Criminal Defense Investigation: Theory, Practice, and Methods

Do you want a physical copy of this book? You can purchase a copy through Amazon.

Recommended citation:

Pennington, Jeremy. Criminal Defense Investigation: Theory, Practice, and Methods. Ironton: Pennington & Associates Ltd., 2016


Hypothesis Generation

A criminal defense investigator’s primary goal is to find evidence of innocence. The second goal is to test the credibility of incriminating evidence. Typically a straightforward approach is utilized while accomplishing these two goals. Simply stated, ideas are formulated on how evidence could be found to meet both goals. The formulation of the an “idea,” or hypothesis, is the key factor in this process. Most commonly used when applying the scientific method, hypotheses among criminal defense investigators are largely misunderstood and are underrepresented in a criminal defense investigator’s work product. Traditionally, utilizing a hypothesis has not been a mainstream practice of criminal defense investigators or criminal investigators. Instead, investigators largely rely on criminal theories. However, overly generic criminal theories provide little to any utility in reconstructing a historical event. In comparison, an array of hypotheses provide considerable utility during the search for evidence.

The use of hypotheses is commonly misunderstood among criminal defense investigators. Generally, generating and testing hypotheses is viewed as having no utility. This is mainly due to associations of hypotheses with the traditional scientific research. In simple terms, a hypothesis is developed, and an experiment is constructed to test the hypotheses. The testing stage may appear to have little application during criminal defense investigations. However, this is simply not the case. Can a criminal defense investigator formulate a hypothesis then test the hypothesis in the same manner as a scientist? In simple terms, no; this is not possible in the environment encountered by the criminal defense investigator. The criminal defense investigator is unable to construct a precise testing method to determine the validity of a hypothesis in the same way as a practitioner of the hard sciences can. What a criminal defense investigator can do is utilize an array of hypotheses as an instrument during the search for evidence. This is the same process used in the scientific method but breaks from the traditional need to use precise testing to prove or disprove a specific hypothesis.

Utilizing an Array of Hypotheses

Hypotheses are generated on a compounding scale. However, most, if not all, cannot be tested using the traditional application of the scientific method. Reconstructing and testing a historical event is nearly impossible. Only small aspects of the event can be tested with repeatable precision. For example, can a bullet travel along a given trajectory? This question can be answered by formulating a hypothesis and then testing the hypothesis through several known tests. Although the answering this question sheds some light on the historical event under investigation, it will not shed light on the other aspects of the event. Simply stated, many aspects of a historical event cannot be tested and proven in the traditional senses of science. Many would-be investigators attempt to utilize the traditional scientific method with a false senses of certainty. They take a limited view of the subject event based upon the only facet of the event that is testable. The focus should be more on hypnosis generation and less on traditional precision testing.

The endeavor of criminal defense investigators, or any individual attempting to reconstruct a historical event, has one overriding theme: every segment of information, no matter the form, testimony or physical, is evidence. Some evidence has absolutely nothing to do with the subject event. Other evidence has everything to do with the event. The key is distinguishing between relevant and irrelevant evidence.

A hypothesis is the only instrument available to define the utility of evidence. Relevance is the foundation of determining the utility of any evidence in reconstructing a historical event. However, the process of determining relevance is multifaceted and achieved through the use of not just one hypothesis, but an array of hypotheses examined concurrently. The relevance of evidence can only be determined by comparing hypotheses. Simply stated, under close examination, evidence can support more than one hypothesis. By examining an array of hypotheses, an investigator can understand how specific evidence supports or challenges those various hypotheses. As a result, the evidence's utility can be determined.

A hypothesis is an instrument of inquiry. How does a criminal defense investigator know where to find evidence? This is a pressing question throughout any investigation. The tendency, unfortunately, is largely to follow the already established criminal theory of law enforcement, which typically entails exploring only one hypothesis through lead generation. Questions are posed to explore whether the State's evidence really supports the alleged criminal conduct of the defendant. As a result, the criminal defense investigation is narrowed into a limited view of evidence and the identification of new evidence. When an array of hypotheses is utilized by the criminal defense investigator, the resulting search for new evidence is broadened. Simply stated, without the aid of a hypothesis, the possibility of evidence existing to support the subject hypothesis will not be explored. Thus, an array of hypotheses is utilized to force the criminal defense investigator to search for evidence that would be considered nonexistent in the shadow of a single hypothesis.

Hypotheses are the engine that generates the identification of evidence. What about the process of testing each hypothesis? This is the aspect of hypotheses that is typically misunderstood by criminal defense investigators. The search for and identification of evidence is the initial stage of testing a hypothesis. The testing of hypotheses is concluded by comparing of how each facet of evidence supports each hypothesis. In the criminal defense investigator's investigative environment, hypothesis testing is the process of identifying evidence in the shadow of each hypothesis and determining how each piece of evidence impacts all hypotheses. Specific structured analysis techniques are utilized in testing hypotheses. The key is not just accessing one hypothesis but rather an array of hypotheses.

Generating Hypothesis

A general discussion about hypothesis generation can be the abstract work of focus groups, brainstorming strategies, and other creative process at the individual and group level. From the perspective of a criminal defense investigator, specific core concepts need to be addressed that are normally not possible in discussions on the subject. Simply stated, alleged crimes have core themes that allow a focused approach to hypothesis generation.
Although every alleged crime is a unique event in history, the following core possibilities exist in every alleged criminal act:

  • The defendant committed the crime.
  • The defendant and another person(s) committed the crime.
  • An unknown person(s) committed the crime.
  • A known person(s) committed the crime.
  • A known person(s) and an unknown person(s) committed the crime.
  • The accused was not physically capable of committing the crime.
  • The accused did not have the necessary resources to commit the crime.
  • The accused was not mentally capable of committing the crime.
  • The alleged crime was an accident.
The alleged crime was a conspiracy of the alleged victim(s) or another person(s).
Although the above core possibilities are generalized, an array of hypotheses can be generated based upon these core possibilities. There is no one right why of generating a hypothesis. Essentially, the process is a matter of brainstorming ideas that are written as statements. However, the above core possibilities act as a springboard during this brainstorming process. Each core possibility can be utilized to generate an array of hypotheses. For example, the core possibility that “a known person committed the crime” can be utilized by making an explicit hypothesis about each known witness of the alleged crime. In simple terms, each witness is tested as a possible perpetrator of the crime. In turn, an array of hypotheses is generated based upon this core possibility. A similar approach is taken with each core possibility.

The key to hypothesis generation is to reach beyond the plausible. No matter how unlikely a specific hypothesis is, the hypotheses should still be considered. This is a critical concept in hypothesis generation. In general, if a hypothesis is not considered, there is no possibility of uncovering supporting evidence. As a result, the process of hypothesis generation should be a viewed completely as a theoretical exercise to prevent bias in the face of known information. If not, then information known to the criminal defense investigator can cause a group of hypotheses to be considered implausible without any attempt to validate them through investigation. Therefore, a complete array of hypotheses should be generated based upon all core possibilities.

While brainstorming possible hypotheses, each hypothesis should not be considered in isolation, but as part of a pair of competing hypothesis. The goal is to establish a balanced approach of testing hypotheses. For example, if the core possibility that “the accused was not physically capable of committing the crime” is being considered than for every hypothesis generated, a second, opposing hypothesis should be generated. The following is an example of polar opposite hypotheses:

  • The defendant is physically capable of committing the alleged crime.
  • The defendant is not physically capable of committing the alleged crime.
Generating hypotheses in pairs forces the criminal defense investigator to explore possibilities in a balanced and holistic approach. Simply stated, if a coin was being examined to check if it is counterfeit, would the examiner not look at both sides of the coin? If the examiner only examined one side, would not the examiner’s judgement be limited to a confidence level of only 50%? If, however, the examiner utilized both sides of the coin during the examination, would not a higher degree of confidence be possible than just 50%? This is a simplistic example, but it illustrates the problematic process of only considering one hypothesis versus considering that and an opposing hypothesis.
A core concern during hypothesis generation is the level of detail that is examined through the hypotheses. Simply stated, should a hypothesis be posed at the level of the person or at the level of the specific action? For example, John Doe killed Jane Doe (person level) or John Doe shot Jane Doe (action level). Answering this question of detail is always problematic and presents a degree of liability in committing an error in judgment. Thus, a systematic framework should be utilized to determine the level of detail required of each hypothesis.

Initially, when generating hypotheses, the detail level should be set at the person level. Every known person and the possibility of unknown persons should be included in the threshold of the hypothesis array. This is from the high-level diagnostic view of the alleged crime. The key is that any alleged crime is a holistic event. However, as information emerges during the investigation, a lower level of detail at the action level should be explored through an additional hypothesis array. This utilization of hypotheses at the action level should be applied to critical segments of evidence. For example, could a witness travel a known distance through an alleged means of travel? In examining this form of critical evidence, a pair of polar opposite hypotheses should be used to explore each possibility for the witness’s means of travel. Thus, the evidence's credibility and the overall interpretation will be determined.

Core evidence is a critical concept in examining the action level through a hypothesis array. The concept of core evidence is expressed in the Criminal Activity Equation:

Criminal Activity = Intent + Opportunity + Ability

Intent, opportunity, and ability can be represented in a wide array of evidence forms, from physical evidence to witness testimony; the possibilities are endless. Typically, this evidence will emerge as the core evidence that defines the alleged crime, for example, the timeframe during which the crime allegedly occurred, the weapon and method used during an alleged assault, or entry and exit into and from a building during a burglary. All of these examples are directly tied to the Criminal Activity Equation and in a real world investigation should be included within the hypothesis array at the action level.

Simply generating a hypothesis array is not adequate to meet the needs of a criminal defense investigation. The array must be developed and utilized through structured analysis to have any real actionable utility. This book present two methods for utilizing hypotheses, probable event analysis and the analysis of competing hypotheses.