Chapter EightInvestigative PlanProcess, plan, or strategy.In our discussion of criminal investigations, the preliminary concerns have been addressed. Now, it is time to start the process. We considered what an investigation isand how it needs to be initiated. Reactive investigations usually begin with an eventthat indicates someone has been killed, injured, ripped off, or otherwise diminished.The event appears to be the act of another. That person is likely to have broken the lawand should be held accountable for the crime. We defined the laws and the jurisdictionwhere the investigation should occur. We determined which law enforcement agencyis responsible for conducting the investigation. We made sure that the investigativeresponsibilities are clear and the investigator knows what needs to be proven to reacha conclusion.We considered how the investigator’s authority is defined in a free society andwhat the rights are of any person accused of a crime. We understood why those rightsprovide a landscape and process by which the investigation is to proceed. We thenturned our attention to the investigators and decided how a team approach has provensuccessful in the past and how it should be applied to the process going forward.We determined that witnesses are the key sources of evidence. All criminal investigations need to be considered in the human context in which they are defined andsubsequently solved. We discussed witnesses’ concerns for their own safety and forjustice and the adjustment in their responses, which is needed to tell their story appropriately within the criminal justice system of rules and rulings.We considered the logic and science of evaluating the scene of the crime event sothat the investigator can start to use informed speculation and reasonable analysis tobegin an investigation.This same approach and process is used to take on proactive investigations, whichinvolve a much larger landscape of criminal conduct. Multiple crime scenes or eventswill be studied, and tactics will be developed. In proactive investigations, we nolonger trace the origin back to a single event. We review multiple crimes or evenfuture crimes and focus our suspicions on one or more persons who are believed to beregularly involved in criminal conduct. The investigation’s goal is to ensure that law18519 0055 Reilly.indb 1854/1/19 3:02 PM

186Chapter Eightenforcement intelligence or suspicion evolves to the point where crimes are solved,and certain patterns of criminal activity are eliminated.THE PLANAn investigative plan includes speculative analysis based on experience and logic.The facts and evidence available to the investigator after the initial introductory phaseof an investigation are reviewed, and certain determinations about that crime aremade. A good working plan begins with answering the following basic questions andestablishing the best way to apply the answers to a specific set of facts. What criminal statute or statutes were violated?Does the investigator and the agency have jurisdiction?How large is the population of suspects who could have committed the crime?Does the investigator have the authority to effectively resolve all the questionsraised by the crime event or series of events under investigation? Is there a pool of witnesses who can be helpful in the investigation? Is the crime solvable based on reliable witnesses; a reliable intelligence base; orthe recovery of physical evidence, which can provide forensic identification of thesuspect?A plan should be a predictable road map leading to a solution of the crime. Cohesiveorganization with a step-by-step process should provide the best approach, but thereare as many variables as there are constants when you consider the nature of proof,the value of evidence, and the determination about how facts are best used to proveor support an argument. The criminal investigator needs to understand that, from onecase to another, it is rare that the same process will yield the same results. Investigation is not just science, psychology, or precise planning. It may be all three, but thereare times when an investigation presents as chaos that turns into an understandableand orderly process by the criminal. Some violent crimes, for instance, may appear tobe random violence with no motive. As the investigation evolves, the criminal’s planbecomes apparent and almost predictable. A plan, therefore, must be malleable andadaptable. As soon as the investigator begins to uncover what is going on in the mindof the criminal, a more orderly path to solution will be available.In an investigation, there are certain factors that hopefully will always be available.Each investigation needs at least one witness who can testify about the crime, or thecriminal, or even just about circumstances relating to the crime. Each investigationneeds at least one victim and one criminal. Aside from these needs, the possibilitiesare endless. Even so-called victimless crimes may affect the investigative plan. Wellorganized and precise plans reflect the criminal investigator’s capabilities and theteamwork that is applied to the investigation.The most important goal of a plan is effectiveness and success. If the facts, evidence, and proof come together and present the truth for a judge or jury and the criminal is made to pay for the action, the case is a success and the plan worked. In our19 0055 Reilly.indb 1864/1/19 3:02 PM

Investigative Plan187discussion, we will present steps that can be followed that will result in a successfulinvestigation. You will note that the steps are multifaceted and may appear to be ajumble of disparate processes, but this is how criminal cases manifest themselves. Theinvestigator is usually hit with multiple needs all at once, and throughout the steps, thelimits of time management and organization are tested until all the leads are covered.Then, there is dead time and space during which the investigator must be creative,patient, and sustained in applying pressure to achieve the goal. Law enforcement workis a process of daily routine and boredom, which is then punctuated by sheer terror andsustained emergency demands. In following certain steps, there are points at whichthe investigator can adjust, implement decisions, and produce much-needed supportto reach the goal.After the initial investigative step has been completed, the plan usually becomes anexercise with one or more theories being considered and determining the answers towho, what, where, how, why, and when the crime was done. Most of the time withreactive crime investigations, the what and where are self-evident. Occasionally, thewhen is also known. In some cases, such as commercial armed robberies, the crimemight have happened in front of several eyewitnesses. The theory or speculation aboutwhat happened is not a mystery. In homicide investigations, it is more demandingwhen investigators are called to the scene of a deceased person. Crimes that occurredwithout a definitive crime scene are even that much more demanding. The initial information that a crime occurred may be supported by one or more witnesses, but nophysical evidence is immediately available. The theory or speculation develops fromthe details provided by the complaining witness, as in a kidnapping case.Investigative inquiry is a waste of time and effort if there is no reliable source ofinformation upon which to base a theory or speculation about the crime. The sourcesof that information are a physical crime scene or dump site, knowledgeable and reliable witnesses, and victims and then any other supporting information that exists andallows progress in an investigation.The two types of investigations have two separate starting points. A reactive caseusually begins with the crime scene. If there is no known crime scene, then begin withthe complainant who reports the crime to law enforcement. Once the crime scene hasbeen established, proceed as follows:1. Determine if there are witnesses and or victims to the crime present and conductinitial interviews.2. Begin the detailing of leads that need to be followed.3. Coordinate with the crime scene examiners. If there is no crime scene team or unit,begin processing the scene yourself.4. Go over the actions of the first responders, and make sure they send you any notes,photos, or reports they generate. (In the current state of technology, these itemsmay be digital files, which will eventually find their way into the investigative file.)5. If appropriate, determine if there is outstanding investigative or tactical activity being carried out by responding patrol units. (This outstanding activity may involvefollowing up on a lookout for a getaway car or a suspect who matches the description of the criminal.)19 0055 Reilly.indb 1874/1/19 3:02 PM

188Chapter EightThese five procedures are prominent examples of the investigative actions that needto be taken when responding to a crime. They can be adjusted and applied to everyinvestigation; even proactive investigations will have multiple crime events that haveto be reviewed for this same basic information.In a proactive investigation, begin with a thorough background investigation of thesuspects identified in the case as being responsible for a pattern of criminal conduct.It is also a starting point to begin with the crime reports, crime scene examinations,witness statements, and any follow-up significant physical evidence recovered. Proactive investigations often have known (or unknown) suspects who are responsible forthe pattern of crime. Focus is on the suspected pattern of crimes or the backgroundsof the suspects themselves. Most proactive investigations are initiated by reviewingreports, statements, photographs, and any evidence related to the investigation. Theinvestigator must become thoroughly knowledgeable about all aspects of the suspectsor the suspected activity.Most proactive investigations are initiated by actionable intelligence that is reliableand can be accessed for further information when the case is advanced to the secondphase. (Actionable intelligence is information from a reliable source who providesdetails sufficient to generate investigative action or tactical response.) Both proactiveand reactive investigations move into a second phase when the investigator begins theeffort to catch up with the suspects. Catch up is a term that refers to the fact that, as aninvestigator, you are behind in a race to the truth. It is your job to recover and moveforward to the point where you are not just even but ahead in the race.The following steps are an effort to customize the various plans to particular violations. These violations are (1) crimes against persons and (2) crimes against property.There are individual criminal acts discussed with each three-step plan of action.Crimes against persons include homicides, sexual assaults, and aggravated assault andbattery. Under crimes against property are armed robberies, burglaries, and car theft.Three-step plans discussed in this fashion provide the student with an orderly plan ofaction, so the three-step approach affords a simple “beginning, middle, and end” toeach investigation.Step 1: Crimes against PersonsWhen considering a plan or a scheme to follow in any investigation, there are somelogical compartments in which to place investigations. One compartment is crimesagainst persons. Any crime that involves violence or assault on a person is considered a crime against persons. The victim is the starting point in the plan. There maybe times when the crime scene, or where the violence occurred, may not be known.When the police are called to the venue where the complainant determines there isevidence of a crime, that evidence may simply be the person who was victimized.When the first responders arrive, the body of the homicide victim is present, or thevictim of a rape or a serious physical assault where there is significant bodily harm ispresent. Step 1 in the plan of crimes against persons is to make sure any person whoneeds medical help gets that care.19 0055 Reilly.indb 1884/1/19 3:02 PM

Investigative Plan189Homicide CaseWhen the lead investigator arrives at a homicide scene, the body of the victim maybe removed if the victim was in the process of dying when the complainant called forthe police. The lead investigator needs to ensure there will be coordination among theemergency medical responders, the emergency room staff, and the coroner or medical examiner. Each person who came in contact with the remains of the victim needsto be documented, and her work space needs to be examined for evidence. Importantevidence can be recovered at each step in the treatment and examination process. Investigators or officers need to trace the process through or accompany the victim untilthe victim is turned over to the medical examiner. In most jurisdictions, the autopsyof a homicide victim should be observed by the criminal investigator, and any physical evidence recovered in the autopsy should be turned over to the investigator or thepolice evidence technicians.In the next example, the body remains at the response location. This happens whenmedical assistance is not necessary. In these cases, the lead investigator, a representative from the coroner or medical examiner, and the crime scene team work the venuetogether to make a preliminary finding as to what happened. Witnesses are identifiedat the location and separated from each other or monitored to avoid witness contamination. Each aspect, from discovering and recovering physical evidence to conductingon-the-scene interviews, is done without missing important facts resulting from theseefforts.It is usually best to start with the complainant who called the police to the scene.This person can be anyone: a close associate of the victim, a suspect, or a witness tothe whole incident. This person can also be a total stranger who just happened uponthe victim. Any other bystanders, witnesses, and potential suspects need to be interviewed. A review of all the witness statements needs to be done before any witnessis released from the scene. This demand for cooperation is an essential part of step 1.Exercising police authority in a matter like this may be unpopular with the civilianwitnesses, but it is a necessary inconvenience.After the witnesses have been interviewed, the lead investigator needs to coordinatethe findings from the witnesses with the physical elements determined from the crimescene. If the findings of the crime scene team point to the fact that the death of the victim does not appear to have occurred at this scene, further investigation needs to occur. The lead investigator should attempt to consult with the medical examiner or techfor any scientific indicator that may support the movement of the victim postmortem.On the other hand, if the crime scene team has recovered significant physicalevidence that the crime occurred on or near where the body was recovered, the leadinvestigator needs to make sure there are no immediate discrepancies between thewitness statements and the locations and type of evidence that were discovered. Forexample, if expended shell casings were recovered that indicate the assailant in ashooting murder was standing in a certain location but witnesses state the shooter wasstanding elsewhere, every effort should be made to resolve the conflict. That kind ofdiscrepancy can be resolved in one of three ways: (1) The witness is mistaken basedon poor observation skill, a false claim, or suspicious behavior. (2) The shell casingswere moved, or they represent evidence from a shooting that did not result in the death19 0055 Reilly.indb 1894/1/19 3:02 PM

190Chapter Eightof the victim (two shooters, and the killer shot the victim with a revolver). (3) A thirdperson, possibly even the shooter, moved the casings.Any resolution of the discrepancies based on supportable facts and reasonable logicwill help the case going forward. A permanent record of the discrepancy should bemade. It may be that the discrepancy can’t be resolved. In that case, the investigatoris aware of the problem and will have to resolve the issue before it becomes a sorepoint at trial time. The investigation conducted in step 1 will have flaws and gapingholes that need to be filled. However, completing the examination of the crime sceneand interviewing all the available witnesses puts the investigation on the right path tosuccess.In most jurisdictions in the United States, it is the responsibility of the lead investigator or designated police official in homicide cases to notify the family, next of kin,or other appropriate person of a death. This notification process is a requirement thatnormally takes place during step 1 in an investigation. Obviously, the identity of thevictim needs to be determined. It may take days or even weeks for this to be donewith a victim whose identification is missing from the remains and is found in an areawhere no one will come forward and provide a preliminary identification.Once a name is officially connected with the remains, a formal identification process by the next of kin or close family member must be done in a manner consistentwith a protocol for the jurisdiction. This can range from an identification that takesplace at the medical examiner’s office to a display of a photographic image of the remains by the investigator to the next of kin or appropriate family member. Given thisrequirement, the investigator’s first contact with the next of kin may be very traumaticand unsettling, but it must be done. Even though the investigator may be dealing withextreme grief and anger, there can be observations made that will inform the investigation. If the investigator acts with genuine human concern and empathy, it is likely thatthe next of kin and the family will be willing to help the investigation. Following area few questions that must be asked during this very traumatic interview: Does the victim have anyone who would have wanted him killed?Does the victim have enemies?Why would the victim be found where the body was found?Where does the victim work or frequent?What is the general reputation of the victim?These questions and a few more should be judiciously put to the family to see howthey react specifically and try to determine if the family is being open and honest orclosed and protective. Some families in this circumstance will be astonished at thethought of someone killing their loved one. Some families will be aware of a dark sideto their loved one and won’t be overly surprised. Other families may be saddened but,in some ways, relieved. There is no stock reaction to this notification, but the investigator should read the reaction and decide how to proceed. The investigator may makethe notification, arrange the positive identification, ask the immediate and preliminaryquestions, and then arrange an appointment to go over the background of the victimin depth. He may walk away from this notification with leads on the victim’s business19 0055 Reilly.indb 1904/1/19 3:02 PM

Investigative Plan191and social life and begin the important relationship with the victim’s family that willbe ongoing for the course of the investigation.Rape or Serious Assault CasesStep 1 in a rape or serious assault case is very similar to step 1 in a homicide, exceptthat the victim is transported to the hospital for medical treatment. When the victim’shealth is stabilized, the investigator must initiate an effort to recover any physical evidence from the live victim. This can be done only with the permission of the victim.A victim who is unconscious and unable to consent may require that permission beobtained by proxy from a next of kin or, if the victim is a child, by a parent. In theevent there is no one available to give consent, a court order may be needed; however,the physical evidence must be obtained legally.In a rape case or any sexual assault, the examination for trace evidence is usuallyvery invasive and requires a well-trained, forensically experienced medical professional. This is usually the beginning of the imposing personal and emotional relationship between the lead investigator and the victim, as discussed in chapter 6. If theinvestigator feels unable to handle this relationship, another investigator on the teamneeds to work with the victim.On serious assault cases, the recovery of a bullet is a medical procedure that isusually necessary in a gun assault case. Permission for this procedure is usually givenin the consent to provide medical treatment. More invasive or even extraneous examinations for trace physical evidence may require the same permission required in asexual assault case. Victims in these cases may have been beaten, bitten, strangled, orotherwise physically assaulted, leaving the suspect’s trace material on the victim. Anexchange of physical evidence from a blunt-force weapon or knife is also the kind oftrace evidence that can be recovered from the victim. Recovery of this evidence maybe essential in proving the crime.Once that treatment and evidence recovery effort is completed, step 1 in a sexualor serious assault case proceeds the same way the step proceeds in a homicide case.There is usually a complainant or complaining witness. That person may be the victim, but that is not always the case. Interviewing that person and any other bystandersor suspects at the scene where the victim was recovered is the important process thatbegins the investigation. Also, the exploitation of the scene where the police werecalled is part of this process. If possible, determine that the crime occurred where thefirst responders were called, and try to resolve any discrepancies. Interview witnesseson hand, conduct a crime scene examination, and resolve conflicts between witnessesand crime scene variations.Step 1: Property Crime InvestigationsFor purposes of this text, property crimes are any criminal investigations that resultin the theft of property, currency, or anything of value. This category includes armedrobbery, robbery, shoplifting, burglary, embezzlement, and any other kinds of larceny,including auto theft.19 0055 Reilly.indb 1914/1/19 3:02 PM

192Chapter EightStep 1 involves responding to the scene as instructed by the complainant. In casesof this kind, it is not “normal” that anyone at the scene will need medical attention,but in some armed robbery cases, it is possible that a victim who refused to cooperatewith the criminals is injured. Emergency medical care and accompanying the victim tothe hospital or urgent care facility is priority. Aside from that possibility, these casesinvolve a process similar to that used for crimes against persons. The complainant andany bystanders must be interviewed, and a thorough examination of the crime scenemust take place.This crime scene examination will be disruptive to a commercial establishment,such as a bank, grocery store, restaurant, or drugstore, because these stores must beclosed until all areas related to the crime are examined. This usually involves multiplevenues in a crime scene. As discussed in chapter 7, venues are separate areas in whichsuspects carried out parts of their crime. They include points of entry and exit as wellas the route used by the suspects to arrive at and leave from the main venue where thecrime occurred. In the case of an armed robbery of a bank, for example, the venuesmay be the front entrance of the bank, the hallway leading to the main teller area, andthe hallway leading to a rear exit from the building, which was used by the suspect orsuspects committing the crime. In this case, there are five venues in one crime scene.There can also be auxiliary venues where other aspects of the crime were carried out.Auxiliary venues in a robbery can be vault areas, safe deposit box areas, count rooms,or locations where cash is prepared for final distribution.In burglary cases, the main venues may be bedrooms where jewelry is stored orelectronic equipment is housed. But in burglary cases, the points of entry and exitas well as the routes to and from the main venue should be examined. In residentialburglaries, burglars have been known to steal food and drink from kitchen areas. Thekitchen may be a venue that is appropriate to examine even though the criminal aspectof the case is not centered there.The focus of the crime scene examination must be customized to each crime. Eachvenue needs to be examined and exploited for physical evidence, including fingerprints, trace evidence, pattern evidence, and biological material. Logic and witnessinformation can guide the work that is needed. The other important considerationis the unusual, suspicious, or mysterious variation that is observed during the crimescene examination. During step 1 in any investigative plan, the crime scene examination must be thorough, and all the facts must be known because the investigative teamusually has only one chance at the scene.Once the investigator reaches the point when all the witnesses have been interviewed and all the crime scene venues have been examined and exploited for physicalevidence, the scene will be turned over to the property owners for a return to normaluse. Only when the deceased victim of violence is killed inside her own home orbusiness can the crime scene be sealed for any extensive period. Crime scenes wherecommercial robberies or thefts, such as shoplifting, occur are usually places of business, which must be returned to regular use as soon as possible. Crime scenes such asburglaries of residences and businesses also must be returned to regular use as soonas possible. These kinds of decisions are made by the crime scene technician in conjunction with the lead criminal investigator. In unusual cases where the seizure of a19 0055 Reilly.indb 1924/1/19 3:02 PM

Investigative Plan193crime scene is determined necessary, a court order will usually be required absent thepermission of the property owner.Car TheftCar theft is one of the most reported grand larceny crimes in the United States. Cartheft occurs so often (about one million cars are stolen every year in the United Statesat an average cost to victims of 6,000) that it is hard for most police agencies to spendthe time necessary to investigate the crimes thoroughly. The victimization is alsoindemnified by the auto insurance industry, which most states mandate, and all autoloan entities require allowing the complainants to receive compensation for their losswithin days of the crime. These two things tend to make the priority of these crimeseven lower. The community just doesn’t demand an immediate investigative responseeven though the value of the car is usually much more than the average larceny. In alarger sense, the real victims of auto thefts are the insurance companies, which haveestablished the National Auto Theft Bureau to assist the police in the identificationand recovery of stolen cars nationwide. Since most of the physical evidence that canbe recovered from a stolen car can be recovered only from the car itself, the crimescene may be nothing more than an empty slot in a parking lot or spot on a publicstreet.All the information that can inform an investigation of a car theft is most likelygoing to come from the owner. A detailed interview with the owner is the primarystarting point. If the car is recovered, an actual crime scene examination can be doneon the car itself. Witnesses can be found around the location where the car was stolen,but very few people will even notice an unknown person getting into a car and driving away. Older model cars with key entry and ignition are stolen using blunt-forcemethods, which may include crossing ignition wires and overriding the ignition cylinder. Newer-model cars and most high-dollar vehicles, such as BMWs, Mercedes,and Range Rovers, use keyless entry and ignition systems. Honda Accord sedans areamong the most stolen models in the world. They also have keyless entry and ignitionsystems.All the high-tech keyless entry vehicles rely on the onboard computer systems,which are vulnerable to computer hacking, thus making the job of the thief simpleif the thief has been schooled in this method. Expensive computer programs can beused to disrupt the onboard computer system through the onboard diagnostic port, adigital access connection under the dashboard of most modern cars. These ports are tobe used by professional auto mechanics and dealers to discover mechanical problems,but they also allow professional thieves to reprogram the keyless entry and ignitionsystem to respond to their key fobs, thereby allowing them to simply drive away andoperate the vehicle as if they had the original key fob. All the thief needs is a laptop, asmartphone, a tablet with the right reprogramming app, a tool to break into the car orsmash the window, and a blank key fob. Even if this software is expensive and technically difficult to use, the profit from stealing a 100,000 vehicle or even a 30,000vehicle makes the investment worthwhile.As discussed in chapters 3 and 5, car theft is a low-priority investigation unlessthere is a professional organization stealing cars and then shipping them overseas for19 0055 Reilly.indb 1934/1/19 3:02 PM

194Chapter Eightresale or chopping them up for their valuable parts, which can be sold on the blackmarket for more than the intact vehicle sells for in brand-new condition. Engines,transmissions, radios (entertainment systems), computer modules, wheels, air bags,and other major parts or systems when sold individually can yield profits that are morethan buying the used car for the standard price. In many oversees countries, a stolenhigh-value car can sell for double the asking price than in the United States or Europe.If there are no repercussions for reselling a stolen car, that MO for a car theft ring isalso very lucrative. The other very lucrative appr

These five procedures are prominent examples of the investigative actions that need to be taken when responding to a crime. They can be adjusted and applied to every investigation; even proactive investigations will have multiple crime events