Criminal Defense Investigation: Theory, Practice, and Methods

Do you want a physical copy of this book? You can purchase a copy through Amazon.

Recommended citation:

Pennington, Jeremy. Criminal Defense Investigation: Theory, Practice, and Methods. Ironton: Pennington & Associates Ltd., 2016


Analysis of Competing Hypotheses

Matters of criminal defense are posed with one critical issue, which has two distinct adversarial views. These two competing views can be framed as hypotheses. Each side presents and argues evidence to support a proposed hypothesis. The evidence presented, along with skilled arguments supporting each hypotheses, is decided upon by the judiciary. In some cases, one hypothesis gains considerable weight over the opposing hypothesis, and the opposing side succumbs to the demands of the prevailing hypothesis’s architect. This, in turn, leads to a settlement or plea bargain. The similarities of this context to the historical use of the analysis of competing hypotheses (ACH) method is undeniable.

ACH has been used by professional intelligence analysts since the 1970s. Generally, this method is used to make difficult probability judgments involving many different alternative hypotheses. In short, the goal is to find and select the hypothesis most likely to become true during predictive research. ACH is considered by some as the most robust form of qualitative analysis available. An examination of ACH reveals its utility in the measurement, comparison, and diagnostic exploration of criminal evidence.
Criminal defense investigators are tasked with supporting criminal defense attorneys. The type of support varies between different investigator-attorney relationships. However, at the foundation, criminal defense investigators have the task of sorting and measuring the impact of information. This information is deconstructed and organized to create a coherent image of the alleged crime, allowing the defense attorney to competently argue a defense. Critical aspects of information can be easily overlooked while sifting for critical facts.

The criminal defense investigator is responsible for three critical tasks involving information: reviewing the information presented by the prosecution team, uncovering new information that is either denied or unknown by the prosecution, and deconstructing and measuring all information for its impact on the overall defense strategy. The resulting analysis is communicated to and interpreted by the defense attorney. However, there is a high risk of error during the process. The criminal defense investigator or attorney could easily miss a pivotal fact or fail to search for specific evidence due to bias. Historically, this process has been completed through intuitive reasoning, which is error prone. An investigator can miss pivotal information based on the sheer volume of information or fail to recognize a critical fact. ACH presents the opportunity to alleviate the errors historically encountered by investigators.

ACH in Theory, Method, and Practice

ACH was originally meant for predictive research on an international scale, specifically dealing with issues of U.S. national security. Ideally, this method is used to evaluate controversial issues that are placed under considerable scrutiny. Several procedural methods are built into the ACH method that support national security goals. The use of an array of hypotheses represents several plausible future events. Thus, ACH is a method of selecting the right hypothesis or event in the face of abstract information.
ACH was created by Heuer (1999). In ACH, a hypothesis is defined as a “potential explanation or conclusion,” which is examined by collecting evidence and formulating arguments. The ACH method requires the explicit identification of all plausible alternative hypotheses and lays them in competition for favor by the practicing analyst while minimizing cognitive limitations. This method breaks from the traditional approach of qualitative intuitive reasoning.

The ACH method, as described by Heuer, (1999) is presented below for clarity:

  • Identify the possible hypotheses to be considered. Use a group of analysts with different perspectives to brainstorm the possibilities.
  • Make a list of significant evidence and arguments for and against each hypothesis.
  • Prepare a matrix with hypotheses across the top and evidence down the side. Analyze the “diagnosticity” of the evidence and arguments—that is, identify which items are most helpful in judging the relative likelihood of the hypotheses.
  • Refine the matrix. Reconsider the hypotheses and delete evidence and arguments that have no diagnostic value.
  • Draw tentative conclusions about the relative likelihood of each hypothesis. Proceed by trying to disprove the hypotheses rather than prove them.
  • Analyze how sensitive your conclusions are to a few critical items of evidence. Consider the consequence for your analysis if that evidence were wrong, misleading, or subject to different interpretation.
  • Report conclusions. Discuss the relative likelihood of all the hypotheses, not just the most likely one.
  • Identify milestones for future observation that may indicate events are taking a different course than expected.
ACH allows the intelligence analyst to overcome the inherent limitations of human memory. The process of generating a matrix of hypotheses and evidence allows the analyst to evaluate information in a systematic process. Otherwise, the endeavor would overload an analyst with information. ACH is a model for evaluating complex problems. The ACH process acts as a vehicle for applying the scientific method to complex qualitative problems. However, the limitations of predictive analysis are that a hypothesis cannot be tested using the application of the scientific method; this is the same during criminal defense investigations. Thus, ACH stands as the most approximate contemporary approach to evaluating qualitative data without testing hypotheses.

ACH is a method that is intended to overcome the analyst’s cognitive limitations. Analysts intuitively select their preferred hypothesis. In short, this occurs when the analyst specifically selects evidence supporting their favored hypothesis and discounting any non-supporting evidence. This phenomenon has been termed “satisficing,” or selective perception. During ACH, the analyst is attempting to disprove each hypothesis as enumerated in the fifth step of the ACH method. Thus, the analyst is positioned to examine an array of hypotheses rather than focus solely on one hypothesis.

Engaging an array of hypotheses is critical. The most devastating aspect of engaging a single hypothesis is the overwhelming odds that an incorrect hypothesis is being advanced. The general idea is to initially engage a large array of hypotheses. However, the structured analysis of competing hypotheses (SACH), a version of ACH, uses different approach. SACH uses what is termed a “drill-down” effect. In short, the analysis begins by utilizing only two different hypotheses in the early stages. After finding one hypothesis true, additional research questions are asked to generate more hypotheses. The argument for using SACH versus ACH is the prevention of cognitive bias. ACH was advanced with the same rationale. To date, these two opposing methods are used at the analyst’s discretion. Nevertheless, the simple reality is that the use of only two hypotheses does not lead to the diagnosticity of evidence. The lack of a hypothesis array limits the search for evidence during analysis. The primary strength of ACH is its diagnostic value.

Diagnostic value can be framed as the evidence’s value across all hypotheses. Diagnostic value is not the support of all hypotheses, but the explicit support of one select hypothesis. Heuer (1999) asserts that a common experience during the use of ACH is an analyst finding favored evidence that supports their preferred hypothesis as well as several other hypotheses. In turn, the evidence holds no diagnostic value. Heuer (1999) determined that identified diagnostic evidence should drive judgments. Thus, in theory, judgments made through ACH are highly objective.

The objectivity of ACH is dependent on the hypothesis array. Step one of the ACH method requires the identification of all possible hypotheses for consideration. The hypothesis array is directly tied to the ability to find and evaluate all available evidence. If a critical hypothesis remains unavailable during analysis, then the diagnostic value of specific evidence’s will remain undiscovered. Thus, hypothesis generation is a critical step.

ACH in Criminal Defense

Criminal litigation is a prime environment for the application of ACH. It is human nature to seek a smoking gun when placing blame. However, an environment composed of strict qualitative information is normally not acquainted with a trenchant piece of evidence. In some cases, such evidence may not be available, and in other cases the relationship may not be readily apparent. In the best of cases, ACH is a means to uncover an unseen smoking gun in criminal litigation.

Human cognitive limitations increase with the complexity of an investigation. Cognitive limitations are normally not an issue in simple investigations that include a small number of variables. However, as investigative variables increase, the limitations of human cognition have a compounding effect. In short, humans simply are unable to organize, measure, and effectively evaluate a large number of variables.

Figure 8.1 - ACH Example Matrix

Hypothesis #1 (H1) – The defendant committed the murder.
Hypothesis #2 (H2) – committed the murder.

A prime example of this cognitive limitation is a criminal defense scenario involving a group of suspects. An investigating law enforcement agency arrests one suspect based on an admission during the interrogation of the defendant. There is a meeting that includes seven suspects and the victim. During a brief break from the meeting, lasting no longer then fifteen minutes, all individuals exit into a long corridor with bathrooms, vending areas, and storage areas. Upon returning to the meeting, the victim is unaccounted for, and one other individual is also missing, the defendant. The meeting reconvenes. Fifteen minutes later, the defendant returns to the meeting stating that he became sick in the restroom. The victim never returns.

Two days later, law enforcement is contacted by the victim’s family. Six days later, the victim’s body is found in a storage area adjacent to the meeting room in a cabinet that required the murderer to lift the victim five feet off the ground. The victim is described, by law enforcement officers, as six-feet tall weighing three hundred and fifty pounds. The resulting investigation determined the occupancy of the building was limited to the meeting attendees. The defendant and the victim had a public disagreement two days prior to the incident, and a long, well-known adversarial relationship. Figure 8.1 is an example of how this information would be used within an ACH matrix.

Considering the victim’s known relationship with the defendant, we assume the defendant had a motive to murder the victim. This conclusion is represented by a “+” mark under hypothesis H1. In the same token, the defendant and victim had the opportunity to be alone prior to the murder, which is signified by an additional “+” mark under H1. The victim was in contact with seven people preceding the murder. Because the defendant is one of the seven people, both H1 and H2 receive a “+” mark. Lastly, the victim’s body weighs three hundred and fifty pounds. An average person would feasibly be unable to lift the victim’s body five feet from the ground. Thus, H1 receives a “-” mark, and H2 receives a “+” mark.
Examining the matrix reveals four key points. Three of these key points are arbitrary: one, the defendant, based on the matrix, had access to the victim, two, the meeting group as a whole had access to the victim, and three, the defendant is assumed to have a motive. The primary key point that holds diagnostic value is the victim’s body weight and the placement of the body. This diagnostic value should be the driving factor of the investigation. With this diagnostic value, a Criminal defense investigator only needs to prove the defendant is unable to physically lift the victim’s body five feet off the ground, either through natural means or through some form of assistance.

Why does the body weight hold diagnostic value and the remaining evidence does not? A critical examination of the matrix shows that the body weight does not support the H1 hypotheses. This is critical in understanding how to utilize ACH during a criminal defense investigation. Yes, H1 is supported by other evidence but not by the issue of body weight. Why does the body weight become so critical during our evaluation? In short, the body weight supports a single hypothesis.

Figure 8.2 - ACH Example Matrix

Hypothesis #1 (H1) – The defendant committed the murder.
Hypothesis #2 (H2) – An unknown person(s) committed the murder.

The diagnostic value of the body weight becomes more apparent in Figure 8.2, where it becomes clearer that it supports only one hypothesis: H2. Moreover, there is no other evidence supporting this same hypothesis. Yes, the remaining evidence does support H1. However, the issue of body weight only supports H2. Why does this evidence not support H1? More importantly, why is this lack of support for H1 significant? Simply stated, H1 is disproved by the existence of the body weight issue. In the same token, H2 is disproved by the existence of evidence that only supports H1. The significance of the body weight evidence in supporting one hypotheses drives the investigator to reconsider the favored hypothesis and its underlying supporting evidence.

In practice, the diagnostic value of the body weight would force the criminal defense investigator to consider additional hypotheses and search for evidence to support these hypotheses. In the process, the investigator would exhaust all possible hypotheses until only one remains. It is important to note that ACH is not about declaring a winner but considering possibilities. ACH is meant to determine the likelihood of each hypothesis.

This example is meant to demonstrate the application of ACH in criminal defense investigations. An array of hypotheses can be evaluated based on available evidence. Specific evidence can be measured based on “diagnosticity.” The critical aspect of ACH is that evidence can be evaluated, using a matrix, across a wide spectrum of possible hypotheses. ACH can allow the criminal defense investigator to determine what is and what is not known with a given degree of certainty. In turn, ACH holds considerable utility for criminal defense investigator through the measurement, comparison, and diagnostic exploration of criminal evidence.

Utilizing ACH

ACH should be viewed as a rallying point during any investigation. Before ACH is utilized, a good footing should already be in place. Simply stated, the criminal defense investigator should have already processed the discovery file using information quality checks, completed the required collection operations, and completed the analytical techniques presented earlier in this book.

For clarity each step of ACH is examined in detail from the perspective of a criminal defense investigator:

1. Identify the possible hypotheses to be considered. Use a group of analysts with different perspectives to brainstorm the possibilities.
The previously developed hypothesis array is utilized during this step. However, hypothesis generation should be a continuous process. This can include obtaining additional perspectives from peer investigators, but in many cases this may not be possible.

2. Make a list of significant evidence and arguments for and against each hypothesis.
During this step, all investigative data and analytical products should be considered for inclusion. The criminal defense investigator must ensure any information utilized has been fully vetted through an information quality check. This step also includes “arguments.” From the perspective of a criminal defense investigation, “arguments” include any known analytical judgements made by the State and any interpretation of the evidence made by the criminal defense investigator.

3. Prepare a matrix with hypotheses across the top and evidence down the side. Analyze the “diagnosticity” of the evidence and arguments—that is, identify which items are most helpful in judging the relative likelihood of the hypotheses.

In this step, hypotheses are plotted across the top of the matrix. Then, each facet of information is considered for inclusion on the matrix. This can be a haphazard process in the hands of an unskilled investigator. Generally, an investigator with limited experience should include all information and then consider the “diagnosticity” of each piece of evidence. However, an experienced investigator can make these judgments with a high degree of certainty without plotting all information. As a rule, the Criminal Activity Equation should be the foundation when making these considerations:

Criminal Activity = Intent + Opportunity + Ability

The following aspects of evidence should be considered when plotting evidence:

The chronology of events that define the alleged crime
The credibility of each piece of evidence
The existence of absent evidence

4. Refine the matrix. Reconsider the hypotheses and delete evidence and arguments that have no diagnostic value.

In this step, hypotheses and evidence holding no diagnostic value are eliminated. Simply stated, information is reduced from a large to a consumable scale. In practice, all evidence supporting a large number of hypotheses should be eliminated.

5. Draw tentative conclusions about the relative likelihood of each hypothesis. Proceed by trying to disprove rather than prove each hypotheses.

In this step, a critical review of each piece of evidence is undertaken. A revised view of each hypothesis is taken, where the focus is on disproving rather than proving each hypothesis. Then, each facet of evidence is assessed to ascertain whether it supports a specific hypothesis. Simply stated, the investigator focuses on why the evidence would not support a specific hypothesis rather than whether the evidence supports the specific hypotheses. This approach to assessing each facet of evidence is key during the ACH process.

6. Analyze how sensitive your conclusions are to a few critical items of evidence. Consider the consequence for your analysis if that evidence were wrong, misleading, or subject to different interpretation.

In this step, critical evidence is assessed. What is considered critical evidence? Again, from the perspective of a criminal defense investigation, this comes back to the Criminal Activity Equation:

Criminal Activity = Intent + Opportunity + Ability

The equation should be the theoretical lens from which all evidence is viewed and assessed. The consideration is made if the analysis is wrong from the perspective of each piece of evidence. The Investigative Evidentiary Equation is the foundation of this this assessment:

Event = Evidence + Silent Evidence - Absent Evidence - Credibility

The Investigative Evidentiary Equation represents a process underlying the ACH. The option exists to rank each piece of evidence based upon its credibility. Instead of simply utilizing a “-” or “+” symbol, evidence supporting a hypotheses can be indicated on a scale of 1 through 10, “1” representing the lowest credibility and “10” representing the high level of credibility. During the more generalized application of ACH, a similar scale can be utilized to indicate the level of support a facet of evidence lends to a specific hypothesis. However, this method is not recommended in a criminal defense setting due to the preferred usage of a credibility variable.

7. Report conclusions. Discuss the relative likelihood of all the hypotheses, not just the most likely one.

In this step, a consideration is made of the prior results. The resulting matrix is viewed from the perspective of an array of possible answers based upon the relative likelihood of each hypothesis. In turn, the resulting conclusion is then incorporated into the ongoing investigation.

8. Identify milestones for future observation that may indicate events are taking a different course than expected.

ACH is utilized in predictive analysis; as a consequence, this step may seem of place during a criminal defense investigation. However, this is not the case. A “milestone” in a criminal defense investigation represents information that could emerge that changes the overall conclusions of the analysis, for example, a codefendant turning State witness, an new witness proving incriminating testimony, or the results of a pending forensic test. Milestones are critical aspects of a criminal defense investigation, not because they require further collection operations but because of the possibility of silent evidence.

Utilizing ACH in The Real World

Implementing ACH during real-life, complex investigations can be an overwhelming task for an investigator. Considering the ACH matrix will be reassessed and reassessed over the lifespan of an investigation, this is an ideal issue to be handled through the use of computer software. A spreadsheet serves this purpose well. The use of spreadsheets allows easy transfer to a written report and overall manipulation of the ACH matrix. There is specific software available for ACH through Palo Alto Research Center. This software has considerable utility and automates the manipulation of the ACH matrix. However, the software does not allow the matrix to be exported into a printable format, which makes generating a report difficult. The software is freely available for download through the following URL:

http://www2.parc.com/istl/projects/ach/ach.html

ACH Reporting

The results of an ACH analysis should be reported to the defense attorney. This serves two purposes in the investigator-attorney relationship. First, the attorney is able to understand the criminal defense investigator’s professional opinion of the alleged crime within a format that can be audited. The ability to audit an analysis completed through ACH is one of the reasons the method is utilized during controversial issues. Therefore, the criminal defense investigator must ensure an adequate amount of detail is available on the matrix for this audit to take place. References to original source documents is helpful in this respect. Second, the attorney is able to utilize the ACH matrix when attempting to understand the criminal defense case as a whole and while generating arguments. ACH reporting should occur late in the investigation in order to reflect the utilization of the ACH method throughout the investigation. Simply stated, ACH will be completed several times throughout an investigation of a single alleged crime. The matrix will go through several revisions as new information emerges and additional hypotheses are considered. Only the final ACH matrix should be provide to the attorney to prevent any overlap or errors in information.