Criminal Defense Investigation: Theory, Practice, and Methods

Do you want a physical copy of this book? You can purchase a copy through Amazon.

Recommended citation:

Pennington, Jeremy. Criminal Defense Investigation: Theory, Practice, and Methods. Ironton: Pennington & Associates Ltd., 2016


Network Analysis

Investigative data can be viewed from many varying angles. A beneficial one is how information within an event is connected. How do relationships between witnesses emerge? How are witnesses connected to places and durations of time? A criminal defense investigator is able to generate another perspective on this information through the use of network analysis, which allows unforeseen connections to emerge. These connections can provide critical insight into their impact on an event.

A network analysis is an organized approach to understanding the impact of information that defines an alleged crime. In practice, the process may be tedious at times, but it is simple in methodology. The utility of network analysis is found in the ability to understand the interdependency of information that is defined through connections between individuals, physical items, locations, and organizations. Two goals are achieved by constructing a network chart: the visualization of information from the perspective of a network and a critical understanding of how facets of information impact connected facets of information. Simply stated, a network analysis allows a criminal defense investigator to uncover the overall impact of the relationship between information that may be elusive when the same information is digested in a narrative format.

Constructing a Network Chart

The process of performing a network analysis is straightforward. Initially, a known point is used as the starting point, generally, the alleged crime scene. From this point, the network is built outward. For example, all known physical evidence is connected to the crime scene and and to individuals. The goal is to illustrate known connections between individuals, physical items, locations, records and organizations.

A network analysis is performed by visualizing a network through a chart. The critical element in generating this chart is utilizing quality information. Nodes are used to represent individuals, physical items, and records. Lines are used to designate connections between the nodes. Two forms of connections should be used: connections that have a high degree of certainty and suspected connections. Locations and organizations should be represented by organizing the nodes on the chart in clusters. The goal is to generate a visual representation of the overall network that existed within an event.
The following should be adhered to when constructing a network chart:

  • Confirmed connections should be labeled with a solid line
  • Suspected connections should be labeled with a broken line
  • The type of connection should be identified
  • Nodes of the network should be designated based upon their real life representation through a descriptive label
  • The overall network should be illustrated in a simple format
  • Nodes should be organized based upon their connection to other nodes
  • Locations and organizations should be represented by boxes that contain connected nodes

Utilizing a Network Chart

A network chart should represent all that is known of an alleged crime from a network perspective. As more information emerges on the alleged crime, the network chart should be continually updated. The chart can be used to understand known information and assess the possibility of elusive information. Beyond gaining an understanding of the networked information, assessing the chart for unknown information is considerably useful. Once the network chart has been generated, anticipated and possible connections should be considered. If these connections are not illustrated on the chart, they could represent a gap in information, which would require continued collection efforts. Anticipated and possible connections on a chart will vary from alleged crime to alleged crime. This variation requires the criminal defense investigator to utilize experience and knowledge of the local area where the crime allegedly occurred in their assessment. Generally, the absence of a connection between any nodes should always be considered on the basis of whether a connection should exist and why the connection is not present.

The following are general areas of consideration when completing an assessment of anticipated and possible connections:

  • Unknown connection between individuals
  • Unknown connection between individuals and a location
  • Unknown connection between individuals and physical evidence
  • Unknown connection between individuals and organizations
  • Unknown connection between individuals and records
  • Unknown connection between physical evidence and a location

Network Analysis Computer Software

The availability of computer software has only increased the tendency to make an otherwise simple process in to a complex one; it causes more confusion than actionable utility. Although computer software exists to generate a network visualization, the author recommends avoiding these forms of software, except in limited applications. Pen and paper typically produce the best results, followed by the use of some form of graphical illustration software to generate a clean visual representation of the network. The detailed knowledge acquired through the tedious assembly of a network cannot be gained through the use of computer software.

Network Analysis Reporting

The network chart is a powerful communication tool. The network chart should be provided to the attorney. In some complex cases, several network charts may be utilized. The use of several charts is typical in cases where specific subnetworks need to be highlighted. In any case, the attorney should only be given the final network chart to prevent any information errors due to the chart's evolution throughout the criminal defense investigation.