In this chapter we will work through some investigative STAIR scenarios to demonstrate the required investigative awareness required to transition from the tactical investigative response to the strategic investigative response. Once in the strategic response mode we will practice applying theory development to conduct our analysis of the evidence and information found and we will create investigative plans.

This chapter presents two investigative scenarios each designed to illustrate steps of the STAIR tool allowing the student to recognize both the tactical and the strategic investigative responses and the implications of transitioning from the tactical to the strategic response.

In the strategic investigative response of the second scenario, the student is challenged to work through an exercise of identifying the available information and evidence and developing theories in order to guide their investigative plans.

Topic 1: Beginning With Your End in Mind and Focusing on Results

Any investigation an investigator embarks upon must focus on the desired Results to guide the thinking and investigative action. If we know where we are going and what our results need to be, we will know how to prioritize our actions to reach those results. Setting and monitoring priorities is a critical piece of the mental mapping process. A police investigator needs to know that whatever course of action taken to achieve a result, it will be incumbent upon the investigator later to provide a reasonable and justifiable explanation of how and why that chosen course of action was taken. Understanding and keeping these Results in mind while entering a Situation allows better clarity to define the priorities and develop the immediate investigation and action plan.

As mentioned above, in defining and assigning priorities to the Results, the top priority is very clear: protecting the life and safety of persons. Achieving the other priorities will sometimes be sacrificed to make certain this primary priority is achieved. Protecting property, gathering and preserving evidence, accurately documenting the event, and establishing reasonable grounds to identify and arrest offenders are all important, but are considered secondary results. These individual Results may also sometimes be sacrificed, one in favour of the other, depending on the way events unfold. The setting and defining of priorities for Results will be further illustrated and practiced in several scenarios presented below. For now, with our Results concept in mind, let us apply the STAIR tool in the following scenario.

Situation

In this Situation phase of our STAIR tool, you have been provided with a limited amount of information. You start by breaking down the information into components:

• A witness, Bill Murphy, has identified his neighbour as having assaulted a woman, identified as the suspect’s wife, Jane
• Suspect identified is Randy Smith
• Victim identified as Jane Smith
• Randy Smith may be a heavy drinker, and alcohol may be a factor
• This is an active event and it may still be in progress as noise from the house continues
• The offence recognition would define this as an assault and possibly forcible confinement
• Persons who may have their safety in danger are Jane Smith and her two young sons
• The incident is reported as being currently confined to inside the house; however, the incident was, at one point, on the front lawn of their home

Keep in mind that to investigate this incident and to act in the execution of your duties, each piece of the foregoing information may be considered and acted upon as the truth, until it has been verified. Each piece of information here can contribute to the forming of reasonable grounds to enter onto private property or to make an arrest. Each piece of information you have can assist in forming beliefs regarding the safety of persons.

Remember that we begin with our end in mind considering our Results. At this stage of the investigation, there appears to be an immediate threat to the safety of Jane Smith. Domestic disputes are always emotionally charged situations, and it is reasonable for attending police officers to consider that their own personal safety will also be at risk. This is definitely a Level 1 Results priority.

Tasks

As you proceed to attend to the area of the call, you embark upon the Tasks portion of the STAIR tool.

Task 1: Responding in the Correct Mode

In this case, the report identifies an active event where the suspect is still at the scene and criminal activity may still be in progress. You will be responding in Tactical Investigative Response mode.

Task 2: Identifying the Players in the Event

• Randy Smith
• Jane Smith
• Two sons – ages 8 years and 4 years old
• Witness Bill Murphy

Task 3: Breaking out the Facts of the Event

In this case, possible criminal actions witnessed by the neighbour indicate that an assault has taken place. The wife was struck in the face and dragged into the house. There may be a forcible confinement taking place. Your offence recognition, in this case, is focused on two possible offences: assault and forcible confinement. You recognize that each of these offence types is an indictable offence for which an arrest can be made if you form reasonable grounds to believe the offence(s) have been committed by Randy Smith.

Task 4: Gathering All Additional Information That Might be Available

Faced with these circumstances, additional information would assist in making a risk/threat assessment. You proceed to the CPIC and PRIME – RMS databases to determine:

• Criminal record information on both Randy and Jane Smith
• History of previous calls to this residence

From CPIC, you determine that Randy Smith, of this address, has a record for Impaired Driving. There is no criminal record for Jane Smith. Police Records Information Management Environment (RMS) shows a previous complaint of a domestic dispute at this same residence 11 month ago. At that time, Randy Smith was arrested but not charged with assault. Jane Smith, the complainant in that case, would not proceed with charges, and there were no independent witnesses to the assault.

Analysis

For a police officer attending the scene of an in-progress event, it is important to consider the issues of safety and ongoing threats to safety to know how best to approach the scene and what immediate actions can be taken. As is the case with many in-progress events, there is a concern for the safety of all persons. In this case, the wife, Jane Smith, has reportedly been assaulted and dragged back into the premises. There are possibly two young sons also at the premises. Whenever there is a concern for the safety of persons, exigent circumstances exist and a police officer has extensive powers for the entry onto private property, if necessary, to detain any persons present to secure the scene and stop the continuation of an offence.

Investigation

Considering the explicit threat to the safety of Jane Smith, and a possible implied threat to the safety of the two sons, the issue of the safety of persons here is clear. Since this is a domestic violence complaint, there is also an implied danger to all police officers attending that must also be considered. In this case, you call for a backup patrol unit to attend. Your tactical investigative response plan is to approach the premises using concealment and cover as you and your backup unit assess what you can hear and see as you approach the scene.

You decide that if you do not hear or see any ongoing immediate threat, you will approach by knocking on the front door and making contact. If you do see or hear evidence to indicate there is an ongoing threat to the safety of a person (e.g. ongoing assault), you know you can enter the premises without a warrant under exigent circumstances to protect the safety of persons. You know you have an eyewitness to the offence of assault, and, with this piece of witness evidence alone, you have formed reasonable grounds to believe the offence of assault has taken place. The added information of possible alcohol involvement and past record of domestic assault complaints can be considered in the evaluation of the threat level to engage the extended authorities of exigent circumstances.

As you walk towards the house, the neighbour/witness, Bill Murphy, approaches you and states that Randy Smith just left the premises alone in his blue Dodge truck. You can see a woman and two young boys looking out the front window of the premises.

Your event classification now must change to an inactive event, and you transition to a strategic investigative response mode. The Results priorities now change as well. Your new priorities become:

Results

1. Gather and preserve evidence:
   1. Interview witness Bill Murphy
   2. Interview the victim Jane Smith
   3. Take photographs of any injuries to the victim
   4. Determine if there are other witnesses available
   5. Determine if other physical evidence, weapons, and/or liquor bottles are present
2. Accurately document the event
   1. Take the statement of witness Bill Murphy
   2. Take statement of the victim, Jane Smith
   3. Make personal notes
   4. Complete an occurrence report
3. Establish reasonable grounds to identify and arrest an offender
   1. Verify that an offence has occurred
   2. Verify the type of offences (e.g. assault, or assault causing bodily harm, and/or forcible confinement, and possibly impaired driving)
   3. Verify the identity of Randy Smith as the person responsible for identified offences
   4. If an offence and an identity of the suspect are verified, broadcast a “Be On Lookout For (BOLF)” to arrest Randy Smith for assault

In this case, the offender was easily identifiable. This is true of many in progress occurrences that police attend. These types of cases are often handled in the progression described above, starting off as a tactical investigative response and transitioning to a strategic investigative response mode.

In cases where the offender is not immediately identifiable, or the fact pattern of the event is not clear, the investigation becomes more complex and protracted. These are the cases where the strategic investigative response will include analyzing the information and evidence to develop theories, to identify possible suspects, and to test possible fact patterns against the physical evidence and timelines.

To examine this process of strategic investigative response, we will look at a more complex scenario where additional skill sets and strategies need to be considered within the STAIR Tool.

Situation

Using the STAIR tool, as you approach the scene, you are aware that the suspects have left the crime scene and this is an inactive event. Although aware of the possibility that you may see suspects leaving the area of the crime scene, your arrival and approach to the crime scene do not require the tactical investigative response of an active event. The immediate danger to the life and safety of persons at the crime scene has passed. You are in the strategic investigative response mode. Beginning with your end in mind, you now consider what will be the Results for this case:

• Protecting the life and safety of persons at this crime scene is no longer an issue because the armed suspects have now left the scene
• Protecting property will be an issue because $120,000 worth of merchandise and $350 in cash have been taken and need to be recovered
• Gathering and preserving evidence will be an issue because there are witnesses to interview at the scene and possibly physical evidence left behind by the suspects
• Accurately documenting the event will be necessary
• Establishing reasonable grounds to identify and arrest offenders will certainly be the desired outcome

Tasks

With our Results priorities clearly in mind, you now undertake some specific Tasks of the STAIR tool:

• Secure the crime scene
• Examine the crime scene and call upon forensics for evidence collection
• Broadcast a description of the suspects and incident details as a BOLF
• Identify all witnesses and victims present
• Run each witness and victim through police databases to determine any criminal records, history of criminal conduct, or association to known criminals
• Take individual statements from each witness and victim

After completing your victim and witness interviews and your database searches, you have the first pieces of information from which the Analysis component can begin. Your forensic team is at the scene dusting for fingerprints and photographing the damage.

Analysis

As mentioned above, STAIR will assist in developing strategies to guide the Investigation efforts. Based on the Strategic Investigative Response Funnel, all incoming information is flowed into the top of the funnel to start the process of analysis. The analysis begins by considering each of the individual known facts about the incident. In this case, the facts to be considered include:

• Date of offence: Saturday August 15, 2012
• Time: 4 PM
• Location: jewellery store in down town strip mall
• Owner/manager and one employee present (witnesses)
• Two elderly women shopping together present (witnesses)
• One 25-year-old female shopper present (witness)
• Three apparently male suspects entered the store through front door
• All suspects were wearing ski masks, gloves, blue jeans, and dark jackets
• Each suspect had a handgun
• One suspect stood guard
• Two suspects entered the store
• Suspects told everyone to lay on the floor
• Suspects smashed display cases and loaded jewellery and watches into bags
• Each suspect carried away the stolen goods in white bags
• One suspect had the manager open the cash register and took $350 cash
• Approx. $120,000 worth of jewellery was taken
• Some of the watches and diamonds stolen are identifiable by serial numbers
• Suspect fled out the front door and south around the corner of the building
• No vehicle was seen
• Entire robbery took under five minutes

To continue this Analysis, we start by reflecting on some of the theories we might evolve considering the facts of this case. This will begin the process of developing theories and formulating investigative plans to identify suspects and search for new evidence that either confirms or disproves those theories.

1. What theories might you have about the time and location of this offence?
2. Can you develop any theories about the level of planning that went into the robbery?
3. Consider theories about how well these three suspects know each other.
4. Is it possible that the suspects had been at the store sometime prior to this robbery?
5. What relevant theories might be considered from the way the suspects were dressed?
6. What relevant theories might be considered from the fact that the robbers carried handguns?
7. What theories might be considered from the way the robbery was carried out?
8. What theories might be considered regarding the items taken?
9. Theorize and consider if these three suspects were working alone.
10. Theorize who else might be involved.

Think about the fact pattern of this incident and answer these questions. In this process, you will engage your imagination and your deductive reasoning skills to consider the possibilities and develop theories to guide your investigative plan going forward. In this step of the Analysis process in the STAIR, what logical theories can you develop to explain how this crime may have been committed, and who may have been involved? Try and develop at least two or three alternate theories. As you answer each question, consider different avenues of investigation you might follow to confirm or disprove some of your theories. Can aspects of your theories be confirmed or disconfirmed against an examination of the existing physical evidence?

Investigation

As you proceed through the STAIR tool, the process of Analysis and Investigation can become somewhat circular, as the investigation reveals new information, and new information is analyzed to confirm, disprove, or modify the theories of suspects and events that you are considering.

Do your theories present any avenues where you can investigate further to gain additional information?

Outline your own analysis, assumptions, deductions, and theories. Outline the further avenues for investigations that you can undertake in this case. After you have completed your own analysis, theory development, and investigative plans, move to the end of this chapter and check your assumptions, analysis, theories, and investigative plans against the answers provided there.

Topic 2: Getting Answers in the Robbery Scenario

1. What theories might you consider about the time and location of this offence?
   • The fact that the jewellery store is in a strip mall may have been a factor in the robbers selecting this location as a target. This type of business premises allows for drive by viewing of the inside of the premises, as well as quick access and exit to the outside parking area. This location also allows for the suspects to maintain an ongoing look-out for approaching police response.
   • The time of the offence could have been intentionally chosen closer to the end of the day on a Saturday in the hope that more cash would be in the store. Depending on the typical customer traffic volume in the mall area on a Saturday, the suspects may have hoped for more traffic volume to assist with their escape.
2. Can you develop any theories about the level of planning that went into the robbery?
   • Since the suspects arrived in disguise, armed with handguns, and carrying bags to take away the proceeds of the robbery, it might be theorized that they took some time to put together this special equipment to carry out the crime.
   • The precision with which the robbery was carried out (e.g. completed in five minutes, one suspect guarding the door, all persons ordered onto the floor) would indicate a high level of planning to orchestrate this robbery.
3. How well did these three suspects know each other?
   • It is very likely that the three suspects knew each other well enough to establish the level of trust required to carry out the robbery.
   • The type of goods taken in this robbery, except for the cash, would need to be converted to cash to be divided up later. This could indicate that a longer term relationship exists between these robbers.
   • The planning that is apparent would indicate that the suspects spent some time together to plan, collect the necessary equipment, and divide up the proceeds of the robbery.
4. Is it possible the suspects had been at the store sometime prior to this robbery?
   • To plan this robbery and execute it with this level of precision, it is very likely that the suspects spent at least some time looking over the premises and the surrounding area to plan their approach, execute the robbery, and plan their escape.
5. What relevant theories might be considered from the way the suspects were dressed?
   • It appears that all three suspects were wearing similar outfits with dark jackets, blue jeans, and ski masks. This may indicate that the suspects deliberately purchased specific gear for committing a crime.
   • This clothing might be considered somewhat non-descript, and not easily distinguishable or unique for a witness to accurately or specifically describe the fleeing suspects. The use of masks and non-descript outfits might indicate that the criminals were experienced.
   • The fact that they are all wearing jackets on a summer day in August might indicate that they were covering up tattoos, scars, or other distinguishing features that might otherwise assist in identifying the suspects.
   • The fact that all suspects were wearing gloves would indicate that they are aware that any fingerprints left behind could identify them.
6. What relevant theories might be made from handguns being carried by the robbers?
   • Handguns are more easily concealed and may be the weapon of choice for more professional criminals.
   • Handguns are more difficult to obtain, and legal handguns are generally registered, so it is likely that these were unregistered or stolen handguns.
7. What might be theorized from the way they carried out the robbery?
   • From the overall planning and precision in the execution of the robbery, it might be theorized that this is not the first robbery that these three have done together. This method may have been used elsewhere.
8. What might be theorized considering the items taken?
   • Considering that the items taken were specialty items and that some were marked with identifying serial numbers, it might be theorized that the robbers have a prearranged or preplanned means of disposing of the items or otherwise converting them to cash.
   • Alternately, the fact that they have taken items that are identifiable by serial numbers may indicate a level of haste or even inexperience because these items, if discovered after being sold, may be traced back to the robbery suspects.
9. Were these three suspects working alone?
   • Considering the speed of execution and the apparent level of planning that went into this robbery, it is possible that there was a fourth accomplice waiting outside in a get-away vehicle.
   • There is a possibility that the suspects had some inside knowledge of the jewellery store and the inventory through association with a person connected to the store.
10. Who else might be involved?
    • A fourth criminal associate as a get-away driver and lookout.
    • A customer inside the store, at the time of the robbery, acting as a scout.
    • A current or former employee of the store may have provided inside information.
    • The owner/manager of the store could be involved as part of an insurance fraud scheme.

Topic 3: Answers to Possible Theories in the Robbery Scenario

Theory #1

This is a well-planned robbery executed by three or four experienced criminals. In addition to the three suspects in the store, there might have been an outside get-away driver acting as a lookout. They intentionally selected this store because of the strip mall location and the easy access to inventory by smashing the display cabinets. They were wearing disguises and jackets to avoid facial identification and possible tattoo or scar identification. They were wearing gloves probably because they already have criminal records and know that any fingerprints left behind may allow for the suspects to be identified. The suspects gained the information to execute their robbery by conducting surveillance on the store. They intentionally selected the date and time to conduct the robbery because of customer traffic patterns. They have some means of converting or disposing of the stolen items for cash. Considering the precision of the crime, this is likely not their first robbery of this type. The possession of handguns also indicates they are likely professional criminals.

Theory #2

As with Theory #1, this is a well-planned robbery executed by three or four experienced criminals; however, the store was selected because they had an inside person, employee, or former employee working with them, and were provided with information to assist in the plan.

Theory #3

As with Theory #1, this is a well-planned robbery executed by three or four experienced criminals; however, the store owner/manager is a conspirator in the robbery, and assisted with the offence to collect insurance with the possible additional intent to be the person who resells the stolen merchandise. If this is the case, the owner/manager may be providing an inflated inventory of items taken or perhaps incorrect serial numbers for the items taken to allow for the stolen items to be more easily disposable.

Topic 4: Answers — Investigative Plans From Theory Development

Do the theories above present any avenues where you can investigate further to gain additional information?

Theory #1

• Since it is likely not their first robbery of this kind, we should search police records for other robberies using this similar modus operandi (MO) in the recent past and in our area and its surrounding areas. We would be looking for similarities in:
  1. Target selection
  2. Number of suspects
  3. Disguises used
  4. Weapons of choice
  5. Methodology (i.e. guard at door, making patrons lie down on the floor, bags to carry away goods)
• Considering the likelihood that these suspects conducted surveillance of this store to select it as a target, we should look at security cameras in the strip mall area and from the victim’s store for images of possible suspects watching the store on the previous Saturday at this same time.
• Since a few of the items stolen had serial numbers, these numbers can be entered into CPIC as identifiers to stolen property.
• Since the handguns used were likely stolen, we should look for incidents of stolen handguns recently reported.

 Theory #2

• Considering the possibility that an inside person, employee, or former employee is involved and provided the robbers with information, we should look closely into the criminal record and police record of the employees present at the time of the crime, as well as any other employees or former employees who can be identified. We are looking for:
  1. Evidence of criminal conduct by any employee or former employee
  2. Information of any associations between the employees or former employees to criminals, particularly those with records for robbery
  3. Information from the owner/manager about suspicious conduct on the part of an employee, a past employee, or a disgruntled past employee
  4. Since customers inside the store at the time of the robbery may have also been in collusion with the robbers, all three customers should be examined for criminal histories or associations to known criminals.

Theory #3

• If the owner/manager is involved in the robbery for the proposes of insurance fraud and/or inventory resale, we should examine several areas for evidence and information:
  1. Any past record of criminal conduct by the owner/manager, particularly insurance fraud
  2. A record of association to known criminals
  3. A record of insurance policy status on inventory, particularly recent increases
  4. Cross-check and verification of product inventories against items alleged to be stolen
  5. Verification of accuracy of serial numbers on items stolen against supplier inventory records.

Topic 5: Validation of the Report

Based on the theories considered in our robbery investigation, everyone present in the jewellery store at the time of the robbery is being considered a possible suspect. This is a part of analysis and theory development called validating the report. In criminal investigations, it occurs time and again that people reporting criminal events will lie, fabricate, or embellish, the facts. These failures to provide an accurate account of what happened occur for a variety of reasons, including, but not limited to:

• Personal gain or financial reward, such as insurance fraud
• Attempting to take revenge on someone by accusing them of a crime
• Covering up personal involvement in the criminal act to avoid prosecution
• Attempting to shift responsibility for a crime to someone else
• Covering up the involvement of an associate to divert prosecution

With these kinds of motives in mind, an investigator analyzing and validating the facts and developing a theory of the crime should always consider four key questions to authenticate the crime report:

1. Does the evidence support the report that an offence occurred?
2. If an offence did occur, did it happen at the time being reported?
3. If an offence did occur, did it happen at the place being reported?
4. If an offence did occur, did it happen the way the fact pattern being reported suggests (Arcaro, 2009)?

Thinking about these questions as part of the Analysis can help the investigator to formulate possible theories and develop effective investigative plans.

At this point in the investigative process, as theories are developed and tested, additional new facts are discovered. With the discovery of new facts, the Analysis and Investigation steps of the STAIR tool become, as noted earlier, a bit of a circular process, where a new fact can confirm, disprove, or modify a theory, and a new investigative plan may evolve in a new direction seeking the formation of reasonable grounds to believe a particular suspect is responsible for the offence.

Topic 6: Evidence Transfer Theory

In our robbery scenario, the reported fact pattern appears to be fairly clear. The investigative strategies being planned are aimed at suspect identification as a first goal. But, once a suspect or suspects have been identified, because of some circumstantial association or linkage to the crime scene, it does not mean they can immediately be arrested. Often, these kinds of linkages are sufficient to only provide grounds for suspicion and are not enough to form reasonable grounds for belief to make an arrest.

The ability to link a suspect back to a crime and to form reasonable grounds for belief to make an arrest can depend on the existing evidence transfer. Evidence transfer means that evidence will transfer from a suspect to the crime scene, a suspect to a victim, from the crime scene to the victim, or from the crime scene to the suspect. Modern forensic science has evolved into forensic specialties that look for evidence transfer. For example, with the advances being made in DNA science, evidence transfer is becoming more refined allowing the analysis of ever smaller samples for comparison (Savino, 2011).

Remarkably, it is not just DNA or fingerprints that can contribute to connecting a suspect to a criminal event. Hair and fibre, shoe prints, tool marks, bite marks, ballistics, and other forensic exhibits do contribute to the range of comparison tools. We will discuss these more in-depth later in our chapter on forensic evidence; however, the point is that forensic comparisons are only one form of evidence that is developed to create circumstantial connections between a suspect, the crime, and/or the victim.

Topic 7: Spatial Relationships and Timelines

Other circumstantial evidence can be illustrated that connect suspects to the crime through relationships, associations, and chronology. This type of circumstantial evidence can include exhibits and witness statements that demonstrate spatial relationships. Spatial relationships are circumstantial links that demonstrate connections between objects, events, or people. This can be any type of evidence that demonstrates a connection or relationship between the suspect and the criminal event or the suspect and the victim. It could also be evidence that demonstrates where a suspect was during the critical times when the crime was occurring.

Recall the example of the young man standing behind a tree one block away from the scene of the warehouse break in. This was an example of both timeline evidence, namely being present at the scene when the event took place, and spatial relationship evidence, namely being one block away from the crime scene. This kind of evidence can be considered by the investigator in forming reasonable suspicion and reasonable grounds to believe and take action at a later point in time.

Topic 8: Timeline Evidence

Timeline evidence is any item that demonstrates a time alignment of the suspect to the criminal event or the victim. Spatial relationship evidence comes from items that demonstrate other types of connections, relationships, or associations. Consider for example, the following scenario.

Timeline evidence would include:

• 12 Noon: time the body was found by the janitor
• 10 AM: time the victim’s flight arrived
• 10 AM: time the suspect’s flight arrived
• 10:45 AM: time the suspect was recorded on security camera near the crime scene

This timeline evidence provides some significant information, as it establishes a time range when the crime occurred and it establishes that the suspect was at the airport during the possible time of the crime.

Topic 9: Spatial Relationship Evidence

• Victim and suspect’s boarding passes show that they were both on Fight AC201 and were seated next to each other
• Security video puts the suspect in the area of the crime scene during the timeframe when the crime occurred
• The suspect is an airport employee and was in possession of a key that would open the door of the crime scene

It is important to note here that the items of evid, in this case, ase are not forensic exhibits such as fingerprints or DNA that might draw a definite link between the suspect and the crime. They are instead linkages in times and common locations within those times. These connections within time and locations are spatial relationships, and although this circumstantial evidence from spatial relationships alone is not sufficient to prove guilt beyond a reasonable doubt, it is often sufficient to form reasonable grounds to believe that an individual is implicated in the offence. In this case, the suspect would be detained and cautioned. Additional forensic evidence collection and interrogation would follow to develop reasonable grounds for belief and possibly the grounds to lay a charge, if additional forensic evidence could be developed.

Summary

In this chapter, we have worked through some scenarios demonstrating the application of the STAIR tool in both tactical and strategic investigative processes. In working through the strategic process, we have practiced examining the fact patterns of events and making the assumptions to drive theory development directing the engagement of our investigative plans. This is truly the creative art of the investigative process and, as such, it is a process that can be enhanced through practice and experience. This can also be a great opportunity for collaboration and teamwork where brainstorming sessions take place to analyze the facts, develop theories, and develop investigative plans. Along with theory development and investigative plan making, we have examined the ways physical and circumstantial evidence of spatial relationships can be used to confirm, negate, and modify theories and investigative plans.