Advanced Criminal Investigations and Intelligence Operations
Page 26
Intelligence Files and Analytical Investigative Methods
205
SECRET. Any additional designations are adjectives referring to the type of information accessed, such as CRYPTO and SCI (specially compartmented
information). Terms such as EYES ONLY are used in other countries, such as Great Britain (MI5 and MI6 SIS).
Strategic intel igence supports long-range planning or policy. Tactical intel igence is for immediate operational use. Reactive intel igence refers to a response to a situation after the fact. Proactive intel igence refers to anticipation of needs and/or preemptive action before an incident.
Intelligence files were once literally paper files that were indexed by
names and subjects, with file numbers. They were cross-referenced by pri-
mary categories and subcategories (primary, secondary, and tertiary). Source documents were indexed and filed (documenting the source of raw data or
information). Source documents were rated for reliability, content, and classification. Folder logs and dissemination control forms were used to control information. Such manual systems can be of value in areas where technology is scarce but the need for intelligence files is great. Primarily, however, today, intelligence files are automated and computers are programmed to process
massive amounts of stored data, information, and intelligence.
Intelligence Analysis
The analysis of intelligence can be conducted by two nearly identical processes, which were developed from scientific and engineering practices: analytical investigation methods (AIMs) and visual investigative analysis (VIA).
Other methods of intelligence analysis are available, but AIM and VIA are commonly used by law enforcement, intelligence, and military analysts to
present complex information with presentation media.
Analytical Investigative Methods
AIMs analyze large amounts of information using scientific concepts of investigation, data collection, and evaluation techniques, including the following:
• Construction of association matrices and link analysis
• Use of inductive and deductive logic from sources of information
• Flow charting and construction of charts for analysis
• The analytical process
• Development of inferences from analysis
• The delivery of clear and concise briefings and presentation media
AIMs, like VIA, emerged from using tools and techniques borrowed from
science and engineering project management. Two such tools, critical path
206
Advanced Criminal Investigations and Intelligence Operations
method (CPM) and program evaluation and review technique (PERT), are
discussed further under section “Visual Investigative Analysis.”
CPM is used for scheduling, planning, and control ing projects with deadlines. Users decide which path in a network will take the most time. This path then becomes a critical path.
PERT is a scientific management information system for scheduling, planning, and control ing complex research and development projects. It is oriented to events and uses a network to display graphically the sequence of events, dependent relationships, and estimated duration of times for all the activities.
A network is a series of interconnected and interrelated symbols that graphically displays the sequence of occurrences and dependent relationships. Link network analysis shows associations, while time flow analysis shows sequential events.
Visual Investigative Analysis
VIA was developed in the 1960s by the Los Angeles Police Department and
named VIA by the California Department of Justice in the 1970s (Morris, 1982, p. iv). It was first used in trial support in Los Angeles in 1968 in the trial of Sirhan Sirhan for the murder of U.S. Senator (and former Attorney General) Robert F. Kennedy (Morris, 1982, p. 5).
VIA, or crime analysis charting if used in criminal cases, makes complex
investigations more controllable and makes it easier for supervisors and managers to monitor the hour-by-hour use of resources to avoid duplication. It also helps trial attorneys to quickly understand complex cases and large amounts of information by providing a sort of roadmap of critical events and essential elements. It also helps judges and juries to understand cases by allowing them to see and hear the progress of the events presented. Such analysis saves time, often reducing trial time by half, and clearly states essential facts.
VIA developed from concepts borrowed from engineering, construc-
tion, and ship building that used techniques such as CPM and PERT . CPM
is similar to PERT and is geared toward scheduling and controlling projects.
PERT is geared toward facilitating control of research activity in scientific tasks. The two can be integrated into one system. VIA is such an integration, with modifications that are responsive to the law enforcement or intelligence functions. VIA is a network approach to displaying graphically the sequences of events and the relationships of each element of an incident
(Morris, 1982, pp. 3–4).
VIA can be performed manually or by use of computer graphics and
tools. While computers are more practical today, understanding the manual system can aid in practice or be used in more remote or primitive environments. To perform VIA manually, the analyst needs a few tools and supplies:
Intelligence Files and Analytical Investigative Methods
207
1.
Index cards—3 × 5, using only one side, to tape or affix to the layout.
2.
Binders—a case library for copies of all documentation supporting the VIA chart. Each binder is numbered and each page in each binder
is numbered for quick reference (e.g., a document or information in
Binder 2 and on page 25 would be noted on an index card as 2-25).
3.
Highlighter pens—during the reading phase of the documentation,
the analyst highlights items or information for transfer to the index
cards. This can simply be in yellow highlight or various colors can be
used to color-code specific aspects of information.
4.
Template—symbols can be drawn using a template that includes cir-
cles, rectangles, arrows, triangles, and other symbols.
5.
Paper—durable drafting paper can be used for the chart and tracing paper can be used for final drafts.
6.
Tape and pins—pins can hold index cards on the drafting paper during layout and tape can be used to affix them when finalized. Here, the
index cards are taped down after the lines, circles, arrows, and triangles are added and the chart takes the shape and appearance of a storyboard.
7.
Pens and pencils—for compiling the index cards and drawing the
chart. The final draft, of course, should be in ink.
8.
Copies of reports and documentation—all materials for the case
should be copied (never the originals) because they will be hole
punched, page numbered, and highlighted.
The same process can be performed with a computer, using various com-
puter-aided design (CAD) tools and programs (such as Visio®, IntelliVIEW®, and other commercially available programs). The important points of developing a VIA chart and library are as follows:
1. Determine the important elements and data in reports, documents,
and other information from the case library:
a. Does this information relate to the incident in question?
b. Does this information provide a who, what, when, where, why, or how?
c. Does this information build upon another known or suspected
key element?
2. Summarize information into 50 words or less (for each element or
key point):
&nbs
p; a. The index card’s upper line might show who gave the data
(W = Witness, I = Informant, V = Victim, O = Officer, etc., fol-
lowed by the name).
b. The bottom line might show when—day, date, time, and binder
and page numbers.
3. Link the nexus between activities when dates, times, and other ele-
mental details are unclear, ambiguous, or missing.
208
Advanced Criminal Investigations and Intelligence Operations
The VIA process should not be viewed as individual steps, but as a continuous process like the intel igence cycle itself. However, the tasks in the VIA process include the following:
• Confer with the client/consumer for planning and direction (trial attorney or intelligence consumer) on the EEIs.
• Collect source documents; collection.
• Develop the case library (documentation).
• Conduct first reading of source documents.
• Conduct second reading of source documents.
• Create index cards ( processing) (Figure 12.6).
• Compare and edit materials.
• Conduct index card analysis ( analysis).
• Take the information from the reading and rereading of the
source documents of the case library and write each activity on
an individual index card.
• Study the index cards to determine which event and card most
likely starts the network and which one is the logical conclusion.
• Arrange the remaining cards in a logical chain of activity
(sequential, if possible).
− Activity flow (sequential and logical)
− Parallel activity (simultaneous)
− Activity display— nodes
W = witness
I = informant
V = victim
O = officer
Source name
Activity description
Date
Time
Page
Binder number
number
Figure 12.6 VIA index cards.
Intelligence Files and Analytical Investigative Methods
209
• Create chart (attaching information from index cards) ( analysis and production).
• Use Network Logic to show each nexus.
• What activities precede the next one (logical sequence)?
• What activities are concurrent with this one (simultaneous)?
• What activities follow this one (continuing logical sequence)?
(Morris, 1982, p. 16)
• Create arrows and nodes (arranged to show the logical sequence of activities and their relationship) and assign reference numbers
(to source binders and pages from the case library) ( analysis and production).
• Use symbols to represent information in the network and on the
chart.
• Each arrow represents one activity (any portion of the case analysis that consumes time and/or resources and has a definable
beginning and end).
• A circle or node, between the arrows, denotes the start and stop of an activity. These event nodes consume no time or
resources.
• Every activity in a network must be preceded and succeeded by
an event node (except the conclusion of the chart); there can only
be one activity between every two nodes.
• A burst (depicted by vertical sets of event nodes) is the initiation of two or more activities.
• A merge depicts the completion of two or more activities.
• The end of a VIA chart is signified by a triangle (the termination symbol) (Figure 12.7) (Morris, 1282, pp. 19–20, 22).
• Create activity and dummy lines (analysis and production).
• An activity arrow (mentioned earlier) represents one activity.
• A dummy line is represented by a dotted arrow and represents an activity that consumes no time.
− It maintains network continuity and logic by indicating that,
while a relationship exists between two activities, it does not
warrant the strength of a solid line arrow.
− The dotted dummy line completes a straggler line by attach-
ing it to something—a continuing solid line (Figure 12.8)
(Morris, 1982, pp. 20–22).
• Confer (again) with the client/consumer on the progress from
the planning and direction phase (trial attorney or intelligence consumer).
210
Advanced Criminal Investigations and Intelligence Operations
Event 1
Event 2
Event 3
Event 4
Event 5
5
10
15
20
25
12/07
12/14
12/24
12/26
01/01
Activity
Dummy
21 Node
Flowchart or link diagram
71
Terminal
Legend
Figure 12.7 Flowchart or link diagram.
Node
Node
Termination
Node
Figure 12.8 Nodes, activity lines, dummy lines, and termination.
• Finish drafting and finalizing (inking, if manual y constructed) the
chart.
• Number each node or circle (in increments of five or more along the main line to allow for upgrades) for reference to points of
interest.
• No two nodes should have the same number except fragnets and
subnets (Figure 12.9) (Morris, 1982, p. 22).
• Attach information from index cards (with tape, if manually
constructed).
• Create a legend (of symbols), title, and credits (of who drafted the chart).
Intelligence Files and Analytical Investigative Methods
211
5
1 Event#2
Event#3
11/16/2013
11/17/2013
2
Individuals
Event#1
involved
Decision
11/14/2013
point
4
6
Start
Event#2
Event#4
Finish
11/16/2013
11/17/2013
11/14/2013
02/23/2014
3
7
Event#1
Event#3
Decision
11/14/2013
11/17/2013
point
Individuals
Individuals
involved
involved
Video
Video
Documents:
1. Receipt
4. Cash deposit slip
7. Video tape and cash
2. Credit card payment 5. Receipt
receipts
3. Video tape
6. Credit card payment
Figure 12.9 Network diagram.
• Develop fragnets and subnets, used to expand a complex chart.
• Fragnets are an expansion that occurs as an appendage (for smal er amounts of information) on the face or surface of the original chart.
− It is usual y small (one to five activities) and always relates
directly to one activity between two nodes on the original chart.
− It is depicted by dotted lines, without arrow heads, attached to
each end of the fragnet and to the nodes on the original chart.
− Node numbering in the fragnet begins with the first node
number to be fragneted on the original chart and ends with
the next node number to the right (Morris, 1982, p. 23).
; • Subnets resemble a fragnet but are displayed on an independent chart and usually represent large amounts of information or
numbers of activities.
− It is usually represented as a separate chart of its own, often
after the completion of the original (main) chart. (When
created on a computer, it may be embedded and brought up,
opened, or enlarged with a click.)
− It follows the numbering of the original chart. (It begins with
the first node number to be subnetted on the original chart
and ends with the next node number to the right.) (Morris,
1982, p. 23).
212
Advanced Criminal Investigations and Intelligence Operations
• Conduct a final review with the client/consumer for planning and
direction (trial attorney or intelligence consumer) ( dissemination and feedback).
The use of computers can greatly simplify this process, especially the use of fragnets and subnets. The final draft of the chart can be copied using the trace paper or saved as a computer document, using overlays. Charts may then be present using presentation software, such as PowerPoint®.
Financial Information
Single-entry bookkeeping refers to the entry of information from all sources in one place without making an effort to balance the records. Double-entry bookkeeping refers to a system in which every transaction affects two or more accounts (with equal debits or credits) and is recorded in these accounts.
Two or more adjustments must be made (never only one) and, in summary
form, shows the results of many transactions and the force affecting the
organization.
Fundamental Equation
Assets (items of value) = claims assets = Liabilities and Capital
A − L = C
Accounting Cycle
1.
Journalizing—analyzing and recording transactions in a journal 2.
Posting—copying the debits and credits of journal entries into the ledger accounts
3.
Preparing a trial balance—summarizing the ledger accounts and
testing the recording accuracy
4. Constructing a work sheet:
a. Affecting the adjustments without making entries in the account
b. Sorting the account balances into
i. Balance sheet