An effective strategy for learning any new skill is to define it and break it down into logical steps, establishing a progression that can be followed and repeated to reach the desired results. The process of investigation is no exception and can be effectively explained and learned in this manner. In this chapter, you will learn how each of the following issues relates to the process of investigation.

1. The distinction between investigative tasks and investigative thinking
2. The progression of the investigative process
3. The distinction between tactical investigative and strategic investigative responses
4. The concepts of event classification and offence recognition
5. The threat vs. action response dilemma
6. The distinction between active events and inactive events
7. The connection of active events and Level 1 priority results to the powers afforded under exigent circumstance
8. The Response Transition Matrix (RTM) and the critical need to transition from tactical response to strategic response

Topic 1: The Distinction Between Investigative Tasks and Investigative Thinking

To understand the process of investigation, it is necessary to comprehend the distinction between investigative tasks and investigative thinking. Investigative tasks relate to the information gathering processes that feed into investigative thinking and the results. Investigative thinking, on the other hand, is the process of analyzing information and theorizing to develop investigative plans. Let us consider this distinction in a little more depth.

Investigative Tasks

Investigative tasks relate to identifying physical evidence, gathering information, evidence collection, evidence protection, witness interviewing, and suspect interviewing and interrogation. These are essential tasks that must be learned and practiced with a high degree of skill to feed the maximum amount of accurate information into the investigative thinking process. Criminal investigation is aimed at collecting, validating, and preserving information in support of the investigative thinking process. Accordingly, it is important to learn to do these evidence collection tasks well.

Investigative Thinking

Investigative thinking is aimed at analyzing the information collected, developing theories of what happened, the way an event occurred, and establishing reasonable grounds to believe. Those reasonable grounds to believe will identify suspects and lead to arrest and charges. Investigative thinking is the process of analyzing evidence and information, considering alternate possibilities to establish the way an event occurred and to determine if they are reasonable.

Topic 2: Progression of the Investigative Process

The investigative process is a progression of activities or steps moving from evidence gathering tasks, to information analysis, to theory development and validation, to forming reasonable ground to believe, and finally to the arrest and charge of a suspect. Knowing these steps can be helpful because criminal incidents are dynamic and unpredictable. The order in which events take place, and the way evidence and information become available for collection, can be unpredictable. Thus, only flexible general rules to structured responses can be applied. However, no matter how events unfold or when the evidence and information are received, certain steps need to be followed. These include collection, analysis, theory development and validation, suspect identification and forming reasonable grounds, and taking action to arrest, search, and lay charges.

In any case, as unpredictable as criminal events may be, the results police investigators aim for are always the same. And, you should always keep the desired results in mind to provide focus and priority to the overall investigative process. We will talk more later in this book about developing a mental map of the investigative process to assist in recording, reporting, and recounting events. It is mentioned now because a mental map is an appropriate metaphor to illustrate the investigative thinking process.

In this process, even though the path we will take to investigate may be unclear and unpredictable at first, the destination, the results we seek in our investigation, will always be the same and can be expressed in terms of results and their priorities.

Results and priorities focus first on the protection of the lives and safety of people. They focus second on the priorities of protecting property, gathering and preserving evidence, accurately documenting the event, and establishing reasonable grounds to identify and arrest offenders.

Priorities refer to Level One Priorities, as the protection of the lives and safety of people. This includes the protection and safety of the police officer’s own life and the life and safety of other officers.

The Level Two priorities are the four remaining aforementioned results, and these may be considered equal value to each other. Depending on circumstances, a rationale can be made for choosing to concentrate on one Level Two priority at the expense of another depending on the circumstances presenting.

The critical point to be made here is that under no circumstances should an investigator ever choose to focus his or her efforts and attention to a Level Two priority if doing so would compromise the Level One priority of protecting the life and safety of a person, including police officers themselves. In the event that evidence is lost or destroyed, or that a suspect is not identified or apprehended because investigators were taking care of the Level One priority, that is a justifiable outcome. A response that would sacrifice the safety of people to achieve a level two priority would not be justifiable, and could even lead to civil or criminal outcomes against the investigators making such a choice.

Now that we have looked at the critical aspects of investigative tasks and the response priorities police investigators need to apply to decision making when they take action, we can proceed to examine the two different types of investigative response. We will refer to these as the Tactical Investigative Response and the Strategic Investigative Response.

Topic 3: Distinction Between a Tactical Investigative Response and a Strategic Investigative Response

These two different types of investigative responses are defined by the nature and status of the event that the investigator is facing. If it is an active event, it will require a Tactical Investigative Response and if it is an inactive event it will require a Strategic Investigative Response. It is important for an investigator to understand these two different levels of response because they include different response protocols, different legal authorities, and limitations to authority.

Tactical Investigative Response

Tactical Investigative Response is faced by operational officers who are engaged in the frontline response to criminal events. As mentioned earlier, police are often challenged to respond to events, sometimes life and death situations, where information is limited and critical decisions need to be made to take action. In these Tactical Investigative Responses, the responding officers often have little or no time to undertake the tasks of gathering information. They must rely on the information of a dispatched complaint, coupled with their own observations made once they arrive at the scene. If an officer takes the action of making an arrest or using force to bring the situation under control, they are accountable for the action they have taken, and they may be called upon by the court to articulate their thinking, albeit based on limited information.

Strategic Investigative Response

Once an investigator has arrived at the scene of an event and has brought the event under control by either making an arrest or by determining that the suspect has fled the scene and no longer poses a threat to the life or safety of persons, the investigation becomes a strategic investigative response. With this expiration of life and safety issues, also comes the expiration of exigent circumstances and the additional authorities to detain persons suspected and to enter and search private property without a warrant.

Clearly understanding and being able to define and articulate the circumstances of either an active event and tactical response, or a controlled event and a strategic response is critical. In court, it becomes important for a police investigator to describe what they were told going into the complaint, what they saw and heard when they arrived at the complaint, and, most importantly, what they were thinking to justify the action that was taken. For the court to be satisfied that the investigator acted lawfully, the judge needs to hear the investigator describe their thinking process to form reasonable grounds, or in some emergency cases, to have a reasonable suspicion that justifies the action taken.

To properly articulate their thinking in these investigative responses, it is important for the officer to understand the situational elements that can help define their thinking process when they testify in court. Two of the most important situational elements to understand are event classification and offence recognition.

Topic 4: Event Classification and Offence Recognition

In order to enter any investigation in either the tactical or the strategic response mode, an investigator must engage their thinking processes and make decisions about the event they are confronting. Is it an active event in progress that requires immediate and decisive tactical actions; or is it an inactive event where a less urgent, slower, and more strategic approach can be taken? This slower and more considered approach is the strategic investigative response, and the situational elements of this approach will be discussed in detail later in this chapter. Thinking about these situational elements of active event or inactive event is call event classification.

Considering the possible crime being committed in the event is called “offence recognition,” and this recognition of a specific offence activates the investigator’s thinking to look for the evidence that supports the elements of that recognized offence.

Topic 5: Classifying the Event as Either an Active Event or an Inactive Event

For each of these classifications of active event or inactive event, the investigator has some different legal authorities to put into action, as well as some immediate responsibilities for the protection, collection, and preservation of evidence. When attending the scene of any reported event, the investigator should assume that the event is active until it has been established to be inactive.

In many cases, an event can be re-classified as an inactive event when it is determined that the suspect has left the scene of the event, or the event has concluded by the suspect being arrested. In cases where the suspect is still at the scene of an active event, the investigator needs to be thinking about the possibility of detaining the suspect or making an arrest of that suspect for an offence in progress. To make that detention or arrest, the investigator should be thinking about what possible offence they are being called to investigate by the initial complaint, and also by the evidence they are seeing and hearing upon arrival.

The classification of active event or inactive event is critical. It is a distinction that will guide an officer to determine what powers of detention, arrest, use of force, entry to property, and search may be relied upon to take action. The defining elements between active event and inactive event are:

An Active Event

1. The criminal act is or may still be in progress at the scene.
2. The suspect is or may still be at the scene of the event.
3. The situation is, or may be, a danger to the life or safety of a person, including the life or safety of attending police officers.

An Inactive Event

1. The criminal act has concluded at the scene.
2. The suspect or suspects have left the scene or have been arrested or detained.
3. The situation at the scene no longer represents a danger to the life or safety of a person, including police officers.

Topic 6: Threat vs. Action Analysis Dilemma

The critical elements of this Threat vs. Action Analysis Dilemma were demonstrated in what became known as “Active Shooter calls” flowing from the incident at Columbine High School in 1999 (Police Executive Research Forum, 2014). In this incident, two armed teenagers went on a shooting spree in the high school killing 13 people and wounding 20 others before turning their weapons on themselves and committing suicide. Officers responding to that call followed departmental protocols of that era. These protocols dictated they should wait for the arrival of their Emergency Response Team in events where armed suspect confrontations were taking place. The fact that these first responders waited despite ongoing killing taking place inside the high school led to a determination that police have a duty to take action in such cases, and waiting is not the correct response. As a result of these determinations, active shooter response protocols were adopted across North America and police agencies re-trained their personnel to respond to active shooters with more immediate action and strategies to enter and confront the shooters in order to protect lives of possible victims.

The Threat vs. Action Analysis Dilemma response protocols in the active shooter response situations now provide the standard or benchmark that a responding officer must consider when faced with the decision to enter a dangerous situation alone and take action, or to wait for back-up before entering to take action. For active shooter situations, the protocols across North America are now prescribed responses, where responding officers are trained to enter and confront with minimal back-up. That said, not every potentially dangerous Threat vs. Action Analysis Dilemma is going to be an active shooter. Responding officers will often be faced with other calls where danger exists to the safety of persons and the decision to enter or wait for back-up must still be made. In these cases, the responding officer must weigh the available information and respond or wait for back-up per their own threat vs risk assessment of the facts. The active shooter protocols have provided something of a calibration to this analysis where extreme ongoing threat to life and safety of person equals high duty and high expectation to take action.

Topic 7: Rules of Engagement for an Active Event or an Inactive Event

Police officers may be called to action by many different means. It may be a radio dispatch 911 call to attend an emergency, a citizen flagging down the passing police car to report an incident, or an officer coming upon a crime in progress. Whatever the means of being called to action, this is the first step of the police officer becoming engaged in a thinking process to gather and evaluate information, make decisions, and take action. The first step of this thinking process for the investigator is to make the evaluation and ask the questions:

1. Is this an Active Event requiring a Tactical Investigative Response?
2. Is this an Inactive Event requiring a Strategic Investigative Response?

As a subsequent part of this evaluation determining an Active Event or Inactive Event, the investigator should also be alert to the type crime being encountered. For example, is it an assault, a robbery, or a theft? From the perspective of police tactical investigative response, an investigator confronted with an active event must first assess the threat level. Is there a danger to the life or safety of persons that would require a Level One Priority Result, taking immediate action to protect life and safety of persons, including the life and safety of attending police officers?

In assessing these threat levels to life and safety, police are often faced with very limited information. Sometimes there is only a possible threat, or an implied threat to the life or safety of persons. In such cases, it is only necessary for the police to suspect that there is a threat to the life or safety of a person to evoke the extended powers provided by exigent circumstances. In these cases of implied threats, police are authorized to rely on the powers afforded by exigent circumstances to enter private property without a warrant and to detain and search suspects who may present a danger. These are significant powers and an investigator must be aware that if they use these powers, there is a strong possibility they will later be called upon to justify the exercise of those powers. Let us consider that section of the Criminal Code that authorizes officers to enter a dwelling without a warrant, and then apply that understanding to some scenarios:

Authority to enter dwelling without warrant under the Criminal Code of Canada

529.3 (1) Without limiting or restricting any power a peace officer may have to enter a dwelling-house under this or any other Act or law, the peace officer may enter the dwelling-house for the purpose of arresting or apprehending a person, without a warrant referred to in section 529 or 529.1 authorizing the entry, if the peace officer has reasonable grounds to believe that the person is present in the dwelling-house, and the conditions for obtaining a warrant under section 529.1 exist but by reason of exigent circumstances it would be impracticable to obtain a warrant. (Criminal Code, 1985, s 529(1))

Exigent circumstances
(2) For the purposes of subsection (1), exigent circumstances include circumstances in which the peace officer

(a) has reasonable grounds to suspect that entry into the dwelling-house is necessary to prevent imminent bodily harm or death to any person; or

(b) has reasonable grounds to believe that evidence relating to the commission of an indictable offence is present in the dwelling-house and that entry into the dwelling-house is necessary to prevent the imminent loss or imminent destruction of the evidence. (Criminal Code, 1985, s 529(2)(a,b))

Where warrant is not necessary pursuant to the Criminal Code of Canada

487.11 A peace officer, or a public officer who has been appointed or designated to administer or enforce any federal or provincial law and whose duties include the enforcement of this or any other Act of Parliament, may, in the course of his or her duties, exercise any of the powers described in subsection 487(1)(Criminal Code, 1985, s 487(1)) or
492.1(1) without a warrant if the conditions for obtaining a warrant exist but by reason of exigent circumstances it would be impracticable to obtain a warrant. (Criminal Code, 1985, s 492(1))

As you might imagine, an officer attending the calls outlined in the preceding scenarios needs to be very clear on the circumstances where implicit distress and exigent circumstances can be interpreted to use the powers to enter private property. This same need extends to using appropriate levels of force and making an arrest. Considering these are active and still evolving criminal events, there is urgency to act. It is critical for the investigating officer to have a clear understanding of these principles to quickly assess the presented facts, make the event classification, and take the necessary action in an expedient manner.

As outlined earlier in this book, there is a significant difference between reasonable grounds to believe and reasonable grounds to suspect, and an officer who is not clear on the distinction might have a difficult time articulating to the court how and why they took the initiative to act or not to act. It is these types of cases, where there is implied distress, or an implied threat to life or safety, that an investigator must be clear on their interpretation of the event and on their authorities to take action. The thinking involved might be described as an active event and an explicit or implied threat to life or safety equals exigent circumstances.

More on Offence Recognition

At the same time the event is being classified as either active event or inactive event, the investigator should be engaging in the thinking process of offence recognition. In other words, what offence is being reported or what is the offence being observed in the fact pattern that is unfolding? With this offence recognition, the investigator will begin to assemble a mental inventory of the evidence and information that will be required to support the recognized offence(s). Having an offence in mind, the investigator will also begin to consider their range of powers and authorities that can be used under the law regarding that offence. The investigator will ask them self;

• Is this a summary conviction offence where the suspect must be found committing to justify an arrest?
• Or, is it an indictable or dual procedure offence where there is direct evidence or strong circumstantial evidence to support an arrest?

If the investigator determines that they are attending to an Active Event and their offence recognition suggests that there may be a danger to the life or safety of a person, such as assault causing bodily harm, they will know that they need only find evidence to form reasonable grounds to believe in order to make an arrest. As part of attendance to the scene of the event, the investigator should be classifying the location to determine what their legal requirements are for their authority to enter. Consideration of the possible authorities to enter private property would include:

• Consent of the property owner
• Section 487 CCC warrant to search
• Exigent circumstances to suspect a need to protect the life or safety of a person
• Exigent circumstance with reasonable grounds to believe there will be a destruction of evidence of an indictable offence
• Fresh pursuit of a suspect found committing an offence

If the investigator arrives at the scene where a suspect is immediately apparent, the investigator can make an immediate detention or perhaps even an arrest. The investigator may rely on the Section 529 (2) of the Criminal Code of Canada (1985) under exigent circumstance to enter private property without a warrant to make the arrest and ensure the safety of persons at the scene. If the investigator makes an arrest after forming reasonable grounds for belief, they are required by the Canadian Charter of Rights and Freedoms to tell the suspect what offence they are being arrested for.

Required Warnings

The following is the standard Charter of Rights (Canadian Charter, 1982, s 10(a,b)) warning and police warning. These standard caution warnings are given as follows:

I am arresting you (or detaining you) for [name of offence(s)].

POLICE WARNING
I wish to give you the following warning: You need not say anything. You have nothing to hope from any promise or favour, and nothing to fear from any threat whether or not you do say anything. Anything you do or say may be used as evidence.

Do you understand? (Transit Police, 2015)

CHARTER WARNING

You have the right to retain and instruct counsel without delay. You also have the right to free and immediate legal advice from duty counsel by making free telephone calls to [toll-free phone number(s)] during business hours and [toll-free phone number(s)] during non-business hours.

Do you understand?

Do you wish to call a lawyer?

You also have the right to apply for legal assistance through the provincial legal aid program.

Do you understand? (Transit Police, 2015)

Let us consider the following scenario to illustrate these principles in action.

From this fact pattern the investigator could make an immediate arrest for assault with a weapon. The investigator would seize the bloody knife and protect it as evidence of that offence. The facts within this scenario that allow the investigator to take action, enter the private property, and form their reasonable grounds for belief and make the arrest. When the case goes to court, the investigator of this case will articulate the chain of events along with their thinking to substantiate their reasonable grounds for belief. To achieve this, the investigator’s testimony would be that:

• they were dispatched to attend a complaint of assault with a weapon in progress,
• the suspect was still on scene and it was an active event,
• considering the potential danger to life or safety of a person, they entered the property under the provisions of exigent circumstances,
• an independent witness at the scene stated the home owner had stabbed a guest in the home,
• a man bleeding from an apparent wound ran from the home, and
• another man standing in the doorway was holding a bloody knife and was identified by the witness as the home owner.

The investigating officer arriving at the scene of this event would treat this as a Level One priority because there is an ongoing danger to the life and safety of persons. Under these circumstances, the Criminal Code authorities of exigent circumstances would apply. The investigator would be justified in detaining all parties present, including the witness and the victim, on the reasonable suspicion that they may all have been involved in combative behaviour and might each still pose a threat to the life and safety of others, including the investigator. The powers of exigent circumstances are significant in this kind of scenario, and provide authority to take immediate action that will neutralize threats to the safety of people. Even if the facts of this assault with a weapon had evolved to show that it was taking place inside the private home of the suspect with the bloody knife, the authority of exigent circumstances would permit the investigator to enter that home without a warrant to protect the life and safety of persons. A very significant point to be made here is that as soon as the event is under control the extended powers of exigent circumstances expire.

Once this event has been brought under control and the threat to the life or safety of persons had been eliminated by arresting or detaining all persons present, the investigator must reclassify this event as an inactive event. As soon as this occurs, some of the rules of engagement and legal authorities to take action change, and the investigation must switch to a Strategic Investigative Response.

With the expiry of exigent circumstances and the switch to a Strategic Investigative Response, several factors change. If this assault with a weapon had been taking place in the suspect’s private home, and the investigator had entered under the authority of exigent circumstance, the authority to remain in the private residence and search it would expire. If the investigator needed to collect additional physical evidence in that home, such as blood from the stabbing assault, a warrant or consent to search would now be required.

In this type of case, the residence of the suspect could be locked down externally and all persons removed until a search warrant was obtained to complete the investigation. Evidence obtained up to the point where the arrest was made and before exigent circumstances expired would be lawfully seized without a warrant. This would include the seizure of the bloody knife as plain-view search or a search incidental to arrest. Anything else searched for and seized after the arrest could be challenged as an unlawful seizure if it was taken without a search warrant.

In addition to the requirement for search warrants, in some cases after exigent circumstances expire, other priorities and investigative must also change. As you will recall, the protection of life and safety of people is the Level One priority. With that priority, the court allows significant leeway to investigators in regards to the protection of crime scenes and the collection of evidence. If an investigator is attending any criminal event, the protection and collection of evidence always takes a backseat to the protection of life or safety of people. That said, once the life and safety issues have been resolved, the securing of the crime scene and the subsequent protection and collection of evidence becomes the number one priority.

Once the life and safety issues are resolved, it is time to lock down the crime scene and start protecting evidence for court. If it is possible to protect the life and safety of people and collect, protect, and preserve evidence, this is the preferred outcome. If it is not possible, the court will accept the fact that damage to evidence occurred prior to life and safety issues being resolved. Once those issues are resolved, the expectation is that a high level of care will be taken. If proper care is not taken, and evidence becomes contaminated, or continuity of possession is lost, the evidence may be ruled inadmissible at a trial. It is important for the investigator to fully grasp the construct that dictates when to transition from Tactical Investigative Response to Strategic Investigative Response.

Topic 8: Response Transition Matrix (RTM)

The RTM is a matrix tool to illustrate the considerations for police response when considering the authorities and issues to escalate or de-escalate from a Tactical Investigative Response to Strategic Investigative Response. Considering the following questions will help an investigator to identify an event as either a Tactical Investigative Response or a Strategic Investigative Response:

1. Is the event active or inactive?
2. What offence(s) is possibly occurring?
3. Do I suspect an implicit or explicit danger to the life or safety of a person?
4. Do I have reasonable grounds to believe evidence of an indictable offence will be lost or destroyed?
5. What immediate actions can be taken to protect the life or safety of persons?
6. What immediate action can be taken to protect evidence, without compromising life or safety?
7. Have life and safety issues been resolved, and should the change be made from Tactical Investigative Response to Strategic Investigative Response?

The Canadian Charter of Rights and Freedoms, the Criminal Code, and common law authorities provide police with both powers to act and limitations to taking action. In the Canadian justice system, both statutory law and case law have evolved to establish a range of authorities and police powers that allow rapid response at the more dangerous end of the matrix, and more time-consuming restrictions to act at the less threatening end of the matrix. The chart below illustrates the duty to act, the authority to act, and the priorities for action to consider.

Summary

In this chapter, we have discussed the progression of the investigative process and the key elements within the progression that must be considered by an investigator. These elements within the investigative process are the signposts on the roadway of a mental map. These signposts of active event or inactive event tell us to either take action within the extended authorities of exigent circumstances or to modify our response for an inactive event and recognize the need to make the transition to a strategic response. An investigator’s understanding of the changes in circumstances that define these situations and the change from active to inactive events can make the difference between successful and unsuccessful investigative outcomes.

Long Descriptions

Investigative response priority results long description: There are two levels of investigative response priority results. Level 1 includes “Protecting the life and safety of people including police officers attending the scenes of crime.”

Level 2 has four priority results:

1. Identifying, gathering, and preserving evidence
2. Establishing reasonable grounds to identify and arrest suspects
3. Accurately recording and documenting the event in notes and reports
4. Protecting property

[Return to Investigative response priority results]

The RTM: Response Transition Matrix long description: In the case of an active event with recognized offence, suspected issues of life safety or reasonable and probable grounds of evidence destruction, police need to take tactical investigative response action considering level-one priority results. Immediate action is required in such exigent circumstances, and as such, an officer has reasonable and probable grounds to detain and search without a warrant.

In the case of an inactive event with recognized offence but no life or safety issues or issues of evidence destruction, police need to take strategic investigative response action considering level-two priority results. This action should be specific to an identified offence. In such non-exigent circumstances, an officer has reasonable and probably grounds to perform an arrest and search only with a warrant. [Return to The RTM: Response Transition Matrix]