Criminal Defense Investigation: Theory, Practice, and Methods

Do you want a physical copy of this book? You can purchase a copy through Amazon.

Recommended citation:

Pennington, Jeremy. Criminal Defense Investigation: Theory, Practice, and Methods. Ironton: Pennington & Associates Ltd., 2016


All Source Analysis

Criminal defense investigations require a robust information flow. This information must be directly and coherently communicated to the responsible defense attorney. The mistake made by many professional investigators attempting to enter the arena of criminal defense investigation is the misconception that there is a complete focus on collection. All too often, they perceive this profession as one consisting only of interviewing witness, documenting the alleged crime scene, and completing background checks on individuals named as witnesses for the State. However, a complete criminal defense investigation includes much more than just collecting information. Moreover, the process does not include limited analysis of one segment of the alleged incident. The goal is to provide the responsible criminal defense attorney with a clear image of the entire alleged event.

A clear image of the alleged event is provided through all source analysis. In simple terms, all facets of the alleged incident are accessed and examined in detail. This process is the accumulation of the State’s evidence and evidence uncovered by the criminal defense investigator, which is then driven through a comprehensive analysis process. Information used in this process can arrive in a wide array of forms.

  • The most common forms of evidence include:
  • Witness testimony
  • Expert testimony
  • Law enforcement testimony
  • Physical items (large items to trace evidence)
  • Official reports
  • Official records
  • Third party records
  • Photographs
  • Video footage
  • Evidence internally generated by the criminal defense investigator
Each type of information has a unique aspect in analysis. The process used to handle witness testimony will differ from the handling of physical evidence. However, all forms of information must be incorporated during the final analysis to generate a cohesive image of the alleged incident.

During criminal defense investigations, all source analysis includes the accumulation of witness testimony, evidence in the form of physical items or specimens, documents, records, and accepted scientific knowledge. “All source analysis” is a term meant to convey the process of analyzing all facets of an issue; it is not meant to represent a specific method of structured analysis.

Any all source analysis should include the following four categories of data, which make up any event in history, and are of special interest to the criminal defense investigator:

  • Temporal (Time)
  • Geospatial (Location)
  • Topical (Content)
  • Network (Relationships)
The temporal category views an event based upon time. When did an event start? When did the event end? What relationship or impact does one event have on another based upon the time at which the two events occurred? These types of questions are the foundation of assessing an overall event from a temporal perspective. The event is assessed through deconstruction and assessing each segment of the event based upon their chronological order. In simple terms, each segment of the event is assessed based upon time, specifically how the segment is connected to the proceeding segment, which provides a detailed examination of the overall event from a temporal view.

Geospatial data refers to information regarding the event’s location or locations. Where did the event occur? Is there more than one location to consider? How are differing locations connected? These types of questions form the foundation for assessing an event from a geospatial perspective. As in a temporal analysis, geospatial information is deconstructed and assessed based upon the location characteristics and how it is connected to other locations of interest.

Topical data is information related to the event’s content. Simply stated, a topical view of an event is the event’s narrative. Generally, during a criminal investigation a narrative of the event is established through witness testimony, which is a simplistic approach. However, from the perspective of a criminal defense investigation, the event’s narrative is represented not only through witness testimony but through all raw information not represented in a temporal, geospatial, or network form. In any criminal defense investigation, there is a considerable volume of topical information. In short, topical information is represented by all testimony, physical, and analytical evidence. Combined, this evidence represents the event’s narrative or content.

Network data pertains to information regarding the event’s internal and external relationships. In a criminal defense investigation, a network surpasses the limitations of a peer-to-peer network and incorporates not only individual associations and relationships but also their connection to locations, physical items or trace evidence, time, and the subject event from an external view.

Structured Analysis

In the following chapters, considerable attention is paid to the application of structured analysis methods. All source analysis constitutes the combined application of these methods. Each criminal defense investigation is unique, and at times one or more of the following methods may be used. In some cases, a method may not be need. However, the available information within each case will drive which methods are utilized.

The term “structured analysis” is used throughout this book, and it is the foundation of the theory and methods presented. Defining structured analysis can be a complex task, considering there are hundreds of methods employed and new methods are regularly developed to meet new needs. However, in Structured Analytic Techniques for Intelligence Analysis, Richard Heure and Randolph Pherson developed a taxonomy for structured analysis techniques. An examination of this taxonomy enables the reader to gain an understanding of how structured analysis compares to traditional approaches of assessing information.

In Heure and Pherson’s taxonomy, two systems of thinking are presented: System 1 Thinking and System 2 Thinking. System 1 Thinking involves the traditional approach to intelligence analysis using intuitive judgement. Investigators, criminal investigators, and criminal defense investigators have traditionally utilized System 1 Thinking. In general, System 1 Thinking is an approach based upon subject-matter expertise coupled with basic cognitive skills. In contrast, System 2 Thinking is based upon four categories: critical thinking, structured analysis, quasi-quantitative analysis, and empirical analysis. The theory and methods presented in this book pertain to the areas of critical thinking and structured analysis.
Critical thinking, in Heure and Pherson’s taxonomy, is the “application of the process and values of scientific inquiry” to the matter under investigation. A critical thinker understands the need to check key assumptions, access contradictory information, and assess an array of possibilities.

Structured analysis is conducted through a step-by-step process unitized by the investigator that externalizes the investigator’s thinking. This process makes the investigator’s thought process and logical reasoning “readily apparent to others, thereby enabling it to be reviewed, discussed, and critiqued.”
Structured analysis techniques are organized into eight families:

  • Decomposition and visualization
  • Idea generation
  • Scenarios and indicators
  • Hypothesis generation and testing
  • Assessment of cause and effect
  • Challenge analysis
  • Conflict management
  • Decision support
Each family includes a wide array of structured analysis techniques. In general, the broad spectrum of these eight families is beyond the scope of this book. However, a discussion of structured analysis techniques belonging to the families of decomposition and visualization, idea generation, hypothesis generation and testing, and assessment of cause and effect is included. Not all the techniques in these four families are discussed, but a select group that have been found particularly effective in criminal defense by this author. Many additional techniques exist and are available for use in criminal defense. This book is by no means meant to suggest the techniques contained within this book are the only ones available and appropriate.

The application of structured analysis holds two important aspects for the criminal defense investigator. The first is the ability to process information in a predefined organized manner. This is a complex task, considering at times the criminal defense investigator will be required to process and gain an understanding of an overwhelming amount of information. However, this understanding is not just how the crime allegedly occurred, but what each specific segment of information represents across the event in question? Structured analysis gives the criminal defense investigator a framework from which to gain this footing and communicate this understanding clearly.

The second aspect is the diagnostic capability achieved through the application of structured analysis. In simple terms, structured analysis is formalized critical thinking; it is guided by a framework of predefined steps. The investigator is not limited by this framework but rather utilizes the framework as a roadmap insuring the complete terrain has been traveled. Some structured analytical techniques are specific to particular areas of concern. For example, hypothesis generation techniques are meant to generate hypotheses and not analyzing events over a period of time. On the other hand, some techniques are applicable very broadly. For example, the technique known as “analysis of competing hypotheses” has been utilized in a wide array of applications and diverse lines of inquiry. Regardless of the technique, all structured analytical techniques hold some degree of diagnostic capability.
In simple terms, information is organized, allowing knowledge extraction to occur. Some intelligence analysts, the traditional practitioners of structured analysis, group structured analysis techniques as either “diagnostic” or “non-diagnostic.” This is understandable from the intended use of the specific structured analytical technique. For example, hypothesis generation techniques have traditionally not been considered diagnostic techniques. On the other hand, the technique of analysis of competing hypotheses has been considered the most robust diagnostic method developed to date. However, both, hypothesis generation techniques and analysis of competing hypotheses perform the key task of discriminating between options. Thus, a diagnostic decision is made through their application.

Through the use of structured analysis, a criminal defense investigator is able to process, organize, and make diagnostic judgements. However, this highlights an important aspect when considering the issue of diagnostic judgements. Is the work product generated through structured analysis evidence or simply an investigative aid? In some cases, the end work product, in whole or in part, can be used as evidence. In most cases, the work product will be utilized in part. For example, a diagram illustrating a peer-to-peer network will be used instead of the complete analysis process that generated the diagram, which could constitute hundreds of documents. Thus, the end work product of the specific structured analysis technique is utilized as evidence instead of the complete analytical process.

Structured analysis, by its very nature, is an investigative aid. First, the in-depth process of using a step-by-step technique allows the investigator to organize and sort through information. In turn, the diagnostic benefits found in this process act as robust instruments of inquiry. Second, the end result of each specific structured technique can be passed through an additional technique for further refinement. Not only does structured analysis act as an investigative aid, but the end work product can be utilized in the future as an instrument of inquiry or evidence.