billy14: yea u? Donny14: yea lets trade Billy14: ok, sent Donny14: Man your pic is hot, What u in2 Billy14: kinda new, done cyber, pics and fone a few times, what age guys u like Donny14: Love 12-15, especially when they first get hair and have clear cum Billy14: me2 u got pics like that Donny14: yea u? Billy14: no i crashed and lost everything, can u help me out Donny14: yea sure here, start with these
After little more than five minutes, child pornographic pictures are sent over the Internet. At the same time, Donny14 starts to experience some sexual arousal and fantasies. He tries to imagine what Billy14 must look like, especially naked. Some would describe Donny14 as in a dissociate state as he pictures himself in sexual contact with this imaginary character. His thoughts and fantasies race as the conversation continues.
Exhibitionism, voyeurism, fetishes, and pedophilia are common paraphilias, as compared to klismaphilia, partialism, and formicaphilia, which are relatively rare. The paraphilias are described in the Diagnostic and Statistical Manual of Mental Disorders (1994) as “. . . characterized by recurrent, intense sexual urges, fantasies, or behaviors that involve unusual objects, activities, or situations, and cause clinically significant distress or impairment in social, occupational, or other important areas of functioning.” What determines what is deviant behavior and what is normal is a function of statistics and cultural norms, which change over time. In speaking about the definition of paraphilias, Kafka (1993) wrote . . .
Cultural and historical perspectives also determine whether a sexual behavior is considered mutual and consensual, as opposed to exploitative or coercive. Victimization often determines whether behavior is considered paraphilic. For example, while men are permitted to use pornography in our culture, if they read or utilize child pornography, they can be incarcerated; also, if a man calls an unsuspecting women over the phone and makes obscene comments or asks sexually oriented questions, he is considered to have a paraphilia, “telephone scatogia” (obscene phone-calling). Yet the telephone sex industry is booming. The critical distinction between obscene phone-calling and commercial
62 Illinois Law Enforcement Executive Forum • 2002 • 2(3) telephone sex is the presence of a willing participant on the other end of the line; you pay for the service and can talk about what arouses you.
Kafka (1993) has created another category of paraphilias that he calls “Paraphilia- related Disorders.” He defines them in this way:
. . . [they] comprise intense sexually arousing fantasies, urges, and activities that are culturally sanctioned but are carried out (again, over a period of at least six months) with a frequency or intensity that preclude or disrupt reciprocal affectionate and sexual activity. The principle distinction between a paraphilia and a paraphilia-related disorder is the deviance of the former with respect to social norms, which of course vary culturally and historically.
Both Kafka (1993) and Carnes (1983) describe the obsessive/addictive nature for subjects who engage in paraphilias. Many of the subjects arrested for computer sex crimes reveal the long hours they have sat in front of their computers collecting child pornography or engaged in other sexual activity. Massive child pornography collections with as many as 40,000 image files have been seized. These image files are divided and subdivided many times into folders according to age, hair color, sex acts portrayed, and many other categories. Some of these categories are very specific such as grouping prepubertal male children who are only wearing socks to circumcised pubescent children shown in bedroom settings. The amount of time it takes to download one picture, view it, and place it in a file folder, multiplied by the size of the collection, demonstrates the large investment of time these behaviors represent.
Abel et al. (1987) has shown how it is rare for a subject to be involved in just one paraphilia; multiple paraphilias appear to be the rule. Computer technology allows for the subject to engage in multiple paraphilias as a result of the many different functions available through the modern computer. These include exhibitionism and voyeurism through live-time video hookups, pedophilia through contact with children in chat rooms, telephone scatogia through voice programs and networks, and role-playing fantasies involving any paraphilia that can be facilitated through contacts and images available over the Internet. Technophilia involves any one or a combination of these behaviors through the use of modern computer technology.
Donny14 spends the next thirty minutes talking to Billy14 about sexual acts. This includes a detailed account of his first acts of masturbation through his complete sexual history. At the same time, he is constantly collecting information from Billy14. Periodically he remarks how sexually aroused he is and asks if Billy14 is also experiencing the same sexual arousal. Donny14 now has his pants down to his knees and is masturbating as he carries on this conversation. More pornographic pictures are sent. E-mail addresses are exchanged. Donny14 feels the opportunity and time is right and asks Billy14 what he thinks of guys in their thirties who like guys “their age.” Billy14 responds favorably and feels this is perfectly normal. Donny14 then reveals how he is really 35 years old. Billy14 continues the conversation. This causes Donny14 to think of other possibilities. Donny14 now feels comfortable enough to send a real picture of himself. He is on edge as he waits for Billy14’s reaction. When Billy14 reacts favorably to the picture, new thoughts and fantasies are generated and the conversation continues.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 63 The Internet can simply be defined as a global network of computers that are connected with each other. They are connected with network cables, telephone wires, microwaves, and satellites. The Internet has many sections, which include the World Wide Web, user groups, electronic mail, and Internet Relay Chat to name a few. The Internet has many opportunities for sexual deviancies beyond simple pornography collecting/viewing. The Internet has enabled people with very specific paraphilias to connect with one another.
In one of the older sections of the Internet called the Internet Relay Chat system (IRC) sexual offenders surf. This multiple user chat system allows users to chat in real-time with one another. IRC was created in 1988 by Jarkko Oikaninen at the University of Oulu in Finland with about ten regular users at the time of its inception (Pyra, 1995). Presently, at any given time, as many as 50,000 users are online in as many as 25,000 different channels (sample from three different nets on IRC, December 1997). Users can be on more than one channel at a time and engage in multiple simultaneous discussions. Offenders can easily navigate through IRC by simply using a “list channels” search device. A search word can be entered like “boy-love” or “preteen,” and the system will list every channel that includes these words, as well as show how many people are on each channel. The following channels can regularly be found: #100%preteenboysex, #100%littleboysex, #100%littlegirlsexpics, #rapesex, #NamblaManBoylove, and #snuffsex.
Channels have loose rules for conduct. These same rules do not apply to two users who meet on the channel, but to those who are engaged in a private discussion unseen by others. Openly trading image files is not allowed on some channels. Other channels are set up specifically for trading, and chat is rare. If an offender is not satisfied with the opened channels or the rules on those channels, he can easily set up his own. Key words indicating his interest can be entered so others searching for the same topic will find him. A few users develop a following and lock out others from their channels. You can only enter these channels if invited by one of the members. These channels are protected by a password.
Donny14 has already ejaculated once during this conversation, and his arousal again returns. He thinks of the possibilities of meeting Billy14 in real life. He brings up the idea, and Billy14 is agreeable to the idea, as long as it is kept secret and no one finds out, a condition that Donny14 quickly agrees to. The conversation continues with . . .
Donny14: How will u be able to get out for the night without your mom getting suspicious Billy14: I could tell her i am staying with friends, she never checks Donny14: ok, sounds kewl, Donny14: where ya want to meet, should be public so u can decide if I am ok Billy14: how bout McDonalds Donny14: sounds good, I will be there at 3:00 right after u get out of school Billy14: how will i know its u Donny14: I will be driving a red volvo, and I will have on a black baseball cap Billy14: K cya there
Many offenders go online into these chat rooms representing themselves as children. They come complete with a history and personal picture and chat away,
64 Illinois Law Enforcement Executive Forum • 2002 • 2(3) pretending to be a child. They maintain this character day after day, always sighting the same physical descriptions and other information about their fictitious character. They trade child pornography and engage in cybersex. They might also feel out the person they are chatting with, asking what their feelings are about engaging in sex with adult males. If the child responds favorably, they might reveal their true age or log off and then back on as their true character and engage the child anew. They further these relationships over time. Steps may include moving the child from chat, to phone contact, to phone-sex, soliciting the child to take nude pictures of himself (to be mailed to the offender), and possibly culminating with an “irl” (in-real-life) meeting for sex.
Some offenders go online and represent themselves truthfully. They are up-front about their love of boys and offer themselves as a faithful friend to younger chat room participants. They supply pornography when asked or may even send pictures before making a connection. After sending the unsolicited picture, they request to have a private chat and ask the child if he liked the picture and if he wanted more. Some offer information on sexual issues. Others seem to be more concerned with having the children fully describe what they look like naked or in collecting graphic information about their masturbation experiences. Some users collect specific accounts. Examples include boys who have been caught masturbating or ones who recall experiencing sexual arousal when having their temperature checked with a rectal thermometer. Specific channels are set up for those that have more general needs such as family sex, male incest, slave sex, snuffsex, or sexual humiliation to name a few.
As the day arrives to meet Billy14, many thoughts come forth. Maybe this is a sting, and he has been communicating with the police. Maybe it is a reporter for some news show setting a trap. But just the possibility that it is a 14-year-old male who will allow and enjoy sexual contact with him floods Donny14’s thoughts, and any degree of caution quickly erodes. He has packed a bag with condoms, lubricants, and the new computer camera he has bought especially for this occasion. He has showered and decided on wearing jeans and a sports shirt. He is halfway out the door when he remembers to bring his black baseball cap so Billy14 will know for sure that it is he. He has had difficulty thinking of anything else while at work. A thought of having sex with an attractive 14-year-old boy has been all he can think of. This continues to be the case as he sets out for the meet. His thoughts have been overwhelmed with Billy14 since they first met in chat some three days ago. He experiences anxiousness, sexual arousal, and fear all at the same time as he drives along.
There are channels specifically set up for people to connect for phone-sex. Channels such as “gayphonesex,” “teenphonesex,” and “phonesex” are examples. Users enter these channels and send out a message telling all channel members their physical description and sexual interest. They then wait for interested parties to ask for private chat. From the responses, they select someone to connect with over the telephone. Once on the phone, they role play sex verbally as they masturbate. One female offender would instruct her teenage male contacts to use a lubricant to enhance the sound of masturbation. These persons should not be confused with those who make obscene phone calls (scatophilics). The computer users on these channels do not want to shock others by making random calls. They want a willing
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 65 and accommodating participant with whom they can fulfill their mutual needs. Users might be specifically looking for teens, those who will humiliate with homophobic terms, or who will be submissive/dominant in the role-playing.
Also available are channels set up so people can connect visually with what is called “CUseeme” software. This involves the use of a “QuickCam” and software, which enables two or more users to connect their computers and see live-time video images of one another. Two users can connect and see each other as they expose their genitals and watch each other masturbate. Instead of watching a 3” by 3” image on his computer screen, one creative offender had the images sent to his big-screen television set. Reflector sights exist, which allow many users to see each other. As many as eight different windows can be opened for viewing. A chat box is also included so the participants, even those not sending video images, called “lurkers,” can talk about what they are doing and seeing. One offender from Tennessee was arrested recently who had sent out QuikCams to teenage boys so they could connect and masturbate for him. These QuikCams cost about $100.00 each. Another offender from Pennsylvania engaged in a live-time sex show with another adult male for an adolescent boy. Those participants who are into humiliation and submission field commands from others on how to sexually violate themselves.
His heart begins to race as he enters the city of Keene, New Hampshire. On the seat next to him are the directions he printed out. He’d used a computer program for road directions to chart and print out directions to McDonalds on Winchester Street. He pulls into McDonalds in an alert state and searches for the boy he will fulfill his needs and fantasies with. As arranged, he parks in the lot and waits for Billy14 to approach.
Suddenly two vehicles approach and block him in. Two men wearing bulletproof vests and aiming pistols at him demand he show his hands. Everything is a blur. The handcuffs are tight. A copy of a search warrant for his person and car is stuffed into his shirt pocket. He is seated in the rear of a police car and shortly finds himself in a holding cell. Eventually a detective tells him that a search of his residence will now take place. He can’t believe his world is being exposed. He wonders what will happen when they discover the 10,000 child porn pictures on his computer. He can’t believe he has revealed himself and what he is to the world—what now??
Although no statistics have been collected, it can be assumed, from the level of activity on the Internet, and the reports of arrest in the media, that the probability of being arrested for collecting or distributing child pornography over the Internet is substantially less than 1%. As a result, one of Finkelhor’s (1984) four preconditions for committing a child sexual abuse crime—that being overcoming internal inhibitions—is substantially weakened. It is theorized that as a result of the easy availability of child pornography, paired with the perceived anonymity of Internet users, has resulted in more subjects engaging in this behavior than ever realized to date. The true frequency of these crimes can not be calculated. Returning inhibitions, through the realization of arrests and subsequent negative consequences, may possibly help to curtail the frequency of these crimes. Searches of the homes of these suspects have shown that very few read newspapers or news periodicals. The offenders are using all of their time at work or in front of their computers in chat. The use of their computers isolates them. Cognitive distortions
66 Illinois Law Enforcement Executive Forum • 2002 • 2(3) about children and sex become entrenched. One offender said that after looking at thousands of pictures of children engaged in sex, he started to believe that sex was happening all around him and he had failed to ever recognize it in the past, let alone take advantage of it. So when an opportunity came his way over the Internet, he was primed to respond.
The following chart represents 46 subjects who were investigated for distributing and/or possession of child pornography (Title 18 sec. 2252), travelling interstate to have illegal sex with a child (Title 18, sec. 2243), and/or using a computer to lure a child (Title 18, sec. 2422). These investigations took place between May of 1997 and February of 1998.
Sexual Offenders Investigated Since June 1, 1997
Past Involvement/ Occupation Age Location sex arrest child College student 18 NE No College student 21 CT No College student 18 MA No College student 18 SC No College student 21 NH No Tutored children College student 20 NH No College student 21 NY No Youth camp worker College student 18 NH No College student 18 Canada No College student 29 VA Yes Computer technician 35 NH No Computer technician 38 TN No Computer technician 36 Canada No Computer technician 38 NH No Mother of two Computer technician 32 Canada No Computer technician 30 PA No Computer technician 41 CO Yes Computer technician 31 NH No Teacher (HS) 60 IN No Via occupation Teacher (Elem) 41 England No Via occupation Teacher (Elem) 38 FL No Via occupation Teacher (College) 49 PA No Youth group volunteer Laborer 29 PA No Member anti-porn group Laborer 41 NH No Laborer 39 SC No High school student 17 VT No High school student 17 NH No Engineer 59 NH No Father of three Engineer 46 NH Yes USAF enlisted 25 NE No Youth group volunteer USAF Captain 28 NH No Youth group volunteer Radio Station GM 44 NH No
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 67 Sexual Offenders Investigated Since June 1, 1997 (cont.)
Past Involvement/ Occupation Age Location sex arrest child Nurse 31 OK No Mother of one Fast food worker 24 NH No Off/Machine man 29 NY No Worked as nanny Airport worker 32 GA No Father of two Retired 65 NY No Taxi dispatcher 31 NY No Disabled 36 MA No Gas station worker 27 NH No Worked as nanny Truck driver 43 PA No Little league coach Youth Athletic Dir. 54 VT No Coach Maintenance worker 44 NY No Set up gym for kids Real Estate agent 43 Canada No Camp counselor Unknown 42 IN No Self-employed 24 CA No
The age range for these subjects is from 17 to 65, with a mean average of 33.5, and median age of 31. More importantly, the modes for this group indicate that younger adults are more likely to engage in this behavior. This may simply reflect the fact that more young adults, than older, are computer literate. An over-representation of those in the computer business and of college students has resulted. Again this might indicate more computer knowledge and use than anything else. A characteristic of offenders gaining access to children through volunteer position or engaging in activity children are attracted to has been extensively written about (Groth, 1978, Lanning, 1992; Tower, 1993). Those arrested with no access to children represented 41%, and those with a prior arrest for a sex crime represented 7%. This might indicate that those offenders who use a computer are more isolated and introverted than the extra-familiar (Lanning’s Preferential/seduction offender) sex offenders we have encountered in the past. This sample has only two female offenders (4%), which is consistent with noncomputer-using sexual offenders.
Computers, like other advances in technology, have resulted in new challenges for law enforcement. These new dangers for a society travelling the information superhighway were not fully anticipated. The North American Boy/Love Association, in one of their recent news bulletins (1995), had an article titled, “Man/Boy Love on the Internet.“ This article gives detailed information to the membership on how to use the Internet for their deviance. More and more subjects who have sexual interest in children will find opportunities for fulfilling their desires with a computer. At the same time, we can never forget that the overwhelming majority of computer uses are lawful and receive great benefit from their computer use. First Amendment rights and privacy issues have to be protected by the same police who are also charged with the responsibility of seeking out those who pose a threat to others in the cyber world. New ethical challenges will be encountered as we try to keep pace with technological advances and with those who would exploit these opportunities.
68 Illinois Law Enforcement Executive Forum • 2002 • 2(3) References Abel, G. G., Becker, J. V., Mittelman, M. S., Cunningham-Rathner, J., Rouleau, J. L., & Murphy, W. D. (1987). Self-reported sex crimes of nonincarcerated paraphilics. Journal of Interpersonal Violence, 2, 3-25.
American Psychiatric Association. (1994). Diagnostic and statistical manual of mental disorders (4th ed.). Washington, DC: Author.
Carnes, P. (1983). Out of shadows: Understanding sexual addiction. Minneapolis: CompCare Publishers.
Finkelhor, D. (1984). Child sexual abuse. New York: Free Press.
Groth. A. N. (1978). Adult sexual orientation and attraction to underage persons. Archives of Sexual Behavior, 7(3), 175-181.
Kafka, Martin P. (1993). Update on paraphilias and paraphilia-related disorders. Currents in Affective Illness, 12(6).
Lanning, K. V. (1992). Child molesters: A behavioral analysis. Washington, DC: National Center for Missing & Exploited Children.
Pyra, M. (1995). Using Internet Relay Chat: The user-friendly reference. Indianapolis: Que Corporation.
Tower, C. (1993). Understanding child abuse and neglect. Boston: Allyn and Bacon.
Weise, E. (1997). Net use on the rise. AP article printed by the Keene Sentinel, March 13.
James F. McLaughlin has been a Keene, NH, police officer since 1981, after having served as a military policeman in the U.S. Marine Corps. He has earned an AA degree in police science from Mount Wachusett Community College, a BA degree in psychology from Keene State College, a certificate degree in child sexual abuse intervention from the University of Alabama, and a MS degree in criminal justice from Fitchburg State College. He is presently assigned as a detective with the investigation division. He also serves on the Attorney General’s Task Force on Child Abuse and Neglect. Send comments or questions to
The Regional Task Force on Internet Crimes Against Children for Northern New England web pages are maintained by the Keene Police Department web team. Send comments or questions to
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 69 70 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Steganography: New High-Tech Tool for the Perfect Cyber-Crime
Mark Edmead, MTE Software, Inc.
Stega—what???? Believe it or not steganography is a term originating from ancient Greek, meaning “covered or secret writing.”
The 21st century variation of the word refers to the technique—and technology for—embedding information in a graphic image, sound file or text for the express purpose of hiding the information from unwanted eyes. Today’s cyber-pros affectionately refer to the process simply as stego.
According to cyber-forensics experts, it is both difficult to detect the existence of steganography in Internet-transmitted messages and impossible to decipher a steganographic message.
That’s why Thomas Varney, a former Army CID investigator and Secret Service forensics expert, recently termed steganography a tool for “the closest thing to the perfect crime in the 21st century.”
Steganography is not the same thing as encryption. With encryption, a message is translated from readable form to unreadable form, using readily available and relatively inexpensive software. With stego, the information doesn’t have to be encrypted (though some users like to combine encryption with stego for added security). It just has to be hidden by use of technology analogous to high-tech camouflaging.
Messages can be easily encrypted using off-the-shelf software. But when you see an encrypted message, though you may lack the code-breaking means with which to decipher it, at least you know it’s there.
With stego, you could look straight at the Web image of a beautiful California sunset and have no clue that it contains a super-sensitive message from a company’s headquarters to its overseas outpost.
There are two main ways to use steganography:
• Data injection. The message or data is directly embedded into a “host” image. The only problem is that this technique expands the size of the image, making it suspicious to discriminating eyes. There are many products out there for creating stego files. • Data substitution. Normal data is replaced by with the secret data. When this is done, the host file’s size changes only marginally. One drawback of this method is that the host file’s quality can be degraded depending on the type of host file and/or the amount of data being hidden.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 71 Stego program market leaders include the following:
• S-Tools 3. A Freeware program that allows users to hide files of any kind in .bmp images as well as .wav sound files. The application also is a cryptographic product using some of today’s most secure encryption algorithms. • Steganos 3 Security Suite. A shareware program, this tool uses modern encryption algorithms as well and can also hide messages in .bmp images and .wav sound files. Steganos also includes a feature called Internet Trace Destructor, which allows the user to erase all traces of Internet activities from hard drives. This product costs $49.95.
For a listing of some 80 different stego software options with description of capabilities, visit
Importance for Users and Investigators Since September 11, more and more legitimate businesses (and nonbusinesses) have looked closely at steganography as a new way to keep their data transmissions tightly secured.
Legitimate businesses and other organizations can benefit from steganography in the following ways:
• Storing password information on an image file, such as a jpeg on your hard drive or on a page on your website • Law enforcement agencies securely transmitting secret messages among field agents (Of course, the same transmission security can be used by corporations to communicate with remote offices and others in the field.) • Protecting proprietary website images
Example: A company has images it wants to post to its website or transmit via some other electronic method. Without security, users visiting the website can easily steal these images and then use them claiming that they own them. With stego, the company can embed an image or text message within the proprietary image. If an unauthorized entity or individual uses the image, the company thus has proof in the event of litigation that it does have legitimate ownership of the image.
The following are ways that steganography can be used to commit cyber-crimes:
• Child pornographers comprise the largest category of criminals using stego to conceal illegal images inside host images. For more information on this, visit
72 Illinois Law Enforcement Executive Forum • 2002 • 2(3) How Investigators Can Break Stego Files . . . or Not Steganalysis is the relatively new science of detecting and deciphering messages hidden with the use of steganography.
If the hidden message is embedded inside a graphic image, and you have the original unaltered image, doing a filed comparison will usually reveal whether they differ.
Even if you are able to detect the presence of steganography in a suspicious file, however, it is virtually impossible to decipher the file—even if you possess stego-decoding software programs that are able to unscramble the files. You must be provided by the originator with the secret password or algorithm that was used to create the stego file in order to enable decoding.
Steganography Versus Watermarking Many in the crime-fighting business are familiar with the technique of watermarking, whereby trademark information is embedded in graphic images such as music and software.
Watermarking, however, is not true steganography. In stego, the information is completely hidden, while watermarking actually adds graphic element to the image, thereby becoming part of the image itself.
Mark Edmead, CISSP, SSCP, TICSA, is the president of MTE Software Inc. He has over 20 years of experience performing network security assessments, security system reviews, and development of security recommendations. This article is adapted in part from his recent contribution to Passport published by the Information Systems Security Association (ISSA).
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 73 74 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Applying Digital Imaging Technology to Domestic Violence and No-Drop Policies
Leigha Stroud, Instructor and Laboratory Assistant, Institute for Forensic Imaging
In today’s society, domestic violence and child abuse are becoming social problems instead of being thought of as private and personal issues. Even though, in a 1986 study conducted by the Bureau of Justice Statistics, 49% of the women studied did not report acts of domestic violence and child abuse because they felt that it was a private and personal matter, the general population is tiring of domestic violence. It is understandable that society is growing tired of this problem. Every 15 seconds, a woman is battered according to the Bureau of Justice Statistics’ Report to the nation on crime and justice. Domestic violence and child abuse is also a nondiscriminatory crime. The victims come from all social classes, levels of income, races, and ages.2
One aspect of domestic violence is that it is cyclical in nature. In the cycle of domestic violence, there are three identifiable phases. The first is characterized by an increase in anger, tension, blaming, and arguing. The second phase of the cycle is characterized by violence, which may be manifested in acts of hitting, slapping, biting, choking, use of weapons, and even rape. The third phase of the cycle is characterized by a sense of calm. During this final phase, the abuser may or may not acknowledge that the violence took place. The final stage will occur in decreasing frequency and duration the longer the abusive relationship is in existence.4
Furthermore, spousal abuse has been directly associated with child abuse. In a study done on battered wives, it was found that in 54% of the cases studied, men were said to have extended the violence they forced on their wives onto their children. In the same study, it was found that 37% of the women studied admitted to hitting the children “quite violently.”6 Through this evidence, it can be seen that domestic violence may lead to child abuse. In another study, the hypothesis that one who experiences child abuse will be more likely, as an adult, to either commit spousal abuse or child abuse was researched. In this study, one of the husbands involved in spousal abuse relayed a childhood experience in which he lost an eye due to an injury inflicted upon him by his mother with a fork.5 From this study, Dewsbury (1975) concluded that “the contagion of violence” could be spread from generation to generation.
In response to the increased knowledge of domestic violence and child abuse, some policy advancements have been made to better address this issue. One policy advancement, in particular, is what is known as a “no-drop” policy. Another type of policy is “victimless prosecution.” This allows for the prosecution to move forward with the case without being dependent on the testimony of the victim by showing documentation of the incident with pictures, videos, or statements made by the victim and/or witnesses. Both of these policies can be considered “pro-prosecution” policies.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 75 No-drop policies may be defined as a statement that the state will not drop domestic violence cases due to the victim not participating and as a practice and protocol for enforcing that statement. This policy represents official recognition that victims of domestic violence are apprehensive to testify against their abusers. This policy also shows the commitment of the criminal justice system to treat domestic violence as a serious crime.7 No-drop policies, in practice, regulate the use of prosecutorial discretion in cases in which the victim declines to participate and comes into use after formal charges have been filed and the victim has indicated that he or she will not support the policies. No-drop policies assist in pursuing most cases notwithstanding the reluctance of the victim, stressing prosecutorial control of the case to the victim, and facilitating victim cooperation with state efforts.7
Among jurisdictions, strategies for the use of no-drop policies vary. Some jurisdictions have unwritten rules, which are nothing more than office custom while other jurisdictions have extensive written policies on when the policy should be used and how it is to be used. Some of these policies include addressing the issue of using subpoenas to compel the victim to testify in court.7
Currently, not every state has passed legislation that encourages the use of no-drop policies.7 In Florida, it is recommended that the adoption of “pro-prosecution” policies should highlight that the reluctance of the victim to testify be disregarded when considering whether or not to drop the charges or file formal charges.8 In Utah, as a matter of state policy and pursuant to a joint house resolution, prosecutors and judges are encouraged to “refrain from dropping charges based solely on a victim’s request” (Utah Laws 1543). Similarly to Utah, Wisconsin law directs all district attorneys’ offices to “develop, adopt, and implement written policies,” which indicate “that a prosecutor’s decision not to prosecute . . . should not be based . . . upon the victim’s consent to any subsequent prosecution of the other person.”10 Minnesota takes a different approach than the previously discussed states. In Minnesota law, it is required that all city and county attorneys “develop prosecution plans that address methods for gathering evidence exclusive of the victim’s in-court testimony” and to identify procedures for use of subpoenas on the victim.11
Through the Illinois Domestic Violence Act of 1986, all law enforcement agencies in Illinois were required to “develop, adopt, and implement” written policies addressing arrest procedures for domestic violence incidents that are consistent with the provisions of the act. This act went one step further to advise law enforcement agencies to consult with other agencies and community organizations with expertise in dealing with domestic violence. In recent years, the Illinois Supreme Court rulings have put more “teeth” into the law by mandating that law enforcement officers act to protect victims of domestic abuse. One of the standard operating procedures (SOP) in place due to this law states that all acts of domestic violence be treated as criminal conduct by the officers of that department. It goes on further to state that the officers of the department are required to utilize the arrest powers granted to them by the legislature when there is probable cause. It is also required that officers provide immediate effective assistance and protection to the victims and take appropriate action against the offenders. This SOP from the Bloomington Police Department states as one of the guidelines for the communications officers that domestic violence situations “should be handled
76 Illinois Law Enforcement Executive Forum • 2002 • 2(3) as top priority.” The thoroughness of this particular SOP strongly illustrates the new attitude taken by the criminal justice system and law enforcement professionals.
Another no-drop policy is the one in place in Indiana. Since the definitions of domestic violence and child abuse vary between jurisdictions and quite frequently cannot be agreed upon, Indiana legislature provides their definition in their domestic violence protocol. It states . . .
Domestic violence includes any harmful physical contact, along with property damage offenses, threats, and violations of certain court orders that occurs between current or former spouses, cohabitants, boyfriends or girlfriends, adult family members, separated or divorced couples, and other individuals who have a relationship, including homosexual couples.
This definition continues on to say that the prosecution of domestic violence also includes “violence perpetrated by parents or by parents’ lovers/intimates upon children of one of the adults and violence perpetrated upon parents by adult (over age 18) children.”
After establishing the definition that is used, Indiana protocol lists the guidelines that are used when deciding whether to file criminal charges or to drop charges against the perpetrator. A case will not be dropped if the defendant has a prior conviction, has been sent a letter of warning, has another case pending for an act of violence against the same victim, or is on probation and is subject to violation for a new offense. Furthermore, no case will be dropped before an initial hearing has taken place. This is supported by the statistic that one in five women victimized by their spouse or ex-spouse report they had been repeatedly victimized by the same person.13 In an article in the Courier-Journal, it was shown that the dismissal rate of domestic violence cases in Marion County, Indiana, has dropped from a 75% dismissal rate in 1977 prior to the no-drop policy to a dismissal rate of 20% after the no-drop policy was implemented.14
Much like Illinois, Indiana also has a policy in place in regards to when to arrest. IC 35-33-1-1 gives officers the power to arrest the perpetrator of domestic violence if there is probable cause. Some of the elements of probable cause are visible signs of injury or impairment, witness accounts, victim’s claim of pain as a result of the battery, damaged clothing or furniture, and inconsistencies in the suspect’s account of the incident. Victims are never to be asked if they want the offender to be arrested or prosecuted, nor are they asked to execute an affidavit.
Domestic violence has clearly begun to be viewed as a social problem by the criminal justice system. The no-drop policies are under some scrutiny for taking away the victim’s choice, but the system is doing so in order to break the cycle of domestic violence. As previously stated, it has been shown that those who experience violence first-hand are more likely to commit violent acts. Combine this knowledge with the knowledge that spousal abuse is often accompanied by child abuse; one can infer that if the cycle of violence can be broken the number of future spouse abusers and child abusers can be decreased. Since the implementation of no-drop policies, law enforcement officers now have better tools enabling them
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 77 to have more power when dealing with domestic violence and child abuse cases by means of laws and policies.
Through the use of digital imaging technology during the investigation of such crimes, these existing laws can become even more effective in the fight against domestic violence and child abuse. There is a wide array of devices that are considered to be digital imaging technology such as flatbed/negative scanners and cameras. Digital cameras do not require film, and the images are comprised of picture elements or “pixels.” The more pixels an image consists of, the higher the quality the image will be.
Until the advent of digital cameras, many law enforcement agencies relied on instant film cameras to document domestic violence and child abuse. While these cameras afforded the user instant viewing of the images, they generally did not provide high-quality images. That is not the only problem with instant film. As is often seen, if something provides more convenience, it is typically more expensive. This is true of instant film cameras. In fact, the use of instant film cameras can get so costly that officers are limited to the number of images they can take at any one scene. The last thing that needs to occur during an investigation is for it to fail because instant film is too expensive. When the victim refuses to cooperate during prosecution, the images of the injuries are sometimes all the prosecutors have to use for conviction.
Granted, acquiring all the equipment necessary for digital imaging (i.e., computer, printer, etc.) may not be the most affordable, but the equipment pays for itself in the long run. The Institute for Forensic Imaging (IFI) in Indianapolis conducted a research project to study the effect of the use of digital cameras on the prosecution of domestic violence from April 1998 through the end of 1999. In the initial phases of this project, the costs of using an instant film camera were compared to the costs of using a digital camera. These figures include the cost of equipment and supplies. It was found that officers may take five images with only one image resulting in high enough quality to be used. This translates into one instant picture costing approximately $4. To print six images taken on a digital camera on an 8x10 piece of photo quality paper, the cost is roughly $1.10 a sheet; therefore, one image printed from a digital camera costs approximately 18 cents. Another positive quality of digital cameras is that all the images captured do not have to be printed. If an image is of no use due to poor quality or content, it can simply be saved to protected media like a CD and kept in the case file. Another problem with instant film cameras is that quality reproduction or enlargement of the image is next to impossible. The quality of the images isn’t usually high enough to warrant scanning the image into a computer for reproduction purposes. The problem of inability to reproduce images doesn’t occur with digital images. In summary, digital imaging is cost-effective and reliable for use in the investigation of crimes including domestic violence.
The proper investigation of a crime is key to a conviction in the court system. The ease of using a digital camera to gather photographic evidence will aid in the prosecution of domestic violence in that more photos will be taken, and the quality of those images will be improved over what was previously available. In a study, the participating officers believed their ability to investigate and document domestic battery crime scenes was improved by digital cameras.30 Also, in this
78 Illinois Law Enforcement Executive Forum • 2002 • 2(3) study, it was found that the defendants in the experimental group plead guilty two and a quarter times more than the defendants in the control group. The conviction rates were double that of the control group, plus they were ordered to serve time three times more than the control group. The conclusion in this study was . . .
. . . if an investigating officer responds to a domestic battery call where a crime has occurred and he/she: (1) has a digital camera, (2) is properly trained, and (3) is employed by a department that has an appropriate program in place to support this technology, the defendant is likely to plead guilty, be convicted, and serve some time in custody.
Many officers came away from the study with more confidence that their work at domestic violence scenes was not merely tossed aside, inspiring them to maintain their elevated level of investigation.
Perhaps one of the main concerns with digital imaging is the admissibility of such evidence into court. While none of the cases in the domestic violence study previously discussed have received any objections based on the digital imaging, this concern is valid. The Washington state court of appeals addressed the issue of applying digital imaging to forensic science and admitting such evidence into court proceedings in 1998. In Washington v. Hayden, the defendant was convicted of felony murder in the first degree after his hand and fingerprints were positively matched using digital imaging after the material had been processed with amido black. The issue in the case was whether enhanced digital imaging was too novel of a process to be admitted as evidence. The court held that enhanced digital imaging is not a novel idea, but rather a new practice. They went further to say in their decision that the theory underlying digital imaging is a valid science according to the Frye rule and that such science would have been applied to forensic science sooner had it been more affordable. The case of Washington v. Russell31 was cited in Hayden. While Russell did not address digital imaging directly, the case did address the issue of valid sciences. In the holding, there was a clear warning about adhering to strict protocols when dealing with new practices. It is essential to law enforcement that they heed the warning issued in Russell—follow an SOP when dealing with new practices such as digital imaging. There are two key terms in digital imaging: (1) manipulation and (2) enhancement. Manipulation means to change by artful or unfair means so as to serve one’s purpose. Enhancement is to make greater or better in terms of value, desirability, or attractiveness. After some training, an individual would be able to manipulate a digital image using readily available enhancement software to the point of making the image an inaccurate and false representation of the scene; however, if the operator acquires and maintains proper training, he or she would be able to do enhancements that maintain the image as a true and accurate representation of the scene. If the SOP clearly defines what tools can and cannot be used in image enhancement software, the risks of evidence being inadmissible due to manipulation should be kept to a minimum.
Through much heartache of victims and the individuals who work within the criminal justice system, a more adequate means to address the problem of domestic violence is in place in the system than has ever been seen in the history of the United States, and it will continue to evolve. The advancement of technology is
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 79 also forthcoming, which will enable investigators to do their work even more effectively than they can now. The advent of new technology enabling officers to better document domestic violence and child abuse will allow states to use “victimless prosecution” when they do not have the compliance of victims to testify. In order to support the cases under the “no-drop policies,” the victim’s testimony is typically needed. No-drop policies are used when there is not enough documentation of the event to keep the success of the prosecution being dependent on victim testimony. Also, as cases using digital images as evidence make their way into the court systems, more and more precedents will be established making digital imaging a common, comfortable tool for crime investigations.
Through a combination of these aspects, the criminal justice system and all those involved in the system will advance and function smoother through time. The use of new technology in crime investigation is key to lasting success. As criminals get smarter and obtain new tools, the system and individuals who deal with criminals also need to gain knowledge, tools, and techniques.
Endnotes 1 Bureau of Justice Statistics. (1983). Report to the nation on crime and justice: The data. Washington, DC: Office of Justice Programs, U.S. Department of Justice.
2 Novello, Aurgeon General Antonia as quoted in Domestic violence: Battered women. Cambridge, MA: Publication of the Reference Department of the Cambridge Public Library.
3 Goss, J., & Rose, K. (1989). Domestic Violence Statistics. Washington, DC: National Criminal Justice Reference Service, Bureau of Justice Statistics, U.S. Department of Justice, p.8
4 Domestic Abuse Intervention Project, Duluth, MN.
5 Dewsbury, A. R. (1975). Family violence seen in general practice. Royal Society of Health Journal, 95(6), 292.
6 Gayford, J. J. (1975). Battered wives. Royal Society of Health Journal, 95(6), 292.
7 Corsilles, A. (1994, December). No-drop policies in the prosecution of domestic violence cases. Fordham Law Review.
8 Fla. Stat. Ann. 741.2901(2)
9 A Joint House Resolution of the Legislature Urging Prosecutors to Develop and Implement a “No-Drop” Policy. HRJ Res. 3, 48th Leg., 1990 Gen. Sess., 1990 Utah Laws 1543.
10 Wis. Stat. Ann. 968.075(7)(a)(2) (Supp. 1994)
11 Minn. Stat. Ann 611A.0311(b)(5), (b)(7)
80 Illinois Law Enforcement Executive Forum • 2002 • 2(3) 12 Office of the Prosecuting Attorney, Marion County, IN, Domestic Violence Protocol, Oct. 1, 1990.
13 Common Purpose, Inc. The Basics of Batterer Treatment, Jamaica Plain, MA.
14 Wessel, Kim Court Led to Aggressive Prosecution in Indiana, Courier-Journal, June 9, 1993, at 5B.
15 Evidence Code 667.
16 Evidence Code 668.
17 Evidence Code 669.
18 United States v. Allery, 526 F.2d 1362 (1962).
19 Trammel v. United States, 445 U.S. 40 (1980).
20 Evidence Code 663.
21 Evidence Code 660.
22 Indiana Evidence Code 803(2).
23 Indiana Code 35-37-6-9(a).
24 Indiana Code 35-37-6-9(a)(3).
25 Danner v. Kentucky, 963 S.W.2d 632 (1998).
26 Maryland v. Craig, 497 U.S. 836, 857 (1990).
27 Domestic violence for healthcare providers, 3rd Edition, Colorado Domestic Violence Coalition, 1991.
28 Biden, Senator Joseph. (1991). U.S. Senate Committee of the Judiciary, Violence Against Women: Victims of the System.
29 Zack, M. (1998, December 28). Trying “Victimless Prosecutions.” Star Tribune. p. 1A
30 Garcia, C. A. (1999, September). The impact of photographic evidence on domestic violence case processing.
31 Washington v. Russell, 882 P.2d 747 (1994).
Leigha Stroud is an instructor and laboratory assistant for the Institute for Forensic Imaging. Leigha assists in the operation of the Institute for Forensic Imaging (IFI) laboratory and with the training programs. She assists in teaching several courses including forensic digital imaging and crime scene
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 81 photography. She also managed the domestic violence program for the IFI, provided one-on-one training for the officers involved, and coordinated the domestic violence program with the prosecutors’ offices of Marion and Hamilton Counties.
Stroud also works with local law enforcement agencies in capturing and enhancing videos of crimes and producing prints of photographic evidence from the domestic violence program for local attorneys and prosecutors.
Stroud completed her BS in criminal justice in May of 2000. She was president of the Iota Upsilon Kappa chapter of the Alpha Phi Sigma national Criminal Justice Honors Society for the academic year 1997 and a member of the Criminal Justice Association on the Indiana University at Kokomo (IUK) campus. She has been active in fundraising for area women’s shelters through the organizations of which she is member. She was awarded a Certificate of Honor for outstanding Academic Achievement in 1998 from the chancellor of IUK and was also the recipient of the Certificate of Accomplishment for her activities in Alpha Phi Sigma in 1998.
82 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Language as Clue: Authorship Identification in an Electronic Society
Carole E. Chaski, PhD, Criminal Justice Department, Delaware Technical and Community College; University of Delaware
The Need for Language-Based Author Identification A forged check, a ransom note, a farewell letter printed at a college computer lab, a threatening letter, a diary of crimes, a diary of a relationship, suicide notes on computer disks, and e-mail messages over a corporate network or over the Internet—such documents create “paper trails” leading to suspects—even in a paperless society. As our society has rapidly moved beyond pen and pencil, some have estimated that 93% of our documents are produced electronically. Documents composed on the computer, printed over networks, faxed over telephone lines, or simply stored in electronic memory defy the traditional identification of authorship based on handwriting, ink, and typewriter. When authorship of an electronically produced document is disputed, handwriting and ink analysis obviously do not apply, but even in the case of networked printers to which thousands of potential users often have access, ink, paper, and printer identification cannot narrow the range of suspects. Further, since the ruling of District Judge McKenna in United States v. Starzecpyzel (1995), handwriting examination has been increasingly difficult to introduce as scientific evidence into court. In many subsequent cases, the handwriting expert has either been excluded from testifying completely or allowed to testify without stating any conclusions. This restriction against stating an expert’s conclusion undercuts the whole point of expert testimony, which is to provide expert opinion helpful to the judge or jury.
The language of a document, however, is independent of whether a document is handwritten in a natural or disguised form; printed from a single or networked printer; or typed, faxed, or copied at an office equipment warehouse or stored electronically. Language-based author identification has a special urgency now for law enforcement due to technological advances in document production, on the one hand and the legal standards for scientific evidence on the other. Currently there are four language-based author identification techniques available to investigators: (1) linguistic profiling, (2) text analysis, (3) forensic stylistics, and (4) syntactic analysis.
Linguistic Profiling and the Anthrax Letters Linguistic profiling deduces demographic characteristics (gender, age, race, education, geographic location, religious orientation, occupation, etc.) from linguistic features in a document. Theoretically, linguistic profiling applies sociolinguistic research about the linguistic performance of demographic subpopulations. Sociolinguistic research programs begin with a clearly-defined demographic subpopulation—such as white and black southern Americans of a particular age range and educational level. In all data collected, the demographic characteristics of each speaker are documented. This documentation ensures that the subpopulation is accurately defined and becomes especially important because
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 83 sociolinguistic method requires that linguistic features of one subpopulation be compared with other subpopulations. This comparative method enables the sociolinguist to determine which linguistic features are specific to particular subpopulations and which are shared among several subpopulations or the general population. The assumption that different groups can be identified by linguistic features rests on the comparative method applied to clearly defined datasets. Clearly defining subpopulations is a difficult task. For instance, the demographic feature “gender” is not obviously marked by particular linguistic features; rather, some scholars have argued that linguistic features associated with gender in early research are actually associated with powerlessness—a state of being for both men and women at certain points in life.
While linguistic profiling has a potential academic base in sociolinguistics, in actual practice, linguistic profiling does not follow the sociolinguistic method of comparing a document’s linguistic features to well-defined datasets such as the linguistic features of southern American male, 30-40-year-old, white, college graduates. In part, this is probably due to the fact that most profilers are not academically trained in linguistics but also to the fact that the demographic subpopulations relevant to criminal investigations are not researched sociolinguistically. We don’t know, for instance, the linguistic features indicative of southern American male, 30-40-year-old, white, college graduate embezzlers, kidnappers, or murderers. In practice, then, linguistic profiling relies on the profiler’s intuition about what demographic characteristics are suggested by the language of the document.
In the ongoing Amerithrax case, the FBI has obtained a linguistic profile. The burning question about the anthrax-laced letters recently sent to Senator Daschle, NBC anchorman Tom Brokaw, and the editor of the New York Post is, “who wrote them?” Handwriting analysts readily admitted that they could do little with the block printing of these letters. Based on the text of the anthrax letters, Donald Foster, a professor of English literature, has suggested that the author of the anthrax letters is foreign, a Pakistani, a speaker of Arabic, Persian, or Urdu, not an Arabic speaker, and a competent English speaker, as reported in articles in The Washington Post, The London Times, The Hartford Courant, and the AP wire. According to a February article in The Hartford Courant, “What we have here is a welter of contradictory and ambiguous evidence, he [Foster] said in an interview last week” (Anthrax Mystery, 2002).
According to an October article in The Washington Post, “One official said the only significant clue raising the possibility of foreign terrorist involvement is the conclusion of FBI behavioral scientists, who believe that whoever wrote the three letters delivered to Daschle, NBC News, and The New York Post did not learn English as a first language” (FBI, 2002).
Even though the linguistic profile is self-contradictory and Professor Foster himself suggests the author is either a foreigner or an American, in November, the FBI broke through a front door in a raid on the house of two Pakistani brothers in West Chester, Pennsylvania (Raids, 2001). According to USA Today (May 21, 2002), “The government has begun a strategy of focusing on possible sources of anthrax and casting a wide net, rather than identifying suspects from the few clues gained from the letters.” Finally.
84 Illinois Law Enforcement Executive Forum • 2002 • 2(3) In Amerithrax, linguistic profiling has certainly not narrowed the list of potential suspects. This technique, however, has real potential use for law enforcement under two conditions: (1) the sociolinguistic method described above, rather than intuition, is used and (2) the linguistic profiler has documented training and proficiency as a linguist shown by the appropriate credentials and research experience.
Text Analysis and the JonBenet Ramsey Ransom Note Text analysis relies on two ideas from literary criticism: (1) vocabulary measures and (2) intertextuality. The particular measure of vocabulary that has attracted Shakespearean scholars, including Professor Foster, is the type-token ratio. This is the ratio between the different words in a text and the total number of words in a text. In order for this ratio to indicate authorship, tens of thousands of words are necessary; in a test of the type-token ratio on documents of less than 1,000 words—which is the likely scenario in forensic cases—the type-token ratio was unable to differentiate documents from different authors or to cluster a document with its actual author (Chaski, 2001).
Intertextuality is the presence, in one text, of allusions to another text. Foster’s training in English literature is apparent in an interview about the anthrax letters, when he said that “one of the things I have to do is figure out what he’s been reading” (Anthrax Mystery, 2002). Foster’s intertextuality technique also played a role in his first analysis of the ransom note in the JonBenet Ramsey homicide. In his June 1997 letter to Patsy Ramsey in which he said he would stake his reputation on her innocence, Foster said of the ransom note, “It appears to have been written by a young adult with an adolescent imagination overheated by true crime literature and Hollywood thrillers.”
Later, in his November 1997 interview with the New York Times, Foster’s report is excerpted as follows:
A corporate thread . . . includes diction associated with a chief executive officer, day-to-day business concerns, or computer equipment, possibly indicating a businessperson as author, and/or someone wishing to implicate John Ramsey (November 19, 1997, New York Times: Metro Section of City Edition).
Finally, Foster concluded that Patsy Ramsey authored the ransom note, but he was not able to testify to this fact because “procedural mistakes may limit the value or admissibility of the evidence thus obtained, as in the JonBenet Ramsey homicide investigation” (Foster, 2001, p. 4). Further, Foster says . . .
One of the most likely direct influences on the Ramsey ransom note and attendant staging was the film Dirty Harry. The Boulder police, however, were unable to establish which of the various suspects saw it, or when, because few video rental stores keep such records longer than 90 days (Foster, 2001, p. 8).
Foster’s use of intertextuality assumes that an individual’s linguistic performance is influenced by what he or she reads in books, magazines, and newspapers and
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 85 hears in movies, radio, and television. Can individuality actuality be determined by influences that are, by the very nature of publication and telecommunication, read and heard by potentially millions?
At this point in the Ramsey investigation, text analysis has certainly not narrowed the list of suspects. Text analysis, as a language-based approach to author identification, is also very difficult to test empirically. If we asked five people to read the same books, how long would we have to wait before some similarity between their personal writings and the five books showed up in their writings? If we assumed authorship based on the ideas we hold, how many innocent people would have been arrested for the Unabomber crimes, based on a very common disgust with the pace and gadgetry of our society? Because text analysis is so difficult to test empirically, it may never be admitted into evidence at trial, under the Daubert criteria; therefore, if law enforcement seeks to use text analysis, this technique should never be allowed to close a case.
Forensic Stylistics, Errors, and Restricted Admissibility Forensic stylistics attribute authorship based on linguistic features shared among questioned and known documents. There is no list of which linguistic features are compared; rather, the important linguistic features “pop out” to the analyst from the questioned document at which point the known documents are then searched to determine whether the same linguistic features occur. Generally, forensic stylistics rely on prescriptive grammar (i.e., grammatical errors, spelling errors, punctuation marks).
In empirical tests, reported in Chaski 2001, these linguistic features were not able to differentiate between documents composed by different authors or cluster a document with the author’s other documents correctly. Actually, this is not surprising for two reasons. First, we already know that certain “grammatical errors” are so commonly shared among most native English speakers that our schools repeatedly teach us not to speak and write in such ways and scholars can publish books with titles such as The Most Common Mistakes in English Usage (Berry, 1971). Second, spelling errors are also often shared by many people, but more importantly, people who misspell a word in one document may spell it correctly in another (Chaski, 2001). Furthermore, the presence of spell-checkers in most word-processing programs reduces the likelihood that misspellings, even if they were stable in a person’s writing, would even occur in electronically- produced documents. The basic question is the same one asked of text analysis’s intertextuality: can the grammatical patterns which are shared by so many native speakers of English actually indicate individuality?
In 2000, in the United States District Court, District of New Jersey, Roy Van Wyk was brought to trial for making threatening communications (United States v. Van Wyk, 2000). The government, represented by Assistant U.S. Attorney Charles B. McKenna, proposed that Special Agent James R. Fitzgerald of the Federal Bureau of Investigations be allowed to testify as an expert in forensic stylistics (later text analysis) about the authorship of the threatening letters. The government argued that Fitzgerald’s testimony should be admitted because it relied on McMenamin’s peer-reviewed publication (McMenamin, 1993), thus meeting at least one Daubert
86 Illinois Law Enforcement Executive Forum • 2002 • 2(3) criterion. The Court did, in fact, recognize the “lack of scientific reliability of forensic stylistics”:
Although Fitzgerald employed a particular methodology that may be subject to testing, neither Fitzgerald nor the Government has been able to identify a known rate of error, establish what amount of samples is necessary for an expert to be able to reach a conclusion as to probability of authorship, or pinpoint any meaningful peer review. Additionally, as Defendant argues, there is no universally recognized standard for certifying an individual as an expert in forensic stylistics (United States v. Van Wyk, 2000, 523).
Even with these weaknesses, Judge McKenna ruled that . . .
The Court grants in part Defendant’s motion to exclude Fitzgerald’s testimony by limiting his testimony to the comparison of characteristics or “marker” between handwritten and typed writings, in which Defendant is known to the author (“known writings”) and the handwritten and typed writings, in which authorship is “questioned” or unknown (“questioned writings”). Fitzgerald’s testimony regarding any “external” or extrinsic factors and his conclusion as to the author of the “questioned” writings are barred.
The barring of Fitzgerald’s conclusion as to authorship is especially important since it undercuts one of the essential functions of expert testimony. Proponents of forensic stylistics (McMenamin, 1993) must respond to the Daubert criteria through actual research and empirical testing of their techniques or accept limited use in court. Law enforcement can decide if such a technique, like the polygraph, is worth using or not.
Syntactic Analysis Method, Linguistic Foundations, and Full Admissibility The syntactic analysis method relies on standard linguistic techniques of analysis, results from experiments in the psychology of language, and standard tests in statistics. The primary technique is syntactic analysis: this is the labeling of each word in a document for its function and combinations with other words. In all languages, some combinations are not allowed by native speakers (ungrammatical); some are less often produced; and some are frequent. In English, for example, the combination “the the” is not allowed (although an editor might say “the the seems like it should be an a,” in which case both the italicized words have been nominalized by metalinguistic mention). The combination “the man whose wristwatch was laying on the table” is less frequent than the combination “the man with a wristwatch,” which is less frequent than the combination “the man.” When all of these combinations are determined using the same techniques on both the known and unknown documents, the combinations can be counted for each text. These counts are then tested statistically to determine whether the known documents and questioned documents are significantly different or similar. The statistical results, rather than the analyst’s intuition, determines the final decision about authorship.
The syntactic analysis method rests on well-known facts about how we process and understand language. Linguistic communication takes place so quickly that
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 87 we can finish each others’ sentences. We can talk so quickly that we can’t remember our own words. When we listen to others, we can repeat what the speaker meant far more accurately than how the speaker said it. In terms of psychology of language, linguistic processing is an automatized, unconscious behavior. In particular, syntactic units—combinations of words into phrases and phrases into larger units—are particularly automatized. We know this from the patterns of speech errors, responses in psycholinguistic experiments, and memory experiments which demonstrate that the syntactic (perceptual) structure of a message is forgotten within milliseconds while the semantic message is retained indefinitely. The form (or syntax) is disposable, while the message (or semantics) is durable. In fact, experiments show that attention to form rather than content is so difficult that specific instruction and attention must be devoted to remembering syntactic form. In terms of imitability, difficulty decreases from syntax to semantics to phonology. This is why it is easier for people to imitate someone’s accent or vocabulary than someone’s sentence structures.
Unlike techniques from text analysis and forensic stylistics, in empirical testing, the syntactic analysis method was able to differentiate and cluster the documents correctly (Chaski, 2001). In response to Grant and Baker (2001), further statistical work using discriminant analysis and canonical correlation is currently underway; so far, pilot tests have confirmed the Syntactic Analysis Method’s ability to different and cluster documents correctly.
Research into the syntactic analysis method has shown at least four standards required for it to work properly in a forensic context. These are: (1) Quantity; (2) Timeframe; (3) Register; and (4) Internal Consistency. The syntactic analysis method requires at least 200 words in the documents. The method does not work, for example, with bank robbery notes, which typically contain about 40 words. The timeframe for the production of the known and questioned documents should be tight—adult writings should be compared to adult writings, adolescent writings to adolescent. We know in general that language development changes over time, but we do not know how far into adulthood this can occur, although this research is currently underway. Furthermore, the documents should come from similar registers or communicative purposes; love letters should be compared to other friendly letters or even narrative essays, but business documents should not be compared to love letters. These communicative functions correlate with different syntactic patterns. Finally, documents from a known source should be tested to find out if the known writer’s syntactic patterns are internally consistent. Frequently, authors will have several syntactic patterns in known writings. Known documents should be segmented into subsets that contain identifiably different patterns. The questioned document should be compared to each of these subsets. These methodological standards enable both the analyst and the investigator to have confidence in the results because the method—under these standards—will have not overreached its known capacity at this time.
Finally, the syntactic analysis method has been ruled fully admissible, without restrictions, in state and federal courts. In June 1998, Judge Lawrence H. Rushworth, Anne Arundel County Circuit Court, 5th Judicial Circuit, State of Maryland, ruled that testimony of language-based author identification based on the syntactic analysis method admissible without any restrictions. In June 2002, after a Daubert hearing in the trial Greene v. United States Navy/Dalton, Judge Henry Kennedy
88 Illinois Law Enforcement Executive Forum • 2002 • 2(3) of the United States District Court for the District of Columbia ruled testimony of language-based author identification based on the syntactic analysis method admissible without any restrictions. The linguist was permitted to explain the method, discuss the known and questioned documents, and state a conclusion to the jury. This is an important advance for the field because, as noted earlier, forensic stylistics/text analysis testimony had only been admitted with severe restrictions.
For attribution of authorship, the syntactic analysis method is the most reliable in experimental tests independent of any litigation or investigation, the most robust in its foundations in linguistics and statistics, and the most admissible in terms of getting evidence from investigation into trial. There are instances, however, when the crime just doesn’t allow for its use but still has a linguistic dimension to it.
The Anthrax Letters: A Linguist’s Analysis The Anthrax letters are a perfect example of language-as-clue. From the very beginning, the burning question has been “who wrote them?” First, as just mentioned, in order to perform a full analysis of a document and get enough counts for the statistical procedures, the documents should be at least 200 words. This means that a syntactic analysis of the anthrax-letters for the determination of authorship based on an independently validated method is not possible.
Second, as mentioned previously, spelling errors are not unique to individuals. Although spelling errors seem to jump out of the page to many people and may seem very odd to the point that one might think they are unique, they are not (Chaski, 2001). In the case of the anthrax letters, the misspelling of penicillin as “penacilin” is typical of groups rather than individuals. The spelling variation “penacilin” is common among American rap music aficionados. I have also found this spelling among native American English speaking college graduates.
Linguistics can offer some help in this case, however. Second-language interference is a linguistic method examining the effect of the first language on the second; these effects are predictable from systematic differences between the two languages. Non-native English speakers typically have phonetic interference from the native language; this accounts for the many different accents of foreign speakers of American English. Likewise, the non-native English writer has orthographic interference, based on the native language, which will appear in spelling variations. On the hypothesis that the anthrax-letters were written by a non-native speaker of English, non-native interference should show up depending on the spelling systems of different languages. In the anthrax letters, second-language interference actually suggests that the spelling variant “penacilin” is not predictable from Arabic and many other languages associated with terrorist groups.
Under the hypothesis of second-language interference, there are four interesting features of the spelling variant “penacilin” for penicillin. The first spelling feature is the p. In English, Korean, Indonesian, Thai, Russian, Hebrew, and Farsi, penicillin is spelled with an initial p. In Arabic, penicillin would be transliterated “benicillin.” The p spelling aligns with a non-Arabic speller.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 89 The second spelling feature is the a representing the unaccented vowel in the second syllable. All languages have a vowel that is used for unaccented syllables, known as the reduced vowel; in American English, the reduced vowel sounds like “uh” (as in “uh-huh”). This is also how we say the word a (as in “a letter”). What is interesting about “penacilin” is that the reduced vowel is spelled a, representing the sound of the highly frequent word a, but the pronunciation of penicillin in Arabic, Farsi, Russian, Korean, Indonesian, and Thai is notably without a reduced vowel in the second syllable. The fact that the second syllable is represented as having a reduced vowel indicates that the author is a native speaker of English.
A third interesting feature of “penacilin” is the c representing s. In American English spelling, c has two phonetic values: c represents the k sound or the s sound depending on what follows it. In “penacilin,” the c represents the s due to the following i. In Pashto, Korean, Indonesian, Farsi, and Arabic, spelling interference would map the c onto s so that the expected spelling would be something like “penisilin.” In Russian and Hebrew, spelling interference would map the c onto tz so the expected spelling would be something like “penitzilin.” What is interesting is that the c is retained for the representation of s. This indicates that the author is a native speaker of English.
The fourth feature of “penacilin” is the reduction of the double ll to single l. American English spelling includes double consonants even though we do not lengthen our consonants when we speak. Because these double consonants are not phonetic, they are often reduced; for instance, we have till and til as spelling variants in American English. Arabic, Korean, and Thai do have double consonants, while Farsi, Russian, and Hebrew do not. So, for instance, a native Russian speaker would be expected to reduce the consonant from a double l to a single l, like a native American English speaker, while a native Arabic speaker would not.
These four features—the initial p, the reduced vowel in the second unstressed syllable, the retention of c to represent the s sound, and the reduction of the doubled consonant—plus the fact that the spelling variant “penacilin” is found among native American English speakers point to the conclusion that a native American English speaker authored the anthrax letter.
Technological Lessons Learned from Language-Based Author Identification Language-based author identification, as one of the most recent technologies introduced into criminal justice, reveals several lessons about how law enforcement officials can innovate and keep up with society’s technological advances.
First and foremost, law enforcement personnel can continue to apply the open- minded curiosity and bull-dog determination that characterizes the best detectives. In my experience, these are the qualities that lead to technological innovation within law enforcement, crime-solving, and scientific research. In 1992, during the course of investigating a death by injection, Detective W. Allison Blackman of the Raleigh, North Carolina Police Department was given computer disks containing suicide notes from the deceased. Detective Blackman first contacted David Dunn
90 Illinois Law Enforcement Executive Forum • 2002 • 2(3) of the North Carolina State Bureau of Investigation, Questioned Document Unit. Mr. Dunn, who should be commended for recognizing the limits of his science, informed Detective Blackman that without ink, paper, or handwriting, the unit could not work on the case. Detective Blackman persisted, however, in seeking out someone to help him. He called the local universities and colleges in the Raleigh area until he found a theoretical linguist who could help him. In this case, the syntactic analysis method of language-based author identification showed that the deceased had not written the suicide notes while the roommate was very likely to have authored them. The roommate confessed during the trial to authoring the suicide notes in order to take suspicion away from himself. Detective Blackman’s commitment to crime-solving as well as his determined curiosity led to the arrest and conviction of the deceased’s roommate.
Second, law enforcement personnel can themselves become familiar and comfortable with new hi-tech devices and techniques. This familiarity does not have to verge on expertise, but it should at least be enough to help law enforcement officials discern between true expertise and phony buzzword-laden verbosity. Good scientists and good detectives have in common a general attitude of skepticism, which makes them question what they see and hear. Law enforcement personnel should be just as skeptical of language experts as they would be of potential suspects; language experts who are offended by this questioning (e.g., unable to say when they don’t know or eager to rely on credentials rather than actual experimental results) reveal their own lack of scientific training.
Third, law enforcement personnel can, especially once equipped with this technical familiarity, seek out academic experts and researchers. The U.S. Justice Department’s National Institute of Justice (NIJ) is the primary resource for forensic research. The Institute’s Office of Science and Technology (OST) funds innovative research for the improvement of the criminal justice system. Even if NIJ’s OST is not funding a particular line of research at the time, program managers often have a wealth of knowledge about current research projects, innovative ideas, and qualified researchers.
The American Association for the Advancement of Science is the primary membership organization for scientists and researchers from the full gamut of the sciences although it is heavily populated by the biological and chemical scientists. Likewise, there are many scholarly organizations focused on particular academic topics. For example, the International Association of Forensic Linguists is the primary membership organization for forensic linguists whose interests range far beyond language-based author identification to such topics as language proficiency and court translation. The local college or university provides a resource for finding out who are the major players in a particular field of research; colleges are typically congenial toward public service. Finally, Internet search engines provide massive amounts of possibilities for finding the type of research- based analysis that an investigator needs for a particular case. Through contacting these resources, law enforcement can determine if the crime scene evidence can be subjected to some sort of scientific analysis that can yield investigative leads.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 91 References Anthrax mystery turns scholars into sleuths. (2002, February 6). The Hartford Courant.
Berry, T. E. (1971). The most common mistakes in English usage. New York: McGraw- Hill.
Chaski, C. E. (1997, September). Who wrote it? Steps toward a science of authorship identification. National Institute of Justice Journal.
Chaski, C. E. (2001). Empirical evaluation of language-based author identification techniques. Forensic Linguistics: International Journal of Speech, Language, and Law, 8(1), 1-65.
Chaski, C. E. Preface. Linguistic Authentication and Reliability. National Conference on Science and Law Proceedings. Washington, DC: U.S. Department of Justice, Office of Justice Programs. [online]. Available through National Criminal Justice Reference Service:
Chaski, C. E. A Daubert-inspired assessment of current techniques for language- based author identification. ILE Technical Report 1098. [online]. Available through National Criminal Justice Reference Service:
FBI and CIA suspect domestic extremists: Officials doubt any links to Bin Laden. (2001, October 27). The Washington Post.
Foster, D. W. (1989). Elegy by W. S.: A study in attribution. Newark: University of Delaware Press.
Foster, D. (2001, December). Policing anonymity. Ideas in American Policing, 5. Washington, DC: Police Foundation.
Grant, T., & Baker, K. (2001). Identifying reliable, valid markers of authorship: a response to Chaski. Forensic Linguistics: International Journal of Speech, Language, and Law, 8(1), 66-79.
McMenamin, G. R. (1993). Forensic stylistics. Amsterdam: Elsevier.
Raids on Pakistan-born men follow fruitless day on Anthrax trail. (2001, November 15). The Wall Street Journal.
United States v. Van Wyk, 83 F.Supp.2d 515, D.N.J. (2000).
For Further Reading Crystal, D. Review of forensic stylistics. Language, 71(2), 381-385.
Donaldson, R. G. (1985). Admissibility of evidence as to linguistics or typing style (forensic linguistics) as basis of identification of typist or author. American Law Reports [Annotated 36 ALR4th 598].
92 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Goutsos, D. Review article: Forensic stylistics. Forensic Linguistics: International Journal of Speech, Language, and Law, 2(1), 99-113.
Pickett, P. O. (1993, October). Linguistics in the courtroom. FBI Law Enforcement Bulletin.
Smith, S. S., & Shuy, R. W. (2002, April). Forensic psycholinguistics: Using language analysis for identifying and assessing offenders. FBI Law Enforcement Bulletin.
Squires, S. Linguist developing scientific method to identify authorship. The Criminal Practice Report, 11(24), 460-464.
Carole E. Chaski earned her BA magna cum laude in greek and English at Bryn Mawr College, her MEd in psychology of reading at the University of Delaware, and her MA and PhD in linguistics at Brown University in Rhode Island. She has taught syntactic theory, computational linguistics, and literacy studies at the University of South Carolina in Columbia and North Carolina State University in Raleigh. She has consulted with law enforcement, defense, prosecution, civil attorneys, and victims of crime since 1992. From 1995-1998, Chaski served as a Visiting Research Fellow in the U.S. Department of Justice’s National Institute of Justice. In 1998, she founded the Institute for Linguistic Evidence, a tax-exempt, nonprofit research organization for continued research in forensic linguistics and service to the justice system (www.LinguisticEvidence.org). She has qualified as an expert witness in state and federal courts. In addition to her research, Chaski teaches interviewing and computational databases in the Criminal Justice Department of Delaware Technical and Community College and linguistics and research methods at the University of Delaware.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 93 94 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Policy Review: CVSA Is a Valid Law Enforcement Tool Hugh Wilson Ridelhuber, MD, FABP, NITV Patrick Flood, PhD, NITV
Introduction The tragic events of September 11, 2001 have emphasized the importance of investigative techniques in the law enforcement profession. The search for truth is one that requires innovative tools that make the investigation process more efficient and effective. The Computer Voice Stress Analyzer (CVSA) is a technologically advanced voice stress analyzer used by law enforcement officials that detects stress associated with deception. The history of CVSA reflects a progressive movement of a new technology that will assist the efforts of law enforcement officers in the search for truth.
Theory/ History Behind CVSA In 1971, British physiologist Olaf Lippold discovered the “muscle micro-tremor.” Lippold found that voluntary muscles in the arm generate a physiological tremor or micro-vibration at about ten per second when the subject is relaxed. When the subject is aroused or stimulated, the micro-tremor tends to disappear. Lippold’s theory relates to the voice in that muscles in the throat and larynx show micro- vibration that diminishes with stress through the vagus nerve. When a person is stressed, the CVSA detects a minimum number of micro-tremors.
Since the publication of Lippold’s discovery of the micro-tremor, there has been an effort to develop an instrument that could accurately measure these tremors and record them. Three former U.S. Army Intelligence officers, who had discovered a method of analyzing the human voice after it had been captured on a standard reel- to-reel tape recorder, developed the first successfully commercial instrument. They dubbed their device the Psychological Stress Evaluator (PSE) and debuted the system in 1970. Although initially successful, the company, Dektor Counterintelligence, offered a training program that was inadequate. The testing protocols were not properly validated and were mostly based on old polygraph techniques, which turned out to be a fatal mistake. Like the first polygraphs, the early PSE systems were difficult to use and suffered because of poorly structured protocols and poor training.
The National Institute of Truth Verification (NITV) emerged in 1988 as the result of an improved version of the PSE, currently known as CVSA. The NITV began to market CVSA by selling to law enforcement agencies that were interested in an alternative to the polygraph. By 1994, many law enforcement agencies had purchased CVSA after a short period of time and shut down their polygraph units. More than 1,300 local and state law enforcement agencies currently use the CVSA instrument.
The CVSA is a laptop computer with software that can be used in the field or in the interview room. This innovative tool is used to measure stress in the voice that is directly related to a situation of real jeopardy when fear of discovery is present. Vocal pictures depict changes in voice frequencies that can be reasonably quantified. As with changes measured by the polygraph in the respiration and blood pressure, the voice print demonstratively reveals levels of stress that a trained examiner can easily evaluate.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 95 Benefits of the Computer Voice Stress Analyzer (CVSA) The CVSA instrument allows law enforcement officers to achieve maximum admissible interrogation results (confessions) by providing a relaxed environment with no sensors, pressure tubes, pressure cuffs, or special chair. A more relaxed atmosphere helps the person in question achieve a relaxed state from which a stressful response may be detected. Pretest interviews rule out the possibility of miscommunication and misunderstanding of the proposed line of questioning and may deliver a confession prior to the exam. When deception is indicated on a chart, the rate of confession tends to be very high due to the ease with which the subject can view his or her own results, and the low anxiety of the interrogation technique from the start, allowing the person to want to tell the truth (rather than being coerced).
Cost is a significant issue for law enforcement agencies when deciding to utilize new technology. The CVSA is a tool that is meant to be readily accessible to law enforcement officers with minimum amounts of time for training. The purpose of the intensive six-day training is to allow police officers to achieve maximum usage and training of the equipment and procedure without putting the department at an inconvenience by demanding an unreasonable amount of time away from the job. With innovation comes the modification from the eight-week polygraph training to a six-day intensive course resulting in trained CVSA examiners that are conducive to the modern needs of law enforcement.
A specific example of the cost savings resulting from CVSA use by law enforcement departments comes from the Orange County Sheriff’s Office in Florida. With 2,000 employees, Sheriff Kevin Beary reported an estimated savings of $110,000 in the year 2001 following conducted tests on 653 applicants. These verifiable reports of huge cost savings and the ability to use those savings in other areas of need coupled with time saved in man-hours are additional benefits of using CVSA technology.
An additional point that deserves attention relates to the criteria for CVSA training. The only standard for becoming a trained CVSA examiner is to be employed by a law enforcement agency. This requirement may seem simple, yet some polygraph training facilities require a bachelor’s degree as a prerequisite. It is important for all law enforcement personnel to be trained appropriately with equal and affordable access to important investigative tools. The nature of the CVSA is that the software does the work of analyzing data and producing a result that may be readily interpreted by any certified examiner. An additional benefit to using CVSA is that there are no opportunities for the inconclusive results that are common with the polygraph, thus saving many man-hours.
CVSA presents opportunities for use in covert operations that would enhance counter-terrorism efforts. Voice recordings can be made and analyzed at a later date, which would allow unlimited information gathering in the law enforcement sector. CVSA is beneficial on the local law enforcement level in terms of analyzing voice recordings or live conversations with informants. Law enforcement officers must rely on informant information that can be affirmed by simple use of the CVSA. Use of this technology can save lives by detecting deception regarding faulty information.
There is no known way to thwart the CVSA test due to the physiological measurement of uncontrollable micro-tremors in the voice. Application of CVSA technology can prevent a situation similar to that of Aldrich Ames, who regularly
96 Illinois Law Enforcement Executive Forum • 2002 • 2(3) beat the polygraph and succeeded in spying when employed by the CIA, leading to the death of several agents.
Research on CVSA Critics of CVSA technology continually cite studies from the Department of Defense Polygraph Institute (DoDPI). A study done by Cestaro and Dollins (1994) serves as an example of a DoDPI study cited by critics in earlier articles. The method of testing in this study used vocal response from a low stress test involving a subject concealing a number. Cestaro and Dollins concluded that the study did not resolve or answer any questions as to whether or not voice is a detector of deception.
A second DoDPI study was conducted by Cestaro (1995), which proceeded to conduct a two-part study comparing CVSA and the polygraph in a low stress scenario. This study concluded that the CVSA functions electronically in accordance with the foundations of voice stress analysis theory. Also, “. . . data indicate there may be a systematic and predictable relationship between voice patterns and stress related to deception.”
CVSA technology was created for the purpose of use in situations of real jeopardy. Subjects in a laboratory that are told to lie or steal an object in a mock crime scenario will not achieve the same level of stress required to produce an adequate result. A study done by Barland (1973) reaffirms this point in the conclusion that a certain level of stress must be reached in the individual before changes in the voice occur. Once the level of stress is exceeded, differential changes in the voice can be used to determine deceptiveness.
The CVSA is a different kind of innovative technology that has yet to be disproved. Initial studies involving voice stress analysis continually determine that the relationship between stress and the voice are valid (Brenner, 1974).
The successful use of CVSA technology is dependent upon the quality of the examiner utilizing the parameters taught in the six-day instruction. Attempts to compare CVSA and the polygraph completed by DoDPI by Dr. Vincent Cestaro (1995) and another by Dr. Palmatier (1999) were skewed from the start by ignoring these guidelines. There was insufficient jeopardy. The methodology of interview and exam set up was to fit the needs of polygraph. Then, the CVSA was used following these methods, not the operating instructions that took years to implement. The NITV suspended cooperation with federal research when it became clear that the CVSA was not being tested in the context of the required “jeopardy,” and the statistical data collection was not the same for the purposes of comparison. The testing scenario is comparable to having an automotive performance test to see whether a diesel powered or a gasoline powered engine was better while forcing both of them to use the same fuel. One is doomed to fail from the beginning.
An important point that all research concludes is that voice stress analysis warrants further research and that there is no evidence that CVSA is ineffective. The important point of responding to previous research is that the scenarios created for purposes of the experiments maintained no real jeopardy with consequence that warranted a valid stress situation. CVSA technology is an improved form of the PSE that surpasses the earlier model of voice stress analysis.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 97 Conclusion CVSA represents a user-friendly, cost-saving, and efficient tool for use by law enforcement officers to aid in investigations. This innovative technology measures voice stress with no known countermeasures. In addition, it has the potential for covert examinations that have never been a possibility with the polygraph. CVSA is quite simply a product of advanced technology that may soon replace the polygraph in the law enforcement community.
It is the responsibility of all members of the law enforcement community to utilize new technology that will improve the law enforcement process. Benefits of CVSA include low-cost, time-efficient, intensive training; availability to all law enforcement personnel; convenience of a laptop model; and innovative software with no known countermeasures.
President Bush signed the Aviation and Transportation Security Act (2001) that authorizes the Security of Transportation to use voice stress analysis for the purpose of airport security. The CVSA has the potential to deter terrorist and criminal activity that is applicable to airport security and the federal employee screening process. Recent incidents of caseworkers at Washington Dulles International Airport maintaining access to secure areas with prior felonies and immigration fraud may be avoided by periodic CVSA testing that will discourage criminal activity. CVSA technology is currently applied successfully in criminal investigations and pre-employment screening in the law enforcement field.
The best reflection of success can be found by well-established proponents which include the Federal Protective Services, California Highway Patrol, Washington, DC Metropolitan Police Department, New Orleans Police Department, San Diego County Sheriff’s Department, Missouri Department of Public Safety, Miami-Dade Police Department, and the Sacramento County Sheriff’s Department.
Critics will continually refer to flawed federal studies, but the evidence speaks for itself. When applied in real-world scenarios, the CVSA has proven beyond a doubt to be a valuable resource for law enforcement.
References Aviation and Transportation Security Act, S. 1447 (2001).
Barland, G. H. (1973). Use of voice changes in the detection of deception.
Borgen, L. A. (1997, April). An Annotated Bibliography: Studies involving the PSE in non-deception situations. Prepared for the ISSA Seminar, Houston, TX.
Borgen, L. A., & Goodman, L. I. (1976, March 18). Voice stress analysis of anxiolytic drug effects. Ann Arbor, MI: The American Society of Clinical Pharmacology and Therapeutics, Parke-Davis Research Laboratories.
Brenner, M. (1974, April). Stagefright and Steven’s Law. Presented at the Convention of the Eastern Psychological Association. Department of Psychology, Ohio State University, Columbus, OH.
98 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Cestaro, V. L., & Dollins, A. B. (1994). An analysis of voice responses for the detection of deception (DoDPI94-R-0001). Fort McClellan, AL: Department of Defense Polygraph Institute.
Cestaro, V. (1995, August). A comparison between decision accuracy rates obtained using the polygraph instrument and the computer voice stress analyzer in the absence of jeopardy. Ft. McClellan, AL: Department of Defense Polygraph Institute.
Chapman, J. L. Professor, Corning Community College. Director, Criminal Justice Program and Forensic Crime Laboratory. With PSE confession rate of 91.4%
Dahm, A. E. (1974). Study of the field use of the psychological stress evaluator. U.S Congress, House. Subcommittee of the Committee on Government Operations. The Use of Polygraphs and Similar Devices by Federal Agencies. Washington, DC: Government Printing Office, 255-267.
Halliday, A. M., & Redfearn, J. W. T. (1956). An analysis of the frequencies of the finger tremor in healthy subjects. The Journal of Physiology, 134(3), 600-611 (QP1.J75).
Heisse, J. W., Jr. (1974). Is the micro-muscle tremor usable? – The micro-muscle tremor in the voice. U.S. Congress, House. Subcommittee of the Committee on Government Operations. The Use of Polygraphs and Similar Devices by Federal Agencies, Hearing, 93rd Congress, 2nd Session, June 4 and 5. Washington, DC: Government Printing Office, 339-342 (J74.A23).
Heisse, J. W. Jr. (1976, May). Audio stress analysis: A validation and reliability study of the psychological stress evaluator (PSE). The University of Kentucky College of Engineering; Carnahan Conference of Crime Countermeasures.
Kenety, W. H. (1979-1980). The psychological stress evaluator: A new concept in lie detection. Indiana Law Journal, 55(2), 348-374.
Kradz, M. (1974). The psychological stress evaluator – A study. U.S. Congress, House. Subcommittee of the Committee of Government Operations. The Use of Polygraphs and Similar Devices by Federal Agencies. Hearing, 93rd Congress, 2nd Session, June 4 and 5. Washington, DC: Government Printing Office, 224-254 (J74.A23).
Kradz, M. P. (1972). Psychological stress evaluator. Unpublished document. Ellicott City, Maryland.
Lippold, O. C. J. (1970, February). Oscillations in the stretch reflex arc and the origin of rhythmical 8-12 C/S component of physiological tremor. Journal of Physiology, 206(2), 359-382 (QP1-J75).
Lippold, O. (1971). Physiological tremor. Scientific American, 224(3), 65-73 (T1-S5).
MacCaughelty, R. (1990a). The interaction of repression and situational coping consistency with delayed indication of psychological stress in voice stress analysis using the computerized voice stress analyzer – A validation study. Dissertation submitted to The Fielding Institute. Charlotte, NC: RM Press.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 99 MacCaughelty, R. (1990b). Voice stress analysis research findings and the voice stress analysis – Polygraph controversy. Dissertation submitted to The Fielding Institute. Charlotte, NC: RM Press.
MacCaughelty, R. (1990c). Voice stress analysis instruments: What they electronically do. Dissertation submitted to The Fielding Institute. Charlotte, NC: RM Press.
MacCaughelty, R. (1990d). The human nervous system and voice stress analysis. Dissertation submitted to The Fielding Institute. Charlotte, NC: RM Press.
MacCaughelty, R. (1990e). Muscle microtremor, voice mechanisms, and inaudible voice microtremor. Dissertation submitted to The Fielding Institute. Charlotte, NC: RM Press.
MacCaughelty, R. (1990f). The measurement and clinical assessment of psychological stress. Dissertation submitted to The Fielding Institute. Charlotte, NC: RM Press.
Palmatier, J. J. (1999, June). The computerized voice stress analyzer: Modern technical innovation or the emperor’s new clothes? American Bar Association’s GP, Siki & Small Firm Lawyer Magazine, 42-45.
Podlesny, J. A., & Raskin, D. C. (1977). Physiological measure and the detection of deception. Psychological Bulletin, 84, 782-799 (BF1- P75).
Shipp, T., & Izbetski, K. (1981). Current evidence for the existence of laryngeal macrotremor and microtremor. Journal of Forensic Sciences, 26, 501-505 (RA1001.A57).
Smith, G. A. Voice analysis for measurement of anxiety. Journal of Police Science and Administration, 11, 62-68.
Smith, G. A. (1974). The measurement of anxiety: A new method by voice analysis.
Smith, G. A. (1977). Voice analysis for measurement of anxiety. British Journal of Medical Psychology (RC321.B3).
Tippet, R. (1994, August). Comparative analysis study of the computer voice stress analyzer and polygraph. Florida Department of Law Enforcement. [online]. Available:
Worth, J. W. (1972). An early validation study with the PSE.
Worth, J. W. (1974). Transfer of stress through verbal and written communication.
Hugh Wilson Ridelhuber, MD, FABP is a board-certified psychiatrist with 38 years experience in child and adult psychiatry. His subspeciality is in forensic psychiatry. Dr. Ridlehuber is an unpaid board member for the NITV.
Patrick Flood, PhD, is a retired investigator from the Sacramento County Sheriff’s Department where he utilized the polygraph prior to his training in CVSA. He had taught at Backster’s School of Lie Detection in San Diego. He now teaches for the NITV, as well as for California POST.
100 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Emerging Technologies and Law Enforcement Training: Building a Technology-Competent Police Force
Thomas J. Jurkanin, PhD, Executive Director, Illinois Law Enforcement Training and Standards Board Vladimir A. Sergevnin, PhD, Illinois Law Enforcement Executive Institute
Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand.
Putt’s Law
Technology is one of the most powerful factors that change the way police agencies carry out their missions and functions. The invention and utilization of the telephone, automobile, and computer all revolutionized policing.
In present-day American law enforcement agencies, we can find many new technological innovations and techniques that were unthinkable only 20 years ago. The Information Age has opened new windows of opportunity for criminals. In 1980, there were almost no cellular phones in the United States. By July 2000, there were over 100 million cellular phone subscribers in the United States. In January of 2002, 165.1 million people in the United States had home Internet access. These technological developments have greatly limited the ability of public authorities to conduct communications surveillance using traditional methods (Etzion, 2002).
These advancements are very demanding for law enforcement personnel and require the police to solve new problems and to accomplish new tasks—to open up lines of technologies and communications. Officers and law enforcement executives must be trained to recognize high-technology crime and fight back. That is why it is important to make an inquiry into this vast area of new technology training for police and technocultural change. Throughout the entire history of law enforcement in the United States, there has been a megatrend toward a permanent increase in technological training and standards for police. This trend is understandable because law enforcement needs to solve an increasing variety of complicated problems.
Today, criminal justice systems in the United States are faced with a new area of criminal activity with new types of terrorism and white-collar and cyber-crime, which involve highly intellectual criminals who are adept at manipulating new technologies. This demands an adequate response from the police. In today’s world, we need not only be physically strong and profusely dedicated, but also technologically sound police officers. American law enforcement agencies need to increase the technological, intellectual potential and educational level within the law enforcement community. Another reason that this topic is timely is the reality that most of the professions in present-day society demand a high level of familiarity with new technologies. You cannot imagine a doctor, engineer, or teacher without computer skills. In contrast, it’s very possible to find police
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 101 officers, especially in their 40s and 50s without adequate computer awareness. When comparing the social importance of law enforcement officers and other social servants, the functions of the law enforcement officer is far more challenging, difficult, and in many ways important to society than many other professions.
The entire field of law enforcement is experiencing change. This change has been precipitated by changing homeland safety priorities, problems of communications in a decentralized system, increased reliance on technology, rising expectations of the public, various terrorist threats to public safety, and myriads of other reasons. The end result is a changing job and set of responsibilities for law enforcement professionals. The job of an officer has become and will continue to become more complex. As a result, officers will need to increasingly rely on new technologies in communications, investigation, and patrol to make decisions and take appropriate actions. Following a specific set of guidelines or relying on outdated equipment and experiences are no longer sufficient to deal with the new, challenging situations of today.
Technological Challenges Present-day local, state, and federal law enforcement agencies are faced with challenges of implementing new technologies in various sectors:
• Biometrics – Voice verification and identification systems that work over the Internet to authenticate and verify suspects and provide voice stress analysis; facial recognition and retrieval systems designed to enhance the identification of suspects; automated fingerprint identification systems • Communication devices – Computerized devices that allow patrol officers to run pieces of identifying information about people or places through databases without going through dispatchers; portable, software-driven universal translators that police use at the scene to translate speech; hand-held walkie-talkies that are capable of imagery transmission, live scan fingerprint identification, cryptographic algorithms, position tracking, and a variety of plug-in capabilities; portable video cameras that allow live video feeds from the officer’s point of view back to headquarters; universal computerized system containing a laptop computer, printer, fax, copier, digital camera, scanner, cellular telephones, satellite telephones, GPS system, GIS system, and portable fingerprint capture • Computerized systems – Mobile digital terminals installed in police cars that provide updates on ongoing criminal activity, perform crime analysis and profiling of suspects, and conduct scenario analysis; arrestee digital mugshot systems; intelligence analysis software packages; software packages that perform street-level crime trend and pattern recognition (hot spot analysis); intelligence analysis package that uses fuzzy logic to gain, retrieve, and analyze intelligence from ongoing conspiracy and major crime cases • Evidence – Robots that are used for bomb disposal, hostage negotiations, and crime scene searches; portable DNA identification device; software application designed to accommodate the reporting and tracking needs of a crime lab • Traffic and safety – Video cameras; accident reconstruction software applications that analyze vehicle collisions; auto recovery systems that auto manufacturers can secretly put inside vehicles, which transmit a code that the police can send or receive; violation reporting systems or handheld traffic citation devices that print out a ticket
102 Illinois Law Enforcement Executive Forum • 2002 • 2(3) • Training and public relations – Computer-based instruction software applications usually of a multimedia or interactive nature and used for educational or training; firearms training systems (FATS) or computer-generated images projected on a big-screen TV with various shoot-don’t shoot scenarios; law enforcement television network; management software applications for recording and tracking the competence level of employees (Criminal justice technology, 2001).
Technological advances have led to the development and use of new tools to support the work of law enforcement officers. Computer technology provides officers with better information, faster access to information, and faster processing of information. These advances facilitate more effective performance of trained officers; however, the new technology requires new skills. The most common technology-related skills are linked directly to the use of technology. The use of a sophisticated rendering system for developing composite drawings of suspects requires an officer to learn the computer and software specifics. Additionally, officers need to learn how to use the results or outputs of the technology in new and more sophisticated ways.
Obstacles We should not overlook the obstacles of utilizing new technologies in law enforcement. National police information systems are not integrated. Developing and enhancing links between law enforcement agencies for the purpose of information sharing should be a priority today. Sharing the information enables law enforcement officials to make better decisions.
Law enforcement communications are not integrated nationwide, and it would be advantageous for law enforcement agencies to install comparable communication equipment.
Financial resources are limited, and most police departments in the country are small- and medium-sized. Budgetary resources are limited because law enforcement agencies spend most of their funds on personnel and have little left over for new equipment (The Evolution, 1998). To purchase new technologies that can be implemented by law enforcement agencies nationwide, it is necessary to establish federal funding.
Utilization of the new technologies may save money in the long run, but initially, it’s going to be a big expense, and there are liability concerns as well.
Demographics are affecting the ability of law enforcement to adopt new technologies. The officer’s average age is going up. Some police executives are more conservative in utilizing high-tech equipment and are suffering from “technophobia,” or the fear of technology.
Some police executives are afraid of “technological opposition” in the agency. Another potential problem with the use of these new technologies is that officers will expect them to solve the crime or any other problem. New pieces of technology are no more than tools.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 103 Initially law enforcement officers will have to spend extra time learning the new technology, and the initial perception may be that the technology has made things worse, not better.
It is a political risk for police executives to implement new technologies because his or her initiative will be associated with the success or the failure of this technology.
Inservice training courses are providing little formal training on computers. Cyber-crime is intimidating for police officers because they have not received enough training, and they don’t have adequate equipment. The research done in 2001 shows that only 24.3% of law enforcement agencies reported having computer crime investigative capabilities (Collins & Morrisson, 2001). Criminals are far ahead of law enforcement agencies.
The younger generation has more skills and knowledge in new technologies than experienced police officers. For the first time in the history of policing, rookies can teach veterans.
The speed at which technology changes also influences the importance of increased training in this area. As technologies are developed and diffused into the police workplace, new knowledge and skills are needed to install, operate, and maintain equipment and to manage the processes used to control the technologies. These changes demand that we continually develop training programs in order to gain the understanding and skills needed to adapt. Police training in the area of utilizing new technologies will increase.
The Illinois Law Enforcement Training and Standards Board foresees increased demand of law enforcement training in many areas dealing with technology.
Solutions: Recruitment Law enforcement executives have to think strategically about resources and efforts for the recruitment of officers capable of dealing with emerging technologies and investigating high-tech crimes.
Much has been written about Generation X employees (born between the mid- 1960s and the late 1970s). Computers, technologies, music, movies, mass media, and television have influenced their lives, environment, and expectations. They are generally self-reliant, informal, skeptical, independent, and casual in their approach to authority. Individuals in this generation do not expect to have a lifetime career and prefer jobs that are stimulating, challenging, and flexible. They do not like strict work environments and expect that the law enforcement agency has to have medium- to high-level technological “weaponry.”
While there has been less written of the Millennial or Net Generation (born between 1977 and 1997), we know that members of this generation have been influenced by technology, especially computers. They know more about technology than their parents and bosses. They expect a high level of technological resources and support in the workplace.
104 Illinois Law Enforcement Executive Forum • 2002 • 2(3) • There will be more chances to reach these potential employees through the Internet. • Explain that law enforcement agencies need advanced knowledge and skills in computers and new technologies. • Encourage preservice training programs to be more technologically sophisticated. • Provide incentives for college-educated computer, technology, chemistry, and science majors to join a police agency.
Solutions: Overcome the technophobia ideology. One of the strongest limitations in utilizing new technologies is that some police executives are not computer literate (Walker, 1997). Early police officer interactions with computers were limited to accounting and typewriting. The first information technologies in police departments were managed by highly trained technicians, separated from law enforcement experience and were “foreign” to police departments. New information technologies were used mostly for storing and selecting vast amounts of files and other data, but they were not used for analytical and managerial purposes. The computer’s potential was not used because specialized software was too expensive and training was not available. In addition, new information technologies in many instances overloaded the police executives with information that made the decision-making process more difficult. All these produced technophobic attitudes among police management and increased technoprejudice. Intensive training programs promoting the utilization of new technologies can be helpful.
• Provide new technology training for top- and medium-level management of the law enforcement agencies. • Evaluate computer literacy of your department. • Evaluate computer accessibility of the personnel. • Implement a computer awareness program that all personnel must attend. • Develop a network with other agencies that have already implemented new technologies. • Provide special training on Internet capabilities. A lot of examples can be found on the Internet. • Establish your own department home page. • Establish more communications within the police department through the Internet between officers. The Internet provides an information exchange not only with “insiders” but with criminal justice agencies; it promotes discussion and analysis.
Solutions: Training and Implementation of New Technologies Approach Law enforcement agencies are under the pressure of the market and private enterprises trying to promote and sell as many products as possible. This is especially true after the events of September 11, 2001. Myriads of new technologies from law enforcement exhibitions potentially can disorient law enforcement executives and destroy the stability, efficiency, and the budget of the department. That is why it is crucial to develop a strategy based on “technological” evaluation of your agency, sociopolitical/financial environment, and its mission.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 105 Technology must be used to enhance law enforcement agency efficacy and personnel performance. New technologies have to be used only if they improve the efficacy of delivering the services for the public and strengthening law and order in the community. Law enforcement executives must demonstrate a clear commitment to supporting the introduction of the new system. Adopted technologies have to be used regularly and must be beneficial for all levels of the agency.
Plan the technological utilization process. The law enforcement agency has to develop a general plan of long-term and short-term implementation of new technologies. The long-term (strategic) plan has to reflect the vision of technological change along with all functional dimensions of the agency in the next five to ten years. The plan should incorporate all divisions of the agency and include the following:
• Work resources and costs • An inventory of current technological equipment • Identified links to existing technological systems • A cost-justification process that quantifies expectations and measures costs and benefits in the long run. Costs may include personnel equipment such as the following: • Weaponry • Communications and mobility • Information • Computer (aiding investigation, patrol, screening criminals and personnel, etc.) • Artificial intelligence (expert systems, navigation, visual perception, speech recognition, etc.) • Biometrics • Robots • Evidence • Traffic and safety • Homeland security • Time saved by new equipment and savings in costs associated with technological change • A realistic perspective of budgeting and possible agreements or cooperation needed to fulfill the plan over time • Strategy for overcoming resistance to change, such as ongoing communication, workshops, support, and training
Short-term (tactic) planning has to provide the implementation of new technologies from the following dimensions:
• Priority • Compatibility • Budget • Training • Evaluation package (If a technology was too inefficient, it should not be used) • Cooperation with other agencies (Small police departments have no resources for new technologies.)
106 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Some law enforcement agencies invest considerable portions of their budget and staff training time for emerging technologies that end up being under-utilized and failing to live up to their vast potential because the staff had unrealistic expectations for the technology. Creating the plan to implement the new technologies will help the agency to become more effective in daily operations, to use funds more effectively, and to prevent turnover of personnel.
Create a technology implementation task force. Top and middle managers and supervisors of the police agency should be included. The task force will develop a plan; detect obstacles; build solutions; and develop guidelines, policies, and standards. By including all supervisors, contradictions of different divisions setting up incompatible technologies are avoided.
The successful task forces are those that have police chief support and combine technical with management expertise. It is crucial to look for potential agreements or cooperation at the start. A possible starting point would be for the task force to complete a survey of what other law enforcement agencies are using for applications and how they are benefiting from them.
Train and educate personnel. The main challenge for the law enforcement executive is to plan and choose to implement the new technology. Initial training has to be reinforced regularly. Law enforcement executives must demonstrate a clear commitment to support officers during their learning curve.
Plan to move training efforts from initial outside training to regular inservice training. Without inservice training, there will be no utilization of new technology. Encourage police officers to take technological courses in the universities and colleges. It is unrealistic to plan having all police officers be computer specialists, but all first responders do need training to handle crimes and crime scenes involving computers (Goodman, 1997).
Prioritizing Personnel New police technologies will never replace law enforcement officers and their education, training, knowledge, skills, experience, and intuition. The most profound and sophisticated piece of equipment is only a tool to assist in finding a solution. Technology will never replace skills, judgment, and common sense.
Liability Factor In utilizing new technologies, law enforcement agencies have to analyze possible legal complications. The criminal justice system, public, and especially courts will try to strike back and raise “hue and cry” about individual rights violations. Individual rights, equality under the law, and due process issues all require reinterpretation as new technology is adopted (Schmalleger, 1999).
Conclusion Modern society has placed the burden of investigating high-technology crimes on the shoulders of law enforcement agencies. Unfortunately, many financial, political, and personnel factors in the criminal justice system have left police unprepared
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 107 for the challenges that have come about as a result of new technologies. Programs to address the problem of dealing with new technologies need to address the educational and training factors that are currently as important as financial and institutional roadblocks. At the present time, the key points for law enforcement executives are planning utilization of emerging technologies and educating and training personnel to keep up with advanced criminal activity nationally and worldwide.
Bibliography Collins, P., & Morrison, L. A. (2001). Cyber-crime: A report on the status of law enforcement (Power point presentation). Eastern Kentucky University: Justice and Safety Center.
Etzion, A. (2002). Implications of select new technologies for individual rights and public safety. Harvard Journal of Law & Technology, 15(2), 1-34.
Goodman, M. D. (1997). Why the police don’t care about computer crime. Harvard Journal of Law & Technology, 10(3), 102-131.
Criminal justice technology. (2001). Police futurism & technology. North Carolina Wesleyan. [Online]. Available:
Schmalleger, F. (1999). Criminal justice today: An introductory text for the twenty first century. Upper Saddle River, NJ: Prentice Hall.
The evolution and development of police technology. (1998). Technical report. Washington, DC: Seaskate, Inc.
Walker, J. T. (1997). Re-blueing the police: Technological changes and law enforcement practices. In M. L. Dantzker (Ed.), Contemporary policing: personnel, issues & trends (257-276). Newton, MA: Butterworth-Heinemann.
Thomas J. Jurkanin serves as the Executive Director of the Illinois Law Enforcement Training and Standards Board, a position he has held since 1992. He has 25 years of experience in the policing field. Dr. Jurkanin holds a PhD from Southern Illinois University in Education and Social Justice. Dr. Jurkanin serves as Vice Chairman of the Governor’s Law Enforcement Medal of Honor Committee.
Vladimir A. Sergevnin, PhD, is a research associate of Illinois Law Enforcement Executive Institute and professor at St. Petersburg University of the Ministry of Internal Affairs, Russia. He earned his PhD at the Moscow Institute of Popular Economy in 1986. He has 25 years of teaching experience at Illinois State University, Western Illinois University (USA), Saint Petersburg University, Vladimir Juridical Institute (Russia). He has published over 40 articles and written six books. Vladimir Sergevnin can be reached at
108 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Internet-Based Distance Learning: Implications of Emerging Technologies for Public Safety Training
Rob Miller, PhD, Advanced Systems; Cameron University, Lawton, Oklahoma
Changes to Technology and Processes Technology’s presence in the workplace is increasingly pervasive. Once, small networks of specialists directed the employment of multi-million dollar mainframes to provide data management. Now, workers at every level perform daily tasks over networks of personal computers and wireless devices that span the organization. This change is exponential in nature, progressing in wave-like fashion through every aspect of business and commerce. The same forces that are changing business are now poised to influence the delivery of training, education, and performance support. If predictions of 63 million Americans using the Internet at work in 2005 are correct, then Internet-based solutions to distance learning may become commonplace.
The Promise of Internet-Based Distance Learning Thomas Edison believed that the moving picture would revolutionize education, motivating students to learn in ways never before seen, perhaps even replacing textbooks (Heinich, Molenda, & Russell, 1989). Likewise, several predictions suggested that distance learning technologies would rise to the challenge and forever change the way in which organizations conducted training.
“The biggest growth area in the Internet will be eLearning. It’s at the same stage as eCommerce was at the beginning of 1997” (Chambers, 1999).
Some estimates suggested an $11.4 billion demand for Internet-based distance learning solutions by 2004. Firms that traditionally provided classroom-based instruction adjusted their strategies and moved quickly into the technology-based training market. Some presenters at trade shows and conferences even claimed that “eLearning” actually enhanced learning by tapping elusive brain functions somewhere in the human consciousness.
The Reality of Internet-Based Distance Learning The fact is, while Internet-based distance learning received significant attention within the technology industry, several of the early entries into this field collapsed. This is primarily due to heavily leveraged financing, economic uncertainty within the technology sector, and poor business models. Generally, these companies attempted to acquire broad market appeal by offering vast libraries of content for every conceivable subject; however, consumers did not automatically respond.
That is not to say that distance learning over the Internet collapsed. Online information technology training is already a $0.87 billion industry, and soft
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 109 skills training will probably surpass it by 2003 (McCrea, Gay, & Bacon, 2000). Almost 90% of colleges or universities intend to offer courses over the Internet by 2005 (Lake, 2001).
Generally, the dominant Internet-based distance learning providers recognized that customers want more than shallow offerings of generic courseware. They want multiple media types (e.g., CD-ROM, Web-based, books, instructor-led, videotapes) and integrated services (e.g., training, training management, certification, testing, and consulting). Consumers expect Internet-based offerings to provide values that exceed those of more traditional approaches to instruction. Typically, that value is measured in terms of cost avoidance, liability avoidance, and operational efficiencies.
The Value of Internet-Based Distance Learning to Public Safety Organizations Recent studies have indicated that organizations of every type face increasingly rapid technological change, increased regulatory supervision, and increased liability and litigation to a greater extent than ever before (Hall, 2001a; McCrea, Gay, & Bacon, 2000; Urdan & Weggen, 2000). Consequently, these organizations are expected to “manage, distribute, and uptake knowledge . . . faster and cheaper.” (McCrea, Gay, & Bacon, 2000). In this regard, public safety organizations are no different than their commercial counterparts.
Add to this a growing dissatisfaction with conventional approaches to training delivery (Hall, 2001b; McCrea, Gay, & Bacon, 2000; Urdan & Weggen, 2000). With traditional training methods, companies generally spend more money on transporting and housing trainees than on actual training programs. According to the American Society for Training and Development, travel expenses account for two-thirds of training costs. Additionally, time spent traveling or in class is time away from the job; managers must replace employees or do without them for the duration of the training requirement. In many smaller organizations (such as public safety organizations), these costs may prohibit training entirely.
Rather than loosing workers to lectures and seminars, public safety organizations need to tightly integrate their training solutions with their operational requirements. The scale of this requirement suggests that managers in public safety organizations need training solutions that are cost-effective, manageable, and distributed.
Distance learning offers managers one tool with which to face the significant challenges of keeping public safety workforces trained and informed. Emerging distance learning technologies and the proliferation of Internet-capable devices within the United States suggest that Internet-based solutions may be one way to address those training needs.
Distance Learning Distance learning is best defined as any use of instructional media that separates the learner from the instructor by time or space. From this perspective, distance learning is hardly new. Consider that many cave drawings and petroglyphs served to pass on important knowledge to future generations long after the authors
110 Illinois Law Enforcement Executive Forum • 2002 • 2(3) departed. Certainly, the most prolific distance learning technology is text, whether in print or in an electronic format.
Distance learning may employ high technology strategies such as satellite broadcasts to link instructors and students over great distances in real time. At the same time, distance learning may employ less sophisticated media to link instructors and students over an extended period of time (e.g., correspondence courses).
Internet-based distance learning is a nascent concept. As such, the literature suffers from the lack of a standard classification of the various delivery mechanisms. To facilitate further discussion, this article will address three common ways in which Internet-based distance learning delivers content: (1) Asynchronous content, (2) collaborative content, and (3) live online delivery.
Each of these is a viable approach to Internet-based distance learning; neither approach is particularly superior in and of itself. Rather, each possesses unique advantages that allow them to integrate into both distance learning and classroom settings.
Asynchronous or “Self-Paced” Content Asynchronous content does not require simultaneous communication between people. A computer-based lesson on how to collect DNA evidence, whether delivered over the Internet or with a CD-ROM, is a good example of this approach.
Asynchronous content provides students with a common curriculum of tutorials and references. References may consist of instructor notes, online articles, or texts converted to online formats. Individual lessons contain automatically scored evaluations to assess student progress within the lesson’s framework. These evaluations may occur in the form of pretests, embedded questions, or posttests. Remediation is usually supported using branching, a technique that allows students to review material previously presented or to receive additional instruction on material. This approach is well-suited for subjects that employ written tests.
A significant advantage to asynchronous content is that it paces itself to the student. For several years, studies have consistently noted that computer-based training that follows this training approach tends to yield “substantial savings of student time” (Kulik & Kulik, 1991). Citing these studies, Brandon Hall (1995) notes . . .
There is very strong evidence that computer-based training requires less time for training compared to instructor-led training. The amount of reduction ranges from 20-80 percent, with 40-60 percent being the most common. Time reduction for multimedia training is usually attributed to a tighter instructional design, the option for participants to bypass content not needed, and the opportunity for participants to focus on those sections of the course not yet mastered.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 111 Another advantage to this approach is that the program delivering the instruction will perform consistently for all students. Unlike instructors, it will not tire, become irritable, or forget to cover every point in the lesson; however, asynchronous content is only interactive with the student to the extent allowed in the program. This limits interactivity to the program design. To accommodate student requirements for additional feedback or assistance, students must resort to more collaborative means.
Collaborative Content Early attempts at asynchronous content delivery actually date back to the 1950s. Attempts to make these systems more reflective of human cognitive processes yielded specialized learning environments such as LOGO, MYCIN, and PUFF. Despite the sophistication of the programs, these efforts yielded tutorials that were still limited by the programs in which they were built (Saettler, 1990). Furthermore, the skills required to develop learning materials in these environments were fairly specialized. Recent developments rooted in communications technologies offer a far more practical means of facilitating dynamic interactions in distance learning.
Collaborative learning approaches allow students to share ideas, inquiries, and resources with their peers, mentors, and instructors. The underlying technologies most often consist of e-mail, bulletin boards, and threaded discussions.
Both e-mail and bulletin boards are technically asynchronous in nature and are usually limited to textual materials (although media files may be attached); however, their use is uniquely different from asynchronous courseware because they support group-learning opportunities. They involve interactions with students, instructors, facilitators, or mentors. Most online students are familiar with these capabilities and have access to the necessary tools. Since it allows the instructor and students to communicate at different times, it is an excellent means for accommodating differences in work-shifts or time zones.
E-mail provides an asynchronous link to request assistance, pose questions, or turn-in assignments. One difficulty in planning for the use of e-mail is providing students with a complete set of addresses for potential course requirements. For example, students may require addresses for technical support, the instructor, peers, mentors, administrative support, and library resources.
In the distance learning environment, bulletin boards are often described as “threaded discussions.” This technique allows bulletin board discussions to follow tangents, called “threads.” The unpredictability of threaded discussions represents a two-edged sword. Maintaining continuity among the threads and ensuring that contributors comply with the guidelines for group discussions may often require a significant effort on the part of a moderator. Additionally, as threads develop and diverge, students may become lost in the maze; however, the benefits of this approach address many of the weaknesses of asynchronous tutorials. These formats allow students to evaluate the materials, pose questions, develop arguments, and provide constructive criticism. Collaborative content is best suited for training goals that are more ambiguous. These goals may require application, analysis, synthesis, or evaluation.
112 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Live Online Learning (Synchronous) Throughout the 20th century, many institutions attempted to harness proliferating communications technologies for educational purposes. One of the earliest was radio-based education, which is still a staple in many underdeveloped countries. In the post-World War II era, however, the United States focused on technologies enabled by communications satellites and telephony (Saettler, 1990). Many of these attempts lacked the necessary interactivity to do much more than augment film and video. A notable exception, however, is teleconferencing technology.
Video teleconferencing and its cousin video desktop conferencing are not new; however, their bandwidth requirements and equipment price usually place them outside of reach of many potential students (i.e., few students possess the capability to conduct teleconferences in their homes or at their worksite). The primary successes of these technologies have been within the confines of institutions that possess the necessary infrastructure to accommodate its requirements.
Live online learning provides the synchronous alternative to more expensive teleconferencing technologies. These technologies allow students to interact with instructors and peers in real time, using existing dial-up connections. By relying on low bandwidth technologies, virtual classroom technologies allow synchronous learning environments to exist in homes and workplaces without extensive hardware or software requirements.
These approaches may range from simple text chat to virtual classrooms. Text chat tools represent a “low end” approach. Many of the tools are free, and they require minimal bandwidth. Instructionally, chat tools tend to be somewhat limited for use in lengthy courses. They can provide an excellent augmentation for students seeking assistance from instructors, mentors, or peers.
A relatively recent development in distance learning is the development of synchronous classroom environments that allow instructors and students to share information in real time. These live environments often referred to as “virtual classrooms,” enable students to connect to their classroom over existing (dial-up) Internet connections.
In the virtual classroom, instructors control students’ computers. Students view the instructor’s materials as the instructor advances through a presentation. By employing Voice-Over-Internet-Protocol (VOIP), the students also hear the instructor’s comments just as they would in a classroom. Most of these systems allow students to signal the instructor when they have questions. When the instructor recognizes the student, the question may be provided via text chat, or in more robust systems, the student may use the same VOIP technology as the instructor and pose the question vocally, allowing other students to hear the question.
Many virtual classroom approaches also include white boarding tools that provide students with the virtual equivalent of the chalkboard. Instructors and students may write equations, solve problems, or display graphics on their screens and share them with all participants. Other capabilities may include the support for breakout groups, virtual field trips, quizzes, and video. A singular advantage of virtual classroom
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 113 technologies is that they are typically accessible at slower modem speeds (often as low as 28.8 Kbps). This allows students in even the most remote regions to participate.
Another advantage of virtual classroom technology is its ability to leverage existing instructor capacity in a distance-learning environment; however, this presupposes that the instructors are adequately prepared to conduct their classes within a synchronous, distance-learning environment. While synchronous technologies provide the appearance of a traditional classroom, they do employ somewhat different presentation techniques. To provide adequate interactivity, instructors must continually seek to engage their students by directing questions to them and providing activities for them. Live online learning is best suited for training that requires intense information sharing and extensive collaboration.
Considerations for Adopting Internet-Based Distance Learning Managers in any organization should not adopt Internet-based distance learning until they have considered the training requirements of their students and their organization. Technology is a moving target; chasing the latest technology is an expensive proposition that few public safety organizations can afford.
Value-Based Considerations Increasingly, public safety organizations will be required to justify training expenditures from the perspective of their support for organizational objectives (i.e., training objectives and budgetary objectives). Public safety organizations should expect training products to provide tangible results either through improved student performance or through cost-effectiveness (or both).
Currently, the Internet-based training community emphasizes the cost-effectiveness of computer-mediated formats over instructor-led formats; however, as the market becomes increasingly saturated, training managers should avail themselves of the opportunity to compare products. Training managers may wish to use calculations of return-on-investment (ROI) or cost-benefit analysis (CBA) to quantify the value of various training methods to their organization. These techniques consider the total product cost to the organization, factoring in purchase price and cost avoidance. Quite often, the costs avoided through careful use of Internet-based learning technologies can be significant.
Beyond budgetary concerns, however, training managers should seek to determine if training actually improves on-the-job performance. What performance should the training improve? While many training providers offer a wide variety of Internet-based distance learning courses, very few may be relevant to the specific needs of the public safety community. Prudent managers should ensure that the content supports their organizations’ training requirements.
Content Development Considerations As distance learning technologies gain broader acceptance, customer priorities are shifting away from stand-alone training courses to more comprehensive and increasingly complex approaches, which require more assistance with integration and implementation.
114 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Historically, courseware has followed a “monolithic” design in which the presentation program contained the pertinent information; the course content was inextricably embedded in the presentation. Access to the information depended upon access to the presentation technology (i.e., the courseware employed a programming language that restricted its use to a particular family of computers or computer operating systems). Further complicating this problem, many programs would only record student progress to a single proprietary management system. Purchasing the management system therefore restricted consumers to a small pool of courseware vendors. Increasingly, developers and consumers view this approach as inefficient. Student records from one course must be transferable to other courses, especially when different vendors provide the courseware.
At the forefront of integration is the concept of courseware reuse and sharing. Commonly referred to as learning objects, reusable instructional objects, or shareable courseware objects, this effort seeks to promote a “granular” approach to courseware development. Within this new framework, student data and courseware would be transferable between different systems and platforms.
Several organizations now support a move to defined, open standards within the distance learning community. Reliance upon open standards offers the potential to allow purchasers of distance learning products to select from a wider array of course offerings. Currently, the most prominent of these organizations is the Advanced Distributed Learning (ADL) initiative. Established by the Department of Defense and the White House Office of Science and Technology Policy, they are developing the Shareable Content Object Reference Model (SCORM). This specification provides guidelines for developing interactive courseware that a wide variety of computer platforms can share and reuse. Their work includes the efforts of other organizations including the following:
• Aviation Industry CBT Committee (AICC), which has produced the most widely used standard for the transfer of scores and course management information between computer systems. • Institute of Electrical and Electronics Engineers, Learning Technology Standards Committee (IEE/LTSC), which has developed guidelines for computer training components and systems. • IMS Global Learning Consortium, which has developed technical specifications for software and services in distributed learning.
The SCORM is not a true standard, yet. Indeed, by ADL’s own admission, it is a specification, but its implications are significant. Organizations with large bodies of legacy courseware may not be able to convert much of their content to newer, sharable formats. Likewise, organizations with older hardware may not be able to share newer content with more robust multimedia enhancements (i.e., video, animation, and audio). The specifications produced by these bodies are still evolving; however, their adoption and continued development holds significant promise for Internet-based delivery of asynchronous content. This specification provides the basis for developing shareable training products with off-the-shelf technologies, thus minimizing cost implications. To that end, many of the federal government’s defense organizations now mandate SCORM conformance from their training vendors.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 115 Content Aggregation Considerations As demands on distance learning grow, managers will require additional content. Industry trends suggest that much of this content will come from third parties. This strategy (called content aggregation) allows organizations to obtain content without an increase in development staff.
One source for job-relevant content in the public safety field is the Federal Law Enforcement Training Center. They offer a variety of asynchronous courseware to public safety organizations and professionals throughout the world.
The use of third-party courseware is not without risk. The factors of relevance, quality assurance, and shareability have the potential to limit access to third-party content. Relevance to organizational requirements is paramount in selecting courseware or training programs. The courseware should address the job tasks to be performed by the student audience. The courseware should also support management requirements for student documentation (e.g., test scores and training records). Likewise, a vendor’s ability to deliver quality courseware consistently is also important; however, this is difficult to assess until the product has been purchased and used. Selecting vendors that are certified under a recognized quality assurance standard (e.g., ISO 9001 or the Malcolm Baldridge Quality Award) would provide an indication of the vendor’s ability to consistently meet quality requirements. The documentation associated with these standards (particularly concerning product testing and evaluation) would also provide a basis for evaluating the vendor’s product. Finally, adherence to shareable content standards (i.e., ADL’s Shareable Content Object Reference Model) would provide a basis for importing and exporting courseware from other systems.
Infrastructure Considerations Managers should determine whether their organization and their intended students possess adequate software, hardware, and computer network access to support Internet-based distance learning. All too often, managers in large organizations seek to develop the necessary infrastructure to deliver Internet- based distance learning autonomously. Managers should also evaluate whether their organizations are prepared to provide the necessary support services and maintenance. Such a staff requires skills and knowledge to address the infrastructure and specialty software requirements. These skills will probably include certifications such as Microsoft Certified Systems Engineer (MCSE); Microsoft Certified Solution Developer (MCSD); Certified Cisco Network Associate (CCNA) or Master CNE; or another database, network, or web certification. Additionally, these certifications may include vendor certifications associated with technical support for specialty software.
Managers should also consider the operational readiness standards that ensure continued availability of training resources to the end-user. For example, Internet service provider (ISP) standards are most commonly no more than 1% downtime within a 24-hour period or approximately 15 minutes. This standard, however, may not support bandwidth-intensive requirements (e.g., live online applications). For these requirements, a mean-time-to-failure standard of 0.5% (geometric mean) is probably more appropriate. To achieve this standard, service providers plan
116 Illinois Law Enforcement Executive Forum • 2002 • 2(3) for redundancy. This implies additional hardware and continual backup of data. When systems must be maintained, backup systems must be brought online to accommodate demand. In the event of a catastrophic event, critical data must be available to reinstate services. All of this must be invisible to the student.
At the same time, students, instructors, and supervisors may require access to training data. This includes test scores, evaluations, bookmarks, assignments, and user profiles. Again, the implications for hardware and personnel suggest that Internet-based distance learning will evolve to 24-hour operations facilitating the requirements of clients to access learning materials during downtime or between shifts.
It is unlikely that many public safety organizations could support these demands. Instead, managers should determine whether prospective vendors meet these requirements.
Organizational Considerations Support requirements also suggest that managers should consider organizational requirements to support this structure. The skills sets typically required for sustained operation of Internet-based distance learning enterprises include strategy, information technology management, eCommerce, content management, application development, infrastructure management, customer relationship management, and project management (Gomolski, 2001). Assembling this diverse set of skills within one organization is often challenging, at best. One option that public safety organizations must consider in obtaining the necessary skills sets is outsourcing to specialty firms or requiring vendors to provide these services.
Implementing and supporting Internet-based distance learning suggests significant requirements for organizational change. The change is not revolutionary but evolutionary; however, managers should assess their organizations’ adaptability. The organizational implications extend beyond the skill sets and organizational requirements of the eLearning enterprise. Internet-based distance learning may generate significant amounts of student performance data (e.g., scores, certifications, course selection, individual schedules, and attendance data). In many ways, the data management requirements resemble those of an instructional institution. If managers lack adequate training staff, they should pay close attention to the collection, security, and integration of student performance data if they are to avoid information overload.
Developing and distributing distance learning commonly requires auxiliary software and hardware, especially to support Internet-based access. This may include servers, server software, database software, and storage devices.
Integrating new hardware and software into an existing operational infrastructure may also be problematic. Managers should review their organization’s polices regarding plug-ins, firewalls, and dial-ups. The security concerns and bandwidth requirements for accessing or delivering distance learning products may compromise the network’s ability to perform other critical functions. This may necessitate a decision to outsource the requirements instead of applying them to an existing infrastructure.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 117 System Integrity and Security Considerations Managers should assume that an Internet-based distance learning enterprise will be the target of cyber-crime seeking to obtain personal information or deny service. Often cyber-attacks amount to little more than vandalism (e.g., changing words on web pages or uploading pornographic images); however, these attacks are becoming increasingly more insidious. The information contained in many distance learning systems (i.e., names, addresses, phone numbers, or financial data) is increasingly sought after by cyber-criminals and is a significant motivation for cyber-attacks. Safeguarding this information should be a primary concern.
While there is no substitute for rigorous security, managers must also practice a prudent level of risk avoidance and mitigation. One strategy to mitigate this risk is to minimize the amount and types of information stored within the confines of the distance learning enterprise. Most notably, the potential liabilities associated with the maintenance of personal information on a local server are significant. This is a significant reason to consider using a vendor to provide these services.
Value-Added Services Public safety organizations should consider the importance of “value-added” services in the selection of training providers. These services enhance management’s ability to deliver and monitor training over wider distances than previously. These services may include custom curriculum design and development, pre- and post-training mentoring and support, training effectiveness analysis, reporting and tracking tools, and advisory services on how to integrate distance learning into an organization’s training strategy. For example, managers in public safety organizations may require advance notification when their employee’s certifications are about to expire. Many Internet-based distance learning systems can provide this service. Additionally, they can also provide the ability to notify students and managers when training materials are updated due to regulatory changes.
Increasingly, training providers are offering full suites of products and services ranging from initial skills-gap analysis, course development, assessment, and delivery to course registration, tracking, and hosting (Urdan & Weggen, 2000).
Summary Internet-based distance learning is not a silver bullet. It is one of many tools that public safety organizations should consider. Training managers and instructors should recognize, however, that technology is a moving target. As such, it is the means to an end not an end in itself. Training decisions should focus first on the organization’s training and training management requirements and the target audience requirements and then the delivery infrastructure. Employed correctly, Internet-based distance learning can provide the training flexibility that public safety organizations require.
118 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Bibliography Chambers, J. (1999). Presentation at COMDEX. [online]. Available:
Gomolski, B. (2001, March). Boosting e-business talent requires finding the right skills and their sources. E-Business Matters. [online]. Available:
Hall, B. (1995). Return on investment and multimedia training. Sunnyvale, CA: Brandonhall.com.
Hall, B. (2001a). Learning management systems: How to choose the right system for your organization. Sunnyvale, CA: Brandonhall.com.
Hall, B. (2001b). Live e-learning: How to choose a system for your organization. Sunnyvale, CA: Brandonhall.com.
Heinich, R., Molenda, M., & Russell, J. (1989). Instructional media and the new technologies of instruction (3rd ed.). New York: Macmillan.
Kulik, C., & Kulik, J. (1986). Effectiveness of computer-based education in colleges. AEDS Journal, 19, 81-108.
Kulik, C., & Kulik, J. (1991). Effectiveness of computer-based instruction: An updated analysis. Computers in Human Behavior, 7, 75-94.
Kulik, C., Kulik, J., & Shwalb, B. (1986). The effectiveness of computer-based instruction in adult education: A meta-analysis. Journal of Educational Computing Research, 2, 235-252.
Kulik, J. (1994). Meta-analytic studies of findings on computer-based instruction. In E. L. Baker & H. F. O’Neil, (Eds.), Technology assessment in education and training (pp. 9-33). Hillsdale, NJ: Lawrence Erlbaum Associates.
Lake, D. (2001, March). The 5-year forecast: Where’s the information revolution going? Check out predictions for 2005. The Industry Standard. [online]. Available:
McCrea, F., Gay, R., & Bacon, R. (2000). Riding the big waves: A white paper on the B2B e-learning industry. San Francisco: Thomas Weisel Partners, LLC.
Saettler, P. (1990). The evolution of American educational technology. Englewood, CO: Libraries Unlimited.
Urdan, T., & Weggen, C. (2000). Corporate e-learning: Exploring a new frontier. San Francisco: W. R. Hambrecht & Co.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 119 Rob Miller has more than 20 years training and training development experience within government and commercial sectors. In addition to serving as Advanced Systems Technology’s Senior Instructional Systems Designer, he is currently serving as an adjunct professor and corporate advisor at Cameron University in Lawton, Oklahoma. In that role, he is providing instruction to undergraduate students in the application of distance learning technologies to governmental and commercial training situations. He is also an advisor to the Multimedia Department’s curriculum committee. He has developed more than 40 computer-based training, web-based training, and performance improvement products. Miller holds a PhD in instructional psychology and technology from the University of Oklahoma and a Master of Behavioral Science (Human Relations) degree from Cameron University in Lawton, Oklahoma.
120 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Formal Training Is Only Part of the Solution
Richard Pigeon, PhD
The Employee Continuous Development Program (ECDP) provides the employees of the Royal Canadian Mounted Police (RCMP) with learning resources within a strategic framework that helps make them high-performers. The website brings together various types of learning materials.
Best Learning Experience In workshops to implement the ECDP participants were asked, “What has been your best learning experience?” Eighty to 100% of the examples given by participating RCMP members related to on-the-job, experiential, nonclassroom training. The ECDP is an approach to learning that recognizes that formal training can only be part of the solution and that individuals must accept some of the responsibility for learning.
Self-Directed Learning Is Not New “In itself, self-directed learning is neither new nor untested. In the late 1970s, Canadian educational researcher Allen Though found that 90% of all adults engaged in at least one self-directed learning project every year [...] Some researchers are suggesting that we now put more than 500 hours a year into SDL” (Zemke, 1998). Of course, learning to be successful must be tailored and integrated as soon as possible to our work methods.
The purpose of the ECDP is to promote on-the-job opportunities and, where appropriate, formal training opportunities—such as those offered by the Canadian Police College—to develop the competencies of RCMP employees at all levels of responsibility. The ECDP reflects the commitment of the RCMP to become a continuous learning organization and, consequently, to the development of competent, confident, and committed employees.
The main characteristics of the ECDP are the following:
• Learning is multifaceted; formal training, coaching, mentoring, sharing experiences and insights, dialoguing, networking, consulting with clients all contribute to learning. • Learning responsibility and accountability are shared between the employee and the organization. • The acquired information, knowledge, and experience are integrated into the attitudes and practices of the organization. • ECDP can be used for the development of employees and to address their performance deficiencies.
The ECDP requires that supervisors take on new roles. In cooperation with their employees, they have the responsibility to determine learning needs, design learning opportunities (such as mentoring, coaching, and secondments) and assess whether
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 121 performance improves or whether the performance problem needs reassessment. To help the acquiring and improvement of competencies required to perform their job, regular members have access to a handbook to develop their learning strategy. It can be obtained at the RCMP learning site or from divisional training supervisors.
Learning Resources Online Employees also have access to a learning resource database on the Intranet of the RCMP and on the Internet at
. . . high performing organizations provided each employee with an average of only 30 hours of [formal] training, compared to the average 45 hours of [formal] training for each employee in all other organizations . . . High performing companies consistently fostered an environment of continuous learning in which non-traditional training opportunities such as mentoring and job sharing were offered and encouraged. Their employees in turn reported greater access to training and development than those employees at other companies (Bailey, 1998).
Becoming High Performers The ECDP provides our employees with learning experiences within a strategic framework that will help make them high performers. The website brings together materials developed nationally and internationally; it is linked to systems in other departments and agencies. The national and international police community can take advantage of the RCMP learning site on the Internet, just as RCMP employees are encouraged to access learning available in other agencies and institutions.
Learn, Unlearn, Relearn In order for an organization to remain competitive or simply to survive in today’s knowledge-based society, it must become a learning organization. Thirty years ago, Alvin Toffler wrote, “The illiterate of the year 2000 will not be the individual who cannot read and write, but the one who cannot learn, unlearn, and relearn” (Future Shock, 1970). Self-directed learning and learning online are part of the solution.
References Bailey, G. (1998, July). Training as a recruitment tool.
Zemke, R. (1998, May). In search of self-directed learning in training.
122 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Richard Pigeon is a senior researcher and methodology advisor in learning and development directorate. With his colleagues, he has been responsible for implementing Employee Continuous Development in the Royal Canadian Mounted Police. He has a PhD in educational measurement and research from the University of Ottawa. His directorate won the Award for Leadership in Service Innovation (2000) presented by the Association of Professional Executives of the Public Service of Canada. Pigeon has given presentations on continuous learning and employee learning strategies across Canada as well as in the United States, Spain, and Singapore.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 123 124 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Bang-Bang You’re Dead: A Case for Using Simulation in 911 Training
Sue Pivetta, Professional Pride Training Co.
He looked like one of those police chiefs who came up from the ranks, early 50s with an air of authority. He leaned easily on the booth as we talked, his eyebrows came together each time he mentioned the “Comm Center.”
“We don’t use simulation in our training program, our dispatchers learn by observation.” “End of discussion,” he thought. “Beginning of discussion,” I thought.
I paused for effect, “Hmmm. When your officers go to the firing range, do they stand behind a marksman, observing?” Or point and go “Bang-Bang?” He rolled his eyes, but I saw recognition. I didn’t want to challenge his leadership role; after all, he was the Comm Center supervisor, and I’m sure people received excellent training at his agency. Still, I was once again bewildered that the necessity for adult experiential learning was recognized for the entire public safety network—except for communications. Yet, here was where experience was most necessary with life and death decisions while you wait.
Our Public Safety Team Since the 1950s, law enforcement training has provided simulation training at academies and police departments for cadets. Driving simulation, handcuffing, take downs, shooting simulators, and firing ranges are just a few of more than 50 types of simulation training now considered indispensable to the field training officer. Simulators can be leased or purchased in the $100,000 range. We rely on simulators to intensify the message by providing a bit of reality.
Since the 1960s, fire departments have used many types of simulation training from burning down donated houses to fire academies with elaborate burn houses and dummy ships for cargo fires. Old firefighters hold onto the tails of rookies so they can stumble around blindly in the smoke, wearing their new gear, and similarly paramedics and EMTs mercilessly gouge rubber babies (or each other) with long needles in recognition of the need for practice in training.
So what about the other member of the public safety team, the emergency telecommunicator? How do call takers and dispatchers practice until they get it right? With an unbelievable variety of call types and an infinite number of situations, you would think they would need to practice! With increased types of technology, combined with multi-tasking and critical thinking, you would think this work would require simulation. When immediate decisions are made under pressure to be 100% correct, you would think call takers would rehearse! You would think so.
“911, what are you reporting?’ “My husband has a gun to his head.”
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 125 “Uhhhhh, what do I say? Boy this is hard. Can you come in here? Have you had a call like this before? OK, let me try.” “Maam, where is he now?”
This is the type of activity for the Telecommunicators Firing Range. Simulation is a safe place to learn step-by-step. Mistakes are road signs, and learning is out of harm’s way. Simulation is about recreating the work. A great majority of Emergency Communications training programs do not use recreation training. Are we missing the target by not having console simulators in every agency or college training program? Yes! Without simulation, we’re overlooking many essential components of adult education, which is learning by practice.
Necessity, the Mother of Invention 911 StarZ stands for Simulation Training And Response Zone. This size-of-a-breadbox electronic simulator was created to provide experiential learning for Emergency Call Takers and Dispatchers. As a veteran Comm Center supervisor and trainer, I invented this tool for a college program struggling with lab requirements.
I was frustrated trying to bubble gum old Motorola consoles together trying to interconnect phone, recorders, CAD systems. Nothing ever integrated. We had students wearing two headsets, they never could get the foot pedal to work and recording their work for evaluation was a huge process on one reel-to-reel recorder. After five years of searching for a company that would build an ideal simulator to recreate the multi-tasking environment, I finally shrunk the Comm Center and got everything I ever wanted and more.
College training for the profession of emergency communications is also a new thought, and colleges and criminal justice academies everywhere are stepping up to take leadership for their vital link—the Telecommunicators. Any training of good standing is looking for a way to practice. Sue’s company Professional Pride provides many realistic simulation tools, games, videos, and books exclusively for the Comm Center.
What do simulation users say?
I have been using our new StarZ simulator for about three weeks now, and I felt that I just had to let you know my feelings. In a nutshell . . . I don’t know how I ever got along without it. I had two telecommunicator trainees in their fourth week of training when the unit arrived. We had been doing some simulations, but the StarZ made it so much more realistic. I would estimate that I can have trained people ready to do supervised call taking in about 25% less time than before (Greg Bowles Weston 911, Weston CT).
Emergency Communications Tools Besides their voice and ability to communicate, the Telecommunicator has a few necessary tools. Simply put, they need phones, radios, a recording device, and maps. Walk into any Comm Center today, and the simply-put tools definition wouldn’t seem to apply. Most Comm Centers look like the Starship 911 with touch screen technology, GPS, GIS, ACD, and other such communications tools.
126 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Simulators aren’t designed to teach technology in the Comm Center. Learning to use the equipment isn’t the hard part of this work; although, it’s necessary and demanding. Once learned and used, the trainee can build proficiency that doesn’t need to change with every call. The most challenging part of the work is dealing with humans in crisis and responders who depend upon radio support. The complexity of call types, situations, judgment, and higher level thinking skills is an internal process—one that is a very personal matter.
In support of 911 StarZ, another user comments . . .
Most Telecommunicators who have passed initial training work autonomously. Judgment skills, understanding relationships, critical thinking, and using uncommon sense is something that is gained by experiencing the complexity first-hand and having a trained specialist there to model. Simulation training can cover any call type, any amount of times until it’s right (Pennee Body, Clover Park Technical College Emergency Call Receiver Program).
Simulation training for Emergency Communications isn’t a hard sell. Most Public Safety responders “get it.” The very real problem communications people face is distracted leadership or inadequate funding. Like all progress, the wheels turn slowly while the needs spin fast, and like most significant changes in our government practices, decision by committee is an educational process that takes time—or a tragedy. Telecommunicators are hopeful that leadership will soon recognize the needs of the Comm Center as the needs of the responders—once removed.
Sue Pivetta is president of Professional Pride Training Company. She has a BA in Adult Learning and Communications. She is a certified mediator for courts and an avid volunteer.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 127 128 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Communication Assistance for Law Enforcement Act (CALEA)
Michael P. Clifford, FBI, Special Agent
Introduction Electronic surveillance is one of the most valuable tools in law enforcement’s crime fighting arsenal. In many instances, serious criminal activity has been either thwarted, or if crimes have been committed, the criminals have been apprehended as a result of lawfully authorized electronic surveillance.
The use of lawfully authorized electronic surveillance continues to increase in importance to law enforcement as telecommunications systems become cornerstones of everyday life: dependence on telecommunications for business and personal use has increased dramatically; computers and data services have become increasingly important to consumers; and the nation has become enthralled with mobile communications.
Three primary techniques of lawfully authorized electronic surveillance are available to law enforcement: (1) pen registers, (2) trap and trace devices, and (3) content interceptions. Pen registers and trap and trace devices, which account for the vast majority of lawfully authorized surveillance attempts, record/decode various types of dialing and signaling information utilized in processing and routing the communication such as the signals that identify the numbers dialed (i.e., outgoing) or the originating (i.e., incoming) number of a telephone communication. A third and more comprehensive form of lawfully authorized electronic surveillance includes not only the acquisition of call-identifying or dialed number information, but also the interception of communications content.
Although lawfully authorized electronic surveillance is crucial to effective law enforcement, it is used sparingly. This is particularly true with respect to the interception of communications content. The federal government, District of Columbia, Virgin Islands, and 45 states allow the use of this technique but only in the investigation of felony offenses such as kidnaping, extortion, murder, illegal drug trafficking, organized crime, terrorism, and national security matters, and only when other investigative techniques either cannot provide the needed information or would be too dangerous. No call content order may be approved by a judge for a “period longer than is necessary to achieve the objective of the authorization, nor in any event longer than 30 days.”1 Applicable state and federal laws and procedures also require continuous judicial oversight throughout the tenure of the intercept activity through the filing of regular reports with the authorizing judge “showing what progress has been made toward achievement of the authorized objective and the need for continued interception.”2
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 129 Legal Origins of Electronic Surveillance Passage of the Communications Assistance for Law Enforcement Act (CALEA) was not without precedent; it was a logical and necessary development of the nation’s electronic surveillance laws.
The modern legal framework for electronic surveillance arises out of the Supreme Court’s landmark decision in Katz v. United States, 389 U.S. 347 (1967). Prior to Katz, the Supreme Court had regarded wiretapping as outside the scope of the Fourth Amendment’s restrictions on unreasonable searches and seizures.3 In Katz, however, the Supreme Court reversed its prior position and held for the first time that Fourth Amendment protections do apply to government interception of telephone conversations.
A year after the Katz decision and after a failed attempt to address wiretapping through amendments to the Communications Act of 1934, Congress enacted the Omnibus Crime Control and Safe Streets Act of 1968.4 Title III of this Act created the foundation for communications privacy and electronic surveillance law. The Omnibus Act not only established a judicial process by which law enforcement officials could obtain lawful authorization to conduct electronic surveillance, but also prohibited the use of electronic surveillance by private individuals. A subsequent amendment to Title III also required telecommunications carriers to “furnish [law enforcement] all information, facilities, and technical assistance necessary to accomplish [an] interception.”
In response to continued advances in telecommunications technology, Congress expanded the protections of Title III by enacting the Electronic Communications Privacy Act (ECPA) of 1986. Among the ECPA amendments to Title III were requirements that interceptions be conducted unobtrusively and with a minimum of interference with the services of the person whose communications are being intercepted and that the interception be conducted in such a way as to minimize access to communications not otherwise authorized to be intercepted. The ECPA also expanded electronic surveillance authority to include telecommunications technologies and services such as electronic mail, cellular telephones, and paging devices.
Following the enactment of the ECPA, advancements in telecommunications technology continued to challenge and, in some cases, thwart law enforcement’s electronic surveillance capability. What was once a simple matter of attaching wires to terminal posts now either required expert assistance from telecommunications service providers or was impossible altogether.
Although Title III required telecommunications carriers to provide “any assistance necessary to accomplish an electronic interception,” the question of whether telecommunications carriers had an obligation to design their networks in a way that did not impede a lawfully authorized interception had not been decided.
In October 1994, at the request of the nation’s law enforcement community, Congress responded to this dilemma by enacting CALEA, which clarified the scope of a carrier’s duty in effecting lawfully authorized electronic surveillance.
130 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Communications Assistance for Law Enforcement Act Although telecommunications carriers have been required to cooperate with law enforcement personnel in conducting lawfully authorized electronic surveillance since 1970, CALEA for the first time requires telecommunications carriers to modify the design of their equipment, facilities, and services to ensure that lawfully authorized electronic surveillance can actually be performed.
Federal Bureau of Investigation On February 24, 1995, the Attorney General delegated management and administrative responsibilities for CALEA to the Federal Bureau of Investigation (FBI). The FBI, in turn, created the CALEA Implementation Section (CIS), which works with the telecommunications industry and the law enforcement community to facilitate effective and industry-wide implementation of CALEA.
Federal Communications Commission Consistent with the FCC’s duty to regulate the use of wire and radio communications, Congress assigned specific CALEA responsibilities to the FCC. These include, but are not limited to . . .
• Determining in consultation with the Attorney General which entities should be considered telecommunications carriers for purposes of CALEA. • Establishing technical requirements or standards for compliance with the assistance capability requirements of CALEA if industry associations or standard-setting organizations fail to issue technical requirements or if a government agency or any other person believes that industry-adopted standards are deficient.
Telecommunications Carriers Telecommunications carriers must ensure that equipment, facilities, or services that provide customers the ability to originate, terminate, or direct communications meet the following assistance capability requirements:
• Expeditious isolation and interception of communications content • Expeditious isolation and access to call-identifying information • Delivery of communications content and call-identifying information to law enforcement • Doing so unobtrusively while protecting the privacy and security of communications not authorized to be intercepted • Ensuring the capability to perform multiple simultaneous interceptions
Equipment Manufacturers and Support Service Providers Congress also recognized that without the assistance of manufacturers of telecommunications equipment and support service providers, carriers would be unable to comply with CALEA. To that end, it imposed an affirmative duty on manufacturers of telecommunications equipment and support service providers to make available all features or modifications necessary to meet the assistance capability requirements of CALEA.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 131 CALEA Development of an Industry Standard In early 1995, an ad hoc group, sponsored by the Telecommunications Industry Association (TIA), began working to develop an industry standard that would satisfy the assistance capability requirements of CALEA for wire line local exchange, cellular, and broadband PCS services (i.e., the primary participants in the Public Switched Telephone Network). This effort included participation by industry and law enforcement.
On December 5, 1997, TIA announced the adoption and joint publication of an official interim industry technical standard, J-STD-025.
J-STD-025 defines the services and features necessary to support lawfully authorized electronic surveillance and the interfaces used to deliver intercepted communications and call-identifying information to law enforcement. Although the interim technical standard was received favorably by industry, it was met with some disfavor by both law enforcement and privacy organizations. Law enforcement argued that the interim standard was underinclusive and failed to satisfy CALEA requirements because it did not include nine specific capabilities. The following table contains a brief description of these nine “punch list” capabilities.
Name Description 1. Content of subject-initiated This capability enables law enforcement conference calls to access the content of conference calls supported by the subject’s service (including the call content of parties on hold).
2. Party hold, party join, party drop Messages would be sent to law enforcement that identify the active parties of a call (specifically, on a multi-leg call, whether a party is on hold, has joined, or has been dropped from the call).
3. Access to subject-initiated dialing Access to all dialing and signaling and signaling information available from the subject would inform law enforcement of a subject’s use of features. (Examples include the use of flash-hook and other feature keys).
4. In-band and out-of-band signaling A message would be sent to law (Notification message) enforcement when a subject’s service sends a tone or other network message to the subject or associate. This can include notification that a line is ringing or busy or that a call is waiting.
5. Timing to associate call data to This information is necessary to correlate content call identifying information with the call content of a communications interception.
132 Illinois Law Enforcement Executive Forum • 2002 • 2(3) 6. Post-cut-through dialed digits Provision to law enforcement of call- (a.k.a., dialed digit extraction) routing digits dialed by a subject after the initial call setup is completed as would be necessary when the subject makes a credit card call.
7. Surveillance status message This message would provide the verification that an interception is still functioning on the appropriate subject.
8. Continuity check (i.e., C-Tone) This electronic signal would alert law enforcement if the facility used for delivery of call content interception has failed or lost continuity.
9. Feature status message This message would provide affirmative notification of any change in a subject’s subscribed-to-features.
Law Enforcement Objections The “punch list” items listed above are extremely important to law enforcement. The possibilities of how the lack of the “punch list” capabilities could hinder police investigations are limited only by the initiative and creativity of criminals and terrorists. To illustrate, consider the following three hypothetical scenarios:
1. Post-Cut-Through Dialed Digits – Calvin and Edward kidnap Veronica and demand a million dollar ransom. They tie Veronica up and leave her in an apartment guarded by Edward. Law enforcement is told by an informant that Calvin and an unidentified male are the kidnappers and that Veronica is being held at the unidentified male’s residence. Law enforcement obtains a pen register on Calvin’s telephone and waits for Calvin to call his accomplice, which will allow them to obtain the accomplice’s telephone number. In turn, they can then trace the number to the accomplice’s location. Calvin, however, successfully thwarts their efforts by calling Edward using his AT&T calling card. Instead of obtaining Edward’s phone number, the only number that law enforcement receives on its lawfully authorized pen register is 1-800-CALL ATT.
2. Party Hold, Join, and Drop Messages – Dennis is suspected of running a large scale drug operation and ordering the murders of two rivals. Law enforcement develops probable cause of Dennis’ activities. In an effort to prove their charges and identify other members of Dennis’ organization, they obtain a Title III Electronic Intercept on Dennis’ telephone. Dennis frequently talks to a number of his associates simultaneously by switching between each person. On one such occasion, Dennis is talking to Adam, Bob, Charles, David, Edward, and Frank. Each time any associate is placed on hold, that person cannot hear the conversation between Dennis and the associate with whom he is conversing. While switching between callers, Dennis orders one of his associates to kill a local narcotics detective. Dennis then hangs up. Law enforcement cannot tell which of Dennis’ friends or associates received this order.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 133 3. Content of Subject-Initiated Conference Calls – Oscar the organized crime boss is suspected of drug dealing, murder, interstate theft, loan sharking, and bribery. Law enforcement has conducted an extensive investigation and managed to obtain a Title III Electronic Intercept on Oscar’s telephone. Since a few members of his criminal organization have become cooperating witnesses for law enforcement in the past, Oscar takes measures to prevent members of his extensive crime family from knowing the names, telephone numbers, and whereabouts of other members. One day, at a prearranged time, Oscar, using his telephone’s conference call feature, calls an unidentified male number one at a telephone booth and unidentified male number two at another telephone booth. He tells these two individuals to quickly arrange a meeting time and place for the “heroin exchange.” He then places them on hold and calls his girlfriend. While the two unidentified males are on hold, they can make their arrangements with each other on Oscar’s line, but law enforcement is unable to listen to what is being said.
Privacy Groups’ Objections Privacy organizations, such as the Center for Democracy and Technology (CDT), Electronic Frontier Foundation (EFF), Electronic Privacy Information Center (EPIC), and American Civil Liberties Union (ACLU) have repeatedly argued that the interim technical standard was overinclusive because it included access to information that identified the location of an intercept subject’s mobile terminal at the beginning and end of a call. CDT also argued that the “punch list” items sought by law enforcement were not required under CALEA and would further render the industry standard deficient.
By April 1998, the FCC had received four official petitions requesting that it establish, by rule, technical requirements and standards for CALEA compliance. The FCC responded, launching what would become a protracted debate, by issuing a public notice and soliciting comments on the petitions.
On August 31, 1999, the FCC issued a Third Report and Order, adopting technical requirements for wireline local exchange, cellular, and broadband PCS services. The FCC ruled that telecommunications carriers will be required to implement all of the capabilities included in JSTD-025 plus six of the nine “punch list” missing capabilities requested by law enforcement (i.e., the first six of the nine “punch list” items previously mentioned). The subcommittee was allowed seven months, or until March 30, 2000, to complete necessary changes to J-STD-025 in accordance with the FCC ruling. The FCC further ruled that while CALEA did not require carriers to provide the remaining three missing “punch list” capabilities, carriers may offer the capabilities to law enforcement at their discretion.
On November 16, 1999, members of the telecommunications industry appealed to the United States Court of Appeals challenging certain elements of the FCC’s Third Report and Order.5 On August 15, 2000, the United States Court of Appeals rendered a decision regarding the FCC’s Third Report and Order. The Court vacated a portion of the FCC’s order and remanded the following four “punch list” capabilities to be reassessed by the FCC on the grounds that the FCC did not adequately substantiate its conclusions: (1) party-hold, party-join, and party-drop messages, (2) access to subject-initiated dialing and signaling, (3) in-band and out-of-band signaling, and (4) post-cut-through dialed digits. The Court upheld the FCC’s conclusions regarding location information.
134 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Nationwide Right-to-Use (RTU) Licenses The FBI has implemented a reimbursement strategy that allows telecommunications carriers to receive CALEA software at no charge. Under nationwide RTUs, the FBI pays for the development of CALEA software, which allows telecommunications carriers to receive CALEA software at a nominal charge for their switching equipment.
When CALEA was enacted into law in 1994, Congress authorized $500 million to be appropriated to reimburse the telecommunications industry for certain eligible costs associated with modifications to their networks. This dollar amount was authorized to remain available until expended. CALEA was subsequently amended by The Omnibus Consolidated Appropriations Act of 1997, which created the Telecommunications Carrier Compliance Fund (TCCF). The purpose of the TCCF is to facilitate the disbursement of funds available for CALEA implementation.
Outstanding Issues Regarding CALEA Implementation CALEA was necessitated by the telecommunications industry’s transition from a wireline analog environment to a wireless and digital one. In the analog world, law enforcement could affect Title III, pen register, and trap-and-trace intercepts at the local loop between the subscriber and the carrier. In the wireless and digital environment, call routing and feature management have become carrier equipment based, necessitating a re-engineering of telecommunications switches and networks to provide intercept capabilities. This re-engineering was projected by the industry to cost billions of dollars.
Through nationwide RTU licenses, CIS completed an important phase in CALEA implementation and obligated approximately $400 million dollars from the TCCF. These funds reimbursed the industry for various software that would provide intercept solutions for the primary wireline and wireless switches in use today which account for 93% of the switches currently deployed in the Public Switched Telephone Network (PSTN). This precludes hundreds of millions of dollars in costs, which would have been incurred had telecommunications carriers individually reimbursed manufacturers for the re-engineering of each of their various switches.
Law enforcement is now at an important juncture of CALEA’s implementation as CIS proceeds to reimburse certain eligible carriers for deploying switch software solutions. The deployment of the software solutions to carrier switches will require a certain level of engineering work and hardware to bring the software online as well as peripherals for certain switching platforms. CIS is also seeking to obtain the necessary capacity on carriers’ switches, which will allow for the level of intercept activity reasonably anticipated by law enforcement. As CIS negotiates with carriers toward reasonable costs in this essential phase of CALEA implementation, CIS will need to obtain support for the required funding. Based upon current negotiations, CIS anticipates those reasonable costs to exceed the remaining balance in the TCCF by approximately $200 million dollars. CIS also needs to combat various industry-initiated efforts through the courts, the FCC, and Congress to delay or limit the implementation of CALEA. These delays are impeding and will continue to impede the ability of law enforcement to effect lawfully authorized Title 111, pen register, and trap-and-trace orders.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 135 To ensure that law enforcement leaders remain cognizant of the progress CIS is making and the issues with which CIS is grappling, CIS formed a Law Enforcement Executive Forum (LEEF), which had its first meeting in Chantilly, Virginia on October 24, 2001. Membership in this forum (which was attended by local, state, and federal law enforcement officials from around the country) was extended to law enforcement executives recommended by their respective national organizations including the International Association of Chiefs of Police (IACP), the National Sheriffs’ Association (NSA), the National Association of Attorneys General (NAAG), and the National District Attorneys Association (NDAA). During the meeting of the LEEF, concern was expressed that unless CIS is provided an additional $200 million dollars for the TCCF for fiscal year 2003, CIS will be unable to reimburse carriers for the costs associated with deploying CALEA compliant software throughout their networks. Without reimbursement, carriers will not act, and law enforcement’s ability to conduct vital electronic surveillance of criminal and terrorist organizations will be degraded and in some cases, negated.
Further Information The CIS of the FBI represents the interests of the entire law enforcement community in matters pertaining to CALEA. CIS has established a website,
Notes 1 Title 18, U.S. Code, Section 2518 (5)
2 Title 18, U.S. Code, Section 2518 (6)
3 Olmstead v. United States, 277 U.S. 438 (1928).
4 Section 605 of the Communications Act of 1934 was amended to provide that “no person not being authorized by the sender shall intercept any communication and divulge or publish [its] existence, contents . . . or meaning.” By 1968, the provisions of the Act dealing with wiretapping had become so muddled by inconsistent interpretations of state and federal courts that Congress intervened. See Pub. L. No. 90-351, 82 Stat. 212.
5 U.S. Telecom Association v. FCC, 227 F. 3d 450 (D.C. Cir. 2000).
Michael P. Clifford, Section Chief, Supervisory Special Agent, is a 22-year veteran of the FBI. He heads the CIS which leads CALEA implementation efforts by addressing the responsibilities assigned to the Attorney General, in consultation with local, state, and federal law enforcement, the telecommunications industry, and privacy advocates. The CIS represents the interests of the local, state, and federal law enforcement community before Congress, the FCC, and other government agencies involved in the implementation of CALEA.
136 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Surveillance Videos
Jack Jacobia, Lab Director, Institute for Forensic Imaging
Many of us don’t realize it, but we’re having our picture taken almost everywhere we go—the store in the mall, the schoolhouse, gas station, the bank, and many other places. In Europe, you can’t even walk down the street without being photographed. Right here in our country, they have video cameras placed at major intersections to catch drivers committing infractions.
Why? Basically there are two reasons: (1) it is used as a deterrent; if you know you are being photographed, maybe you won’t commit a crime and (2) video is accepted in the courtroom as evidence and has been used many times to obtain a conviction.
An example of using video in the courtroom is the Rodney King beating in Los Angeles in March 1991. The events were captured from an apartment house on videotape and were instrumental in the indictment and conviction of a number of police officers. The tape was also used in a civil case as evidence. There was one difference though; unlike surveillance video, there were many witnesses, including the individual that taped the incident. Surveillance video systems are usually stand-alone; in other words, no one is physically watching the incident take place. Viewing the incident on tape is after-the-fact, and usually, the viewer is trying to see what took place and obtain the identity of the perpetrators.
This is where the problems begin. The quality of video images leave a lot to be desired, and the quality is only one of the problem areas. Security companies are plentiful and sometimes prey on large companies, getting them to install large video surveillance systems telling them that they will help deter crime in their business and help apprehend the individuals that commit the crime. Many insurance companies also give discounts on the premium for those customers that have a surveillance system installed. In reality, we, at the Institute for Forensic Imaging (IFI), have found that there is about a 10% chance of getting any useful information out of most surveillance video. There are many reasons for this, which will be discussed.
Not only is the quality (resolution) poor in most surveillance systems, but there are many other problems as well.
Lenses used on the cameras are the number one problem. Most companies install wide-angle lenses so they can record a wider view of the area; consequently, they have to install fewer cameras. This is a great concept as far as reducing the cost of the system, but in most instances, the cameras are useless for making any identification. Wide areas of view are necessary for orientation purposes because you need to see what is happening overall. In addition, you need to cover the hotspots with long lenses. An example may be the cash register/counter area or the entryway. With this option, everyone that leaves the area gets a close-up picture taken of them. This requires a few more cameras to be installed, but it will tremendously increase the chances of making an identification.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 137 Camera placement and lighting go hand-in-hand. You can’t just consider where the hotspots are and then slap a camera up on the wall and expect to get good pictures. Before a camera is placed, take into consideration, where the light is located. Too many times, it is behind the subject and what you end up with is a silhouette. Subjects have a large shadow on their faces making it impossible to identify them. All video cameras have auto-exposure; they read the light reflected from the subject and set the exposure. If there is a light in the background such as a window, the cameras see it and try to adjust the exposure accordingly. Some camera exposure controls can be set manually, but this is time-consuming and doesn’t allow the camera to adjust for any light changes automatically. Lighting is not as important for the wide-angle view cameras as it is for the cameras you have on the hotspots. Look at these closely, and install additional lights if necessary. The better the exposure, the more information can be obtained from the image.
Recording systems and tape usage also is a large problem. It is not unusual for IFI to receive tapes from a video system that has so much “electronic noise” on them that it is impossible to see the image. Rerecording on the tapes multiple times usually causes this problem. Eventually, the recording surface becomes damaged, and when played, the noise appears as lines across the image. Even if there is useable information on the video, it is obscured by the noise. Limit the use of the tapes. Twelve iterations are about all a videotape can handle. The recording systems vary widely from time-lapse quad-video to full frame, and each can affect the quality of the information that can be obtained from the tape. Time-lapse is the process of using many cameras on one recording system (tape) many times using the quad-video format. Quad-video is the recording of four cameras on one frame of video. A number of problems can exist with using time-lapse and quad-video. Imagine four cameras on one frame of video when using the quad system. You started out with low-resolution video, and now, it has been reduced by 75% because you have four cameras recording on one frame. This is not a very good way of recording your images when you’re looking for high quality. It does save money, however, because you don’t need as many recording devices. Time-lapse is another recording method that can save money, but you are sacrificing quality and many times missing part of the action. Usually, you are using one recording device with many cameras feeding into it from different locations at the scene. It could be recording quad-video or full frame; it just depends on the system. Time-lapse means that the system is switching between cameras each time it records the images. Depending on how many cameras there are on the system and whether it is full frame or quad-video will regulate how much time elapses from recording the first camera in the system to the last. Even though this is a rapid process, valuable information can be missed if it happens when that particular camera is not recording. With all this said about recording methods, the best information is going to be obtained from a tape that has been recorded full-frame regardless of the speed at which it was recorded.
New recording systems are appearing rapidly. The video surveillance cameras are basically the same, but instead of recording the images on videotape, they are being digitized and recorded on a computer hard drive. Are the images any better? Not really, because the cameras are the same, so the resolution being recorded has not improved. About the only improvement is the fact that they no longer use videotape, so no loss in image quality is seen from deterioration of the tape itself.
138 Illinois Law Enforcement Executive Forum • 2002 • 2(3) One problem area that has arisen out of this type of system is compressing the images or storing the images at lower resolution to reduce the file sizes. Video files are very large, especially if they are color and will fill a large hard drive rapidly. Compressing an image or storing it at lower resolutions affects the quality of the image. Both of these must be taken into consideration when using this system. An additional problem IFI encountered with some of these systems is that they are proprietary. You must have their software to even view the videos. This creates problems for the users. If the company goes out of business next year, how do you continue using your system? Always look for a system that is off-the-shelf and requires no proprietary software or hardware.
In 1999, the Institute for Forensic Imaging received a grant to test video systems for school surveillance from the Institute for Criminal Justice (ICJI). Assisting IFI in these tests was the Naval Surface Warfare Center, Crane Division (NAVSEA) and the School of Public and Environmental Affairs, Indiana University Purdue University of Indianapolis.
A final report was submitted to ICJI, and it was very extensive covering many areas when using video surveillance. I’m not going to attempt to discuss all the tests accomplished, but I do want to use some of the findings to reinforce what I have discussed previously.
NAVSEA conducted the camera tests for the project, testing dynamic range, color fidelity, and resolution. The following paragraph is quoted from their final report to ICJI:
From this analysis, it is clear that one should not expect to identify people on the basis of video that captures the full figure of an adult person or any space greater than that. In fact, a waist to head shot is even borderline. A far better approach is to aim for head and shoulders shots if one wants to make identifications using normal surveillance video cameras. Wide-angle video can show the general activity in a broad area, but it is not likely to be useful for identification of individuals and/or hand-held items in that area.
This analysis supports the fact that long lenses are needed to capture the hotspots; you cannot obtain identification using the wide-angle video.
Although I didn’t discuss black and white versus color video cameras, NAVSEA’s tests also indicate that color video, although it is capturing more information, is of little or no use.
From the NAVSEA report it is clear that color fidelity is not reliable. One will get color images, but one should not plan on using color information in any detailed identification. That is, one can say there is interest in the individual with the blue slacks and the red shirt, but one should not plan on saying that a particular shirt is a match for one in the image (Surveillance Tools for Safer Schools, Final Report, January 2002).
The following chart was prepared for the NAVSEA report showing the results from the cameras tested. These are typical video cameras that are used with many of the current video surveillance systems.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 139 Smallest Resolvable Image Frame Feature (mm) Resolution Resolution Head Waist Full LP/mm* Lp/Fram Shot Shot Figure Camera Width Height Width Height 10” high 40” high 80” high
Philips LTC 0450/21 A 42.5 42.5 242 185 1.4 5.5 11.0 Philips LTC 0350/21 A 33.7 30.1 192 131 1.9 7.8 15.5 Philips LTC 0330/21 26.8 26.8 153 116 2.2 8.8 17.5 Philips LTC 0430/61 A 42.5 42.5 242 185 1.4 5.5 11.0 Philips LTC 0350/21 A 37.9 37.9 216 165 1.5 6.2 12.3 Philips LTC 0500/20 33.7 42.5 260 250 1.0 4.1 8.1 Panasonic WV-CP460 47.7 42.5 272 185 1.4 5.5 11.0
* from NAVSEA report, Table 5.
In the above chart, the data from the NAVSEA table 5 are interpolated out to indicate the equivalent line pairs per frame width and height. Then, the three columns on the right show the size of the smallest feature that one would expect to be resolved in the images. For example, the typical fixed ballpoint pen is about 7 mm in diameter. So a ballpoint pen would be almost indistinguishable in a waist to head shot with the Philips cameras that have smallest features larger than 7 mm. The typical button on a man’s shirt is about 10 mm in diameter. As a result, only the Philips LTC 0500/20 would resolve these in a full figure shot. Some other common items are the iris of an adult’s eye (about 8 mm in diameter), the wire on the typical computer mouse (4 mm), and the nose bridge on the typical pair of wire-frame eyeglasses (about 1.5 mm) (Surveillance Tools for Safer Schools, Final Report, January 2002).
The chart will give you an indication of what size area can be reliably reproduced with any given resolution.
IFI also evaluated the systems from the installation standpoint and their actual operation involving various scenarios. The following paragraphs from the final report will reinforce the need for good photographic techniques, such as composition, lighting, and equipment.
The installation mistakes commonly found in surveillance systems are based on poor photography. A good photographer will pay a lot of attention to composition, camera angle and lighting, whereas many camera installers are usually technicians and not photographers, and they seem to go out of their way to violate the photographic basics.
Composition. If one is interested in recognizing who is in an image, the frame should be largely comprised of the individual’s head and upper body. This would require tight framing of shots, but often when installing fixed cameras, one does not know where people will be most of the time so they are set for wide angle viewing. There are some situations, however, in which one does know where people will be. For example, it is known that people will be in doorways when they enter and leave a room. Accordingly, recognition cameras can be located in these areas and set up with fairly tight framing. The typical installation
140 Illinois Law Enforcement Executive Forum • 2002 • 2(3) today has wide-angle lenses on all of the cameras, and each is set to record as much as possible of a room or outdoor setting (e.g., a parking lot). These cameras can indicate what sort of action might be taking place in the wide areas but will be of little to no use in determining who is involved in the activities.
Camera Angle. We normally see and recognize people by looking vertically straight on at their faces, that is at about face-to-face level. Views taken at significantly different levels can impede ability to recognize people. From too low an angle, the shape of the nose is lost, and from too high an angle, the eyes are not rendered well. In many surveillance systems, cameras are mounted at high levels. This is done for two reasons. First of all, a camera mounted high up is able to cover a wider field of view. Secondly, there is concern that a camera mounted within reach of people will be subject to mischief. Nonetheless, more and more banks are now moving to install cameras at face-to-face angles at doorways and Automatic Teller Machines. These are mounted inside recesses and covered over with highly durable transparent material. They give much better recognition results than wide area cameras.
Lighting. There are two main lighting factors that should be considered. How much light there is and how evenly it is distributed. Clearly the system should be designed and installed so that the amount of light in the area of interest is at a general level sufficient to the needs of the cameras. This is not hard to do most of the time, but it is sometimes overlooked when surveillance of areas at night or of closed rooms is needed. Uniformity of lighting is often not considered when cameras are installed. Many rooms are lit by ceiling-mounted fixtures. This results in the bulk of the light coming from above the heads of people in the room. There is usually some attempt to diffuse some of the light by grates or diffusers in the fixtures, but these are more successful for human vision on the scene than they are for video cameras. When too much of the light in a room comes from overhead, peoples’ eyes tend to become just dark recesses, and shadow-created “beards” and “mustaches” appear on peoples’ faces. Another problem is a window on one side of a room and the cameras pointed towards the window side. The cameras will adjust to the high brightness from the windows and underexpose most of the people in the room. Attention should be given to lighting fixtures and their placement, wall treatments (dark walls, or shiny walls will not help diffuse lighting), and camera placements.”
The complete report that was conducted by IFI for this grant can be obtained from the Institute for Forensic Imaging.
Now, what to do with the video after it has recorded an incident. If you cannot make the identification from the video itself, the common belief is that it can be greatly enhanced using computer software/hardware to bring out detail that cannot otherwise be seen in the video. This probably stems from watching too many TV shows such as CSI (Crime Scene Investigation).
Although it is true that you can enhance the video images somewhat, it is limited. As mentioned earlier, the resolution of video is very low, which limits the capabilities of any software program to obtain fine detail from the image, especially if it is an overall view of the area. Usually the objects that you want to identify are such a small part of the image, and it contains so few pixels, there is nothing to enhance. This reinforces the use of long lenses to obtain large image sizes.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 141 There are many methods of capturing video frames for enhancement. They range from inexpensive video capture hardware/software programs to complete integrated systems that are designed just for capturing video and enhancing it, but, regardless of the system you are using, you are limited by the resolution of the video you captured at the scene.
To sum it all up, video surveillance can be a very useful tool, especially when it is properly installed and all parameters are taken into consideration such as lighting, composition, and the recording media. Each of these go hand-in-hand as the system is designed and installed.
Establish the best location for the camera, keeping in mind the angle of view and the lighting for that particular installation. Supplement the cameras covering the overall area with cameras containing long lenses to cover the hotspots and ensure these areas are sufficiently lighted. If the recording media is VHS tape, limit its use. It does no good to capture a good image if it is going to be stored on a damaged tape.
If all criteria is met, the usefulness of the images from videotape will increase tremendously, when trying to make any kind of identification. Always remember “the larger the image on the video, the better the chance you have of obtaining any useful information.”
Bibliography Surveillance tools for safer schools. Final report. (2002, January). [online]. Available:
Jack Jacobia manages the Institute for Forensic Imaging (IFI) laboratory and conducts applied research. He developed and teaches several courses, including forensic digital imaging and crime scene photography. He has also developed and taught courses for Indiana University Purdue University Indianapolis (IUPUI) Continuing Studies Department.
Mr. Jacobia has installed digital imaging darkroom equipment in crime laboratories throughout the state of Indiana and serves as a computer consultant trouble-shooter for these. He has served as a consultant for other law enforcement agencies, as well.
Prior to joining IFI, Jacobia was the Assistant Chief of the Photojournalism Division of the U.S. Defense Information School, an accredited institution, where he managed six different photography courses. He was responsible for the training of more than 1,000 allied and U.S. officers and enlisted and civilian students. He designed the first digital imaging course for the Department of Defense. This course is currently taught at the Defense Information School at Ft. Meade, Maryland to Department of Defense photojournalists and graphic illustrators.
Jacobia served with the Navy for 20 years and was a photojournalist and aerial photographer with the photographic squadrons aboard ships in the Atlantic and Pacific.
142 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Making Technology Work for the State Courts
Hugh Collins Robert Wessels, Court Manager, Harris County, Texas Tom Henderson
The National Center for State Courts (NCSC) estimates that, collectively, courts spend well in excess of $500 million annually on information technology. These dollars are committed for planning new automated applications, specifying their requirements, purchasing hardware, developing or procuring software, installing new systems, and training and supporting users. The magnitude of this expenditure and the complexity of the task are an opportunity for courts to rethink their operations to enhance the quality of justice and to make courts more efficient.
The Conference of State Court Administrators (COSCA) and the National Association for Court Management (NACM) in partnership with the National Center for State Courts (NCSC) have initiated a joint national program to take advantage of the opportunities technology has to offer to improve court performance. The COSCA/NACM Standards Program is led by the Joint Technology Committee and staffed by NCSC. It is organized around three concurrent developments:
1. A concept of operations that will define the issues technology is to address 2. Standards for court based software 3. A tool for modeling court operations and procedures
The final component of the program consists of the specific applications courts require to manage their cases and ensure the information is available when and where it is needed.
COSCA/NACM Standards Program
Concept of Operations • Judicial Decisionmaking • Caseflow Management • Information Sharing • Adjudication Process
Standards • Functional Standards • Data/Document Standards • Performance Standards
Modeling • As Is • To Be • Gap Analysis
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 143 Applications • Caseflow Management • E-Filing • Records Management • Court Performance
The program is well underway. The concept of operations has been established and provides the overall framework for the effort. The standards initiative has already developed several products, and more are in process. A modeling program is currently under development, and the first caseflow management programs have appeared based on the initial set of functional standards. In short, the COSCA/NACM Standards Program has already proven itself as an effective means for harnessing technology to the needs of the courts.
Concept of Operations The concept of operations is the framework that has guided the COSCA/NACM program. It lays out the basic assumptions on which the rest of the program is built. The concept of operations of the COSCA/NACM Program rests on four assumptions:
1. The judicial decision-making process is at the heart of court operations. The primary reason for information system development is to ensure the effectiveness and integrity of the adjudication process.
2. The management focus of courts is to move cases through the adjudicatory process. This caseflow process includes a host of support activities including record keeping, report generation, case filing, etc.
3. Courts must actively share information with each other and with executive agencies. A recent study of information exchanges among criminal justice agencies found that over 80% of all exchanges involved the courts. Any information system must be able to support the movement of information to and from executive agencies as effectively as it supports internal operations.
4. Finally, the concept of operations must view adjudication as an iterative rather than a linear process. The assumption that cases move sequentially through executive agencies and the courts has led to the development of stove pipe information systems that focus on the operations of individual courts and administrative agencies. The reality is that there is a high degree of interdependence among the judiciary executive agencies, the bar, and individu- als. Adjudication is a process that moves in fits and starts with regular recycling of cases, individuals, decisions, and increasingly, a dependence on information and the decisions of nonjudicial sources (e.g., treatment providers who may or may not be part of a government agency).
These four fundamental assumptions have framed the COSCA/NACM program. They have led to creating a national program that is organized around creating standards for trial court case management systems and a modeling tool that will allow managers to objectively review their operations.
144 Illinois Law Enforcement Executive Forum • 2002 • 2(3) The most important assumption of this program is that technology gives court lead- ers an opportunity to improve and enhance their justice system. As we learn more about technology, we recognize that a continual examination of the processes and procedures of a court calls everyday operating procedures into question. In convert- ing from paper-based processes to electronic processes, we have an opportunity to take a fresh look at how we do things. Technology makes some steps more efficient, opens up the possibility of more effective alternatives, and reveals processes that demand the human touch.
Standards The second component of the COSCA/NACM program is to develop a set of standards based on consensus within the judiciary. State judicial system officials can use these standards to guide information system development.
The use of standards as the focal point for a national effort has two major advantages. First, it takes into account the decentralized structure of our federal system of government and of most state judicial systems. Second, it provides a common framework for court officials, executive agencies, federal officials, and private vendors to use in developing and implementing information systems.
To be successful, the standards must be well-grounded in the needs of the user community and have the clear support of the judicial leadership. To achieve this consensus, the COSCA/NACM program uses a formal development process. It begins with the experiences of the practitioners in the field. A survey is conducted of practitioners to identify the products, issues, and processes, good and bad, of the several states. The results of this survey are used to prepare a draft standard. The draft is then subjected to a broad based review process involving a series of meetings of practitioners who review the draft document and make necessary changes to create a national consensus on the final product. The series of review meetings has an expanding membership that includes representatives from all relevant executive agencies and the private sector. The result is a product that addresses the concerns of the courts, the public agencies on which they depend, and the vendors who produce the software.
The final step is formal approval by the two national associations representing court management, COSCA and NACM, and the leaders of the state judiciaries, the Conference of Chief Justices. The result is standards that meet the technical requirements of the practitioners, the management requirements of the court administrators, the information sharing requirements of the noncourt world, and the policy requirements of the state judicial leadership.
Categories of Standards Standards are being developed in three categories: (1) functional standards, (2) data and document standards, and (3) performance standards.
Functional Standards Functional standards are specifications for court and case management operations and suboperations such as case initiation, indexing, docketing, record keeping,
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 145 scheduling, document generation (notices, summons, forms, etc.), calendar management, hearings, accounting, state and federal reporting, and management reporting. They also include necessary external interfaces or levels of integration within and outside of the court system (e.g., referral to the appellate courts; reporting to the Supreme Court/Judicial Council or other state entities; and integration with prosecution, defense, corrections, juvenile justice, child support or protective services authorities; and providing access to the public). Functional standards are, in sum, a description of the fundamental operations and procedures of the adjudicatory process.
The COSCA/NACM program began by developing functional standards for trial court operations. The standards are organized around six case types: (1) criminal, (2) civil, (3) domestic relations, (4) juvenile, (5) traffic, and (6) probate (including involuntary commitment). The standards define a minimum set of common business processes for court operations that can then be supplemented by requirements unique to each site. They are at a level of detail sufficient to provide a framework for vendors to develop software but general enough to allow creative solutions.
The Program began with functional standards for civil cases. They were used to test and refine the development process. The Civil Standards are now complete and have been given final approval by COSCA and NACM. Drafts of the functional standards for criminal and for domestic relations have also been completed and are under review. Development of the functional standards for juvenile courts is underway, with a completion deadline of spring 2003. Development of traffic standards is scheduled to begin in fall 2002.
Data and Document Standards Data and document standards define the general types of data and data sets that should be included in the system. These data sets and data elements are directly related to each of the functions that were agreed upon in the functional standards development process. At the national level, it is difficult to specify the data element coding structures because these must take into account the legal codes of the several states. Because of these variations, data standards are more difficult to develop than functional standards. Moreover, it is difficult to reach consensus with executive agencies as the different business needs lead to different data requirements on even common information such as names of individuals. Several steps have been taken to begin addressing the issue of data standards. One project currently underway is revision to the data dictionary used by states to report case filings to the annual State Court Caseload Statistics report conducted by the NCSC. Another effort has been organized around the development of electronic filing standards using XML. As an initial step, data standards are being included as a second phase of the criminal functional standards project.
Closely allied to data standards are the standards required to move and store documents electronically. Traditional court procedures depend upon the form of the document as well as its content to establish authenticity and maintain control. Unless or until courts move to a paperless environment, it is important to establish standards to facilitate the exchange of documents as well as individual data elements.
146 Illinois Law Enforcement Executive Forum • 2002 • 2(3) This has been approached through the development of standards for documents and for electronic filing of cases using XML.
Performance Standards The final set of standards focus on management reports generated by an information system. We recognize that the reports carry with them a measure of what the adjudicatory process is intended to achieve. It is expected, therefore, that any information system design will be able to automatically generate summaries of operations based on accepted performance standards where they exist.
The most comprehensive set of such standards are the Trial Court Performance Standards that were published in 1990 by the NCSC, and Appellate Court Performance Standards and Measures published in 1999. Performance standards have also been developed for specific case types [e.g., Victor E. Flango, Measuring Progress in Improving Court Processing of Child Abuse and Neglect Cases. Family Court Review, 39(2), April 2001].
Modeling the Judicial Process The third component of the COSCA/NACM program is the development of a conceptual framework and instrument that will support the application of the standards efforts to the issues confronting individual courts and judicial systems. The framework must capture the assumptions underlying the concept of operations. It must enhance judicial decisionmaking, address the problems of court management, support information sharing with executive agencies, and reflect an iterative adjudication process. The traditional, stovepipe approach to information system design does not meet those criteria.
The solution has been to develop a computer-based package that will allow court officials to model their processes and compare the result with a model based on the national standards. Currently under development, the software package called Models of Adjudicatory Processes and Procedures (MAPP) employs the Unified Modeling Language (UML) from the systems engineering community as the operational framework. Court officials will use MAPP to perform three analytical tasks:
1. To prepare an “as-is” model – a summary of how they are currently processing cases
2. To create a “to-be” model – a description of how they think case processing ought to be carried out
3. To conduct a “gap analysis” – an assessment of what changes are necessary to move from the as-is to the to-be operation of their court
Work has already begun on MAPP, using the criminal justice functional standards as the focus. The first step in the project has been to develop a to-be model of court operations based on the functional standards. This will be followed by field tests in which as-is models and gap analysis will be carried out in three volunteer courts. As the project moves forward, it will produce a database and graphical models of
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 147 functional capabilities of participating sites as well as a model of the standards. This database will provide judicial managers with the ability to draw on the experience of other sites as well as the national standards in modeling their own operations.
Applications The final component of the COSCA/NACM Technology Program is to implement applications that meet the needs of individual courts. These are likely to take many forms depending upon the needs of the courts, the progress in developing different components, and the resources available.
The COSCA/NACM Program assumes that the application of technology is a continuous process that will move in fits and starts instead of a specific project with a beginning and end. Moreover, it assumes that improvements will be made incrementally. Judicial managers do not have to wait until all standards have been developed or a single concept of operations has been created to use the tools available.
First, we expect court managers to use the tools developed from this program to assess and, where appropriate, reengineer their processes and procedures. The concept of operations, functional standards, data and document standards, performance standards, and MAPP can be used individually or in concert to provide court officials with objective guides for reviewing their operations in nontechnical terms. Such a self-examination is a valuable tool for managers even if an automated information system never goes forward.
Second, the program will provide a cost-effective means for developing the specifications for software that meets the specific needs of the court. The standards provide the framework for an RFP that communicates equally well to vendors and internal developers. The standards provide a common baseline and vocabulary on which the unique needs of each site can be built.
In addition, the program gives vendors a framework for reducing the cost of developing case management packages and increasing the market for their products. Several vendors have already begun using the available functional standards to guide their development and reduced the cost of their products.
Lastly, the program provides a means for development of information systems that can address the interdependence of courts within their environment. Courts are part of communities that require close coordination (e.g., law enforcement, mental health and treatment providers, the several bar specialties, corrections, and transportation). These are complicated relationships involving interchanges with executive agencies, corporations, partnerships, and individuals representing a host of subject areas.
The COSCA/NACM Joint Program is designed to make technology the handmaiden of justice not the driver. Its effect will be to provide judicial leaders with the tools they need to review their current operations, redesign procedures and practices, improve case processing, revise their information systems, and develop effective performance reporting systems.
148 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Conclusion It is common to invoke the metaphor of a construction project to describe the development of an automated information system for a court, but this is misleading as it implies a single event that has a beginning and an end, the result of which is a longstanding edifice. On the contrary, as we have all learned from experience in information system development, it is a continual process that requires constant revisions and upgrades, with irregular bursts of concerted effort. The COSCA/NACM Standards Program reflects this reality. It has been created as an ongoing effort in which standards and models are developed, tested, implemented, and revised as we gain new knowledge and experience. It is designed, in short, to serve as the means by which court managers can harness technology to the needs of the courts.
Bob Wessels is the court manager for the 15 County Criminal Courts of Law, Harris County, Texas, a position he has held since 1976. He received his BBA from Sam Houston State University, his MA from the University of Houston–Clear Lake and is a fellow of the Institute for Court Management. He has taught in the areas of court management, judicial administration, and management information systems as an adjunct professor at the University of Houston–Clear Lake, Sam Houston State University, the Institute for Court Management, and the Texas College for New Judges.
He currently serves as a member of the Judicial Committee on Information Technology recently established by the Texas Legislature and appointed by the Chief Justice of the Texas Supreme Court. He is a founding member of the Texas Association for Court Administration.
Wessels is a past president of the National Association for Court Management. He is a member of the Board of Directors of the National Center for State Courts and the Justice Management Institute. For the past two years, he has served as chair of the National Task Force on Court Automation and Integration. He is a member of the COSCA/NACM Joint Technology committee, the COSCA Statistics Committee, the Texas Judicial Committee on Information Technology, and numerous other local and state committees in the area of criminal justice administration, policy, and corrections.
Thomas A. Henderson is the executive director of Association Services and the Office of Government Relations of the National Center for State Courts. He has worked with state court leaders to develop and advocate policies and programs on national issues of importance to the state judiciaries, such as welfare reform, integrated justice information system development, criminal justice legislation, privacy and security of court records, the Violence Against Women Act, a proposed Victims Rights Constitutional Amendment, and judicial access to federal funding streams. Henderson writes a regular column on national issues affecting state courts for the Court Manager and for state newsletters. He has published books and articles on such subjects as court unification, child support guidelines, judicial record keeping systems, and caseflow management. Henderson was formerly executive director of the Criminal Justice Statistics Association, cofounder of the Institute for
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 149 Economic and Policy Studies, Inc., staff associate with the Council of State Governments, and professor of political science at the University of Florida and Georgia State University. He holds a BA from Haverford and a PhD from Columbia University.
150 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Seeing Is Believing—Exhibits from the Perspective of the Forensic Document Examiner
Emily J. Will, CDE, Second Vice President, NADE
Oral testimony without demonstrative evidence is a flat, one-way process. The expert talks, and everyone else listens. Without an exhibit, an expert witness can only say to the judge and/or jury, “let me tell you how and why I reached this opinion.” When an exhibit is introduced, other dimensions are added. The eyes and other senses are engaged. The trier-of-fact is made a partner in the process of reaching the opinion, and the testimony has greater impact and significance. With a good exhibit, the expert can say “let me show you how and why I reached this opinion so that you can reach the same opinion yourself.”
Document examination is a field that almost requires the use of exhibits. Why? Because the vocabulary, theories, and methods used by document examiners are not commonly understood. If the testimony is limited to the spoken word, the listener can easily become confused or bored. Words are often imprecise, and when the document examiner makes one statement, the jurors may be hearing 12 different statements.
People process information in different ways, and offering both visual and verbal explanations allows more people full access to the information. Albert Osborn (1929) writes in Questioned Documents,
It is generally assumed that all who hear testimony understand it, but this is far from the fact, and those with the necessary experience know best that the presentation of visible evidence may be vastly more effective than an appeal to the sense of hearing alone. When it is feasible, therefore, it becomes important that the testimony be made visible in every way possible (p. 63).
For example, in a handwriting identification case, the document examiner might say, “The known writing is illegible, but shows good line quality, and is written from start to finish without lifting the pen from the paper. The questioned writing is also illegible, but has poor line quality and two internal pen lifts.” This may not make much sense until it is paired with photographs of the known and questioned writing (see Figure 1). The exhibit gives the judge and/or jury an immediate understanding of the terms “pen lift” and “line quality,” and it makes a more powerful statement of the differences between the known and questioned writings than the examiner can make with words alone.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 151 Figure 1. The known signature is above the questioned signature. The dashed arrows point to some of the areas of poor line quality on Q1. The solid arrows point to the two internal penlifts. K1 shows good, smooth line quality and no penlifts within the signature.
K1 - May 5, 1999
Q1 - May 10, 1999
Properly formulated and designed visual exhibits are among the materials most easily understood and best remembered by jurors. Katherine Koppenhaver (2000), CDE, contends, “. . . jurors retain facts longer, maintain attention and understand information better when it is presented both verbally and visually.”
Exhibits come in many forms, all designed to graphically explain the reasoning behind the expert’s opinion. Photographs, videos, slides, charts, diagrams, models, transparencies, and demonstrations are all commonly used in courtroom exhibits.
Considerations Exhibits should be designed to inform, educate, and enlighten in support of a witness’s testimony. The first consideration is the selection of content for the exhibit. Exhibits should focus attention on the critical issues of the case and assist the trier-of-fact in understanding the evidence. What points are to be emphasized? Any information that is significant in reaching the opinion or any point that is complex and has potential to be misunderstood should be addressed. Verbal testimony that is likely to attract cross-examination should also be illustrated.
Exhibits must be fairly constructed, which means that they must be truly representative of the elements of the case. For example, in a handwriting identification case, handwriting evidence that may appear to contradict the opinion should also be included in the exhibit, and an explanation should be given of why the opinion stands (see Figure 2). This allows the trier-of-fact to see the range of evidence and to
152 Illinois Law Enforcement Executive Forum • 2002 • 2(3) better understand the reasoning leading to the opinion. By deliberately addressing the most difficult areas of comparison rather than omitting or glossing over them, the examiner forestalls objections that may be festering in the minds of the jurors. The jurors may not be able to ask questions during a trial, but the questions are there, and the best presentation of the evidence takes into account these unspoken questions and answers them.
Figure 2. This is part of an exhibit prepared to demonstrate the opinion that Q1 is not a genuine signature. The differences between Q1 and K1 are clear. K2 is pictorially closer to Q1 and is rightly included in the exhibit. The expert explains the structural differences (such as the constant movement to the right in Q1 as opposed to the looping and retracing of strokes in the knowns) between Q1 and K1 during testimony.
Q1
K1
K2
Any “known” material relied upon by the expert must meet legal requirements. The attorney must be certain that the material presented to the expert is really “known” and that it cannot be successfully challenged. The document examiner will review
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 153 the known material for internal consistency and make the attorney aware of any potential problems noted, but it is still the responsibility of the attorney and client to be sure that the comparison material is reliable.
The medium and method chosen for the exhibit should enhance the message. The expert should first determine what the visual aid will demonstrate and then determine the proper media to illustrate the findings. In Figure 3, a means to determine the direction of a stroke is illustrated. The simple selection of a curved arrow as opposed to a straight arrow adds extra graphic information to the explanation. The added information may help a juror to intuitively understand a concept that otherwise could be confusing.
Figure 3. This exhibit shows how striation evidence is used to determine the direction of pen travel within a stroke. Each arrow parallels a striation in the ink line caused by imperfections in a ballpoint pen. The striation is formed moving from the inside to the outside of a curve as the pen moves forward; therefore, the o on the left was written in the counter-clockwise direction, while the lower loop of the J on the right was written in the clockwise direction.
Visual aids cover everything from impromptu blackboard drawings to complex videotaped evidence. Most exhibits fall somewhere in between. High-tech exhibits have a place, but in some ways are also a double-edged sword. Turning down the lights to view slides can also result in a loss of viewer attention. Electronic gadgetry has a tendency to misbehave at a crucial moment, and unless the expert is totally familiar with the equipment and prepared to troubleshoot in a courtroom situation, there can be problems. It is the opinion of this examiner that high-tech demonstrations should be saved for those situations that really require them.
In a 1996 article, Sandra L. Ramsey reports on two surveys (1988 and 1993) of forensic document examiners. In 1993, slightly over 50% of the respondents reported that 71-90% of their casework involved handwriting identification, and an additional 31% reported 91-100%. The nonhandwriting questions involve other aspects of document preparation: erasures, alterations, obliterations, page substitution, indented writing, sequence of preparation, date of preparation, and ink and paper comparisons. Questions in these categories can often be answered with nondestructive testing by the document examiner, and high-tech demonstrations may be appropriate in presentation of this evidence.
154 Illinois Law Enforcement Executive Forum • 2002 • 2(3) For example, a promissory note was submitted for examination. In deposition testimony, the alleged signer of the note testified that although she had signed the second page, the first page was a substitution that greatly increased the amount of the note. The solution to this case was found when some trace evidence, in the form of indented writing, was developed.
Writing with sufficient pressure can press indentations matching the writing into any other paper that is under the document. The reader may be familiar with the use of the flat portion of a pencil lead rubbed lightly over such an indentation to make it visible. That works because the pencil lead blackens the paper except for the location of the indentations, which then stand out against the blackened paper. The pencil lead technique does not work on mild indentations, and is considered to be destructive testing. Since the late 1970s, there has been a better way to detect indented writing.
The VacuBox is a type of electro-static detection apparatus. The questioned document is placed on the flat metal top of the box and covered with a thin protective plastic film. A vacuum pump draws the plastic tightly to the document. The examiner smooths out any wrinkles in the plastic. A separate unit, called a corona wand is plugged into the VacuBox. When this wand is on, an electro-static charge is generated and can be transferred to the paper by passing the wand in close proximity to the plastic-covered document. After charging the document, the examiner brushes some specifically formulated powder onto the document (still protected by the plastic film). The electrostatic charge, which builds up in the indented areas, attracts the toner and causes the indentations to appear darkened against the color of the paper. At this point, the examiner can photograph the indentations and/or cover them with a clear adhesive sheet, forming a plastic sandwich with the powder between the first and second sheets of plastic. Once the vacuum pump is turned off, the “sandwich” can be peeled away from the document, which remains unharmed. The indented writing evidence is thus preserved.
This procedure was applied to the questioned promissory note. An indentation of the admittedly genuine signature written on the second page was found on the allegedly substituted first page of the document. This does not rule out the possibility of page substitution, but it does prove that the first page was beneath the second page when the signature was affixed, and this is counter to the deposition testimony of the signer.
Here, we have a case where some type of technical demonstration would be effective. The equipment used could be explained with the aid of photographs (see Figure 4), slides or a videotape, or courtroom demonstration. The indentations in this case were clear and dark, but in another case, they might be faint. It may be important, as it was in this case, to demonstrate that they match a particular source writing. This could involve a large screen presentation (transparencies or a video presenter) to show the jury that the indentations will overlay and match the genuine signature (see Figure 5).
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 155 Figure 4. This photo illustrates one step in the development of indented writing. The document is protected by a thin film of plastic, and a vacuum has been drawn. Now, the handheld corona wand is transferring an electrostatic charge to the document.
Figure 5. At the top is a portion of the indented writing visible on the first page of the document. Below is a part of the actual signature on the second page of the document. In a trial, transparencies could be used to assist in the comparison of the indentation and the signature.
156 Illinois Law Enforcement Executive Forum • 2002 • 2(3) One more consideration related to use of technical equipment in demonstrations is the courtroom itself. The layout of some courtrooms, with high ceilings and huge windows, does not easily allow for the room to be darkened. There may be a sudden change of trial location from one courtroom to another resulting in a need to change presentation plans. Any high-tech demonstration should be backed-up with an effective low-tech alternative.
Requirements Exhibits must be generated by the expert or under the expert’s supervision. The name of the expert or other person who prepared the exhibits should be affixed.
The exhibits must be relevant and material to the case. They must assist the trier-of-fact in understanding the document examiner’s testimony.
Material must be clearly marked and identified, either on the exhibit itself or on a transparent overlay. “Questioned” and “Known” entries should be labeled, and documents should be identified by their designation such as Q-1 or K-1. It should be easy to locate the source of the exhibit.
Exhibits should be organized and labeled for easy retrieval so as not to waste the court’s time with frantic searching through exhibits.
Enhancements Sometimes, it is necessary to remove extraneous material from a photocopy or photograph. White-out or computer enhancement can be used but care must be taken not to delete any part of the relevant material. For example, when illustrating a signature that has obliterating lines, the lines need to be removed without removing any part of the signature. The unaltered document must also be available for comparison.
Arrows or other markers can be placed at strategic locations to point out features that the expert plans to discuss. Photographs may be marked in advance with colored pens, or they may be covered with clear plastic overlays that highlight important points. Unmarked copies should also be available. When documents have different color background and/or ink, colored copies help to link the words or letters selected for the exhibit to the source documents.
Anyone should be able to look at the exhibit and understand its message. Keep exhibits simple, clear, and convincing, and do not try to demonstrate all points at one time. An overcrowded exhibit can cause confusion instead of clarification.
Scanners and Digital Cameras Scanners and digital cameras that use electronic media instead of film are useful for producing exhibits. An image can be captured with a digital camera or scanner and imported into a computer. From there, exhibits can be created with a range of software assistance and paper-quality options. It is important to note that unless calibration software or techniques are used, it is difficult to obtain digital images
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 157 that are exactly the same percentage of enlargement, so raw size comparisons may not be warranted with this method of visual demonstration.
Computer printouts of digital photographs are an excellent way to prepare jury books illustrating handwriting characteristics in a handwriting identification case, but in a case involving line sequence (which line was written, typed, printed, or stamped first), 35 mm photography through the microscope might be more appropriate. Again, the medium must be chosen according to the nature of the evidence. All of the images presented in the figures were captured with a video camera, which can link to a microscope or a digital still camera.
Conclusion Judges and juries want to understand testimony that is being presented to them. Sometimes there is contradictory testimony, and as the decision-makers in the courtroom, the triers-of-fact want to have a basis to decide which testimony to accept. Osborn (1929) writes that clear exposition of the physical basis of all testimony “. . . removes evidence relating to documents from the bare statements of an opinion and furnishes the facts by which it becomes possible for judge and jury to determine for themselves which of two conflicting contentions is the correct one.”
While this article has used as its basis the expertise of document examination, this and other ideas presented apply to any expert testimony used in the courtroom. Properly designed, prepared, and presented exhibits can indeed invoke the adage, “seeing is believing.”
Bibliography Bradford, R., & Bradford, R. (1992). Introduction to handwriting examination and identification. Chicago: Nelson Hall.
Hilton, O. (1993). Scientific examination of questioned documents. Boca Raton: CRC Press.
Koppenhaver, K. M. (2000). Demonstrative evidence. Journal of the National Association of Document Examiners, 23(1), 12.
Osborn, A. S. (1929). Questioned documents (2nd ed.). Chicago: Nelson Hall Publishers.
Ramsey, S. L. (1996). The effects of computers on forensic document examiners. International Journal of Forensic Document Examiners, 2(3), 188-189.
Emily J. Will has been a document examiner for the past 15 years and was certified by the National Association of Document Examiners in 1997. Will is the second vice-president of NADE and the editor of the NADE Journal. She maintains a well-equipped laboratory and extensive professional library and has testified in state and federal courts. You can learn more about document examination through Will’s extensive Document Examination Website at
158 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Viewing Technology as an Obstacle to Law Enforcement Strategic Planning
Michael A. Blazek, Major, DuPage County Sheriff’s Office
A recent print advertisement for a leading “electronic – government” service provider boldly proclaims . . .
“What will government look like in the future? . . . In six months? . . . In five minutes?”
As the most visible arm of government to local communities, law enforcement administrators are facing pressing new challenges in strategic planning for their agencies as they adapt to the explosion of information in the computer age. The rise of e-government is underway, and police agencies across the country are engaging in strategic planning processes to understand what it means to communicate and conduct business with citizens electronically.
Most law enforcement strategic plans today include enhancing the community policing philosophy and extending homeland security efforts through the use of technology and e-government applications. Funding from the U.S. Department of Justice for technology advancements and personnel training has led the drive toward increased efficiency in policing. Simply put, e-government is defined as practically leveraging the Internet to simplify government. E-government can improve the business of government by creating more efficient and convenient public-to-government, business-to-government, and even government-to- government interaction.
With the challenges of homeland security added to those of community policing, strategic planning has become more complex with a wider range of objectives seen as relevant. In addition, a wider range of programs, policies, procedures, tactics, and strategies are seen as potentially viable, which substantially increases the information needs of police managers. Despite claims of the effectiveness of community policing, research shows that the recent decrease in America’s crime rates are mainly due to . . .
• More strict laws and penalties. • Prosperous economic conditions.
Police strategic planning must now focus on keeping it decreased. Technology will play a primary role in that focus; however, the new issue is whether technology will be more of an obstacle than an asset to law enforcement strategic planning. How do you plan for the future when the agency’s primary tools change so rapidly and unpredictably?
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 159 First, let’s look at what strategic planning is. The Government Performance and Results Act of 1993 defines a Strategic Plan as a five-year plan (updated every three years) that is comprised of . . .
• the agency’s mission. • general goals and objectives. • means and processes to achieve goals and objectives. • the relationship between performance goals and strategic goals. • key factors and values that can affect achievement. • program evaluations and schedule of evaluations (or assessments).
More elementary strategic planning is defining where the agency wants to be in a certain amount of time and how to get there. It is trying to predict the future, and seldom has the future been more uncertain than it is today. Strategic planning is an agency’s design for the future. A law enforcement agency’s mission states its purpose or why the agency exists. The mission is the intent of the agency, a clear statement of the type of business it is in. An agency’s vision includes its direction or the way the agency intends to go. Vision is where the future begins. The values of an agency are the beliefs that guide the agency and provide the moral basis for decisions and actions. Goals are the building blocks of the strategic plan. The strategic goals should promote collaboration, growth, and development and reduce stifling management and personal agendas. Performance goals, identified yearly or more frequently, are specific tangible actions and tactics to achieve the strategic goals. Performance goals and objectives are established well after a strategic plan is defined. Sometimes, though, even the best strategic planning efforts are insufficient.
The challenge of improving law enforcement strategic planning lies in the development of integrated technological solutions that will enable law enforcement agencies to unify components, track case data, share records, organize intelligence, and process information quickly. Modern strategic planning focuses on goals that impact both internal employees and the citizens of the community. People are rapidly becoming aware of an expanding variety of commercial services online, and soon, they will also begin to expect to get their government services that way. Citizen’s expectations are growing so significantly that they are demanding fast, convenient, and knowledgeable service—at all hours of the day and night. Any law enforcement strategic plan must include a redefinition of how its services are delivered to the public. Law enforcement agencies must acquire the tools and resources to meet these expectations and operate effectively. Already, many leading businesses have recognized that the only way to gain an edge is to become “customer-focused.”
Historically, law enforcement strategic planning has prioritized reducing crime, preventing crime, tactical training, community involvement, and cooperation—“we need you to work with us on this.” Policing in the 1970s targeted the management of civil disturbances and social unrest and focused on the formation of tactical units and procedures. Goals were results-driven. In the 1980s, policing targeted the reduction of crime and disorder and focused on reactive, aggressive actions; and goals were response-driven. Policing in the 1990s aimed its efforts at reducing the fear of crime and neighborhood decay. The focus was on community policing, and goals were values-driven. The year 2000 sets information technology and
160 Illinois Law Enforcement Executive Forum • 2002 • 2(3) organizational change as the targets of policing, and agency goals are technology- driven. In the future, strategic planning will focus on implementing technology, information security, process training, resource management, liability mitigation and collaboration—“we need you to do this for us, and we can do that for you.” In addition, the intelligence failures identified in the post-September 11, 2001 era will demand that new technologies shape the ways that law enforcement will handle massive amounts of new information. New technologies will have an impact on police strategic planning processes on four distinct levels:
1. Change management and training – Keeping up with the curve, updating and configuring systems and networks, and training and retaining qualified information technology workers 2. Asset control and resource management – Budgeting for and buying tomorrow’s technologies instead of today’s and hardware and software and licensing control 3. Outsourcing and maintenance – Aggregating infrastructure services across a number of agencies to get economics of scale and the abilities to remotely diagnose and troubleshoot problems 4. Security and monitoring – Opening up new avenues of intelligence gathering while protecting the rights of citizens and preserving electronic records while providing electronic access
All of these levels of strategic planning involve evaluating the forces of change in the agency’s environment to identify risks and opportunities. These forces of change drive the evolutionary process and include economic, political, legal, social, cultural, demographic, and technological factors and current trends. Then, a police agency defines its strengths and weaknesses to chart a course to improve its capabilities and reduce its deficiencies. To illustrate, the U.S. Postal Service, in a recent strategic five-year plan, warned that its future is threatened by the increasing use of e-mail in place of first-class letters, bill paying, and even as a replacement for junk mail. Not being able to predict what future technologies may be will make it difficult to build on an agency’s strengths, reduce its weaknesses, account for external forces of change, deal with potential risks, and take advantage of opportunities. Law enforcement problems such as the use of excessive force or allowing pursuits have traditionally been handled as matters of policy and procedure rather than opportunities for new technology.
The use of changing technologies is often cited in strategic planning, particularly those centered on a community-policing philosophy solely for improving the link between an agency’s capabilities and opportunities.
The rapid changes in technology can render even the best strategic plan obsolete before it is even published. A strategic plan needs to be flexible enough to change every three to six months as police managers learn and find better tools. If one looks at where radical change is happening in our commerce—the dot-coms and small start-ups—they have decisive leadership, not a five-year strategic plan. They look out ahead for 90 days or six months. They hit the ground running fast, and some have, in fact, stumbled. It is difficult to experience radical change in law enforcement agencies and government in general because of the extensive system of checks and balances. Our current bureaucratic form of organization and our traditional styles of management were developed in another era to combat a set of long-past problems.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 161 Changes in leadership and management have not kept pace with the rest of modern societal systems. Other perceptions of technology as an obstacle to police strategy planning include the following:
• The fragmentation of police agencies at the local levels • Few resources for research and development • A lack of national performance standards • The concern over liability issues • Risks to some constitutional rights to assure security • Escalation in the uses of force and weapons of mass destruction • The fear of technology misuse • “Big brother” government surveillance • A belief that leadership must extend beyond technology to develop the most appropriate and ethical ways for society to gain from our technology and to ensure that the technology cannot be misused
Another contemporary role of leadership in agencies is the effective improvement of morale among its workers. Technology impacts this area as well. Newer police officers usually welcome technology because it applies their modern learned knowledge and behavior. Younger officers connect their work-related technology to their everyday lifestyles, and morale improves. Time and distance take on different meanings to people growing up in the information age. Conversely, older, tenured officers usually are resistant to change due to fear of the unknown. Technology adds elements of confusion and reduction to entry-level training. Older officers are comfortable in the “status quo,” and any change results in decreased morale.
Knowledge, information, and communication are the driving strategic forces in today’s national security, economic prosperity, and social stability. In the hands of aware law enforcement decisionmakers, good information can and does avert and divert pending crisis. A great deal of data traditionally desired by police administrators when managing incidents can be made available now in real time, to any location. This new decision-support technology means that instant communication will command instant decisionmaking. But, how exactly will the technologies five years from now improve our communications? Technology improves communication to enable people to share what they know. Knowledge becomes information when it is shared. The sharing of information before, during, and after an event has long been recognized as a means of reaching goals and getting things done.
Unfortunately in the 21st century, the explosion of electronic information has also led to an explosion in new types of criminal activity or so-called cyber-crimes. Nowadays, in addition to the guns and drugs usually found on search scenes, police are encountering another “tool” in the criminal’s tool bag: the computer. Computers give criminals their chance to be borderless and anonymous and engage in “low- risk” crime. Victims are typically large corporations, banks, and big businesses. Trends in cyber-crimes today include financial fraud, domestic terrorism, identity theft, institutional violence, and sexual predators. The current procedure for prosecuting some nonviolent cyber-crimes is to get convictions with noncustody time sentences. Police go through very long and intensive investigations that result in cases resolved with minor charges and without any time in jail; however, the
162 Illinois Law Enforcement Executive Forum • 2002 • 2(3) focus on computer crime as a terrorist activity, as well as the funding to fight it, is likely to change in the next few years as computer crime affects more parts of society. It is also certain that changes in technology, yet unseen, will create new types and classes of crimes.
When planning for the future, advancements in technology will dramatically impact legal factors as well. In the near future, the Supreme Court will tackle the definitions of search and seizure as they are now utilized. The pressure from citizens for electronic access to government documents and information has to be balanced against tight budgets, changing regulations, and concern for safeguarding privacy. The use of eavesdropping technology raises serious, difficult questions about the Fourth Amendment and the narrow differences between forms of communication. There are enormous insecurities and risks with current Internet applications, but the number of legitimate transactions every day are staggering. Law enforcement planning will need to learn the offenses of “personal intrusion” as opposed to the commonly encountered crimes of “physical intrusion.”
Currently, there is a trend in the private sector to secure networks with biometrics—fingerprint verification, facial analysis, iris recognition, hand geometry, signature dynamics, voice identification, etc.—the use of technology to verify identity based on the differences in people’s physiologies or behaviors. As the public acceptance curve flattens out, law enforcement should follow the lead of business in this network system security. As agencies implement technologies that collect information about the activities of citizens, they will be required to add strict guidelines to secure such information. Unforeseen consequences can result when you develop an information resource that can suddenly become a sought- after commodity that can be used in positive and negative ways. Additionally, the legal and jurisdictional issues within and among different countries will cause an unprecedented surge of cooperation in the investigation and prosecution of terrorist and cyber-crimes.
Finally, every agency’s strategic plan should identify training and education as a means for achieving its mission. Technology is becoming a huge obstacle in well-established training curriculums in many law enforcement agencies. In most cases, training can play a pivotal role in ensuring that an agency’s strategic plan is being followed. According to the American Society for Training and Development, research shows that high-impact companies, public-sector agencies, and other institutions attribute much of their leading-edge status to recognition of the importance of including training as a key element in their strategic planning process. Still, it is not an easy task to incorporate technology training when an agency isn’t even certain what its employees already know. Some agencies do not even consider the experience and skills of new employees because technologies are changing so fast that they must invest heavily in retraining regardless of previous experience. Nevertheless, with all of the training required for competence by today’s police officer, law enforcement strategic planning should include modern processes for the recruitment of a technologically educated workforce. As previously discussed, law enforcement of the future will require high-tech training to investigate and solve new complex types of computer crimes and to learn the operation of the computer as a process tool to manage other functions.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 163 Recruitment and selection have been particularly difficult for police agencies in recent years due to the prosperous economic conditions in this country—and recruitment of workers trained in technology matters is especially a problem due to the lure of the more lucrative private sector. Recruitment and selection of police personnel consists of not only the selection of the most qualified candidate, but also the candidate’s potential to be in philosophical agreement with future strategic plans and goals. More burdens are placed on strategic planning when it is learned that most law enforcement leaders report that their main training needs are in computerized mapping, computer-assisted call assignment, intelligence analysis, and use of the Internet, while local government and community leaders think that police need additional training in cultural diversity, communication skills, conflict resolution, and dealing with ethical issues. From this perspective alone, technology has injected new concerns in an agency’s strategic planning.
Technology will change law enforcement more in the next decade than it has in the past century. The bottom line is that technology is now a valuable, practical, and necessary tool for law enforcement personnel in the field. To prepare for this impact, technology development and strategic planning need to be joined with flexible and innovative links. Every day, the nature of the Internet changes as people add more content, build faster computers, create better means of storage, improve application softwares, and develop more capable communications. Such explosive growth precludes a comprehensive, one-size-fits-all approach to strategic planning. The best solution is to develop a strategic plan for only one or two years that focuses on implementing useful processes that clarify future direction, unify the agency’s goals, refine decisionmaking, and facilitate the setting of priorities for the agency based on community needs.
It will not be one single breakthrough that will make a difference, nor a combination of technologies. Rather, it will be an extensive level of integration that puts these new processes and resources right where they need to be—at the fingertips of the line police officer. This integration will include . . .
• flexible, expandable, and upgradeable system architectures. • technologies that will provide the right information at the right time. • devices that will support standardization and security of information databases. • training opportunities and employment perks to retain the skilled employees.
Accurate accomplishment of these factors may require a “crystal ball” for law enforcement—to determine what is probable and what is possible—during the formulation of their strategic planning. This is especially true because the government process typically stifles creativity and risk-taking—quite the opposite of what is found in business and industry. Visionary leaders and decisive management, however, are challenging the notion that the pace of government is going to be slow.
Technology is blurring geographical and temporal boundaries; boundaries that are becoming more meaningless every day. Problems will no longer be segregated by jurisdictional lines and spheres of responsibility. Strategic plans need to add the concepts of innovation and creativity from internal and external sources to mission and vision statements.
164 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Policing has made substantial progress in reducing crime by more intelligent use of information. This ability is directly related to the imaginations of the human resources. Defining the future for law enforcement agencies is not easy. That’s why it is important for leaders to plan ahead of the curve in order to procure tomorrow’s technologies instead of today’s. An Internet website is no longer a luxury but rather a required means of enhancing an agency’s operation while providing an accessible means of public information. As stated by futurist author, Watts Wacker, “In the end, your vision is only as good as your commitment to the execution of it.” Law enforcement can continue to make positive progress by overcoming the technology obstacles to strategic planning and remaining committed to our visions. Effective leaders truly must approach their strategic planning with the mind-set of “What will law enforcement look like . . . in five minutes?”
Bibliography Carney, D. F. (2000, August 15). Managing on the fly. Federal Computer Week. [online]. Available:
Field, M. (2000, February). Organizational dynamics in a technology-driven world. The Police Chief.
Furey, B. (2000, July/August). Using the Internet to manage emergencies. Public Safety Product News. Melville, NY: Cygnus Publications.
Hall, D. (2000, July). Cybercrime: The toughest challenge yet? Police. Torrance, CA: Bobit Publishing Co.
Hanson, W. (2000). E comes calling. Electronic government (Government Technology supplement). Folsom, CA: E. Republic, Inc.
Heal, S. (2000, June). Sheriff’s department explores technology. Law and Order. Deerfield, IL: Hendon Publishing Co.
McKay, J. (2001, April). New times, new crimes. Crime and the tech effect. Government Technology. Folsom, CA.
Robb, D. (2000, April). Electronic Weapons. Crime and the tech effect. Government Technology. Folsom, CA.
Sarkar, D. (2002, March 28). New technology means new problems. Federal Computer Week. [online]. Available:
U.S. Government Accounting Office. (1996, June). Executive guide: Effectively implementing the government performance and results act. Washington, DC.
U.S. Office of Personnel Management. (2000, July). A guide to strategically planning training and measuring results. Washington, DC.
Michael A. Blazek has served with the DuPage County Sheriff’s Office since 1978. His assignments have included patrol officer, traffic specialist, certified
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 165 firearms instructor, crime scene technician, property and violent crimes detective, patrol sergeant, patrol district commander, training division coordinator, and patrol division commander. He currently holds the rank of major and is assigned as the director of the Office of Professional Standards, which oversees the employment practices, internal affairs function, and crisis response plans of the agency. After completing 13 years on the Sheriff’s Special Operations (SWAT) Unit, Blazek currently serves on the DuPage County Crisis Management Team. In 2000, he researched and wrote the Sheriff’s Safe Schools Strategy addressing the recent national tragedies of school violence. He frequently lectures on the subject. Major Blazek majored in public management at the University of Arizona and is a graduate of the Northwestern University Center for Public Safety, School of Police Staff and Command and the Executive Management Program. He is also a current member of the DuPage County Chiefs of Police Association, the DuPage County Senior Police Management Association, and the American Society of Law Enforcement Trainers.
166 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Liquid Phase Chemiluminescence: Potential for Forensic Analysis
Simon W. Lewis, PhD, School of Biological and Chemical Sciences, Deakin University, Geelong, Victoria, Australia
Introduction There is an increasing demand within law enforcement agencies, worldwide, for selective and sensitive methods for the determination of illicit substances. The rapid characterisation and quantification of illicit drugs and explosives in a variety of challenging matrices is an essential service provided by forensic science laboratories throughout Australia.1, 2 In particular, the control of illicit drugs is of increasing social concern due to the significant increases in their availability and use in the last few years, and the associated crime and health problems.3-4 It is also to be expected that the determination of trace explosives will become an issue of high priority as a result of the rise in the profile of international terrorism.
Many forensic samples are complex mixtures derived from biological extracts or debris associated with the scene of an explosion. The analytes of interest in these samples are also likely to be present at low levels so the detection technique should be selective and sensitive. Traditionally separation and identification of drugs and explosives has been carried out using gas chromatography (GC) and high-performance liquid chromatography (HPLC).5 There are, however, some cases in which the analyte in question behaves poorly under GC or HPLC analysis. This might be due to thermal instability or at least high-temperature reactivity, as is the case with the drugs LSD and psilocin (the active ingredient in “magic mushrooms”); the benzodiazepines; and the explosives PETN, RDX, and HMX during GC analysis.2, 5 Alternatively, the analyte might be too volatile to observe under “normal” GC operations (e.g., methylamine derived from methylammonium nitrate, a common component of commercial explosives).2 When analysing by HPLC, the most common mode of detection, ultraviolet-visible spectrophotometry, is insensitive for analytes such as PETN.2 This problem of detectability is compounded by the fact that these analytes are often present only in trace amounts.
Over the last ten years, our group at Deakin University has established that liquid phase chemiluminescence reactions provide valuable detection systems for flow analysis and capillary electrophoresis.6-11 We have successfully applied these technologies to the demanding field of process analytical chemistry in the opiate pharmaceutical industry. The analytical challenges we have faced in this work are of a similar nature to those of a forensic scientist. Recognising this, we have recently entered into a collaboration with the Victoria Forensic Science Centre and South Australia Forensic Science to research the application of liquid phase chemiluminescence to forensic analysis of illicit substances. This article gives an overview of analytical liquid phase chemiluminescence and discusses our application of it to pharmaceutical analysis and its potential for forensic science.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 167 Liquid Phase Chemiluminescence The term chemiluminescence was first coined by Eilhardt Weidemann in 1888 and refers to the emission of light from a chemical reaction.12 While the generation of light by living creatures (bioluminescence) had been observed from ancient times, the first report of artificial chemiluminescence was not until 1669. In that year, the German physician, Hennig Brandt, hoping to make his fortune from alchemy, isolated a substance from urine which glowed continuously in the dark. The substance, then termed phosphorus mirabilis, better known now as white phosphorus, was extensively studied by Sir Robert Boyle who published his results in two pamphlets: The Aerial Noctiluca (1680) and The Icy Noctiluca (1681). In the former, Boyle suggested some practical applications of phosphorus mirabilis including the possibility of using the emission of light from phosphorus as a “guide knowable at a good distance off in spite of tempestuous winds and greatest showers, and this in the darkest night.”13
Chemiluminescence from synthetic organic compounds was first observed in 1877 by Bronsilaus Radziszewski during the preparation of lophine (2, 4, 5-triphenylimidazole) from hydrobenzamide. Since that time, many other chemiluminescent compounds have been synthesized, most notably luminol (5-amino-2, 3-dihydro-1, 4-phthalazinedione), lucigenin (N, N’-dimethyl-9, 9’-diacridinium nitrate) and pyrogallol (1, 2, 3-trihydroxybenzene). Of particular interest was the oxidation of certain diaryl oxalates in the presence of a fluorescent sensitiser, the so-called “peroxyoxalate reaction” initially observed by Chandross in 1963. Rauhut and coworkers subsequently developed this type of reaction, which now forms the basis of Cyalume chemical light sticks.
A chemiluminescent reaction in its simplest form can be represented by . . .
A + B → [I]*→ PRODUCTS + LIGHT (Where A and B are reactants and [I]* is an excited state intermediate.)
This is termed “direct chemiluminescence”; a well known example is the luminol reaction. In certain cases in which the excited state is an inefficient emitter, its energy may be passed on to another species (a sensitiser, F) for light emission to be observed. This is called “indirect chemiluminescence”; an example of this is the peroxyoxalate (light stick) reaction.
A + B → [I]* + F→ [F]* → F + LIGHT
The light emitted from the chemiluminescent reactions has differing degrees of intensity, lifetime, and wavelength with the latter parameter covering the spectrum from near ultraviolet, through the visible, and into the near infrared. Chemiluminescent reactions that have found analytical application often produce light in the visible region, and some of these have been summarised in Table 1.
168 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Table 1 Properties of Liquid-Phase Chemiluminescence Reactions
Quantum Reaction Colour (lmax) yield*
Oxidation of luminol in aqueous alkali blue (425 nm) 0.01 Oxidation of luminol in dimethyl sulphoxide green-yellow (500 nm) 0.05 Oxidation of lucigenin in alkaline hydrogen peroxide blue-green (440 nm) 0.016 Oxidation of lophine in alcoholic sodium hydroxide yellow (525 nm) - Peroxyoxalate reaction sensitiser dependant 0.05 - 0.5 Reduction of tris (2, 2’-bipyridyl) ruthenium (III) by certain amines, opiate alkaloids, and oxalate orange (610 nm) - Oxidation of certain opiate alkaloids by acidic potassium permanganate in the presence of polyphosphates red (680 nm) - ATP-dependant oxidation of D-luciferin with firefly luciferase pH 8.6 green-yellow (560 nm) 0.88 pH 7.0 red (615 nm)
* The intensity of emission of a reaction is dependent on the quantum yield. The quantum yield is a measure of the efficiency of the chemiluminescence reaction. Quantum yields vary from 10-15 (ultraweak chemiluminescence) to nearly 1 (bioluminescent processes).
Chemiluminescence and Chemical Analysis Chemiluminescence is well known as the basis for detection in the gas phase, particularly in the form of nitrogen oxide detectors and selective gas chromatography detectors for sulphur and phosphorus; however, over the past 20 years, liquid phase chemiluminescence has gained wider acceptance, especially in the areas of liquid chromatography and flow analysis detection.14 Chemiluminescence is an attractive proposition for detection in both laboratory-based and process chemical analysis for the following reasons:
• The potential for excellent limits of detection due to the absence of source noise and light scatter • High selectivity as a result of the limited number of available reactions • Robust and inexpensive instrumentation for use in static and flowthrough modes
Undoubtedly, it is the high sensitivity of chemiluminescence detection, with detection limits often being orders of magnitude lower than those obtainable by conventional absorbance and fluorimetric measurements, that has prompted research in this area. Examples of the detection limits that have been achieved by our
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 169 group and others using chemiluminescence are presented in Table 2. The selectivity of chemiluminescence detection, which can be manipulated to suit a particular analytical requirement, can also be extremely advantageous.14
Table 2 Examples of Detection Limits Achievable with Liquid-Phase Chemiluminescence Detection
Detection Limit Analyte mol dm-3 g mL-1 Reference
Heroin 4.5 x 10-8 1.6 x 10-8 15 Morphine 5.0 x 10-10 1.4 x 10-10 8 Codeine 5.0 x 10-9 1.5 x 10-9 7
The most successful analytical application area for liquid phase chemiluminescence to date has been the biomedical field. Particular application areas have been as a means of detection in immunoassay and for the direct analysis of various substances of clinical interest by bioluminescence. Chemiluminescence has been used in forensic science through the well-known luminol test for bloodstains. The chemiluminescence emission observed when a reagent containing luminol (5- amino-2, 3-dihydro-1, 4-phthalazine-dione) and hydrogen peroxide is sprayed on a bloodstain has been widely utilised by forensic scientists worldwide in investigations involving violent crime.16
The instrumentation required for monitoring liquid phase chemiluminescence reactions is relatively simple and inexpensive. The most important component of the instrument is the light detector, which traditionally has been the photomultiplier tube (PMT). Solid state devices for the detection of light [e.g., the photodiode and the charge coupled device (CCD)] are more robust than PMTs. Photo diodes are inexpensive, small, and rugged and have low power requirements (<15 V DC). Red and blue/UV sensitive photo diodes are available, and with careful instrument design, they can give sensitivity comparable to PMTs. CCDs have found application for imaging, particularly in astronomy, and their use for spectroscopy is increasing.
Batch luminometers are widely available with various degrees of automation. In a typical instrument, a fixed volume of reagent is injected into a tube containing the sample. This type of instrument is well-suited to monitoring reactions that are selective and have a high quantum yield and/or a long lifetime (e.g., bioluminescence reactions); however, many of the most analytically useful chemiluminescence reactions are too fast to obtain precise results using batch methods. For these reactions, other approaches to liquid handling are required.
Flow Analytical Techniques One well-established sample-handling technique for laboratory analysis is flow injection (FI).17 This technique has been defined as the injection of a liquid sample (10-200 µl) into a moving, nonsegmented continuous carrier stream of a suitable
170 Illinois Law Enforcement Executive Forum • 2002 • 2(3) liquid. The injected sample forms a zone, which is then transported to the detector via conduits constructed of PTFE tubing (0.3-0.8 mm internal diameter). The sample is modified by reaction with reagents merging with the main carrier stream. The response at the detector is in the form of a peak, the dimensions of which are directly related to analyte concentration. A schematic diagram of a typical FI instrument (manifold) is shown in Figure 1.
Figure 1. Schematic Diagram of an FI Manifold
Components: (a) peristaltic pump, (b) injection valve, (c) T-piece (mixing point), (d) detector [lines represent PTFE tubing (0.5 mm i.d.) (reproduced from ref 12)]
Automated flow injection systems have been applied to online process analysis in industrial and environmental situations with a great deal of success. FI is ideally suited to monitoring chemiluminescence reactions because of the rapid and reproducible mixing of sample and reagent that can be achieved in close proximity to the detector, which results in maximum sensitivity and reproducibility for weak and short-lived emissions.
We have used FI and its close relative, sequential injection analysis (SIA), to determine a wide range of analytes, from pharmaceuticals to neurotransmitters.6-11 One key area of our research has been the development of methodologies for the determination of opiate alkaloids in process streams. Morphine and codeine are extracted from opium poppies by a proprietary process involving a series of aqueous and solvent extractions. Control of the alkaloid concentration is most important as this directly influences manufacturing capacity and efficiency, which in turn necessitates rapid, selective, and reliable procedures for process analysis. Analytical methodology for the analysis of these process streams involves manual removal of samples to a laboratory followed by liquid chromatography. This leads to long analysis times (2 analyses h-1), which does not allow real-time process monitoring and control. An alternative is to use a procedure based on FI with samples drawn directly from the process stream into the instrument (online analysis).
We utilised two chemiluminescent reactions with our FI systems, namely (i) the reduction of acidic potassium permanganate in the presence of polyphosphates and 3+ (ii) the reduction of tris (2, 2´-bipyridyl) ruthenium (III) (Ru(bipy)3 ):
(i) Analyte KMnO4/H+/polyphosphates [manganese species]* products + light (680 nm)
3+ Ru(bipy)3 2+ (ii) Analyte [Ru(bipy)3 ]* products + light (610 nm)
2+ 18 [Where [manganese species]* and [Ru(bipy)3 ]* are excited species].
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 171 The two main alkaloids of interest, morphine and codeine, differ markedly in the observed relative emission intensities. Morphine gives a bright flash of light upon reaction with acidic potassium permanganate while codeine elicits no chemiluminescent signal with this reagent. Codeine, however, gives a bright 3+ emission with the (Ru(bipy)3 ) complex while morphine gives only a barely measurable signal at high pH. This is remarkable considering the close structural similarity between these two compounds at a molecular level (see Figure 2).
Figure 2. Chemical Structures of Morphine and Codeine
Note that both molecules only differ in the top left hand corner of these structures (-OH group in morphine, -OCH3 group in codeine).
Taking advantage of this serendipitous result, we developed selective FI procedures with chemiluminescence detection for the determination of morphine and codeine employing the respective chemiluminescence reagents discussed previously. In both cases, the methodology was validated with actual process stream samples and good agreement was found between our new chemiluminescence assays and the standard liquid chromatographic methodology.
As can be seen from Figure 2, morphine and codeine are similar in molecular structure, making the difference in their reactivity difficult to rationalise. We have also found that other structurally similar alkaloids (see Figure 3) give light with these reactions and that reaction conditions have a significant effect on the emission intensity and lifetime.19, 20
172 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Figure 3. Chemical Structures of Opiate Alkaloids
Diamorphine (heroin), acetylcodeine, thebaine, papaverine and noscapine give 3+ chemiluminescence with Ru(bipy)3 while 6-O-monoacetylmorphine gives chemi- luminescence with acidic potassium permanganate.
Investigations into the relationship between the molecular structure and environment of the papaver alkaloids and their chemiluminescence activity with both acid potassium permanganate and tris (2, 2’-bipyridyl) ruthenium (III) are ongoing at Deakin University, and we have established a structure activity relationship that allows us to predict with a high degree of certainty whether an analyte will give chemiluminescence with either of the two reagents named above. Under what conditions an analyte will give optimal chemiluminescence (with relation to both lifetime and intensity) still has to be established by experimentation.
Separation Techniques Chemiluminescence can also be used as a detection system for separation techniques such as high performance liquid chromatography (HPLC) and capillary electrophoresis (CE). Indeed, one of the first reports of the analytical use of the acidic potassium permanganate reaction was for detection of morphine in forensic samples after separation by HPLC.21 CE offers unrivalled separating power for a wide range of analytes; however, it also suffers from relatively poor detectability using ultraviolet- visible spectrophotometry. This is a particular failing when applied to forensic samples in which the analytes of interest may only be present in trace amounts.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 173 As has been mentioned above, one of the main driving forces behind research into chemiluminescence detection has been the potential for very low detection limits. With this in mind, a number of research groups have attempted to develop chemiluminescence detection systems for CE.14 The main problem has been with the coupling of the separation capillary to a postcapillary reactor in order to mix the capillary effluent with chemiluminescence reagents immediately prior to detection. We have developed a chemiluminescence detection system for CE that has proven to be robust, and in combination with the previously described acidic potassium 3+ permanganate and Ru (bipy)3 reactions it has been applied to the determination of low levels of opiate alkaloids in process liquors (see Figure 4).
Figure 4. (a) Schematic diagram of the capillary electrophoresis instrumentation coupled to the chemiluminescence detection system (b) Electropherogram of opiate separation using acidic potassium permanganate chemiluminescence, (A) morphine, (B) oripavine (C) pseudomorphine (Reproduced from Barnett, N. W., Hindson, B. J., & Lewis, S. W. (2000). Determination of morphine, oripavine and pseudomorphine using capillary electrophoresis and acidic potassium permanganate chemiluminescence detection, Analyst, 125, pp. 91-95.)
As would be expected, the chemiluminescence detection was more sensitive than conventional UV-absorbance, with the detection limits for morphine, oripavine, and pseudomorphine being an order of magnitude lower using the acidic potassium permanganate reaction.
Pulsed Flow Chemiluminescence Analysis In forensic science, the rapid characterisation of drug seizures is vitally important in the ongoing fight against drugs. Over the last decade, there has been an increasing demand for onsite chemical measurement in fields as diverse as industrial process analysis, environmental monitoring, clinical diagnostics, and the forensic sciences. This demand has translated into a search for robust instrumentation capable of
174 Illinois Law Enforcement Executive Forum • 2002 • 2(3) producing results in real time and often in a continuous (or near continuous) manner. Hand in hand with this search has been a drive towards miniaturisation of analytical processes. Reduction in size of instrumentation has a number of advantages including enhanced portability, improved safety due to small reagent volumes, and the potential for enhanced levels of automation. In addition, miniaturised analytical systems are inherently environmentally benign due to the use of minimal amounts of reagents and the production of negligible volumes of waste. Robust miniature (handheld) instrumentation, which is capable of rapid assays of drug seizures by nonlaboratory trained staff in the field, would add another dimension to the provision of intelligence to the police and other law enforcement agencies.1, 2 Recently, we have developed an instrument based on the principles of pulsed flow chemistry, which shows great promise in such a role.11
Pulsed flow chemistry,22 has been developed by the Australian company Precision Devices as an alternative approach to solution handling in flow-based analysis techniques. The pulsed flow module utilises short pressure pulses to generate bursts of solution flow interspersed with relatively long periods when the solution remains static within the conduits of the instrument. The precise timing of the continuous pulsing, achieved via computer automation, combines reproducible flow characteristics with overall flow rates comparable to conventional pumping units in a compact device highly suited for miniaturised flow systems. This solution propulsion device also features the ability to dictate the solution ratio in each pulse by controlling the opening of orifices through which the two solutions flow. This simplifies the flow analysis manifold by eliminating the requirement for an injection valve to introduce the sample and allows a variety of analysis modes. This fact is demonstrated by Wang et al. who replicated flow injection, continuous flow, and flow titration with potentiometric detection, simply by changing software settings (see Figure 5).22
Figure 5. Analysis Modes Possible with Pulsed Flow Chemistry (FI = flow injection, CF = continuous flow)
Analytically useful chemiluminescence reactions such as the reduction of acidic potassium permanganate require rapid mixing in close proximity to the detector in order to achieve sensitive and precise analyses. Owing to the fast, efficient mixing resulting from the turbulent flow generated through the orifices in the pulsed flow device and the possibility of immediate presentation of the reacting zone to the detector cell due to the miniaturised components, pulsed flow
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 175 chemistry is ideally suited to solution handling in chemiluminescence assays. We have recently demonstrated this by utilising the acidic potassium permanganate reaction to determine morphine in process samples using a prototype pulsed flow chemiluminescence analysis instrument.11
The pulsed flow chemiluminescence analyser that is currently under development produces low volumes of waste (µL as opposed to mL for conventional FI) and is able to achieve high analytical frequencies (greater than 60 analytical cycles per hour). The instrumentation is compact, light (less than 1 kg.), and has fewer moving parts when compared to a conventional flow analysis system. One manifold may be switched between various modes of flow analysis (flow injection, continuous flow, stopped flow) through software without physical reconfiguration. In addition, the instrument is low voltage and only requires a 12 V battery for operation. These characteristics of pulsed flow chemistry make this approach to solution handling for analytical chemiluminescence an ideal candidate for automated portable instrumentation. We have been examining the application of this instrumentation in combination with the acidic potassium permanganate and tris (2, 2’-bipyridyl) ruthenium (III) reactions for the determination of opiates. Using the instrument, we can determine codeine in the -1 3+ presence of morphine down to the level of 6 µg L using the Ru (bipy)3 reaction. Our preliminary results from the analysis of drug seizures show that we can distinguish between different seizures qualitatively.20
The Future? Our studies into the application of liquid phase chemiluminescence detection to forensic analysis are at an early stage. Our initial studies have concentrated on the opiate drugs of abuse;20 we are now beginning to move beyond that field to investigate other potential target analytes. In addition to new chemistries, we are also investigating novel approaches to carrying out chemiluminescence analyses particularly in the field. For example, heroin is highly variable containing different proportions of a number of other papaver alkaloids including 6-O-monoacetyl morphine, acetyl codeine, and noscapine. The proportions of each of these contaminants can aid in identification of a particular source of heroin.1, 5, 23 Each one of these opiates gives chemiluminescence with either acidic potassium permanganate 3+ or Ru (bipy)3 ; however, the exact reagent conditions (such as reaction pH), which give a detectable emission, vary for each opiate. It can be envisaged that a testing protocol could be developed that enables the determination of the proportions of different opiates within a heroin seizure to give an approximate profile or chemical “fingerprint.” This information would be available to the investigator at the scene of the seizure in short order. It should be noted that this in no way would replace the more detailed analysis that would be obtained from the laboratory for use in court; it would, however, furnish the investigator with useful intelligence at an early stage in a criminal investigation.
Looking further into the future, one area in which chemiluminescence has an opportunity to make an impact is as a detection system for the so-called “lab- on-a- chip” devices.24, 25 Industrial and academic interest in this area is high, as evidenced by the establishment of a British consortium of industry and universities to investigate miniature analytical and synthetic systems and the launch of a journal in 2001 devoted to this area of scientific research.26 A key area that needs to be addressed is the method of detection. “Lab-on-a-chip” devices have
176 Illinois Law Enforcement Executive Forum • 2002 • 2(3) extremely small detection volumes and suffer from the same detectability issues as CE. Already several workers in this field have shown that chemiluminescence is a viable detection technique for these devices; for example, Gillian Greenway et al. at the University of Hull successfully determined codeine with a microflow 3+ 26 device by reaction with Ru (bipy)3 .
Endnotes 1 Liddy, M., & Pearson, J. (2000, December). Victoria Forensic Science Centre, private communication.
2 Sims, N. (2000, December). South Australian Forensic Science Centre, private communication.
3 Australian Institute of Criminology. (2002, April). Australian alcohol and illicit drugs. [online]. Available:
4 Victorian Institute of Forensic Medicine. (2002, February). Heroin related deaths in Victoria 1999-2002. [online]. Available:
5 Cole, M. (1998). Drugs of abuse. In P. White (Ed.), Crime scene to court (pp. 210- 231). Cambridge: Royal Society of Chemistry.
6 Barnett, N. W., Rolfe, D. G., Bowser, T. A., & Paton, T. W. (1993). Determination of morphine in process streams using flow injection analysis with chemiluminescence detection. Analytica Chimica Acta, 282, 551-557.
7 Barnett, N. W., Bowser, T. A., Gerardi, R. D., & Smith, B. (1996). Determination of codeine in process streams using flow-injection analysis with chemiluminescence detection. Analytica Chimica Acta, 318, 309-317.
8 Barnett, N. W., Hindson, B. J., & Lewis, S. W. (1998). Determination of 5- hydroxytryptamine (serotonin) and related indoles by flow injection analysis with acidic potassium permanganate chemiluminescence detection. Analytica Chimica Acta, 362, 131-139.
9 Barnett, N. W., Hindson, B. J., Lewis, S. W., & Purcell, S. D. (1998). Determination of codeine, 6-methoxycodeine and thebaine using capillary electrophoresis with tris (2, 2’-bipyridyl) ruthenium (II) chemiluminescence detection. Analytical Communications, 35, 321-324.
10 Barnett, N. W., Hindson, B. J., & Lewis, S. W. (2000). Determination of morphine, oripavine and pseudomorphine using capillary electrophoresis and acidic potassium permanganate chemiluminescence detection. Analyst, 125, 91-95.
11 Lewis, S. W., Francis, P. S., Lim, K. F., Jenkins, G. E., & Wang, X. D. (2000). Pulsed flow chemistry: A new approach to solution handling for flow analysis coupled with chemiluminescence detection. Analyst, 125, 1869-1874.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 177 12 A good source of information on the history of chemiluminescence can be found in A History of Luminescence by E. N. Harvey (American Philosophical Society, Philadelphia, 1957). Photographs of chemiluminescence reactions can be found by following the links from
13 Boyle, R. quoted in The Shocking History of Phosphorus by John Emsley, Pan, 2000, pp. 34-42.
14 There are a number of texts on the analytical use of chemiluminescence; the most recent is A. M. Garcia-Campana & W. R. G. Baeyens (editors), Chemiluminescence in Analytical Chemistry, Marcel Dekker, New York, 2001.
15 Greenway, G. M., Knight, A. W., & Knight, P. J. (1995). Electrogenerated chemiluminescent determination of codeine and related alkaloids and pharmaceuticals with tris (2, 2’-bipyridine) ruthenium (II). Analyst, 120, 2549- 2552.
16 Laux, D. L. (1998). The detection of blood using luminol. In S. H. James & W. G. Eckert (Eds.), Interpretation of bloodstain evidence (2nd ed.). Boca Raton: CRC Press.
17 There are a number of texts describing flow injection analysis and related techniques; one example is Martinez Calatayud, J. (1996). Flow injection analysis of pharmaceuticals: Automation in the laboratory. London: Taylor and Francis.
18 For reviews of the analytical application of these two reactions, see Barnett, N. W., Gerardi, R. D., & Lewis, S. W. (1999). The analytical applications of tris (2, 2’-bipyridyl) ruthenium (III) as a chemiluminescent reagent: A review. Analytica Chimica Acta, 378, 1-41 and Hindson, B. J., & Barnett, N. W. (2001). Analytical applications of acidic potassium permanganate as a chemiluminescent reagent. Analytica Chimica Acta, 445, 1-19 (acidic potassium permanganate).
19 Barnett, N. W., Gerardi, R. D., Hampson, D. L., & Russell, R. A. (1996). Some observations on the chemiluminescent reactions of tris (2, 2’-bipyridyl) ruthenium (III) with certain papaver somniferum alkaloids and their derivatives. Analytical Communications, 33, 255-260.
20 Agg, K. M., Anastos, N., Barnett, N. W., Lewis, S. W., & Pearson, J. (in press). The application of chemiluminescence to the forensic detection and quantification of opiates. Analytica Chimica Acta.
21 Abbott, R. W., Townshend, A., & Gill, R. (1997). Determination of morphine in body fluids by high-performance liquid chromatography with chemiluminescence detection. Analyst, 112, 397-402.
22 Wang, X. D., Cardwell, T. J., Cattrall, R. W., & Jenkins, G. E. (1997). Pulsed flow chemistry. A new approach to the generation of concentration profiles in flow analysis. Analytical Communications, 35, 97-102.
23 Siegel, J. A. (1988). Forensic identification of controlled substances. In R. Saferstein (Ed.), Forensic Science Handbook (p. 99). Englewood Cliffs: Prentice Hall.
178 Illinois Law Enforcement Executive Forum • 2002 • 2(3) 24 Baker, P. (1999). Instrumental changes in chemistry 2000, Royal Society of Chemistry, 27.
25 Fletcher, P., & Haswell, S. (1999). Downsizing synthesis. Chemistry in Britain, 35(11), 38-45.
26 Greenway, G. M., Nelstrop, L. J., & Port, S. N. (2000). Tris (2, 2’-bipyridyl) ruthenium (II) chemiluminescence in a microflow injection system for codeine determination. Analytica Chimica Acta, 405, 43-50.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 179 180 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Insider Diversion: Profiling the Anthrax Attacks
Paul De Armond, Research Director, Public Good Project, Bellingham, Washington
Summary The anthrax attacks that followed September 11, 2001 caught the nation’s attention and left law enforcement officials searching for answers. This article attempts to limit the pool of potential suspects through profiling.
The anthrax attacker’s access to weaponization technology, virulent cultures, and immunization is strongly indicative of an “insider” diversion from a government program by an idiosyncratic terrorist. This means the most probable and productive pool of suspects are people who were employed in weapons research.
The individual or group responsible for these crimes has the following characteristics:
• Had access to anthrax weaponization technology • Had access to Ames strain anthrax cultures originating at USAMRIID • Was vaccinated for anthrax • Used good biological containment facilities during the purification and weaponization
This combination of characteristics drastically reduces the potential pool of suspects, particularly if all the crimes contributing to the anthrax attacks were committed by a single individual. The known characteristics of the attacker strongly suggest that he or she was employed in a weapons-related facility. The number of facilities where biological weapons research is conducted is small. Likewise, the number of personnel who received anthrax immunization is traceable through personnel records. This picture of the attacker is admittedly speculative, but it provides a clear investigative strategy of locating and interviewing a manageable pool of potential suspects. It also provides the most obvious and uncomplicated picture of the attacker without dragging in unwarranted or speculative assumptions.
Four Crimes, Not One The anthrax-by-mail attacks are the culmination of a series of distinct crimes. Any prosecution for these attacks will have to address at least four criminal acts. Examining these crimes individually may reveal a pattern of events that will lead to the perpetrator. There are four separate and distinct groups of crimes required to use anthrax as a weapon:
1. The diversion of the weaponization technology 2. The diversion of the anthrax culture 3. The production of weaponized anthrax 4. The delivery of the anthrax to commit murder
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 181 The three preliminary crimes have received remarkably little attention in the media but are probably more fertile grounds for developing leads than working backwards from the targets of the attacks. The overlap between the four crimes must home in on the perpetrators. The public almost certainly has valuable information regarding the preliminary crimes, if they only knew what was significant. Since they have not been adequately educated about what constitutes suspicious circumstances, however, they are unlikely to spontaneously come forward with leads which will help identify the culprits. Any adverse consequences of publicizing the full profile are substantially smaller than the risk of potential mass casualty attacks.
The Technology Diversion The technique for preparing weaponized anthrax is a closely guarded military secret. It is not something that can be easily discovered by trial and error, nor is it information which can be pieced together from open sources. The published facts suggest the technology was diverted from a weapons-related project, probably in the last seven years. While it is possible that the attacker(s) obtained the technology and critical materials from outside of the United States, the available information about the weaponization process used in the attacks indicates the technology diversion probably took place within the United States and involves information originating from government-operated or -sponsored facilities. In December, the White House and the FBI made vague statements acknowledging domestic involvement in the attacks.
In the November 2000 issue of the National Domestic Preparedness Office newsletter, Col. William C. Patrick III (ret.), the former chief of the military bioweapons production program, stated that the knowledge necessary to create charge- suppressed aerosol powders “rests with me and possibly two other people from the old program.” This statement is now known to be false. Small quantities of weaponized anthrax have been routinely produced at Dugway Proving Grounds for many years. At the time Mr. Patrick briefed the FBI, he knew of these activities, since he had provided Dugway with information about older weaponization processes. A more accurate estimate of the number of people with access to Ames, technical knowledge, and the ability to use it is in the dozens.
There are not a large number of facilities in the United States engaged in biological weaponization research. The various government facilities like Dugway Proving Ground, Los Alamos National Laboratories, Nevada Test Site, Pine Bluff and Fort Detrick, and quasi-civilian facilities like Battelle Laboratories have been mentioned in public reports. Similarly, there are reports of bio-weapons programs within intelligence agencies using civilian contractors. The recent revelations about Project Jefferson, Project BACHUS, and Project Clear Vision show weapons-related programs are currently underway, sometimes without oversight by Congress and the Executive Branch.
Present and former personnel engaged in anthrax weapons research should be identified, located, and interviewed. Investigative teams should include technically oriented personnel with experience in the biological weapons field, arms control, or biological weapons intelligence. Nine months into the investigation, it has become clear that the FBI has experienced great difficulty in mobilizing adequate technical expertise to assist the investigation. According to several biological warfare experts,
182 Illinois Law Enforcement Executive Forum • 2002 • 2(3) the FBI was reluctant to use their services until they had been investigated for possible complicity in the attacks, an indication that the FBI had not developed an adequate pool of expert advisors, despite being involved in biological investigations since the mid-1990s.
The Diversion of Anthrax Culture The specific Ames strain of anthrax used in the attacks is not widely available. Highly sensitive DNA testing using both genomic sequencing and polymerase chain reaction have positively identified the anthrax used in the attacks as originating at the USAMRIID facilities at Ft. Detrick. The results of these tests were available to the investigation sometime in February or early March, though the publication of the scientific findings was delayed for several months. Several nonmilitary facilities possessing virulent anthrax have been mentioned in the media, including the University of Utah, the University of Texas, the University of Louisiana, Northern Arizona University, and the FDA biolevel-3 labs at Plum Island, as well as the private BioPort facility in Lansing, Michigan where vaccine is produced under contract to the Department of Defense. Many of the nonmilitary facilities employ personnel previously employed in weapons research. There probably are other facilities in the United States in which the weaponization process was known or studied. Subpoenas have been issued for samples of anthrax from some research facilities.
According to the Washington Post, approximately two dozen facilities in the United States possess this strain. This number is enormously smaller than was first assumed. Earlier reports had falsely claimed over 150 facilities in the United States possess cultures of the strain used in the attacks. The revised number increases the likelihood of a link between the technology diversion and the diversion of the anthrax culture. Given the simplicity and ease of single-cell culture techniques, the diversion could be as simple as concealing a single swab.
The attacker’s success at obtaining a virulent culture favored for weapons-related research deserves attention in pursuing the investigation. The diversion of anthrax culture, combined with the diversion of the weaponization technology and the probable immunization of the person or persons producing the material used in the attacks makes it likely that these three factors are related to each other.
The Production of Weaponized Anthrax As early as late October, sufficient information about the anthrax used in the attack had been publicly available to reconstruct many of the steps the attacker followed. In very broad outlines, the stages are obtaining a pure culture of the Ames strain which originated at USAMRIID, growing a quantity of live vegetative cell anthrax and then forcing it to turn into dormant spores, separating the spores from the vegetative cells and other fermentation products, and drying the purified spores into a fine powder. The entire process requires considerable technical expertise and specialized knowledge. The first two stages are hazardous, but not unusually so. Living anthrax bacteria are dangerous pathogens but can be contained by normal biological procedures. Once the bacteria forms spores, the material is extremely hazardous. The process of purifying and drying the spores involves dangerous procedures requiring extraordinary care to keep the material contained (see diagram below).
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 183 The recovered anthrax powder has differed in particle size. The New York material is larger and only skin infections were associated with this material. The Florida and Senate material was finer and more readily aerosolized and reportedly possessed anti-static and secondary aerosol characteristics. Epidemiological evidence indicates the New York and Florida letters were mailed at the same time. Taken together with information about the production process, it appears likely that there was only one batch of anthrax, but it varied in particle size and purity. If this is the case, the sequence of filling the envelopes was probably New York, Florida, Senate.
The differing physical characteristics and very small amounts contained in the letters strongly suggest that the New York and Senate samples was produced as a single batch. The variation in particle size and contamination by vegetative cells may be due to the natural process of particles separating by size and the fact that sporulation was incomplete. The relatively low sporulation shown by the vegetative cell contamination contrasts with the sophistication of the weaponization process, an interesting feature worthy of further investigation.
The use of chemical additives during the weaponization process was confirmed by Major General John Parker at a series of Homeland Security press conferences in late October and early November. The formulation of these additives is known to the investigators from Energy Dispersive Spectroscopy (EDS) testing performed on the Daschle sample. The use of these additives is the most significant clue to come to light so far. The particular combination of additives is a military secret and dramatically reduces the number of suspects. The access to Ames strain is relatively broad compared to the technical knowledge of specific weaponization methods.
Once weaponized as a dry powder, anthrax is remarkably stable. The amount of time between the 9/11 jetliner attacks and the first mailing of the anthrax in mid-October is too short to accomplish all of the steps outlined above. It is a reasonable inference that the attacker’s initial crimes occurred before the 9/11 attacks, perhaps years earlier. It is possible that the material used in the attacks was already produced and in storage long before the attacks. To date, no information regarding the time-frame of the anthrax production has emerged from the investigation. If such evidence exists, it will be most likely to come from the New York Post material.
The Attacker’s Safety Precautions The production location has demonstrated adequate containment facilities. There are no known incidents of infections related to the attacker’s production processes. Considering the extent of the cross-contamination through the postal system and the mysterious death of Kathy Nguyen in New York, this suggests a high degree of competence on the part of the person or persons involved in the weaponization process. The FBI’s success in constructing an expedient containment facility for handling the quarantined mail containing the Leahy letter demonstrates the degree of care necessary to prevent accidental exposure.
184 Illinois Law Enforcement Executive Forum • 2002 • 2(3) The people or person producing and handling the anthrax must take prophylactic measures to prevent their accidental infection by contamination. Antibiotics and immunization provide differing degrees and periods of protection. Taking large doses of antibiotics over an extended period of time may lead to drug reactions and provides less than 90% protection against infection.
The use of antibiotics as a prophylactic measure is risky and limited in duration. The more likely alternative is that the attacker(s) were immunized against anthrax within the last year—at least in regards to filling the letters. As noted above in the sections about the criminal diversion of the weaponization technology and the Ames culture, the suspects may have worked in a research facility that handles anthrax. If so, they may also have been immunized against anthrax. Anthrax vaccination provides protection for a limited period of time, and annual booster shots are required to maintain maximum immunity.
The FBI has recently announced that it will polygraph approximately 200 past and present employees at Ft. Detrick and Dugway Proving Ground who received anthrax immunizations. If the intent is to polygraph all personnel in contact with anthrax research in the recent past, the number is too small. Before the Gulf War, the reported total U.S. consumption of anthrax vaccine was about 500 doses per year (almost entirely by research personnel). This consumption indicates a pool of 200-300 people at that time, assuming an average tenure of five years. After the Gulf War, the amount of research expanded as is indicated by increased budget figures. The particle size of the attacker’s anthrax suggests a drying process reportedly not researched by the United States until sometime during or after 1994, extending the window of investigation back at least seven years. Assuming 20% annual turnover in personnel, one arrives at the conclusion of less than 100 people having access to the Ames strain at any particular time. It is also apparent that the polygraphing is not comprehensive of all immunized research personnel, much less civilian contractors.
Conclusions The series of criminal acts involved in the anthrax letter attacks, the contents of the letters, and the sequence of targets suggest the anthrax attacker . . .
• Was employed at some time at a facility possessing the technical information necessary to prepare weaponized anthrax. • Received anthrax immunization in the course of employment. • Had access to the Ames strain of anthrax. • Had a well-contained production facility for making weaponized anthrax.
The diversion of biological weapon technology and culture material points to a possible breach in security. If, as published reports suggest, the technology used to prepare the weaponized anthrax used in the recent attacks is consistent with the favored weaponization technology closely held by the U.S. government, this is a serious problem. First of all, the facts suggest the penetration of a facility or program that should be highly secure. Secondly, the attacks constitute a serious proliferation issue. In addition, the consequences to U.S. domestic and foreign security policy initiatives have already been severe, as demonstrated by the U.S.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 185 announcement of its intent to unilaterally withdraw from the Biological and Toxin Weapons Convention (BWC).
The withdrawal of the United States from the BWC is tantamount to an admission that biological weapons research programs continue to operate in the United States. It should be further noted that the U.S. withdrawal from the convention severely restricts U.S. participation in multilateral investigations of other countries’ biological warfare programs.
The purpose of the attacker was to demonstrate capability, rather than to inflict mass or catastrophic casualties. It appears the attacker’s supply of weaponized anthrax was limited, and he or she sought to maximize the financial and psychological impact of the attacks. The attacker’s assumed lack of continued access to production, while something to be devoutly wished, does not lessen the risk of attacks in the future. Only the apprehension of the attacker can resolve the danger.
It has been stated that the tactics of enclosing warnings in the letters shows that the attacker did not intend to commit murder. This is nonsense. The death of Robert Stevens was public knowledge before the Senate letters were mailed. The attacker knew full well that he or she was placing large numbers of people in deadly peril and acknowledged this in the text of the Senate letters. As Brian Jenkins has famously noted, “terrorists want a lot of people watching, not a lot of people dead.” The letter tactics were chosen to maximize the scope of the terrorism, not to limit or avoid casualties.
The longer the period between attacks, the greater the opportunity for the attacker to scale up production or transfer the stolen technology. While there is not a clear indication that the attacker(s) seeks mass or catastrophic levels of casualties, the longer he or she remains free, the greater the risk of further attacks and the greater the potential magnitude of those attacks. The longer this case goes unsolved, the more the risks increase.
The available open source evidence strongly suggests that the attacker had access to specific weaponization technology, Ames anthrax culture from USAMRIID, and probably immunization against anthrax. The one place where all three of these factors originate is a U.S. weapons-related research facility. If, as seems very likely, the anthrax attacks resulted from criminal activity inside government weapons programs, the anthrax attacks are the most serious theft of secrets since Klaus Fuchs stole nuclear weapons plans from the Manhattan Project.
Paul de Armond is a research director at the Public Good Project, a privately- funded research network. He has written about crime and political conflicts that threaten democracy. His most recent works include an analysis of the WTO protests in Networks and Netwar: The Future of Crime, Terrorism and Militancy (Rand, 2001) and a discussion of right-wing domestic terrorism and weapons of mass destruction in Hype or Reality? The “New Terrorism” and Mass Casualty Attacks (Chemical and Biological Arms Control Institute, 2000). In 1995, de Armond was the first news source to identify the Oklahoma City bombing as domestic right-wing terrorism.
186 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Illinois Law Enforcement Executive Forum • 2002 • 2(3) 187 188 Illinois Law Enforcement Executive Forum • 2002 • 2(3) A Tactical Model for High-Risk Warrant Service
Homer C. Hawkins, Michigan State University Catherine L. Montsinger, Johnson C. Smith University
Introduction Between 1976 and 1998, an average of 79 police officers have been murdered each year in the line of duty. Two-thirds of the felons who murdered a police officer had a prior record. The majority of police officers murdered by felons were killed while responding to disturbance calls (16%) or arrest situations (39%) (Bureau of Justice Statistics, 2001).
A great number of police officers have been killed in the line of duty in high-risk situations. In addition, a substantial number have died in situations that appeared to be fairly innocuous. With a universal charge of protecting and serving society, brave men and women continue to risk their lives each day in an attempt to preserve the peace and ensure safety in our towns and cities across America.
It is important for police departments nationwide to have a formal agenda that speaks to the dangers of being a police officer. There is a need to move beyond the enactment of policies in a rudimentary fashion. Each department needs a formalized program that addresses the high-risk issue and also the identification of occurrences that appear not to be dangerous but could have a lethal outcome. The Charlotte-Mecklenburg Police Department (CMPD) in Charlotte, North Carolina has developed a program that focuses on high-risk warrant service. It exemplifies the way high-risk encounters can be addressed in order to make the job of every police officer more effective and safer.
Why Adopt a High-Risk Warrant Service Training Program Gone are the days when departments had the luxury of having officers solely dedicated to the serving of warrants. The CMPD ended the warrant officer classification some ten years ago. Today, the serving and execution of both arrest and search warrants largely falls to the frontline officer. The Special Services Bureau took the initiative in 1997 to design and conduct special training in the service of high-risk warrants (Neimeyer, 1997). Although the department has no fatalities associated with this activity to date, it is recognized that Southern law enforcement officers are more likely to face felonious assaults and homicide than officers in other regions (FBI, 2000). Warrant service has always been unpredictable, but with the widespread ownership of guns, coupled with willing assailants, the necessity of such training is even more critical. In self-report studies, it is recorded that 42% of Americans report having a gun in their home, and in the South that rises to 52%, topping all other regions of the nation (Bureau of Justice Statistics, 2001).
It is estimated that one-third of all CMPD warrants fall into the high-risk category (J. Baker, personal communication, June 20, 2002). Special personnel such as Special Weapons and Tactics (SWAT) or vice operatives serve warrants that are clearly high- risk. Frequently though, these elite teams are assisted by uniformed patrol officers
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 189 as backup. For this reason, the training has been made available to all sworn officers irrespective of rank or assignment. SWAT, vice, street drug interdiction, and street crime units were the priority trainees at the initial adoption of the program; however, one- third of the department’s sworn personnel, approximately 500 officers, have completed the three, eight-hour days of training. The training has become so successful that the department has become a resource for training local, state, and federal agencies.
Identifying a High-Risk Warrant Training begins with the basic rationale for participating in such an exercise. The absence of a demonstrated need such as death or injury during the serving of a warrant does not diminish the need for this training. Officers must never mistake good luck for good tactics. It is commonly understood that when one lets down his or her guard and proceeds in a routine fashion, that is when one is most vulnerable to danger.
Routine police behavior is often based on the repetitive teaching of policies and procedures. Paramount to this training is to teach skills and technique, not policy. When an officer resorts to a standard operating procedure, he or she may be missing the element of danger not covered in a procedural policy. Officers must always be flexible and able to adapt their procedure to the circumstance at hand. For this reason, all warrants cannot be served in the same manner. Beware of repetition in training because it trains officers to drop their guard and rely on choreographed movements and tactics rather than on-the-scene assessment and response.
To assess the degree of risk associated with a warrant, consider the following elements:
The subject • Does the subject have prior charges or convictions for violent offenses? • Apart from formal records, does the subject have a history of violent behavior as reported by informants or other officers? Does he or she have a reputation as being impulsive, aggressive, or “trigger happy”? • Is there evidence or even a suspicion that the subject may be armed? • Is the subject involved in drug sales and/or usage? • Does the subject have practical knowledge of law enforcement tactics thereby being forearmed for your approach?
The structure • Is this a fortified structure wherein the occupant has taken extraordinary measure to ensure security from outsiders? • Is this structure home to outlaw groups such as biker clubs or street gangs? Is it a drug house or a haven for counterculture elements (e.g., a terrorist or other extremist group)?
The officer • The officer’s senses go a long way in assessing the risk factor. The sixth sense that a savvy officer develops on patrol should never be underestimated or ignored. • What is the officer’s confidence in the reliability of the informant’s information about this subject and structure?
190 Illinois Law Enforcement Executive Forum • 2002 • 2(3) The Technique
Planning The very nature of search and arrest warrants allows officers a reasonable amount of time to do some preplanning before execution. North Carolina search warrants have a relatively short life, 48 hours. Even this short period offers some planning opportunity. It is important to be sure all operatives have a clear understanding of the mission objective, and there needs to be a proper briefing before execution.
A good checklist for the planning process is as follows:
• Do a site survey, diagramming the structure and approach. Identify the best route to the target within. This step requires surveillance before and during the warrant execution. Don’t rely solely on informants for your details. • Keep the plan simple and flexible; this reduces confusion once the execution begins. Allow officers to react to unforeseen circumstances that, undoubtedly, arise once the action takes place. Remember, don’t rely on rehearsed procedures; there is no such thing as a routine warrant service. Have a contingency plan for any possible unexpected occurrences that you are reasonably able to predict. • Use only equipment you have trained with; now is not the time to try out new- fangled gadgets or technology that others are using but with which you lack familiarity. • Clearly identify all police participants. Those not in uniform should be wearing bold markers identifying them as police.
Types of Clears The first type of structure clear is known as slow and deliberate. This is associated with scenarios that have a less urgent quality to them. In these, officers have time to methodically enter and secure a premise for a search or the seizure of a suspect who may be holed up in the structure. Officer safety is foremost in this action as officers move from one room to the next, thoroughly securing each before proceeding to the next and taking the utmost care in checking every possible hiding place.
The second type of structure clear is the law enforcement or conventional. This is the typical structure entry officers are taught in the academy. The level of threat is low, but officers must be aware of the flash potential for encountering a perpetrator as they move through this scene. Seeking adequate cover for oneself and identifying places a suspect may be concealed are the basic premise of this action.
The third type of structure clear is known as dynamic action and is the one for which training is the most critical in high-risk warrant service. It is based on the Special Air Service (SAS) model developed by the British military. Dynamic action is applicable to drug raid warrants, the rapid take-down of vehicles, or other scenarios in which hostages are at risk, evidence may be destroyed, or dangerous persons could mobilize a counter assault.
The elements of dynamic action are speed, surprise, and shock action. The technique requires the prioritization of threats, the greatest threat being any person(s) in the structure. Second is an open door, third, a closed door.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 191 The basics of this technique begin with the first entrant moving to the first immediate threat encounter upon entry. The second entrant covers the officer in front of him or her until all immediate threats are neutralized. Then, he or she proceeds to the next immediate threat while being covered by the third entrant and so on. This sequential process continues as the entire team moves through the structure securing each threat until the structure is secured and all threats are neutralized. Once this is complete, officers can leisurely search the structure.
This tactic requires training in groups. Repetition in training increases the mastery of trainees, but once again, it is critical not to choreograph movements. Trainers assign initial entry positions only. Once inside the structure, the officers must learn to assess and act upon each unique threat as they encounter it, not relying on a choreographed script.
Some additional concepts not to be overlooked in dynamic action clear training are as follows:
• Always have two persons to a room. • Do not proceed past a noncleared area or unsecured person. • Maintain control of all persons in the structure. • Have back up available. • Never “button hook” or criss-cross in front of other officers. • Avoid multiple entries on the same level. • Use clear verbal commands in an audible voice when confronting a subject. When communicating with other law enforcement, also use clear language, and avoid code words unless the meaning is unmistakable. • Move along walls avoiding the middle of the room. • Discuss shots fired or barricades encountered.
Resources to Facilitate Training Police administration must recognize the critical nature of such training and encourage and facilitate all sworn personnel to take the training. While dynamic action clears in particular are often executed by tactical teams such as SWAT, training is not wasted on uniformed patrol officers as they sometimes back up these tactical teams. It is also seen as excellent “reminder” training from which all officers, veteran and rookie, alike, can benefit.
The authors were informed that this program requires only a few teaching aids such as an available classroom and a location in which to practice the techniques. In lieu of a field location in which to practice, trainers agreed that the classroom instruction, which could be delivered in a single eight-hour block, had value in and of itself.
If a department wishes to commit the resources, a “shoot house” can be constructed where officers can practice the tactics as they physically move from room to room securing a premise. This roof-less structure provides a gallery venue overhead from which trainers can observe and critique trainees. In lieu of a “shoot house,” it was suggested that the agency might use a vacant home under city control.
Trainers stressed that all participants train as realistically as possible. This means they practice in full standard issue gear commensurate with their assignment be it
192 Illinois Law Enforcement Executive Forum • 2002 • 2(3) patrol, SWAT, or plain clothes. Also, avoid a “play” quality to training; it diminishes the impact and desensitizes officers to the real danger associated with high-risk warrant service. “Simunition” is recommended for uniformed patrol officers, but when officers are highly skilled in such tactics, live ammunition accompanied with full body armor and other assault equipment should be used.
Conclusion This is not meant to be a full guide to training but rather a vehicle to heighten interest in the implementation of such a program. The CMPD has focused attention on high-risk warrant service as well as low-risk situations that can potentially evolve into deadly encounters. This tends to instill in a department a heightened sense of awareness when interacting with individuals in the community. Deadly encounters may or may not be related to the serving of a warrant. All high-risk situations should be handled in a manner that is based on intensive training. Many officers over the years have been killed in high-risk situations. In addition, encounters that appeared not to be high-risk have often evolved into situations that have led to the death of a number of police officers. The training program in place at CMPD sets the tone for its officers in terms of how to handle themselves in the streets. It is the department’s hope that every individual will, eventually, have the opportunity to go through this program. This type of program helps the officer to recognize encounters that are potentially dangerous and to deal with those situations in an appropriate manner.
Admittedly, different departments have varying needs, and perhaps this program as instituted may not be a perfect fit in all cases; however, when used as a guide, most departments would find that what has been implemented at CMPD has many beneficial qualities.
References Bureau of Justice Statistics. (2001). Sourcebook of criminal justice statistics 2000. Washington, DC: U.S. Government Printing Office.
FBI Uniform Crime Reports. (2000). Law enforcement officers killed and assaulted. Washington, DC: U.S. Government Printing Office.
Neimeyer, G. A. (1997). High-risk warrant service. Charlotte, NC: Special Services Bureau. Charlotte-Mecklenburg Police Department.
U.S. Department of Justice, Bureau of Justice Statistics. (2001). Justifiable Homicide by Police, Police Officers Murdered by Felons. Policing and Homicide 1976-1998. Washington, DC: U.S. Government Printing Office.
Homer C. Hawkins is an associate professor in the School of Criminal Justice and of Urban Affairs Programs at Michigan State University in East Lansing, Michigan. His research interests include race and sentencing, police officer burnout, correctional officer burnout, and the relationship of arrest rates for violent crimes to drug arrests.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 193 Catherine L. Montsinger is an assistant professor of Criminal Justice at John- son C. Smith University in Charlotte, North Carolina. She has taught criminal justice for the past 20 years. Her research interests include community policing and other frontline law enforcement issues.
194 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Guidelines for Preparing Manuscripts
There are virtually no restrictions on subject matter as long as the material pertains, in the opinion of the editor, to law-enforcement-related areas. Manuscripts should be typed and double-spaced. A résumé or vitae from the author(s) must accompany submissions. Book reviews and research notes will be considered for publication. No submission will be published until recommended by referees, who will review blind copies.
Final manuscripts must be submitted on 3.5" microcomputer diskettes readable on Macintosh or IBM (and true compatible) computers. Please specify word processing program used when submitting diskettes (e.g., MacWrite 5.0, WordPerfect 5.1, and so on). Also, an ASCII version would be most helpful. Disks will not be returned. Figures and line drawings must be submitted in camera-ready form.
Send three hard-copy manuscripts, vitae(s), and a diskette to . . .
Vladimir A. Sergevnin, PhD, Editor ILE Executive Forum Editorial Office 1 University Circle Macomb, IL 61455 (309) 298-1939; fax (309) 298-2215
Manuscripts should be prepared according to the Publication Manual of the American Psychological Association (5th ed.) (2001). Webster’s Third New International Dictionary (3rd ed.) (1983) is the standard reference for spelling. Contributors are responsible for obtaining permission from copyright owners if they use an illustration, table, or lengthy quote that has been published elsewhere. Contributors should write to both the publisher and author of such material, requesting nonexclusive world rights in all languages for use in the article and in all future editions of it.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 195 196 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Works Published/Produced Through the Illinois Law Enforcement Executive Institute
Emerging Challenges in Illinois Law Enforcement Collective Bargaining, Lewis Bender, Robert Fischer, and Thomas J. Jurkanin, January 2001.
Illinois Law Enforcement Executive Forum Journal, inaugural issue, June 2000.
Methamphetamine Labs: A New Danger for Illinois, 30-minute videotape, produced in cooperation with the U.S. Drug Enforcement Administration, Illinois State Police, through funds from the Illinois Law Enforcement Training and Standards Board.
Small Town Policing in the New Millennium: Strategies, Options, and Alternate Methods, Robin Johnson, author and researcher; published in cooperation with the Illinois Institute for Rural Affairs, March 2000.
Managing a Clandestine Laboratory Enforcement Program, Inspector Thomas McNamara, through a grant from the Illinois Law Enforcement Training and Standards Board, March 1999.
Model Domestic Violence Protocol for Law Enforcement, 1999, through a grant from the Illinois Criminal Justice Information Authority.
Making Empathy Statements to Defuse Conflict and Generate Rapport, Joseph Kulis et al., 1998.
Developing Persona Skills for Community Policing: A Manual for Trainers, Joseph Kulis, 1998.
An Assessment of Municipal and County Computer Crime Investigations in Chicago, Illinois Metropolitan Area, Bradley Byers, 1997.
Identifying the Future of Law Enforcement: 1997 Executive Forum Series Summary of Proceedings and Conference Notes, Illinois Law Enforcement Executive Institute in cooperation with the Illinois Law Enforcement Training and Standards Board, 1997.
Sex Crimes Investigation Course: Train-the-Trainer, Scott Keenan, Susan Welch, Polly Poskin, authors, Illinois Law Enforcement Executive Institute, 1997.
Police Executive’s Perspectives of the Pre-Service Model, Kent Harrington, primary researcher and author, Illinois Law Enforcement Executive Institute, 1997.
Surviving and Thriving as a Law Enforcement Executive in the Twenty-First Century, May 1996, November 1996, June 1997, October 1997, June 1998.
Illinois Law Enforcement Executive Forum • 2002 • 2(3) 197 Model Guidelines and Sex Crimes Investigation Manual for Illinois Law Enforcement, editor, Illinois Law Enforcement Executive Institute and the Illinois Coalition Against Sexual Assault through a grant from the Illinois Criminal Justice Information Authority, 1996.
Illinois Legislative Updates, 1995, 1996, 1997, Kevin Burke, author, Illinois Law Enforcement Executive Institute. (Videotapes produced as well as an annual satellite interactive television program through Educational Broadcasting at Western Illinois University.)
Zero Tolerance, 1994 Illinois Secretary of State Police. (Videotape produced as well as a satellite interactive television program through Educational Broadcasting at Western Illinois University.)
Sexual Assault Investigation Series (three tapes) in cooperation with the Illinois Coalition Against Domestic Violence through a grant from the Illinois Criminal Justice Information Authority, 1996.
1. Preliminary and In-Depth Interview of the Victim of Adult Sexual Assault
2. Evidence Collection
3. Suspect Interview
Domestic Violence Investigations Series (three tapes) in cooperation with the Illinois Coalition Against Domestic Violence and the Illinois Attorney General through a grant from the Illinois Criminal Justice Information Authority, 1997.
1. Obvious Scenario
2. Subtle Scenario
3. Rural Scenario (Orders of Protection)
198 Illinois Law Enforcement Executive Forum • 2002 • 2(3) Subscription to Illinois Law Enforcement Executive Forum Name ______
Organization ______
Address ______
City ______State _____ Zip ______
Country ______
Subscription Categories for 2002-2003 only: Institutional – $40 Personal – $25
Enclosed is a check for $______. Please add $20 for postage outside the U.S.
Subscription to Illinois Law Enforcement Executive Forum Name ______
Organization ______
Address ______
City ______State _____ Zip ______
Country ______
Subscription Categories for 2002-2003 only: Institutional – $40 Personal – $25
Enclosed is a check for $______. Please add $20 for postage outside the U.S. ______
Illinois Law Enforcement Executive Forum 1 University Circle Macomb, IL 61455
______
Illinois Law Enforcement Executive Forum 1 University Circle Macomb, IL 61455