Major Incident Analysis Manual

This practice advice was produced in November 2005, drawing on good practice identified within the field of Major Incident Analysis in UK policing. The original document contains restricted information. In order to deliver this version, which is not protectively marked, a large amount of good practice examples have necessarily been removed. This version of the MIAM is only available on CD-Rom. Copies may be obtained from: Opsline National Centre for Policing Excellence Wyboston Lakes Great North Road Wyboston Bedfordshire MK44 3BY Email: [email protected]

This PDF file contains interactive links that help you to navigate the document quickly, and to enable you to gain immediate access to all websites listed. Clicking on any of the items in the main list of Contents (screen pages 5 to 10) will take you directly to the page listed. Or click on any item in the list of Contents at the start of each Section. To immediately access cross-referred items contained in this document, click on any cross-references shown in purple. To return to the list of Contents, simply click on the line “NOT PROTECTIVELY MARKED…” at the foot of each page.

Where you see a website address featured in purple, click on it to make a direct link. This document has been bookmarked to further assist navigation.

MAJOR INCIDENT ANALYSIS MANUAL (Revised Edition)

2006 Produced on behalf of the Association of Chief Police Officers by the ACPO National Analyst Working Group in conjunction with the National Centre for Policing Excellence.

MAJOR INCIDENT ANALYSIS MANUAL (REVISED EDITION) This document has been written on behalf of the Association of Chief Police Officers (ACPO) by the ACPO National Analyst Working Group and produced as practice advice by the National Centre for Policing Excellence (NCPE). It will be updated according to legislative and policy changes and re-released as required. The NCPE was established by the Police Reform Act 2002. As part of its remit the NCPE is required to develop policing doctrine, including practice advice, in consultation with ACPO, the Home Office and the Police Service. Practice advice produced by the NCPE should be used by chief officers to shape police responses to ensure that the general public experience consistent levels of service. The implementation of all practice advice will require operational choices to be made at local level in order to achieve the appropriate police response.

All enquiries about this manual should be addressed to: Opsline National Centre for Policing Excellence Wyboston Lakes Great North Road Wyboston Bedfordshire MK44 3BY Email: [email protected]

Acknowledgements The ACPO National Analyst Working Group and the NCPE would like to express their thanks to all those involved in the drafting of this document. This included major incident analysts and investigating officers and the ACPO Homicide Working Group. All of the responses during the consultation phase of this project were appreciated and contributed to the final document. © Association of Chief Police Officers (2006) © Centrex (2006)

All rights reserved. No part of this publication may be reproduced, modified, amended, stored in any retrieval system or transmitted, in any form or by any means, without the prior written permission of Centrex and ACPO or their duly authorised representative. Centrex is committed to providing quality products and services which comply with the Centrex Quality Assurance Framework and encompass diversity.

CONTENTS

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

7

Section 1 INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1 1.2 1.3

9 Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Supporting the SIO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Section 2 THE MAJOR INCIDENT PROCESS . . . . . . . . . . . . . . . . . . . . . 13 2.1 2.2 2.3

2.4 2.5 2.6

The Use of the Analyst and Researcher . . . . . . . . . . . . . . . . . . . . . . . Location of the Analyst and Researcher . . . . . . . . . . . . . . . . . . . . . . . Functions, Roles and Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.1 The Analyst . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.2 Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.3 The Researcher . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.4 Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Analyst Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Lead Analyst . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Role of the SCAS Analyst . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

14 15 16 16 16 18 18 19 19 19

Section 3 THE ANALYST’S TECHNICAL REQUIREMENTS . . . . . . . . . . 21 3.1 3.2

Software/IT Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Section 4 THE START OF AN INVESTIGATION . . . . . . . . . . . . . . . . . . . 23 4.1 4.2 4.3

Good Practice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Legislation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Section 5 THE INTELLIGENCE CYCLE . . . . . . . . . . . . . . . . . . . . . . . . . 33 5.1

The Intelligence Cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Section 6 DIRECTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 6.1 6.2 6.3

The Direction Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Terms of Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Actions and HOLMES 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.1 Tasking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.2 SIO’s Policy File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.3 Proactive Generation of Tasks through Analysis . . . . . . . . . . .

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

38 38 39 39 39 40

© ACPO Centrex 2006

CONTENTS

Section 7 COLLECTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 7.1 7.2

7.3 7.4 7.5 7.6

7.7 7.8

The Collection Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Closed Data Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.1 HOLMES 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.2 Force Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.3 Police Departments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.4 Outside Contacts (National) . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.5 Outside Contacts (Local) . . . . . . . . . . . . . . . . . . . . . . . . . . . . Open Data Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.3.1 Evaluating Open Data Sources . . . . . . . . . . . . . . . . . . . . . . . . Schedules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Note Taking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Storage and Document Management . . . . . . . . . . . . . . . . . . . . . . . . 7.6.1 Physical Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.6.2 Electronic Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exhibit Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Scene Visits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

42 42 42 46 49 50 56 57 60 60 61 62 62 62 63 64

Section 8 COLLATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 8.1 8.2

8.3

8.4 8.5 8.6 8.7 8.8

The Collation Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Charts ............................................... 8.2.1 Charting Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.2 Network Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.3 Timelines/Sequence of Events Charts . . . . . . . . . . . . . . . . . . . 8.2.4 Statement Comparison Charts . . . . . . . . . . . . . . . . . . . . . . . . Spreadsheets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.1 Comparative Case Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.2 Timelines/Sequence of Events Spreadsheets . . . . . . . . . . . . . . 8.3.3 Witness Comparison Charts . . . . . . . . . . . . . . . . . . . . . . . . . . Tables ............................................... Databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Maps ............................................... Commodity Flows including Financial Material . . . . . . . . . . . . . . . . . Communications Flow and Frequency Charts . . . . . . . . . . . . . . . . . . 8.8.1 Communications Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.8.2 Telecommunications Data Types . . . . . . . . . . . . . . . . . . . . . . . 8.8.3 Flow Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.8.4 Network Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.8.5 Frequency Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

66 67 67 69 70 70 70 71 71 74 74 74 75 75 76 76 77 78 79 79

© ACPO Centrex 2006

Section 9 EVALUATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 9.1 9.2

9.3 9.4 9.5 9.6

The Evaluation Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Brainstorming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2.1 Brainstorming Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2.2 5WH Matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2.3 Brainstorming Outcomes . . . . . . . . . . . . . . . . . . . . . . . . . . . . Charting Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Covert Intelligence Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Inference Development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Hypothesis Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

82 83 84 84 86 86 87 87 88

Section 10 ANALYSIS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 10.1 10.2 10.3 10.4 10.5

10.6

The Analysis Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Scope of Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Inferences and Hypotheses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The National Intelligence Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.1 Incident Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.2 Network Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.3 Subject Profile Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.4 Crime Pattern Analysis (CPA) . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.5 Risk Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.6 Market Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.7 Social and Demographic Trend Analysis . . . . . . . . . . . . . . . . . 10.5.8 Criminal Business Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.9 Results Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.10 Operational Intelligence Assessment . . . . . . . . . . . . . . . . . . . Which Analytical Techniques Should Be Used? . . . . . . . . . . . . . . . . . 10.6.1 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.2 Victim-Related Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.3 Offender-Related Techniques . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.4 Location-Related Techniques . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.5 Incident-Related Techniques . . . . . . . . . . . . . . . . . . . . . . . . . .

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

92 92 92 93 93 93 95 96 98 101 102 103 104 104 105 106 106 107 109 111 112

© ACPO Centrex 2006

CONTENTS

Section 11 DISSEMINATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 11.1 11.2 11.3 11.4 11.5 11.6 11.7

11.8

The Dissemination Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Charts and Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Briefings and Presentations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Analytical Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exhibits ............................................... Disclosure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Analyst’s Role in Court . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.7.1 Pre-Court Involvement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.7.2 Attendance at Court as a Professional Witness . . . . . . . . . . . 11.7.3 Material for Court . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.7.4 Attendance in the Court Room to Support the Prosecution Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Public Inquiries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

116 117 117 118 119 119 120 120 121 122 122 123

Section 12 DIRECTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 12.1 12.2 12.3 12.4

12.5 12.6 12.7 12.8

The Direction Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tasking and Co-ordination Group Process . . . . . . . . . . . . . . . . . . . . . Community Impact Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Reviews ............................................... 12.4.1 Results Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.4.2 Risk Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.4.3 Operational Intelligence Assessment . . . . . . . . . . . . . . . . . . . 12.4.4 Reviewing Analytical Processes . . . . . . . . . . . . . . . . . . . . . . . . Links into Strategic Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Dissemination of Intelligence into Regular Policing . . . . . . . . . . . . . Hypotheses Testing and Inference Development . . . . . . . . . . . . . . . Reviewing the Analyst’s and Researcher’s Workloads . . . . . . . . . . . .

126 126 127 127 128 128 128 128 129 129 129 129

Section 13 WELFARE OF ANALYSTS AND RESEARCHERS . . . . . . . . . 131 13.1 13.2

Welfare Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Risk Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

Summary of Appendices Appendix Appendix Appendix Appendix Appendix Appendix Appendix Appendix Appendix

1 2 3a 3b 4a 4b 5 6 7

Terms of Reference 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Search Techniques and Useful Websites . . . . . . . . . . . . . . . . . . Intelligence Network Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . Evidential Network Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Intelligence Timeline Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . Evidential Timeline Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Abbreviations and Acronyms . . . . . . . . . . . . . . . . . . . . . . . . . . Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References and Suggested Further Reading . . . . . . . . . . . . . . .

136 138 141 142 143 144 145 147 148

Summary of Figures Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Figure 6 Figure 7 Figure 8 Figure 9 Figure 10 Figure 11 Figure 12 Figure 13 Figure 14 Figure 15 Figure 16

The Intelligence Cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Example Schedule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Charting Protocols Matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Simple Timeline Showing Movements of Suspect on 01/01/2006 . . . 5WH Matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Evaluation Matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Peacock Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Grouped Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Inference Development and Information Management . . . . . . . . . . . Problem Analysis Triangle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Major Incident Problem Analysis Triangle . . . . . . . . . . . . . . . . . . . . . . Victim-Related Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . . . Offender-Related Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . Location-Related Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . Incident-Related Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . . Major Incident Analysis Product Matrix . . . . . . . . . . . . . . . . . . . . . . .

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

34 61 68 73 85 85 87 87 88 106 107 107 109 111 112 113

© ACPO Centrex 2006

CONTENTS

Summary of Tables Table 1 Table 2 Table 3 Table 4 Table 5 Table 6 Table 7 Table 8 Table 9 Table 10 Table 11 Table 12 Table 13 Table 14 Table 15 Table 16 Table 17

Considerations before Starting Work on a New Investigation . . . . . . Legislation that Needs to be Considered by the Analyst . . . . . . . . . . . Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . HOLMES 2 Closed Data Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . Force Systems Closed Data Sources . . . . . . . . . . . . . . . . . . . . . . . . . . Police Departments Closed Data Sources . . . . . . . . . . . . . . . . . . . . . . National Outside Contacts Closed Data Sources . . . . . . . . . . . . . . . . Local Outside Contacts Closed Data Sources . . . . . . . . . . . . . . . . . . . Open Data Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Grading Open Source Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Naming Convention Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Features Included in a Spreadsheet Timeline . . . . . . . . . . . . . . . . . . . Victim-Related Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . . . Offender-Related Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . Location-Related Analytical Technique Examples . . . . . . . . . . . . . . . . Incident-Related Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . . Analyst Welfare Risk Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . .

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

24 25 31 43 46 49 50 56 58 60 62 72 108 109 111 112 133

© ACPO Centrex 2006

PREFACE

Since the 1990s analysts and researchers have become widely used in operational policing. The National Intelligence Model (NIM) has played a significant role in developing the role of the Analyst in intelligence-led policing, however, the use of major crime analysts has been less structured. With the growth of the analytical profession and an increased understanding of the Analyst’s role, the need for guidance, training and standard procedures has been identified. In 2004 a small group of analytical representatives from Surrey, Essex, Kent, Cambridgeshire and Sussex police forces was established to consolidate the lessons learned from their forces’ recent high profile cases. In the light of reviews of these cases and subsequent inquiries such as Bichard, the group acknowledged that there was a need to develop practice advice and good practice for use by analysts in major investigations. At this time the ACPO National Analyst Working Group (NAWG) expanded its terms of reference to include development of analytical techniques and it was felt that the work already commenced by the small group of forces, as mentioned above, should continue to be developed. This group subsequently became the Major Incident Analysis Working Group (MIAWG), a subgroup of the NAWG analytical techniques group. NAWG reports directly to the ACPO Intelligence Portfolio. The membership of the group was expanded to ensure knowledge and experience was obtained from policy makers, managers and practitioners, including a representative from the ACPO Homicide Working Group. An initial consultation group was also established to represent the entire UK. Since its formation the MIAWG has been guided by a number of key principles:

• That the group will accept the majority view in relation to good practice but will not exclude differing approaches. The intention is to be inclusive and, where possible, to provide a number of options.

• While not prescriptive, the aim of this manual is to provide a set of guiding principles that are both useful and practical.

• The guidance that the group produces will not stifle innovation, but encourage thinking outside of recommended good practice. It is an aim of the MIAWG to provide assistance to the National Centre for Policing Excellence (NCPE) review of both the ACPO (2005) Major Incident Room Standardised Administrative Procedures (MIRSAP) Guidance and the ACPO (2005) Murder Investigation Manual (MIM).

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

7

The existing MIRSAP and MIM documents make basic recommendations with regard to the use of analysts in major incidents. The rewriting of these manuals has, however, represented an excellent opportunity to accurately reflect the roles of the Analyst and Researcher. This Major Incident Analysis Manual (MIAM) complements these documents by providing supplementary detail of good practice based on operational experience throughout the country, and is the culmination of the work of the MIAWG. On this basis, this manual should be of interest to practitioners, customers, managers and co-workers and, in particular, should be used as a point of reference for analysts, researchers, analyst managers and Senior Investigating Officers (SIOs). This manual will prove to be a useful tool to those continuously involved in major investigations. It will also provide advice to those who may be involved in major investigations on a seconded or temporary basis, particularly as the document builds on existing NIM analytical techniques and products.

8

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

SECTION 1

Section 1 INTRODUCTION

T

his section gives details on the purpose and aims of the manual. The scope of the manual is also explored here.

CONTENTS 1.1 1.2 1.3

Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Supporting the SIO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

9

‘The importance of using intelligence analytical techniques to drive investigations is now acknowledged within the police service. By using research/analysis to underpin murder investigations they will be more focused, cost effective and more likely to succeed.’ ACPO (2000) Murder Investigation Manual

1.1 PURPOSE The purpose of the Major Incident Analysis Manual is to provide practice advice to analysts supporting Senior Investigating Officers (SIOs) involved in major incidents. Specifically this manual will:

• Recommend good practice on the organisation and infrastructure of major

• • • •

• • •

incident rooms specifying the role of the Analyst and Researcher and tasking of analysts; Provide practice advice regarding the type of material that analysts working within major incident rooms should have access to; Establish what technical resources are required by analysts involved in major incidents; Recommend standardised charting processes; Provide practical advice regarding the use of experts (for example, the National Centre for Policing Excellence, Operations) particularly relating to timely information sharing; Recommend good practice on the symbiosis between SIO policy and analysis; Establish practical advice and examples of analytical products and techniques for use in major investigations; Provide practical advice determining where major incidents fit into the National Intelligence Model (NIM) processes and ensure that all final products are compliant with the national standards of the NIM.

1.2 SUPPORTING THE SIO This manual describes the analytical support for the SIO by positioning the Analyst’s role as a professional advisor, providing improved support for decision making and assisting with the identification of new investigative opportunities. Additionally, the Analyst can provide reassurance to the SIO that all relevant matters have been properly examined which will help to underpin the court process and contribute towards the achievement of successful outcomes. The manual represents good practice in relation to current analytical procedures and, therefore, does not always reflect some of the practical constraints that the SIO may find themselves under. For example, time pressures can be intrinsic to operational policing and decision making within major investigations. Therefore, it is vital that the Analyst can provide products in a timely fashion, meeting the SIO’s requirements. The complexities of managing a major investigation are far reaching and as such have not been fully discussed within this manual. The Analyst is encouraged to fully support the SIO within any given set of circumstances, using this manual as practical advice to help guide the quality of the analysis.

10

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

For the purposes of this manual, major incidents are defined as: critical incidents, murders, stranger rapes, attempted murders, linked serious crimes, kidnap, abduction, road deaths, major disaster, missing person inquiries, some serious organised crime incidents and terrorism.

INTRODUCTION

1.3 SCOPE

The material contained within this document is intended to be as current as possible and, as such, it will be revised with the advent of any new and updated legislation, changes in working practices and the collation of new examples. It is intended that this manual acts as a reference document and users should, therefore, access relevant sections as required. The material contained within this manual will be made available to the NAWG and sanctioned by the Analytical Techniques Working Group who are in the process of producing similar practice advice concerning the application of analytical tools. Course outlines specifically dedicated to major incident analysis skills will then be developed. Inputs relating to major incident analysis will also be provided at specific levels of police training to improve understanding of the Analyst and Researcher role in major investigations.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

11

12

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

SECTION 2

Section 2 THE MAJOR INCIDENT PROCESS

O

utlined in this section are the main roles and responsibilities of the Analyst and Researcher within a Major Incident Room, along with the role of the Analyst Manager, Lead Analyst and the Serious Crime Analysis Section (SCAS) Analysts. CONTENTS 2.1 2.2 2.3

2.4 2.5 2.6

The Use of the Analyst and Researcher . . . . . . . . . . . . . . . . . . . . . . . Location of the Analyst and Researcher . . . . . . . . . . . . . . . . . . . . . . . Functions, Roles and Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.1 The Analyst . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.2 Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.3 The Researcher . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.4 Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Analyst Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Lead Analyst . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Role of the SCAS Analyst . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

14 15 16 16 16 18 18 19 19 19

© ACPO Centrex 2006

13

2.1 THE USE OF THE ANALYST AND RESEARCHER The application of processes designed to ensure the efficient management and analysis of information and intelligence is the cornerstone of any major investigation. The role of the Analyst and Researcher should not be underestimated in this process and analytical products can often prove to be fundamental to successful operational decision making. The appropriate use of analysis directly supports the pursuit of ethical policing and best value. Analytical products frequently provide the justification for decision making at a review stage. Their use in driving investigations will, however, make those investigations more focused, cost effective and better able to succeed. The MIM advocates that a team-based approach to problem solving will allow the SIO to harness knowledge, skills and experience to target investigative problems with a view to finding investigative solutions. The skill of the SIO is to use their own generic knowledge and to work closely with experts as a team to harness their knowledge and experience and to target investigative problems for the purpose of producing solutions. As the Analyst is an expert in the interpretation of information, the SIO should regard the Analyst as a professional tactical advisor for the use of analytical services and products. A close, efficient working relationship between the SIO and analyst is essential to effective investigation management. The MIM outlines that at every stage in an inquiry, research and analysis should underpin all information-based decision making. The Analyst should, therefore, be brought into the inquiry from the beginning in order that they are fully responsive to the SIO’s objectives. Effective decision making must involve an appreciation of all the material available. Analytical products not cognisant of all investigatory material will be inherently flawed; therefore, the SIO must ensure that the Analyst is allowed access to all material. The following represent the key benefits to managers in deploying analysts in a timely manner. Analysts can:

• • • • • • • • • • • • • 14

Inform resourcing decisions; Maximise existing or limited resources; Focus the inquiry; Focus intelligence gathering through identifying intelligence gaps; Prioritise lines of enquiry; Provide a projection of likely future criminal activity; Assist in the prevention of further crime and incidents (criminal activity); Provide an objective summary of the case therefore preventing miscarriages of justice; Assist the process of narrowing the justice gap; Ensure compliance with legislation and guidance; Maximise intelligence into mainstream policing through dissemination; Manage information professionally to inform decision making; Minimise the cost of investigations.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

While material gathered as a direct consequence of the investigation is likely to be the prime source of information, analysis should include material from other in-force databases and open sources where appropriate. Analysts should have access to the range of technology that supports them in executing their role effectively. In order to set analysis within the context of the offence, the Analyst should have a detailed understanding of the location of the offence. They can do this by visiting the scene(s) of crime as soon as reasonably practicable following the conclusion of evidence collection, and should be encouraged to view evidential footage.

THE MAJOR INCIDENT PROCESS

The timeliness of analysis is essential to its value. The Analyst should, therefore, be a priority recipient of material. While HOLMES 2 should be the source of investigatory records for analysis, given the often vast amount of material received particularly at the start of an investigation, it is good practice to ensure that the Analyst receives paper copies of material entering the Major Incident Room (MIR) immediately. Storage, however, must be considered as a limiting factor. HOLMES 2 can then be used to underpin this information flow by the Analyst who will assign tags when documents have been read.

A significant amount of research is required to support the MIR. Without the assistance of a researcher, analysts are frequently tasked with such requirements. SIOs should be aware of the different competency expectations of each role and consider the limitation of analytical potential where analysts are tasked with completing research. SIOs should ensure that the Analyst is both fully integrated within the investigative team, and participates in operational briefings and management meetings. While analytical products must be accompanied by a verbal or written report, in order to assist the SIO in structured decision making processes, the Analyst should be included and involved in management meetings as appropriate. SIOs may find that the most appropriate time to discuss analytical products is within the ‘Current and Emerging Lines of Enquiry’ agenda item. Analysts are expected to be innovative and creative in the way they apply their analytical skills to the particular incident and the SIO’s objectives. While SIOs should recognise the potential for analysis, and demand such innovation from their staff, all geographic and behavioural profiling should be tasked to specialists in these disciplines, as this is not within the professional capability of in-force analysts. The Serious Crime Analysis Section (SCAS) also has a national remit to carry out comparative case analysis (CCA) in support of forces in the case of serious and sexual crime.

2.2 LOCATION OF THE ANALYST AND RESEARCHER In order to synthesise intelligence with other material gathered during the enquiry, it is essential that researchers and analysts sit within the MIR. Providing intelligence has passed through the sterile corridor, there is no reason why researchers, analysts and research and development officers should not work within the MIR. Although it may be considered practical to organise such staff within a ‘cell’ this should not be regarded as separate to the MIR.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

15

Where analysts work away from the MIR and MIR staff, there is a strong possibility that they will become isolated and that the necessary level of communication between the Analyst, SIO and other staff will not be attained. This will have the effect of undermining and diminishing the Analyst’s role and the products produced. In some circumstances it may not be possible or it may be decided, following consultation between the SIO and the Analyst Manager, that the Analyst should be located away from the MIR. The implications of this decision should be considered and potential problems mitigated against. Consideration also needs to be given to the Analyst’s requirement for physical space to undertake their work in an innovative and unconstrained manner.

2.3 FUNCTIONS, ROLES AND RESPONSIBILITIES The primary purpose of research and analysis is the collation, evaluation, interpretation and presentation of material in order to inform the SIOs decision making process. In order to clarify the competency expectations of each role, the functions, roles and responsibilities of each (as outlined in ACPO (2005) Major Incident Room Standardised Administrative Procedures (MIRSAP) Guidance) are detailed below. No distinction has been made between a full time Major Incident Team (MIT) Analyst or Researcher or one that has other primary roles such as volume crime. It is possible that an analyst may work on a number of operations at any one time. In this case, a decision will need to be made as to the most appropriate place to locate the Analyst. Distinction has also not been made between the role of a covert intelligence analyst and an analyst dealing with evidential material. The skills and profile for either post are identical. It is the context of the roles that differs and this is explored in relevant sections within the manual.

2.3.1 THE ANALYST The Analyst is responsible for evaluating and interpreting all material that forms part of the investigation, together with any other pertinent material, with a view to assisting the SIO in structured decision making processes. The Analyst will form part of the Management Team as stipulated in the ACPO (2005) Murder Investigation Manual (MIM).

2.3.2 RESPONSIBILITIES The Analyst must have the necessary skills and competencies to be able to:

• Search and retrieve material from HOLMES 2 and other local databases; • Ensure all documents are read and analysed (given the often vast amount of material received, particularly at the start of an investigation, it may be appropriate to include the Analyst within the formal paper chain of information); • Establish links and associations between material (eg, intelligence, statements, officers’ reports, interview transcripts, telephone calls, financial records);

16

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

matter in question;

• Use analytical software and geographic information systems as appropriate,

• •

• • •

• •

•

•

• •

•

•

•

produce relevant and timely analytical charts, accompanied by verbal or written reports and presented in a format that is concise and understandable to the audience (Note: Verbal briefings should usually be backed up by written reports); Make recommendations based upon the analysis to assist the SIO to progress current, and identify potential new, lines of enquiry; Ensure that all analysis is undertaken in compliance with all relevant legislation (eg, CPIA, RIPA, DPA, HRA) and according to national standards of good practice as prescribed by the NAWG; Attend all briefings and management meetings, presenting analysis as appropriate; Maintain a dynamic workload and work flexibly to provide analytical support to (potentially) a number of major incidents at any one time; At all times be aware of the current intelligence requirement and developments in the investigation and ensure that analysis takes account of, and runs alongside, these; Maintain close liaison with the Researcher(s) and any external analytical services (such as those employed by Serious Crime Analysis Section); Maintain an awareness of the force and Basic Command Unit (BCU) Intelligence Requirements, informing the SIO of issues in the investigation that may impact on these (and vice versa); Act in the capacity of professional advisor to the SIO regarding viability, timescales and type of outcome likely for different analytical products, and assist the SIO to prioritise the most worthwhile analytical course of action; Ensure that all analytical material presented to the SIO/MIR is fully documented, making certain that a separate version of each product is recorded and retained, alongside associated material and decisions made from that product; Ensure that a record is kept of all their own thought processes and decisions taken to underpin analytical processes; Assist in the preparation of interview schedules, and participate in downstream monitoring of the interview, with a view to identifying inconsistencies and potential lines of questioning Prepare analysis suitable for court presentation, and where required to do so as a professional witness, write statements and give evidence in court relating to such analysis; Where not called as a witness themselves, to attend court to analyse witness and defendant testimonies, to identify inconsistencies and assist the prosecution in potential lines of questioning for cross-examination; Identify strategic trends relating to major crime and contribute towards the development of major crime reduction and prevention plans.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

THE MAJOR INCIDENT PROCESS

• Identify gaps and inconsistencies within the material; • Go beyond the known facts to develop inferences and hypotheses about the

17

2.3.3 THE RESEARCHER The Researcher is responsible for searching and retrieving information and material in support of the investigation, compiling factual reports and briefings and presenting such material to MIR staff and analysts.

2.3.4 RESPONSIBILITIES The Researcher must have the necessary skills and competencies to be able to:

• Support the Analysts and MIR staff to search and retrieve material from

• • • • •

• • • • • • •

relevant paper and computer-based sources including HOLMES 2, local crime, incident and intelligence databases, open sources, PNC (including VODS and QUEST) in support of current, and potential lines of enquiry; Devise appropriate methods of evaluation, collation and dissemination of material obtained from research; Use information and communication technology to best effect; Produce relevant and timely verbal or written reports and present in a format that is concise and understandable to the audience; Prepare visual aids to illustrate factual material in a readily understandable format; Under the supervision of an analyst, use information visualisation software (such as Electronic Charting Systems and Geographic Information Systems) to display factual material; Attend all briefings and management meetings, presenting briefings and reports as appropriate; Record notes for own/analyst’s use at briefings and meetings; Maintain close liaison with the Analyst(s), undertaking research on their behalf, as directed; Produce research summaries as required by the SIO; Undertake comprehensive research in support of the Action Team, making internal and external enquiries, as required; Handle information and intelligence in accordance with legislation, national guidelines and local protocols; Ensure that all research is undertaken in compliance with all relevant legislation (eg, CPIA, RIPA, DPA, HRA.) and according to national standards of good practice as prescribed by the NAWG.

In some circumstances it may not be possible to employ both an analyst and a researcher on an inquiry. The Analyst is able to undertake their own research, however, it must be acknowledged that a significant increase in research activity will result in a reduction of analytical productivity. Where there is no analyst, a researcher cannot undertake analysis.

18

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

The Analyst Manager provides professional guidance and is responsible for quality assurance of the Analyst’s product. S/he will ensure that all aspects of the analytical product comply with national and force guidelines. This post is not necessarily based in the major incident department, and should be the function of the force’s head of intelligence analysis or a senior/higher analyst. The post-holder will work closely with SIOs and senior managers in the major incident department, to ensure that the major incident structure facilitates and gains maximum benefit from analysis. It may be beneficial if this individual has prior knowledge of major incident work. The Analyst Manager should also work with the SIO in resource planning to ensure that sufficient trained and competent analysts are available and equipped to support the investigation as appropriate. Within this planning process, the Analyst Manager and SIO should consider the welfare of the Analysts, particularly with regard to exposing analysts to potentially distressing evidential material, and provide support measures as appropriate.

THE MAJOR INCIDENT PROCESS

2.4 THE ANALYST MANAGER

The Analyst Manager would not normally be part of the SIO’s management team, unless they were a dedicated resource within the inquiry.

2.5 LEAD ANALYST Where a number of analysts are deployed on a specific investigation or the investigation is particularly complex, an analyst should be appointed as soon as possible to assume the ‘lead’. This Lead Analyst is responsible for coordinating and supervising analysis, attending and representing the other analysts at the management meetings. They are also the conduit through which all analytical actions are raised and resulted. The Lead Analyst must have all the same necessary skills and competencies as the Analyst, and should be competent in team supervision and management.

2.6 THE ROLE OF THE SCAS ANALYST While this manual covers the remit of analysts and researchers involved in major incidents, the role of the SCAS Analysts must be considered, in order to ensure clarity over the difference between the roles. SCAS analysts are trained specifically in the behavioural analysis of serious and sexual crime. Their involvement in a case will depend on the terms of reference that are agreed with the Officer In the Case (OIC), however, the SCAS Analyst specifically asks about force analyst involvement. Where possible, the SCAS Analyst will speak to the force analyst to establish the extent of the work they have carried out. The remit of the SCAS Analyst includes:

• Searching the national database to identify potentially linked offences; • Conducting QUEST/VODS searches to identify potential nominals of interest; • Liaising with force analysts to offer advice on the relevant importance of the offender’s behaviour to assist searching in-force systems;

• Production of Comparative Case Charts and analysis of these. In linked enquiries, it is good practice for SCAS to take the lead on this;

• Provide Similar Fact Evidence on appropriate cases. NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

19

20

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

THE ANALYST’S TECHNICAL REQUIREMENTS

SECTION 3

Section 3

I

n this section the core technical resources required for analysts and researchers to carry out effective and timely analysis in order to progress a major incident inquiry are outlined.

CONTENTS 3.1 3.2

Software/IT Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

21

Within major investigations there is a requirement for technical resources to be made available to the Analyst in a timely and unrestricted manner. The exact resources required should be evaluated according to the needs of each investigation, however, consideration should be given to the following list of technical resources:

3.1 SOFTWARE/IT SYSTEMS • • • • • • • • • • • • • • •

Adequate drive space and, where necessary, shared drive space Adobe Acrobat pdf conversion software Charting software Command and Control system Crime Recording system Data mining tools for HOLMES 2 GIS system HOLMES 2 Intelligence system Internet MS Office (Word, Excel, PowerPoint and Photo Editor) PNC QUEST Video Witness VODS

3.2 HARDWARE • • • • • • •

A3 colour printer Access to A3 colour photocopier Access to audio and visual equipment Access to a plotter for printing out larger charts/timelines Access to a scanner Access to suitable presentation facility Large screen monitor

It is essential that analysts and researchers receive adequate training in these systems prior to using them, not only to ensure competency within the Analyst’s role but also within the criminal justice process. The majority of technical resources used by analysts and researchers within major incidents will be familiar to those working within the volume crime arena. There are a few resources that are specific to major incidents, for example, HOLMES 2 and local bespoke systems. Technological support has the benefit of increasing efficiency and making analytical output more professional. These tools, however, do not replace the mental processes that constitute intelligence analysis.

22

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

SECTION 4

Section 4 THE START OF AN INVESTIGATION

A

checklist of good practice is provided in this section to assist the Analyst in the most effective way to approach the investigation. The most relevant and current information regarding legislation and guidance affecting major incidents and analysis is included.

CONTENTS 4.1 4.2 4.3

Good Practice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Legislation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

23

4.1 GOOD PRACTICE The start of an investigation is usually the busiest time for analysts, however, this checklist should be consulted and the practical tips used as a point of reference. TABLE 1 Considerations before Starting Work on a New Investigation GOOD PRACTICE

24

In order to work in an efficient and professional manner the following issues should be considered

Link to relevant section of manual

Scene visits

The Major Incident Process Collection

Viewing all material

The Major Incident Process

Government Protective Marking Scheme (GPMS)

Legislation

Disclosure

Legislation Dissemination

Clear direction including Terms of Reference

Direction

Communication with the SIO

Direction Dissemination

Storage, both physical and electronic, including clear desk policy

Collection Collation

Sourcing of documents

Collection

Exhibit handling

Collection

Note taking

Collection Collation

The stage of the investigation (ie, is the material being used to progress the investigation or being used in an evidential manner?)

Collation Dissemination

Versioning

Collation

Analysts vs. Experts

Evaluation Analysis

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

There is a wealth of legislation that affects both major incident and analytical work. While the following is not a complete description nor an exhaustive list of all legislation, it provides a summary with practical tips that analysts and researchers must consider. The following relates to UK legislation. TABLE 2 Legislation that Needs to be Considered by the Analyst LEGISLATION Analytical work must be undertaken in compliance with relevant legislation

Practical Tips

Computer Misuse Act 1990 Provides power to prosecute those individuals whom deliberately and without authority, misuse computer systems. The following sections should be considered in analytical work: Section 1 – is an offence to knowingly cause a computer to perform any function with the intent to secure unauthorised access to any program or data held in the computer. Section 3 – is an offence to intentionally cause an unauthorised modification of the contents of any computer to impair or hinder the working of the computer or program or impair the reliability of its data.

• As with DPA, basic

Copyright Copyright gives the creators of a wide range of material economic rights enabling them to control the use of their material in a number of ways. It also gives moral rights that are concerned with protecting the personality and reputation of authors. Copyright does not protect ideas or such things as names or titles. Most users of copyright material require permission from the owner. There are some exceptions, however, including limited use of material for judicial proceedings. Copyright is automatic in the UK, there are no forms to fill in and no fees to pay to get protection. There is also no official registration system. As long as work has been recorded in some form, then the author has copyright protection. Copyright owners can take certain precautions to help protect their rights.

• Analysts must take

Crime and Disorder Act 1998 This Act is intended to reduce general levels of crime and disorder in society through the introduction of various strategies, powers and court orders. Section 5 imposes a legal duty on the Police Service, local authorities, health authorities and probation committees to formulate crime reduction strategies based on inter agency partnerships. Section 17 (1) imposes an obligation on every Police Authority, local authority and other specified bodies, to consider crime and disorder in exercise of their duties. This includes major incidents. The Crime and Disorder Act also makes provision for police and partnership agencies to share information through the use of information sharing protocols.

• Ensure compliance

NOT PROTECTIVELY MARKED

knowledge is important so that analysts and researchers understand the limitations of their work.

THE START OF AN INVESTIGATION

4.2 LEGISLATION

into account the copyright of any material used in their work and must consider this when copying and distributing their work.

with information sharing protocols.

• Consider partner

Major Incident Analysis Manual (Revised Edition)

agencies when collecting open source data, particularly for strategic work and socio-demographic data.

© ACPO Centrex 2006

25

TABLE 2 Legislation that Needs to be Considered by the Analyst (continued) LEGISLATION Analytical work must be undertaken in compliance with relevant legislation

Practical Tips

Criminal Justice Act 1993 Section 52(2)(b) states that it is illegal for unauthorised personnel to leak information from an ‘insider’ to outside agencies, eg, the media, whether or not that person makes any financial or personal gain. It has to be in the proper performance functions of employment, office or profession. The majority of this legislation has now been repealed but continues to provide explanations of the term ‘insider’ and ‘inside information’.

• Familiarisation with

Criminal Justice Act 2003 An Act to make provision about criminal justice and about dealing with offenders. Two sections are particularly relevant to the work of analysts and researchers as they allow evidence of bad character and hearsay evidence in certain circumstances to be admissible in court. Part 11, Chapter 1 – Bad Character: Evidence of a person’s ‘bad character’, (ie, previous convictions) or a disposition towards this can be used as evidence unless: • It has to do with the alleged facts of the offence with which the defendant is charged; • Is evidence of misconduct in connection with the investigation or prosecution of that offence.

• Familiarisation with

the relevant details of the legislation.

• Liaise with the Data Protection Officer.

the Act.

• Liaison with the CPS and SIO.

Such evidence is only admissible if: • All parties agree to the evidence being admissible; • It is important explanatory evidence; • It is relevant to an important matter in issue between the defendant and the prosecution; • It has substantial probative value in relation to an important matter in issue between the defendant and co-defendant; • It is evidence to correct a false impression given by the defendant; • The defendant has made an attack on another person’s character; • It is adduced by the defendant or is given in answer to a question. Chapter 2 – Hearsay Evidence In criminal proceedings, a statement not made in oral evidence in the proceedings is admissible as evidence only if certain conditions are agreed. These include all parties in the proceedings agreeing to it being admissible, the court is satisfied that it is in the interests of justice for it to be admissible and other statutory provisions and rules of law make it admissible.

26

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

LEGISLATION Analytical work must be undertaken in compliance with relevant legislation

Practical Tips

Criminal Procedure and Investigations Act 1996 (CPIA) CPIA is essential to law enforcement agencies as it concerns the disclosure of prosecution and defence material in criminal proceedings. The Act attempts to ensure good recording practices. Main areas of interest to law enforcement are: • Part I – aspects of disclosure; • Part II – creates codes of practice to be followed by investigators; • Part III – preparatory hearings – looks to improve efficiency of case proceedings and avoid interruptions at trial.

• Liaise with the

CPIA (as amended by the Criminal Justice Act 2003), is designed to ensure that fair disclosure of material which may be relevant to an investigation and which does not form part of the prosecution case. The amendments in the Criminal Justice Act 2003 abolished the concept of primary and secondary disclosure and introduced an amalgamated test for disclosure of material that ‘might reasonably be considered capable of undermining the prosecution case or assisting the case for the accused’. It also introduced a new code of practice. The Attorney General asserts that there must be ‘a concerted effort to comply with the CPIA disclosure regime robustly in a consistent way in order to regain the trust and confidence of those involved in the criminal justice system’.

• Consider use of

Disclosure Officer within investigation.

• Set up disclosure schedule at start.

• Ensure use of notebook.

naming convention.

THE START OF AN INVESTIGATION

TABLE 2 Legislation that Needs to be Considered by the Analyst (continued)

• Use of version control.

Part II refers to sensitive material (that which is not in the public interest to disclose) and the need to have Public Interest Immunity (PII) against that material that is deemed too sensitive to reveal to the defence. This includes: • Material relating to national security; • Material relating to identity or activities of informants or undercover officers; • Material revealing, directly or indirectly, techniques and methods in the course of detecting crime, eg, covert surveillance techniques. An analyst or researcher, must ensure that work does not inadvertently contain sensitive material and that the Disclosure Officer is aware of which work should be considered for PII. Failure to comply with the Act may result in miscarriages of justice, prosecution of law enforcement personnel, payment of damages and loss of public confidence in law enforcement.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

27

TABLE 2 Legislation that Needs to be Considered by the Analyst (continued) LEGISLATION Analytical work must be undertaken in compliance with relevant legislation

Practical Tips

Data Protection Act 1998 (DPA) Concerns the processing of material relating to individuals, including the obtaining, holding, use or disclosure of such material.

• Liaise with the Data Protection Officer.

• Ensure knowledge Refers to both paper and electronic files and, therefore, makes the Analyst/researcher personally liable for material received. Also concerns length of time to keep material, storage of material, how it is processed and its relevance. Any individual not only has a right of access to material held about them but also has the right to have material corrected or erased. They can also take action against any breaches of the Act which leads them to suffer from harm.

of the 8 principles within the Act, particularly section 55.

The DPA bases everything around eight principles. Personal data should be: 1. Fairly and lawfully processed; 2. Obtained and processed only for one or more specified and lawful purpose; 3. Adequate, relevant and not excessive; 4. Accurate and up to date; 5. Kept no longer than necessary; 6. Processed in accordance with rights of data subjects; 7. Surrounded by appropriate security measures; 8. Transferred only to countries outside European Economic Area which ensure adequate levels of data protection. Section 55 is especially relevant to analytical and research work as it states a person should not knowingly or recklessly, without the consent of the data controller: • Obtain or disclose personal data or information contained in personal data; or, • Procure the disclosure to another person of the information contained in personal data. Unless: • It was necessary for the purposes of preventing or detecting crime; • It was required or authorised by rule of law or court or the person acted in reasonable belief that they had the right in law to obtain the material; • They would have had the consent of the data controller or in the particular circumstance, the obtaining, disclosing or procuring was justified as being in the public interest. Enforcement action can be taken against the data user. This can take the form of a prosecution of the Chief Constable and/or employee who was in breach of the Act.

28

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

LEGISLATION Analytical work must be undertaken in compliance with relevant legislation

Practical Tips

The Freedom of Information Act 2000 (FOIA) The FOI Act creates new rights of access to information. It will permit people to apply for access to documents, or copies of documents as well as the information itself. In simple terms it means that every written record is open to public scrutiny. The FOI Act: • Provides a right of access to recorded information held by public authorities; • Creates exemptions from the duty to disclose information; • Establishes the arrangements for enforcement and appeal.

• Liaise with freedom of information specialist within force.

• Continually be aware of requirement to share information.

• Ensure use of naming conventions is clear and complies with FOI.

Conditions need to be fulfilled before an authority is obliged to comply with a request, however, time limits are set. Circumstances are set out in the Act where the duties do not apply and information can be exempt. If an applicant is not happy with the response received, a request can be made to the Commissioner to decide whether the authority has acted in accordance with the provisions of the Act. Government Protective Marking Scheme (GPMS) GPMS was introduced to ensure that documentation is handled appropriately and given the correct authority levels. To do this, a system of classification is used: • Restricted; • Confidential; • Secret; • Top Secret.

• Ensure that all

Human Rights Act 1998 (HRA) The European Court of Human Rights issued Convention Rights which contain Articles. Those Articles of primary importance to the analytical community are: • Article 2 – The Right to Life: public authorities must not cause the death of any person; • Article 6 – The Right to a Fair Trial: this should take place within a reasonable time and in public unless certain conditions apply. Refers to a person being presumed innocent until proven guilty. Also looks at issues of trial by media; • Article 8 – Respect for Private and Family Life: public authorities may only interfere with someone’s private life where they have the authority to do so. Covers matters such as disclosure of private information, monitoring of employee’s phone calls, entering a person’s home.

• Familiarisation with

documents are labelled with the appropriate GPMS marking.

• Ensure that all documents are handled and stored according to GPMS.

the Act.

• Ensure the relevant authorisation has been given before any analytical work is undertaken.

• Liaise with the Compliance Unit.

• Consider JAPAN –

Each individual within a public authority is responsible for any breaches of the Act.

NOT PROTECTIVELY MARKED

THE START OF AN INVESTIGATION

TABLE 2 Legislation that Needs to be Considered by the Analyst (continued)

Major Incident Analysis Manual (Revised Edition)

is it Justified, Appropriate, Proportionate, Accountable and Necessary.

© ACPO Centrex 2006

29

TABLE 2 Legislation that Needs to be Considered by the Analyst (continued) LEGISLATION Analytical work must be undertaken in compliance with relevant legislation

Practical Tips

Intellectual Property (IP) Intellectual Property allows people to own their creativity and innovation in the same way that they can own physical property. There are four main types of IP: • Patents for inventions; • Trade Mark for brand identity; • Designs for product appearance; • Copyright for material (see above).

• Assure that the correct authority has been received before using IP information.

• Should be particularly considered when using open source data.

Intellectual Property Rights are essentially private rights. If someone infringes those rights, ie, uses material without permission where there is no rule of law that might make such use legal, it is generally right for owners to use remedies available under Civil Law. Permission should be sought from the IP owner before using their material. In some cases, it may be possible to use the IP without permission, ie, exceptions within copyright include limited use of work for judicial proceedings. Official Secrets Act 1911 and 1989 This Act prohibits the disclosure of confidential material from government sources by employees. All police employees sign up to this Act and it remains an offence if the Act is breached.

• Familiarisation with

Police and Criminal Evidence Act 1984 (PACE) This Act makes provisions in relation to police powers, police duties, persons in police detention, police discipline, evidence gathering and complaints against the police.

• Basic knowledge of

the Act.

Act may assist in understanding detained persons deadlines and police procedures.

The Serious Organised Crime and Police Act 2005 (see below) has streamlined police powers of arrest and search as set out in PACE. Regulation of Investigatory Powers Act 2000 (RIPA) The Act concerns itself with: • The interception of communications and the acquisition and disclosure of material relating to communications; • The carrying out of surveillance; • The use of Covert Human Intelligence Sources (CHIS); • The acquisition of the means by which electronic material protected by encryption or passwords may be decrypted or accessed.

• Liaise with intelligence manager and compliance unit, SPOC.

• Familiarisation with the Act.

The Act’s main purpose is to ensure that the relevant investigatory powers are used in accordance with HRA. Within analytical work it is vital to ensure that material being used in support of analytical products has been obtained by the correct means and with the relevant authority.

30

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

LEGISLATION Analytical work must be undertaken in compliance with relevant legislation

Practical Tips

Serious Organised Crime and Police Act 2005 The Act is aimed primarily at creating the Serious Organised Crime Agency (SOCA).

• Familiarisation with the Act.

It makes changes to existing legislation including Proceeds of Crime Act 2002 and PACE and covers issues ranging from protesting, arrests and cooperation with investigations.

4.3 GUIDANCE The following table provides a summary of a number of guidance documents that are available in the UK and National departments that may provide further guidance.

THE START OF AN INVESTIGATION

TABLE 2 Legislation that Needs to be Considered by the Analyst (continued)

TABLE 3 Guidance GUIDANCE There are a number of documents that should inform analytical work and research and include the following

Practical Tips

Analyst Training Courses All analysts should have undertaken foundation training, eg, National Intelligence Analysts Training (NIAT), Initial Analysis Training Course (IATC). The application of skills and techniques learnt on these courses can be applied in major incident situations. Course material is a good point of reference.

• Familiarisation with

Force Documents Internal force documents including the Control Strategy and Intelligence Requirement, along with the most recent Strategic Assessments for both force and BCU or equivalents, will provide an understanding of the main threats and emerging issues being faced at each level. They will also provide an idea of the intelligence that is required to fill the information gaps. Tactical assessments at both BCU and force level will give an understanding of the operational issues being addressed proactively. These documents may be of particular use when considering strategic issues around major crime.

• Awareness of local

Home Office Research, Development & Statistics Department (RDS) The role of this department is to manage research and collect statistics in a number of areas including crime, policing, justice, immigration, drugs and race equality. The internet website contains publications of work conducted, a business plan of future work and details of national statistics work being conducted. The list of subjects covered includes: asylum, gun crime, hi-tech crime, homicide investigations, immigration, organised crime, policing violence, serious crime, sexual offending, stranger rape investigation and terrorism.

• Visit the RDS website

NOT PROTECTIVELY MARKED

training material.

documents and current priorities.

Major Incident Analysis Manual (Revised Edition)

http:// www.homeoffice. gov.uk/rds

© ACPO Centrex 2006

31

TABLE 3 Guidance (continued) GUIDANCE There are a number of documents that should inform analytical work and research and include the following

Practical Tips

Major Incident Analysis Manual (MIAM) 2005 This manual provides extensive guidance, advice and good practice on: • Utilising analysis and research within major incidents; • The role of the Analyst and researcher; • The vital stages of the intelligence process; • General tips and advice for analysts, researchers, analysts managers and SIOs. This is a live document and will be continually updated with good practice.

• Use specific sections

Major Incident Room Standardised Administrative Procedures (MIRSAP) MIRSAP outlines the roles of the Analyst and Researcher within a major investigation and provides advice on the application of the HOLMES 2 system in major incidents.

• Read MIRSAP.

Murder Investigation Manual (MIM) The MIM outlines good practice in relation to the use of analysts.

• Read the MIM.

as required.

• Obtain the most recent version.

• Obtain the most recent version. National Intelligence Model (NIM) As part of the Police Reform Act 2002, all police forces in England and Wales were required to implement the National Intelligence Model to minimum standards by April 2004. Further minimum standards (version 2) have now been published. All police forces in England and Wales have an implementation date of November 2005.

32

NOT PROTECTIVELY MARKED

• Know the

Major Incident Analysis Manual (Revised Edition)

intelligence and analytical products.

© ACPO Centrex 2006

SECTION 5

Section 5 THE INTELLIGENCE CYCLE

T

he key stages within the Intelligence Cycle are introduced in this section of the manual. This is a process that develops information into intelligence to support and inform decision making. CONTENTS 5.1

The Intelligence Cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

33

5.1 THE INTELLIGENCE CYCLE The Intelligence Cycle is a method of processing material in order that it can support and inform decision making. The Intelligence Cycle is a cyclical and sequential process that allows information to be developed into intelligence. The NIM uses this process in directing police resources from a prevention, intelligence and enforcement perspective. This process can also be applied when supporting SIOs in major incidents. FIGURE 1 The Intelligence Cycle

Direction

Dissemination

Collection

Analysis

Collation

Evaluation

In the context of major incidents, the Intelligence Cycle elements can be defined as follows:

34

Direction

The initial task or objective.

Collection

Gathering of information from all material sources to support the task or objective.

Collation

The organisation of material in a meaningful format.

Evaluation

The consideration of relevant material; assigning of value to information; inclusion of material to support an initial task or objective.

Analysis

The drawing of conclusions and inferences with recommendations and intelligence gaps highlighted.

Dissemination

The method of communicating the results of the intelligence process.

Direction

The change or continuation of a line of enquiry, strategy or similar, depending on the results of the intelligence process.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

Additionally, the evaluation stage may occur independently. The generation of hypotheses through brainstorming processes can be a catalyst for the start of a new cycle. The Analyst and Researcher can add value to the process of testing hypotheses against evidence.

THE INTELLIGENCE CYCLE

While this is a sequential process, some elements may occur out of sequence. For example, collection of material is likely to be an ongoing process and, therefore, may continually interrupt the cycle. A new piece of collected data may require immediate collation and evaluation. The order of subsequent intelligence cycle stages is not altered by this. The need to continually collect and collate emphasises the importance of the researcher role. Where the Researcher can support the Analyst through continual collection and collation, the Analyst can progress the evaluation and analysis stages, using timely information to inform their work.

Applying this intelligence-led process to major incidents will result in them being better focused and cost effective. The following sections represent the elements of the intelligence cycle within a major inquiry and guidance is provided as to the detailed role of the Analyst and Researcher within each of these stages.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

35

36

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

SECTION 6

Section 6 DIRECTION

T

his section describes the direction phase of the Intelligence Cycle. It specifically refers to the methods by which analysts and researchers should be tasked; the importance of clear, accurate and specific tasking that is aligned to the SIO’s objectives and, therefore, how analysis is generated. The issues surrounding the use of Terms of Reference and the SIO’s Policy File to ensure analysts are being used correctly, and the generation of further actions through analysis are also discussed. CONTENTS 6.1 6.2 6.3

The Direction Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Terms of Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Actions and HOLMES 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.1 Tasking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.2 SIO’s Policy File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.3 Proactive Generation of Tasks through Analysis . . . . . . . . . . .

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

38 38 39 39 39 40

© ACPO Centrex 2006

37

6.1 THE DIRECTION PHASE The direction phase involves setting tasks and actions at both the strategic and tactical level. The effective tasking of analysts is a key factor in the success or otherwise of analytical products produced during a major incident. The lack of clarity and detail of tasking often means that the Analyst has a lack of understanding with regards to the objectives of the analysis. This can result in the production of analytical products that do not address the SIO’s requirements. The establishment of terms of reference for analyst work is, therefore, fundamental to the provision of effective analytical support.

6.2 TERMS OF REFERENCE The Analyst should discuss the exact requirements and objectives of the analysis with the SIO and agree initial Terms of Reference. The Analyst Manager may be involved in this process. When discussing Terms of Reference the SIO and the Analyst should consider each issue or line of enquiry and decide the best analytical product to address it. It is essential that the provision of analytical products is aligned to the SIO’s objectives. Products should also be described in terms of the NIM analytical products. The Analyst should also advise the SIO on issues such as viability and timescales and assist the SIO to prioritise the most productive analytical course of action. The SIO must balance the need for a rapid response with the need to consider the best product available. Only the SIO (or Deputy SIO, Senior/Lead Analyst) should be authorised to task the Analyst. This will ensure that analytical work is properly focused to the objectives of the investigation. Regular reviews should be carried out to ensure the work of the Analyst remains focussed and the Terms of Reference should be updated as the investigation proceeds and new analyst tasks are raised. Dependant on the length of the enquiry, it may be advisable for the Senior/Lead Analyst to establish a timely meeting structure with the SIO to conduct these reviews. Examples:

Appendix 1 – Terms of Reference 1

The Analyst Manager may wish to develop a more detailed strategy that will enable them to track work flows and ensure that material is delivered in an efficient and coherent manner.

38

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

DIRECTION

6.3 ACTIONS AND HOLMES 2 6.3.1 TASKING The Analyst should receive a written action prior to commencing analytical work. This will avoid duplication and prevent compromising other aspects of the investigation. Given the Analyst’s role within the management team, the SIO (or Deputy SIO in their absence) will often allocate actions directly to the Analyst. The Researcher may have discrete research tasks which are defined through Actions, however, they may also have a supporting role to the Analyst and may then work on specific tasks to facilitate the analysis. In either case these Actions should be recorded. All Actions should be recorded on HOLMES 2 so that they can be audited and reviewed at a later date. There may be occasions where operational necessity makes it impractical to issue a HOLMES 2 Action prior to starting analytical work. In this situation the analytical tasking should be recorded accurately and always followed up retrospectively with an action on HOLMES 2. In the case that an investigation is not recorded on HOLMES 2, a paper tasking system should be maintained via the MIR, allowing for all actions and other material to be clearly audited. The Analyst and Researcher should seek further clarification regarding Actions, where necessary, and must not be afraid to negotiate the task in order to ensure an appropriate product is produced. This should be done in consultation with the SIO and can take place prior to Actions being recorded on HOLMES 2.

6.3.2 SIO’S POLICY FILE The SIO’s policy file should document the appointment of the Analyst and detail the Terms of Reference agreed between the SIO and the Analyst. The policy file should indicate the main lines of enquiry or decisions that analysis has contributed towards. The Analyst’s recommendations and subsequent actions taken (or not) should be clearly recorded in the policy file. They should also be recorded in the Analyst’s notebook/rough book as well as the report detailing the analysis. The policy file should be periodically reviewed to ensure that any changes are reflected in the analysis to maintain links to the lines of enquiry. The policy file is a point of reference for the Analyst enabling them to see the SIO’s decisions and ensure that their analytical product reflects accurately the SIO’s strategy. It will also contain details of the intelligence and analytical strategy adopted, together with the SIO’s prioritisation of lines of enquiry.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

39

6.3.3 PROACTIVE GENERATION OF TASKS THROUGH ANALYSIS In line with the Analyst’s and Researcher’s role profiles every postholder is expected to be able to apply innovative thought processes. The generation of new approaches to analysis and research will enhance the delivery of analytical support to the SIO. The Analyst and Researcher should apply their initiative and negotiation skills when discussing the scope of their work with the SIO and throughout the inquiry. All self-generated tasks should be discussed or negotiated with the SIO and recorded in the same manner as directed tasks.

40

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

SECTION 7

Section 7 COLLECTION

T

he collection phase of the Intelligence Cycle is covered in this section of the manual. Explanations of open and closed data sources are provided along with extensive examples of other useful data sources within these categories. The importance of evaluating the reliability and validity of this information is discussed along with the need for effective document and information management. The issue of exhibit handling is also examined with emphasis given to the importance of adhering to strict rules when handling exhibits. CONTENTS 7.1 7.2

7.3 7.4 7.5 7.6

7.7 7.8

The Collection Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Closed Data Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.1 HOLMES 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.2 Force Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.3 Police Departments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.4 Outside Contacts (National) . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.5 Outside Contacts (Local) . . . . . . . . . . . . . . . . . . . . . . . . . . . . Open Data Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.3.1 Evaluating Open Data Sources . . . . . . . . . . . . . . . . . . . . . . . . Schedules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Note Taking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Storage and Document Management . . . . . . . . . . . . . . . . . . . . . . . . 7.6.1 Physical Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.6.2 Electronic Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exhibit Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Scene Visits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

42 42 42 46 49 50 56 57 60 60 61 62 62 62 63 64

© ACPO Centrex 2006

41

7.1 THE COLLECTION PHASE The Murder Investigation Manual stipulates that: ‘…analysts should be allowed unfettered access to investigative material’ and ‘…should enjoy the full confidence of the SIO.’ ACPO (2000) Murder Investigation Manual

The collection of all material is essential to an investigation and the Analyst and Researcher should actively seek further data sources ensuring SIO awareness. While the Analyst will predominately handle material that has been collected by others and is going through the HOLMES 2 system, there may be data sources that are generated through analytical work and research. Such material should be immediately directed to the MIR and logged accordingly. Where an analyst is directly involved in purely covert intelligence analysis, the sterile corridor should be maintained and the Analyst should not be party to the raw collected product. The collection process will involve both open and closed data sources:

• Closed source data is that which is not readily available. This is often contained within specific databases or systems within the law enforcement and multiagency environments; • Open source data is that which is available to any member of the public. This can be in both paper and electronic format.

7.2 CLOSED DATA SOURCES Within a major investigation, closed source data will often represent the primary material used by analysts and researchers. Key systems, for example HOLMES 2, will contain the material supporting the investigation. Additionally, such systems may also highlight other data sources that are held elsewhere, for example exhibits, CCTV footage and documents. It should be noted that not all major inquiries are recorded and managed on HOLMES 2. Paper systems will sometimes be used, depending on the nature and scale of the inquiry. In this situation, the HOLMES 2 naming conventions will still apply.

7.2.1 HOLMES 2 The HOLMES 2 system links each of its data source elements thereby allowing the Analyst and Researcher to link to other records while in one data source. It is important that the Analyst and Researcher receive sufficient training on the HOLMES 2 system. The most common Closed Data Sources are in Table 4.

42

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

COLLECTION

TABLE 4 HOLMES 2 Closed Data Sources HOLMES 2 Data Source

Features

Actions

Denoted as A1, A2, A3, etc An Action is a written instruction to carry out a task. They are generated from information gathered during the investigation. Actions are raised once authorised by any of the following: • SIO; • Deputy SIO; • Office Manager; • Receiver; • Document Reader. Actions will detail the specific course of action, who it has been allocated to and its provenance. These may help to identify previous courses of action and, therefore, inform the Analyst’s recommendations as to future courses of action.

Category Index

This index is used to record a wide range of information which will not fit into any of the other indexes. Creating category records requires a structured approach in order to assist the retrieval of material. Sub-indexes are also used to deal with information regarding scene(s), victim(s) and suspect(s).

Documents

Denoted as D1, D2, D3, etc. Documents may be items such as copies of exhibits, letters, police rough books. They may be held in HOLMES 2 in full or referenced as a description.

Electronic Transmission

Denoted as T1, T2, T3, etc. Electronic transmissions, such as faxes and emails, can be registered to any index.

Exhibits

Denoted as X1, X2, X3, etc. It is also possible to search on HOLMES 2 via the Witness Reference field. This contains the initials of the person producing the exhibit and a sequential number based on how many exhibits they have produced, eg, KFS/2. In most circumstances, exhibits will be held in a secure store managed by an appointed officer. HOLMES 2 will contain a description of the exhibit. Regulation around handling of exhibits should be adhered to.

House-to-House (HtoH) HtoH questionnaires are given a number by the HtoH coordinator and Questionnaires are not automatically numbered by the HOLMES 2 system. The HtoH questionnaire is registered to the nominal record of the person interviewed.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

43

TABLE 4 HOLMES 2 Closed Data Sources (continued) HOLMES 2 Data Source

Features

Interviews

Denoted as Y1, Y2, Y3, etc. Letters after the number, Y1a, will indicate further interviews by the same nominal. Interviews are a record of an interview with a person, either a suspect, victim or witness. They can be: • Audio taped; • Video taped; • Written contemporaneous notes. They are registered to the person interviewed and always registered to the nominal index. The original tapes or videos will be held as exhibits.

Location Index

This index contains records of locations that come to notice during the investigation. A location can be a property, street, postcode or any other specified location. This can include: • Addresses of persons in the nominal index; • Streets in which enquiries have been made or will be made; • Reference to any location referred to in documentation. Unknown streets can also be recorded.

Messages

Denoted as M1, M2, M3, etc. Messages can contain a variety of information such as initial reports from the public and witnesses that enter the MIR via telephone, verbally or officer’s information. Messages can be registered to any of the indexes on HOLMES 2.

Nominal Index

Denoted as N1, N2, N3, etc. Anyone who comes to notice during the investigation will be recorded on the Nominal Index. They will be either: • The author of a document; • Have been referred to in a document. This means that nominals can be: • Identified – where surname/family name is known; • Unknown – where only forename or nickname is known; • Unidentified – where only a description is known. Where known, full descriptive factors will be detailed. This may help when carrying out, for example, subject profile analysis, network analysis.

Organisation Index

44

NOT PROTECTIVELY MARKED

This index is structured in an identical manner to the category index. This index may be used to record the structures of organisations and may be particularly useful, for example, during fraud investigations.

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

COLLECTION

TABLE 4 HOLMES 2 Closed Data Sources (continued) HOLMES 2 Data Source

Features

Personal Descriptive Form (PDF)

The PDF is given a unique reference number, the next consecutive number, prefixed by the letter P, eg, P3. Letters after the number, P3a, will indicate further PDFs relating to the nominal. The PDF is designed to record personal details. This includes the description of an individual, details of vehicles owned or used and types of convictions recorded where appropriate. The PDF is always registered to the person to whom it refers and is registered to the nominal index.

Questionnaires

Questionnaires are used for a variety of purposes such as stop checks or reconstructions. They will be registered to the person subject to the questionnaire and always registered to the nominal index. The unique reference number will be the next consecutive number prefixed by the letter Q and a code for that particular type of questionnaire, eg, a stop check questionnaire may be preceded by the code STOP and so the number would be QSTOP1.

Reports

Denoted as R1, R2, R3, etc. Letters after the number, R1a, will indicate further reports by the same nominal. Reports detail information from police officers or police staff that is not contained within a statement, for example, an officer’s notes regarding specific aspects of the inquiry. It is normally registered to the author and therefore registered to the nominal index.

Sequence of Events

This index allows the recording of pertinent events in chronological order, enabling events to be grouped into themes or timelines.

Statements

Denoted as S1, S2, S3, etc. Letters after the number, S1a, will indicate further statements by the same nominal. Statements are registered to the person who provides the statement and always registered to the nominal index.

Telephone Index

This index contains records of telephone numbers and extensions that come to notice during the investigation. They may be landline, mobile, telephone kiosks or pagers. The index can also detail complete, part or unidentified numbers. Telephone numbers can be searched, using both partial and full details. This will highlight, for example, documents, nominals and addresses that the number is linked to.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

45

TABLE 4 HOLMES 2 Closed Data Sources (continued) HOLMES 2 Data Source

Features

Vehicle Index

This index contains records of vehicles that have come to notice during the inquiry. They will be vehicles either owned or used by a nominal or referred to in documentation. Vehicle records may be a complete Vehicle Registration Mark (VRM), part VRM or identified only by description. Where only partial or no details of a VRM are known, the vehicle is given a ‘Unident No’. Both this and partial index numbers can be searched on. The index can also include details of farm or plant machinery. Full descriptive factors will often be detailed including VRM, make, model, body type, description, colour and engine and VIN number where known.

7.2.2 FORCE SYSTEMS A number of systems exist which all forces have access to providing closed source data on a variety of topics including nominals, vehicles, addresses, forensic information and property. Table 5 details some of the most common closed data sources available within forces. This list is not exhaustive. The following systems relate to UK policing. TABLE 5 Force Systems Closed Data Sources

46

Data Source

Features

Automatic Number Plate Reading (ANPR) Intelligence

ANPR technology records vehicle registration details that are captured when vehicles pass by ANPR cameras. These can be fixed or mobile units, and can be deployed as a result of a major incident to specific locations. ANPR have a live link to PNC and a variety of databases feeding in. The majority of forces store ANPR data for a period of time, therefore, this information can be explored.

Child Protection Records

These are often held separately because of the sensitive nature of the material. Separate databases or paper systems may be used by forces. Details recorded may include a history of offences against children, suspect and offender details, home addresses.

Communications Data

Communications data may include telephone and/or internet usage by nominals. This material will arrive in various formats and is usually service provider specific. Occasionally, this data may only be available in paper format. Such information may not always be available as legislation such as RIPA and ECHR needs to be adhered to. Consideration also needs to be given to whether the material is in an evidential or intelligence format. Such material can be used to support the majority of analytical products. Communications data is continually changing. The material that each service provider can supply is often different and retention periods can vary dramatically, being very short under some circumstances.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

COLLECTION

TABLE 5 Force Systems Closed Data Sources (continued)

Data Source

Features

Communications Data (continued)

Early communication must, therefore, take place with the Single Point of Contact (SPOC) who can provide, for example, up-to-date advice on what material can be obtained, how it can be applied for, retention periods and sensitivity. Regular communication is also essential, once the material has been received, between the SPOC, Telephone Liaison Officer (TLO) and Analyst. These parties can provide advice on what is included (and, therefore, what is excluded) and interpretation issues.

Crimelink (previously known as Comparative Case Analysis (CCA))

Crimelink is an intelligence and analytical tool used for the identification of cross-border crime series. Crimelink relates specifically to crime types not covered by SCAS (SCAS crime types are: murder, kidnap, abduction, rape and series of sexual offences). It allows forces to input detailed accounts of crimes, in line with their regional Control Strategies and force requirements. The system is based on a keyword principle and forces will have dedicated Crimelink Researchers/Analysts trained to research the system.

Crimes

These can provide details of the crime being investigated and other linked offences. The Analyst or Researcher may undertake an exploration of historical data to look for previous or pre-cursor crimes.

Custody Records

All police forces retain records of arrests and detained persons. These are often a mixture of paper and electronic documents. They will contain a number of details including name, address, DOB, arrest details, crime record numbers, custody log, DNA, any property details, bail and court details, charges and vehicles.

Financial Data

Financial data may include transactions from accounts including those relating to an identified nominal or from a company or an ATM machine. Financial material is obtained via a court order in line with legislation. Advice should be sought from the relevant departments when using such data, eg, Economic Crime Unit, Fraud Unit, Financial Investigators. Such material can be used to support the majority of analytical products. Credit reference agencies such as Experian and Equifax can provide an indication that a person or business has made an enquiry to a finance company. In some circumstances, account numbers can be obtained.

Forensic Intelligence

This will provide information from a scene of crime or a material person. Such information may be useful when analysing links between nominals and nominals to locations and vehicles.

Incidents

These can provide details of the initial incident being investigated and other linked incidents. This may be described as the initial call log and may provide details of witnesses or lines of enquiry. The Analyst or Researcher may explore historical data to look for previous or pre-cursor incidents.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

47

TABLE 5 Force Systems Closed Data Sources (continued)

48

Data Source

Features

Intelligence

Intelligence refers to information that has been sanitised and evaluated using the 5x5x5 system and is held on force and other organisational intelligence systems. This can provide information about, for example, nominals, vehicles and addresses within an investigation. The Analyst, whether dealing with evidential or covert material, will find access to such information beneficial. Each item should be evaluated accordingly.

National Method Index

This database is maintained by the Metropolitan Police Service and can provide details of persons convicted of offences where the method of the offence and/or whose personal description is distinctive or unusual. Details are recorded in relation to the MO, personal descriptive factors, speech, areas of operation and addresses.

Photographs

All forces hold photographs of nominals for both evidential and intelligence purposes.

PNC

PNC records can provide details of nominals, vehicles and stolen property (firearms, plant, machinery and animals) that are connected to the inquiry. Nominal records provide a wide range of information including offending and custodial history, aliases, associates and descriptions. Vehicle records provide details such as registered owners and insurance. It is essential that users adhere to PNC regulations.

Stop and Search (All Stops)

These records provide details of persons and vehicles that have been stopped and searched under police legislation. Within a major inquiry, this may provide information on persons and/or vehicles that were in specific locations at specific times.

VODS and QUEST

These are enhanced applications linked to PNC. VODS (Vehicle Online Descriptive Search) allows users to search large sets of vehicle data where specific details are unknown, ie, full index number. QUEST (Query Using Extended Search Techniques) allows users to search for nominals using descriptive terms where specific details are unknown, ie, full name.

#TE

The #TE (Transaction Enquiry) is available via PNC. It provides details of what, where and why in relation to any known PNC transaction. The #TE will retrieve all cases (in specific time period) where a vehicle has been checked by an officer, providing details of that officer so they can be contacted for further clarification.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

There are a multitude of police departments that can provide valuable information to major investigations. Table 6 provides details of some of these departments. This is not an exhaustive list and some police forces may have other departments which are not mentioned below. It is suggested that analysts and researchers familiarise themselves with the different departments within their own force.

COLLECTION

7.2.3 POLICE DEPARTMENTS

The following departments relate to UK policing. TABLE 6 Police Departments’ Closed Data Sources

Data Source

Features

Aliens Department

The Aliens Department is available to provide information about Aliens, particularly Non EU nationals, who are registered either with them or with the Home Office. They can provide background information regarding marital status, addresses, arrival and departure dates and work details of those in possession of a permit.

Central Ticket Office

Information is held on the Central Ticket Office (CTO) computer relating to Home Office Road Traffic (HO/RT) documents, fixed penalty tickets, vehicle defect rectification notices and speed cameras issued by police officers, traffic wardens and police support staff. Details can be obtained from this department relating to names, vehicles, locations events and cheques.

Prison Liaison

Police forces have created liaison officers throughout the country with responsibilities for prisons located in the force area. It would be advisable to contact the force’s prison liaison officer to establish what information may be available.

Road Policing Unit/ Strategic Roads Unit

Road policing units may record details of vehicles and people involved in road traffic collisions. The road policing departments may also have access to ramp data. This provides information on vehicles passing through safety camera zones that are on motorways or in speed controlled areas, such as road works. As well as vehicle details, it may be possible to obtain photographic images which may assist in identifying individuals or vehicle damage for example.

Safety Camera Unit

The Safety Camera Unit holds data on speeding infringements. These can be permanent or mobile units. While the data is held to enforce speeding penalties, data held can also be mined for intelligence. Additionally, photographic images are held and can provide useful leads.

Sex Offenders Unit

The Sex Offenders Unit has a responsibility for monitoring the activities of registered sex offenders.

Special Branch

Special Branch units hold largely sensitive data relating to issues of national security. Data is usually held on separate systems and access would, therefore, need to be negotiated and integrity maintained.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

49

7.2.4 OUTSIDE CONTACTS (NATIONAL) Nationally, there are a multitude of departments and agencies that hold information potentially relevant to major inquiries. Some of these departments may form part of wider organisations while others are independent bodies. Familiarisation of the work and data held within each contact is suggested. Table 7 contains information of some of the most common national outside contacts. This is not an exhaustive list. The following national outside contacts relate to UK law enforcement. TABLE 7 National Outside Contacts Closed Data Sources

50

Data Source

Features

Academic Institutions

There are a number of academic institutions that may be able to provide information or research, for example: • The Centre for Investigative Psychology (Liverpool University); • Department of Criminology (Leicester University); • The Henry Fielding Centre (Manchester University); • Institute of Criminology (Cambridge University); • The Jill Dando Institute of Crime Science (University College London).

BADMAN

BADMAN stands for Behavioural Analysis Data Management AutoIndexing Networking. It is a database that is maintained by Surrey Police Behavioural Science Section. The database contains national and some international cases of rape. The system primarily uses coding definitions to identify components of behaviour, circumstances, characteristics of the event, victims and offenders and can be used to identify possible similar crimes and/or suspects.

Benefits Agency – Organised Fraud Investigation Section

This unit investigates organised and systematic abuse of the Social Security claims and payments systems. Activities include the use of stolen, manipulated and counterfeit payment material, as well as the use of false identities to make multiple fraudulent applications for benefits.

Bramshill Library

Bramshill Library is located at Bramshill, Hampshire. The library holds a vast amount of material relating to all aspects of law enforcement. The library is free for all police officers and police staff to join, and provides a postal service.

British Transport Police (BTP)

BTP is the national force for policing the rail network, London Underground and Docklands Light Railway. BTP has regional offices that can be useful contacts.

CATCHEM

CATCHEM stands for Centralised Analytical Team Collating Homicide Expertise and Management. It is a database that holds information on abductions and murders of females under 22 years of age and males under 17 years of age since 1960. The database is maintained by the NCPE.

Congestion Charges (Transport for London)

Transport for London deal with the processing of congestion charge payments and registration of vehicles that are exempt. Vehicles are captured entering and leaving the congestion charge area and this information is stored.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

COLLECTION

TABLE 7 National Outside Contacts Closed Data Sources (continued)

Data Source

Features

Counterfeit Currency Unit

The Counterfeit Currency Unit is part of NCIS, based in London. All counterfeit currency or suspect counterfeit currency is sent to them from police forces. The unit looks, for example, at trends, links and types of note. They work closely with the Bank of England and receive all counterfeit notes for destruction.

Credit Reference Agencies

There are a number of credit reference agencies that can provide a range of details on individuals, limited and non limited companies and vehicles. Their services include: business information services, direct marketing services, ID verification and fraud prevention services and consumer credit data services. These agencies include Dun & Bradstreet who specialise in business information and Experian and Equifax who provide information on a wider range of topics including consumer and business information, vehicle information and direct marketing services.

DVLA

The DVLA (Driver Vehicle Licensing Agency) holds the central database for vehicle registration and driver details. The police can carry out enquiries with the DVLA through the use of postal forms. Enquiries are mainly for new keeper details not shown on PNC and historical previous keepers of vehicles.

Europol

Europol is the European Union Law Enforcement Organisation. Its mission is to assist law enforcement authorities of Member States in preventing and combating terrorism, unlawful drug trafficking and other serious forms of international organised crime.

Forensic Intelligence Bureau (Forensic Science Service (FSS))

The Forensic Intelligence Bureau is a department within the FSS that provides the following services: • Familial searching – this includes either parent/child searches or sibling searches where the National DNA database has not matched any profile currently held; • Ethnic inference – this is used to give some indication of a person’s ethnicity; • National Firearms Forensic Intelligence Database (NFFID); • Intelligence-led screens – using a crime stain and matching a prioritised group of individuals who provide DNA samples on a voluntary basis; • Pendulum List Searching (PLS) – this is a software program that can be used to interpret DNA mixtures, where two people’s DNA has mixed; • Partial crime stain profile service – this service is provided in cases where a crime stain has produced a partial DNA profile that is not suitable for loading on to the National DNA database. Potential matches from the national database are refined using scientific analysis. This list may be further refined using geographical restriction; • Rare Allele Mapping – some alleles are classified as rare according to their frequency among the population. Where a crime stain profile contains a rare allele and has not produced a match to an individual on the DNA database, rare allele mapping can be used to determine the distribution of this allele throughout England and Wales; • Mitochondrial DNA and Y-STR profiling – the techniques use the inheritance of characteristics of different DNA elements, and can be used to eliminate potential relatives identified through familial searching.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

51

TABLE 7 National Outside Contacts Closed Data Sources (continued)

Data Source

Features

Forensic Science Systems

There are a number of national and local systems that contain information relating to forensic intelligence and evidence. These include: • The National DNA Database (NDNAD) holds records of all persons and scenes where DNA has been taken. As DNA is recovered, it is automatically checked against outstanding persons and scenes; • The National Automated Fingerprint Identification System (NAFIS) contains details of persons who have had their fingerprints taken. Lifts taken from scenes of crime can be compared to this database. Locally, all forces will have records of forensic marks from scenes, including footwear.

HM Revenue & Customs (HMRC)

HMRC is responsible for collecting the bulk of tax revenue, paying tax credits and child benefit and strengthening the UK’s frontiers. They deal with: • Income, corporation, capital gains, inheritance, insurance premium, stamp, land and petroleum revenue taxes; • Environmental taxes; • VAT; • Customs duties and frontier protection; • Excise duties; • National Insurance; • Tax Credits; • Child benefit and child trust fund; • Enforcement of the national minimum wage; • Recovery of student loan repayments. HMRC will provide information they hold on persons suspected of, or having committed, offences within their jurisdiction.

52

HOLMES and HOLMES 2 Previous Incidents

There will be many incidents held on HOLMES and HOLMES 2 that should be continually considered for data mining information, including intelligence.

Immigration and Nationality Directorate (IND)

The IND are part of the Home Office and are responsible for immigration control, managing immigration in the interests of Britain’s security, economic growth and social stability. The IND work in the areas of: • Immigration – consider applications from people who, for example, want to come to the UK to work, to conduct business or settle; • Nationality – consider applications from people who wish to become British citizens; • Asylum – determine applications from asylum seekers as well as removing people from the UK when their claims fail; • Border control; • Law enforcement – enforcement of immigration laws as well as forming them; • Appeals – fast and efficient processing of appeals made against IND decisions.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

COLLECTION

TABLE 7 National Outside Contacts Closed Data Sources (continued)

Data Source

Features

Inland Revenue Special Compliance Office

This department undertakes criminal investigations on behalf of the Inland Revenue. Consideration should be given to providing them with any information that suggests a person may have evaded the payment of revenue, either in the form of income tax or employee contributions.

Interpol

Interpol aims to provide a unique range of essential services for the law enforcement community to optimise the international effort to combat crime. It provides three core services: • A unique global police communication system; • A range of criminal databases and analytical services; • Proactive support for police operations throughout the world.

Land Registry

The Land Registry holds details of the owners of residential property throughout England and Wales. Under an authority and with payment of a fee, it is possible to find out all properties owned by a particular person or the historical ownership of particular properties.

Malicious Communications Service (MALCOMS)

This service is provided by the Forensic Science Service. It compares malicious communications such as anonymous letters, emails, text messages and graffiti against a national selection with the aim of linking crimes.

Ministry of Defence (MOD) Police

This is a statutory civil police force with particular responsibility for the security and policing of the MOD environment. It provides and contributes to the physical protection of property and personnel within its jurisdiction.

National Centre for Policing Excellence (NCPE), Operations Helpdesk

Access is available via this helpdesk to a database containing a list of experts, accredited behavioural scientists, statistical profiles and details of SIOs with experience gained during their career. Support is also available from psychologists, forensic scientists and other specialists.

National Crime Squad (NCS)

The remit of the NCS is to tackle serious and organised crime. It is at the forefront of establishing partnerships with international law enforcement agencies as well as supporting domestic UK forces. NCS works closely with NCIS, HMRC, UKIS and the Home Office, as well as international partners across Europe and the rest of the world. In 2006, NCS will become part of the new Serious Organised Crime Agency (SOCA).

National Criminal Injuries Database

The NCPE maintain this database. The database is mainly focused towards the victim, analysing both the scene and the victim’s wounds. It identifies specific injury patterns caused by a variety of weapons and covers homicides and suspicious deaths since 1992.

National Criminal Intelligence Service (NCIS)

NCIS is a non-departmental public body. Its functions are to: • Gather, store and analyse information in order to provide criminal intelligence; • Provide criminal intelligence to police forces in the UK, the National Crime Squad (NCS) and other law enforcement agencies; • Act in support of such police forces, PSNI, NCS and other law enforcement agencies carrying out their criminal intelligence activities. NCIS will become part of SOCA planned to start work in 2006.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

53

TABLE 7 National Outside Contacts Closed Data Sources (continued)

54

Data Source

Features

National Firearms Forensic Intelligence Database (NFFID)

The NFFID is based within the Forensic Science Service – Forensic Intelligence Bureau. NFFID comprises of two separate computer databases. The first is an information database that allows information from weapons and ammunition to be collected, interrogated and interpreted in one central point. It holds detailed records including types of weapons, makes, models and calibre along with incident data. The second part is an automated system that can compare components of fired ammunition from outstanding crimes and recovered weapons. It operates by suggesting a list of possible matches, either crime-to-crime or gun-to-crime.

The Police National Missing Persons Bureau (PNMPB)

The PNMPB was formed in 1994. It is Home Office funded and staffed by police staff based at New Scotland Yard. The Bureau is for the use of all UK police forces. It maintains a computerised database of missing persons reported to the police, and unidentified bodies and persons.

Post Office Security and Investigation Service

This service deals with, or assists the Police Service and other law enforcement agencies with, all aspects of security and criminal investigations affecting the Post Office and the Department of National Savings. The Royal Mail and Post Office Counters Ltd., however, maintain their own self-supporting security and investigation units. Facilities that are available with the appropriate request are to: • Redirect mail checks to identify the new address of customers; • Check, for a period of twelve days, the mail delivered to particular addresses with a view to identifying the recipient and sender; • Identify the owners of PO boxes; • Provide details of telephone calls from Post Office premises; • Identify the address corresponding to postcodes; • Identify the Post Office code on Giro cheques; • Provide information on Post Office employees.

Royal Air Force (RAF) Police

The Royal Air Force Police are responsible for criminal investigations, counter terrorism and counter intelligence activities, and general police matters that affect the RAF.

Royal Military Police (RMP)

This is the Army’s police force and their role is to police the armed forces at home and overseas, in peacetime and when at war.

Royal Naval Service Police (RNSP)

This is the Navy’s police force and their role is to police the Navy forces at home and overseas, in peacetime and when at war.

SDC1(2)/(3)/(4) Homicide Consultation

In addition to the SCAS database, the Metropolitan Police Service maintain a database of serious offences.

Serious and Organised Crime Agency (SOCA)

SOCA is due to start work in 2006. It will be amalgamation of NCIS, NCS, HMRC and the UK Immigration Service. It will provide a specialised and relentless attack on organised crime. SOCA will be instigated as part of the Serious Organised Crime and Police Act 2005.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

COLLECTION

TABLE 7 National Outside Contacts Closed Data Sources (continued)

Data Source

Features

Serious Crime Analysis Section (SCAS) Database

The SCAS database is maintained by the NCPE Serious Crime Analysis Section who act in a consultative manner and have a national remit to carry out work on behalf of forces on cases falling into set criteria. This includes the following crime types: • Murder with a sexual element; • Rape and serious sexual offences; • Abduction. Police forces are required to submit all offences that fall within these criteria to SCAS. This role is carried out by Contact Officers in each force who coordinate the gathering of papers in relation to a case. The information within these papers is entered on to the system in the form of a comprehensive questionnaire, and the Analysts use their experience to search the database for similar offences. SCAS analysts produce a report for each case analysed which includes: • An interpretation of the behaviour displayed within the offence in order to – enhance the Investigating Officer’s understanding of the significance of the behaviour, eg, statistical rarity or relationship between behaviour, and to – provide some parameters for searching of in-force systems; • Details of similar offences which the Analyst believes could potentially have been committed by the same offender; • Further analytical recommendations which may benefit the investigation.

Stolen Vehicle Intelligence

Stolen Vehicle Intelligence have access to various computer and manual databases and contacts with the motor trade including manufacturing, salvage and repair organisations, insurance companies, loss adjusters, credit agencies and the DVLA. Manual databases include details of locations of identification numbers on vehicles and vehicle valuation guides, along with equipment that can reveal the presence of electronic tagging devices. Computer databases available are Motor Insurers Anti-Theft and Fraud Register (MIATFR), Hire Purchase Information System (HPI) and Experian.

Truck Pol

Truck Pol is run by the Metropolitan Police Service. It was established to coordinate and disseminate information, nationally, about truck crime including crime trends, hotspot locations, series, Modus Operandi (MOs) and known nominals. Each force has a single point of contact located within their Force Intelligence Bureau.

UK Passport Service (UKPS)

The UKPS is an executive agency of the Home Office that issues UK passports to British Nationals living in the UK.

ViSOR

Violent and Sex Offenders Register – a national database with local interface.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

55

7.2.5 OUTSIDE CONTACTS (LOCAL) Table 8 provides details of local contacts outside the Police Service that may hold data relevant to major investigations. This is not an exhaustive list. The following relate to UK local agencies. TABLE 8 Local Outside Contacts Closed Data Sources

56

Data Source

Features

Ambulance Data

The Ambulance Service records details of locations of all calls, along with the initial nature of the call. Most ambulance data tends to be limited as it is primarily focussed on casualty reduction.

CCTV (local systems)

CCTV footage may be used to identify nominals within specific locations at specific times. It can support incident analysis and generate further lines of enquiry.

Education Authorities

Local authority education departments are required to keep records relating to pupils and students attending schools and colleges in their area. Details are likely to include: name, address, parent’s name and address if different from the pupil’s, contact in case of an emergency and some medical record information. There may also be details of a pupil’s school record, for example, exclusions from school.

Fire Service

The Fire Service covers force areas. Details they hold that may be of use in investigations include information regarding whether or not fire calls are malicious, details of premises requiring a Fire Certificate (eg, hotels, factories, shops) and the name of the certificate applicant, proposed use of premises and plans of the building. They can also provide material in relation to previous arsons they have attended but which have not been reported to the police.

Hackney Licensing

Local licensing authorities hold records relating to drivers, vehicles and companies involved in, and licensed to apply for, hire either as a taxi or private hire.

Health Authorities

Records held by the local health authorities are mainly medical records. Details within these records will not generally be released without the authority of the person in question, unless that person is deceased when the coroner can provide authority.

Housing Authority/Agency

Information can be provided regarding the occupancy of premises under the Authority’s or Agency’s control.

Inland Revenue Compliance Officer

Contact should be made with the local district compliance office if information is required that relates to a potential Inland Revenue offence. If this is not the case, access to the information can only be gained via a court order.

Trading Standards

Local Trading Standards departments hold information on consumerfocused operations, and collect intelligence in relation to infringements of trading standards.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

COLLECTION

TABLE 8 Local Outside Contacts Closed Data Sources (continued)

Data Source

Features

Trafficmaster

Trafficmaster is an established technology company focusing on satellite navigation and digital traffic information. It monitors all traffic flows through masts located at key points across the country.

Utility Providers

Each of these companies maintain records for its own purposes, specifically how payment is made for the goods/services they provide. This can include anything from household fuel to television subscriptions.

7.3 OPEN DATA SOURCES Within a major investigation, open source data may be used to enhance the Analyst’s and Researcher’s knowledge of certain aspects of the inquiry and provide supporting material to analyse, for example, socio-demographic data. Use of open source material for the purposes of policing, if collected overtly, is not subject to RIPA. Local force policy around the collection of such material, however, should be adhered to. One of the main forums for obtaining open source data is through the internet as this can be accessed with relative ease but consideration must be given to the fact that footprints will be left, thereby identifying the police IP address. If a covert approach is required to avoid law enforcement agencies being identified as the originator of enquiries, RIPA authorisation is needed. Advice should be sought from the relevant departments such as the Compliance Unit before such searches are undertaken. When using the internet, Boolean operators can be used to carry out more specific search queries with most search engines. Example:

Appendix 2 – Search Techniques and Useful Websites

Some examples of Open Source Data are shown overleaf. This list is not exhaustive and refers to both international and UK-specific data sources.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

57

TABLE 9 Open Data Sources

58

Data Source

Features

ACORN/MOSAIC Data

Acorn and Mosaic are companies that provide consumer data. They classify consumers into specific categories and give these groups attributes about their lifestyles including housing, area of residence, vehicle types used, age and sex. They are usually grouped within postcode areas and can be provided by credit reference companies. Such information may be of use when carrying out social and demographic trend and crime pattern analysis.

Companies House

All limited companies in the UK are registered at Companies House, an executive agency of the Department of Trade and Industry. There are more than 1.8 million limited companies currently registered, and more than 300,000 new companies are incorporated each year. The main functions of Companies House are to: • Incorporate and dissolve limited companies; • Examine and store company information delivered under the Companies Act and related legislation; • Make this information available to the public.

Electoral Roll

Every eligible person in the UK aged 18 or over is required by law to provide their details to the local authority for the purpose of voting in elections. Two versions of the electoral roll now exist, a public version accessible on the internet and in public libraries, and a closed version that is accessible by the police and other law enforcement agencies.

Internet

The internet can provide data on a large variety of topics. Advice should be sought before carrying out searches on this medium. Many of the items listed in this table will be available through this forum.

Journals and Periodicals

Such documents are useful in providing background information and tend to focus on good practice and application of legislation.

Libraries

Library facilities are provided by each local authority area, most have a computer network established to record book usage, other media and members’ details.

Newspapers and Magazines

Both broadsheet and tabloid newspapers and magazines at national and local levels can provide information. Within a major incident such sources of data may not only provide information on the investigation but also pictorial images which may lead to further lines of enquiry. Persons who are crime reporters belong to the Crime Reporters Association. This means they have to abide by certain codes and regulations.

Points of Interest Data

Points of Interest is a unique location-based database of over 3.5 million entries. These include tourist and leisure attractions, businesses, public buildings, retails outlets and landscape features. They can be split into features that have an address such as shops, hotels and dentists and those that are non-addressable such as golf courses, lakes and hilltops. It is available from Ordnance Survey and covers England, Scotland and Wales.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

COLLECTION

TABLE 9 Open Data Sources (continued)

Data Source

Features

Public Surveys

These may include the British Crime Survey (BCS) or local and force public perception surveys. Again this is useful in providing background information regarding perceived levels of crime and disorder. Such information may be beneficial when carrying out Risk and Results Analysis.

Reference Books and Papers

Examples of these include publications from qualified experts, Home Office publications and research documents.

Social and Demographic Data

This includes census data, Multiple Index of Deprivation, local authority data, health and education data. Such information may be particularly useful when analysing critical incidents, conducting risk analysis and predicting strategic trends.

Television and Radio

Information contained within television programmes may provide useful background information. If, however, this is to be used in an evidential manner, relevant authorities should be sought.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

59

7.3.1 EVALUATING OPEN DATA SOURCES Open source data is not always subject to the same evaluation systems as closed source data. Local policies may exist within forces. Open source data should not be used independently without corroboration. Its reliability and validity should be assessed. One example of a possible grading system can be found in Table 10. TABLE 10 Grading Open Source Data Try to select sources that offer as much of the following information as possible: • Author’s name; • Author’s title or position; • Author’s organisational affiliation; • Date of page creation or version; • Author’s contact information; • Some of the indicators of information quality. Use the CARS checklist as an aid to determine information quality. Summary of the CARS checklist for research source evaluation. Credibility

Trustworthy source, author’s credentials, evidence of quality control, known or respected authority, organisational support. Goal: an authoritative source, a source that supplies some good evidence that allows you to trust it.

Accuracy

Up-to-date, factual, detailed, exact, comprehensive, audience and purpose reflect intentions of completeness and accuracy. Goal: A source that is correct today (not yesterday), a source that gives the whole truth.

Reasonableness

Fair, balanced, objective, reasoned, no conflict of interest, absence of fallacies or slanted tone. Goal: A source that engages the subject thoughtfully and reasonably, concerned with the truth.

Support

Listed sources, contact information, available corroboration, claims supported, documentation supplied. Goal: A source that provides convincing evidence for the claims made, a source you can triangulate (find at least two other sources that support it). Source: Robert Harris http://www.virtualsalt.com/evalu8it.htm

7.4 SCHEDULES As the role profile states analysts must ‘ensure all documents are read and analysed’. Therefore at the start of the collection phase consideration should be given to compiling a schedule of all material read by the Analyst and Researcher. This schedule should record when a document has been read. Dependant on the size and nature of the inquiry it may be beneficial to sub-categorise this schedule by themes, eg, victim, offender and incident. This will allow the Analyst and Researcher to easily identify those statements relating to specific topics. A schedule of this nature will ensure that the Analyst and Researcher have received, read and recorded all material relating to the enquiry.

60

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

STATEMENT CONTENTS NO.

NAME OF READER

SUSPECT 1 SUSPECT 2 SIGHTINGS SIGHTINGS

SUSPECT VICTIM(S) SUSPECT OTHER FAMILY SIGHTINGS FAMILY SUSPECT SIGHTINGS BACKGROUND SIGHTINGS

EXHIBIT

OTH

COLLECTION

FIGURE 2 Example Schedule

22 23 24

JP 11/12/02

JP 11/12/02

25

JP 11/12/02

A 08/02/03 B 16/02/03

GP 20/12/02

GP 20/12/02

26 27 28 29 30

JP 12/12/02

31

KS 10/01/03

A 08/02/03

JP 12/12/02 KS 10/01/03

LEGEND GP, JP, KS = Initials of reader. Date (20/12/02) = Date information read. Number (eg 22, 23, 24) = Statement provided by a nominal and unique number assigned (eg, S25). A, B, etc. = Subsequent statements by nominal, that have been read.

This does not have to be a paper-based process and can be managed through HOLMES 2 by using tags. When each document has been viewed, the Analyst can apply a tag such as SBA (Seen by Analyst). Using this system, the Analyst can undertake a tag enquiry which will return all those documents with no SBA tag.

7.5 NOTE TAKING The Analyst and Researcher should maintain a detailed notebook throughout the enquiry in which to record all thought processes, decisions, recommendations and their outcomes, ie, whether adopted or otherwise. The Analyst should check their own working environment to establish if there are notebooks in existence. Some forces may use investigators’ notebooks for major investigation work and it is recommended that the Analyst and Researcher also use these, or similar, when working on major enquiries. Note: such documents are subject to disclosure and therefore should be marked and used accordingly. This includes signing them before handing them to the Disclosure Officer. Note taking allows the Analyst and Researcher to have a documented reference point throughout the investigation which may serve as an invaluable tool for justification of Actions and auditing purposes. Should any of the work produced by an analyst or researcher be used in court it is highly likely that the author will be expected to account for their thought processes and the decisions they made. Analytical work is increasingly subject to review processes; detailed notebooks will facilitate this scrutiny. Such scrutiny may also apply in a public inquiry where the Analyst or Researcher may be required to give evidence where relevant. NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

61

7.6 STORAGE AND DOCUMENT MANAGEMENT The collection phase of the process is the point at which the Analyst and Researcher are obtaining large volumes of material. Although these will be in both electronic and paper format, physical storage in both cases needs to be considered.

7.6.1 PHYSICAL STORAGE All documents should be stored according to the Government Protective Marking Scheme (GPMS). This means that documents should be stored in locked cabinets and a clear desk policy maintained. Electronic documents should be stored in accordance with their protective marking, and access restricted as appropriate. This also applies to documents displayed on walls and paper material in addition to electronically stored documents. All analysts should be aware of the increased need to ensure that high security documents are stored correctly and that, where necessary, the sterile corridor is maintained. Liaison with the Intelligence Manager is advised to determine the most appropriate method of achieving this.

7.6.2 ELECTRONIC STORAGE Many of the documents used by the Analyst and Researcher will be stored on the relevant systems, for example, HOLMES 2 and local systems. Documents produced by researchers and analysts in all stages of completion, however, must be stored appropriately with consideration for appropriate legislation, for example, data protection. If more than one analyst and/or researcher is working on an investigation, a shared drive should be established that is only accessible to identified persons. This will allow the analytical team to share work easily. When constructing the electronic storage system a simplistic approach is advised. The use of folders and a prescribed naming convention can assist when searching for documents. An example of a naming convention that allows documents to be sorted by the date produced, the author and the document title is shown below: TABLE 11 Naming Convention Example C:\Op X\050323 XXX BLOGGS subject profile analysis C:\

Op X

050323

XXX

BLOGGS subject profile analysis

Drive name

Operation name folder

Date YYMMDD

Author’s Initials

Document Title Including named individual

All documents produced by analysts and researchers should be password protected. This will ensure that documents are not amended by anyone other than the author, thereby maintaining the audit trail. Analysts may also wish to consider converting their documents to pdf format as this will minimise storage space required and prevent documents being altered.

62

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

Any exhibit must be considered to be a key piece of evidence in a major incident. Each exhibit should, therefore, be handled very carefully. Exhibits can be a whole range of items from receipts, photos or documents to items of furniture, computers or vehicles. Advice should be sought from the Exhibits Officer with regards to handling exhibits but there are, in any case, rules that must be followed when handling exhibits:

COLLECTION

7.7 EXHIBIT HANDLING

• All exhibits must have a label with key descriptive and continuity information • •

•

•

•

•

•

•

on it; If an analyst has signed for an exhibit then it is the responsibility of that analyst to ensure that the exhibit is stored securely and not handled by anyone else; If the exhibit has forensic value to the investigation, the Analyst or Researcher should not handle this. The Exhibit Officer should be the only handler. It may be appropriate for the exhibit handler to make copies which the Analyst or Researcher can then use as the exhibit may have forensic value, the Analyst should always wear gloves and handle the item carefully. If a copy cannot be made, a decision as to how the Analyst or Researcher will access the exhibit needs to be made by the Crime Scene Manager or the Exhibit Officer; In circumstances where the SIO and/or crime scene manager has identified an exhibit as having no forensic value, the original exhibit can be viewed by the Analyst or the Researcher wearing gloves; Where an item needs to be referred to continually (for example, a handwritten document exhibit) a working copy should be produced so that it can be handled without damaging the original document. This new copy will also be subject to disclosure legislation; Where a video or audio tape exhibit needs to be viewed or listened to by the Analyst, a working copy should be made available. It is usually the responsibility of the Exhibits Officer to make this copy; In order to ensure the continuity of exhibits, they should not be handed over to anyone else while in the Analyst’s/Researcher’s possession, other than back to the Exhibit Officer. An unusual or unnecessary amount of handovers of exhibits will present opportunities to the defence; Most exhibits will be sealed. If the decision has been made that the Analyst or Researcher can view the original exhibit (see above), the Exhibit Officer should break the seal or be in the presence of the Analyst when the seal is broken; A note must always be made of any exhibits that have been handled and the purpose for this in the Analyst’s/Researcher’s notebook, including times and dates and who the exhibit has been handed to and from.

The Analyst should always consider viewing exhibits as an important part of their data collection process. They should also constantly review the exhibits list on HOLMES 2. Local training can be made available to Analysts and Researchers with regards to exhibit handling.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

63

7.8 SCENE VISITS As indicated in the MIM, crime scene visits are essential to enhance the knowledge and understanding of an enquiry for analysts and researchers. Crime scene information, in whatever form it may take, is arguably the single most valuable information at the Analyst’s disposal. It can provide the facts which form the fabric of an investigation and a subsequent prosecution. Crime scene visits can help the Analyst to understand and interpret more accurately the detail in, for example, witness statements, messages, interview transcripts, forensic reports, maps, photographs, crime scene investigators notes and telephone information by providing the Analyst with the following:

• A general ‘feel’ for the area, dwelling or crime scene; • An understanding of the features such as topography, terrain and lighting conditions; • An orientation as to the direction of travel and movement of key subjects; • An enhanced knowledge of key locations in order to understand distances and timescales. By integrating all of the investigative material with crime scene information, the Analyst is better placed to highlight discrepancies, expose information gaps and lines of enquiry, and understand intricacies of the case. With this enhanced understanding, the Analyst can develop inferences and construct hypotheses which are both dynamic and pragmatic. There are a number of key considerations that should be taken into account before attending a scene:

• Authorisation Provided – analysts should not assume that they have the right

• • • •

•

to attend a scene. It is imperative the SIO grants permission and that the Crime Scene Manager or any other relevant person is informed of the Analyst’s attendance prior to a visit; Preparation – the Analyst should consider what information may be required while at the scene, eg, maps, timelines, statements and photographs; Health and Safety – the Analyst should consider whether they have the appropriate equipment and protective clothing, if required; Protection of the Scene – a level of knowledge may be required, or precautions taken, to protect the integrity of the scene; Timing of Attendance – the Analyst should consider whether it is a good time to attend the scene and whether their attendance has been recorded and communicated. Factors to consider may include whether other people are attending at the time, the collection of evidence or if searching is ongoing; Scene Contact – it may be beneficial to have a contact at the scene to act as a guide.

It is essential that analysts use the knowledge they gain from scene visits in their work. This will help to ensure that the resulting analysis assists the inquiry and demonstrates the value of these visits to the SIO.

64

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

SECTION 8

Section 8 COLLATION

T

he organisation of data into numerous formats is explored in this section. Charting techniques, spreadsheets, tables, databases and maps are provided along with practice advice on their application within a major incident. Training in these techniques in order to support the court process and the IT required for their production, is an essential factor in the collation stage and is described here. This section also covers the issues of financial and communications data, describes the types of data that an analyst can expect to encounter within a major incident, and the boundaries between analysts and experts within the communications field. CONTENTS 8.1 8.2

8.3

8.4 8.5 8.6 8.7 8.8

The Collation Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Charts ............................................... 8.2.1 Charting Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.2 Network Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.3 Timelines/Sequence of Events Charts . . . . . . . . . . . . . . . . . . . 8.2.4 Statement Comparison Charts . . . . . . . . . . . . . . . . . . . . . . . . Spreadsheets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.1 Comparative Case Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.2 Timelines/Sequence of Events Spreadsheets . . . . . . . . . . . . . . 8.3.3 Witness Comparison Charts . . . . . . . . . . . . . . . . . . . . . . . . . . Tables ............................................... Databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Maps ............................................... Commodity Flows including Financial Material . . . . . . . . . . . . . . . . . Communications Flow and Frequency Charts . . . . . . . . . . . . . . . . . . 8.8.1 Communications Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.8.2 Telecommunications Data Types . . . . . . . . . . . . . . . . . . . . . . . 8.8.3 Flow Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.8.4 Network Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.8.5 Frequency Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

66 67 67 69 70 70 70 71 71 74 74 74 75 75 76 76 77 78 79 79

© ACPO Centrex 2006

65

‘…analysts may collect information through a variety of means; put that information into a computer; create charts and summaries from the information; but none of these are analysis. Analysis is the intellectual portion of the intelligence cycle – deriving the meaning from data. If analysts are not thinking, they are not analyzing [sic]’ M Peterson, Intelligence Analysis Training: New Frontiers, Intersec, 2004

8.1 THE COLLATION PHASE Collation of material is a fundamental stage for both the Researcher and Analyst roles. Collation involves the organisation of material into a variety of formats that best facilitate analysis. Examples of these include:

• • • • • • •

Charts; Spreadsheets; Tables; Databases; Maps; Commodity flows including financial material; Communication flow and frequency charts.

It is essential that such products are not considered to be the final analytical product. The evaluation and subsequent interpretation of collated material are the key processes that change material into analysis. A primary stage of the collation process is reading all the material. The Researcher or Analyst should develop processes for annotating material and may want to categorise this material in a structured manner. The volume of material to be collated may dictate whether categorisation of material is required. If categorisation is deemed appropriate then advice should be sought on the topic areas. The Analyst or Researcher should bear in mind that categories are likely to become theme lines and, therefore, there should be a correlation between the two. For example, categories may include:

• • • • •

Victim sightings/movements; Victim background; Suspect movements; Suspect background; Suspicious sightings.

The purpose of the second stage, collation, also known as data description, is to arrange the material in a clear and simple format. Consideration should be given to the most appropriate method for this and will depend on the size and complexity of the enquiry, which will need access to the product and what its future use is likely to be. The ability to be innovative and flexible, therefore, is essential.

66

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

COLLATION

The collation stage may involve summarising material such as statements or interviews. It is important that this is conducted accurately and that the Analyst or Researcher does not interpret or change the nature of the original document. Exact words and phrasing should be used where possible. During the collation stage, the Analyst may begin evaluating material that is before them. The Analyst should construct their collation tools in ways that facilitate the recording of these initial evaluation processes. It is essential that all documents are labelled correctly. This not only includes a GPMS classification but also versions of documents, author’s details, date, operation name and whether the document is of an intelligence or evidential nature. Document version control is absolutely crucial, as this allows the Analyst or Researcher to:

• Have an audit trail of development of products; • Provide an accurate view of what facts they were aware of at any given point in time;

• Ensure officers have the most up-to-date information on the right document; • Maintain good document housekeeping procedures. 8.2 CHARTS Charting is one of the basic tools the Analyst uses to collate material. Charting is now done electronically, supported by purpose-designed software. Every analyst, however, should understand the theory behind charting. All those using charting software must be appropriately trained in the theory and technology of it. A lack of training may be scrutinised by the defence where an Analyst’s material is used in court. Charts can be beneficial in assisting visual investigations and the analysis of complex material. There are a variety of formats which a chart can take, including:

• • • • •

Network chart (association chart); Timeline (sequence of events chart); Statement Comparison Charts; Flow charts; Frequency charts.

8.2.1 CHARTING PROTOCOLS There are two main stages in which an analyst can be involved in producing material: 1. Progressing the investigation – commonly regarded as the intelligence phase; 2. Preparation of evidential material – this is usually based on the material that has been produced and used by the Analyst in progressing an investigation.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

67

In order to protect the Analyst when producing material as evidence, specific protocols in relation to charting must be followed. Analysts should enquire as to whether their own organisation has specific charting protocols that should be adhered to. The following table outlines the charting protocol principles that can be applied in any situation. The headings used in the table below refer to stages 1 and 2 as described earlier in this section. FIGURE 3 Charting Protocols Matrix Description

Intelligence

Evidence

Unconfirmed information

✓ ✓ ✓

✗ ✗ ✗

✓

✓ (Criminal Justice Act

Intelligence Unsourced information (eg telephone material that has been supplied for intelligence purposes only) Hearsay

2003) Protective Marking Previous Convictions (Bad Character)

✓ ✓

✗ ✓ (Criminal Justice Act 2003)

✓ ✗ ✓ ✓ ✓ ✓ ✓ ✓

✗ ✓ ✓ ✓ ✓ ✓ ✓ ✓

✓ ✓

✓ ✓

Source Documents (either to be included in legend, on cards, on icon/symbol or on statement if being produced as exhibit)

✓

✓

Exhibit Number

✗ ✗ ✓ ✗ ✓

✓ ✓ ✓ ✓ ✗

✓ ✓

✓ ✓

Operation Name R v Defendant Legend: Title on chart; Author’s Name; Author’s Job Title; File Location; Date and time chart produced; Version; Icons/symbols/attributes used on chart with label explaining what they represent.

Exhibit Label (attached to chart) Author’s Signature Statement (producing chart/s as exhibit) Textual material highlighting analytical thought processes (eg, discrepancies, intelligence gaps) Copyright Scale (maps)

68

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

COLLATION

When producing intelligence charts, the material that is in intelligence format must be denoted in an explicit way, for example, use of colour or bold text. Analysts and researchers should also be aware that all material has the potential for being disclosed and therefore entries such as textual information on an intelligence chart should be carefully considered. Optional annotations may include:

• A sequential reference number that identifies the total number of copies printed and the specific copy number of that chart. For example, 1/20, 2/20, 3/10, where 20 refers to the total number of reproductions of the chart printed and the initial number denotes the individual copies. This may help if it is necessary to monitor how many copies of charts are distributed, where versioning control and dissemination restrictions need to be managed. • Details of the officer/person for whom the chart has been produced. • Details of the officer/person to whom the chart has been distributed. This may be accompanied by a location for a signature. Alternatively, analysts may wish to maintain a register of distribution, and obtain signatures separately on that register. • Textual information may be added which details the report name which accompanies the chart. This can be useful in reminding officers or other staff that the reading of a report in conjunction with the chart is essential, and that the interpretation of the chart is where the analysis lies. Analysts can use the collation IT software to create templates which include the minimum protocols, thereby ensuring that all necessary features are automatically annotated on the chart.

8.2.2 NETWORK CHARTS Network charts or association charts depict links including those between people, groups, companies, vehicles and addresses and highlight the nature of those associations. Clear direction should inform the scope and structure of the network chart. For example, a murder related to a drugs network should demonstrate hierarchy as this may be critical to establishing the motive for the murder. Additionally, the collation stage should involve the Analyst or Researcher maintaining focus on the extent of the network development, ie, establishing how many persons to chart beyond the initial subject. Such factors should be reflected in the direction of the task. The collation of network charts can start the evaluative and analytical thought processes highlighting such things as intelligence gaps, disruption and intervention points. Example:

Appendix 3a – Intelligence Network Chart Appendix 3b – Evidential Network Chart

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

69

8.2.3 TIMELINES/SEQUENCE OF EVENTS CHARTS A timeline or sequence of events chart portrays a chronology of events. These are based around themes which can include people, vehicles, groups, addresses, telephones and general non-specific types of events (eg, suspicious sightings). Before themes are chosen it is vital that the Analyst and Researcher are fully informed of all the material available. A straightforward approach should be adopted. Too many theme lines can complicate charts and will not easily facilitate analysis. Additionally, event boxes containing too much material can make the chart larger than it needs to be. If large volumes of material are being collated within an investigation, consideration should be given to using spreadsheets to compile timelines rather than charting software (see below). There must be clear direction at the start of the collation stage for timelines. This should give consideration to the parameters of the chart, eg, time period covered, and people to be focused on. The Analyst will have a key role to play in this, as they will have read all the material and, therefore, may be best placed to advise the SIO. Example:

Appendix 4a – Intelligence Timeline Chart Appendix 4b – Evidential Timeline Chart

8.2.4 STATEMENT COMPARISON CHARTS Charts can also be used to visually display any type of material involved in the investigation. For example, statements regarding specific exhibits, witness statements detailing descriptions of subjects and forensic material. In a spreadsheet format this may take the form of a comparative case chart. Charting software, however, may help to visually display information in a different format.

8.3 SPREADSHEETS Spreadsheets can be used to collate material to support a variety of analytical products. Spreadsheets will be one of the Analyst’s and Researcher’s most versatile tools and allow a straightforward approach that can be shared very easily as necessary and appropriate. They are usually the least time consuming product to produce. The Analyst and Researcher should consider the use of spreadsheets as a first step in the collation process. Such documents can be imported easily into chart format at a later stage if necessary. The Analyst should advise and provide guidance to SIOs as to the most appropriate format. Spreadsheets are often contained within common IT software and therefore users do not require specialist training. This may be a benefit at the court stage, particularly as they prevent scrutiny of chart features, such as colour or specific icons that can be used by the defence to suggest bias on the part of the Analyst or investigative team. The use of spreadsheets is inclusive of the Researcher who may not be trained in specialist software for charting.

70

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

There are a number of methods used to compile comparative case charts. The base software is often spreadsheets, however, tables and charting software can also be used.

COLLATION

8.3.1 COMPARATIVE CASE CHARTS

A comparative case chart is a matrix that compares similarities and differences between elements of crimes or incidents. This is achieved by the Researcher or Analyst establishing component parts of an offence, for example, the offender’s description, language and actions, the victim’s description or the offence location. These categories need to be established once all the crimes have been read. The use of different colours or symbols for each category can help to denote where crimes have commonalities. Comparative case charts may often start the evaluation and analysis thought process, for example, highlighting intelligence gaps and areas for further investigation. This interpretation should always accompany the chart. Although on its own the chart does not constitute analysis, the chart itself may be extremely useful in demonstrating the links between incidents. Comparative case charts can lead to the production of simple matrices that summarise specific elements of the data. For example, the Analyst may just want to focus on summarising the victim characteristics, thereby directing enquiry teams as to the general profile of potential victims and generating prevention strategies. Alternatively, the Analyst may wish to summarise the offender characteristics to assist the SIO in prioritising offender types or DNA collection. This does not constitute behavioural analysis, however, advice may wish to be sought from SCAS who nationally lead in the area of comparative case analysis.

8.3.2 TIMELINES/SEQUENCE OF EVENTS SPREADSHEETS Timelines are usually produced using charting software, as described above. Spreadsheets, however, can often be an even more effective way of displaying chronological material. The benefits of spreadsheet timelines are that they are:

• • • • • •

Accessible by all; Do not require specialist training; Allow large amounts of material to be easily displayed; Facilitate easy updating; Can be easier to read; Particularly useful when large volumes of material are involved which if displayed on a chart would be unmanageable and sizeable; • Adaptable to the use of themes, using colour; • Can allow the user to begin the evaluative process and annotate the spreadsheet accordingly.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

71

The thought process involved in setting up a spreadsheet timeline is very similar to that of chart timelines. Parameters should be set for:

• • • •

Themes; Column headings; Start and end times and dates; Scope.

Consideration may need to be given to establishing a consistent approach to displaying and describing times of events, particularly where no definitive time is provided. TABLE 12 Features Included in a Spreadsheet Timeline Feature

Comment

Source

• This details the origin of the material, eg, statement number and interview number. This is normally in numerical or alpha-numerical format.

Name

• This details the author of the material and is normally the name of a person or company.

Date

• This is the date of the event the material is referring to. In conjunction with the time field, these two fields set the chronology for the entire document. It is, therefore, essential that they are kept separate.

Time

• This is the time of the event the material is referring to. In conjunction with the date field, these two fields set the chronology for the entire document. It is, therefore, essential that they are kept separate. • In instances where no time is provided or an imprecise time is given, a decision should be made from the start as to how these are going to be displayed. For example, if the material states an event occurred between two times, then the first time will always be used. • If no time is provided, this material will always be shown at the start of the date. Where possible, the anomalies regarding time should be shown in the event field.

Event

• This details what the material source is referring to, eg, a sighting, an action or a communication.

• This should summarise that detail of the material using the exact words or phrases where possible. Comments

• This field highlights the start of the evaluation process, showing discrepancies and anomalies in material, simple hypothesised information and in relation to communication data, whether it was still in intelligence (sensitive) format.

Date Saved

• This is the date that new material is added to the spreadsheet. This allows easy searching when it is necessary to see what material has been added to particular versions. Additionally, if an auto filter is added to the spreadsheet, this column will allow users to self brief.

72

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

COLLATION

TABLE 12 Features Included in a Spreadsheet Timeline (continued) Feature

Comment

Colours

• Each row on the spreadsheet can be assigned a colour. These colours represent pre-defined themes. For example, victim movements, suspect movements, communications, etc. • A legend should be added to the document displaying what each colour represents.

• Coloured text can be used to highlight any required feature. For example, red

Red Text

text may be used to highlight sensitive material, ie, information in intelligence format.

• Other information included may be a description of the subject's clothing or

Other

the cell site location of a subject's communication data.

Spreadsheets can also be used to produce simple timelines. Such products are based on overall timelines and display material relating to one or more themes. By grouping material together in a chronological manner, eg, all sightings of a victim, they highlight where gaps in movements and material are. These documents are high level snapshots of specific time sequences and can be a useful way of focusing the evaluative and analytical thought processes around gap analysis. FIGURE 4 Simple Timeline Showing Movements of Suspect on 01/01/2006 01/01/2006 00:00- 01:00-02:30 01:00 approx

02:3003:00

03:0003:30

03:30 03:35- 03:57- approx 03:55 04:07 04:00

Searching fields with officer

Home

*Visits local shop

Home

Gym

04:08- 06:05 06:00

Fields

Home

06:10

06:1506:30 *Driving out of town

Legend Shaded areas indicate an eye witness sighting. * Partial time accounted for (please see witness statement) Notes 1. Time periods are non-proportionate 2. Some times provided by eye witnesses are approximate – please refer to Word document for details. 3. Some sightings are unconfirmed – please refer to Word document for details

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

73

8.3.3 WITNESS COMPARISON CHARTS These can be similar to comparative case charts, however, instead of comparing similarities in incidents, witness comparison charts are used to collate contrasting witness statements or interviews. A Witness Comparison Chart is often in a matrix format. This is achieved by the Analyst or Researcher establishing component parts of a witness statement/interview, for example, the victim’s description, actions, the suspect’s description, language and actions, the witnesses’ movements and direction of travel. The categorisation of these elements needs to be established once all the documents have been read. The use of different colours or symbols for each category can help to denote where statements/interviews have commonalities. Witness Comparison Charts may often start the evaluation and analysis thought process, for example, highlighting intelligence gaps or areas for further investigation. This interpretation should always accompany the chart. Although the chart alone does not constitute analysis, the chart itself may be extremely useful in demonstrating the links between incidents.

8.4 TABLES In the event of relatively small amounts of material being collected, it may be appropriate to display this material on a table. The Analyst or Researcher should continually bear in mind the simplest approach to collation. Tables can be used to assist case and witness comparison charts by providing snapshot information easily but analysts should be mindful that they are less flexible than spreadsheets where material is continually added.

8.5 DATABASES Within a major incident, bulk data sources may be made available to the inquiry, for example, downloads from PNC, VODS, QUEST or ANPR. It is usually unlikely that this material will be put onto the HOLMES 2 system in its entirety, therefore, crossreferencing between multiple sources of data needs to occur in an alternative format. It is essential that a download of HOLMES 2 is periodically completed in order that the separate databases can be compared against the core system. It is also possible to complete specific data extraction from HOLMES 2. The use of databases to compare sets of data is usually the most effective method to achieve this. The application of this process will facilitate searching for common elements such as names, vehicles or addresses. Where there is not adequate provision for certain types of information that need to be searched, it may be necessary to create a database to supplement HOLMES 2. For example, a police force has undertaken an investigation which involved significant detail about dogs and bicycles in a park at the time of the murder. Although this information could be recorded on HOLMES 2 in its basic format, descriptions could not easily be searched and so the Analyst decided to create a separate database using standard categorisation.

74

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

The collation of material onto maps requires the Analyst to be familiar with, and have access to, a mapping system. The material to be portrayed on maps needs to be sufficiently geographically referenced. This reference may be an address, postcode or geographic reference numbers such as eastings and northings.

COLLATION

8.6 MAPS

Using maps to collate material can have benefits, they can be used to: • Demonstrate links between geography and time within the context of a major incident; • Highlight routes taken by subjects and vehicles, and locations where phones have been used; • Demonstrate the proximity of key locations or events; • Provide standard layouts for search teams and house-to-house enquiries; • Prompt officers when interviewing or taking statements. When maps are being produced, copyright regulations should be adhered to and all maps should show a scale. If maps are being produced as evidence, the author should be trained in the software to be able to withstand scrutiny at court. It is possible to combine maps with other collation techniques, such as network charts, frequency charts, etc. This will help to maximise the description of information thereby facilitating evaluative and analytical processes.

8.7 COMMODITY FLOWS INCLUDING FINANCIAL MATERIAL Commodities and financial material can be collated in a variety of ways. Spreadsheets can be used to summarise the flow of commodities in support of Criminal Business Profiles and Market Profile Analysis. There is no set procedure for the production of such documents other than establishing commodity types, eg, drugs, property or people. These are then plotted against other criteria such as months, weeks, days or stock flow. It may be appropriate to display this material in a chart format. Additionally, commodity flow may be represented within a network chart, for example, as the flow of a commodity passes between people or companies. In addition, network charts can be added to basic flow charts to help provide additional explanatory data about individuals, groups or organisations. It is important that the Analyst or Researcher understands the nature of the commodity or the financial material before they begin this process. This may require liaison with specialist units, for example, the Economic Crime Unit or drugs officers. The majority of financial material that will be useful to the Analyst will relate to transactional data. Where financial material is used to support analytical products, analysts have a remit to work with this material. Where the task is to specifically undertake financial analysis, however, specialist accountancy or financial skills will be required. This should, therefore, be tasked to dedicated and trained financial analysts. In some cases it may be appropriate for the Analyst or Researcher to liaise with these specialists.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

75

8.8 COMMUNICATIONS FLOW AND FREQUENCY CHARTS 8.8.1 COMMUNICATIONS DATA Communications data is any form of material that refers to interaction between people using telecoms technology. This can include:

• • • • • • • • • •

Telephone calls – landline and mobile; Text messages; Pay phone; Emails; Chat rooms; Internet access; Telephone account details; Cell site; Pagers; Radio communication.

Communications data is another material source used to indicate peoples’ movements, associations or conversations. This material can be highly beneficial in an investigation when trying to determine sequence of events, confirm movements and/or establish motive. Analysts should be aware that communications material does not necessarily mean that the subject under investigation, or subsequently discovered associates are in possession of the communications technology at the time of transactions. This emphasises the key role of the Analyst or Researcher in corroborating such material with additional material such as witness sightings or CCTV. The first stage of collating communications data is to format the material in a consistent manner so that it can easily be imported into charting software. It is essential that the Analyst has a working copy and saves a master copy that can be referred to at a later stage. Most telecom companies send their material in differing formats, both electronic and paper. Times, dates, durations, caller IDs and the different types of calls (eg, text, national, local, mobile and voicemail) can appear differently with each company. Communication with the SPOC is necessary in order to ensure that material is interpreted correctly. Where material arrives in paper format, administrative resources should be secured to support the Analyst or Researcher. The material can frequently be high volume and contain very specific information that needs to be accurately transferred into an electronic format, in a timely manner. When communications data is initially received, it will often be in a sensitive format. Material that may later be required as evidence must always be highlighted to the SIO. The Analyst may have a role to play in monitoring the transition of sensitive material into an evidential format. It is crucial that the sensitive nature of the material is reflected in collated products. It may be useful to maintain a separate product that tracks the development of evidential material from its original sensitive status.

76

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

COLLATION

Each time communications material is received, irrespective of whether at face value it appears to be the same as material already held, a thorough comparison must be carried out. It is not unusual for material from the same company to change over a period of time. This is often dependant on the department and software within the company that produces the material. Examples of this include new telephone calls, differences in durations or missing calls. If such problems are found, these should be recorded immediately and brought to the attention of the SIO and SPOC. Within some major investigations a Telephone Liaison Officer (TLO) may be appointed. Their role is to complete requests for communications data in accordance with RIPA, to ensure consistency in applications and to minimise the need for data requests. They will be the single point in the investigation for the SPOC and ensure that the investigation remains focused in relation to communications data. This resource is a valuable reference point for the Analyst or Researcher. Collation issues and techniques should be discussed with the TLO in order that the methodology is fully understood by those who will be using it.

8.8.2 TELECOMMUNICATIONS DATA TYPES The main forms of telecommunications data that can be requested from the telephone companies are:

• Subscribers; • Itemised Billings or Call Data; • Cell site. Subscribers – Subscriber information details the person(s) or company that is recorded as being the subscriber to a given number. This can be useful when establishing networks or undertaking subject profile and incident analysis. Historical subscriber information can also be obtained along with connection dates. The SPOC should be consulted to ascertain what can be obtained from the service provider. The collation of all subscriber information within an inquiry can be continually explored as new material is received. It is, therefore, important that material is stored in an easily retrievable and searchable manner. This may involve using auto-filters or pivot tables on spreadsheets but, if there are large amounts of material, it may be suitable to download the material into a database. Pay-as-you-go mobile phones often yield no subscriber details. Internal force systems can be searched in an attempt to discover the subscriber’s identity. Open source searching on the internet may also be an option. It is strongly advised, however, that advice is sought from the SPOC, who has specific and specialist knowledge regarding RIPA compliance, before commencing such searches. In addition, mobile phone purchase details held by the retailer may provide potential subscriber details. Requests for this information must be done through the SPOC.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

77

A basic table or spreadsheet that details evidence linking a person to a phone can be helpful when working with large volumes of data. This can be particularly pertinent if later called to court over evidential analytical work and questions are raised as to how phone numbers were linked to particular persons, organisations and/or businesses. Itemised Billings/Call Data – Telephone billings list numbers called and destination numbers in a chronological format. Times and dates are included in addition to the duration of the call. Both incoming and outgoing billings for one telephone number can be requested, however, RIPA legislation strictly covers this information in order that a proportional approach is taken. It may be useful for analysts to set up a database containing both the subscriber details applied for in the investigation and the billing data. The numbers contained within these sets of data can then be easily cross-referenced. Cell Site – Cell site is a telephone billing with additional material about the mast site which the mobile phone used to connect the call. The material provided will name the cell site. Although detail can be obtained as to the general geographical area that cell site covers, there are a number of factors that affect the preciseness of this material, for example, weather and the volume of calls. In its raw format cell site material can be used to collate general locations. This can help to corroborate statements or hypotheses within a timeline. Used in conjunction with mapping, it can be used to portray general routes and proximity to key events. There are technological experts who are able to interpret cell site material precisely, and refine the material to support the development of the inquiry. These experts will produce their material in evidential format and are considered expert witnesses within the court environment. It is essential that analysts exercise caution when using such material to progress the inquiry and liaise with SIOs about the boundaries of their work. The Analyst can be involved in meeting the expert witness. This has a twofold benefit as it will increase the Analyst’s knowledge and they will have a familiarisation with the case and be able to assist the expert witness. Communications data can be collated in a number of different formats. It may suit the user to manipulate material in a simple spreadsheet format but there are advantages to displaying material in chart formats. Different types of charts can demonstrate various aspects of communication, for example, frequency of calls, associations, direction of calls or calling patterns.

8.8.3 FLOW CHARTS Flow charts detail communication between different telephone numbers within a specific period of time. Each number will be denoted by its own theme line. Subscriber details will often be included to identify the theme. The calls are then shown in chronological order with a directional arrow showing the originator of the call and the receiver. Flow charts will often display duration of calls and highlight the difference between calls, voicemail and text messages.

78

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

Flow charts are particularly useful when determining patterns in caller activity. The identification of such patterns can demonstrate lifestyle activity and can be used in the analytical process. For example, it may be of value to determine a sequence of events prior to a murder.

COLLATION

Flow charts can identify specific calls that need to be included within timelines.

There is software available that supplements charting technology. It is designed to seek out patterns and routines of communications data.

8.8.4 NETWORK CHARTS Network charts can be used to display evidential and/or intelligence links in communications data. They follow the same structure and compilation as standard network charts and can be used to show the associations between telephone numbers along with addresses, persons, vehicles and all other entities. Networks charts can also be used to show frequencies and flow of communications data, as detailed in the next section.

8.8.5 FREQUENCY CHARTS Frequency charts show the links between two or more numbers and how many times each telephone number has contacted another. This material can be collated in both chart and spreadsheet format. A chart can show visually the associations between numbers and identify the most frequent or even the least frequently contacted subscriber. This can be particularly useful in the evaluation process. Spreadsheets can be manipulated using pivot tables and graphs to determine the frequency of communication between numbers. They can also be used to help identify patterns if looking at the frequency of calls across given points of time. It is essential that analysts do not rely solely on the technology to emphasise features of the communications data. The evaluative and analytical processes should be used to interpret the material thoroughly. The Analyst should continually be questioning and challenging the obvious. Other material may be useful when interpreting communication data such as association charts. These can illustrate hierarchies or controlling influences within an organisation which may not be identified in a frequency chart. The Analyst should always be careful not to make assumptions.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

79

80

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

SECTION 9

Section 9 EVALUATION

E

valuation underpins analysis and examples of the techniques used are provided in this section. Interpretative techniques including brainstorming, charting evaluation, inference development and hypothesis testing are explored along with the specific requirements of covert intelligence analysis. CONTENTS 9.1 9.2

9.3 9.4 9.5 9.6

The Evaluation Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Brainstorming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2.1 Brainstorming Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2.2 5WH Matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2.3 Brainstorming Outcomes . . . . . . . . . . . . . . . . . . . . . . . . . . . . Charting Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Covert Intelligence Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Inference Development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Hypothesis Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

82 83 84 84 86 86 87 87 88

© ACPO Centrex 2006

81

9.1 THE EVALUATION PHASE The evaluation stage in the intelligence cycle represents the translation of material from its collated format into meaningful information that allows analysis to take place. It is at this stage, when the interpretative processes take effect, that value can be added to data. Some examples of evaluation techniques are:

• • • • •

Brainstorming including the 5WH Matrix; Charting evaluation; Covert intelligence evaluation; Inference development; Hypothesis testing.

The evaluation of material can involve the generation of some of the most innovative methods of interpretation. These can help to define the most appropriate analytical product for the set task. It can also be an extremely simple process whereby the Analyst decides whether items should or should not be included in their analysis, or whether specific information items have greater value than others. In order to ensure that the evaluation stage is informed and objective, the collection and collation stages must have been completed thoroughly. Without all the relevant and accurate material having been obtained, read and organised, the interpretation of the material may result in a flawed product. The role of the Analyst and Researcher is to provide timely, relevant and objective products that support the decision making of senior officers and, therefore, influence the direction of the inquiry. While the Researcher will be heavily involved in the collection and collation stages, their involvement in the evaluation stage will depend on the technique. Researchers can have a valuable input into brainstorming and 5WH processes due to their extensive knowledge of the case. Decisions regarding the relative value or interpretation of material, however, should be completed by the Analyst. The Researcher has a key role in supporting the Analyst in the evaluation process by determining the provenance of material that has been generated through evaluation techniques. By doing this, they help to ensure the objectivity of the analytical process. The Analyst or Analyst Manager may wish to include the Researcher for developmental purposes in other evaluation processes. This should always be done in a mentored or guided manner. There are a number of resources in a major inquiry which can assist in interpreting material. These may be specific people or groups of individuals who have detailed knowledge of either the entire case or specific thematic areas. In order to ensure that the evaluation stage considers all material, these people must be included in evaluation techniques. People to consider can include:

• • • • •

SIO; MIR staff; Enquiry teams; SOCO staff; Specialist staff (eg, intelligence cell, economic crime unit, financial investigators, search teams, forensic specialists and CPS); • Partner agencies.

82

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

EVALUATION

The outcome of evaluation sessions can be maximised by considering in advance the appropriate use of intelligence and evidential material. Consideration must be given at all times to the restriction of material, for example, GPMS, and the persons attending these sessions. Evaluation often includes sharing ideas and spontaneous discussion. It is important that any evaluation techniques used are conducted in a structured manner with all the thought processes recorded. Where the process involves a simple evaluation of material to be included or excluded, all decision making should be recorded within notebooks. Consideration should also be given to using a facilitator to ensure the process is managed and to prevent mission creep. Within a major inquiry, the Analyst or Researcher will frequently be the singular analytical or research resource assigned to the investigation. Although they should have supervision and constant communication with Analytical Managers and colleagues, they can become isolated. Time should, therefore, be set aside for evaluation processes whereby the Analyst can share ideas with other analytical staff. Sharing ideas with an analyst not specifically assigned to the investigation can be beneficial. The discussion can help to bring fresh ideas and ensure objectivity, but consideration must be given to the sensitivity of the inquiry and the logistics of including these additional resources within any confidentiality agreements. All evaluation products must be labelled correctly, including version, date and contributors.

9.2 BRAINSTORMING Brainstorming is one of the most useful techniques that can be used to interpret the meaning of material. It is most valuable when conducted with a manageable number of people who have an informed view of the subject matter. The scale of the brainstorming process should be tailored to meet operational needs. For example, in the majority of cases, analysts will work independently within an MIR and it may be the case that the Senior Analyst or Analyst Manager participates in the brainstorming process. There may be situations where large groups of staff from various departments can enhance the brainstorming process. The application of a structure within which to brainstorm will allow focused and timely evaluation of material. The term ‘brainstorming’ has been deemed ‘not offensive when used in its correct context, defining a session amassing spontaneous ideas as potential solutions to a problem’ by The National Society for Epilepsy (UK), March 2004.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

83

9.2.1 BRAINSTORMING PROCESS The following points need to be considered when carrying out a brainstorming process, although it may not be necessary to cover them all:

• The Analyst should clearly define the objectives of the session, with agreement • • • • •

from the SIO, Lead Analyst or senior staff member; A time frame should then be set and agreed with time allowed for each area of discussion; The relevant parties should be informed when the session is due to take place and a suitable location to accommodate the participants identified; If necessary, a facilitator should be appointed and flip charts, white boards and tape or video recorders should be made available for recording purposes; If a facilitator is appointed, they should be made aware of key topics so that they can maintain the momentum of generating and discussing ideas; During the session, consideration should be given to discussing the most appropriate format for analysis and dissemination as a result of the brainstorming.

Disclosure needs to be taken into account at all stages of the brainstorming process and recording techniques should enable comprehensive disclosure, including recording sources of information discussed. Brainstorming can generate fresh ideas and leads based on people’s perception of material and facilitate all of the other evaluation techniques. It is the Analyst’s role to determine the provenance of that material if it is going to be used to further the inquiry. The Analyst or Researcher should not be afraid to challenge the integrity of the material at this stage. If this does not occur, the objectivity that the Analyst introduces may not be present. An example of a large scale structured brainstorming process is the 5WH Matrix. This technique is included in the ACPO (2005) Practice Advice on Core Investigative Doctrine.

9.2.2 5WH MATRIX The 5WH Matrix is a technique that applies a simple framework to material. It uses basic questions of Who, Where, What, When, Why and How to group material that can be set against specific criteria such as ‘What We Know, What We Don’t Know’ or intelligence gaps and anomalies.

84

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

What We Know

What We Don’t Know

Who

EVALUATION

FIGURE 5 5WH Matrix

Where What When Why How

This framework can be applied to any material either at the investigative or evidential stage, although there needs to be a clear distinction between the two. It will be useful if the initial aim of the matrix is established. This may involve assessing the entire case or discrete aspects or themes. It can also be applied to both the high level and detailed information. For example, within a murder inquiry it may be clear that an individual was killed (high level), but, the details of how the murder occurred and the weapons used (finer detail) may be unknown at the time of evaluation. Using the What We Know, What We Don’t Know framework can identify intelligence gaps and anomalies. These can then be added as additional columns to the matrix, if the Analyst finds this method most appropriate. These conclusions represent incident analysis. The Police Service of Northern Ireland (PSNI) are developing a similar model to express the 5WH Matrix. This focuses primarily on the links between each area. FIGURE 6 PSNI Evaluation Matrix

Victim

Time

Opportunity/ Motive

MO

Suspect

Location

There can be up to fifteen links between factors that are common to all major incidents. Each of these links should be explored to identify gaps in information and, therefore, help direct the inquiry.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

85

If either of these evaluation techniques are being used solely to assess evidential material, it can be beneficial to include the CPS or inform them once the evidence has been compiled as this may help to focus the prosecution case. The SIO should also be informed of the outcome of the evaluation and subsequent analysis. These results can be used to facilitate further brainstorming at briefings. The SIO, however, should be in control of the dissemination of such information as the material may be sensitive or affect team morale.

9.2.3 BRAINSTORMING OUTCOMES During an operation in Cambridgeshire, the 5WH Matrix and supporting information were discussed with the SIO. The result of the evaluation and analysis at this stage concluded that there were significant information gaps. The SIO was concerned that sharing this with the team members would have a negative effect on morale. It was, therefore, decided that a specific delivery strategy would be undertaken by the Analysts and echoed by the SIO. This involved focusing on the positive aspects, showing how the gaps were driving the investigation forward and how the information gathered was providing a sound base on which to develop the prosecution case. Subsequent evaluation using this matrix was conducted at given points in time. This clearly demonstrated the progress of the prosecution case and how the individual enquiry teams’ lines of enquiry helped to close information gaps.

9.3 CHARTING EVALUATION The interpretation of charts will result in the Analyst identifying such things as gaps in the material, discrepancies and dynamics between people or events. Much of this process will involve determining what is relevant to the task and assigning a value of importance to specific items or sequences of information. For example, within a sequence of events timeline, there may be a number of concurring witness statements sighting a subject at a specific location between set time parameters. There may also be a contradictory witness statement that indicates the subject is at an alternative location at this time. The Analyst’s role is to determine the weight that should be assigned to the contradictory statement and recommend the value that information has within the investigation. The Analyst can employ a number of methods to evaluate charts, and new approaches are always welcomed. The evaluation process can begin during the collation stage whereby the interpretation of material can be annotated on a chart or spreadsheet. If this is deemed the most appropriate format, it is recommended that a master copy is saved and a working copy is used to record ideas and thought processes. This can be a valuable method of operating when working on specific themes or tasks that are derived from an overall timeline. It also helps to demonstrate the methods used and shows a clear audit trail for working practices.

86

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

FIGURE 7 Peacock Layout

EVALUATION

The format of charts themselves can aid the evaluation process. The use of IT software that manipulates material such as network hierarchies or telephone data layouts can visually begin the evaluation process from a visual perspective. It is the interpretation within a wider context of material, however, that gives this information meaning and facilitates analysis. FIGURE 8 Grouped Layout

Reports can also be used when evaluating charts to highlight the Analysts’ thought processes. This can help to prevent charts from becoming cluttered and to maintain focus.

9.4 COVERT INTELLIGENCE EVALUATION The evaluation process is the same whether the material is of a covert intelligence nature or not. In cases where a separate analyst is used within a covert intelligence cell, that analyst should also have access to resources, such as analyst managers, who assist in the evaluation process. The material generated by evaluation techniques should be provenanced in the same way as regular evaluation processes. The Covert Intelligence Analyst should, however, be continually thinking about how they can enhance the evidential case. They may be able to support the SIO by providing additional or further detail to support or contradict evidential material.

9.5 INFERENCE DEVELOPMENT Inference development is the interpretation of factual material (premises), using the objective, professional judgement and thought processes of an analyst. The formulation of each inference is underpinned by premises that should clearly demonstrate how the inference has been drawn. Inference development provides all analysts with a sound method of interpreting a range of material and drawing conclusions based on it. Inference development should be considered by all analysts working in all environments.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

87

The principal purpose of serious crime analysis is to provide focus to an investigation through information management and inference development. This is generally through the preparation of analytical products, including discussion with the SIO. The PSNI uses the following framework to inform the work of its Serious Crime Analysts. FIGURE 9 PSNI Inference Development and Information Management

Analysis Information Management Analyst Tasking

New Lines of Enquiry

Inference Development

Analytical Products

Presentation & Delivery

SIO

Focus

Actions

MIT

Objectivity Investigation

Objective thought is essential when developing inferences. Consideration should always be given to the value of information and whether other material can support or contradict the premise or inference. The use of a structured framework can help the Analyst to maintain objectivity. For example, the 5WH Matrix can highlight the consistencies and conflicts that support inference development. Inferences are of most value when they are simplistic and focused on the task. They can result in the generation of an analytical hypothesis that provides an overall objectively-based suggestion of what has occurred. Analysts involved in inference development will typically use techniques to describe their thought processes.

9.6 HYPOTHESIS TESTING An hypothesis is defined as: ‘a suggested explanation for a group of facts either accepted as a basis for further verification or accepted as likely to be true.’ Collins English Dictionary (2004)

Another way of describing an hypothesis is: ‘building a scenario that best explains the available material.’ ACPO (2005) Practice Advice on Core Investigative Doctrine

88

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

EVALUATION

Within a major investigation setting, an analyst can generate an hypothesis based on collected, collated and evaluated factual material. The Analyst is, therefore, in the best position within an investigation to develop hypotheses. SIOs can also generate hypotheses but, in both cases, the hypotheses should be fully tested. This reiterates the importance of communication between the Analyst and the SIO. Hypothesis testing involves assessing the validity of the hypothesis, collecting and collating the relevant available material and evaluating the premises of the information with a focus on proving or disproving the hypothesis. This may lead to the development of further inferences. The Analyst and SIO should be aware of the possibility that alternative hypotheses may be generated, and that these should also be tested. The generation of hypotheses through brainstorming processes can be the catalyst for a new intelligence cycle. In addition to progressing the investigation, hypotheses can also provide a possible explanation for events and can be used to anticipate a number of circumstances such as lines of defence to be used in court or interview. Hypotheses that are formed from limited or uncorroborated material can, at best, only amount to an assumption of what may have occurred and this could be influenced by personal bias or stereotyping. In cases where limited material is available, the generation of hypotheses should be avoided until identified intelligence gaps are filled. The Analyst should only use material that is available to them directly from the inquiry (both open and closed sources). If the hypothesis is developed around specific aspects of the case that require a level of knowledge outside the Analyst’s role, it may be necessary for a specialist to be appointed, for example, a behavioural psychologist may advise on motive and a geographic profiler may advise on key locations. The issue of disclosure must be considered when generating and testing hypotheses. The reliance on factual information to underpin this type of work is crucial and will help to guard against potential challenges by the defence. Analysts must use notebooks to ensure that they document all decisions made.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

89

90

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

SECTION 10

Section 10 ANALYSIS

T

he structure of the National Intelligence Model (NIM) provides a framework for the application of the nine analytical techniques within a major incident setting. An additional technique, incident analysis, has been formulated which addresses the issue of analysing timelines and witness information. Each technique is described in detail and their practical application within major investigations is discussed. The methods for determining which techniques should be used in specific situations are also outlined. CONTENTS 10.1 10.2 10.3 10.4 10.5

10.6

The Analysis Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Scope of Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Inferences and Hypotheses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The National Intelligence Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Analytical Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.1 Incident Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.2 Network Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.3 Subject Profile Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.4 Crime Pattern Analysis (CPA) . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.5 Risk Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.6 Market Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.7 Social and Demographic Trend Analysis . . . . . . . . . . . . . . . . . 10.5.8 Criminal Business Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.9 Results Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.10 Operational Intelligence Assessment . . . . . . . . . . . . . . . . . . . Which Analytical Techniques Should Be Used? . . . . . . . . . . . . . . . . . 10.6.1 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.2 Victim-Related Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.3 Offender-Related Techniques . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.4 Location-Related Techniques . . . . . . . . . . . . . . . . . . . . . . . . . 10.6.5 Incident-Related Techniques . . . . . . . . . . . . . . . . . . . . . . . . . .

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

92 92 92 93 93 93 95 96 98 101 102 103 104 104 105 106 106 107 109 111 112

© ACPO Centrex 2006

91

10.1 THE ANALYSIS PHASE Analysis involves generating recommendations to support the SIO’s decision-making process and provide them with material to progress the direction of an inquiry. The Analyst is equipped with a specific skills set to undertake this element of intelligence-led policing. Within a major incident, analysts can apply their procedural and technical training which has been learnt in the general arena of policing.

10.2 THE SCOPE OF ANALYSIS It is imperative that analysts and SIOs understand the boundaries of intelligence analysis. As a professional witness, the Analyst’s work must not extend beyond their area of professional knowledge. The Analyst should seek advice at any stage where they consider their task to go beyond their remit. Examples of specialist roles that do not fall within the scope of intelligence analysis include:

• • • •

Behavioural Investigative Advisors (BIAs); Geographic Profilers; Forensic Specialists; Criminal Psychologists.

There is a tendency to use analysts in areas that do not meet the role profile or involve their analytical skills. The Analyst’s technical knowledge, access to systems and their ability to use these systems often means that they are considered as being the only resource able to carry out these tasks. It is important that analysts, researchers and analyst managers continue to challenge and re-educate tasking officers. Analysts are regularly, yet incorrectly, tasked with the following:

• • • •

Producing maps and charts for illustrative purposes alone; Producing MS PowerPoint presentations; Producing graphical displays; Administrative duties.

The positive value of analysts is derived from the application of high level skills whether in dealing with volume crime, major incidents or any other area of law enforcement work.

10.3 INFERENCES AND HYPOTHESES The development of inferences and hypothesis testing provide the Analyst with structures for drawing conclusions, identifying intelligence gaps and recommending areas for further investigation. These processes can underpin each of the analytical techniques and provide a basis for the dissemination of analytical work.

92

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

NIM is concerned with the proactive deployment of coordinated resources and use of a suite of tactics to combat and reduce crime, incidents or behaviour that impact most on communities.

ANALYSIS

10.4 THE NATIONAL INTELLIGENCE MODEL

Guidelines for analytical products and techniques required for mainstream policing have already been developed and published in the form of NIM Analytical Products and Techniques. While national guidance documents, such as the MIM and MIRSAP, make reference to the role of the Analyst and Researcher in major investigations, there has been no reference to analytical techniques or NIM. The role of the Analyst has become more recognised since these key documents were last written and this is reflected in the updated versions. While producing this manual it was clear that the nine analytical techniques, as defined by NIM, did not address all the needs of Major Incident Analysis. An additional analytical technique has been developed in response to this which completes the suite of products that can support a major incident. This is known as Incident Analysis. It was also felt necessary to change the name of Target Profile Analysis to reflect its scope of individuals, such as witnesses, victims, suspects and offenders. This technique has, therefore, been renamed Subject Profile Analysis for this manual.

10.5 THE ANALYTICAL TECHNIQUES 10.5.1 INCIDENT ANALYSIS Incident Analysis involves examining the detail of an incident or series of incidents. It is good practice to maintain a full, comprehensive timeline that includes all data sources, both evidential and intelligence. This can later be sub-sectioned according to the user’s need. Analysis of specialist material, ie, telephone and financial records, should be included within the wider context of the incident data as this can help the evidential case. Recording, sourcing and version control of all material is essential. Incident analysis can involve looking at a number of areas:

• • • •

Events (the entire timespan of an incident or specific timeframes within this); Themes (movements of suspects, observations of witness, routes travelled); Identification of new lines of enquiry (new potential witnesses); Gaps and conflicts in information (5WH matrix).

Effective collation is an essential component of incident analysis. The development of timelines or case charting will provide the foundations for the analytical process. The Analyst should use the most simple, flexible and effective techniques to portray and collate the information. Priority lines of enquiry should be agreed with the SIO.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

93

Analysing timelines – focusing on specific periods or themes within the timeline can help to focus the inquiry by prioritising witnesses, identifying new lines of enquiry, areas for corroboration and further analysis. The examination of sub-sections of the timeline and other data sources may lead to the identification of new lines of enquiry. Equally, time gaps in the sequence of events may offer a new line of investigation or focus enquiries on these specific periods of time. Analysing witness statements – this can involve interpreting the timeline for specific periods where witness statements are particularly crucial, or using a matrix to compare key elements of witness statements. The advantage of witness statement analysis is that it can support a number of processes to develop the investigation:

• Development of key witness interview questions or packages; • Corroboration or disproving of witness statements, using other material such as telephone or financial data;

• Live time analysis such as downstream monitoring. Focusing on the witnesses provides an opportunity to help strengthen the case against a suspect/offender. When preparing interview packages, the Analyst or Researcher will collect and collate all relevant statements and material. They should then liaise with the enquiry teams and senior managers to agree a format and content. In order that the Analyst can continue to provide the inquiry with objective and meaningful analysis, it is important that they are directly involved in a debrief. Downstream monitoring may be considered the appropriate manner in which to do this. Alternatively, live time analysis during a debrief can give the Analyst an opportunity to provide direct evaluation and comparison of witness statements. Analysing gaps – this process involves the extensive use of inference development and hypotheses generation and testing. The gap analysis process can also be conducted in conjunction with other techniques, eg, case charting. Gap analysis can involve simply interpreting charts or other collated material and drawing conclusions about intelligence gaps and conflicts in the material. Recommendations can then be made to fill those gaps and prioritise lines of enquiry in order to generate key information. It can, however, be a more complex and structured process using such techniques as the 5WH matrix.

94

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

ANALYSIS

Whether complex or simple techniques are used, the Analyst must focus on using the material before them to draw logical and reasoned conclusions and to make informed recommendations based on these conclusions. Gap analysis may result in the Analyst recommending a number of tactical options to obtain the material required. This kind of incident analysis may also be commissioned by an SIO to provide information on the prioritisation of resources on the inquiry. The Analyst’s detailed knowledge of key events, witnesses and locations may be used by the SIO to prioritise the deployment of resources in order to gather further material, such as:

• • • •

Search teams – the identification of search zones; House-to-house teams – the prioritisation of residences; Road check teams – the identification of road check areas; Media teams – areas for displaying appeal posters and zones for targeted mail drops.

Incident analysis allows the Analyst to be flexible and innovative in their approach. Taking into consideration legislation, guidance and force working practices (see checklist), there are no constraining factors around the analytical thought processes for the evaluation, analysis and dissemination of incident analysis. Throughout all the analytical techniques the use of hypotheses and inferences will assist in generating meaningful products, but incident analysis, in particular, lends itself to these techniques.

10.5.2 NETWORK ANALYSIS Network analysis aims to understand the nature and significance of the links between a number of elements, such as:

• • • • • • • • • •

Victims; Offenders/subjects; Witnesses; Locations; Vehicles; Communications; Financial; Forensic; Organisations; Property.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

95

Through network analysis, features of the network can be used to aid management decision making, progress the investigation and develop further lines of enquiry. These features include:

• • • • • • • • • • • •

Strengths and weaknesses of the network; Intelligence gaps; Hierarchy; Potential subjects; Key roles played by individuals; Criminal links; Movements of subjects; Potential witnesses; Criminal Business Profile and Modus Operandi (MO); Communication/financial flow; Lifestyle information; Resource deployment and prioritisation (for example, directing of house-tohouse enquiries).

Analysis of the network will involve drawing conclusions about the links within a network and then making recommendations as to appropriate intervention points and identifying gaps in material. The analytical thought processes will often begin during the preparation stage. In order to meet the objectives of the task, analytical observations should be documented and disseminated. Consideration should be given to the dynamics of a network, as listed above, and the nature of the relationships. The Analyst’s responsibility is to determine how these play a part in the wider investigation, particularly if they are criminal networks. Networks may not be criminal. Establishing the network of family and friends of a victim, may provide opportunities or lines of enquiry to establish the victim’s lifestyle or possible witnesses. Network analysis may be used in conjunction with other analytical techniques or to form a stand-alone product. Network analysis can also be enhanced through reference to academic or specialist advice, for example, reference to statistical research regarding the likelihood of family members or sex offenders being the perpetrators of a crime.

10.5.3 SUBJECT PROFILE ANALYSIS Subject profile analysis aims to provide a comprehensive picture of an individual, including:

• Suspect/offender; • Victim; • Witness.

96

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

ANALYSIS

The analysis can be used to support the ongoing investigation, aid management decision making, progress the investigation and develop further lines of enquiry. This analysis is likely to combine a number of techniques and products to describe the subject’s history (including criminal activity), their lifestyle (including financial material), associations, their strengths and weaknesses, and the risks they pose. It should identify intelligence gaps, indicate how sources and resources may be deployed against the individual, assist in the prioritisation of targets and focus intelligence gathering. Suspect/Offender Suspect/offender analysis may involve either a named or unnamed subject. In either case, the content of the product may include some or all of the following elements:

• Associates of the individual (network analysis); • Relationship between the individual and the victim and/or witness; • Incident analysis, eg, routes travelled in the commission of the offence, precursor incidents;

• Lifestyle information, eg, example routine of the individual, employment, key locations, previous addresses, transportation;

• Information on the victim, witness or suspect/offender such as previous convictions, intelligence and previous contact;

• Communication and/or financial material; • Risk analysis; • Physical description. Victim As in the case of suspect/offender analysis, the victim may also be named or unnamed. Victim analysis may also be carried out on potential future victims, highlighting the risk to those individuals. Analysing the victim and factors of the crime relating to the victim may help to identify the offender and may include analysis on the following:

• • • • • • • •

Associates of the victim (network analysis); Relationship between the victim and the offender and/or witnesses; Victim risk and potential future victim risk; Incident analysis, eg, routes travelled in the vicinity of the offence, precursor incidents (phone calls); Lifestyle information, eg, routine of the individual, employment, key locations, previous addresses, transportation, leisure activities; Previous contact with the police and other key agencies, as victim, suspect, offender and/or witness; Communication and/or financial data; Physical appearance and personality.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

97

Witness Witness analysis will predominantly be focused on key witnesses, both named and unnamed. This product may help to identify further witnesses, possible suspects, offenders or victims. Analysing the witness and their connection to the incident may include the following:

• • • •

• • • •

Associates of the witness (network analysis); Relationship between the witness and the offender/suspect and/or victim; Witness risk and possible witness protection; Incident analysis, for example, routes travelled in the vicinity of the offence, precursor incidents such as phone calls which help to clarify statements), comparison with other witness statements; Lifestyle information, for example, routine of the individual, employment, key locations, previous addresses, transportation and leisure activities; Previous contact with the police and other key agencies, as victim, suspect/offender and/or witness; Communication and/or financial data; Physical appearance and personality.

The collection and collation of material, is key to Subject Profile Analysis. Consideration should be given to material from various sources, not just that available via the HOLMES 2 system, such as key agencies and prisons. It is possible that some major incidents will require the Analyst to gain specialist knowledge to enhance and inform the subject analysis, eg, medical records. Subject Profile Analysis may assist and support investigators and analysts in constructing interview strategies, reconstructions and house-to-house strategies. The Subject Profile may be an evolving product. Timing of revisions should be agreed with the SIO and consideration should be given to version control at all stages.

10.5.4 CRIME PATTERN ANALYSIS (CPA) Crime Pattern Analysis (CPA) aims to identify and examine patterns and trends in crime and incident material, and may form part of other analytical products. CPA is a term used to describe a variety of indicators that suggest that there are specific links between crimes. These links can manifest themselves in a number of ways:

• • • •

98

Hotspots; Crime/incident trends; Crime/incident series; General profiles.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

ANALYSIS

A number of methods can be used to undertake CPA:

• • • •

Matrices; Frequency tables; Bar charts; Mapping (GIS).

Innovation is key to all analysis but CPA is particularly open to new methods of interpreting material to establish whether there are specific patterns. An explanatory report must be included to interpret the diagrams and take the product further so that decision-makers are fully briefed. CPA of linked crime types such as robberies and burglaries can be used to determine links to a single major incident or series of serious crimes. Hotspots – these are defined as locations that display significantly higher than average levels of crime or incidents. In a major incident, the Analyst can be expected to evidence the level of significance through the application of statistical techniques. One example where a hotspot may be used within a major incident investigation is multiple crimes, such as gang shootings, within a specific urban area. This may provide options for preventive action. Where the location of the offence(s) appears to be particularly pertinent the Analyst may use GIS to support their analysis. More complex geographical analysis, however, such as the likely residence of an offender, falls within the remit of geographical profilers. When hotspots are identified, it may beneficial to consider other analytical products such as Social and Demographic Trend Analysis to determine the features of that hotspot. Crime/incident trends – a trend can be defined as a broad direction or pattern that specific types or general crimes or incidents are following over a given period of time. Trends are used to predict future levels, types and features of crimes or incidents. Trends might be identified in major investigations that can be used to target preventive resources, for example, seasonal trends may indicate specific victims, times and locations where serious offences are predicted to occur. This can be used to inform the force strategic assessment. Crime/incident series – series are defined as a number of similar crimes or incidents that are linked by MO, intelligence, descriptive information, location or forensic evidence and, therefore, are likely to have been committed by one offender or group of offenders. In major crime, identification of a series may be tasked following a key incident, for example, a rape or sexual assault. Solved and unsolved crimes must be considered, not only to identify offenders but also to identify copycat offences. An offender’s previous offences can be used to identify common characteristics in offences and predict future behaviour.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

99

Analysts must clearly identify distinctive criteria or features of the incident such as victim details, offender, location, MO or suspect description. This can then be used to research similar crimes as well as suspicious and precursor incidents. Research should then be collated into a comparative case chart and analysed to identify similarities and differences in incidents. The possibility of cross-border series must be considered. SCAS is equipped to analyse specific categories of crime nationally, looking for similarities in crimes in all forces in the UK. SCAS is experienced in producing similar fact evidence. The Analyst may have a key role to play in liasing with the SCAS Analyst. The parameters around linked offences should be taken into account, particularly those offences that are cross-border and these should be agreed with the SIO after consultation with SCAS. The identification of a series should assist tactical management decision making by highlighting:

• • • • •

Intelligence gaps; Potential sources of information; Further forensic lines of enquiry; Vulnerable locations; Vulnerable victim types.

Similar Fact Evidence The SCAS database holds the largest data set of detailed crime information in the UK. SCAS uses behavioural analysis to provide statistical support for the likelihood of one offender having committed a number of similar offences. For example, in a series of three offences, there may be forensic evidence available to show an offender committed one offence and only circumstantial evidence for that same offender against the other two. If those offences share similar behaviours, SCAS may be able to provide statistics that show that the combination of behaviours displayed in all three offences is not found in any other offences on the system. This will add significant weight to the prosecution’s argument that that individual was responsible for all three offences, not just the one that can be proved forensically. This service has recently proved useful with the introduction of Bad Character Evidence where the similarity of behaviours shown in a previously acquitted case has been used to support the prosecution of a current case. SCAS will not express an opinion as to whether a particular individual was responsible for the offences under consideration but will simply report on the rarity of behaviour found across a number of offences. General Profiles – a general profile can be defined as the identification of common characteristics of offenders displaying particular offending behaviour, or characteristics of victims. This type of analysis can be used to predict future criminal activity and identify vulnerable victim types so that they can be targeted for prevention measures. A general profile will typically be developed following the identification of a trend so that action can be taken to target specific victims and offenders.

100

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

ANALYSIS

For both crime trends and general profiles, analysis of external data sources, for example, MOSAIC and CENSUS data or socio-demographic data may be useful to the Analyst. This data is particularly useful when identifying potential victim groups such as the elderly. General profiles may be further used in prioritisation of suspects to support tactical operations such as DNA mass screening, where groups of males between certain ages may need to be identified.

10.5.5 RISK ANALYSIS Risk analysis should be considered in all aspects of major crime analysis. It can either be used independently as a final product, or it can form part of all the other analytical products. Risk analysis within major incidents considers the elements of risk to the following:

• • • • • • • • • • • • • • • • • •

Victim; Offender; Groups of offenders; Groups of victims; Witness; Groups of witnesses; Potential victims; Victim or offender’s family members or associates; Public; Police; Specific sections of the community; Locations; Success of the case; Criminal procedures (criminal justice system); Compliance with legislation and guidance; Specific lines of enquiry or tactics used; Prioritisation of any of the above; Prioritisation of historic case reviews (cold cases).

Strategically, risk analysis could be used to identify the risks posed by a particular type of offender, for example, predatory paedophiles. It can also be used to assess whether apparently isolated incidents are in fact part of a larger pattern or trend to which greater importance needs to be given. Alternatively, risk analysis can determine the prioritisation of a number of individuals or groups using a scoring matrix. For example, at a strategic level, it may be necessary to assess the risk posed by individual gang members involved in drugs trafficking and firearms offences.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

101

West Midlands Police have developed a system, Proactive Risk and Intelligence Scoring Matrix (PRISM), which provides objective risk and threat assessment of an individual’s criminal capability. This provides grounds for targeting and prioritisation of suspects and offenders with a sound audit trail. Criteria have been used to assess risk against the impact on key priority areas, NIM outcomes and set against opportunities for police intervention. Scores are then calculated and, based on the results, subjects are prioritised. This matrix can be used alongside network analysis to provide an intelligence picture and maintain a focus on the highest priority subjects. At a strategic level, the Analyst may also be collaboratively involved in conducting Community Impact Assessments. Within the risk assessment process, risk analysis serves to provide a qualitative context around specific criteria. Analysts can expect to work alongside senior officers and specialist staff in determining the risk process. The Analyst should evaluate the criteria that are material to the objectives of this piece of work through brainstorming with the senior management team and other relevant staff. These criteria should then be evaluated according to the level of risk they pose and the likelihood of recurrence, in consultation with the senior management team. The key aim of risk analysis is to identify risk, measure its likely impact and then, depending on the level of risk, take mitigating action to prevent high-risk scenarios from developing. It is, therefore, imperative that the Analyst is involved in recommending actions to mitigate against potential problem areas. This should be completed collaboratively.

10.5.6 MARKET PROFILE Market profiles can help to analyse a market around a given commodity. These can be criminal markets such as drugs or organised immigration, or legitimate markets. These profiles detail how active the market is, the price and availability of commodities and services, and who the key players are within that market. The legitimate markets may provide lifestyle or motive information that assists the investigation. Market profiles can be combined with a number of other analytical techniques including CPA, network analysis and criminal business profiles. They can also be used to identify potential new sources of material, emphasise emerging trends and key players, focus intelligence gathering and aid management decision making. They may also help to understand the wider picture surrounding an incident. At a strategic level, market profiles can assist in predicting future incidents and both potential victims and offenders. In addition, comparisons can be made following an incident and they may help in evaluating risk. A full market profile can only be established by accessing every available source of material including multi-agency and partnership data. A market profile will assess such issues as business processes, market forces and economic drivers. Police data alone is not sufficient. Advice needs to be sought from specialists in relation to economic material.

102

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

ANALYSIS

The material used in market profiles can often be complex, therefore, presentation of the findings should be in the simplest format.

10.5.7 SOCIAL AND DEMOGRAPHIC TREND ANALYSIS Social and Demographic Trend Analysis examines the nature of demography and its impact on society, locations, groups of offenders and victims, and criminality. This product can be used to support both strategic analysis and tactical operations and may be used in conjunction with other analytical products. Strategically, socio-demographic factors may be analysed to provide information concerning the following:

• • • • • •

Levels of and trends in major incidents; Changing levels of criminality; Community impact and risk assessments (eg, schools); Victim groups (occupations, beliefs); Results analysis to look at the impact of changes in legislation on criminality; Strategies to prevent major crime.

On a tactical level, this product can be applied in a number of ways:

• Suspect prioritisation, for example, demographic characteristics can be used to identify and prioritise subjects for mass DNA screening;

• Identification of victim, witness or offender groups, eg, the demographics of a group within a specific location that becomes a crime scene;

• Production of media strategies; • Identification of locations at risk, eg, where victims may gather such as schools. The majority of material to support Social and Demographic Trend Analysis will come from multi-agency and partnership sources. Academic and open source data may also be used. It is important to ensure that all source data and subsequent analysis of that material uses appropriate statistical methods. Analytical mapping techniques may be used in support of Social and Demographic Trend Analysis. Examining trends requires analysis of comparative data sets, therefore, time parameters should be clearly defined at the start of the investigation and reviewed with the SIO and/or analyst managers. In order that trends add value to the decisionmaking proccess, they should be forward looking and predictive. Social and Demographic Trend Analysis can be most valuable when produced in conjunction with risk analysis and the development of risk matrices including sociodemographic factors.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

103

10.5.8 CRIMINAL BUSINESS PROFILE Criminal business profiles aim to detail how criminal operations/businesses operate. A criminal business can be described in the same way as a legitimate business, the only difference being that with a criminal business there is always a victim. This technique breaks down the criminal business process into stages, focussing on key elements of the business process, such as:

• • • • •

Exact nature of the business; Key players involved; Technical expertise needed within that business; Methods of transporting goods; Methods financing the criminal operations.

A criminal business profile should assist in an investigation by identifying key stages of a criminal operation that cannot be achieved without the completion of another, thereby indicating areas for disruption. It should also highlight weaknesses in systems or procedures that are being exploited and identify intelligence gaps and new lines of enquiry. A business profile may also be used to understand a legitimate business, where this is pertinent to an inquiry. A victim’s business may provide leads in an inquiry, for example, combined with a network chart it may indicate associates who need to be interviewed about their role in the business operation.

10.5.9 RESULTS ANALYSIS Results analysis aims to evaluate the effectiveness of law enforcement activities, in order to:

• • • • •

Monitor the progress of lines of enquiry; Identify good practice; Highlight areas for improvement; Aid professional development; Provide a framework for operational debriefing.

Results analysis can also be applied to an individual or a group of tactics within a major investigation, such as the effectiveness of house-to-house enquiries, the use of the media and reconstructions.

104

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

• Clear objectives as to the intended outcome of the planned activity should be • •

•

•

ANALYSIS

In order to ensure that results analysis is effective, certain elements must be present:

set from the start; Mechanisms to measure the intended outcome and progression towards this should be agreed and put in place at the start; A collaborative approach should be adopted between the Analyst, investigating officer(s) and any other relevant party, for example, a partnership agency or performance analyst; The Analyst should be the lead in this process with progress being the responsibility of, and recorded by, the persons in the best place to do this, for example, house-to-house staff or search teams; The final analytical product will be owned by the Analyst.

Consideration should be given to both qualitative and quantative measures. The results analysis process may be enhanced by comparison against similar operations or tactics in other forces or organisations. In addition, the collation of national good practice will provide a benchmark against which the results can be compared. Both the objectives and the agreed mechanisms to measure effectiveness should be agreed with the SIO and documented in the policy book and by the Analyst. The principles and methodology of results analysis can be applied within a major incident review.

10.5.10 OPERATIONAL INTELLIGENCE ASSESSMENT Operational intelligence assessments aim to ensure that investigations remain focused on their key objectives. This technique is used in ongoing operations to verify that protocols, such as the correct authorisations, are present. It also highlights diversification from agreed objectives, aids compliance with HRA, RIPA and other legislation and prevents ‘mission creep’. The original terms of reference or policy file must, therefore, reflect the objectives of the operation. Operational intelligence assessments can be particularly informative in major incidents that are lengthy and/or complex where sizeable intelligence collection plans may be in place or tactics within the investigation change. It is advisable that within these types of cases SIOs commission operational intelligence assessment in advance. This product may also support the review process. A collaborative approach may be required if the scope of the operational intelligence assessment includes specialist material, eg, authorisations, knowledge of RIPA and compliance with specific legislation such as HRA. In addition, a good communication link with the SIO is advisable to ensure that the Analyst has full knowledge of the decision-making process and the justification for any divergence from the original objectives. The Analyst will examine all data sources including analytical material, comparing it against the original objectives and assessing whether the investigation is appropriately focused. NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

105

10.6 WHICH ANALYTICAL TECHNIQUES SHOULD BE USED? Different analytical techniques work with different types of major incident, the following examples demonstrate this but are not prescriptive. Where analysts feel that alternative techniques meet their specific needs then these should be used.

10.6.1 METHODOLOGY The majority of analysts will be aware of the problem analysis triangle where, for an incident to happen, the following factors will be present:

• Victim; • Offender; • Location. This can be shown graphically as follows: FIGURE 10 Problem Analysis Triangle Location

Incident

Victim

Offender

Cohen L and Felson M Social Change and Crime Rate Trends: A Routine Activity Approach, American Sociological Review, (1979)

Within a major incident there tend to be a number of starting points. For example:

• • • •

The discovery of a victim; The identification of a scene of a crime (location); A confession by an offender; A report of an incident by a witness.

Many incidents contain a combination of these factors. These start points of an incident can indicate to the Analyst which route they should adopt for generating analytical products. The analytical products which can potentially be applied to each of the factors of victim, offender, location and incident are demonstrated in Figure 11.

106

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

ANALYSIS

FIGURE 11 Major Incident Problem Analysis Triangle Location Social and Demographic Trend Analysis Risk Analysis CPA

Incident

Network Analysis Market Profile Risk Analysis Subject Profile Analysis

Incident Analysis Subject Profile Analysis Risk Analysis Market Profile Criminal Business Profile Network Analysis CPA

Network Analysis Criminal Business Profile Market Profile Risk Analysis Subject Profile Analysis

Victim

Offender

Social and Demographic Trend Analysis CPA

Social and Demographic Trend Analysis CPA

10.6.2 VICTIM-RELATED TECHNIQUES FIGURE 12 Victim-Related Analytical Techniques

Network Analysis Market Profile Risk Analysis Subject Profile Analysis

Victim Social and Demographic Trend Analysis CPA

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

107

TABLE 13 Victim-Related Analytical Techniques Analytical Techniques

Types of Incidents

Network Analysis (Victim)

• Assists in identifying the offender in a drug gang killing or domesticrelated incident.

• Identifies associates in a murder to assist with interviewing and building up a lifestyle picture, when analysing a case of stranger rape. Market Profile

• Identifies the victim’s role within an illegal immigration market. • Maps out a drugs market and assists in understanding the pressures on that market and investigating an epidemic of drugs overdoses.

• Maps out a firearms market which is integral to understanding intergang killings. Risk Analysis

• Identifies vulnerable victims of domestic violence or child abuse. • Identifies groups of victims, such as sections of the community, targeted in a critical incident.

• Identifies potential victim groups, such as, the elderly where there is a series of sexual assaults against this age group. Subject Profile Analysis

• Establishes the lifestyle of an unknown or known victim.

Social and Demographic Trend Analysis

• Identifies areas or particular community groups at risk within a critical incident.

• Prevents further cases or investigates cases of terrorism against gay or religious groups or ethnic communities.

• Examines how changes in legislation may affect trends in major

• •

• •

Crime Pattern Analysis

incidents such as changes to the Mental Health Act or immigration legislation. Locates asylum seekers in volatile areas. Assesses the implications on major crime with the construction of towns, villages, temporary Travellers sites or location of animal testing facilities. Considers occupations being targeted in major incidents, such as nurses, police or prostitutes. Some forces undertake homicide prevention work and strategic analysis by analysing, among other things, demographics leading to the development of risk factor models which inform frontline policing about the aspects of risk and danger. The focus of this unit is on specific victims and crime types.

• Examines series of victims who have similar attributes. • Considers repeat victimisation of specific types of victims. • Analyses general profiles of victims with vulnerable features such as age or sexuality.

• Determines trends of potential victim status within specific circumstance, such as when drunk at New Year or as a driver.

108

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

ANALYSIS

10.6.3 OFFENDER-RELATED TECHNIQUES FIGURE 13 Offender-Related Analytical Techniques

Network Analysis Criminal Business Profile Market Profile Risk Analysis Subject Profile Analysis

Offender Social and Demographic Trend Analysis CPA

TABLE 14 Offender-Related Analytical Techniques Analytical Techniques

Types of Incidents

Network Analysis (Offender)

• Assesses group hierarchy for drug dealing, gun smuggling, paedophile rings or terrorist networks to determine dynamics of the network.

• Identifies potential previous victims, where there is a possibility of historical offending.

• Identifies those involved in a conspiracy. • Builds up a picture of the offender’s lifestyle. • Suggests the deposition site of a body if the offender’s lifestyle is known. Criminal Business Profile

• Identifies criminal activity involved in an organisation committing criminal acts, such as gang-related violence.

• Suggests the method of operation of terrorist gangs, identifying a conspiracy.

• Suggests the method of operation of an electoral vote-rigging scam. • Identifies common offenders in a series of crimes through the use of code words in a terrorist bomb attack. Market Profile

• Shows where the acquisition of goods or services is a motivational factor in the offence.

• Assists in understanding the context within which a criminal business is operating.

• Prevents revenge attacks in a drug war by understanding the pressures within the market alongside hierarchies.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

109

TABLE 14 Offender-Related Analytical Techniques (continued) Analytical Techniques

Types of Incidents

Risk Analysis

• Identifies the threat from a bail hostel occupied by sex offenders, preventing crime by mitigating against this risk.

• Conducts community impact analysis where the suspect has been identified.

• Highlights the risk of escalation of actions by an unknown sex offender in a series of offences.

• Identifies the risk of fair trial issues to an offender who has been remanded. Subject Profile Analysis

• Outlines the lifestyle of the offender. • Suggests the motivation of the offender.

Social and Demographic Trend Analysis

• Targets offender groups for intelligence-led DNA screening where a sexual offence has taken place.

• Assesses how changes in legislation, such as the release of mental health patients or care in the community, may impact on the trend of major incidents. • Shows how economic factors are linked to domestic violence.

Crime Pattern Analysis

• Identifies common factors in a series of crimes, such as the offender’s behaviour, language or dress.

• Identifies previous offences following the arrest of an offender. • Highlights habitual patterns of offending in strategic analysis such as domestic violence links to alcohol or drugs.

• Suggests how preventive major incident analysis may consider the systematic abuse or victimisation of an offender as a trigger for their offending behaviour.

110

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

ANALYSIS

10.6.4 LOCATION-RELATED TECHNIQUES FIGURE 14 Location-Related Analytical Techniques Location Social and Demographic Trend Analysis Risk Analysis CPA

TABLE 15 Location-Related Analytical Technique Examples Analytical Technique

Types of Incidents

Social and Demographic Trend Analysis

• Identifies environmental factors that have made a crime scene

Risk Analysis

• Identifies locations of sex offenders in a vicinity for risk assessment. • Risk assesses specific locations which may become a target for

vulnerable such as a bail hostel or a residential area for asylum seekers. • Assesses physical factors of a location such as CCTV, lighting, foliage that conceal a location from view and make it vulnerable. • Assesses events such as theme nights in a nightclub may attract a different demographic to that normally present, for example, a ‘garage night’ may attract a different age and ethnicity group which temporarily changes the entire demographic of a town. • Considers socio-demographic features when developing specific media strategies.

criminal activity such as a terrorist attack or nightclub theme night.

• Suggests common factors of a location that can be used to pre-empt further attacks or prove links between historical cases.

• Assess the impact that opening a crack house has on local residents and other locations such as nearby schools. Crime Pattern Analysis

• Identifies previous offences by location. These can be solved or unsolved murders or rapes, where the offender continually focuses on a locational aspect. • Identifies precursor offences or incidents by focusing on a specific location. Maps incidents of voyeurism within an area, using time parameters, before a rape occurred. • Identifies specific locations that result in the vulnerability of groups such as foreign students congregating in parks during the summer.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

111

10.6.5 INCIDENT-RELATED TECHNIQUES FIGURE 15 Incident-Related Analytical Techniques

Incident Incident Analysis Subject Profile Analysis Risk Analysis Market Profile Criminal Business Profile Network Analysis CPA

TABLE 16 Incident-Related Analytical Techniques Analytical Techniques

Types of Incidents

Incident Analysis

• Compares interviews and downstream monitoring. • Analyses activity in the hours prior to a murder. • Corroborates witness statements of events in a town centre prior to a terrorist bomb.

• Analyses CCTV sightings showing movements of vehicles in the vicinity of a rape and identifies further witnesses and lines of enquiry. Subject Profile Analysis

• Looks at lifestyle and associations of groups of witnesses, suggesting why they are in a key location at a specific time.

• Looks at the previous convictions of a witness and previous contact with the police, as they may provide a key sighting or show, for example, that they are a persistent hoax caller. • Analyses a witness who was the last person to see the victim alive. This is statistically proved to be the most likely person to have committed the crime. • Analyses where the witness has previously been an offender. Risk Analysis

• Highlights the risk of further offences within a series of serious sexual offences.

• Assesses the risk of fair trial issues, and analyses documents to support this.

• Identifies the risk to witnesses. • Assesses the risk of an unreliable witness being used in a case and of using hearsay evidence from this person, and their motivation for coming forward. Market Profile

• Places the context of an incident within a wider market such as people smuggling and gangmaster operations.

• Predicts future incidents based on market changes such as availability of drugs and guns. Criminal Business Profile

112

NOT PROTECTIVELY MARKED

• There may be changes to a criminal business profile as a result of a major incident, for example, terrorists may become forensically aware and change their procedures. This may provide evidence for the case by suggesting their guilt.

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

ANALYSIS

TABLE 16 Incident-Related Analytical Techniques (continued) Analytical Techniques

Types of Incidents

Network Analysis

• Uses witness association charts to highlight a witness’s links to either the victim or offender, identifying where witnesses are sharing information. • Assesses gang-related shooting where witnesses are members of rival gangs.

Crime Pattern Analysis

• Identifies the possibility of connected incidents using similar fact evidence.

• Examines similar MO in series of sex offences.

The following matrix summarises where each of the problem analysis triangle elements link into specific analytical techniques. FIGURE 16 Major Incident Analysis Technique Matrix Product

Victim

Offender

Location

Incident

CPA

✓

✓

✓

✓

Risk Analysis

✓

✓

✓

✓

Network Analysis

✓

✓

✓

Subject Profile Analysis

✓

✓

✓

Market Profile

✓

✓

✓

Social and Demographic Trend Analysis

✓

✓

Criminal Business Profile

✓

✓

✓

Incident Analysis

NOT PROTECTIVELY MARKED

✓

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

113

114

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

SECTION 11

Section 11 DISSEMINATION

T

here are a number of methods used to disseminate analytical products and they are detailed in this section. The Analyst’s role both before and during the court process is explored and the legislative requirements regarding disclosure are examined.

CONTENTS 11.1 11.2 11.3 11.4 11.5 11.6 11.7

11.8

The Dissemination Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Charts and Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Briefings and Presentations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Analytical Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exhibits ............................................... Disclosure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Analyst’s Role in Court . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.7.1 Pre-Court Involvement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.7.2 Attendance at Court as a Professional Witness . . . . . . . . . . . 11.7.3 Material for Court . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.7.4 Attendance in the Court Room to Support the Prosecution Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Public Inquiries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

116 117 117 118 119 119 120 120 121 122 122 123

© ACPO Centrex 2006

115

11.1 THE DISSEMINATION PHASE The dissemination of analytical products is critical to the intelligence cycle and can be achieved in the following ways:

• • • • • •

Report; Chart and Report; Presentation; Briefing; Analytical Maps; Exhibits.

Time management skills are required by an analyst within a major investigation. A review of actions against priority deadlines should be continuous to ensure that products are delivered on time. Being part of the management team and maintaining good communications with the SIO and Analyst Manager will ensure that the Analyst has full knowledge of the wider implications of delivery times such as court dates and review dates. The appropriate method of dissemination may vary according to the time available, the users’ requirements and the nature of the material itself. The Analyst must contribute to ensuring that the investigation maintains its momentum and is driven forward by the timely delivery of analytical products. The dissemination of all analytical material should be compliant with the Criminal Procedure and Investigations Act, 1996 and the amendments to it brought about by the Criminal Justice Act 2003. All documents produced are subject to disclosure. A decision may be made, however, to withhold intelligence information in the interests of Public Interest Immunity (PII). It is, therefore, essential that all documents are marked according to the GPMS and labelled according to whether they are for intelligence purposes or evidential documents. If this is unclear, advice should be sought from the Disclosure Officer. From the outset, analysts should ensure that all products are subject to a clear version control procedure. Similar to the charting protocols, analysts should also decide on and log the frequency of revisions, for example, each time a document is disseminated. In addition, all previous versions should be retained. Regardless of the method of dissemination, all products should have a clear audit trail from the provenance of the document through to the recommendations made to further the investigation. The Analyst should ensure that final products are sent to the MIR for inclusion on HOLMES 2 whether as a document or an exhibit. All notebooks and rough material used throughout the analysis process should also be forwarded to the MIR. Where a covert intelligence analyst has been appointed, the dissemination of their analytical material to the MIR should be discussed and decided on by the SIO.

116

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

• • • •

The usefulness of the product; The extent of its application; Quality; Comparison against the original task.

DISSEMINATION

As dissemination is one of the key points at which analysts interact with customers, analysts are always encouraged to seek feedback. Consideration may be given to:

Feedback can be used to develop the Analyst and assess their performance against their Performance and Development Review (PDR). It can also inform the Analyst Manager as to the extent of organisational knowledge and understanding of the Analysts’ role. All analysts and researchers have a responsibility to their profession to disseminate good practice to their colleagues, both locally and nationally. It is important, however, to consider disclosure and any restrictions on information due to the GPMS marking. It is often good practice to sanitise documents before disseminating them to outside organisations. Any dissemination of this kind should always be authorised by the SIO.

11.2 CHARTS AND REPORTS The production of analytical reports (or charts supporting such reports) will be one of the most frequent forms of dissemination. As in all analysis and in accordance with NIM and analytical training, a chart alone does not represent a final analytical product. The analytical thinking, interpretation and findings should always be documented. A report is a method of capturing this interpretation. If this method is chosen, there should be a clear link between the chart and the report. A report should always be:

• • • •

Clear – using plain English; Concise – focused on the original task; Structured – logical order, use of headings and bullets; Referenced – source material, links to charts and authors details.

11.3 BRIEFINGS AND PRESENTATIONS The regularity of briefings on major incidents may result in the Analyst producing a series of presentations rather than full written reports. This dynamic format will frequently give the inquiry its momentum. The Analyst should always be aware of the environment they will be presenting in and tailor their performance accordingly. The use of technology (eg, MS PowerPoint) may enhance the delivery and allow for a recorded audit trail of findings and recommendations.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

117

Live-time analysis or briefing situations may not always be supported by technological presentations. It is imperative that the findings and recommendations are recorded through minutes or are subject to audio or visual recording. The content of the presentation needs to match the requirements of the audience. It may be necessary to discuss these with the audience beforehand, gauging levels of understanding and ensuring that the release of sensitive material is appropriate. It is advisable to consider briefing the SIO as to the content of the presentation. This will serve to enhance the working relationship between the Analyst and the SIO, and ensure that the delivery of potentially controversial material is managed appropriately. It is often beneficial to adopt a simplistic approach to presentations to prevent the audience from being distracted. For example, the use of over-elaborate animation and sound within an MS PowerPoint presentation may detract from the overall content. Supporting material may be required to hand out to the audience. It is advisable not to overload people with material and clear instructions should be given by the Analyst regarding its retention. For example, network charts may need to be collected in at the end of a presentation if new versions are going to be produced.

11.4 ANALYTICAL MAPS Maps may be used as a form of dissemination, particularly where a large amount of material can be displayed geographically. Travel routes or positions of key subjects at specific times may be better displayed in a map than descriptively in a report. The combination of geography and time elements may be best displayed on an analytical map within a presentation. Geographical layouts may not only include standard cartographic maps but also floor plans, building plans or specific sites such as schools. It may be useful to ensure that a standard map is agreed as a common base product where this is being used to pinpoint locations from, for example, sightings by witnesses or searches. The application of analytical maps can be very wide. Target audiences include:

• • • •

Enquiry teams verifying specific sequences of events or locations; Search teams conducting intelligence-led searches based on analytical findings; House-to-house coordinators prioritising locations for inquiries; Forensic teams targeting specific rooms within properties for SOCO deployment; • Family Liaison Officers (FLO) verifying victim routes. Compliance with copyright law should always be considered when disseminating analytical maps. The map scale should be included in the labelling conventions.

118

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

All analytical material has the potential to be exhibited. A MG11 statement should accompany any product that is exhibited. This statement should contain the following as a minimum:

• • • • • • • • • • •

Name; Role; Where stationed; Qualifications; Experience; Operational name; The task and date on which it was tasked; The date on which the final product was produced; Name and reference of the product; Who it was physically handed to; Factual description of product.

DISSEMINATION

11.5 EXHIBITS

Where IT systems are used to produce the product, these should be named and any training on these systems stated, including the date on which the training took place. An exhibit label will be completed for each separate exhibit. This will detail the exact description of the product, the date and time produced, the unique reference and any subsequent movements of that exhibit between persons. It is imperative that the exhibit label matches the description of the item in the statements, verbatim. Advice should be sought from the Exhibit Officer on exhibit procedures. Training is available for analysts covering statement writing and report writing for use in court.

11.6 DISCLOSURE Disclosure is covered by the Criminal Procedure and Investigations Act 1996. Such legislation is in place to allow all material from an investigation to be made available to the defence. As with the entire product from an investigation, the Analyst’s work will generally fall into one of three categories:

• Used material – that which is used as part of the prosecution case within court proceedings;

• Unused material – that which is used to progress the investigation but is not to be used as part of the final prosecution case;

• PII material – material which is deemed to be of a sensitive nature or containing elements of sensitive material. Such material requires a separate PII hearing before the judge, where a decision is made as to whether to protect this PII information or to disclose it as unused material.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

119

It is imperative that analysts consider disclosure from the very outset of an investigation. It is advisable to have a discussion with the appointed Disclosure Officer and obtain advice as to what kind of material will fall into each of the three categories described above. It is good practice for all analysts and researchers to structure their work in such a way that facilitates easy disclosure of material. Clear naming conventions should be used and it is advisable, within the document name, to use a symbol or word to indicate which items contain sensitive material, as this identifies the potential for PII material. The labelling of documents to distinguish between intelligence and evidential material also becomes particularly important when reviewing work and deciding on how the documents are to be disclosed. The Analyst is advised to discuss the maintenance of a disclosure log and general good practice with the Disclosure Officer from the start of the investigation. It is the Disclosure Officer’s role to review all the documents gathered and to prepare the schedules. Training on disclosure legislation and its application can be sought locally from crime trainers or from experienced disclosure officers.

11.7 THE ANALYST’S ROLE IN COURT As analysts are frequently used in major incidents, they can be expected to be involved in the court process and this is reflected in the Analyst’s role profile. The Analyst can link in with the court process in the following ways:

• • • •

Pre-court involvement; Attendance at court as a professional witness; Production of material for court; Attendance in the court room to support the prosecution case.

It is recommended that all analysts involved in any aspect of the court process undertake the relevant training to cover the issues of providing evidence in court, as well as making statements and report writing for court. In the lead up to a court hearing, the prosecution and defence will agree which items of evidence will be accepted into court without the exhibitor having to give evidence over them. Even if an analyst has exhibited material that is used in court, it may not be necessary to attend court and give evidence in relation to that work.

11.7.1 PRE-COURT INVOLVEMENT Throughout an inquiry, an analyst can provide crucial support to the development of the evidential case through the production of analytical products that drive the inquiry forward.

120

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

DISSEMINATION

It is good practice for analysts to be involved with the CPS and barristers throughout the investigation. Early involvement will ensure that the production of material for court is communicated to the Analyst with as much notice as possible. Where the evidential case is particularly complicated, the Analyst can assist in providing a logical structure for the court file. The pre-court discussions with the CPS and barristers may involve the Analyst explaining their material, agreeing to further material being presented in a specific manner to the jury and/or the best format in which to present the material. Through pre-court involvement, the evidential case may be progressed further and actions may be raised regarding such issues as anticipating lines of defence. It is also good practice for analysts to visit the court prior to any commencement of court proceedings in order to familiarise themselves with the court surroundings and etiquette of procedures. Equally, advice can be sought from experienced analysts or officers.

11.7.2 ATTENDANCE AT COURT AS A PROFESSIONAL WITNESS It is essential that all analysts remember that any material they work on can ultimately be used in court. Their work, therefore, must be of the highest standard. Within the court environment, the Analyst is afforded the status of Professional Witness. A Professional Witness will present factual evidence that has been produced by them within their professional role. A distinction is made between them and an Expert Witness. An Expert Witness offers opinion based on skills, experience and knowledge. Prior to attending the court, the Analyst can prepare for the experience in the following way:

• Seek advice from analyst managers and experienced colleagues; • Produce accurate and precise exhibits and statements for court; • Prepare training and experience schedules that demonstrate career details as an analyst and professional knowledge;

• Refer to all notes and if necessary have these ready to take along providing that this is acceptable to the judge;

• Consider using peers and managers to practice being cross-examined in preparation for the live event. The Analyst will be advised if they are required in court through a letter or notice which also suggests the dates which need to be kept free. Even if an analyst receives a court warning it does not automatically mean that they will be giving evidence.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

121

Training analysts is strongly recommended but there are some tips that can be used by the Analyst attending court:

• • • • • • • • •

Only answer questions and talk about what is known; Do not speculate; Stick to the facts; It will probably help to address the judge with responses rather than counsel; Turn feet to face the judge so that as a witness, the Analyst or Researcher is not drawn into direct banter with counsel; Maintain objectivity; Look for opportunities to emphasise the positive points of work that is subject to questioning; Keep answers as short as possible; Do not give any information beyond that which answers the question asked.

Analyst managers should be aware that this can be one of the most stressful situations for analysts and welfare support should be made available.

11.7.3 MATERIAL FOR COURT Analysts may be requested to undertake the development of material to assist in the wider court process. This material is usually required to simplify complicated information, and will usually be provided to the jury in order to assist with clarification of key issues or facts. This may range from simple timelines and route maps to the display of links in fibre and forensic information. The Analyst will usually have the skills and technology to create graphics which easily demonstrate prosecution material. It is important to ensure that the Analyst is not being used as a graphics officer. The key question that should be answered is ‘does the Analyst have the best detailed knowledge to produce specific items for court?’ If the answer is ‘yes’, and it is possible for the Analyst to complete this, it is good practice to apply basic procedures such as thorough labelling and sourcing material. Where charts are used, charting protocols apply. Material produced by the Analyst throughout the case may be used as part of the material for court. This may involve using part of a timeline to communicate a specific prosecution point. In this case exhibits must be in an evidential format rather than an intelligence format.

11.7.4 ATTENDANCE IN THE COURT ROOM TO SUPPORT THE PROSECUTION CASE The Analyst will usually have a detailed knowledge and understanding of a case. Analysts now attend court to support the entire prosecution team by using their knowledge to highlight discrepancies in witness testimonies in court. Traditionally this function has been undertaken by a member of the MIR using a HOLMES 2 computer but the SIO should be aware of the value that an analyst can add in this situation. The Analyst or their manager should consider negotiating such a role, if it would benefit the case.

122

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

11.8 PUBLIC INQUIRIES An analyst may be involved in producing material to support a public inquiry. In the recent past high profile cases that have resulted in public concern, or cases involving systemic errors within the criminal justice system, have been subject to such an inquiry.

DISSEMINATION

If the Analyst is also a witness, they are not allowed to enter the courtroom until after they have given evidence. If this is the case then advice should be sought from the SIO.

All products can be used to support this process and as with court material, the Analyst may be in the best position to collate material for the inquiry process. During a public inquiry relating to multiple murders, the Analyst produced material including a comparative case chart which documented similarities between each case eg, victim details, offender actions and circumstances relating to death.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

123

124

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

SECTION 12

Section 12 DIRECTION

C

lear and informed tasking by the Senior Investigating Officer is essential to the successful progress and resolution of a major investigation. The importance of reviewing major incidents and analytical products to support the direction of an investigation are explored here. Feeding information back into the NIM Tasking and Co-ordination process is also discussed. CONTENTS 12.1 12.2 12.3 12.4

12.5 12.6 12.7 12.8

The Direction Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tasking and Co-ordination Group Process . . . . . . . . . . . . . . . . . . . . . Community Impact Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Reviews ............................................... 12.4.1 Results Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.4.2 Risk Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.4.3 Operational Intelligence Assessment . . . . . . . . . . . . . . . . . . . 12.4.4 Reviewing Analytical Processes . . . . . . . . . . . . . . . . . . . . . . . . Links into Strategic Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Dissemination of Intelligence into Regular Policing . . . . . . . . . . . . . Hypotheses Testing and Inference Development . . . . . . . . . . . . . . . Reviewing the Analyst’s and Researcher’s Workloads . . . . . . . . . . . .

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

126 126 127 127 128 128 128 128 129 129 129 129

© ACPO Centrex 2006

125

12.1 THE DIRECTION PHASE The intelligence cycle is a continuous process driven by the direction of the senior officer. The results of all the evaluative and analytical processes can either confirm or change the direction of an inquiry. Although the Analyst can add value throughout the various stages of the intelligence cycle, the impact of the analysis and recommendations made can be significant during this stage. Recommendations and subsequent decisions by the senior management team need to be fully documented in the SIO’s policy file. The Analyst should also ensure that they are up to date with priorities and lines of enquiry. Other than through the dissemination of analysis and recommendations, and the subsequent impact these can have on the direction of the inquiry, there are a number of other ways in which an analyst can contribute to the direction of an investigation:

• • • • • • • • • • •

The Tasking and Co-ordination process; Community Impact Assessment; Reviews; Results Analysis; Risk Analysis; Operational Intelligence Assessment; Links into strategic analysis; Dissemination of intelligence into regular policing; Hypotheses testing and inference development; Reviewing analyst workload; Reviewing analytical processes.

12.2 TASKING AND CO-ORDINATION PROCESS The Analyst may have a role in the Tactical Tasking and Co-ordination Group (T&CG) process. Analysis produced during the course of the investigation may be required to support requests for resources or to inform senior managers of the progress of the case. Specific pieces of analysis may be tasked through this process, in particular Risk Analysis, Results Analysis or Operational Intelligence Assessments as these techniques may assess performance against set objectives and the effectiveness of lines of enquiry. The Analyst may be required to provide products for the Strategic T&CG process. Strategic Assessments will take into account historic and predictive levels of crime that will contribute to decision making and the setting of priorities for the coming period. There may be specific investigations or long-term inquiries that need to be prioritised within this process. The SIO may regularly attend tasking meetings to update the group on progress and resourcing requirements. In some cases the major incident team may form their own T&CG process to provide a structure for assessing progress, managing future activity and coordinating resources.

126

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

Community Impact Assessments are used to evaluate and analyse the risks and effects of operations or specific police activity on a local community. The Analyst may be involved in the production of such a document which should be a collaborative approach with local officers, investigation teams, community beat managers and representative members of the community.

DIRECTION

12.3 COMMUNITY IMPACT ASSESSMENT

A Community Impact Assessment may be commissioned at any stage. As the nature of this product provides information to decision makers about the impact of activity, it is, however, most useful to consider it at the direction stage. The Analyst’s involvement in assessing community impact is most likely to take the form of structured risk analysis. In addition, the result of the Community Impact Assessment may be to instigate Results Analysis. The SIO, Gold groups or Tactical T&CG may commission a Community Impact Assessment. In the event of a major incident review, consideration is always given to conducting a community impact assessment at the start of this process.

12.4 REVIEWS A review can occur either at specific time intervals during an ongoing investigation or at any given time if the crime remains undetected. The very nature of a review means that it is likely to change the direction of an investigation although the degree to which this occurs may vary greatly. A review is a constructive tool designed to enhance the investigation and ensure that the direction of the inquiry is clear. The Analyst may be involved in producing specific pieces of work to support the review process, such as Results Analysis, Operational Intelligence Assessment or Risk Analysis. A review may also require an analyst to examine specific lines of enquiry or analytical products that have already been produced, in order to identify potential gaps or opportunities for further investigation. An analyst involved in a review may not only provide specific products but may also use their skills and knowledge in relation to the application of the intelligence cycle to major incident reviews. The evaluative and analytical process applied to material reflects the process used in a review. It is good practice to use an experienced analyst in the review process. The Analyst who completes this review will usually be different from the Analyst who worked on the original inquiry. This will ensure objectivity and may inject a new perspective to work already completed.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

127

12.4.1 RESULTS ANALYSIS Results Analysis may be commissioned either to support a review process or to examine the effectiveness of specific lines of enquiry. It is particularly important during the direction stage of the intelligence cycle as it can change the priorities and focus within an inquiry. It may also be used to inform decision makers about what works well and what does not thereby ensuring that future tactics, either in current or future inquiries, are efficient and effective. It may be decided that Results Analysis is used to measure the effectiveness of recommendations that are generated by a review. It is advisable that this product is used where the recommendations will have an impact or are anticipated to significantly change the direction of the inquiry.

12.4.2 RISK ANALYSIS Risk Analysis of either a specific course of action or the entire investigation can influence the direction of a major incident. Comparative Risk Analysis can also influence the direction regarding the prioritisation of cases. The Analyst should work in collaboration with relevant parties to ensure that the final product is comprehensive. Risk Analysis may also constitute a discrete piece of work on the Community Impact Assessment, to support the review process.

12.4.3 OPERATIONAL INTELLIGENCE ASSESSMENT Due to its nature, Operational Intelligence Assessment may alter the direction of an investigation by demonstrating divergence from the original objectives. This may form part of the review process or may be used by the SIO to pre-empt a review. Use of terms of reference for the Analysts will assist in this process.

12.4.4 REVIEWING ANALYTICAL PROCESSES It may be necessary to review the Analyst’s role in a major incident, either as part of a wider review or as a specific piece of work. This would be used to inform analyst managers of:

• • • •

Organisational understanding of the Analyst’s role; Training needs for SIOs, investigators and specialist departments; Training and development needs of analysts; Improvement and/or amendments of processes and logistics to support analysis; • Data quality and accessibility; • Compliance with guidance and legislation; • Good practice. All analyst managers and heads of intelligence analysis have a responsibility to ensure that analytical processes which support major investigations are continually reviewed and developed.

128

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

Strategic analysis is required to understand the longer-term picture of major incidents. It can be used to identify the long term intelligence, prevention and enforcement opportunities for major crime. An informed strategic view will aid senior managers in assessing resource implications, budget setting and business planning. Strategic analysis can play a large part in preventing major crime. Through the identification of patterns and trends of victims, offenders and/or locations, direction can be given to establish long-term preventive measures.

DIRECTION OF SECTION

12.5 LINKS INTO STRATEGIC ANALYSIS

If preventive measures are implemented they can have a significant impact on the direction of a unit dealing with major crime. Analysis to support a prevention process can help to ensure its effectiveness, maximise resources and minimise the amount of crime that has to be dealt with as a major incident.

12.6 DISSEMINATION OF INTELLIGENCE INTO REGULAR POLICING During the course of an investigation, it is likely that material will come to light about suspects, offenders and other subjects such as witnesses and locations. As this material is likely to be held on HOLMES 2, it may not enter mainstream policing and intelligence systems in an evaluated and timely manner. This material would be of value to operational policing and can be used to direct prevention, enforcement and intelligence activity. It is not necessarily the responsibility of the Analyst to disseminate information. This does, however, reinforce the importance of the Analyst knowing about force and BCU level strategic and tactical priorities, as material may come to light through a major investigation that an analyst can prioritise for dissemination.

12.7 HYPOTHESES TESTING AND INFERENCE DEVELOPMENT Hypotheses-testing and inference development is an integral part of the analytical process but can be particularly significant in the direction stage by identifying and eliminating lines of enquiry, providing focus and indicating knowledge gaps.

12.8 REVIEWING THE ANALYST’S AND RESEARCHER’S WORKLOADS The Analyst’s and Researcher’s workloads should be subject to a continuous procedure of quality assurance by an Analyst Manager. This is to ensure that the analytical work is focused, reflects the priority lines of enquiry, is of an adequate standard and adds value to the investigation. It is also advisable to use this opportunity to ensure the Analyst’s welfare is being addressed (see 13 Welfare of Analysts and Researchers) and that their development needs are being met. Quality assurance processes can mean a change of direction in the Analyst’s work. All analysts involved in an inquiry should be aware of its priorities and be able to clarify, question or challenge tasks and actions if they do not meet the operational requirements. The Analyst may require support from analyst managers when negotiating changes with the SIO.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

129

130

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

WELFARE OF ANALYSTS AND RESEARCHERS

SECTION 13

Section 13

W

orking within a major investigation can have a negative effect on analysts and researchers and this needs to be assessed and reviewed regularly by managers within the department or investigation. CONTENTS 13.1 13.2

Welfare Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Risk Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

131

13.1 WELFARE ISSUES The welfare needs of analysts and researchers involved in major investigations must not be underestimated. Whether a dedicated, seconded or multi-functioning analyst or researcher, a single welfare issue can affect an individual significantly. The key problems that an analyst might encounter are:

• • • •

Disturbing images, statements or other material; Protracted hours and fatigue; Inability to cope with emotional pressure or feelings of responsibility; Concern over skills decay or relocation.

The Analyst and Researcher roles are now almost entirely made up of police staff. Some forces have created risk assessments for police officers to prepare them for encountering disturbing images or situations. Consideration must also be given to analysis and research staff. It is often welfare issues that will have the greatest effect on an analyst’s performance.

13.2 RISK ASSESSMENT The use of a Risk Assessment for analysts involved in major incidents may be of benefit when anticipating likely problem areas. The criteria applied to such an assessment would involve assessing the: 1. Likelihood of a specific risk occurring; 2. Impact of that risk. Using scores or high/medium/low values will assist the manager in determining the specific risk areas. This should be a qualitative process rather than a quantitative one. The aim of assessing risk is to prevent or manage risk, therefore, it is essential that mitigating factors are developed. See Table 17 Analyst Welfare Risk Assessment overleaf for an example of a risk assessment.

132

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

Risk

Likelihood

Impact

HIGH

HIGH

1. Viewing the deposition site video.

Mitigating factors

• Access to free counselling • Pre-briefing by the Principal Analyst and discussion session with the Analysts.

• Advice sought from counsellor by the Analyst Manager.

• Full team debrief. • Post-viewing welfare checks. 2. Flashback images from video and photos.

MEDIUM

HIGH

• Advice sought from counsellor with regards to interrupting flashback images.

• Welfare checks with staff on this specific issue.

3. Reading disturbing statements.

HIGH

MEDIUM

• • • •

4. Emotional impact of understanding likely fate of victims.

HIGH

MEDIUM

• Regular welfare checks.

5. Fatigue due to long hours worked.

HIGH

HIGH

• Enforced day’s leave (all staff to have one day off in fourteen days).

6. Fatigue due to seconded analysts and researchers travelling to HQ everyday.

MEDIUM

7. Emotional intensity of a team working together on an emotive case over a long period of time.

HIGH

8. Feeling isolated and lacking in confidence when returning to normal place of work.

Warning analysts. Periodic welfare checks. Regular informal group discussion. Group counselling session arranged.

WELFARE OF ANALYSTS AND RESEARCHERS

TABLE 17 Analyst Welfare Risk Assessment

LOW

• Terms and conditions arranged for seconded staff.

LOW

• Exit plans for staff. • Ensure regular contact with normal place of work.

MEDIUM

MEDIUM

• Exit plans for staff. • Ensure regular contact with normal place of work.

• Increase working back on division closer to exit point.

• Returning on planned date, taking some case work back.

• Refresher training courses on key systems.

• Group counselling session. 9. Peaks and troughs of motivation.

NOT PROTECTIVELY MARKED

MEDIUM

MEDIUM

• Encouraging timely annual leave. • Welfare checks. • Workload variance.

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

133

It is imperative that managers anticipate as many different scenarios as possible and attempt to make provisions to ward against these situations occurring, depending on risk. It is also necessary to continually debrief analysts so that the manager understands what has affected them and can then amend the Risk Assessment areas accordingly. The Risk Assessment process applies to all staff involved in the inquiry and an analyst manager may need the same support as the full-time analyst if they have had access to disturbing material.

134

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

APPENDICES

APPENDICES

CONTENTS Appendix Appendix Appendix Appendix Appendix Appendix Appendix Appendix Appendix

1 2 3a 3b 4a 4b 5 6 7

Terms of Reference 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Search Techniques and Useful Websites . . . . . . . . . . . . . . . Intelligence Network Chart . . . . . . . . . . . . . . . . . . . . . . . . . Evidential Network Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . Intelligence Timeline Chart . . . . . . . . . . . . . . . . . . . . . . . . . Evidential Timeline Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . Abbreviations and Acronyms . . . . . . . . . . . . . . . . . . . . . . . . Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References and Suggested Further Reading . . . . . . . . . . . .

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

136 138 141 142 143 144 145 147 148

© ACPO Centrex 2006

135

APPENDIX 1

APPENDIX 1 TERMS OF REFERENCE 1 Terms of Reference for Operation XXX Purpose To analyse all data and information relating to Operation XXX in order to primarily assist in the apprehension and conviction of an offender(s). Foundations for Analysis

• Reading and viewing all documents, statements, reports, videos, photographs

• • • •

and visit the site. Even though there may be statements and other information media that are deemed irrelevant by the SIO and OICs, these must be read or viewed by the Analyst. Production of network, association and timeline charts, and spreadsheets in preparation for analysis. Formatting of charts relating to telephone and financial data to prepare them for analysis. This does not include typing of telephone data into spreadsheets. Maintaining a record of statements and documents to ensure all available information is read. Focused research of crime and other force systems to assist analysis.

Key Analytical Tasks

• Comparative Case Analysis of similar offences. • Network Analysis of potential offenders. • Ongoing operational analysis of timeline, events, telephone and financial data, key witnesses, suspects, suspicious incidents and victims. Providing the SIO with recommendations and information to direct the inquiry. Analytical products should be communicated through presentations or reports. Constraints and Considerations

• In accordance with best practice in relation to disclosure, the Analyst will •

• •

• •

136

maintain records of action taken and decisions made when producing analysis. Valuable analysis requires the commitment of an analyst who should remain with the case. If the Analyst is currently working on another operation in addition to Operation XXX, although Operation XXX takes precedence, a significant increase in workload will require a review of hours assigned to this operation. The Analyst should be considered to be working on all aspects of the case. The Analyst should be included in briefings and operational management meetings, in accordance with MIRSAP guidance. Also in accordance with MIRSAP guidance, no information should be withheld from the Analyst. Analysis will be stored on a secure drive and made available to the SIO and OICs as required. All analysis is considered to be intelligence analysis unless stated otherwise. Evidential charting for court purposes should be clearly tasked by the SIO.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

paper copies are available, arrangements should be made to secure admin support for the Analyst. • The Principal Analyst and Senior Analyst (Level 2) are responsible for quality assurance and appropriate working practices. Regular review with the Analyst and, if necessary, the SIO will take place. Further technical guidance relating to analysis on Operation XXX can always be provided to the SIO or other officers if required.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

APPENDIX 1

• Telephone data received by the Analyst should be in electronic format. If only

137

APPENDIX 2

APPENDIX 2 SEARCH TECHNIQUES AND USEFUL WEBSITES SEARCH TECHNIQUES Boolean Operators can be used to carry out more specific search queries and can be used with most search engines. AND

Using the word AND will link two words together to narrow a search and only pages containing both words will be returned. Some search engines allow you to use the plus (+) sign instead.

OR

Using the word OR links two terms and returns pages that contain either term.

NOT

Using the word NOT will search for pages that contain the word that precedes it, but not the word that follows it.

Some search engines allow you to use the minus (–) sign instead. “”

To force the search engine to search for a specific phrase rather than a string of words. Alternatively you can denote a phrase by joining the words with a colon. For example, National:Intelligence:Analysis:Training. Note that some search engines will treat keywords as case sensitive when the quote symbols are used. It is best to enter the search term in lower case and then search engines will generally search for both the upper and lower case format.

()

Brackets can be used to create complex queries. For example: “analysis” AND ((intelligence AND crime) OR police).

*

The AltaVista search engine allows an asterisk (*) to be used as a wildcard after a word to search for anything beginning with those letters. For example entering the keyword polic* will search for pages that contain the words police, policing and policed.

SEARCH ENGINES http://www.google.co.uk http://labs.google.com http://www.altavista.com http://www.alltheweb.com http://search.msn.com http://www.wisenut.com http://www.lycos.co.uk http://search.com http://www.yahoo.com

138

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

APPENDIX 2

META SEARCH ENGINES http://www.metacrawler.com http://www.search.com http://www.fazzle.com http://www.dogpile.com http://www.hotbot.co.uk http://www.infogrid.com http://www.infonetware.com http://www.ithaki.net http://www.mamma.com http://www.kartoo.com http://www.qbsearch.com http://www.queryserver.com http://www.surfwax.com http://vivisimo.com http://www.searchonline.com http://turbo10.com NEWSGROUPS A newsgroup is a bulletin board on a website that is accessed via a web browser. Individuals post news, questions or information on certain subjects within these groups which are ordered by topic. Postings are made to the newsgroups via email. These groups are another area on the Web within which you can search for anything related to a particular individual or subject. Two popular newsgroups are run by Google and Yahoo and can be found at: http://groups.google.com http://groups.yahoo.com Usenet has over 100,000 uncensored newsgroups and advertises it is the internet underground. You have to be signed up to access their newsgroup pages and they provide anonymity by offering a Secure-Tunnel service which allows subscribers to browse their newsgroups without their movements being tracked or logged. Usenet can be found at: http://www.usenet.com

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

139

APPENDIX 2

USEFUL SITES General Information and Statistics http://www.textengines.com http://www.refdesk.com http://www.statistics.gov.uk http://www.tagish.co.uk http://www.multimap.com http://www.upmystreet.com http://www.convictsreunited.com http://www.crooks-reunited.co.uk http://www.archive.org http://www.oultwood.com/localgov/england.htm Policing and Law http://www.nolo.com http://www.uklegal.com http://www.police.uk http://www.police999.com http://www.interpol.int http://www.terrorism.com http://www.police.homeoffice.gov.uk http://www.crimereduction.gov.uk http://www.ncis.co.uk http://www.nationalcrimesquad.police.uk Telephones http://www.bt.com http://www.infobel.com http://www.sitefinder.radio.gov.uk http://www.numberingplans.com http://www.magsys.co.uk/telecom/codelook.asp http://www.operatelecom.com International Data http://www.loc.gov/rr/international/portals.html http://www.cia.gov/cia/publications/factbook IP Address Lookups http://www.chackdomain.com

140

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

APPENDIX 3A

APPENDIX 3A INTELLIGENCE NETWORK CHART

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

141

APPENDIX 3B 142

APPENDIX 3B EVIDENTIAL NETWORK CHART

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

APPENDIX 4A

APPENDIX 4A INTELLIGENCE TIMELINE CHART

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

143

APPENDIX 4B 144

APPENDIX 4B EVIDENTIAL TIMELINE CHART

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

5WH . . . . . . . ACPO. . . . . . . ACPOS. . . . . . ANPR . . . . . . BADMAN . . . BCS . . . . . . . . BCU . . . . . . . . CARS . . . . . . . CATCHEM . . . CBRN . . . . . . . CCA . . . . . . . . CCTV . . . . . . . CHIS. . . . . . . . CPA . . . . . . . . CPIA. . . . . . . . CPS . . . . . . . . CSM. . . . . . . . CTO . . . . . . . . D/SIO. . . . . . . DNA. . . . . . . . DPA . . . . . . . . DVLA . . . . . . . ECHR . . . . . . . FLO . . . . . . . . GIS . . . . . . . . . GPMS . . . . . . HMRC . . . . . . HOLMES 2. . . HRA . . . . . . . . HtoH (H2H). . IND . . . . . . . . IR . . . . . . . . . . JAPAN . . . . . . JIG . . . . . . . . . MALCOMS . . MIAM . . . . . . MIATFR . . . . . MIAWG . . . . . MIM. . . . . . . . MIR . . . . . . . . MIRSAP . . . . . MIT . . . . . . . . NAFIS . . . . . . NAWG . . . . . . NCIS. . . . . . . .

What, Where, When, Why, Who and How Association of Chief Police Officers Association of Chief Police Officers in Scotland Automatic Number Plate Recognition, UK System Behavioural Analysis Data Management Auto-Indexing Network British Crime Survey Basic Command Unit Credibility, Accuracy, Reasonableness, Support Centralised Analytical Team Collating Homicide Expertise and Management Chemical, Biological, Radiological and Nuclear Comparative Case Analysis Closed Circuit Television Covert Human Intelligence Source Crime Pattern Analysis Criminal Procedure and Investigations Act 1996, UK Legislation Crown Prosecution Service Crime Scene Manager Central Ticket Office Deputy Senior Investigating Officer Deoxyribonucleic Acid Data Protection Act 1998, UK Legislation Driver and Vehicle Licencing Agency European Convention on Human Rights Family Liaison Officer Geographic Information Systems Government Protective Marking Scheme Her Majesty’s Revenue and Customs Home Office Large Major Enquiry System, UK System Human Rights Act 1998, UK Legislation House-to-House Immigration and Nationality Directorate Incident Room Justified, Appropriate, Proportionate, Accountable and Necessary Joint Intelligence Group Malicious Communications Service (FSS) Major Incident Analysis Manual Motor Insurers Anti-Theft and Fraud Register Major Incident Analysis Work Group Murder Investigation Manual Major Incident Room Major Incident Room Standardised Administrative Procedures Major Incident Team National Automated Fingerprint Identification System ACPO National Analyst Working Group National Criminal Intelligence Service

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

APPENDIX 5

APPENDIX 5 ABBREVIATIONS AND ACRONYMS

145

APPENDIX 5 146

NCPE . . . . . . . NCS . . . . . . . . NFFID. . . . . . . NIAT. . . . . . . . NIM . . . . . . . . OIC. . . . . . . . . PACE . . . . . . . PDR . . . . . . . . PII. . . . . . . . . . PIP . . . . . . . . . PLS. . . . . . . . . PNC . . . . . . . . PNMPB . . . . . PNMP . . . . . . PRISM . . . . . . QUEST . . . . . . RDS . . . . . . . . RIPA . . . . . . . . SBA . . . . . . . . SCAS . . . . . . . SIO. . . . . . . . . SOCA. . . . . . . SOCO. . . . . . . SPOC . . . . . . . TE. . . . . . . . . . TLO . . . . . . . . TT&CG . . . . . . UKPS . . . . . . . VIN. . . . . . . . . ViSOR . . . . . . VODS. . . . . . . VRM . . . . . . . WRVS . . . . . .

National Centre for Policing Excellence National Crime Squad National Firearms Forensic Intelligence Database National Intelligence Analysts Training National Intelligence Model, UK Codes of Practice Officer in Charge Police and Criminal Evidence Act 1984, UK Legislation Performance Development Review Public Interest Immunity Professionalising the Investigative Process Pendulum List Searching Police National Computer, UK System Police National Missing Persons Bureau Police National Mobilisation Plan Proactive Risk and Intelligence Scoring Matrix Queries Using Extended Search Technique (on PNC), UK System Home Office Research, Development and Statistics Department Regulation of Investigatory Powers Act 2000, UK Legislation Seen By Analyst Serious Crime Analysis Section Senior Investigating Officer Serious Organised Crime Agency Scenes of Crime Officer Single Point of Contact Transaction Enquiry Telephone Liaison Officer Tactical Tasking and Co-ordination Group United Kingdom Passport Service Vehicle Identification Number Violent and Sex Offenders Register Vehicle Online Descriptive Searching, UK System Vehicle Registration Mark Womens Royal Voluntary Service

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

APPENDIX 6

APPENDIX 6 GLOSSARY Community Impact Assessment A risk assessment of issues affecting a community. Compliance Unit Department in UK law enforcement responsible for ensuring compliance with RIPA legislation. Downstream Monitoring Live time monitoring of audio/visual material. Gold Groups A senior level management group committed to deal with the strategic coordination of an incident. MG11 Standard UK statement form. Public Inquiry An investigation into an incident or event, the findings of which are available to the public. R v Defendant A sighted Crown Prosecution Case. ‘R’ refers to Regina (the Crown or State). SIO Policy File Document used to record the SIO’s investigative policy decisions. Sterile Corridor Sterile corridors protect the source of covertly obtained material by ensuring that it cannot be shared and disseminated without prior sanitisation and proper authorisation. Strategic Assessment This drives the business of the Strategic Tasking and Co-ordination Group (ST&CG) by providing it with an accurate overview of the current and long-term issues affecting the BCU, force or region. TAG Marker on HOLMES 2 system. Tasking and Co-ordinaton A process defined by NIM for directing tactical or strategic operational activity.

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

147

APPENDIX 7

APPENDIX 7 REFERENCES AND SUGGESTED FURTHER READING ACPO (2000) Murder Investigation Manual. London: ACPO. ACPO (2002) Manual of Guidance for the Management of Missing Persons. London: ACPO. ACPO (2004) Guidance on Investigating Domestic Violence. Wyboston: NCPE. ACPO (2005) Guidance on Investigating Child Abuse and Safeguarding Children. Wyboston: NCPE. ACPO (2005) Guidance on the Management, Recording and Investigation of Missing Persons. Wyboston: NCPE. ACPO (2005) Guidance on Major Incident Room Standardised Administrative Procedures (MIRSAP). Wyboston: NCPE. ACPO (2005) Manual of Guidance on Police Use of Firearms. London: ACPO. ACPO (2005) Practice Advice on Core Investigative Doctrine. Wyboston: NCPE. ACPO (forthcoming) Code of Practice on the Use of the Serious Crime Analysis Section. London: ACPO. ACPO (forthcoming) Murder Investigation Manual. Wyboston: NCPE. Collins English Dictionary (2003) 6th Edition. London: HarperCollins. Cohen, L. and Felson, M. (1979) Social Change and Crime Rate Trends: A Routine Activity Approach. American Sociological Review, no.44, pp588-608. Harris, R. (1997) Evaluating Internet Research Sources [Internet]. Available from http://www.virtualsalt.com/evalu8it.htm [Accessed 27 July 2006]. HMIC (2004) A Report on the Investigation by Cambridgeshire Constabulary into the Murders of Jessica Chapman and Holly Wells at Soham on 4 August 2002 Summary of Conclusions and Recommendations. London: HMIC. Peterson, M. (2004) Intelligence Analysis: New Frontiers. Intersec, Vol 14, Issue 3, p76.

148

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

Newiss, G. (2004) Estimating the risk faced by missing persons: a study of homicide victims as an example of an outcome-based approach. International Journal of Police Science and Management, Volume 6, pp27-36.

APPENDIX 7

Useful Reference Material

Nordby, J. (1999) Dead Reckoning: The Art of Forensic Detection. Florida: CRC Press. Francis, B. et al (2004) Using Homicide Data to Assist Murder Investigations [Internet], Home Office Online Report 26/04. Available from http://www.homeoffice.gov.uk [Accessed 27 July 2006].

NOT PROTECTIVELY MARKED

Major Incident Analysis Manual (Revised Edition)

© ACPO Centrex 2006

149