Criminal Defense Investigation: Theory, Practice, and Methods

Do you want a physical copy of this book? You can purchase a copy through Amazon.

Recommended citation:

Pennington, Jeremy. Criminal Defense Investigation: Theory, Practice, and Methods. Ironton: Pennington & Associates Ltd., 2016


Defining Investigation

The term “investigation” is used in specific academic endeavors and professional pursuits. Society has incorporated this term to define many professions. For example, we have investigative journalists, criminal investigators, and individuals conducting investigations into matters pertaining to academia, medicine, politics, history; the list reaches the furthest segments of society. The term “investigation” is likely one of the most overly used terms in connection with human pursuits, to the extent that its meaning has become generic and is applied to promote the endeavor's professionalism or the end work product as more credible than one not produced by “investigation.” In reality, many times there has not been a true investigation but rather an opinion-forming endeavor that is riddled with bias. The ambiguity of the term “investigation” is a critical issue in the context of a criminal defense investigator’s work.

A professional criminal defense investigator cannot view an investigation through ambiguity. A criminal defense investigation must be definable through a specific framework. A criminal defense investigation and a criminal investigation are one and the same. The difference is the purpose of the investigator, one of criminal defense and one of criminal prosecution. However, regardless of the investigator’s purpose, several key questions emerge when attempting to define an “investigation.” Is an investigation a scientific pursuit? Is it a matter of tradecraft utilized to uncover unknown information? Is an investigation a simple search for the truth? Many questions could be posed, but these are the core questions in defining the term “investigation” in the context of a criminal defense investigation.

Conducting an investigation is a scientific endeavor. The core concept in the scientific method is the generation of a hypothesis and deriving results from testing the hypothesis. Theories are formulated upon the results that are found true to the degree of repeatability. In general, the scientific method is an investigation in scientific terms. Is it applicable to the work of a criminal defense investigator? To a large degree, it is.

In many aspects of a criminal defense investigator’s work the scientific method will be utilized. For example, a defendant allegedly traveled from a known location and then arrived at another known location at an approximate time. This allegation can be viewed as a hypothesis and tested. The distances can be traveled by the alleged means and timed. The allegation, the hypothesis, is tested providing a result that can be repeated by another party to confirm its credibility. Thus, the scientific method is utilized to prove or disprove the allegation.

The scientific method is dominant in the forensic sciences. The use of forensic methods has become commonplace in criminal investigations. Some forensic methods could be consider pseudo-science, considering their subjective nature. However, forensic methods, derived from the hard sciences of chemistry, biology, and material engineering, have a solid foundation rooted in the scientific method. In many cases, the criminal defense investigator will utilize forensic methods personally or use the results of forensic lab reporting.

Even though the application of the scientific method holds considerable utility in criminal defense investigations, its application is limited in the traditional sense. In general, the criminal defense investigator must reconstruct an alleged incident of criminal behavior in the past. The scientific method is only applicable to a hypothesis that can be tested using an experiment in the present. A criminal defense investigator is therefore faced with assessing a hypothesis grounded in human action that occurred in the past. Facets of this historical event can be fully assessed in a contemporary setting, for example, the previous example of a defendant traveling between two locations. On the other hand, some evidence will have been degraded by the passage of time and human deceit, or the original setting cannot be recreated for experimentation with any real degree of certainty. As a result, the traditional scientific method will not be useful in all circumstances. In many cases, a hypothesis simply cannot be tested. The formulation of the hypothesis is possible, but the testing of that hypothesis may be impossible. For example, a criminal defense investigator is able to test the ability of an eyewitness to have observed an incident through a vision study, but the content of the alleged observation is untestable. The criminal defense investigator is simply at the mercy of the witness's testimony.

The endeavor of reconstructing a historical event may lay squarely beyond the scope of the scientific method. Proof of this is found in the existence of both law enforcement investigators and forensic investigators. If all crimes could be solved through the traditional scientific method, law enforcement investigators would be long extinct. This brings the core investigative methods used by criminal investigators into focus.

Investigation is tradecraft. Criminal investigation is largely based upon the uncovering evidence of guilt through the exploitation of human sources. Through interviewing witnesses and interrogating suspects, criminal investigators are able to essentially fill the void left by the shortcomings of the scientific method or limited resources. Many working professionals and academics would argue that this process, or cluster of methods, is based upon sound research and is the result of professional training. However, history paints a very different image. The tradecraft of handling and exploiting human sources has a long, rich history largely ignored by contemporary practitioners. What is practiced today was already well known in the 1800s. The exploitation of human sources goes well beyond the concept of asking questions during an interview or interrogation and includes the use of undercover operatives, informers, and social engineering. These concepts are still applied in the same fashion in the present, except where limited by the law.

A detailed examination of the scientific method coupled with historical tradecraft reveals a gap in the overall process of completing an investigation. In many cases, practitioners will refer to initiative reasoning or logical reasoning while citing their experiences in dealing with similar matters to fill this gap. Another common analogy used to explain this process or fill the gap is “connecting the dots.” However, no real explanation is given on how this process occurs. Connecting the dots is by far the most unexplained aspect of completing an investigation regarding criminal activity. The absence of explanation bring many questions into focus in regard to what a “criminal investigation” specifically is or is not. In reality, investigators have been historically left to their own devices in this area.

The author's experience as a law enforcement officer and criminal defense investigator suggests that the process of “connecting the dots” is relatively simplistic in its historical application and as the driving force of any investigation. Generally, information is initially collected during the early stages of the investigation. This process is normally conducted by the first responders to the alleged crime, typically patrol officers. In some cases, the initial response will be made by detectives, but this would be unusual. Following the initial collection of information, an investigation is initiated in a formalized process where a detective, also referred to as a criminal investigator, or a group of detectives assumes responsibility for investigating the alleged crime. “Leads” will be generated based upon a review of the initial information collected by the first responders of the alleged crime. The term “lead” is generic and refers to information utilized in the attempt to generate additional information. For example, during an interview with a witness, the witness states that two other people were present during the alleged crime. These two possible witnesses were previously unknown. As a result, this new information is considered a “lead,” and the two individuals would be interviewed, resolving the lead or generating additional leads based upon their statements. “Resolving” the lead refers to being unable to generate any additional information and is sometimes referred to as a “dead lead.” However, in the context of the term “lead,” any number of possible information sources could be targeted for additional information. The generation of leads could cause an investigator to examine a location, person, or any other information source. In theory, as many leads as possible are generated until no more additional leads can be generated. After completing this process, the investigation is closed through the arrest of an individual, or the case is considered “cold,” referring to the inability to generate any additional leads. Terms used to describe this process will vary depending on the local slang used by investigator. Moreover, law enforcement agencies will also use formalized terms specific to case closure and non-closure to describe the end results of an investigation. However, no matter the terminology used, the underpinning concepts are the same. This process, in traditional terms, is the concept of “connecting the dots” from the perspective of a criminal investigator. For clarity, this process is best termed “investigating through lead generation.”

The concepts presented in this book are not meant to challenge the process of investigating through lead generation but rather build upon this concept. Simply stated, this book focuses on “connecting the dots” from the perspective of a criminal defense investigator, although the same concepts presented in this book should be applied by criminal investigators. To fully understand the concepts presented throughout this book, a different definition of the term “investigation” is needed.
The initial description of “investigation” focused on the scientific method coupled with historical investigation tradecraft methods through lead generation. Simply stated, this overall investigative process is like attempting to see through muddy water. The process is abstract and lacks a clear conceptual framework.

In this book, “investigation” is defined through two clearly defined segments, which represent two codependent processes. The first segment is referred to as “collection.” This is the process of collecting information. Collection entails many traditional tradecraft methods used by criminal investigators and has traditionally been the primary focus of criminal investigations. The second segment is referred to as “analysis.” This term describes the task of processing, deconstructing, visualizing, and conducting diagnostic testing of information. To a limited degree, analysis entails the scientific method. However, the analytical methods presented in this book go beyond what is known as the scientific method by their ability to provide insight were the traditional scientific method fails. Traditionally, criminal investigations have held an overly simplistic focus of analysis at the initiative level. In this book, the coupled processes of “collection” and “analysis” are used to define the term “investigation.” Both processes must be present to consider an endeavor an investigation.