2.2: CRIMINAL INVESTIGATION AS A THINKING PROCESS

To understand the process of investigation, it is necessary to comprehend the distinction between investigative tasks and investigative thinking. Investigative tasks relate to the information gathering processes that feed into investigative thinking and the results. Investigative thinking, on the other hand, is the process of analyzing information and theorizing to develop investigative plans. Let us consider this distinction in a little more depth.

Investigative Tasks Versus Investigative Thinking

Investigative tasks relate to identifying physical evidence, gathering information, evidence collection, evidence protection, witness interviewing, and suspect interviewing and interrogation. These are essential tasks that must be learned and practiced with a high degree of skill to feed the maximum amount of accurate information into the investigative thinking process. Criminal investigation is aimed at collecting, validating, and preserving information in support of the investigative thinking process. Accordingly, it is important to learn to do these evidence collection tasks well.

Investigative thinking is aimed at analyzing the information collected, developing theories of what happened, the way an event occurred, and establishing reasonable grounds to believe.

Those reasonable grounds to believe will identify suspects and lead to arrest and charges. Investigative thinking is the process of analyzing evidence and information, considering alternate possibilities to establish the way an event occurred and to determine if they are reasonable (Gehl & Plecas, 2017).

Progression of the Investigative Process

According to Gehl & Plecas (2017), the investigative process is a progression of activities or steps moving from evidence gathering tasks, to information analysis, to theory development and validation, to forming reasonable ground to believe, and finally to the arrest and charge of a suspect. Knowing these steps can be helpful because criminal incidents are dynamic and unpredictable. The order in which events take place, and the way evidence and information become available for collection, can be unpredictable. Thus, only flexible general rules to structured responses can be applied. However, no matter how events unfold or when the evidence and information are received, certain steps need to be followed. These include collection, analysis, theory development and validation, suspect identification and forming reasonable grounds, and acting to arrest, search, and lay charges.

In any case, as unpredictable as criminal events may be, the results police investigators aim for are always the same. And, you should always keep the desired results in mind to provide focus and priority to the overall investigative process. We will talk more later in this book about developing a mental map of the investigative process to assist in recording, reporting, and recounting events. It is mentioned now because a mental map is an appropriate metaphor to illustrate the investigative thinking process.

In this process, even though the path we will take to investigate may be unclear and unpredictable at first, the destination, the results we seek in our investigation, will always be the same and can be expressed in terms of results and their priorities.

Results and priorities focus first on the protection of the lives and safety of people. They focus second on the priorities of protecting property, gathering and preserving evidence, accurately documenting the event, and establishing reasonable grounds to identify and arrest offenders.

Priorities refer to Level One Priorities, as the protection of the lives and safety of people. This includes the protection and safety of the police officer’s own life and the life and safety of other officers.

The Level Two priorities are the four remaining aforementioned results, and these may be considered equal value to each other. Depending on circumstances, a rationale can be made for choosing to concentrate on one Level Two priority at the expense of another depending on the circumstances presenting (Gehl & Plecas, 2017).

The critical point to be made here is that under no circumstances should an investigator ever choose to focus his or her efforts and attention to a Level Two priority if doing so would compromise the Level One priority of protecting the life and safety of a person, including police officers themselves. In the event that evidence is lost or destroyed, or that a suspect is not identified or apprehended because investigators were taking care of the Level One priority, that is a justifiable outcome. A response that would sacrifice the safety of people to achieve a level two priority would not be justifiable, and could even lead to civil or criminal outcomes against the investigators making such a choice.

Now that we have looked at the critical aspects of investigative tasks and the response priorities police investigators need to apply to decision making when they act, we can proceed to examine the two different types of investigative response. We will refer to these as the Tactical Investigative Response and the Strategic Investigative Response.

Distinction Between a Tactical Investigative Response and a Strategic Investigative Response

These two different types of investigative responses are defined by the nature and status of the event that the investigator is facing. If it is an active event, it will require a Tactical Investigative Response and if it is an inactive event it will require a Strategic Investigative Response. It is important for an investigator to understand these two different levels of response because they include different response protocols, different legal authorities, and limitations to authority.

Tactical Investigative Response is faced by operational officers who are engaged in the frontline response to criminal events. As mentioned earlier, police are often challenged to respond to events, sometimes life and death situations, where information is limited and critical decisions need to be made to take action. In these Tactical Investigative Responses, the responding officers often have little or no time to undertake the tasks of gathering information. They must rely on the information of a dispatched complaint, coupled with their own observations made once they arrive at the scene. If an officer takes the action of making an arrest or using force to bring the situation under control, they are accountable for the action they have taken, and they may be called upon by the court to articulate their thinking, albeit based on limited information.

Once an investigator has arrived at the scene of an event and has brought the event under control by either making an arrest or by determining that the suspect has fled the scene and no longer poses a threat to the life or safety of persons, the investigation becomes a strategic investigative response. With this expiration of life and safety issues, also comes the expiration of exigent circumstances and the additional authorities to detain persons suspected and to enter and search private property without a warrant.

Clearly understanding and being able to define and articulate the circumstances of either an active event and tactical response, or a controlled event and a strategic response is critical. In court, it becomes important for a police investigator to describe what they were told going into the complaint, what they saw and heard when they arrived at the complaint, and, most importantly, what they were thinking to justify the action that was taken. For the court to be satisfied that the investigator acted lawfully, the judge needs to hear the investigator describe their thinking process to form reasonable grounds, or in some emergency cases, to have a reasonable suspicion that justifies the action taken.

To properly articulate their thinking in these investigative responses, it is important for the officer to understand the situational elements that can help define their thinking process when they testify in court. Two of the most important situational elements to understand are event classification and offense recognition (Gehl & Plecas, 2017).

Event Classification and Offense Recognition

In order to enter any investigation in either the tactical or the strategic response mode, an investigator must engage their thinking processes and make decisions about the event they are confronting. Is it an active event in progress that requires immediate and decisive tactical actions; or is it an inactive event where a less urgent, slower, and more strategic approach can be taken? This slower and more considered approach is the strategic investigative response, and the situational elements of this approach will be discussed in detail later in this chapter. Thinking about these situational elements of active event or inactive event is call event classification.

Considering the possible crime being committed in the event is called “offense recognition,” and this recognition of a specific offense activates the investigator’s thinking to look for the evidence that supports the elements of that recognized offense (Gehl & Plecas, 2017).

Classifying the Event as Either an Active Event or an Inactive Event

According to Gehl & Plecas (2017), for each of these classifications of active event or inactive event, the investigator has some different legal authorities to put into action, as well as some immediate responsibilities for the protection, collection, and preservation of evidence. When attending the scene of any reported event, the investigator should assume that the event is active until it has been established to be inactive.

In many cases, an event can be re-classified as an inactive event when it is determined that the suspect has left the scene of the event, or the event has concluded by the suspect being arrested. In cases where the suspect is still at the scene of an active event, the investigator needs to be thinking about the possibility of detaining the suspect or making an arrest of that suspect for an offense in progress. To make that detention or arrest, the investigator should be thinking about what possible offense they are being called to investigate by the initial complaint, and also by the evidence they are seeing and hearing upon arrival.

The classification of active event or inactive event is critical. It is a distinction that will guide an officer to determine what powers of detention, arrest, use of force, entry to property, and search may be relied upon to act. The defining elements between active event and inactive event are:

An Active Event

• The criminal act is or may still be in progress at the scene.
• The suspect is or may still be at the scene of the event.
• The situation is, or may be, a danger to the life or safety of a person, including the life or safety of attending police officers.

An Inactive Event

• The criminal act has concluded at the scene.
• The suspect or suspects have left the scene or have been arrested or detained.
• The situation at the scene no longer represents a danger to the life or safety of a person, including police officers.

Threat vs. Action Analysis Dilemma

The critical elements of this Threat vs. Action Analysis Dilemma were demonstrated in what became known as “Active Shooter calls” flowing from the incident at Columbine High School in 1999 (Police Executive Research Forum, 2014). In this incident, two armed teenagers went on a shooting spree in the high school killing 13 people and wounding 20 others before turning their weapons on themselves and committing suicide. Officers responding to that call followed departmental protocols of that era.

These protocols dictated they should wait for the arrival of their Emergency Response Team in events where armed suspect confrontations were taking place. The fact that these first responders waited despite ongoing killing taking place inside the high school led to a determination that police have a duty to act in such cases, and waiting is not the correct response. As a result of these determinations, active shooter response protocols were adopted across North America and police agencies re-trained their personnel to respond to active shooters with more immediate action and strategies to enter and confront the shooters in order to protect lives of possible victims.

The Threat vs. Action Analysis Dilemma response protocols in the active shooter response situations now provide the standard or benchmark that a responding officer must consider when faced with the decision to enter a dangerous situation alone and act, or to wait for back-up before entering to act. For active shooter situations, the protocols across North America are now prescribed responses, where responding officers are trained to enter and confront with minimal back-up. That said, not every potentially dangerous Threat vs. Action Analysis Dilemma is going to be an active shooter. Responding officers will often be faced with other calls where danger exists to the safety of persons and the decision to enter or wait for back-up must still be made. In these cases, the responding officer must weigh the available information and respond or wait for back-up per their own threat vs risk assessment of the facts. The active shooter protocols have provided something of a calibration to this analysis where extreme ongoing threat to life and safety of person equals high duty and high expectation to act (Gehl & Plecas, 2017).

Rules of Engagement for an Active Event or an Inactive Event

Police officers may be called to action by many different means. It may be a radio dispatch 911 call to attend an emergency, a citizen flagging down the passing police car to report an incident, or an officer coming upon a crime in progress. Whatever the means of being called to action, this is the first step of the police officer becoming engaged in a thinking process to gather and evaluate information, make decisions, and act. The first step of this thinking process for the investigator is to make the evaluation and ask the questions:

• Is this an Active Event requiring a Tactical Investigative Response?
• Is this an Inactive Event requiring a Strategic Investigative Response?

As a subsequent part of this evaluation determining an Active Event or Inactive Event, the investigator should also be alert to the type crime being encountered. For example, is it an assault, a robbery, or a theft? From the perspective of police tactical investigative response, an investigator confronted with an active event must first assess the threat level. Is there a danger to the life or safety of persons that would require a Level One Priority Result, taking immediate action to protect life and safety of persons, including the life and safety of attending police officers?

In assessing these threat levels to life and safety, police are often faced with very limited information. Sometimes there is only a possible threat, or an implied threat to the life or safety of persons. In such cases, it is only necessary for the police to suspect that there is a threat to the life or safety of a person to evoke the extended powers provided by exigent circumstances. In these cases of implied threats, police are authorized to rely on the powers afforded by exigent circumstances to enter private property without a warrant and to detain and search suspects who may present a danger. These are significant powers and an investigator must be aware that if they use these powers, there is a strong possibility they will later be called upon to justify the exercise of those powers.

The investigating officer arriving at the scene of this event would treat this as a Level One priority because there is an ongoing danger to the life and safety of persons. Under these circumstances, the Criminal Code authorities of exigent circumstances would apply. The investigator would be justified in detaining all parties present, including the witness and the victim, on the reasonable suspicion that they may all have been involved in combative behavior and might each still pose a threat to the life and safety of others, including the investigator. The powers of exigent circumstances are significant in this kind of scenario, and provide authority to take immediate action that will neutralize threats to the safety of people. Even if the facts of this assault with a weapon had evolved to show that it was taking place inside the private home of the suspect with the bloody knife, the authority of exigent circumstances would permit the investigator to enter that home without a warrant to protect the life and safety of persons. A very significant point to be made here is that as soon as the event is under control the extended powers of exigent circumstances expire.

Once this event has been brought under control and the threat to the life or safety of persons had been eliminated by arresting or detaining all persons present, the investigator must reclassify this event as an inactive event. As soon as this occurs, some of the rules of engagement and legal authorities to act change, and the investigation must switch to a Strategic Investigative Response.

With the expiration of exigent circumstances and the switch to a Strategic Investigative Response, several factors change. If this assault with a weapon had been taking place in the suspect’s private home, and the investigator had entered under the authority of exigent circumstance, the authority to remain in the private residence and search it would expire. If the investigator needed to collect additional physical evidence in that home, such as blood from the stabbing assault, a warrant or consent to search would now be required.

In this type of case, the residence of the suspect could be locked down externally and all persons removed until a search warrant was obtained to complete the investigation. Evidence obtained up to the point where the arrest was made and before exigent circumstances expired would be lawfully seized without a warrant. This would include the seizure of the bloody knife as plainview search or a search incidental to arrest. Anything else searched for and seized after the arrest could be challenged as an unlawful seizure if it was taken without a search warrant.

In addition to the requirement for search warrants, in some cases after exigent circumstances expire, other priorities and investigative must also change. As you will recall, the protection of life and safety of people is the Level One priority. With that priority, the court allows significant leeway to investigators in regards to the protection of crime scenes and the collection of evidence. If an investigator is attending any criminal event, the protection and collection of evidence always takes a backseat to the protection of life or safety of people. That said, once the life and safety issues have been resolved, the securing of the crime scene and the subsequent protection and collection of evidence becomes the number one priority.

Once the life and safety issues are resolved, it is time to lock down the crime scene and start protecting evidence for court. If it is possible to protect the life and safety of people and collect, protect, and preserve evidence, this is the preferred outcome. If it is not possible, the court will accept the fact that damage to evidence occurred prior to life and safety issues being resolved. Once those issues are resolved, the expectation is that a high level of care will be taken. If proper care is not taken, and evidence becomes contaminated, or continuity of possession is lost, the evidence may be ruled inadmissible at a trial. It is important for the investigator to fully grasp the construct that dictates when to transition from Tactical Investigative Response to Strategic Investigative Response (Gehl & Plecas, 2017).

Undercover Operations

An undercover investigation, as reported by Gehl & Plecas (2017), is the practice of a police officer posing as someone other than a police officer for the purpose of collecting evidence of criminal activity that would otherwise be difficult to acquire. The possible personas of the undercover investigator are almost limitless and can range from posing as a person seeking to purchase drugs from local traffickers to impersonating a vulnerable elderly citizen in a park to capture a purse snatcher preying on the elderly. There are also deep undercover strategies that may include establishing a longer-term identity with the purpose of infiltrating a criminal organization or a dissident political group to gain intelligence of organizational activities, culture, and membership.

Police investigators often find undercover strategies successful because criminal activity can be witnessed firsthand, and admissions of guilt made to undercover operators by criminals can be admitted to court without the need of the usual voir dire to test for admissibility. When conducting undercover operations, investigators must be careful to ensure that their presence and communication with the suspect is not the catalyst that causes that person to initiate a crime or carry through with a crime they would not otherwise have done. If these dynamics of initiating the crime occur, a defense of entrapment can sometimes be made on behalf of the accused person. New investigators may be given the opportunity to participate in minor undercover roles fairly early in their careers, and these can be valuable learning experiences.