Criminal Defense Investigation: Theory, Practice, and Methods

Do you want a physical copy of this book? You can purchase a copy through Amazon.

Recommended citation:

Pennington, Jeremy. Criminal Defense Investigation: Theory, Practice, and Methods. Ironton: Pennington & Associates Ltd., 2016


Chronology Analysis

Any criminal act can be reduced to a simple chronology. In simple terms, a chronology is a series of events organized by time. In a criminal defense investigation, a chronology has considerable utility. The criminal defense investigator is able to determine when an event occurred in comparison to events that occurred before and after the event, as well as the relation of events to locations, individuals, and the context of events. A chronology of an alleged crime acts as a storyboard from which considerable insight can be gained.
Unfortunately, the work environment of a criminal defense investigator is complex and requires the processing of a considerable of amount of information in a wide array of forms. This information can be composed of witness statements, telephone records, security camera footage, and many other forms of information. All this information has to be composed into a clear image of the incident. A chronology is utilized to construct this image.

Constructing a chronology is a straightforward process. Typically, the information initially received by the criminal defense investigator when accepting the case will be the starting point. During the onset of the investigation, all information is sorted based upon the date and time of occurrence. This information is then placed on a horizontal axis in chronological order, typically starting from left to right with the most recent event at the end of the axis. During this systematic process of placing the information in chronological order, the quality of the information should be considered.

Information used in the chronology will be received in many different forms. It can typically be categorized as high or low quality. In the construction of a chronology, high quality information is information that has been documented in association with a date and time value, for example, security camera footage, telephone records, and digital images. This form of information is easily organized in chronological order with a high degree of confidence after confirming the validity of the timestamp. On the other hand, low quality information presents several problems. Low quality information is information that is not normally documented in association with a date and time value, for example, witness testimony of the times specific events occurred. This is the most common form of low quality information in the construction of a chronology. In short, human beings are not well equipped to recall precise times that specific events occurred. In turn, consideration must be utilized when placing this type of low quality information on the chronology axis. In practice, low quality information should be viewed as approximate rather than precise.

Constructing a Chronology

A considerable amount of information will be assessed by a criminal defense investigator throughout a criminal defense investigation in order to construction a chronology. The following questions should be used systematically in assessing the resulting chronology:

  • Is there a significant temporal distance between events? Is there a possibility of a gap in the available information?
  • Is there a geographical distance between events? Does the geographical distance align with the available time for travel or other associated actions?
  • Is there information that may have had an impact on or could be related to the event that has not been included?
  • Is there an alternative explanation for each event in the timeline? Are there events in the timeline that are unrelated to the alleged crime?
  • Does the timeline contain all the events that make up the alleged crime?
  • What are the information gaps?
  • Are there any segments of the timeline where new information can be collected in the present?
  • Are there any information gaps that should have been met by the law enforcement investigation? Why? Is it possible law enforcement ignored the information? If the alleged crime occurred, why does this information not exist? Is the absence of information proof of innocence?
  • Are there events not included in the timeline that could have influenced the alleged crime?
The above questions should be systematically worked through when constructing a chronology. In practice, the chronology constructed during a criminal defense investigation will be revised each time new information is uncovered. Initially, a considerable amount of information will be used to construct the chronology; this will be derived from the initial discovery materials received from the defense attorney. Then, additional information will be plotted on the chronology as it is uncovered during the criminal defense investigation and updates to the discovery material are received.

Information gaps are expected during an investigation, and all attempts should be made to close these gaps. Significant temporal distances between two adjacent chronological events indicate an information gap. However, it is necessary to ask to what degree a temporal distance is significant. This question is directly tied to the context of the adjacent chronological events. For example, two gunshots are reported five minutes apart at the same location. This is a significant temporal distance, considering the two gunshots could be tied to the same incident or two separate incidents. In order to determine if the gunshots are part of a common incident, further information will be need. Thus, a gap in information exists that requires further collection. On the other hand, if the two gunshots were only seconds apart, the temporal distance would be less significant.

Determining if a specific temporal distance is significant requires focused critical thinking. A criminal defense investigator must weigh all training, education, and experience on the specific temporal event and how it relates to all adjacent temporal events. In simple terms, the criminal defense investigator must utilize his or her general knowledge and determine specifically how much temporal distance should exist between adjacent temporal events. The distances could be significant if they are too long or too short in duration. The key is analyzing the adjacent temporal events as individual events and then as competing events.

  • Is there a geographical distance between events? Does the geographical distance align with the available time for travel or other associated actions?
  • Is there information that has not been included that may have had an impact on or could be related to the event?
  • Is there an alternative explanation for each event in the timeline? Are there events that belong to an unrelated timeline in respect to the alleged crime?
  • Does the timeline have all the events that makeup the alleged crime?
  • What are the information gaps?
  • Are there any segments of the timeline where new information can be collected in a contemporary setting?
  • Are there any information gaps that should have been met by the law enforcement investigation? Why? Is it possible law enforcement ignored the information? If the alleged crime is true, why does this information not exist? Is the absence of information proof of innocents?
  • Is there events outside the timeline that could influenced the alleged crime?

Utilizing Investigative Information

Time sensitive information is used during the assembly of a chronology. This information is the foundation of any chronology. Data derived from video footage, photographs, written logs, official reporting, and other forms of documentation holding valid temporal values are useful assembling the chronology. However, a criminal defense investigator should always consider of the credibility of the data. If possible, all temporal data should be verified. For example, the date and timestamp of security camera footage should always be verified by examining a live recording. Typically, a display screen is available where the date and time can be observed and compared to a known, accurate date and time. If any temporal data if found to be inaccurate, it should be documented along with its supporting evidence. In turn, the data should be adjusted before it is included in the chronology. Appropriate annotations should be made on the chronology indicating these adjustments.
The following temporal data sources are common in a chronology:

  • Security camera footage
  • Law enforcement dispatch logs and reporting
  • EMS dispatch logs and reporting
  • Telephone records
  • Witness testimony containing a temporal component
Additional investigative information can be included in the chronology. Geospatial data should also be included when dealing with more than one location. Travel time between locations can play an important role when considering the defendant’s ability to commit a crime. Moreover, topical data can be useful in limited cases. Short descriptions of each event that also reference other investigative data can play an important role in understanding a chronology. Brief descriptions of witness observations springboard the analysis of witness credibility.

Assembling and Reporting the Chronology

Chronologies are a powerful tool in communication. This includes communication between the defense Investigator and the attorney. This also includes the attorney's communication with the court. Generally, a complex chronology is assembled by the criminal defense investigator during the initial stages as information emerges. Then, over time, information is removed from the chronology that is found to have no utility in understanding the event in question. The best practice is to use all available data then remove data as needed.

During the initial stages of assembling a chronology, a single credible point in time should be selected as the initial staring point. From this point, the chronology should be assembled forward in time and back in time. The initial starting point should approximately fall in the middle range of the chronology's span. The initial temporal data generated from law enforcement is generally adequate for this purpose. The documentation generated from a 911 call or law enforcement dispatch logs will contain temporal documentation. The goal is to use an accurate temporal data point that the criminal defense investigator has a high degree of confidence in.

Chronologies can be assembled in any form depending on the issue at hand. A chronology can consist of a simple horizontal line with just a few vertical lines representing independent events. On the other hand, a chronology can grow to be multi-tiered, where multiple chronologies are represented allowing a comparison between parallel chronologies. The final chronology or chronologies should be specifically prepared to meet the demands of the investigation. This can only be judged on a case by case bases. The Criminal Activity Equation should also be utilized when finalizing the chronology or chronologies:

Criminal Activity = Intent + Opportunity + Ability

The final chronology is reported to the attorney. At times, more than one chronology will be needed to show different facets of an event. As a general rule, a chronology should be made as simple as possible without redacting the overall narrative of the subject event.
Sophisticated computer software is available to assist in the assembly of a chronology. However, computer software should be utilized with caution. At best, computer software is only a means to capture temporal data and then display the information. Even though temporal data includes quantitative variables, the underlining cause and effect demonstrated through the chronology is of a qualitative nature. Simply stated, contemporary computer software is currently ill suited to handle this form of analysis. The criminal defense investigator must perform the qualitative analysis through critical thinking, framed by the process described above.

A chronology is a robust instrument in any criminal defense investigation. The aggregation of temporal data from multiple sources allows the criminal defense investigator to complete a comparative study of information representing an event. Through the process of assembling a chronology, relationships between independent events or timelines can be uncovered.