Beruflich Dokumente
Kultur Dokumente
Incident Analysis in UK policing. The original document contains restricted information. In order to deliver this version, which is not protectively marked, a large amount of good practice examples have necessarily been removed. This version of the MIAM is only available on CD-Rom. Copies may be obtained from:
Opsline National Centre for Policing Excellence Wyboston Lakes Great North Road Wyboston Bedfordshire MK44 3BY Email: opsline@centrex.pnn.police.uk
This PDF file contains interactive links that help you to navigate the document quickly, and to enable you to gain immediate access to all websites listed. Clicking on any of the items in the main list of Contents (screen pages 5 to 10) will take you directly to the page listed. Or click on any item in the list of Contents at the start of each Section. To immediately access cross-referred items contained in this document, click on any cross-references shown in purple.
To return to the list of Contents, simply click on the line NOT PROTECTIVELY MARKED at the foot of each page.
Where you see a website address featured in purple, click on it to make a direct link.
This document has been bookmarked to further assist navigation.
2006
Produced on behalf of the Association of Chief Police Officers by the ACPO National Analyst Working Group in conjunction with the National Centre for Policing Excellence.
MAJOR INCIDENT ANALYSIS MANUAL (REVISED EDITION) This document has been written on behalf of the Association of Chief Police Officers (ACPO) by the ACPO National Analyst Working Group and produced as practice advice by the National Centre for Policing Excellence (NCPE). It will be updated according to legislative and policy changes and re-released as required. The NCPE was established by the Police Reform Act 2002. As part of its remit the NCPE is required to develop policing doctrine, including practice advice, in consultation with ACPO, the Home Office and the Police Service. Practice advice produced by the NCPE should be used by chief officers to shape police responses to ensure that the general public experience consistent levels of service. The implementation of all practice advice will require operational choices to be made at local level in order to achieve the appropriate police response.
All enquiries about this manual should be addressed to: Opsline National Centre for Policing Excellence Wyboston Lakes Great North Road Wyboston Bedfordshire MK44 3BY Email: opsline@centrex.pnn.police.uk
Acknowledgements
The ACPO National Analyst Working Group and the NCPE would like to express their thanks to all those involved in the drafting of this document. This included major incident analysts and investigating officers and the ACPO Homicide Working Group. All of the responses during the consultation phase of this project were appreciated and contributed to the final document. Association of Chief Police Officers (2006) Centrex (2006)
All rights reserved. No part of this publication may be reproduced, modified, amended, stored in any retrieval system or transmitted, in any form or by any means, without the prior written permission of Centrex and ACPO or their duly authorised representative. Centrex is committed to providing quality products and services which comply with the Centrex Quality Assurance Framework and encompass diversity.
CONTENTS
Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Section 1 INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.1 1.2 1.3
Section 6 DIRECTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
6.1 6.2 6.3 The Direction Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Terms of Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Actions and HOLMES 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.1 Tasking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.2 SIOs Policy File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.3 Proactive Generation of Tasks through Analysis . . . . . . . . . . . 38 38 39 39 39 40
CONTENTS
Section 7 COLLECTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
7.1 7.2 The Collection Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Closed Data Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.1 HOLMES 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.2 Force Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.3 Police Departments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.4 Outside Contacts (National) . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.5 Outside Contacts (Local) . . . . . . . . . . . . . . . . . . . . . . . . . . . . Open Data Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.3.1 Evaluating Open Data Sources . . . . . . . . . . . . . . . . . . . . . . . . Schedules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Note Taking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Storage and Document Management . . . . . . . . . . . . . . . . . . . . . . . . 7.6.1 Physical Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.6.2 Electronic Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exhibit Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Scene Visits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 42 42 46 49 50 56 57 60 60 61 62 62 62 63 64
7.7 7.8
Section 8 COLLATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
8.1 8.2 The Collation Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Charts ............................................... 8.2.1 Charting Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.2 Network Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.3 Timelines/Sequence of Events Charts . . . . . . . . . . . . . . . . . . . 8.2.4 Statement Comparison Charts . . . . . . . . . . . . . . . . . . . . . . . . Spreadsheets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.1 Comparative Case Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.2 Timelines/Sequence of Events Spreadsheets . . . . . . . . . . . . . . 8.3.3 Witness Comparison Charts . . . . . . . . . . . . . . . . . . . . . . . . . . Tables ............................................... Databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Maps ............................................... Commodity Flows including Financial Material . . . . . . . . . . . . . . . . . Communications Flow and Frequency Charts . . . . . . . . . . . . . . . . . . 8.8.1 Communications Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.8.2 Telecommunications Data Types . . . . . . . . . . . . . . . . . . . . . . . 8.8.3 Flow Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.8.4 Network Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.8.5 Frequency Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 67 67 69 70 70 70 71 71 74 74 74 75 75 76 76 77 78 79 79
8.3
Section 9 EVALUATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
9.1 9.2 The Evaluation Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Brainstorming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2.1 Brainstorming Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2.2 5WH Matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2.3 Brainstorming Outcomes . . . . . . . . . . . . . . . . . . . . . . . . . . . . Charting Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Covert Intelligence Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Inference Development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Hypothesis Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 83 84 84 86 86 87 87 88
Section 10 ANALYSIS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
10.1 10.2 10.3 10.4 10.5 The Analysis Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Scope of Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Inferences and Hypotheses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The National Intelligence Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.1 Incident Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.2 Network Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.3 Subject Profile Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.4 Crime Pattern Analysis (CPA) . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.5 Risk Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.6 Market Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.7 Social and Demographic Trend Analysis . . . . . . . . . . . . . . . . . 10.5.8 Criminal Business Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.9 Results Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.10 Operational Intelligence Assessment . . . . . . . . . . . . . . . . . . . Which Analytical Techniques Should Be Used? . . . . . . . . . . . . . . . . . 10.6.1 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.2 Victim-Related Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.3 Offender-Related Techniques . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.4 Location-Related Techniques . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.5 Incident-Related Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . 92 92 92 93 93 93 95 96 98 101 102 103 104 104 105 106 106 107 109 111 112
10.6
CONTENTS
11.8
Summary of Appendices
Appendix Appendix Appendix Appendix Appendix Appendix Appendix Appendix Appendix 1 2 3a 3b 4a 4b 5 6 7 Terms of Reference 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Search Techniques and Useful Websites . . . . . . . . . . . . . . . . . . Intelligence Network Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . Evidential Network Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Intelligence Timeline Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . Evidential Timeline Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Abbreviations and Acronyms . . . . . . . . . . . . . . . . . . . . . . . . . . Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References and Suggested Further Reading . . . . . . . . . . . . . . . 136 138 141 142 143 144 145 147 148
Summary of Figures
Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Figure 6 Figure 7 Figure 8 Figure 9 Figure 10 Figure 11 Figure 12 Figure 13 Figure 14 Figure 15 Figure 16 The Intelligence Cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Example Schedule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Charting Protocols Matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Simple Timeline Showing Movements of Suspect on 01/01/2006 . . . 5WH Matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Evaluation Matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Peacock Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Grouped Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Inference Development and Information Management . . . . . . . . . . . Problem Analysis Triangle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Major Incident Problem Analysis Triangle . . . . . . . . . . . . . . . . . . . . . . Victim-Related Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . . . Offender-Related Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . Location-Related Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . Incident-Related Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . . Major Incident Analysis Product Matrix . . . . . . . . . . . . . . . . . . . . . . . 34 61 68 73 85 85 87 87 88 106 107 107 109 111 112 113
CONTENTS
Summary of Tables
Table 1 Table 2 Table 3 Table 4 Table 5 Table 6 Table 7 Table 8 Table 9 Table 10 Table 11 Table 12 Table 13 Table 14 Table 15 Table 16 Table 17 Considerations before Starting Work on a New Investigation . . . . . . Legislation that Needs to be Considered by the Analyst . . . . . . . . . . . Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . HOLMES 2 Closed Data Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . Force Systems Closed Data Sources . . . . . . . . . . . . . . . . . . . . . . . . . . Police Departments Closed Data Sources . . . . . . . . . . . . . . . . . . . . . . National Outside Contacts Closed Data Sources . . . . . . . . . . . . . . . . Local Outside Contacts Closed Data Sources . . . . . . . . . . . . . . . . . . . Open Data Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Grading Open Source Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Naming Convention Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Features Included in a Spreadsheet Timeline . . . . . . . . . . . . . . . . . . . Victim-Related Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . . . Offender-Related Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . Location-Related Analytical Technique Examples . . . . . . . . . . . . . . . . Incident-Related Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . . Analyst Welfare Risk Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 25 31 43 46 49 50 56 58 60 62 72 108 109 111 112 133
PREFACE
Since the 1990s analysts and researchers have become widely used in operational policing. The National Intelligence Model (NIM) has played a significant role in developing the role of the Analyst in intelligence-led policing, however, the use of major crime analysts has been less structured. With the growth of the analytical profession and an increased understanding of the Analysts role, the need for guidance, training and standard procedures has been identified. In 2004 a small group of analytical representatives from Surrey, Essex, Kent, Cambridgeshire and Sussex police forces was established to consolidate the lessons learned from their forces recent high profile cases. In the light of reviews of these cases and subsequent inquiries such as Bichard, the group acknowledged that there was a need to develop practice advice and good practice for use by analysts in major investigations. At this time the ACPO National Analyst Working Group (NAWG) expanded its terms of reference to include development of analytical techniques and it was felt that the work already commenced by the small group of forces, as mentioned above, should continue to be developed. This group subsequently became the Major Incident Analysis Working Group (MIAWG), a subgroup of the NAWG analytical techniques group. NAWG reports directly to the ACPO Intelligence Portfolio. The membership of the group was expanded to ensure knowledge and experience was obtained from policy makers, managers and practitioners, including a representative from the ACPO Homicide Working Group. An initial consultation group was also established to represent the entire UK. Since its formation the MIAWG has been guided by a number of key principles:
That the group will accept the majority view in relation to good practice but
will not exclude differing approaches. The intention is to be inclusive and, where possible, to provide a number of options.
While not prescriptive, the aim of this manual is to provide a set of guiding
principles that are both useful and practical.
The guidance that the group produces will not stifle innovation, but encourage
thinking outside of recommended good practice. It is an aim of the MIAWG to provide assistance to the National Centre for Policing Excellence (NCPE) review of both the ACPO (2005) Major Incident Room Standardised Administrative Procedures (MIRSAP) Guidance and the ACPO (2005) Murder Investigation Manual (MIM).
The existing MIRSAP and MIM documents make basic recommendations with regard to the use of analysts in major incidents. The rewriting of these manuals has, however, represented an excellent opportunity to accurately reflect the roles of the Analyst and Researcher. This Major Incident Analysis Manual (MIAM) complements these documents by providing supplementary detail of good practice based on operational experience throughout the country, and is the culmination of the work of the MIAWG. On this basis, this manual should be of interest to practitioners, customers, managers and co-workers and, in particular, should be used as a point of reference for analysts, researchers, analyst managers and Senior Investigating Officers (SIOs). This manual will prove to be a useful tool to those continuously involved in major investigations. It will also provide advice to those who may be involved in major investigations on a seconded or temporary basis, particularly as the document builds on existing NIM analytical techniques and products.
Section 1
INTRODUCTION
SECTION 1
T
1.1 1.2 1.3
his section gives details on the purpose and aims of the manual. The scope of the manual is also explored here.
The importance of using intelligence analytical techniques to drive investigations is now acknowledged within the police service. By using research/analysis to underpin murder investigations they will be more focused, cost effective and more likely to succeed.
ACPO (2000) Murder Investigation Manual
1.1 PURPOSE
The purpose of the Major Incident Analysis Manual is to provide practice advice to analysts supporting Senior Investigating Officers (SIOs) involved in major incidents. Specifically this manual will:
10
INTRODUCTION
1.3 SCOPE
For the purposes of this manual, major incidents are defined as: critical incidents, murders, stranger rapes, attempted murders, linked serious crimes, kidnap, abduction, road deaths, major disaster, missing person inquiries, some serious organised crime incidents and terrorism. The material contained within this document is intended to be as current as possible and, as such, it will be revised with the advent of any new and updated legislation, changes in working practices and the collation of new examples. It is intended that this manual acts as a reference document and users should, therefore, access relevant sections as required. The material contained within this manual will be made available to the NAWG and sanctioned by the Analytical Techniques Working Group who are in the process of producing similar practice advice concerning the application of analytical tools. Course outlines specifically dedicated to major incident analysis skills will then be developed. Inputs relating to major incident analysis will also be provided at specific levels of police training to improve understanding of the Analyst and Researcher role in major investigations.
11
12
Section 2
THE MAJOR INCIDENT PROCESS
SECTION 2
O
2.1 2.2 2.3
utlined in this section are the main roles and responsibilities of the Analyst and Researcher within a Major Incident Room, along with the role of the Analyst Manager, Lead Analyst and the Serious Crime Analysis Section (SCAS) Analysts. CONTENTS The Use of the Analyst and Researcher . . . . . . . . . . . . . . . . . . . . . . . Location of the Analyst and Researcher . . . . . . . . . . . . . . . . . . . . . . . Functions, Roles and Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.1 The Analyst . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.2 Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.3 The Researcher . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.4 Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Analyst Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Lead Analyst . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Role of the SCAS Analyst . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 15 16 16 16 18 18 19 19 19
13
14
Inform resourcing decisions; Maximise existing or limited resources; Focus the inquiry; Focus intelligence gathering through identifying intelligence gaps; Prioritise lines of enquiry; Provide a projection of likely future criminal activity; Assist in the prevention of further crime and incidents (criminal activity); Provide an objective summary of the case therefore preventing miscarriages of justice; Assist the process of narrowing the justice gap; Ensure compliance with legislation and guidance; Maximise intelligence into mainstream policing through dissemination; Manage information professionally to inform decision making; Minimise the cost of investigations.
The timeliness of analysis is essential to its value. The Analyst should, therefore, be a priority recipient of material. While HOLMES 2 should be the source of investigatory records for analysis, given the often vast amount of material received particularly at the start of an investigation, it is good practice to ensure that the Analyst receives paper copies of material entering the Major Incident Room (MIR) immediately. Storage, however, must be considered as a limiting factor. HOLMES 2 can then be used to underpin this information flow by the Analyst who will assign tags when documents have been read. While material gathered as a direct consequence of the investigation is likely to be the prime source of information, analysis should include material from other in-force databases and open sources where appropriate. Analysts should have access to the range of technology that supports them in executing their role effectively. In order to set analysis within the context of the offence, the Analyst should have a detailed understanding of the location of the offence. They can do this by visiting the scene(s) of crime as soon as reasonably practicable following the conclusion of evidence collection, and should be encouraged to view evidential footage. A significant amount of research is required to support the MIR. Without the assistance of a researcher, analysts are frequently tasked with such requirements. SIOs should be aware of the different competency expectations of each role and consider the limitation of analytical potential where analysts are tasked with completing research. SIOs should ensure that the Analyst is both fully integrated within the investigative team, and participates in operational briefings and management meetings. While analytical products must be accompanied by a verbal or written report, in order to assist the SIO in structured decision making processes, the Analyst should be included and involved in management meetings as appropriate. SIOs may find that the most appropriate time to discuss analytical products is within the Current and Emerging Lines of Enquiry agenda item. Analysts are expected to be innovative and creative in the way they apply their analytical skills to the particular incident and the SIOs objectives. While SIOs should recognise the potential for analysis, and demand such innovation from their staff, all geographic and behavioural profiling should be tasked to specialists in these disciplines, as this is not within the professional capability of in-force analysts. The Serious Crime Analysis Section (SCAS) also has a national remit to carry out comparative case analysis (CCA) in support of forces in the case of serious and sexual crime.
15
Where analysts work away from the MIR and MIR staff, there is a strong possibility that they will become isolated and that the necessary level of communication between the Analyst, SIO and other staff will not be attained. This will have the effect of undermining and diminishing the Analysts role and the products produced. In some circumstances it may not be possible or it may be decided, following consultation between the SIO and the Analyst Manager, that the Analyst should be located away from the MIR. The implications of this decision should be considered and potential problems mitigated against. Consideration also needs to be given to the Analysts requirement for physical space to undertake their work in an innovative and unconstrained manner.
2.3.2 RESPONSIBILITIES
The Analyst must have the necessary skills and competencies to be able to:
Search and retrieve material from HOLMES 2 and other local databases; Ensure all documents are read and analysed (given the often vast amount of
material received, particularly at the start of an investigation, it may be appropriate to include the Analyst within the formal paper chain of information); Establish links and associations between material (eg, intelligence, statements, officers reports, interview transcripts, telephone calls, financial records);
16
Identify gaps and inconsistencies within the material; Go beyond the known facts to develop inferences and hypotheses about the
matter in question;
17
2.3.4 RESPONSIBILITIES
The Researcher must have the necessary skills and competencies to be able to:
Support the Analysts and MIR staff to search and retrieve material from
relevant paper and computer-based sources including HOLMES 2, local crime, incident and intelligence databases, open sources, PNC (including VODS and QUEST) in support of current, and potential lines of enquiry; Devise appropriate methods of evaluation, collation and dissemination of material obtained from research; Use information and communication technology to best effect; Produce relevant and timely verbal or written reports and present in a format that is concise and understandable to the audience; Prepare visual aids to illustrate factual material in a readily understandable format; Under the supervision of an analyst, use information visualisation software (such as Electronic Charting Systems and Geographic Information Systems) to display factual material; Attend all briefings and management meetings, presenting briefings and reports as appropriate; Record notes for own/analysts use at briefings and meetings; Maintain close liaison with the Analyst(s), undertaking research on their behalf, as directed; Produce research summaries as required by the SIO; Undertake comprehensive research in support of the Action Team, making internal and external enquiries, as required; Handle information and intelligence in accordance with legislation, national guidelines and local protocols; Ensure that all research is undertaken in compliance with all relevant legislation (eg, CPIA, RIPA, DPA, HRA.) and according to national standards of good practice as prescribed by the NAWG.
In some circumstances it may not be possible to employ both an analyst and a researcher on an inquiry. The Analyst is able to undertake their own research, however, it must be acknowledged that a significant increase in research activity will result in a reduction of analytical productivity. Where there is no analyst, a researcher cannot undertake analysis.
18
Searching the national database to identify potentially linked offences; Conducting QUEST/VODS searches to identify potential nominals of interest; Liaising with force analysts to offer advice on the relevant importance of the
offenders behaviour to assist searching in-force systems;
19
20
Section 3
THE ANALYSTS TECHNICAL REQUIREMENTS
SECTION 3
n this section the core technical resources required for analysts and researchers to carry out effective and timely analysis in order to progress a major incident inquiry are outlined.
21
Within major investigations there is a requirement for technical resources to be made available to the Analyst in a timely and unrestricted manner. The exact resources required should be evaluated according to the needs of each investigation, however, consideration should be given to the following list of technical resources:
3.2 HARDWARE
A3 colour printer Access to A3 colour photocopier Access to audio and visual equipment Access to a plotter for printing out larger charts/timelines Access to a scanner Access to suitable presentation facility Large screen monitor
It is essential that analysts and researchers receive adequate training in these systems prior to using them, not only to ensure competency within the Analysts role but also within the criminal justice process. The majority of technical resources used by analysts and researchers within major incidents will be familiar to those working within the volume crime arena. There are a few resources that are specific to major incidents, for example, HOLMES 2 and local bespoke systems. Technological support has the benefit of increasing efficiency and making analytical output more professional. These tools, however, do not replace the mental processes that constitute intelligence analysis.
22
Section 4
THE START OF AN INVESTIGATION
SECTION 4
A
4.1 4.2 4.3
checklist of good practice is provided in this section to assist the Analyst in the most effective way to approach the investigation. The most relevant and current information regarding legislation and guidance affecting major incidents and analysis is included.
23
The stage of the investigation (ie, is the material being used to progress the investigation or being used in an evidential manner?) Versioning Analysts vs. Experts
24
4.2 LEGISLATION
There is a wealth of legislation that affects both major incident and analytical work. While the following is not a complete description nor an exhaustive list of all legislation, it provides a summary with practical tips that analysts and researchers must consider. The following relates to UK legislation. TABLE 2 Legislation that Needs to be Considered by the Analyst LEGISLATION
Analytical work must be undertaken in compliance with relevant legislation Computer Misuse Act 1990 Provides power to prosecute those individuals whom deliberately and without authority, misuse computer systems. The following sections should be considered in analytical work: Section 1 is an offence to knowingly cause a computer to perform any function with the intent to secure unauthorised access to any program or data held in the computer. Section 3 is an offence to intentionally cause an unauthorised modification of the contents of any computer to impair or hinder the working of the computer or program or impair the reliability of its data. Copyright Copyright gives the creators of a wide range of material economic rights enabling them to control the use of their material in a number of ways. It also gives moral rights that are concerned with protecting the personality and reputation of authors. Copyright does not protect ideas or such things as names or titles. Most users of copyright material require permission from the owner. There are some exceptions, however, including limited use of material for judicial proceedings. Copyright is automatic in the UK, there are no forms to fill in and no fees to pay to get protection. There is also no official registration system. As long as work has been recorded in some form, then the author has copyright protection. Copyright owners can take certain precautions to help protect their rights. Crime and Disorder Act 1998 This Act is intended to reduce general levels of crime and disorder in society through the introduction of various strategies, powers and court orders. Section 5 imposes a legal duty on the Police Service, local authorities, health authorities and probation committees to formulate crime reduction strategies based on inter agency partnerships. Section 17 (1) imposes an obligation on every Police Authority, local authority and other specified bodies, to consider crime and disorder in exercise of their duties. This includes major incidents. The Crime and Disorder Act also makes provision for police and partnership agencies to share information through the use of information sharing protocols. Practical Tips
Ensure compliance
with information sharing protocols.
Consider partner
agencies when collecting open source data, particularly for strategic work and socio-demographic data.
25
Familiarisation with
the relevant details of the legislation.
Familiarisation with
the Act.
26
Set up disclosure
schedule at start.
Ensure use of
notebook.
Consider use of
naming convention.
Use of version
control.
27
Ensure knowledge
of the 8 principles within the Act, particularly section 55.
28
Continually be aware
of requirement to share information.
Ensure use of
naming conventions is clear and complies with FOI.
Human Rights Act 1998 (HRA) The European Court of Human Rights issued Convention Rights which contain Articles. Those Articles of primary importance to the analytical community are: Article 2 The Right to Life: public authorities must not cause the death of any person; Article 6 The Right to a Fair Trial: this should take place within a reasonable time and in public unless certain conditions apply. Refers to a person being presumed innocent until proven guilty. Also looks at issues of trial by media; Article 8 Respect for Private and Family Life: public authorities may only interfere with someones private life where they have the authority to do so. Covers matters such as disclosure of private information, monitoring of employees phone calls, entering a persons home. Each individual within a public authority is responsible for any breaches of the Act.
Familiarisation with
the Act.
Consider JAPAN
is it Justified, Appropriate, Proportionate, Accountable and Necessary.
29
Should be
particularly considered when using open source data.
Familiarisation with
the Act.
Basic knowledge of
Act may assist in understanding detained persons deadlines and police procedures.
Liaise with
intelligence manager and compliance unit, SPOC.
Familiarisation with
the Act.
30
Familiarisation with
the Act.
4.3 GUIDANCE
The following table provides a summary of a number of guidance documents that are available in the UK and National departments that may provide further guidance. TABLE 3 Guidance GUIDANCE
There are a number of documents that should inform analytical work and research and include the following Analyst Training Courses All analysts should have undertaken foundation training, eg, National Intelligence Analysts Training (NIAT), Initial Analysis Training Course (IATC). The application of skills and techniques learnt on these courses can be applied in major incident situations. Course material is a good point of reference. Force Documents Internal force documents including the Control Strategy and Intelligence Requirement, along with the most recent Strategic Assessments for both force and BCU or equivalents, will provide an understanding of the main threats and emerging issues being faced at each level. They will also provide an idea of the intelligence that is required to fill the information gaps. Tactical assessments at both BCU and force level will give an understanding of the operational issues being addressed proactively. These documents may be of particular use when considering strategic issues around major crime. Home Office Research, Development & Statistics Department (RDS) The role of this department is to manage research and collect statistics in a number of areas including crime, policing, justice, immigration, drugs and race equality. The internet website contains publications of work conducted, a business plan of future work and details of national statistics work being conducted. The list of subjects covered includes: asylum, gun crime, hi-tech crime, homicide investigations, immigration, organised crime, policing violence, serious crime, sexual offending, stranger rape investigation and terrorism. Practical Tips
Familiarisation with
training material.
Awareness of local
documents and current priorities.
31
National Intelligence Model (NIM) As part of the Police Reform Act 2002, all police forces in England and Wales were required to implement the National Intelligence Model to minimum standards by April 2004. Further minimum standards (version 2) have now been published. All police forces in England and Wales have an implementation date of November 2005.
Know the
intelligence and analytical products.
32
Section 5
THE INTELLIGENCE CYCLE
SECTION 5
T
5.1
he key stages within the Intelligence Cycle are introduced in this section of the manual. This is a process that develops information into intelligence to support and inform decision making. CONTENTS The Intelligence Cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
33
Direction
Dissemination
Collection
Analysis
Collation
Evaluation
In the context of major incidents, the Intelligence Cycle elements can be defined as follows: Direction Collection Collation Evaluation The initial task or objective. Gathering of information from all material sources to support the task or objective. The organisation of material in a meaningful format. The consideration of relevant material; assigning of value to information; inclusion of material to support an initial task or objective. The drawing of conclusions and inferences with recommendations and intelligence gaps highlighted. The method of communicating the results of the intelligence process. The change or continuation of a line of enquiry, strategy or similar, depending on the results of the intelligence process.
34
While this is a sequential process, some elements may occur out of sequence. For example, collection of material is likely to be an ongoing process and, therefore, may continually interrupt the cycle. A new piece of collected data may require immediate collation and evaluation. The order of subsequent intelligence cycle stages is not altered by this. The need to continually collect and collate emphasises the importance of the researcher role. Where the Researcher can support the Analyst through continual collection and collation, the Analyst can progress the evaluation and analysis stages, using timely information to inform their work. Additionally, the evaluation stage may occur independently. The generation of hypotheses through brainstorming processes can be a catalyst for the start of a new cycle. The Analyst and Researcher can add value to the process of testing hypotheses against evidence. Applying this intelligence-led process to major incidents will result in them being better focused and cost effective. The following sections represent the elements of the intelligence cycle within a major inquiry and guidance is provided as to the detailed role of the Analyst and Researcher within each of these stages.
35
36
Section 6
DIRECTION
SECTION 6
his section describes the direction phase of the Intelligence Cycle. It specifically refers to the methods by which analysts and researchers should be tasked; the importance of clear, accurate and specific tasking that is aligned to the SIOs objectives and, therefore, how analysis is generated. The issues surrounding the use of Terms of Reference and the SIOs Policy File to ensure analysts are being used correctly, and the generation of further actions through analysis are also discussed. CONTENTS 6.1 6.2 6.3 The Direction Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Terms of Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Actions and HOLMES 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.1 Tasking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.2 SIOs Policy File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.3 Proactive Generation of Tasks through Analysis . . . . . . . . . . . 38 38 39 39 39 40
37
The Analyst Manager may wish to develop a more detailed strategy that will enable them to track work flows and ensure that material is delivered in an efficient and coherent manner.
38
DIRECTION
39
40
Section 7
COLLECTION
SECTION 7
he collection phase of the Intelligence Cycle is covered in this section of the manual. Explanations of open and closed data sources are provided along with extensive examples of other useful data sources within these categories. The importance of evaluating the reliability and validity of this information is discussed along with the need for effective document and information management. The issue of exhibit handling is also examined with emphasis given to the importance of adhering to strict rules when handling exhibits. CONTENTS 7.1 7.2 The Collection Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Closed Data Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.1 HOLMES 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.2 Force Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.3 Police Departments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.4 Outside Contacts (National) . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.5 Outside Contacts (Local) . . . . . . . . . . . . . . . . . . . . . . . . . . . . Open Data Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.3.1 Evaluating Open Data Sources . . . . . . . . . . . . . . . . . . . . . . . . Schedules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Note Taking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Storage and Document Management . . . . . . . . . . . . . . . . . . . . . . . . 7.6.1 Physical Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.6.2 Electronic Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exhibit Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Scene Visits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 42 42 46 49 50 56 57 60 60 61 62 62 62 63 64
7.7 7.8
41
The collection of all material is essential to an investigation and the Analyst and Researcher should actively seek further data sources ensuring SIO awareness. While the Analyst will predominately handle material that has been collected by others and is going through the HOLMES 2 system, there may be data sources that are generated through analytical work and research. Such material should be immediately directed to the MIR and logged accordingly. Where an analyst is directly involved in purely covert intelligence analysis, the sterile corridor should be maintained and the Analyst should not be party to the raw collected product. The collection process will involve both open and closed data sources:
Closed source data is that which is not readily available. This is often contained
within specific databases or systems within the law enforcement and multiagency environments; Open source data is that which is available to any member of the public. This can be in both paper and electronic format.
7.2.1 HOLMES 2
The HOLMES 2 system links each of its data source elements thereby allowing the Analyst and Researcher to link to other records while in one data source. It is important that the Analyst and Researcher receive sufficient training on the HOLMES 2 system. The most common Closed Data Sources are in Table 4.
42
COLLECTION
Documents
Electronic Transmission
Exhibits
House-to-House (HtoH) HtoH questionnaires are given a number by the HtoH coordinator and Questionnaires are not automatically numbered by the HOLMES 2 system. The HtoH questionnaire is registered to the nominal record of the person interviewed.
43
Nominal Index
44
COLLECTION
Questionnaires
Reports
Sequence of Events
Statements
Telephone Index
45
Features ANPR technology records vehicle registration details that are captured when vehicles pass by ANPR cameras. These can be fixed or mobile units, and can be deployed as a result of a major incident to specific locations. ANPR have a live link to PNC and a variety of databases feeding in. The majority of forces store ANPR data for a period of time, therefore, this information can be explored. These are often held separately because of the sensitive nature of the material. Separate databases or paper systems may be used by forces. Details recorded may include a history of offences against children, suspect and offender details, home addresses. Communications data may include telephone and/or internet usage by nominals. This material will arrive in various formats and is usually service provider specific. Occasionally, this data may only be available in paper format. Such information may not always be available as legislation such as RIPA and ECHR needs to be adhered to. Consideration also needs to be given to whether the material is in an evidential or intelligence format. Such material can be used to support the majority of analytical products. Communications data is continually changing. The material that each service provider can supply is often different and retention periods can vary dramatically, being very short under some circumstances.
Communications Data
46
COLLECTION
Features Early communication must, therefore, take place with the Single Point of Contact (SPOC) who can provide, for example, up-to-date advice on what material can be obtained, how it can be applied for, retention periods and sensitivity. Regular communication is also essential, once the material has been received, between the SPOC, Telephone Liaison Officer (TLO) and Analyst. These parties can provide advice on what is included (and, therefore, what is excluded) and interpretation issues. Crimelink is an intelligence and analytical tool used for the identification of cross-border crime series. Crimelink relates specifically to crime types not covered by SCAS (SCAS crime types are: murder, kidnap, abduction, rape and series of sexual offences). It allows forces to input detailed accounts of crimes, in line with their regional Control Strategies and force requirements. The system is based on a keyword principle and forces will have dedicated Crimelink Researchers/Analysts trained to research the system. These can provide details of the crime being investigated and other linked offences. The Analyst or Researcher may undertake an exploration of historical data to look for previous or pre-cursor crimes. All police forces retain records of arrests and detained persons. These are often a mixture of paper and electronic documents. They will contain a number of details including name, address, DOB, arrest details, crime record numbers, custody log, DNA, any property details, bail and court details, charges and vehicles. Financial data may include transactions from accounts including those relating to an identified nominal or from a company or an ATM machine. Financial material is obtained via a court order in line with legislation. Advice should be sought from the relevant departments when using such data, eg, Economic Crime Unit, Fraud Unit, Financial Investigators. Such material can be used to support the majority of analytical products. Credit reference agencies such as Experian and Equifax can provide an indication that a person or business has made an enquiry to a finance company. In some circumstances, account numbers can be obtained. This will provide information from a scene of crime or a material person. Such information may be useful when analysing links between nominals and nominals to locations and vehicles. These can provide details of the initial incident being investigated and other linked incidents. This may be described as the initial call log and may provide details of witnesses or lines of enquiry. The Analyst or Researcher may explore historical data to look for previous or pre-cursor incidents.
Crimes
Custody Records
Financial Data
Forensic Intelligence
Incidents
47
Features Intelligence refers to information that has been sanitised and evaluated using the 5x5x5 system and is held on force and other organisational intelligence systems. This can provide information about, for example, nominals, vehicles and addresses within an investigation. The Analyst, whether dealing with evidential or covert material, will find access to such information beneficial. Each item should be evaluated accordingly. This database is maintained by the Metropolitan Police Service and can provide details of persons convicted of offences where the method of the offence and/or whose personal description is distinctive or unusual. Details are recorded in relation to the MO, personal descriptive factors, speech, areas of operation and addresses. All forces hold photographs of nominals for both evidential and intelligence purposes. PNC records can provide details of nominals, vehicles and stolen property (firearms, plant, machinery and animals) that are connected to the inquiry. Nominal records provide a wide range of information including offending and custodial history, aliases, associates and descriptions. Vehicle records provide details such as registered owners and insurance. It is essential that users adhere to PNC regulations. These records provide details of persons and vehicles that have been stopped and searched under police legislation. Within a major inquiry, this may provide information on persons and/or vehicles that were in specific locations at specific times. These are enhanced applications linked to PNC. VODS (Vehicle Online Descriptive Search) allows users to search large sets of vehicle data where specific details are unknown, ie, full index number. QUEST (Query Using Extended Search Techniques) allows users to search for nominals using descriptive terms where specific details are unknown, ie, full name. The #TE (Transaction Enquiry) is available via PNC. It provides details of what, where and why in relation to any known PNC transaction. The #TE will retrieve all cases (in specific time period) where a vehicle has been checked by an officer, providing details of that officer so they can be contacted for further clarification.
Photographs
PNC
#TE
48
COLLECTION
Features The Aliens Department is available to provide information about Aliens, particularly Non EU nationals, who are registered either with them or with the Home Office. They can provide background information regarding marital status, addresses, arrival and departure dates and work details of those in possession of a permit. Information is held on the Central Ticket Office (CTO) computer relating to Home Office Road Traffic (HO/RT) documents, fixed penalty tickets, vehicle defect rectification notices and speed cameras issued by police officers, traffic wardens and police support staff. Details can be obtained from this department relating to names, vehicles, locations events and cheques. Police forces have created liaison officers throughout the country with responsibilities for prisons located in the force area. It would be advisable to contact the forces prison liaison officer to establish what information may be available. Road policing units may record details of vehicles and people involved in road traffic collisions. The road policing departments may also have access to ramp data. This provides information on vehicles passing through safety camera zones that are on motorways or in speed controlled areas, such as road works. As well as vehicle details, it may be possible to obtain photographic images which may assist in identifying individuals or vehicle damage for example. The Safety Camera Unit holds data on speeding infringements. These can be permanent or mobile units. While the data is held to enforce speeding penalties, data held can also be mined for intelligence. Additionally, photographic images are held and can provide useful leads. The Sex Offenders Unit has a responsibility for monitoring the activities of registered sex offenders. Special Branch units hold largely sensitive data relating to issues of national security. Data is usually held on separate systems and access would, therefore, need to be negotiated and integrity maintained.
Prison Liaison
Special Branch
49
Features There are a number of academic institutions that may be able to provide information or research, for example: The Centre for Investigative Psychology (Liverpool University); Department of Criminology (Leicester University); The Henry Fielding Centre (Manchester University); Institute of Criminology (Cambridge University); The Jill Dando Institute of Crime Science (University College London). BADMAN stands for Behavioural Analysis Data Management AutoIndexing Networking. It is a database that is maintained by Surrey Police Behavioural Science Section. The database contains national and some international cases of rape. The system primarily uses coding definitions to identify components of behaviour, circumstances, characteristics of the event, victims and offenders and can be used to identify possible similar crimes and/or suspects. This unit investigates organised and systematic abuse of the Social Security claims and payments systems. Activities include the use of stolen, manipulated and counterfeit payment material, as well as the use of false identities to make multiple fraudulent applications for benefits. Bramshill Library is located at Bramshill, Hampshire. The library holds a vast amount of material relating to all aspects of law enforcement. The library is free for all police officers and police staff to join, and provides a postal service. BTP is the national force for policing the rail network, London Underground and Docklands Light Railway. BTP has regional offices that can be useful contacts. CATCHEM stands for Centralised Analytical Team Collating Homicide Expertise and Management. It is a database that holds information on abductions and murders of females under 22 years of age and males under 17 years of age since 1960. The database is maintained by the NCPE. Transport for London deal with the processing of congestion charge payments and registration of vehicles that are exempt. Vehicles are captured entering and leaving the congestion charge area and this information is stored.
BADMAN
Bramshill Library
CATCHEM
50
COLLECTION
Features The Counterfeit Currency Unit is part of NCIS, based in London. All counterfeit currency or suspect counterfeit currency is sent to them from police forces. The unit looks, for example, at trends, links and types of note. They work closely with the Bank of England and receive all counterfeit notes for destruction. There are a number of credit reference agencies that can provide a range of details on individuals, limited and non limited companies and vehicles. Their services include: business information services, direct marketing services, ID verification and fraud prevention services and consumer credit data services. These agencies include Dun & Bradstreet who specialise in business information and Experian and Equifax who provide information on a wider range of topics including consumer and business information, vehicle information and direct marketing services. The DVLA (Driver Vehicle Licensing Agency) holds the central database for vehicle registration and driver details. The police can carry out enquiries with the DVLA through the use of postal forms. Enquiries are mainly for new keeper details not shown on PNC and historical previous keepers of vehicles. Europol is the European Union Law Enforcement Organisation. Its mission is to assist law enforcement authorities of Member States in preventing and combating terrorism, unlawful drug trafficking and other serious forms of international organised crime. The Forensic Intelligence Bureau is a department within the FSS that provides the following services: Familial searching this includes either parent/child searches or sibling searches where the National DNA database has not matched any profile currently held; Ethnic inference this is used to give some indication of a persons ethnicity; National Firearms Forensic Intelligence Database (NFFID); Intelligence-led screens using a crime stain and matching a prioritised group of individuals who provide DNA samples on a voluntary basis; Pendulum List Searching (PLS) this is a software program that can be used to interpret DNA mixtures, where two peoples DNA has mixed; Partial crime stain profile service this service is provided in cases where a crime stain has produced a partial DNA profile that is not suitable for loading on to the National DNA database. Potential matches from the national database are refined using scientific analysis. This list may be further refined using geographical restriction; Rare Allele Mapping some alleles are classified as rare according to their frequency among the population. Where a crime stain profile contains a rare allele and has not produced a match to an individual on the DNA database, rare allele mapping can be used to determine the distribution of this allele throughout England and Wales; Mitochondrial DNA and Y-STR profiling the techniques use the inheritance of characteristics of different DNA elements, and can be used to eliminate potential relatives identified through familial searching.
DVLA
Europol
51
Features There are a number of national and local systems that contain information relating to forensic intelligence and evidence. These include: The National DNA Database (NDNAD) holds records of all persons and scenes where DNA has been taken. As DNA is recovered, it is automatically checked against outstanding persons and scenes; The National Automated Fingerprint Identification System (NAFIS) contains details of persons who have had their fingerprints taken. Lifts taken from scenes of crime can be compared to this database. Locally, all forces will have records of forensic marks from scenes, including footwear. HMRC is responsible for collecting the bulk of tax revenue, paying tax credits and child benefit and strengthening the UKs frontiers. They deal with: Income, corporation, capital gains, inheritance, insurance premium, stamp, land and petroleum revenue taxes; Environmental taxes; VAT; Customs duties and frontier protection; Excise duties; National Insurance; Tax Credits; Child benefit and child trust fund; Enforcement of the national minimum wage; Recovery of student loan repayments. HMRC will provide information they hold on persons suspected of, or having committed, offences within their jurisdiction.
There will be many incidents held on HOLMES and HOLMES 2 that should be continually considered for data mining information, including intelligence. The IND are part of the Home Office and are responsible for immigration control, managing immigration in the interests of Britains security, economic growth and social stability. The IND work in the areas of: Immigration consider applications from people who, for example, want to come to the UK to work, to conduct business or settle; Nationality consider applications from people who wish to become British citizens; Asylum determine applications from asylum seekers as well as removing people from the UK when their claims fail; Border control; Law enforcement enforcement of immigration laws as well as forming them; Appeals fast and efficient processing of appeals made against IND decisions.
52
COLLECTION
Features This department undertakes criminal investigations on behalf of the Inland Revenue. Consideration should be given to providing them with any information that suggests a person may have evaded the payment of revenue, either in the form of income tax or employee contributions. Interpol aims to provide a unique range of essential services for the law enforcement community to optimise the international effort to combat crime. It provides three core services: A unique global police communication system; A range of criminal databases and analytical services; Proactive support for police operations throughout the world. The Land Registry holds details of the owners of residential property throughout England and Wales. Under an authority and with payment of a fee, it is possible to find out all properties owned by a particular person or the historical ownership of particular properties. This service is provided by the Forensic Science Service. It compares malicious communications such as anonymous letters, emails, text messages and graffiti against a national selection with the aim of linking crimes. This is a statutory civil police force with particular responsibility for the security and policing of the MOD environment. It provides and contributes to the physical protection of property and personnel within its jurisdiction. Access is available via this helpdesk to a database containing a list of experts, accredited behavioural scientists, statistical profiles and details of SIOs with experience gained during their career. Support is also available from psychologists, forensic scientists and other specialists. The remit of the NCS is to tackle serious and organised crime. It is at the forefront of establishing partnerships with international law enforcement agencies as well as supporting domestic UK forces. NCS works closely with NCIS, HMRC, UKIS and the Home Office, as well as international partners across Europe and the rest of the world. In 2006, NCS will become part of the new Serious Organised Crime Agency (SOCA). The NCPE maintain this database. The database is mainly focused towards the victim, analysing both the scene and the victims wounds. It identifies specific injury patterns caused by a variety of weapons and covers homicides and suspicious deaths since 1992. NCIS is a non-departmental public body. Its functions are to: Gather, store and analyse information in order to provide criminal intelligence; Provide criminal intelligence to police forces in the UK, the National Crime Squad (NCS) and other law enforcement agencies; Act in support of such police forces, PSNI, NCS and other law enforcement agencies carrying out their criminal intelligence activities. NCIS will become part of SOCA planned to start work in 2006.
Interpol
Land Registry
National Centre for Policing Excellence (NCPE), Operations Helpdesk National Crime Squad (NCS)
53
Features The NFFID is based within the Forensic Science Service Forensic Intelligence Bureau. NFFID comprises of two separate computer databases. The first is an information database that allows information from weapons and ammunition to be collected, interrogated and interpreted in one central point. It holds detailed records including types of weapons, makes, models and calibre along with incident data. The second part is an automated system that can compare components of fired ammunition from outstanding crimes and recovered weapons. It operates by suggesting a list of possible matches, either crime-to-crime or gun-to-crime. The PNMPB was formed in 1994. It is Home Office funded and staffed by police staff based at New Scotland Yard. The Bureau is for the use of all UK police forces. It maintains a computerised database of missing persons reported to the police, and unidentified bodies and persons. This service deals with, or assists the Police Service and other law enforcement agencies with, all aspects of security and criminal investigations affecting the Post Office and the Department of National Savings. The Royal Mail and Post Office Counters Ltd., however, maintain their own self-supporting security and investigation units. Facilities that are available with the appropriate request are to: Redirect mail checks to identify the new address of customers; Check, for a period of twelve days, the mail delivered to particular addresses with a view to identifying the recipient and sender; Identify the owners of PO boxes; Provide details of telephone calls from Post Office premises; Identify the address corresponding to postcodes; Identify the Post Office code on Giro cheques; Provide information on Post Office employees. The Royal Air Force Police are responsible for criminal investigations, counter terrorism and counter intelligence activities, and general police matters that affect the RAF. This is the Armys police force and their role is to police the armed forces at home and overseas, in peacetime and when at war. This is the Navys police force and their role is to police the Navy forces at home and overseas, in peacetime and when at war. In addition to the SCAS database, the Metropolitan Police Service maintain a database of serious offences. SOCA is due to start work in 2006. It will be amalgamation of NCIS, NCS, HMRC and the UK Immigration Service. It will provide a specialised and relentless attack on organised crime. SOCA will be instigated as part of the Serious Organised Crime and Police Act 2005.
Royal Military Police (RMP) Royal Naval Service Police (RNSP) SDC1(2)/(3)/(4) Homicide Consultation Serious and Organised Crime Agency (SOCA)
54
COLLECTION
Features The SCAS database is maintained by the NCPE Serious Crime Analysis Section who act in a consultative manner and have a national remit to carry out work on behalf of forces on cases falling into set criteria. This includes the following crime types: Murder with a sexual element; Rape and serious sexual offences; Abduction. Police forces are required to submit all offences that fall within these criteria to SCAS. This role is carried out by Contact Officers in each force who coordinate the gathering of papers in relation to a case. The information within these papers is entered on to the system in the form of a comprehensive questionnaire, and the Analysts use their experience to search the database for similar offences. SCAS analysts produce a report for each case analysed which includes: An interpretation of the behaviour displayed within the offence in order to enhance the Investigating Officers understanding of the significance of the behaviour, eg, statistical rarity or relationship between behaviour, and to provide some parameters for searching of in-force systems; Details of similar offences which the Analyst believes could potentially have been committed by the same offender; Further analytical recommendations which may benefit the investigation. Stolen Vehicle Intelligence have access to various computer and manual databases and contacts with the motor trade including manufacturing, salvage and repair organisations, insurance companies, loss adjusters, credit agencies and the DVLA. Manual databases include details of locations of identification numbers on vehicles and vehicle valuation guides, along with equipment that can reveal the presence of electronic tagging devices. Computer databases available are Motor Insurers Anti-Theft and Fraud Register (MIATFR), Hire Purchase Information System (HPI) and Experian. Truck Pol is run by the Metropolitan Police Service. It was established to coordinate and disseminate information, nationally, about truck crime including crime trends, hotspot locations, series, Modus Operandi (MOs) and known nominals. Each force has a single point of contact located within their Force Intelligence Bureau. The UKPS is an executive agency of the Home Office that issues UK passports to British Nationals living in the UK. Violent and Sex Offenders Register a national database with local interface.
Truck Pol
55
Features The Ambulance Service records details of locations of all calls, along with the initial nature of the call. Most ambulance data tends to be limited as it is primarily focussed on casualty reduction. CCTV footage may be used to identify nominals within specific locations at specific times. It can support incident analysis and generate further lines of enquiry. Local authority education departments are required to keep records relating to pupils and students attending schools and colleges in their area. Details are likely to include: name, address, parents name and address if different from the pupils, contact in case of an emergency and some medical record information. There may also be details of a pupils school record, for example, exclusions from school. The Fire Service covers force areas. Details they hold that may be of use in investigations include information regarding whether or not fire calls are malicious, details of premises requiring a Fire Certificate (eg, hotels, factories, shops) and the name of the certificate applicant, proposed use of premises and plans of the building. They can also provide material in relation to previous arsons they have attended but which have not been reported to the police. Local licensing authorities hold records relating to drivers, vehicles and companies involved in, and licensed to apply for, hire either as a taxi or private hire. Records held by the local health authorities are mainly medical records. Details within these records will not generally be released without the authority of the person in question, unless that person is deceased when the coroner can provide authority. Information can be provided regarding the occupancy of premises under the Authoritys or Agencys control. Contact should be made with the local district compliance office if information is required that relates to a potential Inland Revenue offence. If this is not the case, access to the information can only be gained via a court order. Local Trading Standards departments hold information on consumerfocused operations, and collect intelligence in relation to infringements of trading standards.
Education Authorities
Fire Service
Hackney Licensing
Health Authorities
Trading Standards
56
COLLECTION
Features Trafficmaster is an established technology company focusing on satellite navigation and digital traffic information. It monitors all traffic flows through masts located at key points across the country. Each of these companies maintain records for its own purposes, specifically how payment is made for the goods/services they provide. This can include anything from household fuel to television subscriptions.
Utility Providers
Some examples of Open Source Data are shown overleaf. This list is not exhaustive and refers to both international and UK-specific data sources.
57
Features Acorn and Mosaic are companies that provide consumer data. They classify consumers into specific categories and give these groups attributes about their lifestyles including housing, area of residence, vehicle types used, age and sex. They are usually grouped within postcode areas and can be provided by credit reference companies. Such information may be of use when carrying out social and demographic trend and crime pattern analysis. All limited companies in the UK are registered at Companies House, an executive agency of the Department of Trade and Industry. There are more than 1.8 million limited companies currently registered, and more than 300,000 new companies are incorporated each year. The main functions of Companies House are to: Incorporate and dissolve limited companies; Examine and store company information delivered under the Companies Act and related legislation; Make this information available to the public. Every eligible person in the UK aged 18 or over is required by law to provide their details to the local authority for the purpose of voting in elections. Two versions of the electoral roll now exist, a public version accessible on the internet and in public libraries, and a closed version that is accessible by the police and other law enforcement agencies. The internet can provide data on a large variety of topics. Advice should be sought before carrying out searches on this medium. Many of the items listed in this table will be available through this forum. Such documents are useful in providing background information and tend to focus on good practice and application of legislation. Library facilities are provided by each local authority area, most have a computer network established to record book usage, other media and members details. Both broadsheet and tabloid newspapers and magazines at national and local levels can provide information. Within a major incident such sources of data may not only provide information on the investigation but also pictorial images which may lead to further lines of enquiry. Persons who are crime reporters belong to the Crime Reporters Association. This means they have to abide by certain codes and regulations. Points of Interest is a unique location-based database of over 3.5 million entries. These include tourist and leisure attractions, businesses, public buildings, retails outlets and landscape features. They can be split into features that have an address such as shops, hotels and dentists and those that are non-addressable such as golf courses, lakes and hilltops. It is available from Ordnance Survey and covers England, Scotland and Wales.
Companies House
Electoral Roll
Internet
58
COLLECTION
Features These may include the British Crime Survey (BCS) or local and force public perception surveys. Again this is useful in providing background information regarding perceived levels of crime and disorder. Such information may be beneficial when carrying out Risk and Results Analysis. Examples of these include publications from qualified experts, Home Office publications and research documents. This includes census data, Multiple Index of Deprivation, local authority data, health and education data. Such information may be particularly useful when analysing critical incidents, conducting risk analysis and predicting strategic trends. Information contained within television programmes may provide useful background information. If, however, this is to be used in an evidential manner, relevant authorities should be sought.
59
Accuracy
Reasonableness
Support
7.4 SCHEDULES
As the role profile states analysts must ensure all documents are read and analysed. Therefore at the start of the collection phase consideration should be given to compiling a schedule of all material read by the Analyst and Researcher. This schedule should record when a document has been read. Dependant on the size and nature of the inquiry it may be beneficial to sub-categorise this schedule by themes, eg, victim, offender and incident. This will allow the Analyst and Researcher to easily identify those statements relating to specific topics. A schedule of this nature will ensure that the Analyst and Researcher have received, read and recorded all material relating to the enquiry.
60
COLLECTION
22 23 24 25 26 27 28 29 30 31 JP 12/12/02 KS 10/01/03 A 08/02/03 JP 12/12/02 KS 10/01/03 GP 20/12/02 GP 20/12/02 JP 11/12/02 JP 11/12/02 A 08/02/03 B 16/02/03 JP 11/12/02
LEGEND GP, JP, KS = Initials of reader. Date (20/12/02) = Date information read. Number (eg 22, 23, 24) = Statement provided by a nominal and unique number assigned (eg, S25). A, B, etc. = Subsequent statements by nominal, that have been read.
This does not have to be a paper-based process and can be managed through HOLMES 2 by using tags. When each document has been viewed, the Analyst can apply a tag such as SBA (Seen by Analyst). Using this system, the Analyst can undertake a tag enquiry which will return all those documents with no SBA tag.
61
All documents produced by analysts and researchers should be password protected. This will ensure that documents are not amended by anyone other than the author, thereby maintaining the audit trail. Analysts may also wish to consider converting their documents to pdf format as this will minimise storage space required and prevent documents being altered.
62
COLLECTION
All exhibits must have a label with key descriptive and continuity information
on it; If an analyst has signed for an exhibit then it is the responsibility of that analyst to ensure that the exhibit is stored securely and not handled by anyone else; If the exhibit has forensic value to the investigation, the Analyst or Researcher should not handle this. The Exhibit Officer should be the only handler. It may be appropriate for the exhibit handler to make copies which the Analyst or Researcher can then use as the exhibit may have forensic value, the Analyst should always wear gloves and handle the item carefully. If a copy cannot be made, a decision as to how the Analyst or Researcher will access the exhibit needs to be made by the Crime Scene Manager or the Exhibit Officer; In circumstances where the SIO and/or crime scene manager has identified an exhibit as having no forensic value, the original exhibit can be viewed by the Analyst or the Researcher wearing gloves; Where an item needs to be referred to continually (for example, a handwritten document exhibit) a working copy should be produced so that it can be handled without damaging the original document. This new copy will also be subject to disclosure legislation; Where a video or audio tape exhibit needs to be viewed or listened to by the Analyst, a working copy should be made available. It is usually the responsibility of the Exhibits Officer to make this copy; In order to ensure the continuity of exhibits, they should not be handed over to anyone else while in the Analysts/Researchers possession, other than back to the Exhibit Officer. An unusual or unnecessary amount of handovers of exhibits will present opportunities to the defence; Most exhibits will be sealed. If the decision has been made that the Analyst or Researcher can view the original exhibit (see above), the Exhibit Officer should break the seal or be in the presence of the Analyst when the seal is broken; A note must always be made of any exhibits that have been handled and the purpose for this in the Analysts/Researchers notebook, including times and dates and who the exhibit has been handed to and from.
The Analyst should always consider viewing exhibits as an important part of their data collection process. They should also constantly review the exhibits list on HOLMES 2. Local training can be made available to Analysts and Researchers with regards to exhibit handling.
63
A general feel for the area, dwelling or crime scene; An understanding of the features such as topography, terrain and lighting
conditions; An orientation as to the direction of travel and movement of key subjects; An enhanced knowledge of key locations in order to understand distances and timescales. By integrating all of the investigative material with crime scene information, the Analyst is better placed to highlight discrepancies, expose information gaps and lines of enquiry, and understand intricacies of the case. With this enhanced understanding, the Analyst can develop inferences and construct hypotheses which are both dynamic and pragmatic. There are a number of key considerations that should be taken into account before attending a scene:
Authorisation Provided analysts should not assume that they have the right
to attend a scene. It is imperative the SIO grants permission and that the Crime Scene Manager or any other relevant person is informed of the Analysts attendance prior to a visit; Preparation the Analyst should consider what information may be required while at the scene, eg, maps, timelines, statements and photographs; Health and Safety the Analyst should consider whether they have the appropriate equipment and protective clothing, if required; Protection of the Scene a level of knowledge may be required, or precautions taken, to protect the integrity of the scene; Timing of Attendance the Analyst should consider whether it is a good time to attend the scene and whether their attendance has been recorded and communicated. Factors to consider may include whether other people are attending at the time, the collection of evidence or if searching is ongoing; Scene Contact it may be beneficial to have a contact at the scene to act as a guide.
It is essential that analysts use the knowledge they gain from scene visits in their work. This will help to ensure that the resulting analysis assists the inquiry and demonstrates the value of these visits to the SIO.
64
Section 8
COLLATION
SECTION 8
he organisation of data into numerous formats is explored in this section. Charting techniques, spreadsheets, tables, databases and maps are provided along with practice advice on their application within a major incident. Training in these techniques in order to support the court process and the IT required for their production, is an essential factor in the collation stage and is described here. This section also covers the issues of financial and communications data, describes the types of data that an analyst can expect to encounter within a major incident, and the boundaries between analysts and experts within the communications field. CONTENTS 8.1 8.2 The Collation Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Charts ............................................... 8.2.1 Charting Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.2 Network Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.3 Timelines/Sequence of Events Charts . . . . . . . . . . . . . . . . . . . 8.2.4 Statement Comparison Charts . . . . . . . . . . . . . . . . . . . . . . . . Spreadsheets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.1 Comparative Case Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.2 Timelines/Sequence of Events Spreadsheets . . . . . . . . . . . . . . 8.3.3 Witness Comparison Charts . . . . . . . . . . . . . . . . . . . . . . . . . . Tables ............................................... Databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Maps ............................................... Commodity Flows including Financial Material . . . . . . . . . . . . . . . . . Communications Flow and Frequency Charts . . . . . . . . . . . . . . . . . . 8.8.1 Communications Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.8.2 Telecommunications Data Types . . . . . . . . . . . . . . . . . . . . . . . 8.8.3 Flow Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.8.4 Network Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.8.5 Frequency Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 67 67 69 70 70 70 71 71 74 74 74 75 75 76 76 77 78 79 79
8.3
65
analysts may collect information through a variety of means; put that information into a computer; create charts and summaries from the information; but none of these are analysis. Analysis is the intellectual portion of the intelligence cycle deriving the meaning from data. If analysts are not thinking, they are not analyzing [sic]
M Peterson, Intelligence Analysis Training: New Frontiers, Intersec, 2004
Charts; Spreadsheets; Tables; Databases; Maps; Commodity flows including financial material; Communication flow and frequency charts.
It is essential that such products are not considered to be the final analytical product. The evaluation and subsequent interpretation of collated material are the key processes that change material into analysis. A primary stage of the collation process is reading all the material. The Researcher or Analyst should develop processes for annotating material and may want to categorise this material in a structured manner. The volume of material to be collated may dictate whether categorisation of material is required. If categorisation is deemed appropriate then advice should be sought on the topic areas. The Analyst or Researcher should bear in mind that categories are likely to become theme lines and, therefore, there should be a correlation between the two. For example, categories may include:
Victim sightings/movements; Victim background; Suspect movements; Suspect background; Suspicious sightings.
The purpose of the second stage, collation, also known as data description, is to arrange the material in a clear and simple format. Consideration should be given to the most appropriate method for this and will depend on the size and complexity of the enquiry, which will need access to the product and what its future use is likely to be. The ability to be innovative and flexible, therefore, is essential.
66
COLLATION
The collation stage may involve summarising material such as statements or interviews. It is important that this is conducted accurately and that the Analyst or Researcher does not interpret or change the nature of the original document. Exact words and phrasing should be used where possible. During the collation stage, the Analyst may begin evaluating material that is before them. The Analyst should construct their collation tools in ways that facilitate the recording of these initial evaluation processes. It is essential that all documents are labelled correctly. This not only includes a GPMS classification but also versions of documents, authors details, date, operation name and whether the document is of an intelligence or evidential nature. Document version control is absolutely crucial, as this allows the Analyst or Researcher to:
Have an audit trail of development of products; Provide an accurate view of what facts they were aware of at any given point
in time;
Ensure officers have the most up-to-date information on the right document; Maintain good document housekeeping procedures. 8.2 CHARTS
Charting is one of the basic tools the Analyst uses to collate material. Charting is now done electronically, supported by purpose-designed software. Every analyst, however, should understand the theory behind charting. All those using charting software must be appropriately trained in the theory and technology of it. A lack of training may be scrutinised by the defence where an Analysts material is used in court. Charts can be beneficial in assisting visual investigations and the analysis of complex material. There are a variety of formats which a chart can take, including:
Network chart (association chart); Timeline (sequence of events chart); Statement Comparison Charts; Flow charts; Frequency charts.
67
In order to protect the Analyst when producing material as evidence, specific protocols in relation to charting must be followed. Analysts should enquire as to whether their own organisation has specific charting protocols that should be adhered to. The following table outlines the charting protocol principles that can be applied in any situation. The headings used in the table below refer to stages 1 and 2 as described earlier in this section. FIGURE 3 Charting Protocols Matrix
Description Unconfirmed information Intelligence Unsourced information (eg telephone material that has been supplied for intelligence purposes only) Hearsay Protective Marking Previous Convictions (Bad Character) Operation Name R v Defendant Legend: Title on chart; Authors Name; Authors Job Title; File Location; Date and time chart produced; Version; Icons/symbols/attributes used on chart with label explaining what they represent. Source Documents (either to be included in legend, on cards, on icon/symbol or on statement if being produced as exhibit) Exhibit Number Exhibit Label (attached to chart) Authors Signature Statement (producing chart/s as exhibit) Textual material highlighting analytical thought processes (eg, discrepancies, intelligence gaps) Copyright Scale (maps) Intelligence Evidence
68
COLLATION
When producing intelligence charts, the material that is in intelligence format must be denoted in an explicit way, for example, use of colour or bold text. Analysts and researchers should also be aware that all material has the potential for being disclosed and therefore entries such as textual information on an intelligence chart should be carefully considered. Optional annotations may include:
69
8.3 SPREADSHEETS
Spreadsheets can be used to collate material to support a variety of analytical products. Spreadsheets will be one of the Analysts and Researchers most versatile tools and allow a straightforward approach that can be shared very easily as necessary and appropriate. They are usually the least time consuming product to produce. The Analyst and Researcher should consider the use of spreadsheets as a first step in the collation process. Such documents can be imported easily into chart format at a later stage if necessary. The Analyst should advise and provide guidance to SIOs as to the most appropriate format. Spreadsheets are often contained within common IT software and therefore users do not require specialist training. This may be a benefit at the court stage, particularly as they prevent scrutiny of chart features, such as colour or specific icons that can be used by the defence to suggest bias on the part of the Analyst or investigative team. The use of spreadsheets is inclusive of the Researcher who may not be trained in specialist software for charting.
70
COLLATION
Accessible by all; Do not require specialist training; Allow large amounts of material to be easily displayed; Facilitate easy updating; Can be easier to read; Particularly useful when large volumes of material are involved which if displayed on a chart would be unmanageable and sizeable; Adaptable to the use of themes, using colour; Can allow the user to begin the evaluative process and annotate the spreadsheet accordingly.
71
The thought process involved in setting up a spreadsheet timeline is very similar to that of chart timelines. Parameters should be set for:
Themes; Column headings; Start and end times and dates; Scope.
Consideration may need to be given to establishing a consistent approach to displaying and describing times of events, particularly where no definitive time is provided. TABLE 12 Features Included in a Spreadsheet Timeline
Feature Source Comment
This details the origin of the material, eg, statement number and interview
number. This is normally in numerical or alpha-numerical format.
Name
This details the author of the material and is normally the name of a person
or company.
Date
This is the date of the event the material is referring to. In conjunction with
the time field, these two fields set the chronology for the entire document. It is, therefore, essential that they are kept separate.
Time
This is the time of the event the material is referring to. In conjunction with
the date field, these two fields set the chronology for the entire document. It is, therefore, essential that they are kept separate. In instances where no time is provided or an imprecise time is given, a decision should be made from the start as to how these are going to be displayed. For example, if the material states an event occurred between two times, then the first time will always be used. If no time is provided, this material will always be shown at the start of the date. Where possible, the anomalies regarding time should be shown in the event field.
Event
This details what the material source is referring to, eg, a sighting, an action
or a communication.
This should summarise that detail of the material using the exact words or
phrases where possible. Comments
Date Saved
This is the date that new material is added to the spreadsheet. This allows
easy searching when it is necessary to see what material has been added to particular versions. Additionally, if an auto filter is added to the spreadsheet, this column will allow users to self brief.
72
COLLATION
Red Text
Coloured text can be used to highlight any required feature. For example, red
text may be used to highlight sensitive material, ie, information in intelligence format.
Other
Spreadsheets can also be used to produce simple timelines. Such products are based on overall timelines and display material relating to one or more themes. By grouping material together in a chronological manner, eg, all sightings of a victim, they highlight where gaps in movements and material are. These documents are high level snapshots of specific time sequences and can be a useful way of focusing the evaluative and analytical thought processes around gap analysis. FIGURE 4 Simple Timeline Showing Movements of Suspect on 01/01/2006
01/01/2006 00:00- 01:00-02:30 01:00 approx Searching fields with officer 02:3003:00 Home 03:0003:30 *Visits local shop 03:30 03:35- 03:57- approx 03:55 04:07 04:00 Home Gym Fields 04:08- 06:05 06:00 Home 06:10 06:1506:30 *Driving out of town
Legend Shaded areas indicate an eye witness sighting. * Partial time accounted for (please see witness statement) Notes 1. Time periods are non-proportionate 2. Some times provided by eye witnesses are approximate please refer to Word document for details. 3. Some sightings are unconfirmed please refer to Word document for details
73
8.4 TABLES
In the event of relatively small amounts of material being collected, it may be appropriate to display this material on a table. The Analyst or Researcher should continually bear in mind the simplest approach to collation. Tables can be used to assist case and witness comparison charts by providing snapshot information easily but analysts should be mindful that they are less flexible than spreadsheets where material is continually added.
8.5 DATABASES
Within a major incident, bulk data sources may be made available to the inquiry, for example, downloads from PNC, VODS, QUEST or ANPR. It is usually unlikely that this material will be put onto the HOLMES 2 system in its entirety, therefore, crossreferencing between multiple sources of data needs to occur in an alternative format. It is essential that a download of HOLMES 2 is periodically completed in order that the separate databases can be compared against the core system. It is also possible to complete specific data extraction from HOLMES 2. The use of databases to compare sets of data is usually the most effective method to achieve this. The application of this process will facilitate searching for common elements such as names, vehicles or addresses. Where there is not adequate provision for certain types of information that need to be searched, it may be necessary to create a database to supplement HOLMES 2. For example, a police force has undertaken an investigation which involved significant detail about dogs and bicycles in a park at the time of the murder. Although this information could be recorded on HOLMES 2 in its basic format, descriptions could not easily be searched and so the Analyst decided to create a separate database using standard categorisation.
74
COLLATION
8.6 MAPS
The collation of material onto maps requires the Analyst to be familiar with, and have access to, a mapping system. The material to be portrayed on maps needs to be sufficiently geographically referenced. This reference may be an address, postcode or geographic reference numbers such as eastings and northings. Using maps to collate material can have benefits, they can be used to: Demonstrate links between geography and time within the context of a major incident; Highlight routes taken by subjects and vehicles, and locations where phones have been used; Demonstrate the proximity of key locations or events; Provide standard layouts for search teams and house-to-house enquiries; Prompt officers when interviewing or taking statements. When maps are being produced, copyright regulations should be adhered to and all maps should show a scale. If maps are being produced as evidence, the author should be trained in the software to be able to withstand scrutiny at court. It is possible to combine maps with other collation techniques, such as network charts, frequency charts, etc. This will help to maximise the description of information thereby facilitating evaluative and analytical processes.
75
Telephone calls landline and mobile; Text messages; Pay phone; Emails; Chat rooms; Internet access; Telephone account details; Cell site; Pagers; Radio communication.
Communications data is another material source used to indicate peoples movements, associations or conversations. This material can be highly beneficial in an investigation when trying to determine sequence of events, confirm movements and/or establish motive. Analysts should be aware that communications material does not necessarily mean that the subject under investigation, or subsequently discovered associates are in possession of the communications technology at the time of transactions. This emphasises the key role of the Analyst or Researcher in corroborating such material with additional material such as witness sightings or CCTV. The first stage of collating communications data is to format the material in a consistent manner so that it can easily be imported into charting software. It is essential that the Analyst has a working copy and saves a master copy that can be referred to at a later stage. Most telecom companies send their material in differing formats, both electronic and paper. Times, dates, durations, caller IDs and the different types of calls (eg, text, national, local, mobile and voicemail) can appear differently with each company. Communication with the SPOC is necessary in order to ensure that material is interpreted correctly. Where material arrives in paper format, administrative resources should be secured to support the Analyst or Researcher. The material can frequently be high volume and contain very specific information that needs to be accurately transferred into an electronic format, in a timely manner. When communications data is initially received, it will often be in a sensitive format. Material that may later be required as evidence must always be highlighted to the SIO. The Analyst may have a role to play in monitoring the transition of sensitive material into an evidential format. It is crucial that the sensitive nature of the material is reflected in collated products. It may be useful to maintain a separate product that tracks the development of evidential material from its original sensitive status.
76
COLLATION
Each time communications material is received, irrespective of whether at face value it appears to be the same as material already held, a thorough comparison must be carried out. It is not unusual for material from the same company to change over a period of time. This is often dependant on the department and software within the company that produces the material. Examples of this include new telephone calls, differences in durations or missing calls. If such problems are found, these should be recorded immediately and brought to the attention of the SIO and SPOC. Within some major investigations a Telephone Liaison Officer (TLO) may be appointed. Their role is to complete requests for communications data in accordance with RIPA, to ensure consistency in applications and to minimise the need for data requests. They will be the single point in the investigation for the SPOC and ensure that the investigation remains focused in relation to communications data. This resource is a valuable reference point for the Analyst or Researcher. Collation issues and techniques should be discussed with the TLO in order that the methodology is fully understood by those who will be using it.
77
A basic table or spreadsheet that details evidence linking a person to a phone can be helpful when working with large volumes of data. This can be particularly pertinent if later called to court over evidential analytical work and questions are raised as to how phone numbers were linked to particular persons, organisations and/or businesses. Itemised Billings/Call Data Telephone billings list numbers called and destination numbers in a chronological format. Times and dates are included in addition to the duration of the call. Both incoming and outgoing billings for one telephone number can be requested, however, RIPA legislation strictly covers this information in order that a proportional approach is taken. It may be useful for analysts to set up a database containing both the subscriber details applied for in the investigation and the billing data. The numbers contained within these sets of data can then be easily cross-referenced. Cell Site Cell site is a telephone billing with additional material about the mast site which the mobile phone used to connect the call. The material provided will name the cell site. Although detail can be obtained as to the general geographical area that cell site covers, there are a number of factors that affect the preciseness of this material, for example, weather and the volume of calls. In its raw format cell site material can be used to collate general locations. This can help to corroborate statements or hypotheses within a timeline. Used in conjunction with mapping, it can be used to portray general routes and proximity to key events. There are technological experts who are able to interpret cell site material precisely, and refine the material to support the development of the inquiry. These experts will produce their material in evidential format and are considered expert witnesses within the court environment. It is essential that analysts exercise caution when using such material to progress the inquiry and liaise with SIOs about the boundaries of their work. The Analyst can be involved in meeting the expert witness. This has a twofold benefit as it will increase the Analysts knowledge and they will have a familiarisation with the case and be able to assist the expert witness. Communications data can be collated in a number of different formats. It may suit the user to manipulate material in a simple spreadsheet format but there are advantages to displaying material in chart formats. Different types of charts can demonstrate various aspects of communication, for example, frequency of calls, associations, direction of calls or calling patterns.
78
COLLATION
Flow charts can identify specific calls that need to be included within timelines. Flow charts are particularly useful when determining patterns in caller activity. The identification of such patterns can demonstrate lifestyle activity and can be used in the analytical process. For example, it may be of value to determine a sequence of events prior to a murder. There is software available that supplements charting technology. It is designed to seek out patterns and routines of communications data.
79
80
Section 9
EVALUATION
SECTION 9
valuation underpins analysis and examples of the techniques used are provided in this section. Interpretative techniques including brainstorming, charting evaluation, inference development and hypothesis testing are explored along with the specific requirements of covert intelligence analysis. CONTENTS 9.1 9.2 The Evaluation Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Brainstorming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2.1 Brainstorming Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2.2 5WH Matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2.3 Brainstorming Outcomes . . . . . . . . . . . . . . . . . . . . . . . . . . . . Charting Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Covert Intelligence Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Inference Development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Hypothesis Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 83 84 84 86 86 87 87 88
81
Brainstorming including the 5WH Matrix; Charting evaluation; Covert intelligence evaluation; Inference development; Hypothesis testing.
The evaluation of material can involve the generation of some of the most innovative methods of interpretation. These can help to define the most appropriate analytical product for the set task. It can also be an extremely simple process whereby the Analyst decides whether items should or should not be included in their analysis, or whether specific information items have greater value than others. In order to ensure that the evaluation stage is informed and objective, the collection and collation stages must have been completed thoroughly. Without all the relevant and accurate material having been obtained, read and organised, the interpretation of the material may result in a flawed product. The role of the Analyst and Researcher is to provide timely, relevant and objective products that support the decision making of senior officers and, therefore, influence the direction of the inquiry. While the Researcher will be heavily involved in the collection and collation stages, their involvement in the evaluation stage will depend on the technique. Researchers can have a valuable input into brainstorming and 5WH processes due to their extensive knowledge of the case. Decisions regarding the relative value or interpretation of material, however, should be completed by the Analyst. The Researcher has a key role in supporting the Analyst in the evaluation process by determining the provenance of material that has been generated through evaluation techniques. By doing this, they help to ensure the objectivity of the analytical process. The Analyst or Analyst Manager may wish to include the Researcher for developmental purposes in other evaluation processes. This should always be done in a mentored or guided manner. There are a number of resources in a major inquiry which can assist in interpreting material. These may be specific people or groups of individuals who have detailed knowledge of either the entire case or specific thematic areas. In order to ensure that the evaluation stage considers all material, these people must be included in evaluation techniques. People to consider can include:
SIO; MIR staff; Enquiry teams; SOCO staff; Specialist staff (eg, intelligence cell, economic crime unit, financial investigators, search teams, forensic specialists and CPS); Partner agencies.
82
EVALUATION
The outcome of evaluation sessions can be maximised by considering in advance the appropriate use of intelligence and evidential material. Consideration must be given at all times to the restriction of material, for example, GPMS, and the persons attending these sessions. Evaluation often includes sharing ideas and spontaneous discussion. It is important that any evaluation techniques used are conducted in a structured manner with all the thought processes recorded. Where the process involves a simple evaluation of material to be included or excluded, all decision making should be recorded within notebooks. Consideration should also be given to using a facilitator to ensure the process is managed and to prevent mission creep. Within a major inquiry, the Analyst or Researcher will frequently be the singular analytical or research resource assigned to the investigation. Although they should have supervision and constant communication with Analytical Managers and colleagues, they can become isolated. Time should, therefore, be set aside for evaluation processes whereby the Analyst can share ideas with other analytical staff. Sharing ideas with an analyst not specifically assigned to the investigation can be beneficial. The discussion can help to bring fresh ideas and ensure objectivity, but consideration must be given to the sensitivity of the inquiry and the logistics of including these additional resources within any confidentiality agreements. All evaluation products must be labelled correctly, including version, date and contributors.
9.2 BRAINSTORMING
Brainstorming is one of the most useful techniques that can be used to interpret the meaning of material. It is most valuable when conducted with a manageable number of people who have an informed view of the subject matter. The scale of the brainstorming process should be tailored to meet operational needs. For example, in the majority of cases, analysts will work independently within an MIR and it may be the case that the Senior Analyst or Analyst Manager participates in the brainstorming process. There may be situations where large groups of staff from various departments can enhance the brainstorming process. The application of a structure within which to brainstorm will allow focused and timely evaluation of material. The term brainstorming has been deemed not offensive when used in its correct context, defining a session amassing spontaneous ideas as potential solutions to a problem by The National Society for Epilepsy (UK), March 2004.
83
The Analyst should clearly define the objectives of the session, with agreement
from the SIO, Lead Analyst or senior staff member; A time frame should then be set and agreed with time allowed for each area of discussion; The relevant parties should be informed when the session is due to take place and a suitable location to accommodate the participants identified; If necessary, a facilitator should be appointed and flip charts, white boards and tape or video recorders should be made available for recording purposes; If a facilitator is appointed, they should be made aware of key topics so that they can maintain the momentum of generating and discussing ideas; During the session, consideration should be given to discussing the most appropriate format for analysis and dissemination as a result of the brainstorming.
Disclosure needs to be taken into account at all stages of the brainstorming process and recording techniques should enable comprehensive disclosure, including recording sources of information discussed. Brainstorming can generate fresh ideas and leads based on peoples perception of material and facilitate all of the other evaluation techniques. It is the Analysts role to determine the provenance of that material if it is going to be used to further the inquiry. The Analyst or Researcher should not be afraid to challenge the integrity of the material at this stage. If this does not occur, the objectivity that the Analyst introduces may not be present. An example of a large scale structured brainstorming process is the 5WH Matrix. This technique is included in the ACPO (2005) Practice Advice on Core Investigative Doctrine.
84
EVALUATION
This framework can be applied to any material either at the investigative or evidential stage, although there needs to be a clear distinction between the two. It will be useful if the initial aim of the matrix is established. This may involve assessing the entire case or discrete aspects or themes. It can also be applied to both the high level and detailed information. For example, within a murder inquiry it may be clear that an individual was killed (high level), but, the details of how the murder occurred and the weapons used (finer detail) may be unknown at the time of evaluation. Using the What We Know, What We Dont Know framework can identify intelligence gaps and anomalies. These can then be added as additional columns to the matrix, if the Analyst finds this method most appropriate. These conclusions represent incident analysis. The Police Service of Northern Ireland (PSNI) are developing a similar model to express the 5WH Matrix. This focuses primarily on the links between each area. FIGURE 6 PSNI Evaluation Matrix
Victim
Time
Opportunity/ Motive
MO
Suspect
Location
There can be up to fifteen links between factors that are common to all major incidents. Each of these links should be explored to identify gaps in information and, therefore, help direct the inquiry.
85
If either of these evaluation techniques are being used solely to assess evidential material, it can be beneficial to include the CPS or inform them once the evidence has been compiled as this may help to focus the prosecution case. The SIO should also be informed of the outcome of the evaluation and subsequent analysis. These results can be used to facilitate further brainstorming at briefings. The SIO, however, should be in control of the dissemination of such information as the material may be sensitive or affect team morale.
86
EVALUATION
The format of charts themselves can aid the evaluation process. The use of IT software that manipulates material such as network hierarchies or telephone data layouts can visually begin the evaluation process from a visual perspective. It is the interpretation within a wider context of material, however, that gives this information meaning and facilitates analysis. FIGURE 7 Peacock Layout FIGURE 8 Grouped Layout
Reports can also be used when evaluating charts to highlight the Analysts thought processes. This can help to prevent charts from becoming cluttered and to maintain focus.
87
The principal purpose of serious crime analysis is to provide focus to an investigation through information management and inference development. This is generally through the preparation of analytical products, including discussion with the SIO. The PSNI uses the following framework to inform the work of its Serious Crime Analysts. FIGURE 9 PSNI Inference Development and Information Management
Analysis Information Management Analyst Tasking Inference Development Presentation & Delivery Analytical Products New Lines of Enquiry
SIO
Focus
Actions
MIT
Objectivity Investigation
Objective thought is essential when developing inferences. Consideration should always be given to the value of information and whether other material can support or contradict the premise or inference. The use of a structured framework can help the Analyst to maintain objectivity. For example, the 5WH Matrix can highlight the consistencies and conflicts that support inference development. Inferences are of most value when they are simplistic and focused on the task. They can result in the generation of an analytical hypothesis that provides an overall objectively-based suggestion of what has occurred. Analysts involved in inference development will typically use techniques to describe their thought processes.
Another way of describing an hypothesis is: building a scenario that best explains the available material.
ACPO (2005) Practice Advice on Core Investigative Doctrine
88
EVALUATION
Within a major investigation setting, an analyst can generate an hypothesis based on collected, collated and evaluated factual material. The Analyst is, therefore, in the best position within an investigation to develop hypotheses. SIOs can also generate hypotheses but, in both cases, the hypotheses should be fully tested. This reiterates the importance of communication between the Analyst and the SIO. Hypothesis testing involves assessing the validity of the hypothesis, collecting and collating the relevant available material and evaluating the premises of the information with a focus on proving or disproving the hypothesis. This may lead to the development of further inferences. The Analyst and SIO should be aware of the possibility that alternative hypotheses may be generated, and that these should also be tested. The generation of hypotheses through brainstorming processes can be the catalyst for a new intelligence cycle. In addition to progressing the investigation, hypotheses can also provide a possible explanation for events and can be used to anticipate a number of circumstances such as lines of defence to be used in court or interview. Hypotheses that are formed from limited or uncorroborated material can, at best, only amount to an assumption of what may have occurred and this could be influenced by personal bias or stereotyping. In cases where limited material is available, the generation of hypotheses should be avoided until identified intelligence gaps are filled. The Analyst should only use material that is available to them directly from the inquiry (both open and closed sources). If the hypothesis is developed around specific aspects of the case that require a level of knowledge outside the Analysts role, it may be necessary for a specialist to be appointed, for example, a behavioural psychologist may advise on motive and a geographic profiler may advise on key locations. The issue of disclosure must be considered when generating and testing hypotheses. The reliance on factual information to underpin this type of work is crucial and will help to guard against potential challenges by the defence. Analysts must use notebooks to ensure that they document all decisions made.
89
90
Section 10
ANALYSIS
SECTION 10
he structure of the National Intelligence Model (NIM) provides a framework for the application of the nine analytical techniques within a major incident setting. An additional technique, incident analysis, has been formulated which addresses the issue of analysing timelines and witness information. Each technique is described in detail and their practical application within major investigations is discussed. The methods for determining which techniques should be used in specific situations are also outlined. CONTENTS 10.1 10.2 10.3 10.4 10.5 The Analysis Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Scope of Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Inferences and Hypotheses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The National Intelligence Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.1 Incident Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.2 Network Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.3 Subject Profile Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.4 Crime Pattern Analysis (CPA) . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.5 Risk Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.6 Market Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.7 Social and Demographic Trend Analysis . . . . . . . . . . . . . . . . . 10.5.8 Criminal Business Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.9 Results Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.10 Operational Intelligence Assessment . . . . . . . . . . . . . . . . . . . Which Analytical Techniques Should Be Used? . . . . . . . . . . . . . . . . . 10.6.1 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.2 Victim-Related Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.3 Offender-Related Techniques . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.4 Location-Related Techniques . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.5 Incident-Related Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . 92 92 92 93 93 93 95 96 98 101 102 103 104 104 105 106 106 107 109 111 112
10.6
91
Behavioural Investigative Advisors (BIAs); Geographic Profilers; Forensic Specialists; Criminal Psychologists.
There is a tendency to use analysts in areas that do not meet the role profile or involve their analytical skills. The Analysts technical knowledge, access to systems and their ability to use these systems often means that they are considered as being the only resource able to carry out these tasks. It is important that analysts, researchers and analyst managers continue to challenge and re-educate tasking officers. Analysts are regularly, yet incorrectly, tasked with the following:
Producing maps and charts for illustrative purposes alone; Producing MS PowerPoint presentations; Producing graphical displays; Administrative duties.
The positive value of analysts is derived from the application of high level skills whether in dealing with volume crime, major incidents or any other area of law enforcement work.
92
ANALYSIS
Events (the entire timespan of an incident or specific timeframes within this); Themes (movements of suspects, observations of witness, routes travelled); Identification of new lines of enquiry (new potential witnesses); Gaps and conflicts in information (5WH matrix).
Effective collation is an essential component of incident analysis. The development of timelines or case charting will provide the foundations for the analytical process. The Analyst should use the most simple, flexible and effective techniques to portray and collate the information. Priority lines of enquiry should be agreed with the SIO.
93
Analysing timelines focusing on specific periods or themes within the timeline can help to focus the inquiry by prioritising witnesses, identifying new lines of enquiry, areas for corroboration and further analysis. The examination of sub-sections of the timeline and other data sources may lead to the identification of new lines of enquiry. Equally, time gaps in the sequence of events may offer a new line of investigation or focus enquiries on these specific periods of time. Analysing witness statements this can involve interpreting the timeline for specific periods where witness statements are particularly crucial, or using a matrix to compare key elements of witness statements. The advantage of witness statement analysis is that it can support a number of processes to develop the investigation:
Development of key witness interview questions or packages; Corroboration or disproving of witness statements, using other material such
as telephone or financial data;
94
ANALYSIS
Whether complex or simple techniques are used, the Analyst must focus on using the material before them to draw logical and reasoned conclusions and to make informed recommendations based on these conclusions. Gap analysis may result in the Analyst recommending a number of tactical options to obtain the material required. This kind of incident analysis may also be commissioned by an SIO to provide information on the prioritisation of resources on the inquiry. The Analysts detailed knowledge of key events, witnesses and locations may be used by the SIO to prioritise the deployment of resources in order to gather further material, such as:
Search teams the identification of search zones; House-to-house teams the prioritisation of residences; Road check teams the identification of road check areas; Media teams areas for displaying appeal posters and zones for targeted mail drops.
Incident analysis allows the Analyst to be flexible and innovative in their approach. Taking into consideration legislation, guidance and force working practices (see checklist), there are no constraining factors around the analytical thought processes for the evaluation, analysis and dissemination of incident analysis. Throughout all the analytical techniques the use of hypotheses and inferences will assist in generating meaningful products, but incident analysis, in particular, lends itself to these techniques.
Victims; Offenders/subjects; Witnesses; Locations; Vehicles; Communications; Financial; Forensic; Organisations; Property.
95
Through network analysis, features of the network can be used to aid management decision making, progress the investigation and develop further lines of enquiry. These features include:
Strengths and weaknesses of the network; Intelligence gaps; Hierarchy; Potential subjects; Key roles played by individuals; Criminal links; Movements of subjects; Potential witnesses; Criminal Business Profile and Modus Operandi (MO); Communication/financial flow; Lifestyle information; Resource deployment and prioritisation (for example, directing of house-tohouse enquiries).
Analysis of the network will involve drawing conclusions about the links within a network and then making recommendations as to appropriate intervention points and identifying gaps in material. The analytical thought processes will often begin during the preparation stage. In order to meet the objectives of the task, analytical observations should be documented and disseminated. Consideration should be given to the dynamics of a network, as listed above, and the nature of the relationships. The Analysts responsibility is to determine how these play a part in the wider investigation, particularly if they are criminal networks. Networks may not be criminal. Establishing the network of family and friends of a victim, may provide opportunities or lines of enquiry to establish the victims lifestyle or possible witnesses. Network analysis may be used in conjunction with other analytical techniques or to form a stand-alone product. Network analysis can also be enhanced through reference to academic or specialist advice, for example, reference to statistical research regarding the likelihood of family members or sex offenders being the perpetrators of a crime.
96
ANALYSIS
The analysis can be used to support the ongoing investigation, aid management decision making, progress the investigation and develop further lines of enquiry. This analysis is likely to combine a number of techniques and products to describe the subjects history (including criminal activity), their lifestyle (including financial material), associations, their strengths and weaknesses, and the risks they pose. It should identify intelligence gaps, indicate how sources and resources may be deployed against the individual, assist in the prioritisation of targets and focus intelligence gathering. Suspect/Offender Suspect/offender analysis may involve either a named or unnamed subject. In either case, the content of the product may include some or all of the following elements:
Associates of the individual (network analysis); Relationship between the individual and the victim and/or witness; Incident analysis, eg, routes travelled in the commission of the offence,
precursor incidents;
Associates of the victim (network analysis); Relationship between the victim and the offender and/or witnesses; Victim risk and potential future victim risk; Incident analysis, eg, routes travelled in the vicinity of the offence, precursor incidents (phone calls); Lifestyle information, eg, routine of the individual, employment, key locations, previous addresses, transportation, leisure activities; Previous contact with the police and other key agencies, as victim, suspect, offender and/or witness; Communication and/or financial data; Physical appearance and personality.
97
Witness Witness analysis will predominantly be focused on key witnesses, both named and unnamed. This product may help to identify further witnesses, possible suspects, offenders or victims. Analysing the witness and their connection to the incident may include the following:
Associates of the witness (network analysis); Relationship between the witness and the offender/suspect and/or victim; Witness risk and possible witness protection; Incident analysis, for example, routes travelled in the vicinity of the offence, precursor incidents such as phone calls which help to clarify statements), comparison with other witness statements; Lifestyle information, for example, routine of the individual, employment, key locations, previous addresses, transportation and leisure activities; Previous contact with the police and other key agencies, as victim, suspect/offender and/or witness; Communication and/or financial data; Physical appearance and personality.
The collection and collation of material, is key to Subject Profile Analysis. Consideration should be given to material from various sources, not just that available via the HOLMES 2 system, such as key agencies and prisons. It is possible that some major incidents will require the Analyst to gain specialist knowledge to enhance and inform the subject analysis, eg, medical records. Subject Profile Analysis may assist and support investigators and analysts in constructing interview strategies, reconstructions and house-to-house strategies. The Subject Profile may be an evolving product. Timing of revisions should be agreed with the SIO and consideration should be given to version control at all stages.
98
ANALYSIS
Innovation is key to all analysis but CPA is particularly open to new methods of interpreting material to establish whether there are specific patterns. An explanatory report must be included to interpret the diagrams and take the product further so that decision-makers are fully briefed. CPA of linked crime types such as robberies and burglaries can be used to determine links to a single major incident or series of serious crimes. Hotspots these are defined as locations that display significantly higher than average levels of crime or incidents. In a major incident, the Analyst can be expected to evidence the level of significance through the application of statistical techniques. One example where a hotspot may be used within a major incident investigation is multiple crimes, such as gang shootings, within a specific urban area. This may provide options for preventive action. Where the location of the offence(s) appears to be particularly pertinent the Analyst may use GIS to support their analysis. More complex geographical analysis, however, such as the likely residence of an offender, falls within the remit of geographical profilers. When hotspots are identified, it may beneficial to consider other analytical products such as Social and Demographic Trend Analysis to determine the features of that hotspot. Crime/incident trends a trend can be defined as a broad direction or pattern that specific types or general crimes or incidents are following over a given period of time. Trends are used to predict future levels, types and features of crimes or incidents. Trends might be identified in major investigations that can be used to target preventive resources, for example, seasonal trends may indicate specific victims, times and locations where serious offences are predicted to occur. This can be used to inform the force strategic assessment. Crime/incident series series are defined as a number of similar crimes or incidents that are linked by MO, intelligence, descriptive information, location or forensic evidence and, therefore, are likely to have been committed by one offender or group of offenders. In major crime, identification of a series may be tasked following a key incident, for example, a rape or sexual assault. Solved and unsolved crimes must be considered, not only to identify offenders but also to identify copycat offences. An offenders previous offences can be used to identify common characteristics in offences and predict future behaviour.
99
Analysts must clearly identify distinctive criteria or features of the incident such as victim details, offender, location, MO or suspect description. This can then be used to research similar crimes as well as suspicious and precursor incidents. Research should then be collated into a comparative case chart and analysed to identify similarities and differences in incidents. The possibility of cross-border series must be considered. SCAS is equipped to analyse specific categories of crime nationally, looking for similarities in crimes in all forces in the UK. SCAS is experienced in producing similar fact evidence. The Analyst may have a key role to play in liasing with the SCAS Analyst. The parameters around linked offences should be taken into account, particularly those offences that are cross-border and these should be agreed with the SIO after consultation with SCAS. The identification of a series should assist tactical management decision making by highlighting:
Intelligence gaps; Potential sources of information; Further forensic lines of enquiry; Vulnerable locations; Vulnerable victim types.
Similar Fact Evidence The SCAS database holds the largest data set of detailed crime information in the UK. SCAS uses behavioural analysis to provide statistical support for the likelihood of one offender having committed a number of similar offences. For example, in a series of three offences, there may be forensic evidence available to show an offender committed one offence and only circumstantial evidence for that same offender against the other two. If those offences share similar behaviours, SCAS may be able to provide statistics that show that the combination of behaviours displayed in all three offences is not found in any other offences on the system. This will add significant weight to the prosecutions argument that that individual was responsible for all three offences, not just the one that can be proved forensically. This service has recently proved useful with the introduction of Bad Character Evidence where the similarity of behaviours shown in a previously acquitted case has been used to support the prosecution of a current case. SCAS will not express an opinion as to whether a particular individual was responsible for the offences under consideration but will simply report on the rarity of behaviour found across a number of offences. General Profiles a general profile can be defined as the identification of common characteristics of offenders displaying particular offending behaviour, or characteristics of victims. This type of analysis can be used to predict future criminal activity and identify vulnerable victim types so that they can be targeted for prevention measures. A general profile will typically be developed following the identification of a trend so that action can be taken to target specific victims and offenders.
100
ANALYSIS
For both crime trends and general profiles, analysis of external data sources, for example, MOSAIC and CENSUS data or socio-demographic data may be useful to the Analyst. This data is particularly useful when identifying potential victim groups such as the elderly. General profiles may be further used in prioritisation of suspects to support tactical operations such as DNA mass screening, where groups of males between certain ages may need to be identified.
Victim; Offender; Groups of offenders; Groups of victims; Witness; Groups of witnesses; Potential victims; Victim or offenders family members or associates; Public; Police; Specific sections of the community; Locations; Success of the case; Criminal procedures (criminal justice system); Compliance with legislation and guidance; Specific lines of enquiry or tactics used; Prioritisation of any of the above; Prioritisation of historic case reviews (cold cases).
Strategically, risk analysis could be used to identify the risks posed by a particular type of offender, for example, predatory paedophiles. It can also be used to assess whether apparently isolated incidents are in fact part of a larger pattern or trend to which greater importance needs to be given. Alternatively, risk analysis can determine the prioritisation of a number of individuals or groups using a scoring matrix. For example, at a strategic level, it may be necessary to assess the risk posed by individual gang members involved in drugs trafficking and firearms offences.
101
West Midlands Police have developed a system, Proactive Risk and Intelligence Scoring Matrix (PRISM), which provides objective risk and threat assessment of an individuals criminal capability. This provides grounds for targeting and prioritisation of suspects and offenders with a sound audit trail. Criteria have been used to assess risk against the impact on key priority areas, NIM outcomes and set against opportunities for police intervention. Scores are then calculated and, based on the results, subjects are prioritised. This matrix can be used alongside network analysis to provide an intelligence picture and maintain a focus on the highest priority subjects. At a strategic level, the Analyst may also be collaboratively involved in conducting Community Impact Assessments. Within the risk assessment process, risk analysis serves to provide a qualitative context around specific criteria. Analysts can expect to work alongside senior officers and specialist staff in determining the risk process. The Analyst should evaluate the criteria that are material to the objectives of this piece of work through brainstorming with the senior management team and other relevant staff. These criteria should then be evaluated according to the level of risk they pose and the likelihood of recurrence, in consultation with the senior management team. The key aim of risk analysis is to identify risk, measure its likely impact and then, depending on the level of risk, take mitigating action to prevent high-risk scenarios from developing. It is, therefore, imperative that the Analyst is involved in recommending actions to mitigate against potential problem areas. This should be completed collaboratively.
102
ANALYSIS
The material used in market profiles can often be complex, therefore, presentation of the findings should be in the simplest format.
Levels of and trends in major incidents; Changing levels of criminality; Community impact and risk assessments (eg, schools); Victim groups (occupations, beliefs); Results analysis to look at the impact of changes in legislation on criminality; Strategies to prevent major crime.
Production of media strategies; Identification of locations at risk, eg, where victims may gather such as schools.
The majority of material to support Social and Demographic Trend Analysis will come from multi-agency and partnership sources. Academic and open source data may also be used. It is important to ensure that all source data and subsequent analysis of that material uses appropriate statistical methods. Analytical mapping techniques may be used in support of Social and Demographic Trend Analysis. Examining trends requires analysis of comparative data sets, therefore, time parameters should be clearly defined at the start of the investigation and reviewed with the SIO and/or analyst managers. In order that trends add value to the decisionmaking proccess, they should be forward looking and predictive. Social and Demographic Trend Analysis can be most valuable when produced in conjunction with risk analysis and the development of risk matrices including sociodemographic factors.
103
Exact nature of the business; Key players involved; Technical expertise needed within that business; Methods of transporting goods; Methods financing the criminal operations.
A criminal business profile should assist in an investigation by identifying key stages of a criminal operation that cannot be achieved without the completion of another, thereby indicating areas for disruption. It should also highlight weaknesses in systems or procedures that are being exploited and identify intelligence gaps and new lines of enquiry. A business profile may also be used to understand a legitimate business, where this is pertinent to an inquiry. A victims business may provide leads in an inquiry, for example, combined with a network chart it may indicate associates who need to be interviewed about their role in the business operation.
Monitor the progress of lines of enquiry; Identify good practice; Highlight areas for improvement; Aid professional development; Provide a framework for operational debriefing.
Results analysis can also be applied to an individual or a group of tactics within a major investigation, such as the effectiveness of house-to-house enquiries, the use of the media and reconstructions.
104
ANALYSIS
In order to ensure that results analysis is effective, certain elements must be present:
Consideration should be given to both qualitative and quantative measures. The results analysis process may be enhanced by comparison against similar operations or tactics in other forces or organisations. In addition, the collation of national good practice will provide a benchmark against which the results can be compared. Both the objectives and the agreed mechanisms to measure effectiveness should be agreed with the SIO and documented in the policy book and by the Analyst. The principles and methodology of results analysis can be applied within a major incident review.
105
10.6.1 METHODOLOGY
The majority of analysts will be aware of the problem analysis triangle where, for an incident to happen, the following factors will be present:
Incident
Victim
Offender
Cohen L and Felson M Social Change and Crime Rate Trends: A Routine Activity Approach, American Sociological Review, (1979)
Within a major incident there tend to be a number of starting points. For example:
The discovery of a victim; The identification of a scene of a crime (location); A confession by an offender; A report of an incident by a witness.
Many incidents contain a combination of these factors. These start points of an incident can indicate to the Analyst which route they should adopt for generating analytical products. The analytical products which can potentially be applied to each of the factors of victim, offender, location and incident are demonstrated in Figure 11.
106
ANALYSIS
Incident
Incident Analysis Subject Profile Analysis Risk Analysis Market Profile Criminal Business Profile Network Analysis CPA
Network Analysis Criminal Business Profile Market Profile Risk Analysis Subject Profile Analysis
Victim
Social and Demographic Trend Analysis CPA
Offender
Social and Demographic Trend Analysis CPA
Victim
Social and Demographic Trend Analysis CPA
107
Identifies the victims role within an illegal immigration market. Maps out a drugs market and assists in understanding the pressures
on that market and investigating an epidemic of drugs overdoses.
Maps out a firearms market which is integral to understanding intergang killings. Risk Analysis
Identifies vulnerable victims of domestic violence or child abuse. Identifies groups of victims, such as sections of the community,
targeted in a critical incident.
Identifies potential victim groups, such as, the elderly where there is a
series of sexual assaults against this age group. Subject Profile Analysis Social and Demographic Trend Analysis
Establishes the lifestyle of an unknown or known victim. Identifies areas or particular community groups at risk within a critical
incident.
Examines series of victims who have similar attributes. Considers repeat victimisation of specific types of victims. Analyses general profiles of victims with vulnerable features such as
age or sexuality.
108
ANALYSIS
Network Analysis Criminal Business Profile Market Profile Risk Analysis Subject Profile Analysis
Offender
Social and Demographic Trend Analysis CPA
Identifies those involved in a conspiracy. Builds up a picture of the offenders lifestyle. Suggests the deposition site of a body if the offenders lifestyle is
known. Criminal Business Profile
Suggests the method of operation of an electoral vote-rigging scam. Identifies common offenders in a series of crimes through the use of
code words in a terrorist bomb attack. Market Profile
109
Identifies the risk of fair trial issues to an offender who has been
remanded. Subject Profile Analysis
Outlines the lifestyle of the offender. Suggests the motivation of the offender. Targets offender groups for intelligence-led DNA screening where a
sexual offence has taken place.
Identifies previous offences following the arrest of an offender. Highlights habitual patterns of offending in strategic analysis such as
domestic violence links to alcohol or drugs.
110
ANALYSIS
Risk Analysis
Identifies locations of sex offenders in a vicinity for risk assessment. Risk assesses specific locations which may become a target for
criminal activity such as a terrorist attack or nightclub theme night.
Assess the impact that opening a crack house has on local residents
and other locations such as nearby schools. Crime Pattern Analysis
111
Incident
Incident Analysis Subject Profile Analysis Risk Analysis Market Profile Criminal Business Profile Network Analysis CPA
Compares interviews and downstream monitoring. Analyses activity in the hours prior to a murder. Corroborates witness statements of events in a town centre prior to a
terrorist bomb.
Identifies the risk to witnesses. Assesses the risk of an unreliable witness being used in a case and of
using hearsay evidence from this person, and their motivation for coming forward. Market Profile
112
ANALYSIS
The following matrix summarises where each of the problem analysis triangle elements link into specific analytical techniques. FIGURE 16 Major Incident Analysis Technique Matrix
Product CPA Risk Analysis Network Analysis Subject Profile Analysis Market Profile Social and Demographic Trend Analysis Criminal Business Profile Incident Analysis Victim Offender Location Incident
113
114
Section 11
DISSEMINATION
SECTION 11
here are a number of methods used to disseminate analytical products and they are detailed in this section. The Analysts role both before and during the court process is explored and the legislative requirements regarding disclosure are examined.
CONTENTS 11.1 11.2 11.3 11.4 11.5 11.6 11.7 The Dissemination Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Charts and Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Briefings and Presentations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Analytical Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exhibits ............................................... Disclosure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Analysts Role in Court . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.7.1 Pre-Court Involvement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.7.2 Attendance at Court as a Professional Witness . . . . . . . . . . . 11.7.3 Material for Court . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.7.4 Attendance in the Court Room to Support the Prosecution Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Public Inquiries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 117 117 118 119 119 120 120 121 122 122 123
11.8
115
Time management skills are required by an analyst within a major investigation. A review of actions against priority deadlines should be continuous to ensure that products are delivered on time. Being part of the management team and maintaining good communications with the SIO and Analyst Manager will ensure that the Analyst has full knowledge of the wider implications of delivery times such as court dates and review dates. The appropriate method of dissemination may vary according to the time available, the users requirements and the nature of the material itself. The Analyst must contribute to ensuring that the investigation maintains its momentum and is driven forward by the timely delivery of analytical products. The dissemination of all analytical material should be compliant with the Criminal Procedure and Investigations Act, 1996 and the amendments to it brought about by the Criminal Justice Act 2003. All documents produced are subject to disclosure. A decision may be made, however, to withhold intelligence information in the interests of Public Interest Immunity (PII). It is, therefore, essential that all documents are marked according to the GPMS and labelled according to whether they are for intelligence purposes or evidential documents. If this is unclear, advice should be sought from the Disclosure Officer. From the outset, analysts should ensure that all products are subject to a clear version control procedure. Similar to the charting protocols, analysts should also decide on and log the frequency of revisions, for example, each time a document is disseminated. In addition, all previous versions should be retained. Regardless of the method of dissemination, all products should have a clear audit trail from the provenance of the document through to the recommendations made to further the investigation. The Analyst should ensure that final products are sent to the MIR for inclusion on HOLMES 2 whether as a document or an exhibit. All notebooks and rough material used throughout the analysis process should also be forwarded to the MIR. Where a covert intelligence analyst has been appointed, the dissemination of their analytical material to the MIR should be discussed and decided on by the SIO.
116
DISSEMINATION
As dissemination is one of the key points at which analysts interact with customers, analysts are always encouraged to seek feedback. Consideration may be given to:
The usefulness of the product; The extent of its application; Quality; Comparison against the original task.
Feedback can be used to develop the Analyst and assess their performance against their Performance and Development Review (PDR). It can also inform the Analyst Manager as to the extent of organisational knowledge and understanding of the Analysts role. All analysts and researchers have a responsibility to their profession to disseminate good practice to their colleagues, both locally and nationally. It is important, however, to consider disclosure and any restrictions on information due to the GPMS marking. It is often good practice to sanitise documents before disseminating them to outside organisations. Any dissemination of this kind should always be authorised by the SIO.
Clear using plain English; Concise focused on the original task; Structured logical order, use of headings and bullets; Referenced source material, links to charts and authors details.
117
Live-time analysis or briefing situations may not always be supported by technological presentations. It is imperative that the findings and recommendations are recorded through minutes or are subject to audio or visual recording. The content of the presentation needs to match the requirements of the audience. It may be necessary to discuss these with the audience beforehand, gauging levels of understanding and ensuring that the release of sensitive material is appropriate. It is advisable to consider briefing the SIO as to the content of the presentation. This will serve to enhance the working relationship between the Analyst and the SIO, and ensure that the delivery of potentially controversial material is managed appropriately. It is often beneficial to adopt a simplistic approach to presentations to prevent the audience from being distracted. For example, the use of over-elaborate animation and sound within an MS PowerPoint presentation may detract from the overall content. Supporting material may be required to hand out to the audience. It is advisable not to overload people with material and clear instructions should be given by the Analyst regarding its retention. For example, network charts may need to be collected in at the end of a presentation if new versions are going to be produced.
Enquiry teams verifying specific sequences of events or locations; Search teams conducting intelligence-led searches based on analytical findings; House-to-house coordinators prioritising locations for inquiries; Forensic teams targeting specific rooms within properties for SOCO deployment; Family Liaison Officers (FLO) verifying victim routes. Compliance with copyright law should always be considered when disseminating analytical maps. The map scale should be included in the labelling conventions.
118
DISSEMINATION
11.5 EXHIBITS
All analytical material has the potential to be exhibited. A MG11 statement should accompany any product that is exhibited. This statement should contain the following as a minimum:
Name; Role; Where stationed; Qualifications; Experience; Operational name; The task and date on which it was tasked; The date on which the final product was produced; Name and reference of the product; Who it was physically handed to; Factual description of product.
Where IT systems are used to produce the product, these should be named and any training on these systems stated, including the date on which the training took place. An exhibit label will be completed for each separate exhibit. This will detail the exact description of the product, the date and time produced, the unique reference and any subsequent movements of that exhibit between persons. It is imperative that the exhibit label matches the description of the item in the statements, verbatim. Advice should be sought from the Exhibit Officer on exhibit procedures. Training is available for analysts covering statement writing and report writing for use in court.
11.6 DISCLOSURE
Disclosure is covered by the Criminal Procedure and Investigations Act 1996. Such legislation is in place to allow all material from an investigation to be made available to the defence. As with the entire product from an investigation, the Analysts work will generally fall into one of three categories:
Used material that which is used as part of the prosecution case within court
proceedings;
Unused material that which is used to progress the investigation but is not to
be used as part of the final prosecution case;
119
It is imperative that analysts consider disclosure from the very outset of an investigation. It is advisable to have a discussion with the appointed Disclosure Officer and obtain advice as to what kind of material will fall into each of the three categories described above. It is good practice for all analysts and researchers to structure their work in such a way that facilitates easy disclosure of material. Clear naming conventions should be used and it is advisable, within the document name, to use a symbol or word to indicate which items contain sensitive material, as this identifies the potential for PII material. The labelling of documents to distinguish between intelligence and evidential material also becomes particularly important when reviewing work and deciding on how the documents are to be disclosed. The Analyst is advised to discuss the maintenance of a disclosure log and general good practice with the Disclosure Officer from the start of the investigation. It is the Disclosure Officers role to review all the documents gathered and to prepare the schedules. Training on disclosure legislation and its application can be sought locally from crime trainers or from experienced disclosure officers.
Pre-court involvement; Attendance at court as a professional witness; Production of material for court; Attendance in the court room to support the prosecution case.
It is recommended that all analysts involved in any aspect of the court process undertake the relevant training to cover the issues of providing evidence in court, as well as making statements and report writing for court. In the lead up to a court hearing, the prosecution and defence will agree which items of evidence will be accepted into court without the exhibitor having to give evidence over them. Even if an analyst has exhibited material that is used in court, it may not be necessary to attend court and give evidence in relation to that work.
120
DISSEMINATION
It is good practice for analysts to be involved with the CPS and barristers throughout the investigation. Early involvement will ensure that the production of material for court is communicated to the Analyst with as much notice as possible. Where the evidential case is particularly complicated, the Analyst can assist in providing a logical structure for the court file. The pre-court discussions with the CPS and barristers may involve the Analyst explaining their material, agreeing to further material being presented in a specific manner to the jury and/or the best format in which to present the material. Through pre-court involvement, the evidential case may be progressed further and actions may be raised regarding such issues as anticipating lines of defence. It is also good practice for analysts to visit the court prior to any commencement of court proceedings in order to familiarise themselves with the court surroundings and etiquette of procedures. Equally, advice can be sought from experienced analysts or officers.
Seek advice from analyst managers and experienced colleagues; Produce accurate and precise exhibits and statements for court; Prepare training and experience schedules that demonstrate career details as
an analyst and professional knowledge;
Refer to all notes and if necessary have these ready to take along providing
that this is acceptable to the judge;
121
Training analysts is strongly recommended but there are some tips that can be used by the Analyst attending court:
Only answer questions and talk about what is known; Do not speculate; Stick to the facts; It will probably help to address the judge with responses rather than counsel; Turn feet to face the judge so that as a witness, the Analyst or Researcher is not drawn into direct banter with counsel; Maintain objectivity; Look for opportunities to emphasise the positive points of work that is subject to questioning; Keep answers as short as possible; Do not give any information beyond that which answers the question asked.
Analyst managers should be aware that this can be one of the most stressful situations for analysts and welfare support should be made available.
122
DISSEMINATION
If the Analyst is also a witness, they are not allowed to enter the courtroom until after they have given evidence. If this is the case then advice should be sought from the SIO.
123
124
Section 12
DIRECTION
SECTION 12
lear and informed tasking by the Senior Investigating Officer is essential to the successful progress and resolution of a major investigation. The importance of reviewing major incidents and analytical products to support the direction of an investigation are explored here. Feeding information back into the NIM Tasking and Co-ordination process is also discussed. CONTENTS 12.1 12.2 12.3 12.4 The Direction Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tasking and Co-ordination Group Process . . . . . . . . . . . . . . . . . . . . . Community Impact Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Reviews ............................................... 12.4.1 Results Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.4.2 Risk Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.4.3 Operational Intelligence Assessment . . . . . . . . . . . . . . . . . . . 12.4.4 Reviewing Analytical Processes . . . . . . . . . . . . . . . . . . . . . . . . Links into Strategic Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Dissemination of Intelligence into Regular Policing . . . . . . . . . . . . . Hypotheses Testing and Inference Development . . . . . . . . . . . . . . . Reviewing the Analysts and Researchers Workloads . . . . . . . . . . . . 126 126 127 127 128 128 128 128 129 129 129 129
125
The Tasking and Co-ordination process; Community Impact Assessment; Reviews; Results Analysis; Risk Analysis; Operational Intelligence Assessment; Links into strategic analysis; Dissemination of intelligence into regular policing; Hypotheses testing and inference development; Reviewing analyst workload; Reviewing analytical processes.
126
DIRECTION
12.4 REVIEWS
A review can occur either at specific time intervals during an ongoing investigation or at any given time if the crime remains undetected. The very nature of a review means that it is likely to change the direction of an investigation although the degree to which this occurs may vary greatly. A review is a constructive tool designed to enhance the investigation and ensure that the direction of the inquiry is clear. The Analyst may be involved in producing specific pieces of work to support the review process, such as Results Analysis, Operational Intelligence Assessment or Risk Analysis. A review may also require an analyst to examine specific lines of enquiry or analytical products that have already been produced, in order to identify potential gaps or opportunities for further investigation. An analyst involved in a review may not only provide specific products but may also use their skills and knowledge in relation to the application of the intelligence cycle to major incident reviews. The evaluative and analytical process applied to material reflects the process used in a review. It is good practice to use an experienced analyst in the review process. The Analyst who completes this review will usually be different from the Analyst who worked on the original inquiry. This will ensure objectivity and may inject a new perspective to work already completed.
127
Organisational understanding of the Analysts role; Training needs for SIOs, investigators and specialist departments; Training and development needs of analysts; Improvement and/or amendments of processes and logistics to support analysis; Data quality and accessibility; Compliance with guidance and legislation; Good practice. All analyst managers and heads of intelligence analysis have a responsibility to ensure that analytical processes which support major investigations are continually reviewed and developed.
128
DIRECTION OF SECTION
129
130
Section 13
WELFARE OF ANALYSTS AND RESEARCHERS
SECTION 13
W
13.1 13.2
orking within a major investigation can have a negative effect on analysts and researchers and this needs to be assessed and reviewed regularly by managers within the department or investigation. CONTENTS Welfare Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Risk Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
131
Disturbing images, statements or other material; Protracted hours and fatigue; Inability to cope with emotional pressure or feelings of responsibility; Concern over skills decay or relocation.
The Analyst and Researcher roles are now almost entirely made up of police staff. Some forces have created risk assessments for police officers to prepare them for encountering disturbing images or situations. Consideration must also be given to analysis and research staff. It is often welfare issues that will have the greatest effect on an analysts performance.
132
HIGH
MEDIUM
Warning analysts. Periodic welfare checks. Regular informal group discussion. Group counselling session arranged.
4. Emotional impact of understanding likely fate of victims. 5. Fatigue due to long hours worked. 6. Fatigue due to seconded analysts and researchers travelling to HQ everyday. 7. Emotional intensity of a team working together on an emotive case over a long period of time. 8. Feeling isolated and lacking in confidence when returning to normal place of work.
HIGH
MEDIUM
HIGH
HIGH
MEDIUM
LOW
HIGH
LOW
Exit plans for staff. Ensure regular contact with normal place
of work.
MEDIUM
MEDIUM
Exit plans for staff. Ensure regular contact with normal place
of work.
133
It is imperative that managers anticipate as many different scenarios as possible and attempt to make provisions to ward against these situations occurring, depending on risk. It is also necessary to continually debrief analysts so that the manager understands what has affected them and can then amend the Risk Assessment areas accordingly. The Risk Assessment process applies to all staff involved in the inquiry and an analyst manager may need the same support as the full-time analyst if they have had access to disturbing material.
134
APPENDICES
APPENDICES
CONTENTS Appendix Appendix Appendix Appendix Appendix Appendix Appendix Appendix Appendix 1 2 3a 3b 4a 4b 5 6 7 Terms of Reference 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Search Techniques and Useful Websites . . . . . . . . . . . . . . . Intelligence Network Chart . . . . . . . . . . . . . . . . . . . . . . . . . Evidential Network Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . Intelligence Timeline Chart . . . . . . . . . . . . . . . . . . . . . . . . . Evidential Timeline Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . Abbreviations and Acronyms . . . . . . . . . . . . . . . . . . . . . . . . Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References and Suggested Further Reading . . . . . . . . . . . . 136 138 141 142 143 144 145 147 148
135
APPENDIX 1
Comparative Case Analysis of similar offences. Network Analysis of potential offenders. Ongoing operational analysis of timeline, events, telephone and financial data,
key witnesses, suspects, suspicious incidents and victims. Providing the SIO with recommendations and information to direct the inquiry. Analytical products should be communicated through presentations or reports. Constraints and Considerations
136
APPENDIX 1
137
APPENDIX 2
OR
NOT
Some search engines allow you to use the minus () sign instead. To force the search engine to search for a specific phrase rather than a string of words. Alternatively you can denote a phrase by joining the words with a colon. For example, National:Intelligence:Analysis:Training. Note that some search engines will treat keywords as case sensitive when the quote symbols are used. It is best to enter the search term in lower case and then search engines will generally search for both the upper and lower case format. Brackets can be used to create complex queries. For example: analysis AND ((intelligence AND crime) OR police). The AltaVista search engine allows an asterisk (*) to be used as a wildcard after a word to search for anything beginning with those letters. For example entering the keyword polic* will search for pages that contain the words police, policing and policed.
()
SEARCH ENGINES http://www.google.co.uk http://labs.google.com http://www.altavista.com http://www.alltheweb.com http://search.msn.com http://www.wisenut.com http://www.lycos.co.uk http://search.com http://www.yahoo.com
138
APPENDIX 2
META SEARCH ENGINES http://www.metacrawler.com http://www.search.com http://www.fazzle.com http://www.dogpile.com http://www.hotbot.co.uk http://www.infogrid.com http://www.infonetware.com http://www.ithaki.net http://www.mamma.com http://www.kartoo.com http://www.qbsearch.com http://www.queryserver.com http://www.surfwax.com http://vivisimo.com http://www.searchonline.com http://turbo10.com NEWSGROUPS A newsgroup is a bulletin board on a website that is accessed via a web browser. Individuals post news, questions or information on certain subjects within these groups which are ordered by topic. Postings are made to the newsgroups via email. These groups are another area on the Web within which you can search for anything related to a particular individual or subject. Two popular newsgroups are run by Google and Yahoo and can be found at: http://groups.google.com http://groups.yahoo.com Usenet has over 100,000 uncensored newsgroups and advertises it is the internet underground. You have to be signed up to access their newsgroup pages and they provide anonymity by offering a Secure-Tunnel service which allows subscribers to browse their newsgroups without their movements being tracked or logged. Usenet can be found at: http://www.usenet.com
139
APPENDIX 2
USEFUL SITES General Information and Statistics http://www.textengines.com http://www.refdesk.com http://www.statistics.gov.uk http://www.tagish.co.uk http://www.multimap.com http://www.upmystreet.com http://www.convictsreunited.com http://www.crooks-reunited.co.uk http://www.archive.org http://www.oultwood.com/localgov/england.htm Policing and Law http://www.nolo.com http://www.uklegal.com http://www.police.uk http://www.police999.com http://www.interpol.int http://www.terrorism.com http://www.police.homeoffice.gov.uk http://www.crimereduction.gov.uk http://www.ncis.co.uk http://www.nationalcrimesquad.police.uk Telephones http://www.bt.com http://www.infobel.com http://www.sitefinder.radio.gov.uk http://www.numberingplans.com http://www.magsys.co.uk/telecom/codelook.asp http://www.operatelecom.com International Data http://www.loc.gov/rr/international/portals.html http://www.cia.gov/cia/publications/factbook IP Address Lookups http://www.chackdomain.com
140
APPENDIX 3A
141
APPENDIX 3B
142
APPENDIX 4A
143
APPENDIX 4B
144
APPENDIX 5
145
APPENDIX 5
NCPE . . . . . . . NCS . . . . . . . . NFFID. . . . . . . NIAT. . . . . . . . NIM . . . . . . . . OIC. . . . . . . . . PACE . . . . . . . PDR . . . . . . . . PII. . . . . . . . . . PIP . . . . . . . . . PLS. . . . . . . . . PNC . . . . . . . . PNMPB . . . . . PNMP . . . . . . PRISM . . . . . . QUEST . . . . . . RDS . . . . . . . . RIPA . . . . . . . . SBA . . . . . . . . SCAS . . . . . . . SIO. . . . . . . . . SOCA. . . . . . . SOCO. . . . . . . SPOC . . . . . . . TE. . . . . . . . . . TLO . . . . . . . . TT&CG . . . . . . UKPS . . . . . . . VIN. . . . . . . . . ViSOR . . . . . . VODS. . . . . . . VRM . . . . . . . WRVS . . . . . .
National Centre for Policing Excellence National Crime Squad National Firearms Forensic Intelligence Database National Intelligence Analysts Training National Intelligence Model, UK Codes of Practice Officer in Charge Police and Criminal Evidence Act 1984, UK Legislation Performance Development Review Public Interest Immunity Professionalising the Investigative Process Pendulum List Searching Police National Computer, UK System Police National Missing Persons Bureau Police National Mobilisation Plan Proactive Risk and Intelligence Scoring Matrix Queries Using Extended Search Technique (on PNC), UK System Home Office Research, Development and Statistics Department Regulation of Investigatory Powers Act 2000, UK Legislation Seen By Analyst Serious Crime Analysis Section Senior Investigating Officer Serious Organised Crime Agency Scenes of Crime Officer Single Point of Contact Transaction Enquiry Telephone Liaison Officer Tactical Tasking and Co-ordination Group United Kingdom Passport Service Vehicle Identification Number Violent and Sex Offenders Register Vehicle Online Descriptive Searching, UK System Vehicle Registration Mark Womens Royal Voluntary Service
146
APPENDIX 6
APPENDIX 6 GLOSSARY
Community Impact Assessment A risk assessment of issues affecting a community. Compliance Unit Department in UK law enforcement responsible for ensuring compliance with RIPA legislation. Downstream Monitoring Live time monitoring of audio/visual material. Gold Groups A senior level management group committed to deal with the strategic coordination of an incident. MG11 Standard UK statement form. Public Inquiry An investigation into an incident or event, the findings of which are available to the public. R v Defendant A sighted Crown Prosecution Case. R refers to Regina (the Crown or State). SIO Policy File Document used to record the SIOs investigative policy decisions. Sterile Corridor Sterile corridors protect the source of covertly obtained material by ensuring that it cannot be shared and disseminated without prior sanitisation and proper authorisation. Strategic Assessment This drives the business of the Strategic Tasking and Co-ordination Group (ST&CG) by providing it with an accurate overview of the current and long-term issues affecting the BCU, force or region. TAG Marker on HOLMES 2 system. Tasking and Co-ordinaton A process defined by NIM for directing tactical or strategic operational activity.
147
APPENDIX 7
148
APPENDIX 7
Useful Reference Material Newiss, G. (2004) Estimating the risk faced by missing persons: a study of homicide victims as an example of an outcome-based approach. International Journal of Police Science and Management, Volume 6, pp27-36. Nordby, J. (1999) Dead Reckoning: The Art of Forensic Detection. Florida: CRC Press. Francis, B. et al (2004) Using Homicide Data to Assist Murder Investigations [Internet], Home Office Online Report 26/04. Available from http://www.homeoffice.gov.uk [Accessed 27 July 2006].
149