Evidence & The Security Officer

by Dana Turner

Overview
Properly collecting and preserving physical evidence items is as necessary in an investigation as practicing effective information-gathering techniques. Not only must the investigator collect and preserve evidence items, but he/she must also be responsible for creating and maintaining an unbroken "chain of custody" so that those items can be accepted for presentation in court. For our purposes, a chain of custody is a legal term that describes a controlled sequence of transfers of physical evidence items from one person to another. This segment addresses the basic steps to collecting evidence common to financial institution embezzlements.

Evidence As An Investigative Tool
A person cannot commit a crime without leaving a clue. This clue may be something that:

Should be present but is absent (e.g., missing currency, negotiable documents, signature card, or paper or computer records); or
Should be absent but is present (e.g., fingerprints, forged signature, unauthorized keys, or an altered computer program).

Methods For Obtaining Evidence
There are four (4) commonly accepted methods used by financial institutions to obtain evidence, and each method involves a search of some kind, and potentially involves a seizure of an item or information:

By personal consent: The person freely and voluntarily gives permission, either verbally or in writing;
By implied consent: The person freely and voluntarily gives permission, as a condition of employment;
Routine business function: The institution has the right because the record, equipment, location or information belongs to the institution, and not to a particular person; or
Lawful order: The institution is obligated to allow and/or participate in a search pursuant to a lawful order of a law enforcement agency or a court.

Paper Products As Evidence
The most valuable and easily used form of physical evidence is a paper item that contains a suspect's fingerprints or handwriting. Fortunately, paper products retain fingerprints very well and provide an excellent medium for handwriting examination by a questioned document examiner.

If paper products other than handwriting samples or currency are gathered during an investigation, the investigator must process them in the following manner:

Obtain all original documents involved with this investigation and date and initial each document on an area unaffected by fingerprints, handwriting or other markings;
Handle the suspect document with tweezers or a folded piece of paper to avoid contaminating the fingerprints, handwriting and impressions already on the document;
Use a pen or pencil of a different type and color than that used to create the original writing; and
Have all persons known to have processed the document initial and date it in the same manner;

If a printing device (e.g., typewriter, check imprinter or computer printer) was used to create the original writing and that device is owned by the institution and still on the institution's premises, secure it for comparison use by the law enforcement agency;

Place all suspect documents in a paper or plastic envelope to avoid further contamination;
Photocopy all original documents three (3) times (both sides if the reverse also contains written or printed information):

Keep one set of photocopies, and attach one set to your report; and
The third set of photocopies will be used during your interviews and interrogations;

Complete an inventory or evidence form for report use; and
Deliver all evidence items to the law enforcement agency if requested, and obtain a receipt.

Paper Products Containing Handwriting As Evidence
If paper products containing handwriting samples, or "exemplars", are obtained during an investigation, the investigator must process them in the following manner:

Obtain all original documents involved with this investigation, and date and initial each on an area unaffected by handwriting or other markings:
Use a pen or pencil of a different type and color than that used to create the original writing;
Photocopy all original documents three (3) times (both sides if the reverse also contains written or printed information):

Keep one set of photocopies, and attach one set to your report; and
The third set of photocopies will be used during your interviews and interrogations;

Place all suspect documents in a paper or plastic envelope to avoid further contamination;
Collect exemplars from all suspects and others known or believed to have written upon the questioned documents, and have those persons date and initial these samples on the face of each sample:

Collect twelve (12) exemplars of each questioned writing to provide the necessary material for an effective comparison by a questioned document examiner;
Have the writer use the same pen type as that used to create the original writing, and containing black or dark blue ink;
Have the person write or print the word or phrase on an index card or facsimile document;
Dictate the words or phrases from the questioned document, and do not allow the person to see the questioned document before providing the sample; and
These samples may be used to both identify suspects and to eliminate others from suspicion;

Date and initial the reverse of each sample collected:

Use a pen or pencil of a different type and color than that used to create the original writing;

Complete an inventory or evidence form for report use; and
Deliver all evidence items to the law enforcement agency if requested, and obtain a receipt.

Currency As Evidence
If currency items are obtained during an investigation, and those items do not contain fingerprints or marking requiring examination, the investigator must process them in the following manner:

Obtain all original currency items involved with this investigation;
Record all denominations and serial numbers;
Photocopy only the face of all currency items three (3) times according to these acceptable standards:

The image must be in black and white; and
The image must be reduced to less than three-quarters (3/4) of the item's original size, measured linearly; or
The image must be enlarged to more than one and one-half (1-1/2) of the item's original size, measured linearly;
Keep one set of photocopies, and attach one set to your report; and
The third set of photocopies will be used during your interviews and interrogations;

Date and initial the face of each sample collected;
Complete an inventory or evidence form for report use;
Have a representative of the law enforcement agency view the currency and validate its authenticity;
Deliver all evidence items to the law enforcement agency if requested, and obtain a receipt containing a statement of validation; and
Return the currency to general circulation

Computers As Evidence
If computer programs or data files are obtained during an investigation, the investigator must process them in the following manner:

If a computer device (e.g., laptop, desktop or mainframe computer) was used to create the original data files, printing or writing and that device is owned by the institution and still on the institution's premises, secure it for comparison use by the law enforcement agency;
Obtain all original computer programs and data files involved with this investigation;
Make two (2) backup copies of all program files, copying the program files to floppy diskettes;
Make two (2) backup copies of all data files, copying the data files to floppy diskettes;
Write-protect and label all copied diskettes;
Print out three (3) data reports of all information involved with this investigation, and date and initial each one:

Keep one set of backup diskettes, and deliver the other set to the law enforcement agency with your report; and
The third data report will be used during your interviews and interrogations;

Complete an inventory or evidence form for report use; and
Deliver all evidence items to the law enforcement agency if requested, and obtain a receipt.

Recorded Statements, Videotapes & Film As Evidence
If recorded statements, videotapes or films are obtained during an investigation, the investigator must process them in the following manner:

Obtain all original recordings, videotapes and films involved with this investigation;
Make two (2) backup copies of all recordings, videotapes and films;
Write-protect all recordings and videotapes, seal film canisters and label recordings, videotapes and films:

Deliver one set of copies to the law enforcement agency with your report; and
The second set of copies will be used during your interviews and interrogations;

Complete an inventory or evidence form for report use; and
Deliver all evidence items to the law enforcement agency if requested, and obtain a receipt.

If written statements are obtained during an investigation, and those items do not contain fingerprints or marking requiring examination, the investigator must process them in the following manner:

Allow the person to make the statement in his/her own words, or dictate the necessary information if the person requests:

Have the statement typed if the person's handwriting is illegible, and retain both the handwritten and typed copies; and
Tape-record the statement, if possible;

Both the person making the statement and the investigator must sign and date the statement;
Photocopy all original statements twice:

Keep one set of photocopies, and attach one set to your report;

Complete an inventory or evidence form for report use; and
Deliver all evidence items to the law enforcement agency if requested, and obtain a receipt.

Identifying Evidence

Mark all evidence items, both originals and copies, with a report number and other identifying information as indicated; and
Store your evidence items in a secure area.

Investigative Keys
The investigator should seek to identify certain evidence items as investigative "keys". For our purposes, an investigative key is an evidence item that has a special investigative significance, as only the investigator and the person who committed the crime know of the item's existence.

Investigative keys are valuable during interviews and interrogations to test the validity of a person's statements. Persons having personal knowledge of a certain key or fact are considered suspects, and the absence of personal knowledge of a certain key or fact logically eliminates other persons as suspects.

Investigative keys should not be released to other employees or as information contained in a press release. Examples of investigative keys that may only be known to the investigator and the suspect are:

Passwords or access codes (e.g., ATM, wire transfer, vault combination);
Account numbers and amounts;
Disposition of funds (e.g., transferred, cashed);
Victims' and suspects' names;
Date, time and specific location and access point of the crime;
Type of document used (e.g., cashiers check, signature card, payroll record); and
Type of implement used (e.g., ball-point pen, check imprinter, teller terminal).

Note: This article is derived from Security Education Systems' Conducting Investigations Manual.

? Security Education Systems 1983 - 2001
Last updated on July 27, 2000

First published on BankersOnline.com 11/5/01