20.5 Investigative Reconstruction


20.5 Investigative Reconstruction

Certain aspects of investigative reconstruction described in Chapter 5, such as equivocal forensic analysis, emerge naturally from a thorough investigation. Also, when investigators are collecting evidence at a crime scene, they perform some basic reconstruction of events to develop leads and determine where additional sources of evidence can be found. Once confident they have enough evidence to start building a solid case, a more complete reconstruction should be developed.

Although a complete investigative reconstruction can benefit any case, it is a time consuming process and the cost may not be warranted for simpler crimes. In more complex cases it may be desirable to perform an investigative reconstruction, even when the offender is known. The process of examining evidence more closely through temporal, relational, and functional analysis, may lead to concealed evidence, aid in linking related crimes, and help improve understanding of the crime and offender fantasy, motives, and state of mind, which are potentially useful in interviews and court.

Being able to assert that a specific offender probably retained incriminating evidence of crimes occurring years in the past can help dispel "staleness" arguments against search warrants. Also, knowing that such evidence likely exists motivates investigators and digital evidence examiners to search until they find it, seeking out hiding places that they might otherwise have overlooked. Similarly, knowing that it is very likely the current victim is not the first to be targeted by a sex offender motivates investigators and digital evidence examiners to seek evidence relating to other victims. It can be even more useful if investigators know what types of victims to look for and where the offender might have come into contact with them. It can also be helpful to know that certain sex offenders will confess to their crimes when treated in a certain manner, but the same approach may drive others into deeper denial.

CASE EXAMPLE (ADAPTED FROM CASEY 1999):

start example

A former bus driver, age 31, was arrested and accused of possessing sexually explicit photos of himself with a child. His computer and many photographs, magazines, and videos were seized. Searching the Internet showed that his nickname and e-mail user name was Zest. His Web page was simple but telling, depicting him topless in Arizona at age 23. He had also posted several messages to newsgroups offering to scan risqu photographs. The following is a representative post:

Subject:

*a_Will scan your Pic's

From:

Zest <zest@oneworld.owt.com>

Date:

1996/09/29

Message-ID;

<324F1FAF.33B@oneworld.owt.com>

Newsgroups: alt.sex.pedophilia.boys, alt.sex.pedophilia.girls, alt.sex.pedophilia.pictures, alt.sex.pedophilia.swaps, alt.sex.phone, alt.sex.pictures, alt.sex.pictures.d, alt.sex.pictures.female, alt.sex.pictures.male, alt.sex.pictures.misc, alt.sex.plushies,alt.sex.pre-teens,alt.sex.prevost, alt.sex.prevost.derbecker, alt.sex.prevost-derbecker,alt.sex.prom, alt.sex.prostitution, alt.sex.raj.NOT, alt.sex.reptiles, alt.sex.safe, alt.sex.senator-exon, alt.sex.services, alt.sex.sgml, alt.sex.sheep, alt.sex.sheep.baaa.baaa.baaa.moo, alt.sex.skydiving.bondage, alt.sex.sm

Need a picture scanned? Nobady local to do it? Or the content is riska? I'm your man, I will scan your pic's for you. One dollar ($1) per pic, and postage, is all that it will cost you. I will save in formats of your choice. GIF, BMP, PCX, TGA, JPG, and TIFF. I'm also able to enlarge your original photo. All pictures are kept confidential.

Interested??? E-Mail me at the address below. I will reply to setup arranangements with you.

<zest@owt.com>

An analysis of the suspect's physical world activities, Web page, and Usenet posts reveals a few insights into the offender. The Web page is a lure. The page depicts the defendant half-naked and smiling in a remote outdoor location almost 10 years ago. This suggests his youthful view of himself, as does his nickname of choice, "Zest." The Web page also refers to time spent in Arizona. The defendant is a traveler. Look into trips he took by examining food, lodging and gas receipts, credit card records, and ATM transactions. Obtain all of his telephone records to find out who he was calling and when. Inquire into his time in Arizona to determine if other victims exist. Check his criminal history there, and anywhere else that he lived. Also check his parent's house/properties for hidden items, and look for any storage facilities that the defendant might have used. In addition to the recommendations above, check for secret compartments under his house, under his parent's house, in attics and look for digital storage devices, negatives, proof sheets, and videos. Check local rental places and see if he rents video equipment.

That "Zest" is a bus driver is no coincidence. Being a bus driver gives him access to a victim population beyond his immediate neighborhood/community. The defendant needs his real life victims to be within traveling distance so that he can develop personal, emotional relationships with them. For him, the Internet appears to be a tool not necessarily for acquiring victims, but rather for soliciting sexually explicit images from private parties. He needs this material to feed his pedophilic fantasies. And part of the attraction is it is not commercially produced, posed material, but privately created. Online he specifically asks for risqu materials and suggestively illegal material in his advertisements to Usenet. These would have been sent directly to his account, as advertised, and his Internet Service Provider (ISP) would be the best source of information regarding messages he received, possibly leading to other individuals who exchange child pornography on the Internet. His incoming and outgoing e-mail might be stored on his ISP's system or even archived by his ISP.

The Internet is only his means for fantasy development, enhancement, and transitory sustenance. The newsgroups he used tell us about the type of pornography he was hoping to acquire from private parties. These posts would not encourage potential victims to inquire, but rather are meant to get people to send him their private illegal pedophilic photos. In as much as this is true, this would also help him network with others who share his interests. There might have been a profit motivation at work here so that he could get into a network where he could sell the pornography that he created, and/or fantasy motive that would allow him to "trade in" to a group of pedophiles who share pornography.

It can be surmised the defendant believes he is genuinely in consensual relationships with these children. He sees nothing about his behavior as criminal or exploitative. He believes that he is merely seizing the day, and that what he is doing benefits the children he exploits. His motive is not to physically harm his victims but to be loved and admired by them. He confuses his own identity with theirs, to an extent, projecting a child-like affect to them. An interview strategy exploiting these factors by appearing to be sympathetic to these factors will offer the best chance of getting information from this suspect.

end example

When the offender is unknown, the reconstruction process becomes a necessary step to help focus the investigation and prioritize suspects. The offender may not be known if the victim met him online prior to the assault and does not know his real identity, or the victim may be missing after traveling to meet the offender. Analyzing online messages from the offender may expose characteristics such as marital status, geographic location, profession, self-image, interests, age, and more. The improved understanding of the crime and offender that results from a thorough investigative reconstruction can have many ancillary benefits. In addition to those mentioned in the previous paragraph, detailed knowledge of an offender can help investigators anticipate future actions, assess the potential for escalation, protect past victims, warn potential victims, and communicate with the offender.

For example, based on a full reconstruction, it may be possible to inform undercover Internet investigators that the offender trawls specific IRC chat rooms for victims who feed into his torture fantasies. This direction not only tells investigators where to look but also enables them to pose as the type of victim that will attract the offender. Also, explaining how and why the offender conceals his identity may lead investigators to identifying information that the offender failed to hide or may help investigators narrow the suspect pool (e.g. to people who were intimately familiar with the victim and concealed their identity to avoid recognition by the victim). Additionally, providing information about an offender's method of approach, attack, or control may help investigators interact with an offender or provide potential victims with protective advice.

20.5.1 Analyzing Sex Offenders

To gain a better understanding of how offenders operate in general, it can be useful to look for trends in past investigations to discern similarities between different offenders. Lanning (2001) uses this approach to identify three general categories of sex offenders: situational, preferential, and miscellaneous. Within each category, Lanning identifies common characteristics such as preferential sex offenders' compulsive record keeping, a behavior that can provide a wide range of incriminating evidence including self-created pornography, information about victims, and other items that the offender can use to recall the pleasure they derived from the events. Lanning also notes that preferential sex offenders generally target victims of a particular kind (e.g. children) compared with situational sex offenders who are generally more power/anger motivated and generally pick convenient targets (e.g. their own children or children living with them).

Another approach to analyzing a crime and the associated behaviors is to look at available evidence from the crime under investigation and look for patterns that reveal something about the offender. For instance, objects in the background of self-created pornography can reveal where the perpetrator committed the offense. As the primary crime scene, this location probably contains a significant amount of evidence. Alternatively, an offender's Internet communications, credit card bills, and telephone records can lead investigators to victims, places where evidence is hidden, and locations where the offender arranged to meet victims. Also, patterns in an offender's online activities can be used to link related crimes and gain insight into the offender's fantasies and motivations. Furthermore, an analysis of behavior may show an escalation in the offender's aggression, indicating that current and future victims are at greater risk of harm.

Both methods have advantages and limitations. Although generalizations about sex offenders can help us identify patterns of behavior in a given case, they can be incorrect or even misleading. To compound this problem, offenders can learn and change over time, modifying their behavior pro-actively and reactively as discussed in Chapter 6. Therefore, it is most effective to use a thoughtful combination of the two methods. In fact, it is very difficult to use one approach without the other. Without a close examination of available evidence it is not possible to make a competent determination which general category the offender most likely fits. Similarly, without a general understanding of offenders and their motives, it can be difficult to recognize and interpret evidence that reveals important behavior.

20.5.2 Analyzing Victim Behavior

Investigators often overlook the value of scrutinizing the behavior of victims of a crime. Victimology can help determine how and why an offender selected a specific victim and may reveal a link of some kind between the victim and offender, as well as other victims. These links may be geographical, work related, schedule oriented, school related, hobby related, or they may even be family connections. Learning that a victim's online activities increased her exposure to attack can lead investigators to new avenues of inquiry. For instance, Internet activities of a seemingly naive victim may show that she used the Internet to obtain drugs, meet men for sex, or was involved with bondage and sadomasochism (BDSM) online groups, both of which can increase the victim's lifestyle risk. Additionally, victimology may reveal that the offender was willing to take significant risks to acquire that victim, providing insight into the offender's needs and possibly indicating a relationship between the victim and offender.

Furthermore, if we can understand how and why an offender has selected their previous victims by studying the complete victimology, as it changes or fails to change over time and throughout incidents, then we have a better chance of predicting the type of victim that they may select in the future. This knowledge can help direct an investigation and protect potential victims. Even if we come to understand that an offender's victim selection process is random, or even more likely, opportunistic, it is still a very significant conclusion.

Investigators can use digital evidence to gain a better understanding of the victim by determining if the victim uses e-mail, has Web pages, posts to Usenet regularly, uses chat networks, sends/receives e-mail or text messages on a mobile phone, and so on. For instance, in past cases, child victims have come into contact with adult offenders in the following ways:

  • provided factual information in an online profile that attracted offender's interest;

  • provided a name, photograph, home address, and telephone number on a Web page that attracted offender's interest;

  • participated in online discussions dedicated to sex among teens (e.g. "alt.sex.teens" on Usenet);

  • participated in online discussions devoted to the topic of sadomasochism (e.g. "#bdsm" on IRC);

  • used online dating services;

  • introduced through friends and acquaintances, both online and in the physical world;

  • exposed through organizations in the physical world (e.g. schools, camps, big brother programs);

  • through chance encounters in public (e.g. parks, swimming pools).

This is not an exhaustive list, but it gives a sense of what investigators might consider in developing victimology. Keep in mind that victims are often very secretive about their online sexual activities and significant effort (and delicacy) may be required to learn about some of these activities. Some victims even take steps to conceal their online activities prior to an offense or afterwards to avoid embarrassment, making it difficult for digital evidence examiners to develop a full victimology.

20.5.3 Crime Scene Characteristics

Aspects of the crime scene other than the evidence it contains can tell us something about the offender. The choice of location, tools, and actions taken combine to make up an offender's modus operandi and can reveal an offender's motivations, sometimes in the form of signature behaviors. Even the decision to use the Internet can reveal something about the offender. A sex offender may have exhausted the local supply of victims and views the Internet as just another source of victims, in which case there is probably evidence of other sexual assaults in his local area. An offender may be under close observation in the physical world and uses the Internet as an alterative means of accessing victims (e.g. a convict or parolee). Alternatively, an offender may be afraid to target victims in the local vicinity because of the presence of family members at home.

Sex offenders generally have a reason for selecting specific places, tools, and methods to acquire victims, hide or dispose of evidence, and commit a sex offense. Some offenders choose particular online tools and locations because they will conceal his/her activities (e.g. using an anonymous service to access an online chat room that does not retain logs of conversations). The same applies in the physical world - an offender might choose a particular location to commit a sex offense because evidence will be destroyed or be harder to find and collect (e.g. in a forest or underwater). These choices can reveal useful offender characteristics, such as skill level and knowledge of the area in question. For example, use of a private peer-to-peer file sharing ring versus a public Web site like Yahoo to share child pornography indicates that the offender has more than a casual connection with online child pornography, since fewer people are familiar with these private file sharing rings than Yahoo, and that he has sufficient interest and technical skill to go beyond the Web browser and use the peer-to-peer file sharing software. Similarly, use of IRC versus AOL chat rooms to acquire victims may reflect skill level of the offender and the desired victim.

Adult offenders seeking adult victims may join an online dating service, go to chat rooms that the sought-after person will be in (e.g. "M4M," "40somethingsingles"), or respond to online personal advertisements. Offenders who prefer to victimize children will use Internet facilities most likely to be frequented by younger people. One offender might choose IRC to target teenage boys because it is more often used by the technologically savvy than casual users - very young users on IRC are more likely to be supervised. Younger victims (under the age of 13) would more likely be found in chat rooms and playing online games.

Items that an offender brings to a victim encounter such as cameras, condoms, lubricant, restraints, or drugs can be evidence of intent.

CASE EXAMPLE (ARIZONA v. BASS 2001):

start example

Jerry Donald Bass was arrested after engaging in sexually explicit Internet communications and arranging to meet with Tucson Police Department Detective Uhall, who portrayed himself as a 13-year-old Tucson girl named "Keri." After Bass was arrested, police found condoms, baby oil, and a Polaroid camera in his truck. During the trial, Detective Uhall testified that, based on his experience, it is common for adult males who are sexually interested in young females to have such items in their possession. Bass argued that such testimony would constitute inadmissible "profile" evidence. Profile evidence cannot be used in Arizona to indicate guilt because it "creates too high a risk that a defendant will be convicted not for what he did but for what others are doing." (State v. Lee, 191 Ariz. 542, 959 P.2d 799 (1998)). However, the court allowed the investigator's testimony for the purposes of rebutting the defendant's testimony that he had those items in his possession for innocent reasons. Although the trial court agreed the investigator could not use the words "pedophile" or "child predator" while testifying, it allowed him to testify as follows:

Q:

[PROSECUTOR] All right. Taking each one of these three items here, are these common among adults seeking sex from young female children?

[uhall] yes, it is.

Q:

The Polaroid camera, why?

photographs allow you to re-visit the event.

Q:

And what about the body oils?

body oils are necessary for lubrication for entry.

Q:

And the condoms?

condoms are possibly for prevention of pregnancy. sex offenders might also use condoms to prevent transmission or contraction of sexually transmitted diseases and to limit the exchange of bodily fluids containing dna that could be potentially damning physical evidence.

Answers

A:

[UHALL] Yes, it is.

A:

Photographs allow you to re-visit the event.

A:

Body oils are necessary for lubrication for entry.

A:

Condoms are possibly for prevention of pregnancy.[2]

Bass was found guilty of conspiracy to commit sexual conduct with a minor under the age of 15.

end example

How an offender approaches and controls a victim or target can be significant, exposing the offender's strengths (e.g. skill level, physical strength), concerns (e.g. sexual inadequacies), intents, and motives. Some offenders who engage in prolonged grooming activities do so because it enables them to develop a relationship with the victim, satisfying their need to believe that the relationship is consensual. Some offenders use deception (e.g. posing as a 14-year-old boy) to approach and obtain control over a victim because they do not want to scare the victim away before having an opportunity to commit a sexual assault. Other offenders are more aggressive and simply use threats to gain complete control over a victim quickly. Different offenders can use the same method of approach or control for very different reasons so it is not possible to make broad generalizations. For example, one offender might use threats to discourage a victim from reporting the crime whereas another offender might use threats simply to gain a feeling of empowerment over the victim. Therefore, it is necessary to examine crime scene characteristics in unison, determining how they influence and relate to each other.

It is also important to remember that an offender is rarely in complete control - unexpected things occur and/or victims can react unpredictably. The pressures of unforeseen circumstances can cause an offender to reveal aspects of his personality, desires, or identity that he would otherwise conceal. One extreme example is an offender calling the victim by name while appealing for cooperation indicating that the offender knows the victim. Therefore, investigators should examine the victim-offender interactions and the events surrounding the crime to determine how an offender reacted to events that he could not have anticipated. When an offender uses a network to approach and control a victim, the methods of approach and control are predominantly verbal since networks do not afford physical access/ threats. Statements made by the offender can be very revealing about the offender so investigators should make an effort to ascertain exactly what the offender said or typed.

The following are some examples of how offenders approached victims on the Internet in past cases.

  • Offender accurately represented himself while grooming young victim he met in online chat room frequented by youths.

  • Offender accurately represented himself while seeking likely victims in discussions of bondage and sadomasochism.

  • Offender pretended to be a younger, more attractive male to attract female.

  • Older male offender pretended to be a young boy to befriend a prepubescent child.

  • Older male offender pretended to be a woman to attract an adolescent boy.

  • Offender persuaded parents to give him access to their children.

Although this list is not definitive, it provides some illustrative examples of crime scene characteristics investigators might look for to develop learn more about an offender. This type of information, combined with other crime scene characteristics, can help investigators develop a clearer picture of the offender they are dealing with, including modus operandi and motivation.

20.5.4 Motivation

The motives underlying pornography vary with the type of pornography (sadistic, domination, child pornography, etc.), how it is gathered (from available sources, self-created), and what is done with it once obtained (e.g. digitally altering images to show children or celebrities in sexual or violent situations). However, the motives underlying pornography do not change simply because the Internet is involved. Sex offenders took photographs of their victims long before the existence of the Internet as trophies of conquest, to revisit and relive the moment, and to show others. Similarly, the motives of individuals who solicit and abuse children are the same whether the Internet is involved or not. Therefore, existing research relating to motivation of sex offenders presented in Chapter 6 (modus operandi, motive, and technology) can be used to gain a better understanding of these offenders: Power Reassurance, Power Assertive, Anger Retaliatory, Anger Excitation, Opportunistic, and Profit.

This is not to say that determining motivation is a simple matter. There is much debate regarding the role of pornography in sex offenses. Some argue that pornography causes crime - Ted Bundy went so far as to claim that he became obsessed with pornography, and that viewing it broke down his resistance and justified his behavior. It cannot be proved that pornography causes offenders to act out their fantasies and a killer's justification of his crimes cannot be trusted. However, an individual's pornography collection reflects his/her fantasies. In David Westerfield's homicide trial, the prosecution claimed that Westerfield's digital pornography collection reflected his fantasies relating to kidnapping and killing 7-year-old Danielle van Dam and, in closing arguments, insinuated that the pornography motivated Westerfield to victimize the child.

Not only does he have the young girls involved in sex, but he has the anime that you saw. And we will not show them to you again. The drawings of the young girls being sexually assaulted. Raped. Digitally penetrated. Exposed. Forcibly sodomized. Why does he have those, a normal fifty-year-old man? ... Those are his fantasies. His choice. Those are what he wants. He picked them; he collected them. Those are his fantasies. That's what gets him excited. That's what he wants in his collection ... When you have those fantasies, fantasies breed need. He got to the point where it was growing and growing and growing. And what else is there to collect? What else can I get excited about visually, audibly? (California v. Westerfield 2002)

However, the cause and effect are unclear, particularly in light of the fact that Westerfield also had pornography involving adults and animals. It could just as easily be argued that Westerfield's pornography collection provided an outlet for his fantasies and he would have committed a crime long before had it not been for this outlet. Aside from this, of all the people who possess child pornography, only a limited number actually commit offenses against children, and of those, only a small fraction have committed a homicide.

Keep in mind that the motivational typologies discussed in Chapter 6 are general categories designed to give investigators a better sense of why an individual may have committed a given crime. The aim is not to fit an offender into one category - some sex offenders commit offenses whenever they have an opportunity, regardless of the risks, and may be motivated by a number of factors. For instance, Larry Garmon had been released on probation from prison in Kansas after serving 9 years of a 20-year sentence for aggravated criminal sodomy on an 8-year-old boy. While checking his home for parole violations, police found pornographic images of men and boys stored on his computer. Garmon was convicted on child pornography charges and was placed in Madison County Detention Center where he allegedly sexually assaulted a 17-year-old boy who had been detained on a misdemeanor charge of possession of a handgun (Associated Press 2001). Other offenders are more directed in their approach to acquiring victims, taking precautions to address the associated risks but it can still be a challenge to dissect their motives.

CASE EXAMPLE (UNITED STATES v. HERSH 2001):

start example

Marvin Hersh, a professor at Florida Atlantic University, traveled to third world countries, ranging from Asia to Central America, to engage in sexual relationships with impoverished young boys. During his travels, Hersh met another sex offender named Nelson Jay Buhler with whom he collaborated. In addition to traveling together to have sex with poverty stricken young boys in Honduras, Hersh taught Buhler where to find child pornography on the Internet and how to encrypt the files using F-Secure and save them to Zip disks that could easily be destroyed. He eventually brought a 15-year-old boy from Honduras back to live with him in Florida, posing as his son. Hersh was convicted of transporting a minor in foreign commerce with the intent to engage in criminal sexual activity, and conspiracy to travel in foreign commerce with the intent to engage in sexual acts with minors, and receiving and possessing material containing visual depictions of minors engaged in sexually explicit conduct.

end example

Failure to understand an offender's motivation can impair an investigation, making it difficult for investigators to interpret evidence, obtain information from a known offender, or apprehend an unknown offender. Having insight into an offender's motivation to commit a sex offense is helpful to prosecutors, because they have the daunting task of persuading a jury that the normal looking man sitting at the defense table in the pin-striped suit actually raped a little boy and masturbates while talking to children on the Internet. Also, knowledge of an offender's motivations and likely behaviors can help shape prevention strategies to avoid future harm to other victims. Given their importance, investigators should attempt to determine an offender's motives, consulting with a forensic psychiatrist, psychologist, or other appropriate specialist in complex cases as needed.

[2]Sex offenders might also use condoms to prevent transmission or contraction of sexually transmitted diseases and to limit the exchange of bodily fluids containing DNA that could be potentially damning physical evidence.




Digital Evidence and Computer Crime
Digital Evidence and Computer Crime, Second Edition
ISBN: 0121631044
EAN: 2147483647
Year: 2003
Pages: 279

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net