Criminal Defense Investigation: Theory, Practice, and Methods

Do you want a physical copy of this book? You can purchase a copy through Amazon.

Recommended citation:

Pennington, Jeremy. Criminal Defense Investigation: Theory, Practice, and Methods. Ironton: Pennington & Associates Ltd., 2016


Information Quality Check

When new information is received during an investigation, an information quality check should be completed. The instinctive practice of the criminal defense investigator should ensure that this structured analysis technique is applied to all information. This method should be built into the criminal defense investigator’s entire collection and analysis process. In general, an information quality check ensures a degree of certainty in regard to the quality and credibility of information. This method is not complex, but it is meant to be used as a reoccurring theme during an investigation. A criminal defense investigator will spend a large portion of their investigative career completing information quality checks.

The Concept of an Information Quality Check

An information quality check is applied by testing the credibility of information. This process, in simple terms, is a matter of fact checking. At times, this fact check requires specialized knowledge and training. The information tested can range from complex scientific information to a simple address. This process’s main focuses is on credibility, but it will also lead to the identification of new collection needs that may produce additional information.

In the range of information commonly confronted by a criminal defense investigator, this method is not normally overly complex. During a typical analysis project, the criminal defense investigator will be confronted by witness testimony, law-enforcement reporting, and investigative methodologies employed by law enforcement. This information must be rigorously tested for credibility as a matter of practice. For example, all witness statements should be tested for credibility in terms of the testimony content. This can range from environmental conditions to the witness’s physical capabilities. The key factor of an information quality check is the method employed. In simple terms, when the criminal defense investigator is confronted with new information, the method is utilized. When old information is challenged, the method is utilized once again in light of the investigator's maturing understanding of the information, based on the new information. Thus, an information quality check is repeatedly employed.

The typical information encountered by a criminal defense investigator that requires an information quality check includes the following:

  • Law enforcement reporting
  • Law enforcement procedures and policies
  • Search warrants
  • Forensic testing
  • Witness testimonies
  • Investigative methodologies
The above list is not exhaustive but rather a general guideline. Basic information, for example, an address, should always be verified for accuracy. The goal is to achieve a high degree of certainty regarding the information utilized during an investigation.

Each of the above forms of information require specialized knowledge. The process of testing search warrant affidavits through an information quality check differs from the process used when assessing law enforcement procedures. There is no standard way of applying an information quality check. The process will vary depending on the information. However, the overall goal is to confirm whether the information is correct and credible.

Law Enforcement Reporting

Considering the environment the criminal defense investigator operates within, law enforcement reporting is of special interest. This specific information should be the first information placed under an information quality check. Law enforcement reporting varies from agency to agency. However, generally, all law enforcement reporting is presented in a narrative format. Otherwise, individual identifying information is typically presented in a form-based report. This report will include specific information, such as the location of the alleged crime and other data that is used by the law enforcement agency for management purposes.

The narrative of law enforcement reporting is of special consideration for the criminal defense investigator. This narrative will describe the reporting officer’s observations and actions. The narrative will include how the reporting officer arrived at the alleged scene, their initial observations, statements made to the reporting officer by witnesses and suspects, the reporting officer's investigative actions, and the final result of the reporting officer’s actions. In most cases, this narrative represents a wealth of information for the criminal defense investigator.

Placing law enforcement reporting under an information quality check will vary depending on the alleged crime. However, the main focus should be on descriptions of locations, physical items, and individual testimony included in the reporting. Law enforcement officers are trained to provide detailed descriptive narratives of their observations and investigative efforts. These descriptive narratives include times, dates, and descriptions in regard to the size, location, and appearance of physical objects and individuals. In many cases, the reporting law enforcement officer will fail to provide an accurate description, or their own bias will be apparent in their reporting.

All dates, times, measurements, and physical descriptions should be compared to other available sources. These sources include reporting from non-law enforcement agencies, law enforcement administrative documentation (dispatch logs, time cards, and other forms of administrative documentation not maintained in the case file), photographs, video footage, and information collected by the criminal defense investigator. The goal is to confirm the information presented in law enforcement reporting through an independent source. Ideally, several independent sources should be examined to the extent of available sources.
Checking the quality of law enforcement reporting provides two results. First, the criminal defense investigator is able to confirm the accuracy of the information. Second, the falsehoods and inaccurate information uncovered through the information quality check can be used by the defense attorney to impeach the reporting law enforcement officer during trial. All falsehoods and inaccurate information should be clearly communicated to the responsible attorney in a written report. Generally, the best practice is to write a report on each specific issue by clearly stating the falsehoods or inaccurate information presented in the law enforcement reporting and then clearly stating the correct information, as well as how the correct information was uncovered and its source.

Law Enforcement Procedures and Policies

All policies and procedures used by the investigating law enforcement agency should be examined in detail. This is approached much like law enforcement reporting. Law enforcement agencies can to a large degree develop their own policies and procedures as they see fit. However, their policies and procedures must be based upon acceptable practices. There are known and accepted ways of performing an investigation, and then there are unacceptable ways.

Typically, contemporary law enforcement policies and procedures are based upon a template provided by a recognized authority. Sometimes this recognized authority is the State's top-tier law enforcement agency, for example, a state police agency. On the other hand, the template may have been provided by an independent agency involved in policy development, for example, the International Association of Chiefs of Police (IACP). In the worst case scenario, the law enforcement agency develops its own policies and procedures. However, this is less common in contemporary society, considering the overwhelming number of resources available from independent, supporting agencies.

Reviews of most policies and procedures used by law enforcement agencies include minimal detail, unless the policy and procedure deals with a critical issue such as the use of force. Policies and procedures can be placed in one of two categories: first, those dealing with administrative issues such as officer appearance and conduct and, second, those dealing with operational issues such the processing of crime scenes. Operational policies tend to be shorter in detail compared to administrative policies and procedures. This is especially true on the issue of how a criminal investigation is conducted.
All policies and procedures applicable to the alleged crime should be examined and compared to the investigating officer's conduct. Did the investigating officer adhere the agency's policies and procedures? In the author's experience, making these comparisons is typically frustrating due the lack of detail in agencies’ policies and procedures. On the other hand, when strict procedures govern the actions of the investigating officer, errors on the part of that officer can be fruitful for the defense. For example, an agency's chain of custody policy is an area where errors can sometimes be found; these are directly tied to the assessment of the evidence's credibility. Typically, law enforcement agencies circumvent officer errors by utilizing simple policies and procedures in their criminal investigations. However, strict adherence to the overly simple policies and procedures does not validate an officer’s investigative conduct. The officer's actions still must be acceptable in comparison to known and recognized standards.

Fortunately, law enforcement agencies have recognized standards developed by the highest authority on the subject of law enforcement, the U.S. Government. Typically, these are the most detailed standards in the areas of evidence handling, forensic practices, and crime scene processing. To adequately assess the quality of an investigative officers actions, the criminal defense investigator should be adequately familiar with these standards. For example, the publication titled Crimes Scene Investigation: A Guide for Law Enforcement is an excellent source to gauge the results of a crime scene investigation completed by law enforcement. The publication is in its third edition as of the writing of this book. In the first edition, an interesting perspective on the publication’s background is presented.

NIJ was asked by Attorney General Janet Reno in 1995 to study cases in which convicted sex offenders were later exonerated by DNA testing. This study resulted in the 1996 publication, Convicted by Juries, Exonerated by Science: Case Studies in the Use of DNA Evidence to Establish Innocence After Trial. After being briefed on this publication, Attorney General Reno asked NIJ to develop a consistent approach to the processing of crime scenes. As a result, NIJ initiated the Technical Working Group on Crime Scene Investigation to develop recommended practices for crime scene management.

NIJ was asked by Attorney General Janet Reno in 1995 to study cases in which convicted sex offenders were later exonerated by DNA testing. This study resulted in the 1996 publication, Convicted by Juries, Exonerated by Science: Case Studies in the Use of DNA Evidence to Establish Innocence After Trial. After being briefed on this publication, Attorney General Reno asked NIJ to develop a consistent approach to the processing of crime scenes. As a result, NIJ initiated the Technical Working Group on Crime Scene Investigation to develop recommended practices for crime scene management.

The above quote alone should cause the criminal defense investigator to closely examine the policies and procedures utilized by law enforcement agencies. Many U.S. Government documents exist that can be used to fully assess the procedures and methods utilized by an investigating officer. However, the criminal defense investigator should not limit their examination to publications by the U.S. Government. There are many active researchers in the area of criminal investigative practices from an array of disciplines. Criminal defense investigators should stay abreast of emerging research that has undergone peer review. In many cases, this research can be beneficial and at times, it can become more valuable than any governmental publication.

Checking the quality of the policies and procedures utilized by an investigating officer allows the criminal defense investigator to determine if the investigative methods used were acceptable. Any conflict should be clearly reported in writing to the defense attorney. This report should include a description of the conflict based upon the specific action, a clear source for the evidence of this action, and supporting documentation of the conflict; this information should be made available to the attorney in a digestible form.

Search Warrants

Search warrants are a common instrument utilized by law enforcement to uncover evidence. The process of obtaining a search warrant is based upon submitting a written application to a judicial official. This application or affidavit is a potential weak point in the process and should be carefully reviewed by the criminal defense investigator.
There is no standard way of preparing a written application for a search warrant. The style of the document will vary from investigator to investigator. The key element of this document is the content communicated to the judicial official and the requested limits of the search. For one, the document should adequately describe the location to be searched. At times, errors are made in this description. Second, the application should describe the limits of the search warrant, which refer to how the search will take place and what evidence will be searched for and seized. Once a search warrant application is approved, the investigating officer is limited to the scope of the original request, unless an additional search warrant is obtained. In some cases, these limits will be violated during the search.

During the criminal defense investigator's review of the search warrant affidavit, careful attention must be given the to the location authorized for the search and the limits of the search and seizure. Any actions that differed from the scope of the search warrant affidavit should be focused upon and clearly reported to the defense attorney in writing. This report should include information from the search warrant affidavit that is in conflict with the actions of the investigating officer, which should be well documented and sourced.

Forensic Testing

Forensic testing is becoming more common in criminal investigations and is a complex topic that is constantly evolving due to widespread academic research interests in this area. Many criminal investigations will not utilize any form of forensic testing. Typically, more common crimes such as burglary, assault, and petty crimes will not be investigated through forensic testing. On the other hand, major crimes such as murder and rape will more commonly include some form of forensic testing. The criminal defense investigator needs to have a working knowledge of forensic testing that of a normal criminal investigator.

From a criminal defense investigator’s perspective, forensic testing should be viewed from two different perspectives:the process utilized to collect and preserve the physical evidence and the process utilized to test or examine the physical evidence. These two perspectives together should form the foundation of the criminal defense investigator's review of any forensic testing.

The collection and preservation should be closely examined. A considerable amount of material is available as the basis for this examination. The first material considered should be any literature available from the lab providing the testing service. Typically, the lab will have some form of literature on the collection and preservation of a specific type of evidence. For example, the FBI laboratory publishes an in-depth publication on the collection, preservation, and submission of evidence, titled Handbook of Forensic Services. Second, academic, peer-reviewed articles should be considered, especially in the case of emerging forensic tests.

Apart from collection and preservation, the specific forensic testing technique should be examined. This review can be complex and to a large degree requires a specialized education. Ideally, an expert in the specific testing method would be utilized to complete the review, but this type of resource will only be available in limited cases. The criminal defense investigator can make a limited review of the forensic testing. For one, is the lab involved in the testing credible? Many criminal labs have been found to be less than credible in the past, and the specific lab may have a current controversy that challenges the lab's credibility. Does the forensic scientist have the necessary credentials to complete the testing? All credentials should be verified to the fullest existent possible. Are the testing results accurately applied in the context of the investigation? In simple terms, is the forensic testing being misrepresented in regard to application and interpretation? Some forensic testing proves a fact but has no real utility, for example, biological testing to determine the presence of blood on a murder victim. Does this form of testing really have any utility in proving guilt or innocence? Many times, forensic testing does nothing but muddy the water due to an overzealous investigating officer who fails to understand the application and interpretation of the specific test. Reviewing forensic testing can be a complex endeavor. Fortunately, a criminal defense investigator will observe a group of recurring forensic tests during their career. Acceptable practices, the application and interpretation, and available peer review academic articles regarding this core group of forensic testing should be highly familiar to the criminal defense investigator.

Forensic testing encompasses an array of scientific and technical disciplines. Today, forensic testing includes various areas, from hard science applications to the examination of digital electronic applications and related networks. New testing techniques are always emerging and appearing in criminal investigations. The criminal defense investigator should always be aware of these emerging applications in forensic testing. Unfortunately, some so-called forensic techniques are nothing more than junk science. This is a critical subject and one that can have destructive results on the foundations of criminal justice. Over time, these techniques are identified and debunked in court. However, this is only done through the handwork of legal and other professionals. The practicing criminal defense investigator should be well read on emerging techniques and those being challenged in court.

Any identified conflict with the forensic testing should be clearly communicated to the defense attorney in writing. Both a written report and any available supporting source material should be prepared for the defense attorney on each specific issue. Not only does the criminal defense investigator need to understand forensic testing issues, the defense attorney must also understand these issues in detail. The importance of delivering high quality source material on identified issues cannot be overstated.

Witness Testimony

Handling and assessing witness testimony is a key theme during any criminal defense investigation. In some cases, the handling of witnesses is the primary focus of a criminal defense investigator during limited investigations. In large complex investigations, the handling and assessing of witness testimony can consume a considerable amount of time and resources. As a result, the ability of a criminal defense investigator to determine the quality of a specific witness's testimony is a critical skill.

Witnesses emerge in a wide array of forms. Everyone other than the defendant is a possible witness, and for someone to be a witness they must have some form of knowledge specifically related to the alleged crime. Both factors must be in place for someone to be a viable witness. Why is the defendant not viewed as a witness? In simple terms, the court is unable to compel the defendant to provide testimony, but anyone else can be forced to testify.

Witness testimony should be assessed for quality on three fronts: first, the content of the witness's testimony, second, the witness's ability to have acquired adequate knowledge to provide their testimony, which is one of the most commonly overlooked issues, and lastly, the witness's possible bias should be considered. How are they socially connected to other witnesses? These three aspects are used to measure the quality of a specific witness's testimony, which equals their credibility as a witness.

The content of witness’s testimony is another critical aspect. In simple terms, this content is what makes them a witness. Unfortunately, in most cases, a group of witnesses will not give consistent testimonies. There is almost always a variation from witness to witness. This should be expected. The key factor to remember is that a witness makes observations independently from their peers. For example, one witness's vision may be obstructed and limited compared to that of another witness. Two witnesses may have viewed the same incident from different timelines. In turn, these witnesses will provide testimony that differs. The key to assessing these two testimonies is based on what they should be able to testify to compared to what they may be interpreting from their observations. This single distinction is why it is paramount to interview all witnesses, even when law enforcement has already documented testimony separating a witness's true observations from their interpretation of events. Moreover, each witness should be assessed regarding how their testimony has changed from when they were first interviewed by law enforcement to the interview completed by the criminal defense investigator. In the end, the investigator should understand the comparisons between specific witness's testimony and that of their peers, as well as the true limitations of that testimony.
Witnesses can provide testimony based upon five senses: ophthalmoception (sight), audioception (hearing), gustaoception (taste), olfacoception (smell), and tactioception (touch). Moreover, a witness is able to perceive their environment through other forms of stimuli such as temperature, kinesthetics, pain, balance, and vibration. Typically, a witness will provide testimony based upon more than one sense. Most commonly, a criminal defense investigator will encounter witnesses whose testimonies are based upon sight and hearing. The most common form of witness testimony is based upon sight, referred to as “eyewitness testimony,” with segments of testimony based upon their hearing.
The most common issue confronted by criminal defense investigators in relation to eyewitnesses is the witness's ability to have observed a specific event. This is also the most commonly overlooked issue when examining eyewitness testimony. At first glance, this seems to be an issue that does not require scrutiny. However, in many cases, eyewitness accounts are substandard due to the limited ability of human vision within a specific environment. A classic example is an observation made by a key witness in low-light conditions. Thus, an eyewitness's testimony should be examined in detail in relation to the environment where the observations occurred.

Like that of an eyewitness, all forms of testimony based upon human sensory abilities should be closely examined. For each sense, the witness's ability to have adequately gained the knowledge underpinning their testimony should be questioned. All forms of human sensory ability are unique, requiring specialized knowledge to access them and prove if the witness's testimony is in fact misleading. The criminal defense investigator should be well educated on the most common aspects of human senses and how to generate evidence to prove or disprove a witness's testimony. In general, the proving or disproving of a witness's ability to have observed a specific event is gained through scientific testing. For example, when testing an eyewitness's ability have observed an event in low-light conditions, a vision study is utilized; this is a technique used by forensic photographers. Testing the witness's ability to have observed the event is a matter of witness credibility. Unfortunately, many times this approach is overlooked by criminal defense investigators.

Bias is an all-too-common reality in witness testimony. A criminal defense investigator must be sensitive to the possibility of a witness holding some level of bias. This is especially true in cases of more serious criminal allegations such as murder or crimes of a sexual nature. At times, a witness's biases will be overtly apparent, and the witness may even admit to their bias. How a witness describes people and places is typically a good indicator of possible basis, for example, a witness's description of another race or religion or use of slang terms to describe an area, like “ghetto” or “slum.” On the other hand, a witness’s biases may not be readily apparent. Social connections between witnesses and the defendant can play a dangerous role in witness testimony. A witness may have intentions or preconceived views based upon these social connections. A witness's family, friends, and professional connections can impact their testimony to the extant of withholding or providing misleading information. This may be rooted in good intentions, malicious intent, or in some form of perceived defense of their self or another party. Moreover, a witness may present an unknown bias in the form of a pre-conceived view of the defendant or based upon a prior negative event with the defendant. A witness may use their testimony as an opportunity for retribution. The criminal defense investigator should always be open to possibility of bias and its impact on witness testimony.
Any factor impacting the quality of a witness's testimony should be clearly reported to the defense attorney in writing. The report should clearly describe the specific issue impacting the witness's testimony and related known supporting evidence. In many cases, a Criminal defense investigator will need to uncover additional evidence to support these claims.

Investigative Methodology

A criminal defense investigator is not just an investigator utilized by an attorney but also an advisor on criminal investigation. This is the core knowledge applied by a criminal defense investigator. After considering all forms of information relayed in writing, media, or verbal communication, the next key area to apply an information quality check is on the criminal investigation completed by law enforcement. In simple terms, the original law enforcement investigation process is considered standalone information to be reviewed and examined by the criminal defense investigator. This form of information quality check can be captured in two questions: What occurred during the law enforcement investigation of the alleged crime? What did not occur during the investigation? By comparing the answers to these two questions using an in-depth knowledge of criminal investigation, a criminal defense investigator is applying an information quality check.
This form of information quality check requires an in-depth understanding of criminal investigation. This cannot be overstated. The criminal defense investigator must not only understand the process of criminal investigation but also have in-depth applied knowledge. Without this, the information quality check will be nothing more than a failed endeavor highlighted by self-assurance born out of ignorance.

The first step in examining a completed criminal investigation is attempting to understand, to the furthest degree possible, why each investigative action was taken or not taken. This allows the criminal defense investigator to understand why certain witnesses were interviewed, certain evidence was collected, and other investigative tasks were conducted. This is not only a matter of applying an information quality check but is also intended to uncover the State's criminal theory. The incompetence or inexperience of law enforcement investigators can limit the effectiveness of this endeavor, making law enforcement investigative efforts appear abstract or illogical. At a minimum, all law enforcement investigative actions should be uncovered and documented.

After understanding, or at least determining the full extent of, law enforcement investigative efforts, the investigation as a whole should be assessed for possible failures and errors. This is a matter of judging the credibility of the law enforcement investigation. The criminal defense investigator must apply learned knowledge of criminal investigation to achieve this goal. Were there witnesses that were not interviewed and should have been? Is documentation missing that should be available for review? Did law enforcement investigators fail to collect physical evidence or even fail to attempt collection? Has appropriate forensic testing not been completed on the physical evidence? Has critical information been ignored? These types of questions will vary depending on the circumstances and type of the alleged crime. Thus, the criminal defense investigator must be knowledgeable about the criminal investigation methods used in the specific alleged crime.

Any failures or errors uncovered in the law enforcement investigation should be clearly reported to the defense attorney in writing. The law enforcement investigator acting in error, or failing to act, must be supported with law enforcement training documentation, authoritative literature, or the qualified expert testimony of the criminal defense investigator.