ASIS CPP - Investigations Flashcards
What is an Investigation?
A systematic & thorough examination or inquiry into something or someone (the collection of facts & information) and the recording of that examination in a report)
What is a fact-finding process, ideally separated from the decision-making process?
Workplace Investigation
Facts of an effective workplace investigation
- Must be fair & impartial
- Must be factual & objective
- Must be thorough
- Must be well documented
- Must protect the rights of suspected violators & witnesses
- Must not violate the law, company policy, labor agreements, or anyone’s right to privacy
- Must be confidential - evidence findings, notes, reports & conclusions should only be shared with those who need to know
- Should always involve upper-management & HR
Primary Purposes of any Investigation
- Documenting incidents
- Identifying the cause of undesirable situations
- Documenting & correlating facts
- Identifying suspects
- Compiling information to prove/disprove allegations or implicate/exonerate suspects
- To make a decision about suitability
What is a lack of solid, ethical standards that can seriously damage the effectiveness of an investigative unit & can leave the organization open to civil or criminal liability?
Ethics
Two Key Decisions for Outsourcing and Investigation
- Size of the preferred vendor
- Whether services will be bundled
5 Attributes of an effective & reliable investigation
- Objectivity
- Thoroughness
- Relevance
- Accuracy
- Timeliness
5 Principle resources of an investigation unit
- People
- Information
- Credibility
- Physical assets
- Financial assets
4 Phases of the investigative life cycle
- Initiation of the investigation & its source
- The investigation itself
- Reporting
- use of the information (includes adjudication)
3 Tools of an investigator (“the 3 I’s”)
- Information
- Instrumentation
- Interrogation (principal tool)
3 Definition or foundation documents for the unit
- Functional charter (usually produced in the suite)
- Policy statement
- Objectives
When should an employer determine whether the employee conduct is a legitimate subject of discipline & inquiry under state & federal laws?
Prior to conducting an investigation
Principle characteristics of internal theft
- diversion
- conversion
- disguise
- divergence
Incident investigations may also be referred to as…
Complaint Investigations (which is the most common type of investigation in many organizations
An Incident Reporting System does 2 things that could not otherwise be done
- Provides a history of events occurring to the organization
- Provides a basis for professional efforts at asset recapture, recovery or incident reduction or termination
4 Categories of Security Data Analysis
- Claims avoided
- Proofs of loss
- Recovery of physical assets
- Uninsured claims or causes of action
The purpose of an Incident Report is to…
Provide data on which to base security decisions
Benefits of an Incident Reporting System
- Identifies the item targeted for theft
- Determines which counter-measures were effective
- Classifies events that are high-probability / low-criticality to low-probability / high-criticality
- Provide an overview of where security personnel are spending their time
- Plot event trends
- Facilitate protection or recovery of assets and apprehension of thieves
3 Steps to recommended reporting progression
- All employees must notify their immediate supervisor of any incidents or known or suspected asset losses
- First-line supervisors should be responsible for completing reports of losses within their areas of responsibility
- The Security Manager is responsible for reviewing the report
3 Types of Incident Database Reports
- General management distribution reports
- Corrective action reports
- Loss status report
Predictive Modeling
By tracking & analyzing incidents, the security manager can determine countermeasures that may prevent future losses
What is a common mistake of inexperienced investigators
Failing to corroborate evidence
3 Forms of evidence
- Oral
- Documentary
- Physical
Spoken statement regarding person’s knowledge which may be direct or indirect & gained in any manner
Oral Evidence
Information usually in the form of documents or writing impressions
Documentary Evidence
Evidence that is tangible
Physical
Evidence that is first-hand knowledge
Direct Evidence
Evidence that is highly informed inference (aka: circumstance evidence or hearsay evidence)
Indirect Evidence
The rule that applies most often in determining the importance of evidence & its ability to prove a point
Materiality
In the majority of inquiries who the most available and valuable sources of information?
The persons involved
What evidence in its natural state, cannot be seen what is contained in the physical object that holds our evidence; equipment & software are required to make the evidence visible (i.e. fingerprints, electronic evidence)?
Latent Evidence
Categories of Physical Evidence
- Corpus Delicti
- Associative
- Identifying
Evidence that proves a crime has been committed
Corpus Delicti
Circumstantial evidence; links a suspect with the scene of the crime
Associative
Associative evidence that establishes the identity of suspect & found at the scene
Identifying
When does success in the use of evidence increase?
When an incident scene search is planned, coordinated, and executed by knowledgeable security employees
* A search may be either a cautious search of visible areas (avoiding evidence loss or contamination or a vigorous search of concealed areas)
2 Main tasks that the on-site team should perform
- Secure & protect the scene
- Take control of the scene immediately
In evidence searches what do you focus on first?
Evidence that could be lost
What OSHA standard says to utilize universal precautions that require all blood, body fluids or other potentially infectious materials to be treated as if infected with blood-borne diseases?
Blood-born pathogens standard
What are 3 things all explosive materials sensitive to?
heat, shock, friction
What can result from direct or indirect exposure to laser beams
Irreversible eye damage
* Prolonged exposure to the skin should also be avoided
What present hazards including toxic gases, explosive or oxygen-deficient atmospheres electrical dangers, or materials that can engulf personnel entering the space
Confined Spaces
PPE - what provides protection from acids, alkaline solutions, hydraulic fluid, photographic solutions, fuels, lubricants, aromatics, petroleum and chlorinated solvents.?
Nitrile
What offers resistance to oil, grease, acids, solvents, alkalies, bases & most refrigerants?
Neoprene
What is resistant to alkalies, oils & limited concentrations of nitric & chromic acids?
Polyvinyl Chloride (PVC)
What resists mild acids, caustic detergents, germicides & electronic solutions
Latex (natural rubber)
What material swells & degrades if exposed to gasoline or kerosene?
Latex
What is a running description of the incident scene?
The Narrative
What type of approach should be used in the narrative
Systematic
What should be used to supplement, not substitute, for the narrative?
Photographs & Sketches
What can be caused by an incorrect point of view, improper perspective & deceptive tones like shadows?
Distortion
What parts of the incident scene should be photographed first
The most fragile areas
In what positions (twice - first) should the important pieces of the evidence be photographed?
A medium distance view that shows the evidence & its position to other evidence A close view that includes a scale and fills the frame
Before releasing the incident scene ensure that the evidence is:
- Collected according to legal requirements
- Documented
- Marked for identification
Who is the only person to release the scene?
The person in charge
What is the most critical point of the incident scene investigation and is the time when errors occur?
Collection of physical evidence
What is the most common type of physical evidence?
Fingerprints
How many people should observe the evidence in place during recovery & being marked
Two
Where to mark evidence
Directly on the evidence when necessary
* The best way to certify a piece of evidence is with investigators initials
What establishes the actual chain of custody
Proper marking of evidence at the time of seizure & transfer
Adhesives - If possible submit the item to which the adhesive, caulk or sealant has adhered
If not possible remove a sample of the material with a clean sharp instrument & transfer it to a resealable plastic bag or leak-proof container, such as a film canister or plastic pill bottle
Steps for proper anthropology
- Clean & air-dry bones if possible
- Pack in paper bags & wrap in protective material, such as bubble wrap or paper
- If the tissue is present in the skeletal material, refrigerate until mailing & then ship in a foam cooler
- Collect insect samples found on the remains in leak-proof containers such as film canisters or plastic pill bottle
- Call the laboratory for additional instructions or contact an entomologist
Handling Blood Evidence
- Collect at least two 5ml tubes of blood in purple-top tubes, w/ EDTA as an anticoagulant for DNA analysis
- Collect samples for drug-or-alcohol testing in gray-top tubes
- Refrigerate (do not freeze) blood samples - use cold packs, not dry ice, during shipping
How to dry bloodstained garments
Air-dry
Bloodstains
- Do not place wet or dried garments in plastic or airtight containers
- Pack in a clean paper - do not use plastic containers
- Air-dry the cloth or swab & pack in clean paper or an envelope with sealed corners - do not use plastic containers
Oral Swabs (Buccal)
Air-dry the swabs & place in a clean paper or an envelope with sealed corners - do no use plastic containers
Building Materials
- Package each item of evidence in a separate paper bag - do not process tools for latent prints
- Submit known a questioned debris in leak-proof containers such as film canisters or plastic pill bottles - do not use paper or glass containers
Chemicals
- Collect an unstained control sample, package separately, & submit it with the stained evidence
- When cutting is not possible, transfer questioned stains by rubbing with a clean cotton swab
- Air-dry the swab & pack in a heat - sealed or resealable plastic bag Submit an unstained swab as a control
Computers
- Use a sturdy cardboard container when shipping computer components; if possible, use the original packing case with the fitted padding
- Use large, plastic bubble wrap or foam rubber pads as packing
- Do not use loose foam pieces because they lodge inside computers & components & create static charges that can cause data loss or damage to circuit boards
- Pack & ship central processing units in the upright position: label the outside container “this end up”
Controlled Substances
Submit evidence in separate, heat-sealed or resealed plastic bags
Lubricants
- Air-dry the evidence & package separately in paper bags
- Air-dry the swab & pack it in a heat-sealed or resealable plastic bag
- Package lubricants separately in leak-proof containers
Two sources of DNA are used in the Forensic analysis
- Nuclear DNA (nDNA) is typically analyzed in evidence containing blood, semen, saliva, body tissue and hairs with tissue at the roots
- Mitochondrial DNA (mtDNA) is typically analyzed in evidence containing naturally shed hairs, hair fragments, bones & teeth
Dyes
Do not submit largely stained evidence (e.g. car seats) when possible, cut a small sample of the stained area & submit in a heat-sealed or resealable plastic bag
Feathers
Submit feathers in heat-sealed or resealable plastic bags or paper bags
Fibers
Submit fibers in clean paper or an envelope with sealed corners
Glass
- Submit samples of glass from each broken window or source in leak-proof containers such as film canisters or plastic pill bottle (do not use paper or glass containers)
- Submit particles in leak-proof containers such as film canisters or plastic pill bottles - do not use paper or glass containers
- Submit vacuum sweepings in leak-proof containers - do no use paper or glass containers
Glass - Fractures
- Pack all glass separately & securely to avoid shifting & breaking during shipping
- Secure the glass between some plywood or sturdy cardboard - do not place any objects into the impact area
Guns & Gun Parts
- Firearms must be minimally handled to avoid loss or destruction of evidence
- Objects must not be allowed to enter or contact the firearms barrel, chamber, or other operating surfaces
- Use fingers to pick up a handgun by its knurl grips - Never stick anything down the barrel of the weapon
- Do not mark the item - firearm pieces must be identified with a tag containing the caliber, make, model and serial number
Hair
- Collect at least 25 known hairs from different parts of the head or pubic regions - comb & pull out the hairs
- Submit hairs in clean paper or an envelope with sealed corners
- Packages each group of hair separately in clean paper or an envelope with sealed corners - do not use plastic containers
- Refrigerate & submit as soon as possible to the selected laboratory
Images
- Never use the pause operation when viewing original videotapes
- Process all film including bank surveillance film, prior to submitting
- Do not mark or cut items submitted for comparisons where they are visible in the questioned images
- Submit items such as clothing & firearms for other examinations before submitting them for image comparison
Ink
Pack ink evidence separately from any document or surface with ink marks
Latent Fingerprints
The laboratory is the best place to develop latent prints However, it is sometimes necessary to develop latent prints at incident scenes
Paint
- Collect control paint chips - controls must be taken from an area close to but not in any damaged area
- Package paint specimens in leak-proof containers, such as vials or pillboxes
- Do not stick paint particles on adhesive tape
- Do not use plastic bags, cotton or envelopes to package paint specimens
Pepper Spray or Foam
- Air-dry the evidence & package separately in paper bags
- Moisten a clean cotton cloth or swab with isopropanol (rubbing alcohol) & wipe over the sprays or foams
- Prepare a second, moistened cloth or swab as a control
- Air-dry the cloths or swabs & pack separately in heat-sealed or resealable plastic bags
- Submit spray canisters when possible
Polymers
- Submit fragments in leak-proof containers, such as film canisters or plastic pill bottles - do not use cotton or paper containers
- Remove damaged motor-vehicle parts & package separately in resealable plastic bags or boxes
- If possible submit entire items with potential or smeared polymeric transfers
- Package separately in paper bags - pack to prevent stain removal by abrasive action during shipping
- Pack in clean paper - do not use plastic containers
Product Tampering
- Package & ship samples separately to avoid contamination
- submit samples in leak-proof containers, such as film canisters or plastic pill bottles - do not use paper or glass
Ropes & Cords
- Submit the entire rope or cord, if the rope or cord must be cut, specify which end was cut during evidence collection
- Submit in heat-sealed or resealable plastic or paper bags
Saliva & Urine
- Pack in clean paper or an envelope with sealed corners
- When possible, cut a large sample of saliva or urine stains from immovable objects with a clean sharp instrument
- Pick up cigarette butts with gloved hands or clean forceps - do not submit ashes Air-dry & place the cigarette butts from the same location in clean paper or an envelope with sealed corners
- Pick up chewing gum with gloved hands or clean forceps, air-dry and place in clean paper or envelope with sealed corners
Semen & Semen Stains
- Submit small, dry semen-stained objects to the selected laboratory
- Absorb dried semen stains on immovable objects onto a clean cotton cloth or swab moistened with distilled water
- Air-dry the swab or cloth & place in clean paper or an envelope with sealed corners
- These samples should not be packed in plastic containers
Photographing Shoeprint & Tire Tread Impressions
General incident scene photographs must be taken to relate the impressions to the incident scene
Shoeprint & Tire-tread Impressions
- Allow the cast to air-dry for at least 48 hrs
- Package the cast in paper, not plastic
- Air-dry & package evidence separately in bubble wrap, clean/smooth paper, laminated folders or paper bags
Soil
- Air-dry the soil & the clothing & package separately in paper bags
- Air-dry the soil & package separately in paper bags
- Submit known & questioned soil in leak-proof containers - do not use paper envelopes or glass containers
Tape
- Whenever possible submit tape still adhered to the substrate minimizing the loss of trace evidence, latent fingerprints or contact impressions
- Do not distort or tear the tape during removal
- If the tape is cut during removal document and initial each cut
Tissues Bones Teeth
- Place tissues samples in a clean, airtight plastic container without formalin or formaldehyde
- Place teeth & bone samples in clean paper or an envelope with sealed corners
- Freeze the evidence place in foam containers, and ship overnight on dry ice
Tool Marks
- Submit samples in leak-proof containers, such as film canisters or plastic pill bottles
- To avoid contamination, do not place the tool against the foot-marked evidence
- Submit the tool rather than making test cuts or impressions
Toxicology
- Because of a large number of potentially toxic substances, it may be necessary to screen for classes of poisons, such as:
- Volatile compounds (ethanol, methanol, isopropanol)
- Heavy metal (arsenic)
- Non-volatile organic compounds (drugs of abuse, pharmaceuticals)
- Miscellaneous substances (strychnine, cyanide)
Toxicology
- The quantity of biological specimens submitted depends on
- Whether identity of a toxic substance is known The route of administration
- Time after exposure that biological specimens are collected
- Whether the persons involved are living or dead
Toxicology
- Place each biological specimen in a separate, labeled, sealed glass tube, plastic cup, or heat-sealed or resealable plastic bag
- Biological specimens must be refrigerated or frozen during shipping
Chain of Custody
The uninterrupted control of evidence, critical to the admission of evidence in court
Written Evidence
Traits such as age, sex, personality, and intent cannot be determined by handwriting
Written Evidence - Types of False Signatures
- Traced signatures are prepared by using a genuine signature as a template or pattern
- Simulated signatures are prepared by copying or drawing a genuine signature
- Freehand signatures as written in the forger’s normal handwriting with no attempt to copy another person’s writing style
Documentary Evidence
Burned or charred paper with information on it can sometimes be deciphered - it must be minimally handled and shipped in the container in which it was burned in polyester film encapsulation or between layers of cotton in a rigid container
Res Gestae
- Things done is an exception to the rule against hearsay evidence based on the belief that because certain statements made naturally, spontaneously, and without deliberation during the course of an event, they leave little room for misunderstanding or misinterpretation by another person
Res Gestae
The courts believe such statements carry a high degree of credibility
Types of evidence that can be admitted as res gestate fall into three categories
- Words or phrases that form part of, or explain, a physical act
- Exclamations that are so spontaneous as to belie concoction
- Statements that are evidence as to someone’s state of mind
The Daubert decision (1993) and Federal Rules of Evidence (Are 702) identify five considerations
- Whether the technique or theory can be or has been tested
- Whether the technique or theory has been subject to peer review and publication
- The known or potential rate of error of the technique or theory
- The existence and maintenance of standards and controls
- The degree to which the technique or theory has been generally accepted within the scientific community
Public vs. Private Sector Investigations Scope
Corporate investigations tend to be broader in scope than those initiated by public law enforcement
Private sector security value is frequently measured in
- Recovery
- Restitution
- Risk reduction
Burdens of Proof
- Public sector (criminal court): Proof beyond a reasonable doubt
- Private sector (civil court): Preponderance of the evidence
Differences in multi-national and international investigations fall into one or more of three categories
- Laws
- Liaison
- Approach
Differences in multi-national and international investigations fall into one or more of three categories
- Laws
- Liaison
- Approach
What originated in the securities industry (Securities Act of 1933)
Due Diligence
Due diligence
Always based on the “reasonably prudent person” rule
Due diligence
Diligence emphasizes the positive aspect of due care, while negligence describes the failure to exercise due care
What is the most important reasons for conducting due investigations
To protect assets
What should be reviewed when performing due diligence investigations on businesses?
Capital expenditures should be reviewed for the last five years
What is a common error in a due diligence investigation?
Relying on information from the target of the investigation
What is the first step in due diligence investigations
To examine the issue at hand - the deal, the person, the investment, etc. - and understand what factors to focus on to answer the problem
Due diligence investigative resources - Primary Sources
- interviews with individuals
- Direct observations of people, places or events
Due diligence investigative resources - Secondary Sources
- Government-maintained public records
- Commercial record sources
- Annual reports and other company records
- News and other media sources
Daubert vs. Merrell Dow Pharmaceuticals, Inc
requires judges to determine whether expert scientific testimony is based on sound science before allowing it into evidence
General Electric Co. vs. Joiner
Found that trial judges can specify the kind of scientific testimony that juries can hear
Kumho Tire vs. Carmichael Co
Expanded the scope of Daubert, requiring that any expert, scientific or otherwise, be scrutinized before testifying
Kumho Tire vs. Carmichael Co
Expanded the scope of Daubert, requiring that any expert, scientific or otherwise, be scrutinized before testifying
OSHA Investigation
OSHA expanded its general duty clause in 1993 to include a duty to protect employees from workplace violence when it fined Charter Barclay, psychiatric care facility, $12,000 for failing to protect its employees from assaults perpetrated by its patients
General Duty Clause
This part of the Act requires employers to provide employees with a working environment free from recognized hazards
Special Duty Clause
This part of the Act requires employers to comply with standards listed in the Act itself or published by the secretary of labor
State Standards
A state-adopted standard separate from the OSHA special duty standards under the Occupational Safety and Health State Plan Association (OSHPA) program - state standards, policies and procedures at least as effective as those of OSHA
Types of OSHA violations
- Imminent dangers
- Serious violation
- Non-serious violation
- De minimis conditions
- Repeated violation/failure to correct
OSHA normally schedules compliance inspections according to the following priorities
- In response to fatalities or the hospitalization of two or more employees from the same incident
- In response to employee complaints
- In selected high-hazard “target industries”
- Based on a random selection of industries that have not been previously inspected
What can cost much more than penalties?
Purchase of new equipment Plant remodeling Lost production time
What can cost much more than penalties?
Purchase of new equipment Plant remodeling Lost production time
OSHA officers may be looking for compliance with two types of standards
vertical standards: which apply to a particular industry or particular operations, practices, conditions, processes means, methods, equipment or installations Horizontal standards: which are more general standards applicable to multiple industries
Fines for OSHA violations
Serious violation: Up to $7k Non-serious violation: Up to $7k Repeated or willful violations: Up to $70k; minimum penalty for a willful violation is $5k Willful violation that resulted in the death of an employee is punishable by up to $10k in fines and a six-month jail sentence Violations of posting requirements are fined up to $7k each
OSHA provides criminal sanctions in 3 situations
- When an employer’s willful violation of a standard, rule, order, or regulation causes the death of an employee
- When an individual makes a false representation regarding compliance with the Act
- When a person gives advance notice of an inspection
In determining whether an employment relationship exists, the OSHRC uses the “economic realities test” to
- Determine who workers consider being their employer
- Who pays workers
- Who has a responsibility to control workers
- Whether the cited employer has control over workers
- Whether the cited employer had the power to hire or fire workers
Multiple-employer doctrine
Is interpreted to hold that general contractors may be held in violation of safety regulations even if they had no employees at the job site, as a general contractor normally has the responsibility and the means to ensure that other contractors fulfill their obligations for employee safety
Common defenses against OSHA-imposed criminal citations
- An isolated occurrence or employee misconduct
- Greater hazard
- Infeasibility or impossibility of compliance
Two types of injury and illness records must be maintained at each establishment
- The log and summary of Occupational injuries and illnesses (OSHA forms 300 and 300A)
- The Supplementary Record of Occupational Injuries and Illnesses (OSHA form 101) or equivalent
Occupational injuries and illnesses that must be recorded are those that result in
- Fatalities, regardless of the time between the injury and death, or the length of the illness
- Lost workday cases, other than fatalities
- Nonfatal cases without lost workdays that result in any of the following
Typically results from a work accident or simple incident
Injury
Typically arises from hours, days, or longer exposure to a substance, heat, noise, or other insults to the body, cumulative in its effect, and which may not have been noticed at the outset. It is an abnormal condition or disorder, other than an injury, caused by exposure to environmental factors connected with employment
Illness
Four-phase program conducted by the security force
Phase 1) Zone the plant and identify critical safety points; use self-inspection checklists the officer can complete
Phase 2) Train security officers in specific OSHA requirements applicable to different inspection zones
Phase 3) Design safety inspection forms to be used by security officers to conduct safety
Phase 4) Review any identified issues or safety discrepancies, and determine the actions to correct them
A “national consensus standard” is any of the following, as defined by OSHA
- Any occupational safety/health standard or modification by a national-recognized standards-producing organization
- Standards developed after conflicting or differing views had been considered
- A practice designated as a national consensus standard by the Secretary of Labor after consultation with other federal agencies
An interactive form of investigation
Undercover Investigation
Main potential problem in an undercover investigation
the possibility that the investigation will be exposed or compromised
Most common types of undercover investigations
Drug investigations Theft investigations
Five phases of undercover operations
- Planning and preparation
- Information gathering
- Verification and analysis
- Disciplinary and corrective action
- Prevention and education
Information gathering phase includes two types of assets
People in the project management team Processes for communications reporting, filing
Five distinct and interrelated individuals included in the investigative team
- undercover investigator
- Project manager
- Client representative
- A corporate attorney
- A law enforcement representative if necessary
One of the most popular formats for investigative reports is
Structured Narrative
Maintains and archives the closed case file
Custodian of Record
Why should I involve legal counsel?
is to protect the investigator’s work product from discovery
Two methods of placement for the undercover investigator in the desired position
- Cold hire
- Controlled hire
Cold hire
The investigator applies for and is hired for a position just like any other applicant (preferred but not always practical)
Controlled hire
The employment process is covertly manipulated to ensure the investigator is hired and placed correctly
What is the first step of the undercover investigator once engaged?
Relationship building
To make (or break) the investigation the undercover investigator must be able to
- Think
- Plan
- Execute
Employees who are involved in breaking the law in one way will often find it easy to join the operative in trying to break the law in other ways
Cognitive Consistency
Workplace crime is a function of three fundamental elements
- Quality of people hired
- The environment
- The quality of supervision
Interviews often begin with those most involved and work toward those less involved because
- perpetrator(s) has already been identified
- Interviews of others before the interrogation of the suspect may tip him off
The timing of the removal of the operative is one of the most frequently debated subjects- Operative is one of the most frequently debated subjects
Operative should be kept it is as long as possible
Who should the communications regarding the findings of an undercover investigation be delivered to?
The workforce only after all corrective actions have taken place
Employee prosecution rarely provides any real return on the company’s investment
Disciplinary action is a preferred recourse, since prosecution from a business perspective, only further erodes the corporate bottom line & has been shown to have little deterrent value
