Criminal Defense Investigation: Theory, Practice, and Methods

Do you want a physical copy of this book? You can purchase a copy through Amazon.

Recommended citation:

Pennington, Jeremy. Criminal Defense Investigation: Theory, Practice, and Methods. Ironton: Pennington & Associates Ltd., 2016


The Criminal Defense Investigation Cycle and Framework

The intertwined process of collection and analysis is dynamic. Traditional criminal investigation practices have been ill defined in academic literature and by criminal investigators. The subparts of the overall criminal investigation have been documented, from suspect interrogations to forensic practices. However, the overall process has been traditionally left to the practitioner’s personal work habits, or at times, overly biased perceptions of reality. The overall investigative process is of key importance for the criminal investigator and the criminal defense investigator, in particular.

This book breaks from the traditional approach of presenting an undefined investigative process and adopts what is referred to as the analysis cycle, or specifically the Criminal Defense Investigative Cycle. In simple terms, the analysis cycle is the overall process that produces quality information for the consumption of the responsible criminal defense attorney. The purpose of the cycle is to assess and re-assess information in a loop over the lifespan of the investigation. In daily life, processes from business to personal tasks are linear in nature. A defined starting point exists with a defined conclusion. However, the Criminal Defense Investigative Cycle presented in this book is a closed loop with no predefined start or conclusion. In theory, the investigative process could progress into infinity without any real tangible conclusion and in some cases this will become reality.
In Uncovering Reasonable Doubt: The Component Method, Brandon Perron, a criminal defense investigator, presented a methodology for members of his profession. This five-step process is essentially a high-level linear approach to completing criminal defense investigations:

  • Investigative Review of the discovery file, police reports; victim/witness statements, crime scene examinations, lab reports, etc.
  • Initial defendant interview
  • Crime scene examination, diagram, and photography
  • Victim/witness background investigation
  • Reporting of investigation and testifying
Academically, the above five-step process includes well-defined high-level tasks. Perron’s Component Method presents as a digestible and understandable process for a criminal defense investigator to utilize. The process does have undeniable utility and without doubt each “component” is a benchmark every criminal defense investigator must meet in professional practice. On the other hand, to a large degree, this methodology is presented as linear and is easily disrupted by outside demands and real world events and shifts: witnesses avoid interviews, crime scene access is withheld, or the scene has been distorted by events following the original incident. A criminal defense investigator is not only faced with field operational issues but also with the tactics utilized by opposing attorneys. The reality is that discovery materials arrive late and at times are withheld into the lifespan of an investigation. These two factors coupled will disrupt any linear investigation more times than not. Without a considerable amount of experience and skill, any criminal defense investigator can become misguided. In turn, a flexible robust framework is required.

Intelligence practitioners utilize a process that is referred to as the “intelligence cycle.” This cycle is a high-level closed-loop process. In simple terms, information is collected and processed, intelligence is produced and communicated to the consumer, and new needs are communicated followed by the process looping over and over. Figure 7.1 represents the intelligence cycle.

A criminal defense investigator works in an environment that is different to some extent than that in which intelligence practitioners operate. Both practitioners face issues ranging from collection, accessing needs, and the processing of information. However, criminal defense investigators differ from intelligence practitioners in their provision of information to a different consumer.

Intelligence practitioners must provide and communicate information, known as intelligence, to a wide array of individuals across all levels of a governmental structure. These individuals range from low-level operational personal to the highest level of decision making authority. These individuals are considered “consumers.” Consumers utilize the communicated intelligence to make decisions at their level of authority. As a result, the intelligence is utilized based upon the consumer’s authority level.

The consumer receives information labeled as “intelligence.” This is an important distinction. “Intelligence” is distinct from raw information. In short, raw information from collection efforts is driven through the intelligence cycle. Specifically, the raw information must undergo analysis by an intelligence analyst before it is labeled as “intelligence.” This distinction drives the reporting a consumer receives. Depending on the consumer’s level of authority, little to no background is provided in the form of raw information. The reporting, considered an intelligence product, will often simply be the intelligence analyst’s assessment of the specific information. Information provided by a criminal defense investigator to a consumer, the responsible attorney, differs greatly from these intelligence products.

A criminal defense investigator’s reporting is much broader and has to meet a wider demand. In one respect, the practitioner has to communicate an expert opinion in the same way as an intelligence analyst does. However, the criminal defense investigator must also meet the demands of the criminal defense attorney, which differ greatly from those of a typical government decision maker.

Attorneys are unique consumers. All raw information must be accessible to the criminal defense attorney in the greatest detail. For example, reporting on a witness interview must have detailed information on the witness testimony. Essentially, the attorney must obtain a detailed understanding of the interview, which typically is only gained from being involved in the interview directly. This level of detail and accuracy must be consistent across all reporting produced by the criminal defense investigator.
Beyond the raw details of investigative operations, the criminal defense investigator must also communicate an expert opinion. This expert opinion is objective logical reasoning gained through investigative methodologies and the application of structured analysis. In short, the criminal defense investigator’s expert opinion is the final result of the analysis cycle.
The responsible attorney essentially represents a second analytical layer but presents a different perspective. The criminal defense investigator’s domain is objective logical reasoning. This perspective is grounded in the objective assessment of evidence leading to a logical conclusion. On the other hand, the attorney’s perspective is grounded in the interpretation of law and skilled arguments in relation to presented evidence. In simple terms, the criminal defense investigator is responsible for producing an objective investigative product, and the attorney is responsible for exploiting the investigative product. The work process shared by the criminal defense investigator and criminal defense attorney drives the analysis cycle.

The Criminal Defense Investigation Cycle

Much like the intelligence cycle used by intelligence practitioners, a criminal defense investigator can apply a specific intelligence cycle to a criminal defense investigation. This is referred to as the Criminal Defense Investigation Cycle. This process is specific to the information and issues encountered by criminal defense investigators. Using a specific structured cycle during an investigation holds many benefits. This process gives the investigation articulable structure, clarity, and, most importantly, actionable utility.

The term “actionable utility” refers to a functional use—utility—and information that can be acted upon—which is actionable. This is two-part concept. A method or concept may have utility but lack any actionable results. For example, a criminal defense investigator may have access to aerial imagery of an alleged crime scene covering two square miles. In theory, this imagery would hold considerable utility. However, when visiting the location and making a physical assessment of the area, the Investigator is faced with the fact that this location has been completely changed by urban development, which occurred after the alleged incident. As a result, the aerial imagery may seem to have utility, considering the many possible uses for the data it includes. However, the imagery presents no actionable utility because the interim changes in the landscape mean that the data cannot be confirmed or acted upon in the present.

The Criminal Defense Investigation Cycle is meant to act as a framework. A criminal defense investigator works in an extremely abstract environment. In many cases, this environment is not easily understood by the criminal defense investigator. Defining investigative goals, collection needs, and analysis needs present varying challenges from case to case. However, the theoretical lens used by a criminal defense investigator to view and access the investigative landscape should be founded in the Criminal Defense Investigative Cycle, which consists of the following five-step process:

  • Defining the issue
  • Collection
  • Model construction
  • All source analysis
  • Diagnostic analysis
  • Retracing
The Criminal Defense Investigation Cycle is a closed-loop process with a redundant feedback loop. Figure 7.2 illustrates this cycle. In theory, there is no predefined starting point in the Criminal Defense Investigation Cycle. However, in practice, this process will more than likely start at the stage of receiving information, which is typically at the point when the criminal defense investigator's services are retained by an attorney and the issue of the investigation is defined. Initially the criminal defense investigator will receive information from the attorney in the form of a discovery file. This may include a limited amount of information initially and then grow in volume as the discovery process unfolds between the defense attorney and the State. Nevertheless, this information is almost always the starting point of a criminal defense investigation.

Understanding the overall process of the Criminal Defense Investigation Cycle is important and required for successful completion. Arguably, this process could be depicted as linear with a defined starting and ending point. However, a linear approach would create information processing errors. This type of error is due to unrecognized or unavailable information at varying points throughout the life the investigation. Thus, a “looping action” is used to process and then reprocess information as new information emerges and needs change within the investigation.

Defining the issues is the first step initiated by the criminal defense investigator and is a task repeated throughout the lifespan of an investigation. This stage of the Criminal Defense Investigation Cycle is by far the most difficult and, if not properly implemented, can cause catastrophic failure. In simple terms, this stage is the process of defining the issue faced by the criminal defense investigator. For example, what specific investigative issues exist within the alleged crime? At a strategic level, the issue is the criminal allegation lodged against the defendant. However, defining the issue is much more complex, and a simplistic approach is neither desirable nor productive. In reality, the criminal defense investigator is faced with defining not one issue, but an array of issues. Issue definition is the foundation of the Criminal Defense Investigation Cycle.

Collection is the typical task envisioned by most consumers of information who retain the services of a criminal defense investigator. However, this is only one facet of the criminal defense investigator's overall work product. Collection operations entail a wide array of tasks. Interviewing witnesses, documenting a scene, and collecting physical evidence falls into this category. Unfortunately, collection has become the main focus of the State's criminal investigators and the opposing criminal defense investigators. Typically, a collection operation is the initial stage of a criminal investigation or criminal defense investigation and is followed by a sparing level of analysis, which is slanted more towards legal analysis than any real analysis of the alleged crime. In terms of the Criminal Defense Investigative Cycle, collection is the second stage of the overall loop and feedback cycle.

During the onset of a criminal defense investigation, the first collection operation will be receiving the discovery file from the responsible attorney. This form of collection will reoccur in large complex defense cases as the case matures overtime. Secondly, collection operations will occur as investigative needs are identified. The process of interviewing witnesses, collecting physical evidence, documenting alleged crime scenes, and many other collection tasks that will emerge as a need throughout the lifespan of the case. This information, in all cases of criminal defense, fall into the categories of temporal, geospatial, topical, and network data. The key principle in discriminating between a collection task and an analytical task is that collection is the process of collecting or receiving information from a person, location, or some form of digital repository. You simply obtain the information. The interpretation of the information is generated through analysis. Following a collection operation, the new information is organized across a model.

Model construction is another foundation point in the Criminal Defense Investigation Cycle and is the cycle’s third stage. In general, after receiving the initial information (discovery file) and all information generated through filed collection operations, the information is assessed through the General Criminal Defense Investigative Model. The model is used to give the information structure and actionable utility. Using the model, the criminal defense investigator is able to identify gaps that exist within the information. The initial information will provide real data structure to the General Criminal Defense Investigative Model. However, there will still be a considerable amount of absent model structure after accessing the initial information received at the onset of the case. The areas of absent structure within the General Criminal Defense Investigative Model are information gaps and require collection operations to eliminate them. As the loop and feedback cycle occurs, these information gaps will be reduced in size and frequency through repeated collection operations. Over the lifespan of the investigation, the model's information needs should be completely fulfilled, unless uncontrollable circumstances exist.

The construction of the General Criminal Defense Investigative Model is not a collection operation or a task rooted in analysis. However, there is considerable overlap in the practice of collection and analysis. A model is the breaking point between collection and analysis. New information is generated and organized across the structure of the model and then exploited through analysis. For example, if a phonebook consisted of a list of random telephone numbers without any form of organization, it would present no real utility and would be nothing more than a box of paper with random numbers on each page. In simple terms, a model represents information obtained through collection operations in an organized structure that enables analysis. The model's validity is measured by the quality of information catalogued within the model.

All source analysis is the accumulation and combining of the information described above through collection and modeling. In general, following the collection operation, the General Criminal Defense Investigative Model should be a coherent dataset, which represents a prior event in history, the alleged crime. The model is then exploited through structured analysis. The combination of these analytical techniques represents the all source analysis, which is specific to the criminal defense investigator's work product.

Diagnostic analysis is the true exploitation of the General Criminal Defense Investigative Model coupled with all source analysis. If the Criminal Defense Investigation Cycle was a linear process, diagnostic analysis would be the final step. However, this is not the case. The Criminal Defense Investigation Cycle is meant to exploit information to the furthest degree possible. As a result, the work product produced during all source analysis is further refined through diagnostic analysis methodologies. In simple terms, this stage in the Criminal Defense Investigation Cycle is where the General Criminal Defense Investigative Model's structure is tested using an array of hypotheses. One structured analysis method is known as the “analysis of competing hypotheses.”

The diagnostic analysis step of the Criminal Defense Investigation Cycle represents a critical stage in the lifecycle of any criminal defense investigation. However, this stage should be experienced more than once in any investigation. Three critical goals are met through diagnostic analysis: diagnostic testing of the State's criminal theory, generation of alternate defense theories, and the identification of additional collection needs. As a result, the criminal defense investigation is able to gain a robust focus by absolutely refuting the State's criminal theory, identifying weaknesses in the State's criminal theory, and providing alternate criminal theories, which can be exploited by the criminal defense investigator through further investigation and analysis. Moreover, the responsible defense attorney is able to exploit this same information in court.

Following the completion of diagnostic analysis two events will occur. In most cases, diagnostic analysis will identify a need for further collection. This collection may be driven by the generation of alternate criminal theories or identified information gaps, which have hindered diagnostic analysis. Second, it is very likely that the State will submit additional information, which is intended to be used at trial by the State. In either case, the criminal defense investigator is faced with new information to collect and assess. As a result, the Criminal Defense Investigation Cycle starts over once again. This is known as the feedback loop or retrace. Any time new information is received or the need for collection is identified, the Criminal Defense Investigation Cycle is restarted. Regardless of the reason for new collection and analysis, the process is initiated at the issue defining stage. In practice, the Criminal Defense Investigation Cycle will be a repeating process of receiving or uncovering new information, adding the information to the General Criminal Defense Investigative Model, generating all source analysis, and completing a diagnostic analysis.

As an academic exercise, the Criminal Defense Investigative Cycle is a straightforward process of repeating stages as new information emerges. In practice, the application of the cycle is less than ideal and can be chaotic at times. A criminal defense investigator can become easily taxed by the sheer volume of information to process. This is of special concern. If the Criminal Defense Investigative Cycle is viewed as an assembly line of gathering and processing information, the process will fail. The key question is when to stop collection operations and exploit the information through analysis. There is no simple answer to this question. Many variables come into play. There is an extreme temptation to identify what information is needed, collect the information, and then process it through analysis, only repeating this process with minimum frequency.

In the ideal situation, the Criminal Defense Investigative Cycle is utilized through the concept of “small batches.” The most extreme example of this is when each new segment of information is processed through the Criminal Defense Investigative Cycle. For example, one witness is identified and interviewed, the resulting information is organized across the General Criminal Defense Investigative Model, the all source analysis is completed, and then diagnostic analysis is completed. The loop is then completed by defining the next issue, and the same process is followed. This process of looping would be repeated for each witness, physical evidence, or any other form of information collected. On the other hand, a “big batch” concept, the opposing extreme, would entail only completing the loop twice: once during the onset of the investigation and then a second time during a sweep to close information gaps. In practice, this would be observed with additional loops as new information arrived through the discovery process, but the core investigation would only entail two passes through the Criminal Defense Investigative Cycle. For practicing criminal defense investigators, the Criminal Defense Investigative Cycle should be utilized on the smallest batch scale, when feasible in the face of operational issues. From day to day, a criminal defense investigator has to balance three distinctive issues. First is the issue of field collection operations. Second is the processing (or analysis) of information derived from field collection operations. Third is the issue of scheduling concurrent case work. The temptation to utilize the Criminal Defense Investigative Cycle as an assembly line to complete an investigation is rooted in these issues and from an inadequate understanding of the utility of structured analysis. The criminal defense investigator must exercise discipline in applying the Criminal Defense Investigative Cycle by ensuring information is collected and processed in the smallest batch possible. The only real driver that should be allowed to disrupt the concept of small batch processing should by the uncontrollable availability and cooperation of witnesses. However, a skilled criminal defense investigator should be able overcome most reasonable issues faced in this area of collection through experience, proper planning, and the application of collection tradecraft. The criminal defense investigator needs to maintain extreme discipline in applying small batch processing, to the degree of rejecting a proposed criminal defense investigation that would exhaust available investigative manpower resources.

Reporting Investigative Information

One critical aspect of the Criminal Defense Investigation Cycle that has been omitted until this point is the issue of reporting. This omission has been made to allow a clear review of the issue of analysis. Communicating the findings of a criminal defense investigation is critical to the overall success of the investigation endeavor. No matter how well a criminal defense investigation is completed, absolute failure will be experienced if the investigative findings are inadequately communicated to the responsible criminal defense attorney.

Two main issues exist within the communication of investigative results. First, the criminal defense investigator will produce raw investigative information during collection efforts, resulting from a wide array of investigative tasks, from witness interviews to documenting alleged crime scenes. Second, the criminal defense investigator will produce analytical products, which are the direct result of structured analysis. These two different investigative actions must both be clearly communicated to the responsible attorney. However, the end results of both investigative actions are starkly different. Both are evidence and could be used in a criminal proceeding. Raw investigative data needs to be communicated without any interpretation. There are borderline exceptions to this rule that rest on the criminal defense investigator's need to descriptively articulate observations and capture an adequate account of events. Nevertheless, the criminal defense investigator should avoid an interpretation of raw investigative information in the original source reporting. On the other hand, when communicating analytical products, also known as the investigator’s expert opinion, the criminal defense investigator is communicating an interpretation of raw investigative information. These different types of information (with and without interpretation) require two different reporting methods for raw information and analytical products.

When preparing reports in general, several common formatting styles should be avoided. Avoid the use of bullets; these should only be used in rare circumstances when reporting information that would confuse the reader in paragraph form. Bullets should not be used as a crutch for weak writing skills. Reporting should be clear and concise. The reader should not be left confused or questioning any statement made by a witness due to ambiguous reporting. A criminal defense investigator should take considerable care to not alter the narrative of the subject action detailed in any reporting. All reporting should fully describe the subject action in considerable detail. A criminal defense investigator should err of the side of caution by not reducing the complex process of any investigative action into a short report on the basis of laziness and or the inability to communicate effectively in writing. For every thirty minutes spent in field collection or analysis, the criminal defense investigator should invest at least two hours in report preparation. Although this ratio will vary depending on the experience and skill of the criminal defense investigator in preparing reports, this ratio should be used as a benchmark for time management.

The two methods of reporting are provided to the responsible criminal defense attorney at two different stages of the Criminal Defense Investigation Cycle. Figure 7.3 illustrates the different stages of reporting non-interpreted and interpreted information to the responsible attorney. The reporting of information that is not interpreted is delivered during the collection of raw investigative information, while the reporting containing the investigator’s interpretation of information is released during the all source and diagnostic analysis stages.

All raw investigative information is reported through a written narrative titled “Memorandum of Investigation.” A Memorandum of Investigation is utilized in real time during collection efforts. For example, when a witness is interviewed, a Memorandum of Investigation is produced to clearly communicate the information uncovered during the interview to the responsible Attorney. A Memorandum of Investigation is a highly detailed written narrative. The goal is to provide a level of detail that could only be experienced by an individual personally observing the event. This is a high benchmark for the criminal defense investigator to achieve. In reality, no matter how skilled the criminal defense investigator is as a writer, this level will remain elusive. Nevertheless, this theoretical benchmark illustrates the critical need to provide detailed and accurate reporting to the responsible attorney.

A three-part Memorandum of Investigation is utilized. Typically written on letterhead, the Memorandum of Investigation presents the initial text, which is essentially an introduction. This paragraph is generic in nature and identifies the following information:

  • Date and time of action
  • Location of action
  • How the event occurred
  • Reason for action
  • Who was involved

That the party involved was advised of who the criminal defense investigator represents and in what criminal proceeding
The introductory paragraph is followed by the body of the Memorandum of Investigation. The content in this section of the report will vary greatly. Some reports will have a body made up of only a couple of lines, while others will consist of several pages of text. The content within the body of the Memorandum of Investigation will be specific to the subject of the report, which may be a witness interview, physical evidence collection, or any other number of investigative collection tasks. The only real requirements of the body, beyond the detail already discussed, are the following elements:

  • Chronological order of events
  • Use of direct quotes from witnesses and not misdirecting the context from which the statement was made
  • If a process is described, describe the process in a degree of detail that would allow the same process to be repeated by a third party
  • The closing text of the Memorandum of Investigation follows the body. This closing text may be presented in more than one paragraph, but typically one paragraph will be sufficient. This closing text is meant to advise the reader of any information that was not appropriate to or would break the chronological order of the Memorandum of Investigation's body text. The following information is typically presented in the closing text:
  • Physical description of witnesses
  • Criminal defense investigator's impressions of credibility in speech and physical demeanor specific to witnesses
  • Reason why specific information was unobtainable
  • Collection of any evidence and through what means
  • Disposal of any evidence collected
  • All analytical products, the results produce through analysis, are reported through a written narrative titled “Memorandum.” A Memorandum can be presented in many forms depending on the analytical product. These analytical products cover a wide area of topics from the criminal defense investigator's opinion to the results of the application of structured analysis. The possibilities are too vast to adequately describe how a Memorandum should be written. However, the following guidelines should be adhered to while preparing these documents:
  • Do not use ambiguous language
  • Clearly separate known information from analytical judgments
  • Clearly identify the source of information discussed or analyzed throughout the report
  • If a process is described, describe the process in a degree of detail that would allow the same process to be repeated by a third party

Preparing written reports is one of the most critical tasks performed by a criminal defense investigator. All reporting most be clear, concise, and demonstrate a consistent reporting and formatting style.