Introduction to Criminal Investigation: Processes, Practices and Thinking

Introduction to Criminal Investigation: Processes, Practices and Thinking

Rod Gehl and Darryl Plecas

Justice Institute of British Columbia

New Westminster, BC




The authors wish to thank Dr. Gary Bass (LLD Honorary and Senior Research Fellow, Simon Fraser University and Retired RCMP Deputy Commissioner West), Inspector Steven McCartney (Program Director, BC Police Academy), Dr. Tim Croisdale (Associate Professor, California State University), Dr. Yvon Dandurand (School of Criminology and Criminal Justice, UFV,  and Fellow, International Centre for Criminal Law Reform and Criminal Justice Policy), Steven Gehl (Sergeant, RCMP Forensic Identification Section, Retired) Robert Gehl (Inspector, Victoria Police Department, Retired), Stuart K. Wyatt, (BA, MA, Asc Forensic Identification Officer, Retired), for their very helpful reviews of earlier drafts of the manuscript. They are also very grateful to Dr. Irwin Cohen (Senior University Research Chair (RCMP) and Director of the Centre for Public Safety and Criminal Justice Research, University of the Fraser Valley) for work in editing the manuscript. Finally, the authors wish to thank Dr. Tannis Morgan (Associate Director, Office of Applied Research and Graduate Studies, JIBC) for her guidance and facilitation of JIBC assistance in publication, Krista Lambert (Instructional Designer, JIBC, CTLI) for her assistance in graphics and manuscript formatting for this book, and to Stephanie Hipkin (JIBC graduate) for her collaboration in copyediting the final draft.



I am honored to have been asked to write the foreword for this important book, written by an accomplished police officer in collaboration with a prominent Canadian criminologist.

Rod Gehl began his career with the Royal Canadian Mounted Police, and went on to have a highly successful career retiring as an Inspector with the Abbotsford Police Department, one of the most respected departments in Canada.   Since retirement Rod has continued to use his investigative expertise providing advice to government and teaching at the Justice Institute of British Columbia.

Now, coming together with Dr. Darryl Plecas, University of the Fraser Valley Professor Emeritus and former RCMP Research Chair, Rod has completed this book which speaks to the operational application of the criminal investigation, processes, practices, and thinking.

Having known Rod professionally for over 22 years, he has my respect and that of our colleagues for his capacity in mastering the investigative processes as well as for his policing leadership. The breadth of his expertise in Major Case Management uniquely qualifies him to have written this book. This introduction to criminal investigation fills a void in the literature and will benefit police officers starting their careers in virtually all aspects of what is important to learn to be effective in policing, It not only speaks to the investigative processes but also the day to day work that policing involves.

More importantly, the underlying theories, processes, practices and thinking skills remain relevant throughout the career of a police officer and therefore this book will be of value to both new recruits and seasoned police officers.

The underlying themes of integrity, diligence, investigative thinking, tenacity, respect, and striving to do the best that one can do at all times, are just as important at the end of a policing career as they are at the beginning. I therefore see this book as having an enduring value to police officers at all levels and stages of their careers, and I am pleased to fully endorse it as such.


Gary D. Bass (Rtd.)
Deputy Commissioner Canada West
Royal Canadian Mount Police


Chapter 1: Introduction

Chapter 1: Introduction
“A good investigator needs to be conscious of his or her-own thinking, and that thinking needs to be an intentional process.”

It is too bad we can not just provide you with a basic template to follow every time you needed to conduct a criminal investigation; but it is not that simple. Criminal investigations can be imprecise undertakings, often performed in reaction to unpredictable and still-evolving events with incomplete information to guide the process. As such, it is impossible to teach or learn a precise methodology that can be applied in every case. Still, there are important concepts, legal rules, and processes that must be respected in every investigation. This book outlines these concepts, rules, and processes with the goal of providing practical tools to ensure successful investigative processes and investigative practices. Most importantly, this book informs you on how to approach the investigative process using “investigative thinking”. In this first chapter, we set the foundation for the book by calling attention to five important topics:

  1. Criminal investigation as a thinking process
  2. The need to think through the process
  3. Towards modern-day investigation
  4. The path to becoming an investigator
  5. Understanding the investigative mind

Topic 1: Criminal Investigation as a Thinking Process

Criminal investigation is a multi-faceted, problem-solving challenge. Arriving at the scene of a crime, an officer is often required to rapidly make critical decisions, sometimes involving life and death, based on limited information in a dynamic environment of active and still evolving events. After a criminal event is over, the investigator is expected to preserve the crime scene, collect the evidence, and devise an investigative plan that will lead to the forming of reasonable grounds to identify and arrest the person or persons responsible for the crime. To meet these challenges, police investigators, through training and experience, learn investigative processes to develop investigative plans and prioritize responses.

In this book, these investigative responses, information analyses, and plan-making skills are broken out using illustrations of both tactical and strategic investigative thinking. The aim of the book is to guide you into the structured practices of tactical investigative response and strategic investigative thinking.

Criminal investigation is not just a set of task skills, it is equally a set of thinking skills. To become an effective investigator, these skills need to be consciously understood and developed to the point where they are deliberately engaged to work through the problem-solving process that is criminal investigation. Trained thinking and response can be difficult to adapt into our personal repertoires because we are all conditioned to be much less formal and less evidence driven in our everyday thinking. Still, as human beings, we are all born investigators of sorts. As Taber (2006) pointed out in his book, Beyond Constructivism, people constantly construct knowledge, and, in our daily lives, we function in a perpetual state of assessing the information that is presented to us. Interpreting the perceptions of what we see and what we hear allows us reach conclusions about the world around us (Taber, 2006). Some people are critically analytical and want to see evidence to confirm their beliefs, while others are prepared to accept information at face value until they are presented facts that disprove their previously held beliefs. Either strategy is generally acceptable for ordinary people in their everyday lives.

Topic 2: The Need to Think Through the Process

Diametrically opposing the analysis processes of everyday people, in the role of a police investigator, the process of discovering, interpreting, and determining the validity of information is different and this difference is critical. As an investigator, it is no longer sufficient to use the strategies that ordinary people use every day. Instead, it is incumbent on investigators to critically assess all the information they encounter because every investigation is an accountable process in which the investigator is not just making a determination about the validity and truth of the information for personal confirmation of a belief. Rather, the police investigator is responsible and empowered under the law to make determinations that could significantly affect the lives of those being investigated as well as the victims of crime.

The investigator’s interpretation of information and evidence commonly requires answers to many questions that can lead critical of decisions, actions, and outcomes, such as:

Significant to these possible outcomes, the investigator must always be ready to explain their thinking and actions to the court. For example, when an investigator is asked by a court, “How did you reach that conclusion to take your chosen course of action?”, an investigator must be able to articulate their thinking process and lay out the facts and evidence that were considered to reach their conclusions and form the reasonable grounds for their actions and their investigative decision-making process. For an investigator speaking to the court, this process needs to be clear and validated through the articulation of evidence-based thinking and legally justifiable action. Thinking must illustrate an evidence-based path to forming reasonable grounds for belief and subsequent action. Thinking must also demonstrate consideration of the statutory law and case law relevant to the matter being investigated.

Considering this accountability to outcomes, it is essential for police investigators to have both the task skills and the thinking skills to collect and analyze evidence at a level that will be acceptable to the criminal justice system. Investigation is the collection and analysis of evidence. To be acceptable to the court, it must be done in a structured way that abides by the legal rules and the appropriate processes of evidence collection. Additionally, it must be a process the investigator has documented and can recall and articulate in detail to demonstrate the validity of the investigation.

Obviously, it is not possible for someone to remain in a constant state of vigilance where they are always critically assessing, documenting, and determining the validity of every piece of information they encounter. However, when on duty, it is frequently necessary for a police investigator to do this. For a police investigator, this needs to be a conscious process of being mentally engaged and “switched on” to a more vigilant level of information collection, assessment, and validation while on duty. A police investigator must master this higher and more accountable level of analytical thinking for both tactical and strategic investigative response. The “switched on” police investigator must:

Most traditional police training provides new officers with many hours of instruction in the task skills of investigation. However, the learning of investigative thinking skills is expected to develop through field experience, learning from mistakes, and on the job mentoring. This learning does not always happen effectively, and the public expectations of the justice system are evolving in a model where there is little tolerance for a mistake-based learning.

The criminal investigation of serious crimes has always drawn a substantial level of interest, concern, and even apprehensive fascination from the public, the media, and the justice system. Police actions and investigations have been chronicled and dissected by commissions of inquiry and the media.  From the crimes of the serial killers like Paul Bernardo (Campbell, 1996), and Robert Pickton (Oppal, 2013) to the historical wrongful convictions of David Milgaard (MacCallum, 2008) and Guy Paul Morin (Kaufman, 1998), true life crimes are scrutinized and the investigations of those crimes are examined and critically assessed.

When critiquing past investigations, the same types of questions are frequently asked:

Today, transparency throughout the criminal justice system and public disclosure of evidence through investigative media reports make it much easier for the public and the media to examine the investigative process. Public and media access to information about police investigative techniques and forensic tools has created an audience that is more familiar and sophisticated about police work. The ability of both social and traditional media to allow public debate has created a societal awareness where a higher standard for the investigation of serious crimes is now an expectation.

One only needs to look at the historical and contemporary judicial reviews and public inquiries to appreciate that there is an expectation for police investigators and police organizations to maintain and demonstrate a high level of competency. In a judicial review, it is often too late if an investigator discovers that they have pursued the wrong theory or they have failed to analyze a piece of critical information or evidence. These situations can be career-altering or even career-ending. A good investigator needs to be conscious of his or her-own thinking, and that thinking needs to be an intentional process.

Topic 3: Towards Modern-Day Investigation

Today, criminal investigation is a broad term encompassing a wide range of specialities that aim to determine how events occurred, and to establish an evidence-based fact pattern to prove the guilt or innocence of an accused person in a criminal event. In some cases, where a person is found committing the criminal act and apprehended at the scene, the criminal investigation is not a complex undertaking. However, in cases where the criminal event is discovered after the fact, or when the culprit is not readily apparent, the process of criminal investigation becomes more complex and protracted.

Although in both cases the criminal investigator must follow practices of identifying, collecting, recording, and preserving evidence; in the case of the unknown suspect, additional thinking skills of analysis, theory development, and validation of facts must be put to work.

The craft of criminal investigation has been evolving since the birth of modern policing in the mid-1700s when the Chief Magistrate of Bow Street, Henry Fielding, organized a group of volunteer plainclothes citizens and tasked them to attend the scenes of criminal events and investigate crimes. This group became known as the Bow Street Runners. Their existence speaks to an early recognition that attending a crime scene to gather information was a timely and effective strategy to discover the truth of what happened (Hitchcock, 2015).

From these early investigators, one of the first significant cases using forensic evidence-based investigation was recorded. To summarize the account by McCrery (2013) in his book Silent Witness; in one notable recorded case in 1784, the Bow Street Runners removed a torn piece of paper wadding from a bullet wound in the head of a murder victim who had been shot at point-blank range. In this early era of firearms, flintlock muskets and pistols required muzzle loading. To muzzle load a weapon, gunpowder would be poured down the barrel of the weapon, and then a piece of “wadding paper” would be tamped into place on top of the gunpowder using a long metal rod. The wadding paper used in this loading process was merely a piece of thick dry paper, usually torn from a larger sheet of paper kept by the shooter to reload again for the next shot. The musket ball bullet would be pushed down the barrel on top of the wadding paper. When the gun was fired, the wadding paper would be expelled by the exploding gunpowder, thus pushing the lead ball-bullet out of the barrel as a deadly projectile. This loading process required the shooter to be in possession of dry gunpowder, wadding paper, and musket balls to reload and make the weapon ready to fire. The Bow Street Runners considered this weapon loading practice and knew their shooter might be in possession of wadding paper. Upon searching their prime suspect, they did find him in possession of that kind of paper and, in a clever forensic innovation for their time, they physically matched the torn edges of wadding paper found in the victim’s wound to a larger sheet of wadding paper found in the pocket of their suspect. From this evidence, the accused was convicted of murder (McCrery, 2013).

This use of forensic physical matching is an example of circumstantial forensic evidence being used to link a suspect to an offence. This type of early forensic evidence also illustrates the beginnings of what exists today as a broad variety of forensic sciences to aid investigators in the development of evidence. This is also the beginning of forensic evidence being recognized as an investigative tool. In 1892, not long after the Bow Street Runners investigation, Sir Francis Galton published his book on the study of fingerprints. In 1900, Galton’s work was used by Sir William Henry who developed and implemented the Henry System of fingerprint classification, which is the basis of the fingerprint classifications system still in use today (Henry, 1900).

Only a few years earlier, in 1886, the use of photography for the first Rogues Gallery of criminal photographs was implemented by the New York City Police Department. This first Rogues Gallery was an organized collection of photographs of known criminals taken at the time of their most recent conviction for a crime (Byrnes, 2015). Prior to this organized collection of criminal photos, facial characteristics on wanted posters had been limited to sketch artists’ renderings. With the advances evolving in photography, having the ability to preserve an actual picture of the suspect’s face amounted to a significant leap forward. With this innovation of photography, the use of mugshots and photographic identification of suspects through facial recognition began to evolve.

These early forensic innovations in the evolution of criminal investigation (such as physical matching, fingerprint identification, and facial recognition systems) demonstrate a need for investigators to develop the knowledge and skills to locate and utilize physical evidence that enables circumstantial links between people, places, and events to prove the facts of criminal cases. Physical evidence is the buried treasure for criminal investigators. Physical evidence can be collected, preserved, analyzed, and used in court to establish a fact. Physical evidence can be used to connect an accused to their victim or used at a crime scene to establish guilt or innocence. Forensic evidence may prove a point in fact that confirms or contradicts the alibi of an accused, or one that corroborates or contradicts the testimony of a witness.

Another significant development in forensic evidence from the 1800s started with the work of French criminal investigator Alphonse Bertillon who developed the Bertillon system of recording measurements of physical evidence (Petherick, 2010). One of Bertillon’s students, Dr. Edmond Locard, a medical doctor during the First World War, went on to further Bertillon’s work with his own theory that a person always leaves some trace of themselves at a crime scene and always takes some trace of the crime scene with them when they leave. This theory became known as “Locard’s Exchange Theory” (Petherick, 2010). To this day, Locard’s theory forms the foundational concepts of evidence transfer theory.

Today, the ability of forensic experts to identify suspects and to examine physical evidence has increased exponentially when compared to early policing. Scientific discoveries in a wide range of disciplines have contributed to the development and evolution of forensic specialities in physical matching, chemical analysis, fingerprints, barefoot morphology, odontology, toxicology, ballistics, hair and fibre, biometric analysis, entomology, and, most recently, DNA analysis.

Many of these forensic science specialties require years of training and practice by the practitioner to develop the necessary level of expertise whereby the courts will accept the evidence of comparisons and subsequent expert conclusions. Obviously, it is not possible for a modern-day investigator to become a proficient practitioner in all of these specialties. However, the modern-day investigator must strive to be a forensic resource generalist with an understanding of the tools available and must be specialist in the deployment of those tools to build the forensic case.

In a criminal investigation, there is often a multitude competing possibilities guiding the theory development of how a criminal incident occurred with circumstantial links pointing to who committed the crime. Competing theories and possibilities need to be examined and evaluated against the existing facts and physical evidence. Ultimately, only strong circumstantial evidence in the form of physical exhibits, testimony from credible witnesses, or a confession from the accused may satisfy the court beyond a reasonable doubt. Critically, the quality of an investigation and the competency of the investigators will be demonstrated through the manner in which that evidence was located, preserved, analyzed, interpreted, and presented.

In the past, police officers generally took their primary roles as first responders and keepers of the peace. Criminal investigation was only a limited component of those duties. Now, given the accessibility to a wide range of effective forensic tools, any police officer, regardless of their assignment, could find themselves presented with a scenario that requires some degree of investigative skill. The expectation of police investigators is that they be well-trained with the knowledge and skills to respond and investigate crime. These skills will include:

In addition to these task skills of process and practice, investigators must also have strategic analytical thinking skills for risk assessment and effective incident response. They must have the ability to apply deductive, inductive, and quantitative reasoning to examine evidence and form reasonable grounds to identify and arrest suspects.

Engaging these higher-level thinking skills is the measure of expertise and professionalism for investigators. As our current justice system continues to change and evolve, it relies more and more on information technology and forensic science. With this evolution, the need for investigators to demonstrate higher levels of expertise will continue to grow.

Topic 4: The Path to Becoming an Investigator

For many people, their idea of what an investigator does is based on what they see, hear, and read in the media, movies, TV, and books. These depictions characterize personas ranging from dysfunctional violent rebels fighting for justice by their own rules, to by-the-book forensic investigators who get the job done clinically using advanced science and technology. The truth is, good investigation and real-life investigators are unlikely to make a captivating fictional script. Professional investigators and competent investigation is about the tedious processes of fact-finding and sorting through evidence and information. It is about eliminating possibilities, validating events, and recording evidence, all the while engaging in an intentional process of thinking, analyzing, and strategically working towards predetermined goals; not to mention extensive note taking and report writing.

Sometimes, new police investigators are, at first, deluded by fictional representations, only to find out, by experience, that the real job, although having moments of action, satisfaction, and excitement, is more about hard work and deliberate attention to detail.

Another common misnomer about the job is the conception that investigation is the exclusive domain of a police officer. Although this may have been true in the earlier evolution of the investigative craft, it has become much less the case today. This change is a result of the enactment of many regulatory compliance statutes that require investigative knowledge, skills, and thinking. Compliance investigators maintain adherence to regulated activities which often involve legal compliance for industries where non-compliance can pose significant risks that threaten the lives and safety of people or the environment. These regulated activities are often responsibilities of the highest order. What starts as a regulatory violation can escalate into criminal conduct. The investigative skills of compliance investigators and inspectors must be capable of meeting the same tests of competency as the police.

Not just anyone can become an investigator. There are certain personal traits that tend to be found in good investigators. Among these traits are:

Considering this list of traits, we can appreciate that good investigators are people with particular attitudes, aptitudes, and intentional thinking processes. These traits all form part of the investigative mindset. Although you cannot teach someone to be passionate about discovering the truth, anyone who has these traits can work towards developing and refining their other traits and skills to become an investigator. Developing the mindset is a learning journey, and the first step of this journey is to become intentionally aware of and engaged in your own thinking processes.

Toward this point, the investigator must always be mindful of the proposition of Shah and Oppenheimer (2008) in their book Heuristics Made Easy – An Effort Reduction Framework. Shah and Opprenheimer remind us that people have learned to become quick thinkers using mental short cuts, known as heuristics, in an effort to make decisions quickly and problem solve the challenges we encounter. They offer the proposition that heuristics reduce work in decision-making by giving the user the ability to scrutinize a few signals and/or alternative choices in decision-making, thus diminishing the work of retrieving and storing information in memory. This streamlines the decision-making process by reducing the amount of integrated information necessary in making the choice or passing judgment (Shah, 2008).

In this book, we will point out that these heuristic shortcuts are often instinctive or intuitive reactions, as opposed to well-reasoned, evidence-based responses. Although they may serve us well in our everyday thinking, they must be monitored and recognized for their short-falls when we are required to investigate matters where the outcomes are critical.

To achieve the investigative mindset and be an objective investigator, it is important to be aware of the heuristic shortcuts and other negative investigative tendencies that can become obstacles to successful outcomes. For example, a good investigator needs to be focussed on the objective of solving the case and making an arrest in a timely manner, but becoming too focussed can lead to “tunnel vision”, which is the single-minded focus on a favorite suspect or theory to the extent that other suspects or alternate theories are ignored. Moreover, a good investigator needs to take responsibility and be accountable for the outcomes of the investigation; however, taken to the extreme, this can lead to an investigator taking complete ownership of the investigation to the exclusion of allowing the ideas of others to provide guidance and influence. Finally, a good investigator needs to be careful about how much information is shared with others. However, excessive secrecy can inhibit information sharing with those who might contribute to the successful conclusion of the case.

Thinking as an objective investigator, it is often necessary to consider and evaluate several competing theories or possibilities of how a crime was committed and who the suspect may be. Often, new investigators, or those uninitiated to the objective mindset, will focus on a favorite theory of events or a favorite suspect, and rush to be first to reach the conclusion and to make the arrest. There is a trap in shortcuts and the focused rush to make a fast arrest. In this trap, other viable suspects and theories are too quickly ignored or discarded. This sometimes leads to investigations being derailed by “tunnel vision”. Worse yet, tunnel vision can lead to the misinterpretation of evidence, ultimately leading to charges against an innocent person, while the guilty remain undiscovered.

To summarize the observations made by Kim Rossmo (2009) in his book on criminal investigative failures, tunnel vision and lost objectivity have been part of the findings in many public inquiries. Commissioners at public inquiries have concluded that, at times, investigators relentlessly pursue a favourite suspect. Sometimes an alternate suspect should have been apparent, or exculpatory evidence was present that should have caused the investigators to stop and re-evaluate their favorite suspect, but tunnel vision had set in and the objective investigative mindset had been lost (Rossmo, 2009).

Similarly and not totally unrelated to tunnel vision, other negative thinking responses also come into play, and can be observed in the behaviors of case ownership and excessive secrecy. It may seem that an investigator taking ownership for his or her investigation, and maintaining some degree of secrecy in the management of case related information, is completely acceptable and perhaps even desirable. However, as happens with any human behavior, it can negatively influence the outcome of investigations. Information appropriately shared with the right people can often reveal connections that contribute to the evidence of a case, and investigators must remain open to this appropriate sharing. Many negative examples can be found where a police investigator, or even an investigative team, adopted the attitude that the conduct of an investigation is their own exclusive domain (Campbell, 1996). With that exclusive ownership, no one else is entitled or allowed to participate, and relevant information that needs to be shared with others can be jealously guarded. Opportunities are missed for other investigators to see details that could connect a similar fact pattern or make the connection to a viable suspect.

Topic 5: Understanding the Investigative Mindset

When we talk about the investigative mindset, in part, we are talking about the self-awareness and the organizational-awareness to avoid negative outcomes. Once learned and practiced, this awareness can be a safety net against destructive investigative practices (i.e. tunnel vision, case ownership, and excessive secrecy). Criminal investigation can require complex thinking where the investigator must assess and determine the validity of information and evidence to guide the investigative process. This thinking strives to move from a position of mere suspicion to one of reasonable grounds for belief to make an arrest and ultimately articulate evidence upon which the court can make a finding of guilt beyond a reasonable doubt. This is a conscious process of gathering and recording information, and thinking analytically to form reasonable grounds for belief supporting defendable actions of arrest and charges. From this conscious process, the investigator in court can articulate a mental map to describe how they derived their conclusions.

As we proceed towards learning the investigative thinking process, keep in mind that:


In this chapter, we have identified the investigative thinking processes as being distinctly different from the thinking processes used by most people in their everyday lives. The critical responsibilities that exist for police investigators in conducting their duties demand that investigators learn to think and respond in a structured and accountable manner. To this end, we have illustrated some of the common negative thinking processes that investigators must avoid, and we have looked at the traits and values that need to be pursued to become a criminal investigator. We have described structured and accountable thinking as the means to achieve an investigative mindset. You will find that investigative thinking and the investigative mindset are a theme throughout this book.

Study Questions

  1. Provide two reasons why it is very important for a police investigator to routinely critically assess all of the information they encounter.
  2. Provide two reasons why evidence gathered as part of an investigation must be collected in a structured way.
  3. What do we mean when we say that an investigator must be “switched on”?
  4. In a single sentence, summarize “Locard’s Exchange Theory”(Petherick, 2010).
  5. List seven characteristics commonly found in good investigators.
  6. What are the skills a modern-day officer must achieve to respond to events and investigate crimes?
  7. What is the first step in developing an investigative mindset?
  8. What is the level of forensic knowledge that a modern-day investigator must achieve to become an effective investigator?
  9. Why must police investigators be mindful of the heuristic shortcuts discussed by Shaw and Oppenheimer (2008)?
  10. In addition to heuristic shortcuts, what are the other three negative investigative tendencies that can become obstacles to successful investigative outcomes?
  11. Why must investigators be mindful of excessive secrecy?



Chapter 2: Some Important Basic Concepts

Chapter 2: Some Important Basic Concepts
“There are many legal rules, concepts, principles, doctrines, and protocols investigators must be attentive to as they work through an investigation, and each must be incorporated into their thinking process.”

It would be impossible to properly appreciate the investigative process without first establishing an understanding of the real-life forum in which it occurs. That forum is the criminal justice system and in particular, the court system. The investigative process also exists within the statutory rules of law, including the Canadian Charter of Rights and Freedoms, and case law rulings adjudicated by the courts. Considering the existence of these conditions, obligations, and case law rules, there are many terms and concepts that an investigator needs to understand to function appropriately and effectively within the criminal justice system. The purpose of this chapter is to introduce some of the basic legal parameters and concepts of criminal justice within which the criminal investigation process takes place. These include:

  1. Fundamental justice and the Charter of Rights and Freedoms
    2. Roles of the judges, the prosecutors, the defence, and the police in the justice system
    3. The burden of proof
    4. Belief beyond a reasonable doubt
    5. Reasonable grounds for belief
    6. Proof within a balance of probabilities
    7. The adversarial system
    8. Statutory law
    9. Common law (Case law)
    10. Actus Reus and Mens Rea
    11. Prima facie case, elements of the offence, and the information
    12. Duty to investigate and use of discretion
    13. Arrest and detention of a suspect

Topic 1: Fundamental Justice and the Charter of Rights and Freedoms

Criminal justice systems exist to protect society using a broad range of laws and regulations designed to define, control, and prohibit unacceptable behaviour and conduct. The behaviour and conduct to be prohibited or controlled can range from criminal acts of terrorism and murder, to infractions of a minor nature, such as exceeding the speed limit or watering one’s lawn outside of permitted time periods. These laws and regulations can result in a variety of sentences, restrictions, and interventions to personal freedom or penalties against offenders. In Canada, penalties can range from life imprisonment with no parole eligibility for 25 years, to fines, probation, or a warning. As a core principle in the application of any of these laws, there are strong social values that reflect the expectations of citizens who live under the protection of the laws. Citizens expect and demand that the law be enforced and administered fairly and in a manner that respects their rights and freedoms as individuals. This expectation most particularly pertains to any person suspected of or charged with an offence.

These values and expectations of fairness have origins dating back to ancient Rome and of English common law, which eventually defined the principles of “natural justice”, now more commonly referred to in Canada as “fundamental justice” (Dostal, 2012h).

At the core of these principles of “natural justice” or “fundamental justice”, some basic operational imperatives have been established to guide the outcomes of the justice system and ensure fundamental justice for persons charged for an offence. For example, one who alleges an offence to have taken place must prove it, the person accused of an offence has the right to see the evidence against them, the person accused has the right to answer to the charge and provide a defense, the trier of fact (i.e. most commonly a judge) must not be biased, and the trier of fact must base their decision upon evidence and must articulate the evidence considered when the decision is handed down. Further entrenching these principles of “fundamental justice”, the Canadian Charter of Rights and Freedoms Sections 7 -14 was enacted into law in 1982, replacing the existing Canadian Bill of Rights (Government of Canada, 2015).

Excerpt from Charter of Rights and Freedoms Sections 7-14, “Legal Rights”: 

7. Everyone has the right to life, liberty and security of the person and the right not to be deprived thereof except in accordance with the principles of fundamental justice.

8. Everyone has the right to be secure against unreasonable search or seizure.

9. Everyone has the right not to be arbitrarily detained or imprisoned.

10. Everyone has the right on arrest or detention

(a) to be informed promptly of the reasons therefor;

(b) to retain and instruct counsel without delay and to be informed of that right; and

(c) to have the validity of the detention determined by way of habeas corpusand to be released if the detention is not lawful.

11. Any person charged with an offence has the right

(a) to be informed without unreasonable delay of the specific offence;

(b) to be tried within a reasonable time;

(c) not to be compelled to be a witness in proceedings against that person in respect of the offence;

(d) to be presumed innocent until proven guilty according to law in a fair and public hearing by an independent and impartial tribunal;

(e) not to be denied reasonable bail without just cause;

(f) except in the case of an offence under military law tried before a military tribunal, to the benefit of trial by jury where the maximum punishment for the offence is imprisonment for five years or a more severe punishment;

(g) not to be found guilty on account of any act or omission unless, at the time of the act or omission, it constituted an offence under Canadian or international law or was criminal according to the general principles of law recognized by the community of nations;

(h) if finally acquitted of the offence, not to be tried for it again and, if finally found guilty and punished for the offence, not to be tried or punished for it again; and

(i) if found guilty of the offence and if the punishment for the offence has been varied between the time of commission and the time of sentencing, to the benefit of the lesser punishment.

12. Everyone has the right not to be subjected to any cruel and unusual treatment or  punishment.

13. A witness who testifies in any proceedings has the right not to have any incriminating evidence so given used to incriminate that witness in any other proceedings, except in a prosecution for perjury or for the giving of contradictory evidence.

14. A party or witness in any proceeding who does not understand or speak the language in which the proceedings are conducted or who is deaf has the right to the assistance of an interpreter (Government of Canada, 2015).

As demonstrated by these eight explicit sections of the charter, any person accused of a crime has a significant level of protection from being presumed guilty or from being treated unfairly by the justice system because of an accusation.

In the criminal justice system, police investigators are very often the first point of contact and they hold a primary obligation to respect the rights and freedoms afforded by the Canadian Charter of Rights and Freedoms. The steps that must be taken by an investigator to ensure that the rights and freedoms are protected and the principles of fundamental justice are followed will be outlined in detail later in this book.

Topic 2: The Role of the Judge, the Prosecutor, the Defence, and the Police

As operational players within the criminal justice system, judges, crown prosecutors, defense lawyers, and police all contribute to the process of “natural justice” or “fundamental justice”. Each of these participants has specific and independent roles to play and duties to perform. For example, the role of the police investigator is to gather information, physical evidence, and witness evidence to form the reasonable ground that a particular suspect committed an offence. Once these reasonable grounds for belief have been formed, the evidence can be presented to the Crown Prosecutor to determine if a charge should be laid. The role of the crown prosecutor is to examine the evidence gathered by police investigators. If charges are laid, the crown prosecutor presents that evidence to a judge who will determine the guilt or innocence of the accused based upon the test of proof beyond a reasonable doubt. The role of the defence counsel is to represent the accused through examination of the evidence presented, testing the strength of the evidence presented, and challenging the reasonable grounds for belief. The defence’s goal is to demonstrate that the test of proof beyond a reasonable doubt has not been met.

Many are the occasions where police have identified and arrested the correct suspect, but the evidence collected in their investigation was rejected by the court because procedural rules were not properly applied. These kinds of cases, lost to errors in process or in misunderstanding of the rules, provide valuable lessons for the police investigator who failed; but sadly, they are a disappointing and a negative experience for the victim of the crime and the public who expect investigators to always get it right.

Topic 3: The Burden of Proof

For a police investigator, it is important to understand that matters under investigation can end up being presented in a criminal or civil court of law. Each of these court venues requires and applies a different burden of proof to the evidence presented. It is entirely possible that a police investigator will be called to present evidence of their investigation in either type of court. For instance, it is possible in cases, such as a motor vehicle crash, that the evidence collected by the police for a criminal court charge of Impaired Driving or Dangerous Driving could be used in a civil court trial where an injured victim sues the impaired driver for damages resulting from their injuries or the loss of their vehicle.

The criminal court is the one most commonly encountered by police investigators. These courts hear cases investigated under the Criminal Code and under Federal, Provincial, and Municipal Statues. Cases can cover offences ranging from personal and property offences to those covered under Municipal Statutes. For criminal courts, judges or judges and juries use the burden of proof described as “proof beyond a reasonable doubt” to determine if they will convict or acquit an accused person. Civil courts take responsibility for making decisions in relation to matters where one party is seeking a non-criminal judgement, damages, or a decision against another party. These can be cases related to personal injury cases, contractual disputes, divorce proceedings, and contested wills or estates. In these cases, the parties involved are referred to as the plaintiff and the defendant. The plaintiff is the party that initiates the civil court action, and the defendant is the party against whom the civil action is filed. In these civil actions, the burden of proof considered by the court is described as “proof within a balance of probabilities”. This is a much lesser test than proof beyond a reasonable doubt as the court seeks to determine, on the balance of probabilities, which side is most likely correct.

Topic 4: Proof Beyond a Reasonable Doubt

Proof beyond a reasonable doubt is the standard measure of proof that the criminal court will apply when determining if evidence presented by the prosecution is sufficient to convict the person charged with an offence. If the evidence is sufficient, and the burden of proof has been satisfied, the court may convict the accused. In these cases, the onus to prove all the elements of the charge rests completely with the prosecution. The accused person is not required to prove that they are innocent.

The Supreme Court of Canada has outlined the concept of proof beyond a reasonable doubt suggesting that it should be explained to juries as follows:

The standard of proof beyond a reasonable doubt is inextricably intertwined with that principle fundamental to all criminal trials, the presumption of innocence (R v Lifchus, 1997).

  • The burden of proof rests on the prosecution throughout the trial and never shifts to the accused.
  • A reasonable doubt is not a doubt based upon sympathy or prejudice, and instead, is based on reason and common sense.
  • Reasonable doubt is logically connected to the evidence or absence of evidence.
  • Proof beyond a reasonable doubt does not involve proof to an absolute certainty. It is not proof beyond any doubt, nor is it an imaginary or frivolous doubt.
  • More is required than proof that the accused is probably guilty. A jury which concludes only that the accused is probably guilty must acquit.

The Supreme Court of Canada emphasized in R v Starr, that an effective way to explain the concept is to tell the jury that proof beyond a reasonable doubt “falls much closer to absolute certainty than to proof on a balance of probabilities.” It is not enough to believe that the accused is probably guilty, or likely guilty. Proof of probable guilt, or likely guilt, is not proof beyond a reasonable doubt (R v Starr, 2000).

It is important for investigators to understand that “proof beyond a reasonable doubt” is a different test from what they are required to meet when considering the value of evidence during their investigation. Later in this book, we will examine the importance of collecting, documenting, and properly preserving as much evidence as possible to assist the court reaching their belief beyond a reasonable doubt.

Topic 5: Reasonable Grounds to Believe

Reasonable grounds to believe, sometimes referred to as reasonable and probable grounds to believe, is the test a police investigator must apply when considering the evidence to exercise their powers during the investigation of an offence. Establishing reasonable grounds to believe that a person is responsible for an offence allows the investigator to exercise powers that are provided under the criminal code. These are the powers to arrest with or without a warrant, the power to search and seize evidence with or without a warrant, and the power to swear an information against a person once reasonable grounds to believe have been established.

Forming reasonable grounds for belief is a subjective thinking process. It is arguably the most important thinking processes an investigator will undertake. It is a thinking process based upon the consideration of information, evidence, and facts the investigator has collected during their investigation. These reasonable grounds for belief must be based upon the investigator’s assessment of the information and evidence available to them at the time the decision to act is made. Evidence of guilt discovered after an action (such as when an arrest or a search has taken place) cannot be used to retroactively justify that action of arrest or search. As such, when the court considers if the investigator was correct and justified in forming reasonable grounds to believe based upon the evidence available at the time of the action, the judge will think about the nature of the evidence the investigator has described in their testimony.

Justice Cory in R v Storrey (1990) provided a very common sense deliberation to be applied in determining if the investigator had reasonable grounds to believe:

The Criminal Code requires that an arresting officer must subjectively have reasonable and probable grounds on which to base the arrest. Those grounds must, in addition, be justifiable from an objective point of view. That is to say, a reasonable person placed in the position of the officer must be able to conclude that there were indeed reasonable and probable grounds for the arrest. On the other hand, the police need not demonstrate anything more than reasonable and probable grounds. Specifically they are not required to establish a prima facie case for conviction before making the arrest. (R v Storrey, 1990)

Reasonable grounds to believe is a very important concept for an investigator to understand, and it must not be confused with the more onerous test of “proof beyond a reasonable doubt” (R v Starr, 2000), which is the test the court will use in weighing the evidence to determine if a conviction for the offence is justified. Confusing these two levels of belief is an error sometimes made by investigators, and it can cause an investigator to hesitate because they do not believe they have reached the adequate level of belief to take action.

It is fortunate that this lesser level of belief, reasonable grounds, is available for police investigators because it requires that police articulate only a subjective belief in the information and evidence available to them at the time of their investigation. It allows police investigators to form reasonable grounds of belief based on physical evidence they have seen, records they have reviewed, and hearsay information acquired from witnesses. In situations where time is of the essence to protect life and safety, protect evidence, or to bring a situation under control, it does not require the investigator to undertake any validation of the information they are relying on. The information may be taken at face-value.

Establishing reasonable grounds to believe and taking the action of making an arrest or conducting a search will not necessarily be the precursor to collecting enough evidence to lay charges. In some cases, an arrest is made because reasonable grounds existed and, after additional information and evidence are accessed, it becomes clear that the person is not guilty of the offence. Consequently, the process of laying a charge does not take place and the person is released. Remaining open to the outcome of determining innocence is truly a test of objectivity for investigators. This objectivity can sometimes be difficult to achieve when there is serious pressure to capture a dangerous offender. The mistake of being too quick to proceed with charges, or even discounting and ignoring evidence that indicates innocence, is a trap that has led many investigators to the end their careers under accusations of lost objectivity or even incompetence (Pennington, 1999).

When charges are laid, objectivity can become a key issue at the trial and the defence may demand that the investigator provide an accurate account of evidence that was considered or ignored in the thinking process to establish their reasonable grounds to believe. Forming reasonable grounds is a process that should be undertaken with careful consideration of the facts. Forming reasonable grounds requires a diligent intent to remember the facts, keeping in mind that an articulation of the subjective analysis used in forming reasonable grounds for belief may be required as testimony in a court.

This degree of self-awareness is a critical step in building the thinking skills to become a good investigator.  With these thinking skills in mind, tools will be provided later in this book that can assist an investigator with the practice of thinking through investigations using a step-by-step process.

Topic 6: Proof Within a Balance of Probabilities

As mentioned above, the balance of probabilities is the civil court standard of proof that is less onerous than the criminal court standard of proof beyond a reasonable doubt. For something to be proven within a balance of probabilities means that it is more likely than not to have occurred. On a scale of equal balance, if the likelihood is more than 50% that something occurred, the test of being “within a balance of probabilities” has been met. In most cases, if the criminal test of proof beyond a reasonable doubt has been met, that same evidence presented at a civil trial is likely to meet the required threshold of being within a balance of probabilities (Allen, 1991). It is important for a criminal investigator to understand that, even though there may not be enough evidence to meet the requirement for a criminal charge or establish proof beyond a reasonable doubt, the evidence may still be successful in establishing civil liability within a balance of probabilities. The possibility of civil action makes it important for investigators to remain diligent in collecting and preserving evidence, even if they believe there will not be a criminal charge proceeding.

Topic 7: The Adversarial System

In the trial of a person charged with an offence in a criminal court proceeding, the judge will hear the evidence and arguments presented by both the prosecution and the defence. The prosecution and the defense exist in court in an adversarial relationship with the onus resting with the prosecution to prove the facts of the case beyond a reasonable doubt. The defence may challenge the evidence, question the testimony and the credibility of witnesses, and present alternate theories of events or evidence, where the accused person could be considered not responsible or sometimes less responsible for the alleged offence. The facts required to be proven will vary depending on the offence being alleged; however, the prosecutor’s task to achieve a conviction requires that every element of the charge is proved beyond a reasonable doubt.

As an investigator, you will often work in partnership with the prosecutor assembling evidence to be presented in court. However, once in court, the police are merely witnesses for the court and do not play active role in the prosecution of an accused. Police investigators are not adversaries to the defence or the accused and should not consider themselves as such. Very often in court, a police investigator will have their evidence aggressively challenged by the defence lawyer in a very adversarial manner, and it will certainly feel as if the investigator is being challenged as an adversary. It is sometimes even a defence strategy to provoke the police investigator into a confrontation where they take an adversarial stance against the defence of the accused. In these cases, it is important for an investigator to remember that their credibility as an objective investigator can be compromised by the demonstration of an adversarial attitude or demeanor in court. This is not to say that an investigator must be submissive to the defence — providing evidence in an objective, respectful, and balanced manner is the key.

To share some advice once provided to this writer by a seasoned senior investigator:

Your job ends on the court house steps. Do your investigation and take your evidence to court. Give your testimony and your job is done. Let the court make their decision and the case is done. If you allow yourself to take ownership of every decision the court makes, you will not last as an investigator. Let your job end on the court house steps,” (Fookes, 1973).

Police investigators are officers of the justice system, independent to the crown prosecutor’s office. Police investigate and collect the evidence, and the crown prosecutor presents the evidence collected by the police to the court. The crown prosecutor does not and should not direct or interfere with police investigations. In Canada, this concept of independent functions between the police and the prosecutor’s office is sometimes misunderstood. This misconception can sometimes happen due to our exposure to the American justice system where district attorneys, as prosecutors, do become very involved in directing the investigative processes in American jurisdictions.

Topic 8: Statutory Law

Statutory law is written law enacted by different levels of government. These written laws regulate the conduct of citizens. Laws are enacted with escalating levels of authority from the three levels of government in Canada. The most serious laws are the domain of the federal government, which takes responsibility for controlling criminal conduct under the Criminal Code of Canada, as well as criminal conduct ascribed to be of national concern under a broad spectrum of other federal statues, such as:

  1. The Criminal Code of Canada
  2. The Controlled Drug and Substances Act for drugs offences
  3. The Fire Arms Act for the control of firearms and restricted weapons
  4. The Canadian Environmental Protection Act for environmental offences
  5. The Canada Revenue Agency Act for Income tax offences
  6. The Canadian Customs and Border Services Act for border security

Statues, such as the Motor Vehicles Acts or the Liquor Control and Licencing Acts, are enacted by the provincial governments, and these laws vary somewhat from province to province. Each province has discretion to independently regulate issues, such as speed-limits or minimum drinking age, reflecting the cultural tolerances and social norms of their jurisdiction. At the lowest level, municipal governments enact by-law statues exclusive to their local concerns, such as parking or littering laws.

The Criminal Code of Canada is the most important and instructive federal statute for investigators. It provides police investigators with their authorities to use force, make arrests, enter private property, search for and seize evidence, and to lay charges against offenders. The wording of the Criminal Code of Canada is very clear regarding the types of action and conduct that constitute criminal offences. The Criminal Code also is generally clear about the rules for when and how a police officer may use force, arrest a suspect, enter private property, search and seize evidence, and lay a criminal charge against a suspect. However, there remains a significant amount of subjective interpretation in the code that must be done in the mind of an investigator to effectively use the various stated authorities to enforce the law. This need to interpret statutory law exists because of case law decisions and the common law precedents that have been established from those case law decisions.

Topic 9: Common Law (Case Law)

Common law is law that is not written down as legislation or a statue and is based on rulings and precedents of past cases to guide judges in making later decisions in similar future cases. It cannot be found in any statute or body of legislation, but only in past decisions. It is flexible and adapts to changing circumstances.

Fulfilling the role of a police investigator requires an understanding of specific statutory authorities, along with the case law and common law definitions for utilizing those authorities. Statutory authorities provide powers for arrest and use of force, powers for entry to private property, and powers to search for and seize evidence. Case law and common law are procedural in nature. They help define limits within statutory authorities and dictate the way the law is administered by the court. By extension, case law and rules of evidence define the way police investigations should be conducted, the way suspects should be treated, and the processes for collecting evidence and preserving it for court. The ability of an investigator to properly interpret and follow these statutory laws, case laws, and rules of evidence, can play a large part in determining if the evidence from an investigation is accepted or rejected by the court.

Case law and common law exist because, over the years, the courts have continually found that applying statutory law cannot happen without interpretation and consideration of exceptions. Critical points of subjective analysis, deciding issues of fairness to the accused, and balancing the need to protect society from criminal conduct have caused the courts to interpret how the law should be applied. These interpretations, when accepted by the judicial system, become precedents and sometimes even doctrines of law. Many of them directly comment on the matters an investigator should consider when making specific decisions to take action. With these stated matters of case law in mind, investigators are called upon to subjectively interpret the circumstances, evidence, and information relating to an event, and to determine if the specific facts and circumstances will meet the tests that allow action to be taken.

Many of an investigator’s interpretations and subsequent actions can be critical to the court accepting the evidence collected when the case goes to court, such as:

In addition to these case law decisions, common law also provides several doctrines of law that define consistent rulings of the courts when making assessments of the evidence being presented in relation to some specific common issues. A doctrine is established through repeated application of the same legal precedents, and there is an expectation that the lower courts will respect the application of these legal precedents in stated cases of the higher courts. Knowing these doctrines, and considering how the court might apply them to the evidence being presented, assists investigators on the proper ways to collect evidence that will best inform the court.

The Common Law Doctrine of Necessity

Under criminal law, the defense of necessity can be invoked by the defence in cases where the accused seeks to provide a rationale that committing the offence was the unavoidable result of some serious circumstance beyond his or her control. In considering this defence, the court will apply a very strict standard in order to meet the conditions prescribed in the common law doctrine of necessity (Gecker, 1989). It is important for an investigator to know the criterion that the court will apply, in-as-much as it will allow the investigator to seek out evidence that either supports or negates the necessity defense. The leading case in Canada for such a defence is R v Perka where Justice Dickson described the rationale for the defence as a recognition that:

A liberal and humane criminal law cannot hold people to the strict obedience of laws in emergency situations where normal human instincts, whether of self-preservation or of altruism, overwhelmingly impel disobedience.

However, it must be “strictly controlled and scrupulously limited.” and [sic] can only be applied in the strictest of situations where true “involuntariness” is found. Three elements are required for a successful defence:

  1. the accused must be in imminent peril or danger
  2. the accused must have had no reasonable legal alternative to the course of action he or she undertook
  3. the harm inflicted by the accused must be proportional to the harm avoided by the accused

The peril or danger must be more than just foreseeable or likely. It must be near and unavoidable.

At a minimum the situation must be so emergent and the peril must be so pressing that normal human instincts cry out for action and make a counsel of patience unreasonable.

With regard to the second element, if there was a reasonable legal alternative to breaking the law, then there can be no finding of necessity. Regarding the third element requiring proportionality, the harm avoided must be at least comparable to the harm inflicted (R v Perka, 1984).

Clearly, the standard for the defense of necessity sometimes requires the interpretation of complex issues. This interpretation determines if the circumstances and evidence fall within the ascribed definitions to be considered necessity. This interpretation is the job of the court assessing the evidence to reach their belief beyond a reasonable doubt.

If an investigator has discovered sufficient evidence and has reasonable grounds to believe an offence has been committed, there are sufficient grounds to lay the charge. In serious cases, where harm to persons, or significant property damage has occurred, police investigators do not have the discretion to consider if an accused person should be afforded the defence of necessity due to the complexity of the issues. In lesser cases, for instance where a police officer stops a car for speeding and the driver shows that they are speeding to get a critically injured person to the hospital, a police officer might use discretion and accept the excuse of necessity to forgo the speeding ticket. Conversely, if an accused person made the decision to cut a lifeline that caused a mountain climber to fall to his death to save himself from being pulled over the edge, that decision of necessity needs to be made by a judge in a court of law.

In serious cases, it is important for an investigator to remember that their job does not include making any final interpretation regarding the defense of necessity, even if evidence of necessity may exist. The investigator’s task is restricted to recognize and collect all evidence that may assist the court to make their decision on the issues of necessity. This would include recognizing and collecting evidence to show:

  1. The nature of the danger being imminent or not
  2. Evidence of other legal alternatives or actions that were available to the accused
  3. Evidence that might indicate the danger was either avoidable or unavoidable
  4. Evidence to demonstrate the anticipated harm from the threat, compared to the harm resulting from the accused’s action

Doctrine of Recent Possession

The doctrine of recent possession refers to the possession of property that has been recently stolen. It permits the court to make the inference that the possessor of the stolen property had knowledge that the property was obtained in the commission of an offence, and, in certain circumstances, was also a party to the initial offence (R v Terrence, 1983; & R v Kowlyk, 1988). When considering whether to make the inference of recent possession, the prosecution must consider all the circumstances (R v Abernathy, 2002). This includes common sense factors, such as the amount of time that passed between possession and the offence (R v Gagnon, 2006). Factors to consider whether the possession was recent include the nature of the object, the rareness of the object, the readiness with which the object can and is likely to pass to another, and the ease of identification. To achieve an inference, the Crown must establish that the accused was found in possession of the item and that the item was recently stolen without an explanation (R v Gagnon, 2006). When the accused is found in recent possession without explanation, the prosecution can draw the inference and make the presumption that the accused had a role in the theft or related offences. The defence can present an argument to counter the presumption by providing evidence of a reasonable explanation (R v Graham, 1974).

Doctrine of Wilful Blindness

Wilful blindness, also called ignorance of the law or contrived ignorance, is something the court will consider when an accused provides a defense claiming that they were not aware of the facts that would make them either criminally or civilly liable for a criminal offence or a civil tort. As an example, this can arise where a person has purchased an expensive item of stolen property for a very small price, then attempts to defend against a charge of possession of stolen property by claiming that they did not to know the item was stolen and/or did not know the true value of the item. In applying the doctrine of wilful blindness, the court will carefully examine the circumstances to determine what the accused should have known or if the accused should have inquired further.

The Supreme Court of Canada articulated the thinking behind the assessment of wilful blindness in R v Briscoe:

“Wilful blindness does not define the mens rea required for particular offences. Rather, it can substitute for actual knowledge whenever knowledge is a component of the mens rea. The doctrine of wilful blindness imputes knowledge to an accused whose suspicion is aroused to the point where he or she sees the need for further inquiries, but deliberately chooses not to make those inquiries” (R v Briscoe, 2010).

The manner in which the court should examine these issues is further expressed in Sansregret v The Queen, [1985] 1 S.C.R. 570 and R v Jorgensen, [1995] 4 S.C.R. 55. As Sopinka J. succinctly put it in R v Jorgensen (at para. 103):

“[a] finding of wilful blindness involves an affirmative answer to the question: Did the accused shut his eyes because he knew or strongly suspected that looking would fix him with knowledge? Courts and commentators have consistently emphasized that wilful blindness is distinct from recklessness. The emphasis bears repeating.”

As the Court explained further in Sansregret v The Queen (at p. 584):

…while recklessness involves knowledge of a danger or risk and persistence in a course of conduct which creates a risk that the prohibited result will occur, wilful blindness arises where a person who has become aware of the need for some inquiry declines to make the inquiry because he does not wish to know the truth. He would prefer to remain ignorant. The culpability in recklessness is justified by consciousness of the risk and by proceeding in the face of it, while in wilful blindness it is justified by the accused’s fault in deliberately failing to inquire when he knows there is reason for inquiry“ (Sansregret v The Queen, 1985).

For an investigator who anticipates that wilful blindness may become an issue at trial, it is important to recognize the need to gather the additional evidence that might demonstrate the accused knew or should have known the nature of the offence taking place, and deliberately failed to inquire.

Topic 10: Actus Reus and Mens Rea

To recognize the types of evidence that need to be collected with respect to various offences, an investigator must become intimately familiar with the concept of actus reus, which is a Latin term definable as “the guilty act” or “the criminal act”, and the concept of mens rea, another Latin term meaning “guilty mind” or “the intent to commit a crime”. For any specific offence, the actus reus will be described by the wording of the statute that prohibits the conduct. For example, for the offence of theft, under the Criminal Code of Canada, the guilty act of theft, and variations of what constitute theft, are described in detail under section 322 (Criminal Code, 1985, s 322(1, 2)) of the Criminal Code of Canada:

Theft 322. (1) Every one commits theft who fraudulently and without colour of right takes, or fraudulently and without colour of right converts to his use or to the use of another person, anything, whether animate or inanimate, with intent

(a) to deprive, temporarily or absolutely, the owner of it, or a person who has a special property or interest in it, of the thing or of his property or interest in it;

(b) to pledge it or deposit it as security;

(c) to part with it under a condition with respect to its return that the person who parts with it may be unable to perform; or

(d) to deal with it in such a manner that it cannot be restored in the condition in which it was at the time it was taken or converted.

(2) A person commits theft when, with intent to steal anything, he moves it or causes it to move or to be moved, or begins to cause it to become movable.

The definition of the offence of theft provides a broad range of actions that will constitute the guilty act of theft. It defines items that can be stolen as anything, whether animate or inanimate. It includes conversion of the use of an item as being a theft, and it even defines the time a theft is completed, saying theft occurs when a person merely begins to cause something to be movable. For an investigator to collect evidence to prove the guilty act of theft, these definitions create a range of activities where evidence can be collected to illustrate a theft has occurred; but, just proving one of the actions that define the guilty act of theft occurred is insufficient because theft is one of the criminal offences that requires the act to be intentional. This is where the concept of mens rea comes into play.

The concept of mens rea seeks to determine if the accused person had the intent to commit the offence. Going back to the wording for the offence of theft, you will see that the words “with intent” are part of that offence wording. The words “with intent” allow that if a person takes someone’s property by accident or without the intent to steal, the offence of theft is not completed. For an investigator, this is an important concept because with this term, there is an added obligation to look for evidence that can assist the court in determining if the accused did in fact have the intent to commit the offence.

In the case of a theft, evidence of intent may be part of the observed actions of the accused, such as where a shoplifter is seen stuffing store merchandise into their pockets and then walking out the nearest exit of the store without paying. In such a case, it would not be enough for the investigator to show that the accused removed the property from the store. The act of concealing the items in the pockets is critical to demonstrate the intent to commit the offence. So, for offences where the term “with intent” forms part of the wording of the offence, the investigator needs to look for those extra pieces of evidence to demonstrate intent to the court.

It should be noted that intent does not form part of the wording for all offences. There are some offences where intent is not required. These are called a “strict liability offence” in Canada, and, with these offences, it only needs to be shown that the guilty act occurred. Some less serious offences, like speeding or failing to stop at a stop sign, are “strict liability” offences, and the investigator does not need to show that there was intent to commit the offence. There are also more serious strict liability offences, such as criminal negligence causing death or bodily harm, where proof of intent is not required. For offences sometimes called “crimes of omission,” it is only necessary to find evidence showing that the accused failed to meet the standard of care that is expected, and that they acted in a reckless manner. In other words, their reckless disregard caused or allowed the harm to occur.

Criminal negligence

219. (1) Everyone is criminally negligent who

(a) in doing anything, or

(b) in omitting to do anything that it is his duty to do,

shows wanton or reckless disregard for the lives or safety of other persons.

Definition of “duty”

(2) For the purposes of this section, “duty” means a duty imposed by law (Criminal Code, 1985, s 219).

Even though intent in not a required element for this kind of charge, careful investigation of the evidence could elevate the offence from criminal negligence causing death or bodily harm to assault or even murder, if evidence of intent can be demonstrated. To demonstrate this point, let us examine a case where three men go hunting together and each is carrying a rifle. A shot is fired and one of the men is killed. The investigation of this death reveals that the shooter had been drinking heavily and was walking along with his loaded rifle and the safety on the rifle was off. The muzzle of his rifle was pointed in the direction of the victim walking beside him. The shooter confesses that he stepped over a log, tripped, and the gun discharged killing the victim. This evidence of drinking, the safety being off, and pointing a gun at the victim might support a charge for criminal negligence causing death.

Further investigation results in a statement from the third hunter who states that the victim and the shooter were business partners, and they had been arguing all morning over how they should divide the assets of the business they were selling. At one point, the shooter was heard telling the victim, “Be reasonable or I will just get rid of you and keep it all for myself.” This statement could be interpreted as an indication of motive and perhaps even intent to kill, and could be enough to elevate the criminal negligence causing death to a charge of murder. Hence, Actus Reus and Mens Rea become core concepts of investigative thinking. As the investigation proceeds, the investigator will undertake an ongoing process of evidence collection, offence recognition, and theory development to determine if an offence occurred, how the offence occurred, and why the offence occurred or is there evidence of intent. These concepts and the thinking to conduct theory development and evidence collection will be discussed in greater detail in the proceeding chapters of this book.

Topic 11: Prima Facie Case, Elements of the Offence, and the Criminal Information (Charge)

It is the job of the crown prosecutor to present evidence to the court that proves a prima facie case. Prima facie means at first sight and is the minimum amount of evidence required to prove each element of the formal charge against the accused. The elements of the offence include proving the specific acts alleged in the offence, such as assault or robbery; however, the elements of the offence also include other critical facts that a police investigator must consider to collect the correct evidence. It is the presentation of evidence that, if believed, would establish each of the elements necessary for the prosecution to succeed. In assessing whether a prima facie case is made, a judge does not decide whether the evidence is likely to be believed; but merely whether, if it were, it would establish the necessary elements for a conviction (Legal Information Institute, 2016).

The formal charge against a person in Canadian criminal law is called an ‘Information’, and there are specific elements or facts within that information that need to be proven. The information is a document sworn by a police officer alleging that the offence has taken place and accusing a person of that offence. The standard wording of a criminal information is as follows:


Criminal Information

I, Constable (name of the informant), do solemnly swear that I have reasonable and probable grounds to believe and do believe that, on or about (date of offence), at or near (place of offence), in the Province of (province name), (name of accused), did unlawfully (statement of actions of the accused), and did thereby commit the offence of (name of the offence) contrary to the provision of (section number the offence under the criminal code or other statute), sworn before me this date of information swearing.


Signature of Judge or JP                                               Signature of the Informant


In the above Information, the elements that need to be proven to establish a prima facie case are:

  1. The identity of the accused person named on the information
  2. The date or time frame in which the offence occurred
  3. The place where the offence occurred (establishing this place is within the jurisdiction of the presiding court)
  4. The action or actions taken by the accused person that will show they committed the offence contrary to the law

In court, this information or charge becomes the first document for consideration by the judge. This information, also known as a criminal charge, is read to the accused on their first appearance in court and after the reading of the charge, the judge will ask the accused person to enter a plea of either guilty or not guilty. If the plea is guilty, the judge will hear circumstances of the offence that will determine the sentence or the penalty for the offence. If the plea is not guilty, the judge will determine if the offence is one that should be heard by a judge-and-jury or a judge alone; and, if it is one of the serious offences where the option for judge-and-jury is available, the accused will be asked to decide which type trail they would prefer. Having received a plea of not guilty, the judge will then schedule a trial date.

When the trial begins, the prosecutor will present evidence to establish the truth of each element of the information beyond a reasonable doubt. Because the court system is an adversarial system, the defence lawyer may challenge any piece of the evidence presented with the goal of not allowing the prosecution to prove one or more of the required elements to make out the prime facie case. The prime facie case is complete when sufficient evidence is presented to prove each element of the charge before the court. If any one element of the information is not proven, the prima facie case is not established beyond a reasonable doubt and the court will make a ruling of not guilty.

Topic 12: The duty to investigate and the use of discretion

An appointment as a peace officer and the duties of a police officer in Canada are made under the authority of various provincial police acts and at the federal level under the RCMP Act. The designation of a peace officer under any one of these acts enables the appointed person to exercise the powers and authorities of a peace officer described in those acts, as well as the powers and authorities to function as a peace officer under the provisions of the Criminal Code of Canada and any other federal and provincial statutes. In addition to these powers and authorities to act, persons designated as peace officers also have some limited protection from criminal charges and civil liabilities in cases where they unintentionally make an error or cause injury to a person. These protections from criminal and civil liability are provided under the Criminal Code for some criminal acts and under Provincial Police Acts and the RCMP Act for civil torts. These protections are not available, or can be withheld, where an officer is found to have acted with criminal intent or is found to have been reckless or criminally negligent in the execution of their duties.

So, police officers are endowed with powers and authorities to act as keepers of the peace. For the police, this responsibility is equated to doing their duty. To fully understand what this entails, one must consider these two most critical questions:

These questions have a long history of both philosophical and legal arguments, dating all the back to the origins of policing in England (Reith, 1943). In those early times, the police were predominately considered to be peace-keepers. As such, the neighbourhood “Bobby” would intervene to settle local disputes. Criminal charges were the last resort. This ability of police officers to settle local disputes using their own judgement and discretion became a valued function of policing skills. The use of discretion remains today at the core of community policing, restorative justice initiatives and alternate dispute resolution programs.

The arguments surrounding police use of discretion and alternate dispute resolution are twofold. Some have argued that police with too much discretion will misuse it and become corrupt, while others contend that the justice system will become overloaded with minor cases if the police do not have the discretion to try to resolve some disputes without laying charges (R v Beare, 1988).

Directly on this point, Justice La Forest J. stated; Discretion is an essential feature of the criminal justice system. A system that attempted to eliminate discretion would be unworkably complex and rigid” (R v Beare, 1988).

Implicitly supporting the ongoing use of discretion, legislators continue to only provide very general definitions regarding what the duties of the police should be. Statements of police duties, such as the following are the norm.

    “… (Police Officers) must perform the duties and functions respecting the preservation of peace, the prevention of crime and offences against the law and the administration of justice assigned to it or generally to peace officers by the chief constable, under the director’s standards or under this Act or any other enactment(Government of British Columbia, 2015).

Even under the Criminal Code of Canada, there is an implied discretion indicating that the laying of an information is a matter of may and not a requirement of will.

Section 504 CCC. Anyone who, on reasonable grounds, believes that a person has committed an indictable offence may lay an information in writing and under oath before a justice, and the justice shall receive the information, where it is alleged

(a) that the person has committed, anywhere, an indictable offence that may be tried in the province in which the justice resides (Criminal Code, 1985, s 504(1)(a)).

For investigators, this implied discretion to not take the action of laying a charge seems to leave the door open for a great deal of latitude and interpretation. Historically, this has been the case; but recently, there have been several cases where the incorrect use of discretion has resulted in case law providing more prescriptive direction and defined process for the use of discretion (R v Beaudry, 2007).

To examine the use of discretion, R v Beaudry (2007) has been very instructive in defining the criterion for officers. The brief facts of the case are as follows: the accused, Sgt. Beaudry, was a Quebec police officer who stopped a vehicle on September 22, 2000. The driver turned out to be intoxicated. Upon discovering that the driver was also a police officer whom he had met on a previous occasion, Sgt. Beaudry decided not to demand a breathalyser test from the driver. Sgt. Beaudry believed the driver to be depressed and stated that he was using discretion to give him a chance. Sgt. Beaudry was charged with and convicted of obstruction of justice. The court ruled that he had improperly used his discretion by allowing favouritism. Ultimately, the Supreme Court of Canada’s ruling clarified some of the limitations that they would assign to police discretion. It stated:

“discretion is not absolute. Far from having a carte blanche, police officers must justify their decisions rationally.”

In R v Beaudry, SCC ruled that the justification or using discretion must have three elements:

  1. It must be an informed decision, based on evidence that constitutes reasonable ground
  2. There must be concrete reasons for the decisions to use discretion that are not based on favouritism or bias
  3. The officer must have both a subjectively and objectively honest belief in the reason for using the discretion, and the judge must determine that the officer’s belief reflected reality (R v Beaudry, 2007).

In addition to these three elements, the Supreme Court also stated that:

“Justification for discretion has to be proportional to the offence and has to be in the interest of public safety (R v Beaudry, 2007).”

From the R v Beaudry (2007) ruling, a set of seven principles were outlined and these principles serve as guidelines for police use of discretion in Canada:

  1. Discretion is vital to the operation of the criminal justice system. Not all offenders must be charged.
  2. The police still have discretion, but it is not absolute, it is limited.
  3. Limited discretion means discretion must be proportional to the seriousness of the offence.
  4. Use of discretion must be justified with concrete reasons.
  5. Improper use of discretion does not automatically constitute “Obstruct Justice”.
  6. A simple error of judgement is not “Obstruct Justice”.
  7. “Obstruct Justice” is committed when discretion is disproportionate, unjustified, and intended to obstruct, pervert, or defeat the course of justice (R v Beaudry, 2007).

 In 2007 following this ruling, in the landmark civil case of Hill v Hamilton-Wentworth Regional Police, the Supreme Court of Canada added an additional rule to the existing Beaudry list of principles:

The decision not to charge an offender cannot be based on the selfish desire to avoid potential civil liability (Hill v Hamilton-Wentworth Regional Police Services Board, 2007).

Topic 13: Arrest and Detention

Arresting or detaining a suspect are two of the most critical actions that a police investigator can take in the process of any investigation. Each is a distinct course of action and offers the investigator strategic advantages to control the investigative environment by:

The concept of arrest for police investigators relates to the process of taking a person into custody upon reaching reasonable grounds to believe that an offence has been committed by the person being arrested. There are many statutes, both federal and provincial, that provide the police with powers of arrest. However, the Criminal Code of Canada provides direction for all police investigators in Canada. Section 495 of the Criminal Code of Canada states:

Arrest without warrant by peace officer
Section 495

(1) A peace officer may arrest without warrant

(a) a person who has committed an indictable offence or who, on reasonable grounds, he believes has committed or is about to commit an indictable offence;

(b) a person whom he finds committing a criminal offence; or

(c) a person in respect of whom he has reasonable grounds to believe that a warrant of arrest or committal, in any form set out in Part XXVIII in relation thereto, is in force within the territorial jurisdiction in which the person is found.

(2) A peace officer shall not arrest a person without warrant for

(a) an indictable offence mentioned in section 553,

(b) an offence for which the person may be prosecuted by indictment or for which he is punishable on summary conviction, or

(c) an offence punishable on summary conviction,

in any case where

(d) he believes on reasonable grounds that the public interest, having regard to all the circumstances including the need to

(i) establish the identity of the person,

(ii) secure or preserve evidence of or relating to the offence, or

(iii) prevent the continuation or repetition of the offence or the commission of another offence, may be satisfied without so arresting the person, and

(e) he has no reasonable grounds to believe that, if he does not so arrest the person, the person will fail to attend court in order to be dealt with according to law (Criminal Code, 1985, s 495(1, 2)).

As a specific power to take action, arrest provides police investigators with a means to intervene in criminal situations and stop persons in the process of dangerous or unlawful acts by taking them into custody. With any arrest, there is an obligation to bring the arrested person before the court for release or otherwise to release the person but compel them to court by other means, such as a summons or promise to appear.

As a lesser power, the police action of detaining a suspect has evolved in common law to allow police to take a person into custody for a shorter time. This detention can be used where reasonable grounds to believe the person has committed an offence have not yet been established, but there is some evidence or circumstances that point to the person as a suspect in the offence being investigated.

For police investigators, the actions of arrest and detention need to be considered as strategic functions of the investigative process. Making an arrest or detaining the suspect are not final outcomes, but merely strategic steps in the process of identifying the offender and gathering sufficient evidence to proceed with a charge. The powers and authorities that exist for police investigators to detain a subject or make an arrest are complex. Detaining a suspect or making an arrest may damage the investigation and threaten the admissibility of evidence flowing from detention or arrest if it is not done on the basis of real facts and circumstances that the officer can adequately articulate to the court.

There is extensive case law that speaks to the issues surrounding both the detention and arrest of a suspect. Case law makes a significant distinction that an investigator needs to consider if they are about to detain or arrest a subject. In the simplest of terms that distinction is:

The distinction between forming reasonable grounds to believe a person has committed the offence and having a reasonable suspicion that a person is somehow implicated in the offence under investigation is a matter of evaluating the evidence available at the time detention or arrest are being considered.

To form reasonable grounds to believe a suspect has committed the offence, the investigator must have evidence that points directly to that suspect. This kind of evidence could be a witness identifying the suspect as committing the offence or strong circumstantial evidence such as fingerprints or DNA connecting the suspect to the scene or the victim. These types of evidence could provide the necessary reasonable grounds to believe the suspect committed the offence. In contrast, reasonable suspicion that a person is implicated in the offence under investigation requires significantly less concrete evidence. An investigator finding circumstantial evidence that points to a person as being implicated can be sufficient to make the detention. In articulating case law, judges have elaborated on the police common law powers to utilize detention as part of an investigation.

In 2004 in the case of R v Mann, the Supreme Court of Canada stated that, in spite of the fact that there is no general power for investigative detention, police may detain a person if there are reasonable grounds to suspect, in all the circumstances, that the individual is connected to a crime and the detention of that person is reasonably necessary on an objective view of the circumstances. The circumstances to be considered should include the extent to which a suspect’s liberty is interfered with in order for the police officer to conduct the required duties, and the individual being detained for investigation, must be told in simple language about the reason for that detention. The detention must be as short as possible in duration, and detention does not impose any obligation to answer questions. In addition, if a police officer has reasonable grounds to believe his safety or the safety of others is at risk, the officer may conduct and pat-down search on the detained subject and this kind of search is not the same as a search subsequent to an actual arrest (R v Mann, 2004).

With these distinctions for arrest and detention in mind, consider the following scenario to illustrate some of the decision-making an investigator must consider.


It is 3 AM on a Wednesday morning and you are a uniform patrol officer working the night-shift alone in your patrol car. Your unit and two other patrol units are dispatched to attend a break and enter alarm at a warehouse building located in an industrial area on the edge of the city. This industrial area is a complex with many warehouses and manufacturing facilities, and it borders a residential subdivision area. As you proceed to the scene of the alarm, you are advised on the radio that the two other units have already arrived at the warehouse. They are confirming that a break-in has taken place. They advise that the main entry glass doors of the warehouse have been smashed. The two other units are awaiting your arrival to commence a search for any suspects inside the warehouse. On the radio, you hear that the two other units have observed an unoccupied green Ford pickup truck parked on the street near the warehouse complex. Upon running the licence plate of the vehicle, it is determined that the vehicle is registered to a Larry Lurken. Criminal records check on Lurken reveal that he has a prior criminal record for several past offences of break enter and theft.

As you proceed to the industrial area, you approach the entry road through the residential subdivision. The warehouse you are going to is only one block inside the industrial area from your entry point off the subdivision. As you approach the entrance, you see a young man standing partly hidden behind a tree on the boulevard that separates the subdivision from the industrial complex. The young man is dressed in dark blue jeans and a dark hoodie and, as you approach him, he starts to walk away.

This is a typical case where the strategy of investigative detention could be used. The facts and circumstances facing you as an investigator are:

  • You have a young man dressed in dark clothing;
  • He is standing partly hidden behind a tree;
  • It is 3 AM;
  • This location is on the border of an industrial complex, only one block away from the scene of a confirmed break-in; and
  • He is starting to walk away.

These are sufficient grounds to suspect that this person may be involved in the criminal offence under investigation. In this case, the goal for you as the investigator would be to detain and determine the identity of this person. To properly observe the rights of this person, you would advise the young man as follows:

“I am conducting an investigation into a break-in at a nearby warehouse building and I am detaining you for my investigation of this break-in. You are not obliged to say anything and anything you do say can be used as evidence. You have the right to retain and instruct counsel without delay.”

After you provide this advice of detention and the appropriate charter and caution, this person is not obliged to answer any questions, other than to provide his identity. The fact that the detainee is not obligated to talk, does not mean you as an investigator are not permitted to ask questions. After all, there may be a reasonable explanation that this man can provide for being at this location at this time, and, as an objective investigator, you must always be prepared to hear these possibilities. He may tell you he lives in the house across the street from where he is standing, and when he heard the alarm going off at the warehouse, he came outside to see what was happening. If that was his claim, and you subsequently check his identification and confirm it to be true, your grounds to suspect he is involved in the offence become greatly diminished, likely to the point where he should be released from detention.

If, on the other hand, he only provides identification and refuses to answer questions about being at this location, your suspicion would remain. Your pat-down safety search of this suspect may reveal something incriminating, such as break-in tools or keys to a Ford truck, or perhaps even a walkie-talkie, which might indicate he is standing look-out for others who were doing the actual break-in. You may find shards of broken glass on his running shoes that may be like the glass from the broken front door of the warehouse, or you may run his name through the police databases to determine that he has a past record for breaking and entering, or perhaps is shown and being an associate of Larry Lurken, the owner of the vehicle parked near the break-in location. Any of these kinds of facts or associations would be sufficient to justify the continued investigative detention of this suspect. These facts could be the beginning of circumstantial evidence from which reasonable grounds to believe could be formed to make an arrest of this suspect.

If the warehouse is searched and Larry Lurken is found inside, Lurken has the matching walkie-talkie to your detained suspect, and it is then discovered that the Ford key in the detainee’s pocket is the key to Lurken’s parked Ford truck, sufficient circumstantial evidence would then exist to form reasonable grounds to believe your detained suspect was a party to this offence of breaking and entering.

If, upon arriving in the area and seeing this suspicious looking young man, you had immediately made an arrest, that arrest would not have been a lawful arrest because it would not have been supported by evidence that could pass the test of forming reasonable grounds for belief. Evidence located later, such as the walkie-talkie and vehicle keys found as part of that arrest, could be excluded by the court because they were not seized as part of a lawful search incidental to lawful arrest. In the foregoing case, detention was justified by the suspicious circumstances and the subsequent discovery of other incrimination evidence after that lawful detention could lead to an arrest on reasonable grounds that could be properly articulated to the court.

As previously mentioned, the process of detention and arrest are authorized actions that an investigator may take to progress through an investigation. These actions are part of the investigative process and they must be taken after careful consideration of evidence that justifies either having a reasonable suspicion to detain or forming reasonable grounds for belief to make an arrest. It is important for an investigator to undertake careful consideration of the available information and evidence before either of these actions are taken. Any arrest or detention of a suspect should be made with awareness that the evidence considered to support the decision for action will need to be articulated later in court.



In this chapter, we have outlined and discussed many of the legal rules that must be considered by an investigator to guide their investigative process. In common for each of these legal definitions, concepts, principles, doctrines, and protocols is the need for each to be incorporated into the investigator’s thinking process. The investigator needs to consider the circumstances being encountered and apply the law as it exists specifically to those events. These legal definitions, concepts, principles, doctrines, and protocols form the basis of the knowledge that an investigator needs to incorporate into his or her mental map to successfully navigate the investigative process. An understanding of these issues and their appropriate application will demonstrate for the court that the investigator is aware of their duty to act, their authorities to act, and it will enable the investigator to properly articulate a justification of their action.


Study Questions

  1. What exactly do we mean when we refer to “fundamental justice” for people who are charged with a criminal offence in Canada?
  2. What protection regarding life, liberty and security is provided by Sec 7 of the Canadian Charter of Rights and Freedoms?
  3. What protection regarding search and seizure is provided by Sec 8 of the Canadian Charter of Rights and Freedoms?
  4. What protection regarding detention or imprisonment is provided by Sec 9 of the Canadian Charter of Rights and Freedoms?
  5. What protection on arrest or detention is provided by Sec 10 of the Canadian Charter of Rights and Freedoms?
  6. What protection to witnesses is provided by Section 13 of the Canadian Charter of Rights and Freedoms?
  7. What language protections are provided by Section 14 of the Canadian Charter of Rights and Freedoms?
  8. What is the difference between “proof within a balance of probabilities” and “proof beyond a reasonable doubt”?
  9. What is the general test for “reasonable grounds to believe”?
  10. When must an investigator remain diligent in collecting and preserving evidence, even though they believe they will not be proceeding with a criminal charge?
  11. What is the role of the investigator in court when presenting evidence?
  12. Why does the police investigator have to be attentive to common law?
  13. Can a police investigator decide whether or not an accused should be afforded the defence of necessity?
  14. What common law doctrine can be applied when an accused is found in recent possession of stolen property?
  15. What evidence must a police investigator gather to demonstrate that an accused was willfully blind?
  16. What does the term “Mens Rea” mean and why is it important?
  17. What is a prima facie case?
  18. What is a criminal information?
  19. Is a police investigator protected from criminal or civil liability if they make an error or cause injury to a person?
  20. In applying his/her discretion to not lay a charge where there is reason to believe a person has committed an indictable offence, what must a police investigator remember?
  21. When can a police investigator arrest without a warrant?
  22. When can a police investigator detain a person?


Chapter 3: What You Need To Know About Evidence

Chapter 3: What You Need To Know About Evidence
“Evidence forms the building blocks of the investigative process and for the final product to be built properly, evidence must be recognized, collected, documented, protected, validated, analyzed, disclosed, and presented in a manner which is acceptable to the court.”

The term “evidence”, as it relates to investigation, speaks to a wide range of information sources that might eventually inform the court to prove or disprove points at issue before the trier of fact. Sources of evidence can include anything from the observations of witnesses to the examination and analysis of physical objects. It can even include the spatial relationships between people, places, and objects within the timeline of events. From the various forms of evidence, the court can draw inferences and reach conclusions to determine if a charge has been proven beyond a reasonable doubt.

Considering the critical nature of evidence within the court system, there are a wide variety of definitions and protocols that have evolved to direct the way evidence is defined for consideration by the court. Many of these protocols are specifically addressed and defined within the provisions of the Canada Evidence Act (Government of Canada, 2017).

In this chapter, we will look at some of the key definitions and protocols that an investigator should understand to carry out the investigative process:

  1. The probative value of evidence
  2. Relevant evidence
  3. Direct evidence
  4. Circumstantial evidence
  5. Inculpatory evidence
  6. Exculpatory evidence
  7. Corroborative evidence
  8. Disclosure of evidence
  9. Witness evidence
  10. Hearsay evidence
  11. Search and seizure of evidence
  12. Exclusion of evidence

Topic 1: The Probative Value of Evidence

Each piece of relevant evidence will be considered based on its “probative value”, which is the weight or persuasive value that the court assigns to that particular piece of evidence when considering its value towards proving a point of fact in question for the case being heard. This probative value of evidence goes towards the judge, or the judge and jury, reaching their decision of proof beyond a reasonable doubt in criminal court, or proof within a balance of probabilities in civil court.

Eye Witness Evidence

A competent, compellable, independent, eye witness with excellent physical and mental capabilities, who has seen the criminal event take place and can recount the facts will generally satisfy the court and provide evidence that has high probative value. In assessing the probative value of witness evidence, the court will consider several factors that we will discuss in more detail in our chapter on witness management. These include:

Physical Evidence

The court will also generally attribute a high probative value to physical exhibits. The court likes physical evidence because they are items the court can see and examine to interpret the facts in issue for proof beyond a reasonable doubt. Physical evidence can include just about anything, such as weapons, fingerprints, shoe prints, tire marks, tool impression, hair, fiber, or body fluids. These kinds of physical exhibits of evidence can be examined and analyzed by experts who can provide the court with expert opinions that connect the item of evidence to a person, place, or the criminal event. This allows the court to consider circumstantial connections of the accused to the crime scene or the accused to the victim. For example, in the case where the fingerprints of a suspect are found at a crime scene, and a DNA match of a murder victim’s blood is found on that suspect’s clothing, forensic connections could be made and, in the absence of an explanation, the court would likely find this physical evidence to be relevant and compelling evidence with high probative value.

Topic 2: Relevant Evidence

Relevant evidence speaks to an issue before court in relation to the charge being heard. Relevant evidence includes both direct evidence and indirect circumstantial evidence. For either direct or indirect circumstantial evidence to be considered relevant to the court, it must relate to the elements of the offence that need to be proven. If the evidence does not relate to proving the place, time, identity of the accused, or criminal acts within the offence itself, the evidence will not be considered relevant to the charge. The prosecution may present evidence in the form of a physical exhibit that the court can see and examine to consider, or they may present evidence in the form of witness testimony, in which case the witness is telling the court what they perceived within the limits of their senses.

Types of Evidence chart. Direct Evidence and Indirect Evidence.

Topic 3: Direct Evidence

Direct evidence is evidence that will prove the point in fact without interpretation of circumstances. (Justice Department Canada, 2017). It is any evidence that can show the court that something occurred without the need for the judge to make inferences or assumptions to reach a conclusion. An eyewitness who saw the accused shoot a victim would be able to provide direct evidence. Similarly, a security camera showing the accused committing a crime or a statement of confession from the accused admitting to the crime could also be considered direct evidence. Direct evidence should not be confused with the concept of direct examination, which is the initial examination and questioning of a witness at trial by the party who called that witness. And, although each witness who provides evidence could, in theory, be providing direct testimony of their own knowledge and experiences, that evidence is often not direct evidence of the offence itself.

Topic 4: Circumstantial Evidence

Indirect evidence, also called circumstantial evidence, is all other evidence, such as the fingerprint of an accused found at the crime scene. Indirect evidence does not by itself prove the offence, but through interpretation of the circumstances and in conjunction with other evidence may contribute to a body of evidence that could prove guilt beyond a reasonable doubt (Justice Department Canada, 2017). Strong circumstantial evidence that only leads to one logical conclusion can sometimes become the evidence the court uses in reaching belief beyond a reasonable doubt to convict an accused. It requires assumptions and logical inferences to be made by the court to attribute meaning to the evidence.

“When one or more things are proved, from which our experience enables us to ascertain that another, not proved, must have happened, we presume that it did happen, as well in criminal as in civil cases.” (MacDonell, 1820)

Circumstantial evidence demonstrates the spatial relationships between suspects, victims, timelines, and the criminal event. These spatial relationships can sometimes demonstrate that an accused person had a combination of intent, motive, opportunity, and/or the means to commit the offence, which are all meaningful features of criminal conduct.

Circumstantial evidence of intent can sometimes be shown through indirect evidence of a suspect planning to commit the offence, and/or planning to escape and dispose of evidence after the offence. A pre-crime statement about the plan could demonstrate both intent and motive, such as, “I really need some money. I’m going to rob that bank tomorrow.”

Circumstantial evidence of conflict, vengeance, financial gain from the commission of the offence can also become evidence of motive.

Circumstantial evidence of opportunity can be illustrated by showing a suspect had access to a victim or a crime scene at the time of the criminal event, and this access provided opportunity to commit the crime.

Circumstantial evidence of means can sometimes be demonstrated by showing the suspect had the physical capabilities and/or the tools or weapons to commit the offence.

Presenting this kind of circumstantial evidence can assist the court in confirming assumptions and inferences to reach conclusions assigning probative value to connections between the accused and a person or a place and the physical evidence. These circumstantial connections can create the essential links between a suspect and the crime.

There are many ways of making linkages to demonstrate circumstantial connections. These range from forensic analysis of fingerprints or DNA that connect an accused to the crime scene or victim, to witness evidence describing criminal conduct on the part of an accused before, during, or after the offence. The possibilities and variations of when or how circumstantial evidence will emerge are endless. It falls upon the investigator to consider the big picture of all the evidence and then analytically develop theories of how events may have happened. Once a reasonable theory has been formed, evidence of circumstantial connections can be validated through further investigation and analysis of physical exhibits to connect a suspect to the crime.

Topic 5: Inculpatory Evidence

Inculpatory evidence is any evidence that will directly or indirectly link an accused person to the offence being investigated. For an investigator, inculpatory evidence can be found in the victim’s complaint, physical evidence, witness accounts, or the circumstantial relationships that are examined, analyzed, and recorded during the investigative process. It can be anything from the direct evidence of an eyewitness who saw the accused committing the crime, to the circumstantial evidence of a fingerprint found in a location connecting the accused to the victim or the crime scene.

Naturally, direct evidence that shows the accused committed the crime is the preferred inculpatory evidence, but, in practice, this it is frequently not available. The investigator must look for and interpret other sources for evidence and information. Often, many pieces of circumstantial evidence are required to build a case that allows the investigator to achieve reasonable grounds to believe, and enables the court to reach their belief beyond a reasonable doubt.

A single fingerprint found on the outside driver’s door of a stolen car would not be sufficient for the court to find an accused guilty of car theft. However, if you added witness evidence to show that the accused was seen near the car at the time it was stolen, and a security camera recording of the accused walking off the parking lot where the stolen car was dumped, and the police finding the accused leaving the dump site where he attempted to toss the keys of that stolen car into the bushes, the court would likely have proof beyond a reasonable doubt.

If an abundance of inculpatory circumstantial evidence can be located for presentation to the court that leads to a single logical conclusion, the court will often reach their conclusion of proof beyond a reasonable doubt, unless exculpatory evidence is presented by the defence to create a reasonable doubt.

Topic 6: Exculpatory Evidence

Exculpatory evidence is the exact opposite of inculpatory evidence in that it tends to show the accused person or the suspect did not commit the offence. It is important for an investigator to not only look for inculpatory evidence, but to also consider evidence from an exculpatory perspective. Considering evidence from the exculpatory perspective demonstrates that an investigator is being objective and is not falling into the trap of tunnel vision. If it is possible to find exculpatory evidence that shows the suspect is not responsible for the offence, it is helpful for police because it allows for the elimination of that suspect and the redirecting of the investigation to pursue the real perpetrator.

Sometimes, exculpatory evidence will be presented by the defence at trial to show the accused was not involved in the offence or perhaps only involved to a lesser degree. In our previous circumstantial case of car theft, there is strong circumstantial case; but what if the defence produces the following exculpatory evidence where:

Provided with this kind of exculpatory evidence, the court might dismiss the case against the accused.

Having read this, you may be thinking that this exculpatory evidence and defence sounds a little vague, which is the dilemma that often faces the court. If they can find guilt beyond a reasonable doubt, they will convict, but if the defence can present evidence that creates a reasonable doubt, they will make a ruling of not guilty. Experienced criminals can be very masterful at coming up with alternate explanations of their involvement in criminal events, and it is sometimes helpful for investigators to consider if the fabrication of an alternate explanation will be possible. If an alternate explanation can be anticipated, additional investigation can sometimes challenge the untrue aspects of the alternate possibilities.

Topic 7: Corroborative Evidence

The term corroborative evidence essentially refers to any type of evidence that tends to support the meaning, validity, or truthfulness of another piece of evidence that has already been presented to the court. A piece of corroborative evidence may take the form of a physical item, such as a DNA sample from an accused matching the DNA found on a victim, thus corroborating a victim’s testimony. Corroborative evidence might also come from the statement of one independent witness providing testimony that matches the account of events described by another witness. If it can be shown that these two witnesses were separated and did not collaborate or hear each other’s account, their statements could be accepted by the court as mutually corroborative accounts of the same event.

The courts assign a great deal of probative value to corroborative evidence because it assists the court in reaching their belief beyond a reasonable doubt. For investigators, it is important to not just look for the minimum amount of evidence apparent at the scene of a crime. Investigation must also seek out other evidence that can corroborate the facts attested to by witnesses or victims in their accounts of the event. An interesting example of corroborative evidence can be found in the court’s acceptance of a police investigators notes as being circumstantially corroborative of that officer’s evidence and account of the events. When a police investigator testifies in court, they are usually given permission by the court to refer to their notes to refresh their memory and provide a full account of the events. If the investigator’s notes are detailed and accurate, the court can give significant weight to the officer’s account of those events. If the notes lack detail or are incomplete on significant points, the court may assign less value to the accuracy of the investigator’s account.

For the court, detailed notes properly made at the time corroborate the officer’s evidence and represent a circumstantial guarantee of trustworthiness for the officer’s testimony (McRory, 2014).

Topic 8: Disclosure of Evidence

It is important for an investigator to be aware that all aspects of their investigation may become subject to disclosure as potential evidence for court. As part of the process of fundamental justice within the Canadian Charter of Rights and Freedoms, a person charged with an offence has the right to full disclosure of all the evidence of the investigation (R v Stinchcombe, 1991). This means that any evidence or information gathered during the police investigation must be available for the defence to review and determine if that evidence could assist the accused in presenting a defence to the charge before the court.

In the disclosure process, the decision to disclose or not to disclose is the exclusive domain of the crown prosecutor and, although police investigators may submit information and evidence to the prosecutor with the request that the information be considered an exception to the disclosure rules, the final decision is that of the crown. That said, even the decision of the crown may be challenged by the defence and that then becomes a final decision for the Judge. The prosecutor will ask the police to provide a full disclosure of the evidence gathered during their investigation.

The list of what should form part of a normal disclosure will typically include:

It is worth stressing that police notes and reports relating to the investigation are typically studied very carefully by the defence to ensure they are complete and have been completely disclosed. Disclosure will also include investigation notes and reports that relate to alternate persons considered, investigated, and eliminated as suspects in the crime for which the accused is being tried. If alternate suspects were identified and not eliminated during the investigation, that lack of investigation may form the basis for a defence to the charge.

The issues relating to the disclosure of evidence have been the subject of several Supreme Court of Canada rulings and a few exceptions to disclosure had been identified where certain information does not need to be disclosed. These exceptions to disclosure were outlined in the benchmark disclosure case of R v Stinchcombe (1991). These exceptions include:

For an investigator, the requirement to comply with disclosure is one of the best reasons to make sure notes and reports are complete and accurately reflect the investigation and actions taken during the investigation. From the court’s perspective, there will never be any excuse for a police investigator to intentionally conceal or fail to disclose evidence or information.

Topic 9: Witness Evidence

Witness evidence is evidence obtained from any person who may be able to provide the court with information that will assist in the adjudication of the charges being tried. This means that witnesses are not only persons found as victims of a crime or on-scene observers of the criminal event. They may also be persons who can inform the court on events leading up to the crime, or activities taking place after the crime.

These after-the-crime activities do not just relate to activities of the suspect, but also include the entire range of activities required to investigate the crime. Consequently, every police officer involved in the investigation, and every person involved in the handling, examination, and analysis of evidence to be presented in court, is a potential witness.

Issues relating to the collection of witness evidence will be discussed in more detail in Chapter 7 on Witness Management.

Topic 10: Hearsay Evidence

Hearsay evidence, as the name implies, is evidence that a witness has heard as a communication from another party. In addition to verbal communication, legal interpretations of the meaning of hearsay evidence also include other types of person-to-person communication, such as written statements or even gestures intended to convey a message. As defined by John Sopinka in his book, The Law of Evidence, hearsay is:

Written or oral statements or communicative conduct made by persons otherwise than in testimony at the proceedings in which it is offered, are inadmissible if such statements or conduct are tendered either as proof of their truth or as proof of assertions implicit therein (Sopinka, 1999, p. 173).

Hearsay evidence is generally considered to be inadmissible in court at the trial of an accused person for several reasons; however, there are exceptions where the court will consider accepting hearsay evidence (Thompson, 2013). The reasons why hearsay is not openly accepted by the court include the rationale that:

The court will consider accepting hearsay evidence as an exception to the hearsay rule in cases where:

Dying Declarations

Exceptions to the hearsay rule include the dying declaration of a homicide victim. This type of declaration is allowed since it is traditionally believed that a person facing imminent death would not lie. Justice Eyre in the 1789 English case of R v Woodcock stated:

The general principle on which this species of evidence is admitted is, that they are declarations made in extremity, when the party is at the point of death, and when every hope of this world is gone: when every motive to falsehood is silenced, and the mind is induced by the most powerful considerations to speak the truth; the situation so solemn and so awful, is considered by the law as creating an obligation equal to that which is imposed by a positive oath administered in a court of justice” (R v Woodcock, 1789).

Per the rules of the Canada Evidence Act (Government of Canada, 2015), for a dying declaration to be acceptable to the court, the victim:

This is a delicate area because in cases where the victim of a serious assault is in danger of dying, the investigator may have the opportunity to gain evidence by taking a statement from that victim; however, that statement would need to include some acknowledgement by the victim that they believed they are in imminent danger of dying (Sebetic, 1950).

Recipient of a Spontaneous Utterance

In cases where a witness hears a spontaneous utterance of a victim, the court may accept the witnesses restating of that utterance if, according to Ratten v R (1971):

… the statement providing it is made in such conditions of involvement or pressure as to exclude the possibility of concoction or distortion to the advantage of the maker or the disadvantage of the accused (Ratten v R, 1971).

Hearsay of Statement From a Child Witness Who is Not Competent

In cases where a child witness is not competent or available to provide evidence, the parent or another adult, who has heard a statement from that child, may be permitted to provide that information by way of hearsay to the court. These circumstances have been illustrated in case law from the case of R v Khan (1990). In this case, the mother of a 3 ½ year old girl was not present when the child was sexually assaulted by her doctor during an examination. However, immediately after the examination, the child made explicate statements of what happened to the mother and provided descriptions of acts that a child could not have made up. From this case, the court did consider hearsay evidence as an exception to the hearsay rule. The case of R v Khan created what has become known as the “principled approach” and it allows that hearsay evidence may be admissible if two conditions are proven. These conditions are necessity and reliability.

In R v Khan (1990), the S.C.C. defined necessity as instances where:

In R v Khan (1990), the court defined reliability factors as relating to the credibility of the person’s observations and these included:

Since the adoption of the Khan Rule, the rules of hearsay have expanded on the principled approach that if the evidence is considered necessary to prove a fact in issue at the trial, the hearsay evidence being submitted is found to be reliable (Dostal, 2012). To prove reliability, the crown must submit evidence that demonstrates the circumstantial guarantee of trustworthiness. This definition of reliability was further articulated in R v Smith:

“The criterion of “reliability” or the circumstantial guarantee of trustworthiness — is a function of the circumstances under which the statement in question was made. If a statement sought to be adduced by way of hearsay evidence is made under circumstances which substantially negate the possibility that the declarant was untruthful or mistaken, the hearsay evidence may be said to be “reliable”, i.e., a circumstantial guarantee of trustworthiness is established” (R v Smith, 1992).

An interesting aspect of hearsay evidence that sometimes confuses new investigators is that during any investigation, the investigator is searching out and retrieving hearsay accounts of events from various witnesses. From these hearsay accounts, the investigator is considering the evidence and using that hearsay information to form reasonable grounds to believe and take action. This is a totally acceptable and legally authorized process, and, if ever questioned in court regarding the process of forming reasonable grounds on the basis of hearsay, the investigator can qualify their actions by pointing out their intent to call upon the original witness to provide the court with the unfettered firsthand account of events. Investigators are merely the people empowered to assemble the available facts and information from various sources found in witnesses and crime scene evidence. As an investigator assembles the evidence they are empowered to form reasonable grounds for belief and take actions of search, seizure, arrest, and charges to commence the court process. Once in court, the investigator’s testimony will only relate to the things they have done in person or statements they have heard as exceptions to the hearsay rule while forming of reasonable grounds to take action.

Topic 11: Search and Seizure of Evidence

In order for items of physical evidence to be accepted by the court as exhibits, each item of evidence must meet the test of having been searched for and seized using the correct lawful authorities. There are a number of ways in which items of evidence may be legally searched for and seized.

Investigators may search for and seize or receive items of evidence:

It is important to note that when evidence is being presented to the court, the investigator will be held accountable to provide an explanation of the circumstances under which an item of evidence was searched for and seized. This may involve the investigator articulating not only details of how they discovered the item, but also circumstances to illustrate the offence committed and their authority to arrest, detain, and/or enter a crime scene lawfully

With similar accountability, when a Section 487(1) Criminal Code warrant is issued, the police are required in advance to swear an affidavit of facts articulating their reasonable grounds to believe that an offence has been committed and the evidence of that offence exists in the premises to be searched. This warrant and the affidavit of facts can be examined and challenged at the trial. As we proceed through this book we will discuss the process of developing the mental map that enables an investigator to meet the challenge of seeing and articulating the issues of lawful authority to search and seize evidence.

Topic 12: Exclusion of Evidence by the Court

In hearing any case, the court has the authority to either accept or exclude any piece of evidence being presented. An evaluation is applied to all evidence to determine if it will be admissible or excluded. The types of evidence that can be admitted or excluded range from the physical exhibits found at the crime scene, to the accounts of events provided by witnesses to a confession taken from a suspect. For investigators, it is important to understand that any piece of evidence could be challenged by the defence for exclusion. If challenged, the court will decide if evidence should be excluded based on a number of rules and depending on the type of evidence being presented.

In the case of witness evidence, the court will first consider if the witness is competent and compellable to give evidence. A competent witness is generally a compellable witness (R v Schell, 2004). Competent means legally qualified to testify, and compellable means legally permitted to testify. Witness competence and compellability are each decided based upon several factors that will be discussed later in the witness management portion of this book.

If a witness is found to be both competent and compellable, the court will hear their testimony and will then consider the value of the evidence provided after assessing the credibility of the witness. If a witness is found to be either not competent or not compellable, their evidence will be excluded at trial.

Like witness evidence, physical evidence is also evaluated by the court to determine its admissibility at trial based upon a number of factors. These factors will be discussed further in our chapter on crime scene management; however, they include:

A flaw in any of these factors can result in evidence being excluded at trial. In addition, the court can completely exclude any evidence that has been obtained following a violation of the Charter Rights and Freedoms of the accused person. Such infringements on these guaranteed rights and freedoms would include:

Section 24 of the Canadian Charter of Right and Freedoms states:

24. (1) Anyone whose rights or freedoms, as guaranteed by this Charter, have been infringed or denied may apply to a court of competent jurisdiction to obtain such remedy as the court considers appropriate and just in the circumstances.

(2) Where, in proceedings under subsection (1), a court concludes that evidence was obtained in a manner that infringed or denied any rights or freedoms guaranteed by this Charter, the evidence shall be excluded if it is established that, having regard to all the circumstances, the admission of it in the proceedings would bring the administration of justice into disrepute.

Practices regarding what evidence may be brought against an individual in trials are addressed by section 24(2). When evidence is obtained through the violation of a Charter right, the claimant is able to apply to have the evidence excluded from the trial under this section (Government of Canada, 2015).

The exclusion of evidence flowing from a Charter violation is not automatic, and there is significant case law that the court will consider to determine if evidence will be excluded.

In the case R v Grant (2009), the Supreme Court of Canada created a new test to determine when the administration of justice has been brought into disrepute (replacing the 1987 test in R v Collins). The Grant test lists three factors the courts must consider:

(1) the seriousness of the Charter infringing conduct (focusing on a review of how society would view the actions of the state),

(2) the impact of the breach on the Charter protected interests of the accused (focusing on a review of how the state’s actions affected the accused), and

(3) society’s interests in the adjudication of the case on its merits (focusing on a review of the importance and reliability of the evidence) (R v Grant, 2009).

Knowing the rules for evidence collection, handling, and preservation can assist an investigator to avoid errors that could exclude evidence at trial. Following the rules that define Charter violations can assist an investigator to avoid having valuable evidence excluded completely at trial because of a charter violation. These topics will all be covered in more detail as we proceed through the various chapters to follow.


Evidence is a key feature to any investigation, so it is important for investigators to understand the various legal definitions of evidence, the various types of evidence, and the manner in which evidence is considered and weighed by the court. Evidence forms the building blocks of the investigative process and for the final product to be built properly, evidence must be recognized, collected, documented, protected, validated, analyzed, disclosed, and presented in a manner that will be acceptable to the court. As we proceed through this book, evidence will continue to be a key element for consideration in the development of proper investigative processes.

Study Questions

  1. What do we mean when we say that evidence will be considered by the court on its “probative value”?
  2. What is direct evidence?
  3. Provide three examples of direct evidence.
  4. Can an accused be convicted of circumstantial evidence alone?
  5. What is inculpatory evidence?
  6. What is exculpatory evidence?
  7. What is corroborative evidence?
  8. What are the exceptions to the requirement of full disclosure?
  9. Is hearsay evidence ever admissible in court?
  10. When can evidence be excluded by a court?
  11. If evidence was illegally obtained, is it automatically excluded by the court?



Chapter 4: The Process of Investigation

Chapter 4: The Process of Investigation

“For the court to be satisfied that the investigator acted lawfully and within the bounds of legally prescribed authority, the judge needs to hear the investigator describe their thinking processes to form reasonable grounds, or in some emergency cases, to have a reasonable suspicion that justifies the action taken.”

An effective strategy for learning any new skill is to define it and break it down into logical steps, establishing a progression that can be followed and repeated to reach the desired results. The process of investigation is no exception and can be effectively explained and learned in this manner. In this chapter, you will learn how each of the following issues relates to the process of investigation.

  1. The distinction between investigative tasks and investigative thinking
  2. The progression of the investigative process
  3. The distinction between tactical investigative and strategic investigative responses
  4. The concepts of event classification and offence recognition
  5. The threat vs. action response dilemma
  6. The distinction between active events and inactive events
  7. The connection of active events and Level 1 priority results to the powers afforded under exigent circumstance
  8. The Response Transition Matrix (RTM) and the critical need to transition from tactical response to strategic response

Topic 1: The Distinction Between Investigative Tasks and Investigative Thinking

To understand the process of investigation, it is necessary to comprehend the distinction between investigative tasks and investigative thinking. Investigative tasks relate to the information gathering processes that feed into investigative thinking and the results. Investigative thinking, on the other hand, is the process of analyzing information and theorizing to develop investigative plans. Let us consider this distinction in a little more depth.

Investigative tasks

Investigative tasks relate to identifying physical evidence, gathering information, evidence collection, evidence protection, witness interviewing, and suspect interviewing and interrogation. These are essential tasks that must be learned and practiced with a high degree of skill to feed the maximum amount of accurate information into the investigative thinking process. Criminal investigation is aimed at collecting, validating, and preserving information in support of the investigative thinking process. Accordingly, it is important to learn to do these evidence collection tasks well.

Investigative Thinking

Investigative thinking is aimed at analyzing the information collected, developing theories of what happened, the way an event occurred, and establishing reasonable grounds to believe. Those reasonable grounds to believe will identify suspects and lead to arrest and charges. Investigative thinking is the process of analyzing evidence and information, considering alternate possibilities to establish the way an event occurred and to determine if they are reasonable.

Topic 2: Progression of the Investigative Process

The investigative process is a progression of activities or steps moving from evidence gathering tasks, to information analysis, to theory development and validation, to forming reasonable ground to believe, and finally to the arrest and charge of a suspect. Knowing these steps can be helpful because criminal incidents are dynamic and unpredictable. The order in which events take place, and the way evidence and information become available for collection, can be unpredictable. Thus, only flexible general rules to structured responses can be applied. However, no matter how events unfold or when the evidence and information are received, certain steps need to be followed. These include collection, analysis, theory development and validation, suspect identification and forming reasonable grounds, and taking action to arrest, search, and lay charges.

In any case, as unpredictable as criminal events may be, the results police investigators aim for are always the same. And, you should always keep the desired results in mind to provide focus and priority to the overall investigative process. We will talk more later in this book about developing a mental map of the investigative process to assist in recording, reporting, and recounting events. It is mentioned now because a mental map is an appropriate metaphor to illustrate the investigative thinking process.

In this process, even though the path we will take to investigate may be unclear and unpredictable at first, the destination, the results we seek in our investigation, will always be the same and can be expressed in terms of results and their priorities.

Results and priorities focus first on the protection of the lives and safety of people. They focus second on the priorities of protecting property, gathering and preserving evidence, accurately documenting the event, and establishing reasonable grounds to identify and arrest offenders.

Priorities refer to Level One Priorities, as the protection of the lives and safety of people. This includes the protection and safety of the police officer’s own life and the life and safety of other officers.

The Level Two priorities are the four remaining aforementioned results, and these may be considered equal value to each other. Depending on circumstances, a rationale can be made for choosing to concentrate on one Level Two priority at the expense of another depending on the circumstances presenting.

Investigative Response Priority Results

The critical point to be made here is that under no circumstances should an investigator ever choose to focus his or her efforts and attention to a Level Two priority if doing so would compromise the Level One priority of protecting the life and safety of a person, including police officers themselves. In the event that evidence is lost or destroyed, or that a suspect is not identified or apprehended because investigators were taking care of the Level One priority, that is a justifiable outcome. A response that would sacrifice the safety of people to achieve a level two priority would not be justifiable, and could even lead to civil or criminal outcomes against the investigators making such a choice.

Now that we have looked at the critical aspects of investigative tasks and the response priorities police investigators need to apply to decision making when they take action, we can proceed to examine the two different types of investigative response. We will refer to these as the Tactical Investigative Response and the Strategic Investigative Response.

Topic 3: Distinction Between a Tactical Investigative Response and a Strategic Investigative Response

These two different types of investigative responses are defined by the nature and status of the event that the investigator is facing. If it is an active event, it will require a Tactical Investigative Response and if it is an inactive event it will require a Strategic Investigative Response. It is important for an investigator to understand these two different levels of response because they include different response protocols, different legal authorities, and limitations to authority.

Tactical Investigative Response

Tactical Investigative Response is faced by operational officers who are engaged in the frontline response to criminal events. As mentioned earlier, police are often challenged to respond to events, sometimes life and death situations, where information is limited and critical decisions need to be made to take action. In these Tactical Investigative Responses, the responding officers often have little or no time to undertake the tasks of gathering information. They must rely on the information of a dispatched complaint, coupled with their own observations made once they arrive at the scene. If an officer takes the action of making an arrest or using force to bring the situation under control, they are accountable for the action they have taken, and they may be called upon by the court to articulate their thinking, albeit based on limited information.

Strategic Investigative Response

Once an investigator has arrived at the scene of an event and has brought the event under control by either making an arrest or by determining that the suspect has fled the scene and no longer poses a threat to the life or safety of persons, the investigation becomes a strategic investigative response. With this expiration of life and safety issues, also comes the expiration of exigent circumstances and the additional authorities to detain persons suspected and to enter and search private property without a warrant.

Clearly understanding and being able to define and articulate the circumstances of either an active event and tactical response, or a controlled event and a strategic response is critical. In court, it becomes important for a police investigator to describe what they were told going into the complaint, what they saw and heard when they arrived at the complaint, and, most importantly, what they were thinking to justify the action that was taken. For the court to be satisfied that the investigator acted lawfully, the judge needs to hear the investigator describe their thinking process to form reasonable grounds, or in some emergency cases, to have a reasonable suspicion that justifies the action taken.

To properly articulate their thinking in these investigative responses, it is important for the officer to understand the situational elements that can help define their thinking process when they testify in court. Two of the most important situational elements to understand are event classification and offence recognition.

Topic 4: Event Classification and Offence Recognition

In order to enter any investigation in either the tactical or the strategic response mode, an investigator must engage their thinking processes and make decisions about the event they are confronting. Is it an active event in progress that requires immediate and decisive tactical actions; or is it an inactive event where a less urgent, slower, and more strategic approach can be taken? This slower and more considered approach is the strategic investigative response, and the situational elements of this approach will be discussed in detail later in this chapter. Thinking about these situational elements of active event or inactive event is call event classification.

Considering the possible crime being committed in the event is called “offence recognition”, and this recognition of a specific offence activates the investigator’s thinking to look for the evidence that supports the elements of that recognized offence.

Topic 5: Classifying the Event as Either an Active Event or an Inactive Event

For each of these classifications of active event or inactive event, the investigator has some different legal authorities to put into action, as well as some immediate responsibilities for the protection, collection, and preservation of evidence. When attending the scene of any reported event, the investigator should assume that the event is active until it has been established to be inactive.

In many cases, an event can be re-classified as an inactive event when it is determined that the suspect has left the scene of the event, or the event has concluded by the suspect being arrested. In cases where the suspect is still at the scene of an active event, the investigator needs to be thinking about the possibility of detaining the suspect or making an arrest of that suspect for an offence in progress. To make that detention or arrest, the investigator should be thinking about what possible offence they are being called to investigate by the initial complaint, and also by the evidence they are seeing and hearing upon arrival.

The classification of active event or inactive event is critical. It is a distinction that will guide an officer to determine what powers of detention, arrest, use of force, entry to property, and search may be relied upon to take action. The defining elements between active event and inactive event are:

An Active Event

  1. The criminal act is or may still be in progress at the scene.
  2. The suspect is or may still be at the scene of the event.
  3. The situation is, or may be, a danger to the life or safety of a person, including the life or safety of attending police officers.

An Inactive Event

  1. The criminal act has concluded at the scene.
  2. The suspect or suspects have left the scene or have been arrested or detained.
  3. The situation at the scene no longer represents a danger to the life or safety of a person, including police officers.

Topic 6: Threat vs Action Analysis Dilemma

The critical elements of this Threat vs. Action Analysis Dilemma were demonstrated in what became known as “Active Shooter calls” flowing from the incident at Columbine High School in 1999 (Police Executive Research Forum, 2014). In this incident, two armed teenagers went on a shooting spree in the high school killing 13 people and wounding 20 others before turning their weapons on themselves and committing suicide. Officers responding to that call followed departmental protocols of that era. These protocols dictated they should wait for the arrival of their Emergency Response Team in events where armed suspect confrontations were taking place. The fact that these first responders waited despite ongoing killing taking place inside the high school led to a determination that police have a duty to take action in such cases, and waiting is not the correct response. As a result of these determinations, active shooter response protocols were adopted across North America and police agencies re-trained their personnel to respond to active shooters with more immediate action and strategies to enter and confront the shooters in order to protect lives of possible victims.

The Threat vs. Action Analysis Dilemma response protocols in the active shooter response situations now provide the standard or benchmark that a responding officer must consider when faced with the decision to enter a dangerous situation alone and take action, or to wait for back-up before entering to take action. For active shooter situations, the protocols across North America are now prescribed responses, where responding officers are trained to enter and confront with minimal back-up. That said, not every potentially dangerous Threat vs. Action Analysis Dilemma is going to be an active shooter. Responding officers will often be faced with other calls where danger exists to the safety of persons and the decision to enter or wait for back-up must still be made. In these cases, the responding officer must weigh the available information and respond or wait for back-up per their own threat vs risk assessment of the facts. The active shooter protocols have provided something of a calibration to this analysis where extreme ongoing threat to life and safety of person equals high duty and high expectation to take action.

Topic 7: Rules of Engagement for an Active Event or an Inactive Event

Police officers may be called to action by many different means. It may be a radio dispatch 911 call to attend an emergency, a citizen flagging down the passing police car to report an incident, or an officer coming upon a crime in progress. Whatever the means of being called to action, this is the first step of the police officer becoming engaged in a thinking process to gather and evaluate information, make decisions, and take action. The first step of this thinking process for the investigator is to make the evaluation and ask the questions:

  1. Is this an Active Event requiring a Tactical Investigative Response?
  2. Is this an Inactive Event requiring a Strategic Investigative Response?

As a subsequent part of this evaluation determining an Active Event or Inactive Event, the investigator should also be alert to the type crime being encountered. For example, is it an assault, a robbery, or a theft? From the perspective of police tactical investigative response, an investigator confronted with an active event must first assess the threat level. Is there a danger to the life or safety of persons that would require a Level One Priority Result, taking immediate action to protect life and safety of persons, including the life and safety of attending police officers?

In assessing these threat levels to life and safety, police are often faced with very limited information. Sometimes there is only a possible threat, or an implied threat to the life or safety of persons. In such cases, it is only necessary for the police to suspect that there is a threat to the life or safety of a person to evoke the extended powers provided by exigent circumstances. In these cases of implied threats, police are authorized to rely on the powers afforded by exigent circumstances to enter private property without a warrant and to detain and search suspects who may present a danger. These are significant powers and an investigator must be aware that if they use these powers, there is a strong possibility they will later be called upon to justify the exercise of those powers. Let us consider that section of the Criminal Code that authorizes officers to enter a dwelling without a warrant, and then apply that understanding to some scenarios:

Authority to enter dwelling without warrant under the Criminal Code of Canada

529.3 (1) Without limiting or restricting any power a peace officer may have to enter a dwelling-house under this or any other Act or law, the peace officer may enter the dwelling-house for the purpose of arresting or apprehending a person, without a warrant referred to in section 529 or 529.1 authorizing the entry, if the peace officer has reasonable grounds to believe that the person is present in the dwelling-house, and the conditions for obtaining a warrant under section 529.1 exist but by reason of exigent circumstances it would be impracticable to obtain a warrant. (Criminal Code, 1985, s 529(1))

Exigent circumstances
(2) For the purposes of subsection (1), exigent circumstances include circumstances in which the peace officer

(a) has reasonable grounds to suspect that entry into the dwelling-house is necessary to prevent imminent bodily harm or death to any person; or

(b) has reasonable grounds to believe that evidence relating to the commission of an indictable offence is present in the dwelling-house and that entry into the dwelling-house is necessary to prevent the imminent loss or imminent destruction of the evidence. (Criminal Code, 1985, s 529(2)(a,b))

Where warrant is not necessary pursuant to the Criminal Code of Canada

487.11 A peace officer, or a public officer who has been appointed or designated to administer or enforce any federal or provincial law and whose duties include the enforcement of this or any other Act of Parliament, may, in the course of his or her duties, exercise any of the powers described in subsection 487(1)(Criminal Code, 1985, s 487(1)) or
492.1(1) without a warrant if the conditions for obtaining a warrant exist but by reason of exigent circumstances it would be impracticable to obtain a warrant. (Criminal Code, 1985, s 492(1))

Scenario #1

A uniform patrol officer receives a call to attend a complaint through radio dispatch. The 911 caller is reporting that he has just witnessed his neighbour punch his wife in the front yard and then drag her forcibly into their house. The responding officer is immediately able to classify this event as an active event. The officer’s offence recognition of the criminal act is that it is likely an assault and possibly a forcible confinement. Given this assessment, the situation requires a Tactical Investigative Response. The suspect is still at the scene and there is an ongoing possibility of danger to the life or safety of the suspect’s wife. In this type of case, the officer can draw upon the extended powers under exigent circumstances to ensure the safety of the wife. Considering the information that has been reported, the officer may go to the residence with a view to using the necessary force to enter without a warrant to investigate the safety and well-being of the identified victim. If, after entering the home, further investigation provides evidence to confirm an assault, the officer can arrest the identified suspect for that offence. In this scenario, the information that allows the classification of the active event and the offence recognition is fairly clear in the reported circumstances.

Scenario #2

Sometimes an event cannot be immediately classified as either an active event or an inactive event. In these cases, where the information is less clear, the investigator may be justified to assume an ongoing danger to the life or safety of persons, and remain in the tactical investigative response mode utilizing the powers afforded under exigent circumstances to pursue the investigation until it is determined that an implied danger no longer exists. For example, consider the situation where police dispatch receives a 911 call from a woman crying. Before any further information can be obtained from the caller, the call is terminated from the caller’s end. A patrol unit is dispatched to attend the residential address associated with the identified phone number. Upon arrival at the front door of the caller’s address, attending officers are met by a male resident of the home who identifies himself as the home owner. The attending officers advise the male that a terminated 911 call from a crying woman was received from this address. The male states that there is nothing wrong in his home and he refuses to allow officers to enter the premises. The officers advise the male that they need to enter the premises to satisfy themselves that there is no ongoing threat to the life or safety of the crying woman caller. The officers warn the man that they will be entering the premises and if he resists he will be arrested for obstructing a police officer. 

The man steps aside and the officers enter the home and find a woman in the bedroom area with a bleeding nose and a bruised face. The woman tells officers that the male, her husband, punched her in the face during an argument and when she attempted to call police he ripped the phone cord from the wall and struck her again. She states that he threatened to kill her if she cried out when the police came to the door. The man is arrested for assault, forcible confinement, and uttering threats. He is provided with his Charter Rights and warning, and he is then asked if he wishes to make any statement.

To evaluate this scenario, the officers had very little information in the first instance that would allow them to make a determination of active event or inactive event. The information to identify a criminal act was equally limited. Fortunately, case law has evolved to recognize this kind of information-limited case, and it provides a framework for making a response that can protect life and safety. In such situations, an officer is still empowered to act under the authority of “exigent circumstances”. Considering information-limited circumstances like this, the officer only needs to have a suspicion that there is a threat to the life or safety of a person to act. That threat may be simply implied by the circumstances being presented. In this case, the implied threat to life or safety of a person was the disconnected 911 call. The officers had a duty to attend and resolve the possible threat to life or safety of a person implied in this disconnected 911 call (R v Godoy, 1999).

As you might imagine, an officer attending the calls outlined in the preceding scenarios needs to be very clear on the circumstances where implicit distress and exigent circumstances can be interpreted to use the powers to enter private property. This same need extends to using appropriate levels of force and making an arrest. Considering these are active and still evolving criminal events, there is urgency to act. It is critical for the investigating officer to have a clear understanding of these principles to quickly assess the presented facts, make the event classification, and take the necessary action in an expedient manner.

As outlined earlier in this book, there is a significant difference between reasonable grounds to believe and reasonable grounds to suspect, and an officer who is not clear on the distinction might have a difficult time articulating to the court how and why they took the initiative to act or not to act. It is these types of cases, where there is implied distress, or an implied threat to life or safety, that an investigator must be clear on their interpretation of the event and on their authorities to take action. The thinking involved might be described as an active event and an explicit or implied threat to life or safety equals exigent circumstances.

Active Event + Explicit or Implied Threat to Life or Safety = Exigent Circumstances

More on Offence Recognition

At the same time the event is being classified as either active event or inactive event, the investigator should be engaging in the thinking process of offence recognition. In other words, what offence is being reported or what is the offence being observed in the fact pattern that is unfolding? With this offence recognition, the investigator will begin to assemble a mental inventory of the evidence and information that will be required to support the recognized offence(s). Having an offence in mind, the investigator will also begin to consider their range of powers and authorities that can be used under the law regarding that offence. The investigator will ask them self;

If the investigator determines that they are attending to an Active Event and their offence recognition suggests that there may be a danger to the life or safety of a person, such as assault causing bodily harm, they will know that they need only find evidence to form reasonable grounds to believe in order to make an arrest. As part of attendance to the scene of the event, the investigator should be classifying the location to determine what their legal requirements are for their authority to enter. Consideration of the possible authorities to enter private property would include:

If the investigator arrives at the scene where a suspect is immediately apparent, the investigator can make an immediate detention or perhaps even an arrest. The investigator may rely on the Section 529 (2) of the Criminal Code of Canada (1985) under exigent circumstance to enter private property without a warrant to make the arrest and ensure the safety of persons at the scene. If the investigator makes an arrest after forming reasonable grounds for belief, they are required by the Canadian Charter of Rights and Freedoms to tell the suspect what offence they are being arrested for.

Required Warnings

The following is the standard Charter of Rights (Canadian Charter, 1982, s 10(a,b)) warning and police warning. These standard caution warnings are given as follows:

I am arresting you (or detaining you) for [name of offence(s)].

I wish to give you the following warning: You need not say anything. You have nothing to hope from any promise or favour, and nothing to fear from any threat whether or not you do say anything. Anything you do or say may be used as evidence.

Do you understand? (Transit Police, 2015)


You have the right to retain and instruct counsel without delay. You also have the right to free and immediate legal advice from duty counsel by making free telephone calls to [toll-free phone number(s)] during business hours and [toll-free phone number(s)] during non-business hours.

Do you understand?

Do you wish to call a lawyer?

You also have the right to apply for legal assistance through the provincial legal aid program.

Do you understand? (Transit Police, 2015)

Let us consider the following scenario to illustrate these principles in action.


An officer is dispatched to attend the complaint of an assault with a weapon and determines that it is taking place in a residential dwelling house in a nearby subdivision. Upon arrival, the officer is met on the front lawn by a man claiming to have witnessed the owner of the home stab a visitor to the home during an altercation as a second male runs out the front door holding his side and bleeding from an apparent wound. A third man holding a bloody knife comes to stand in the front doorway and the witness identifies him as the owner of the home. The officer directs the man with the knife to drop it on the ground and step out of the residence. The man complies and is arrested for assault with a weapon.

From this fact pattern the investigator could make an immediate arrest for assault with a weapon. The investigator would seize the bloody knife and protect it as evidence of that offence. The facts within this scenario that allow the investigator to take action, enter the private property, and form their reasonable grounds for belief and make the arrest. When the case goes to court, the investigator of this case will articulate the chain of events along with their thinking to substantiate their reasonable grounds for belief. To achieve this, the investigator’s testimony would be that:

The investigating officer arriving at the scene of this event would treat this as a Level One priority because there is an ongoing danger to the life and safety of persons. Under these circumstances, the Criminal Code authorities of exigent circumstances would apply. The investigator would be justified in detaining all parties present, including the witness and the victim, on the reasonable suspicion that they may all have been involved in combative behavior and might each still pose a threat to the life and safety of others, including the investigator. The powers of exigent circumstances are significant in this kind of scenario, and provide authority to take immediate action that will neutralize threats to the safety of people. Even if the facts of this assault with a weapon had evolved to show that it was taking place inside the private home of the suspect with the bloody knife, the authority of exigent circumstances would permit the investigator to enter that home without a warrant to protect the life and safety of persons. A very significant point to be made here is that as soon as the event is under control the extended powers of exigent circumstances expire.

Once this event has been brought under control and the threat to the life or safety of persons had been eliminated by arresting or detaining all persons present, the investigator must reclassify this event as an inactive event. As soon as this occurs, some of the rules of engagement and legal authorities to take action change, and the investigation must switch to a Strategic Investigative Response.

With the expiry of exigent circumstances and the switch to a Strategic Investigative Response, several factors change. If this assault with a weapon had been taking place in the suspect’s private home, and the investigator had entered under the authority of exigent circumstance, the authority to remain in the private residence and search it would expire. If the investigator needed to collect additional physical evidence in that home, such as blood from the stabbing assault, a warrant or consent to search would now be required.

In this type of case, the residence of the suspect could be locked down externally and all persons removed until a search warrant was obtained to complete the investigation. Evidence obtained up to the point where the arrest was made and before exigent circumstances expired would be lawfully seized without a warrant. This would include the seizure of the bloody knife as plain-view search or a search incidental to arrest. Anything else searched for and seized after the arrest could be challenged as an unlawful seizure if it was taken without a search warrant.

In addition to the requirement for search warrants, in some cases after exigent circumstances expire, other priorities and investigative must also change. As you will recall, the protection of life and safety of people is the Level One priority. With that priority, the court allows significant leeway to investigators in regards to the protection of crime scenes and the collection of evidence. If an investigator is attending any criminal event, the protection and collection of evidence always takes a backseat to the protection of life or safety of people. That said, once the life and safety issues have been resolved, the securing of the crime scene and the subsequent protection and collection of evidence becomes the number one priority.

Once the life and safety issues are resolved, it is time to lock down the crime scene and start protecting evidence for court. If it is possible to protect the life and safety of people and collect, protect, and preserve evidence, this is the preferred outcome. If it is not possible, the court will accept the fact that damage to evidence occurred prior to life and safety issues being resolved. Once those issues are resolved, the expectation is that a high level of care will be taken. If proper care is not taken, and evidence becomes contaminated, or continuity of possession is lost, the evidence may be ruled inadmissible at a trial. It is important for the investigator to fully grasp the construct that dictates when to transition from Tactical Investigative Response to Strategic Investigative Response.

Topic 8: Response Transition Matrix (RTM)

The RTM is a matrix tool to illustrate the considerations for police response when considering the authorities and issues to escalate or de-escalate from a Tactical Investigative Response to Strategic Investigative Response. Considering the following questions will help an investigator to identify an event as either a Tactical Investigative Response or a Strategic Investigative Response:

  1. Is the event active or inactive?
  2. What offence(s) is possibly occurring?
  3. Do I suspect an implicit or explicit danger to the life or safety of a person?
  4. Do I have reasonable grounds to believe evidence of an indictable offence will be lost or destroyed?
  5. What immediate actions can be taken to protect the life or safety of persons?
  6. What immediate action can be taken to protect evidence, without compromising life or safety?
  7. Have life and safety issues been resolved, and should the change be made from Tactical Investigative Response to Strategic Investigative Response?

The Canadian Charter of Rights and Freedoms, the Criminal Code, and common law authorities provide police with both powers to act and limitations to taking action. In the Canadian justice system, both statutory law and case law have evolved to establish a range of authorities and police powers that allow rapid response at the more dangerous end of the matrix, and more time-consuming restrictions to act at the less threatening end of the matrix. The chart below illustrates the duty to act, the authority to act, and the priorities for action to consider.



In this chapter, we have discussed the progression of the investigative process and the key elements within the progression that must be considered by an investigator. These elements within the investigative process are the signposts on the roadway of a mental map. These signposts of active event or inactive event tell us to either take action within the extended authorities of exigent circumstances or to modify our response for an inactive event and recognize the need to make the transition to a strategic response. An investigator’s understanding of the changes in circumstances that define these situations and the change from active to inactive events can make the difference between successful and unsuccessful investigative outcomes.

Study Questions

  1. What is the difference between investigative tasks and investigative thinking?
  2. What is the difference between Level One Priorities and Level Two Priorities?
  3. What is the difference between a Tactical Investigative Response and a Strategic Investigative Response?
  4. What is the difference between an active event and an inactive event?
  5. When would an investigator consider the Threat vs. Action Analysis Dilemma?
  6. When does an investigator have the authority to enter a dwelling house without a warrant?
  7. Why is it important for an investigator to thinking about “offence recognition” at the same time they are thinking about whether a situation should be classified as an active event or an inactive event?
  8. What is the Response Transition Matrix (RMT)?



Chapter 5: Strategic Investigative Response

Chapter 5: Strategic Investigative Response

“The STAIR model is a tool a new investigator can use to start structuring and developing their own investigative thinking processes.”

In this chapter, we will examine the operational processes of investigation. To this point, we have examined many definitions, concepts, and response protocols to set the stage for embarking on the strategic investigative response. If it can be said that there is a creative art anywhere in the processes of investigation, the strategic investigative response is where that creative art takes place. In this chapter, you will learn how each of the following concepts and processes relates to the strategic investigative response:

  1. Avoiding the three big investigative errors
  2. Recognizing the transition and implementing the strategic investigative response
  3. Describing investigation as a process within the justice system
  4. Utilizing the STAIR tool to work through the investigative process

Topic 1: Avoiding the Three Big Investigative Errors

In very fundamental terms, the three most common errors of the Strategic Investigative Response are:

  1. Failing to identify and collect all the available evidence and information,
  2. Failing to effectively analyze the evidence and information collected to identify suspects and form reasonable grounds to take action, and
  3. Becoming too quickly focussed on one suspect or one theory of events and ignoring evidence of other viable suspect or theories that should be considered.

From the moment a police investigator is dispatched to attend an incident, the opportunity to gather and evaluate information and evidence occurs. It is not uncommon for new investigators to operate under the misconception that all the available evidence and information is going to be readily available and apparent to them at the scene. This is the misconception behind Error #1: failing to identify and collect all the available information and evidence. New investigators often don’t understand that some information and evidence can be elusive and will exist in secondary source locations that must be sought out. There is no room for complacency in the processes of collecting information and evidence. The investigator must be engaged at an elevated level of awareness to access secondary source locations. Information and evidence about the event needs to be actively looked for, recorded, and preserved in a manner that can analyzed, interpreted, and eventually presented in court.

In the first instance of collecting information and evidence, an investigator may become engaged in the process through several different means. It may be receiving information as circumstances provided by the dispatcher in the details of a 911 call, it may be a report from a citizen on the street, or it may even be an on-view situation where the investigator discovers a crime in progress. From the moment the process begins, information will be incoming and available in the form of things that are seen and heard personally by the investigator, and this includes witnesses statements received. In most investigative responses, these are the first level facts that the investigator receives to guide the immediate event classification and offence recognition. But, this information of initial complaint and first observations are not all the information that might be available. There is usually much more information and evidence to be found. This is where the extended task of information gathering begins. Consideration of pre-crime and post-crime activities of the suspect can produce evidence not available at the crime scene. Database searches for records of the suspect, victim, and witnesses, can have great value. This is where the investigator must proactively search. There are many possible sources of additional information and evidence to consider, such as:

These information data sources can all add to the personal observations made by the investigator regarding the scene of the crime. These along with the appearance and demeanor of suspects, victims, and witness; and information provided by those suspects, victims, and witnesses about the event can speak volumes. Now, add to this the physical exhibits of evidence specific to the criminal event as each of these might have meaning in their immediate form or may provide future meaning through forensic analysis.

Having gathered all of the available information from each of the possible sources and locations we have avoided making Error #1.

To avoid making Error #2, we must now analyse the information we have collected. It is not just information about the event and the fact-pattern that are important, it is also information about the people involved in the event and how they are connected within the fact pattern. Criminal records and police records of each person associated to the incident can provide valuable perspectives, such as people’s reputation, credibility, association to past criminal conduct, or even event-related connections between the players.

Evidence and information gathered about the event only exists at face value until the investigator undertakes the proactive process of evaluation and analysis to determine the information’s relevance to the investigation at hand. It may seem that the implications and meanings of the available information and evidence should be clear and, sometimes in simple investigations, it is clear. Sometimes, what you see is what you get. If there are eyewitnesses describing a clear fact pattern and an identified suspect, the investigation will be a straight forward matter of collecting the evidence for presentation to the court.

That said, it is not often that simple in criminal investigations. Frequently, a suspect has not yet been identified and the fact pattern of the crime is unclear. Without a proactive process of evidence analysis, it is not possible to reconstruct the event and recognize the implications and connections within the multiple layers of evidence and information. The indicators of motive, opportunity, and means may not be immediately apparent. If an investigator goes to a criminal event and all they do is record the facts at face value and collect the evidence that is visible on-site, the job is only half complete. They are merely recording the crime.

The outcomes of analyzing information and physical evidence can be truly significant. A focussed effort to analyze physical evidence and information can often yield results that contribute to establishing a fact pattern, identifying a suspect, and forming reasonable grounds for arrest and charges. Let us consider again the example of the British Bow Street Runners (Hitchcock, 2015) who located a piece of wadding paper from the fatal bullet wound in the head of their victim. At that time, wadding paper was typically used when loading any firearm as a plug to compact the powder and direct the explosive force that discharged the bullet. Investigators could have easily recorded this exhibit and dismissed it as just another piece of wadding paper. Instead, they considered the implications. Their analysis of the information and evidence was done by comparing the torn edges of that wadding paper and making a physical match to the originating piece of wadding paper that was found in the pocket of their suspect. This critical piece of circumstantial evidence made the connection between the suspect and the crime, and it led to a conviction in court.

Error # 3 is commonly known as “tunnel vision”. Over the years, commissions of inquiry into wrongful convictions have often determined that investigators in those cases had allowed themselves to fall prey to tunnel vision (MacCallum, 2008; Kaufman, 1998), This tendency to focus on a single suspect or a single theory of events can be pervasive, and even when other viable suspects are present and the physical evidence does not support their theory, investigators have been seen to continue with a single minded focus. Tunnel vision has happened frequently enough that investigators are now cautioned to be self-aware that anyone can fall prey to this error. As part of proper major case management, investigative team members are encouraged to challenge each other when they believe that evidence is being misinterpreted and a single suspect or theory is being exclusively pursued to the point where other viable suspects and theories are excluded or ignored.

Topic 2: Recognizing the Transition and Implementing the Strategic Investigative Response

As much as the tactical investigative response is driven by urgent circumstances that require immediate and decisive action to reach successful outcomes, strategic investigative response is driven by the complexity of circumstances. The investigator will need to take a slower and more deliberate approach. This means observing the rules of law that are more demanding of due process and the rules of evidence that are more demanding of adherence to protocols for crime scene management, evidence preservation, and evidence collection.

The situational elements that define a strategic investigative response are essentially the opposite of those for tactical investigative response. Specifically, the scene is now an inactive event because the suspect has left the scene or has been arrested, and there is no ongoing explicit or implied danger to the life or safety of persons including police. In the strategic investigative response, the Level Two priorities of protection of property, gathering and preserving of evidence, accurately documenting the event, and establishing reasonable grounds to identify and arrest suspects now become the paramount concerns. Switching from a tactical investigative response to a strategic investigative response is a transition point where mistakes can occur. These mistakes happen because the need to shift is not recognized and the transition to Level Two priorities is not engaged. The switch from an active event and tactical response to an inactive event and strategic response means locking down the crime scene to protect evidence and obtaining a warrant to continue the search for evidence.

This failure to transition may happen because the officers attending the scene of an active event are intensely focussed on the issues of protecting life and safety. Once those very critical issues of life and safety are resolved, the adrenaline is still flowing and shift to Level Two priorities can seem less significant than it really needs to be. Investigators need to be aware and recognize the requirement to transition to strategic investigative response and make it happen.

Topic 3: Describing the Investigation Process Within the System

Strategic investigative response process is slow-paced and deliberate. In this response there is a priority to collect and record the maximum amount of information and evidence for court. These tasks of strategic response include witness management, crime scene management, evidence collection, and documenting the event.

Once the determination has been made that the investigation is in strategic investigative response mode, the priorities for results change, and the investigator must start organizing their investigation of the crime being encountered. In cases where the circumstances are simple and the suspect is immediately apparent, this can be a straightforward matter of evidence collection and witness interviews. In other cases, where the facts of the case are not clear or the suspect is not immediately apparent, the tasks of investigation can be daunting, and it requires a more systematic approach. A thorough investigation is one with systems to:

It may be helpful to think about the Strategic Investigative Response like a big funnel where many sources of information and evidence pour data into the top of the funnel. That data passes through the investigative filters of analysis to determine the possibilities, developing theories to identify the best probabilities, and investigating to test those theories against known evidence and facts. It narrows itself down to inculpatory evidence that will support reasonable grounds for belief, or exculpatory evidence that will show innocence and eliminate suspects. Sufficient inculpatory evidence can tip the scale to give police reasonable grounds for belief to take action of arrest and finding proof of guilt beyond a reasonable doubt provides the court with the ability to make a finding of guilt. Exculpatory evidence tips the balance to support the presumption of innocence for the accused.


Topic 4: Utilizing the STAIR Tool to Work Through the Investigative Process

At this point in our study of the investigative process, it is necessary to examine a structured process for strategic investigative response. To illustrate a system for strategic investigative response that can assist an investigator in thinking through the investigative process, we will use a model called the STAIR tool. Organized thinking and the ability to articulate a structured response cannot flow from a disorganized process. Through experience over time, most police investigators learn to structure their thinking, their investigative process, and their response priorities. Each investigator learns to build one’s own mental road map.

The methods and mental mapping of the STAIR tool illustrated here are not an attempt to change the current reality of investigative thinking, it is merely the model of a process to illustrate the thinking used by many investigators. A new investigator can use this tool to start structuring and developing an investigative thinking processes.

Every day, operational police officers are tasked to respond to incidents in a never ending variety of scenarios. Arriving at the scene of an incident, the police investigator is usually at the disadvantage of not knowing many of the facts. The investigator is challenged to gather the available information and analyze what is relevant with a goal of responding quickly, effectively, and appropriately. An effective and appropriate response is a response where the investigator has made decisions according to a predetermined set of priorities. For the investigator, these priorities and the desired results should always be protecting the life and safety of persons, protecting property, gathering and preserving evidence, accurately documenting the event, and establishing reasonable grounds to identify and arrest offenders. With these results in mind, we can start by remembering that in every reported incident, a police investigator is met with a situation Situation that must be resolved. With this situation understood immediate Tasks must then be undertaken to protect life and safety, gather relevant information, preserve evidence, and identify offenders. Lastly, in every situation, the information discovered must be Analyzed to inform and guide the Investigation that must happen to reach the desired Results.

To become more self-aware, an investigator might imagine oneself working through this process and creating a mental map of the road to be traveled for each investigation. This mental map can later be articulated, describing one’s thinking process and responses, observing the law as rules of the road, describing landmarks of evidence, navigating curves in the fact patterns, backing out of the dead ends of false leads, and validating the evidence discovered that led to a final destination. Ideally, that destination is the positive identification of a suspect and sufficient evidence to make an arrest and provide the court with proof beyond a reasonable doubt.

Later, when preparing notes, reports, court briefs, and testifying in court, the investigator will be able to recall their mental map and articulate their decision-making process to form the necessary reasonable grounds for belief to take action. If the crime remains unsolved and the investigation concludes as a cold case, the notes and reports describing the mental road map of the investigation remain on file for the next investigator who will be able to gain a clear picture of the investigation to date.

SITUATION: achieving a big picture view of the event to classify and prioritize a response
TASKS: focus on the results and the priorities of those results based on event status
ANALYSIS: examining the reported facts, the observed facts, and the physical evidence
INVESTIGATION: validating the facts through corroboration of witness accounts and evidence
RESULTS: prioritizing and focussing on the results to guide the investigative process


Please note: The STAIR investigation tool as developed and depicted in this book is based on the author’s conceptual modification of the STAR technique which is commonly used as a tool for behavioural interviewing. 


In this chapter, we have focussed on the strategic investigative process and described the STAIR tool as a means of illustrating and working through the investigative process. This is a process that can be likened to climbing a set of stairs, whereby getting to the top (Results) requires taking one step at a time from the bottom (the Situation). The second step (Tasks) then leads to a third step (Analysis) and the fourth step (Investigation). At this point, the investigator can expect to take a step back more than once to do further Analysis. In any case, the goal is always to get to the top of the stairs. Skipping any of these steps will likely lead an investigator to miss an important part of the process.

As with the preceding chapters, the intent here is simply to assist you in defining and visualizing the investigative process. This delineation should help you to conceptualize investigation as a structured process. This is a process consisting of practices of information and evidence collection, analysis, theory development, and investigative planning, pointing toward achieving consistent outcomes. In the chapters that follow, you will be challenged to apply this thinking in some scenario exercises.

Study Questions

  1. What are the three most common errors investigators make in applying the Strategic Investigative Response?
  2. What five groups of tasks must an investigator follow through on to complete a thorough investigation?
  3. What categories of tasks are involved in the Situation component of the STAIR tool?
  4. What categories of tasks are involved in the Tasks component of the STAIR tool?
  5. What categories of tasks are involved in the Analysis component of the STAIR tool?
  6. What categories of tasks are involved in the Investigation component of the STAIR tool?
  7. What categories of tasks are involved in the Results component of the STAIR tool?


Chapter 6: Applying the Investigative Tools

Chapter 6: Applying the Investigative Tools
“As you proceed through the STAIR tool, the process of Analysis and Investigation can become somewhat circular – as the investigation reveals new information, and new information is analyzed to confirm, disprove, or modify the theories of suspects and events that are being considered.”

In this chapter we will work through some investigative STAIR scenarios to demonstrate the required investigative awareness required to transition from the tactical investigative response to the strategic investigative response. Once in the strategic response mode we will practice applying theory development to conduct our analysis of the evidence and information found and we will create investigative plans.

This chapter presents two investigative scenarios each designed to illustrate steps of the STAIR tool allowing the student to recognize both the tactical and the strategic investigative responses and the implications of transitioning from the tactical to the strategic response.

In the strategic investigative response of the second scenario, the student is challenged to work through an exercise of identifying the available information and evidence and developing theories in order to guide their investigative plans.

Topic 1: Beginning With Your End in Mind and Focusing on Results

Any investigation an investigator embarks upon must focus on the desired Results to guide the thinking and investigative action. If we know where we are going and what our results need to be, we will know how to prioritize our actions to reach those results. Setting and monitoring priorities is a critical piece of the mental mapping process. A police investigator needs to know that whatever course of action taken to achieve a result, it will be incumbent upon the investigator later to provide a reasonable and justifiable explanation of how and why that chosen course of action was taken. Understanding and keeping these Results in mind while entering a Situation allows better clarity to define the priorities and develop the immediate investigation and action plan.

As mentioned above, in defining and assigning priorities to the Results, the top priority is very clear: protecting the life and safety of persons. Achieving the other priorities will sometimes be sacrificed to make certain this primary priority is achieved. Protecting property, gathering and preserving evidence, accurately documenting the event, and establishing reasonable grounds to identify and arrest offenders are all important, but are considered secondary results. These individual Results may also sometimes be sacrificed, one in favor of the other, depending on the way events unfold. The setting and defining of priorities for Results will be further illustrated and practiced in several scenarios presented below. For now, with our Results concept in mind, let us apply the STAIR tool in the following scenario.

Scenario #1

You are working as a uniform patrol officer in a one-person marked police cruiser. It is 9 PM on Saturday evening, and you receive a radio call from dispatch assigning you to attend a domestic dispute complaint in a residential neighborhood. Dispatch advises you that the call has been received from a neighbor to the home where the domestic dispute is taking place.

The caller, Bill Murphy, reports to dispatch that he heard a woman screaming and, when he went outside, he saw his neighbour, Randy Smith and Randy’s wife, Jane, standing on their front lawn yelling at each other. He then saw Randy strike Jane in the face with his fist, and drag her by the hair back into the house. He can still hear them yelling, and he heard some crashing noises coming from their house. He does not know if there is alcohol involved, although he does know that Randy often drinks heavily. No weapons were seen, and the neighbor does not know if Smith owns any firearms. The Smiths have two young sons, eight years and four years of age. The neighbor did not see the two boys.

In this Situation phase of our STAIR tool, you have been provided with a limited amount of information. You start by breaking down the information into components:

Keep in mind that to investigate this incident and to act in the execution of your duties, each piece of the foregoing information may be considered and acted upon as the truth, until it has been verified. Each piece of information here can contribute to the forming of reasonable grounds to enter onto private property or to make an arrest. Each piece of information you have can assist in forming beliefs regarding the safety of persons.

Remember that we begin with our end in mind considering our Results. At this stage of the investigation, there appears to be an immediate threat to the safety of Jane Smith. Domestic disputes are always emotionally charged situations, and it is reasonable for attending police officers to consider that their own personal safety will also be at risk. This is definitely a Level 1 Results priority.


As you proceed to attend to the area of the call, you embark upon the Tasks portion of the STAIR tool.

Task 1: Responding in the Correct Mode

In this case, the report identifies an active event where the suspect is still at the scene and criminal activity may still be in progress. You will be responding in Tactical Investigative Response mode.

Task 2: Identifying the Players in the Event

Task 3: Breaking out the Facts of the Event

In this case, possible criminal actions witnessed by the neighbor indicate that an assault has taken place. The wife was struck in the face and dragged into the house. There may be a forcible confinement taking place. Your offence recognition, in this case, is focused on two possible offences: assault and forcible confinement. You recognize that each of these offence types is an indictable offence for which an arrest can be made if you form reasonable grounds to believe the offence(s) have been committed by Randy Smith.

Task 4: Gathering All Additional Information That Might be Available

Faced with these circumstances, additional information would assist in making a risk/threat assessment. You proceed to the CPIC and PRIME – RMS databases to determine:

From CPIC, you determine that Randy Smith, of this address, has a record for Impaired Driving. There is no criminal record for Jane Smith. Police Records Information Management Environment (RMS) shows a previous complaint of a domestic dispute at this same residence 11 month ago. At that time, Randy Smith was arrested but not charged with assault. Jane Smith, the complainant in that case, would not proceed with charges, and there were no independent witnesses to the assault.


For a police officer attending the scene of an in-progress event, it is important to consider the issues of safety and ongoing threats to safety to know how best to approach the scene and what immediate actions can be taken. As is the case with many in-progress events, there is a concern for the safety of all persons. In this case, the wife, Jane Smith, has reportedly been assaulted and dragged back into the premises. There are possibly two young sons also at the premises. Whenever there is a concern for the safety of persons, exigent circumstances exist and a police officer has extensive powers for the entry onto private property, if necessary, to detain any persons present to secure the scene and stop the continuation of an offence.


Considering the explicit threat to the safety of Jane Smith, and a possible implied threat to the safety of the two sons, the issue of the safety of persons here is clear. Since this is a domestic violence complaint, there is also an implied danger to all police officers attending that must also be considered. In this case, you call for a backup patrol unit to attend. Your tactical investigative response plan is to approach the premises using concealment and cover as you and your backup unit assess what you can hear and see as you approach the scene.

You decide that if you do not hear or see any ongoing immediate threat, you will approach by knocking on the front door and making contact. If you do see or hear evidence to indicate there is an ongoing threat to the safety of a person (e.g. ongoing assault), you know you can enter the premises without a warrant under exigent circumstances to protect the safety of persons. You know you have an eyewitness to the offence of assault, and, with this piece of witness evidence alone, you have formed reasonable grounds to believe the offence of assault has taken place. The added information of possible alcohol involvement and past record of domestic assault complaints can be considered in the evaluation of the threat level to engage the extended authorities of exigent circumstances.

As you walk towards the house, the neighbor/witness, Bill Murphy, approaches you and states that Randy Smith just left the premises alone in his blue Dodge truck. You can see a woman and two young boys looking out the front window of the premises.

Your event classification now must change to an inactive event, and you transition to a strategic investigative response mode. The Results priorities now change as well. Your new priorities become:

  1. Gather and preserve evidence:
    1. Interview witness Bill Murphy
    2. Interview the victim Jane Smith
    3. Take photographs of any injuries to the victim
    4. Determine if there are other witnesses available
    5. Determine if other physical evidence, weapons, and/or liquor bottles are present
  2. Accurately document the event
    1. Take the statement of witness Bill Murphy
    2. Take statement of the victim, Jane Smith
    3. Make personal notes
    4. Complete an occurrence report
  3. Establish reasonable grounds to identify and arrest an offender
    1. Verify that an offence has occurred
    2. Verify the type of offences (e.g. assault, or assault causing bodily harm, and/or forcible confinement, and possibly impaired driving)
    3. Verify the identity of Randy Smith as the person responsible for identified offences
    4. If an offence and an identity of the suspect are verified, broadcast a “Be On Lookout For (BOLF)” to arrest Randy Smith for assault

In this case, the offender was easily identifiable. This is true of many in progress occurrences that police attend. These types of cases are often handled in the progression described above, starting off as a tactical investigative response and transitioning to a strategic investigative response mode.

In cases where the offender is not immediately identifiable, or the fact pattern of the event is not clear, the investigation becomes more complex and protracted. These are the cases where the strategic investigative response will include analyzing the information and evidence to develop theories, to identify possible suspects, and to test possible fact patterns against the physical evidence and timelines.

To examine this process of strategic investigative response, we will look at a more complex scenario where additional skill sets and strategies need to be considered within the STAIR Tool.

Scenario #2

You are in a marked patrol vehicle, and you are dispatched to attend a local jewelry store where a robbery has just taken place. It is August 15, 2017, 4 PM on Saturday. The store is in a strip mall complex on the main street of your city. You arrive at the scene to take the complaint and investigate.

The store manager reports that at approximately 3:30 PM, three suspects entered through the front door of the store from the front parking lot. All three suspects were wearing ski masks, gloves, blue jeans, and dark jackets. All three were armed with handguns. One suspect stood guard at the front door and the other two entered the store yelling at everyone to lay face down on the floor. There were three customers in the store: two elderly women shopping together and one young woman approximately 25 years of age.

There were also two store employees working at the time. One is the store owner/manager and the other is a female sales clerk. After everyone was on the floor, the two men started smashing glass display cases and dumping the contents into white cloth bags that they had with them. One robber demanded that the manager open the cash register, which he did. There was only approximately $350 in the cash register, which was typical because most customers use credit or debit cards. The manager estimates that approximately $120,000 worth of inventory was stolen. The most valuable items taken were diamond rings and high-end designer wrist watches. Watches have serial numbers and are identifiable, and some of the diamonds are identifiable by laser micro-engraving.

The entire robbery happened in just under five minutes and, when the robbers left the store, they ran south around the corner of the building. No vehicle was seen.


Using the STAIR tool, as you approach the scene, you are aware that the suspects have left the crime scene and this is an inactive event. Although aware of the possibility that you may see suspects leaving the area of the crime scene, your arrival and approach to the crime scene do not require the tactical investigative response of an active event. The immediate danger to the life and safety of persons at the crime scene has passed. You are in the strategic investigative response mode. Beginning with your end in mind, you now consider what will be the Results for this case:


With our Results priorities clearly in mind, you now undertake some specific Tasks of the STAIR tool:

After completing your victim and witness interviews and your database searches, you have the first pieces of information from which the Analysis component can begin. Your forensic team is at the scene dusting for fingerprints and photographing the damage.


As mentioned above, STAIR will assist in developing strategies to guide the Investigation efforts. Based on the Strategic Investigative Response Funnel, all incoming information is flowed into the top of the funnel to start the process of analysis. The analysis begins by considering each of the individual known facts about the incident. In this case, the facts to be considered include:

To continue this Analysis, we start by reflecting on some of the theories we might evolve considering the facts of this case. This will begin the process of developing theories and formulating investigative plans to identify suspects and search for new evidence that either confirms or disproves those theories.

  1. What theories might you have about the time and location of this offence?
  2. Can you develop any theories about the level of planning that went into the robbery?
  3. Consider theories about how well these three suspects know each other.
  4. Is it possible that the suspects had been at the store sometime prior to this robbery?
  5. What relevant theories might be considered from the way the suspects were dressed?
  6. What relevant theories might be considered from the fact that the robbers carried handguns?
  7. What theories might be considered from the way the robbery was carried out?
  8. What theories might be considered regarding the items taken?
  9. Theorize and consider if these three suspects were working alone.
  10. Theorize who else might be involved.

Think about the fact pattern of this incident and answer these questions. In this process, you will engage your imagination and your deductive reasoning skills to consider the possibilities and develop theories to guide your investigative plan going forward. In this step of the Analysis process in the STAIR, what logical theories can you develop to explain how this crime may have been committed, and who may have been involved? Try and develop at least two or three alternate theories. As you answer each question, consider different avenues of investigation you might follow to confirm or disprove some of your theories. Can aspects of your theories be confirmed or disconfirmed against an examination of the existing physical evidence?


As you proceed through the STAIR tool, the process of Analysis and Investigation can become somewhat circular, as the investigation reveals new information, and new information is analyzed to confirm, disprove, or modify the theories of suspects and events that you are considering.

Do your theories present any avenues where you can investigate further to gain additional information?

Outline your own analysis, assumptions, deductions, and theories. Outline the further avenues for investigations that you can undertake in this case. After you have completed your own analysis, theory development, and investigative plans, move to the end of this chapter and check your assumptions, analysis, theories, and investigative plans against the answers provided there.

Topic 2: Getting Answers in the Robbery Scenario

  1. What theories might you consider about the time and location of this offence?
    • The fact that the jewellery store is in a strip mall may have been a factor in the robbers selecting this location as a target. This type of business premises allows for drive by viewing of the inside of the premises, as well as quick access and exit to the outside parking area. This location also allows for the suspects to maintain an ongoing look-out for approaching police response.
    • The time of the offence could have been intentionally chosen closer to the end of the day on a Saturday in the hope that more cash would be in the store. Depending on the typical customer traffic volume in the mall area on a Saturday, the suspects may have hoped for more traffic volume to assist with their escape.
  2. Can you develop any theories about the level of planning that went into the robbery?
    • Since the suspects arrived in disguise, armed with handguns, and carrying bags to take away the proceeds of the robbery, it might be theorized that they took some time to put together this special equipment to carry out the crime.
    • The precision with which the robbery was carried out (e.g. completed in five minutes, one suspect guarding the door, all persons ordered onto the floor) would indicate a high level of planning to orchestrate this robbery.
  3. How well did these three suspects know each other?
    • It is very likely that the three suspects knew each other well enough to establish the level of trust required to carry out the robbery.
    • The type of goods taken in this robbery, except for the cash, would need to be converted to cash to be divided up later. This could indicate that a longer term relationship exists between these robbers.
    • The planning that is apparent would indicate that the suspects spent some time together to plan, collect the necessary equipment, and divide up the proceeds of the robbery.
  4. Is it possible the suspects had been at the store sometime prior to this robbery?
    • To plan this robbery and execute it with this level of precision, it is very likely that the suspects spent at least some time looking over the premises and the surrounding area to plan their approach, execute the robbery, and plan their escape.
  5. What relevant theories might be considered from the way the suspects were dressed?
    • It appears that all three suspects were wearing similar outfits with dark jackets, blue jeans, and ski masks. This may indicate that the suspects deliberately purchased specific gear for committing a crime.
    • This clothing might be considered somewhat non-descript, and not easily distinguishable or unique for a witness to accurately or specifically describe the fleeing suspects. The use of masks and non-descript outfits might indicate that the criminals were experienced.
    • The fact that they are all wearing jackets on a summer day in August might indicate that they were covering up tattoos, scars, or other distinguishing features that might otherwise assist in identifying the suspects.
    • The fact that all suspects were wearing gloves would indicate that they are aware that any fingerprints left behind could identify them.
  6. What relevant theories might be made from handguns being carried by the robbers?
    • Handguns are more easily concealed and may be the weapon of choice for more professional criminals.
    • Handguns are more difficult to obtain, and legal handguns are generally registered, so it is likely that these were unregistered or stolen handguns.
  7. What might be theorized from the way they carried out the robbery?
    • From the overall planning and precision in the execution of the robbery, it might be theorized that this is not the first robbery that these three have done together. This method may have been used elsewhere.
  8. What might be theorized considering the items taken?
    • Considering that the items taken were specialty items and that some were marked with identifying serial numbers, it might be theorized that the robbers have a prearranged or preplanned means of disposing of the items or otherwise converting them to cash.
    • Alternately, the fact that they have taken items that are identifiable by serial numbers may indicate a level of haste or even inexperience because these items, if discovered after being sold, may be traced back to the robbery suspects.
  9. Were these three suspects working alone?
    • Considering the speed of execution and the apparent level of planning that went into this robbery, it is possible that there was a fourth accomplice waiting outside in a get-away vehicle.
    • There is a possibility that the suspects had some inside knowledge of the jewellery store and the inventory through association with a person connected to the store.
  10. Who else might be involved?
    • A fourth criminal associate as a get-away driver and lookout.
    • A customer inside the store, at the time of the robbery, acting as a scout.
    • A current or former employee of the store may have provided inside information.
    • The owner/manager of the store could be involved as part of an insurance fraud scheme.

Topic 3: Answers to Possible Theories in the Robbery Scenario

Theory #1

This is a well-planned robbery executed by three or four experienced criminals. In addition to the three suspects in the store, there might have been an outside get-away driver acting as a lookout. They intentionally selected this store because of the strip mall location and the easy access to inventory by smashing the display cabinets. They were wearing disguises and jackets to avoid facial identification and possible tattoo or scar identification. They were wearing gloves probably because they already have criminal records and know that any fingerprints left behind may allow for the suspects to be identified. The suspects gained the information to execute their robbery by conducting surveillance on the store. They intentionally selected the date and time to conduct the robbery because of customer traffic patterns. They have some means of converting or disposing of the stolen items for cash. Considering the precision of the crime, this is likely not their first robbery of this type. The possession of handguns also indicates they are likely professional criminals.

Theory #2

As with Theory #1, this is a well-planned robbery executed by three or four experienced criminals; however, the store was selected because they had an inside person, employee, or former employee working with them, and were provided with information to assist in the plan.

Theory #3

As with Theory #1, this is a well-planned robbery executed by three or four experienced criminals; however, the store owner/manager is a conspirator in the robbery, and assisted with the offence to collect insurance with the possible additional intent to be the person who resells the stolen merchandise. If this is the case, the owner/manager may be providing an inflated inventory of items taken or perhaps incorrect serial numbers for the items taken to allow for the stolen items to be more easily disposable.

Topic 4: Answers – Investigative Plans From Theory Development

Do the theories above present any avenues where you can investigate further to gain additional information?

Theory #1

 Theory #2

Theory #3

Topic 5: Validation of the Report

Based on the theories considered in our robbery investigation, everyone present in the jewellery store at the time of the robbery is being considered a possible suspect. This is a part of analysis and theory development called validating the report. In criminal investigations, it occurs time and again that people reporting criminal events will lie, fabricate, or embellish, the facts. These failures to provide an accurate account of what happened occur for a variety of reasons, including, but not limited to:

With these kinds of motives in mind, an investigator analyzing and validating the facts and developing a theory of the crime should always consider four key questions to authenticate the crime report:

  1. Does the evidence support the report that an offence occurred?
  2. If an offence did occur, did it happen at the time being reported?
  3. If an offence did occur, did it happen at the place being reported?
  4. If an offence did occur, did it happen the way the fact pattern being reported suggests (Arcaro, 2009)?

Thinking about these questions as part of the Analysis can help the investigator to formulate possible theories and develop effective investigative plans.

At this point in the investigative process, as theories are developed and tested, additional new facts are discovered. With the discovery of new facts, the Analysis and Investigation steps of the STAIR tool become, as noted earlier, a bit of a circular process, where a new fact can confirm, disprove, or modify a theory, and a new investigative plan may evolve in a new direction seeking the formation of reasonable grounds to believe a particular suspect is responsible for the offence.

Topic 6: Evidence Transfer Theory

In our robbery scenario, the reported fact pattern appears to be fairly clear. The investigative strategies being planned are aimed at suspect identification as a first goal. But, once a suspect or suspects have been identified, because of some circumstantial association or linkage to the crime scene, it does not mean they can immediately be arrested. Often, these kinds of linkages are sufficient to only provide grounds for suspicion and are not enough to form reasonable grounds for belief to make an arrest.

The ability to link a suspect back to a crime and to form reasonable grounds for belief to make an arrest can depend on the existing evidence transfer. Evidence transfer means that evidence will transfer from a suspect to the crime scene, a suspect to a victim, from the crime scene to the victim, or from the crime scene to the suspect. Modern forensic science has evolved into forensic specialties that look for evidence transfer. For example, with the advances being made in DNA science, evidence transfer is becoming more refined allowing the analysis of ever smaller samples for comparison (Savino, 2011).

Remarkably, it is not just DNA or fingerprints that can contribute to connecting a suspect to a criminal event. Hair and fibre, shoe prints, tool marks, bite marks, ballistics, and other forensic exhibits do contribute to the range of comparison tools. We will discuss these more in-depth later in our chapter on forensic evidence; however, the point is that forensic comparisons are only one form of evidence that is developed to create circumstantial connections between a suspect, the crime, and/or the victim.

Topic 7: Spatial Relationships and Timelines

Other circumstantial evidence can be illustrated that connect suspects to the crime through relationships, associations, and chronology. This type of circumstantial evidence can include exhibits and witness statements that demonstrate spatial relationships. Spatial relationships are circumstantial links that demonstrate connections between objects, events, or people. This can be any type of evidence that demonstrates a connection or relationship between the suspect and the criminal event or the suspect and the victim. It could also be evidence that demonstrates where a suspect was during the critical times when the crime was occurring.

Recall the example of the young man standing behind a tree one block away from the scene of the warehouse break in. This was an example of both timeline evidence, namely being present at the scene when the event took place, and spatial relationship evidence, namely being one block away from the crime scene. This kind of evidence can be considered by the investigator in forming reasonable suspicion and reasonable grounds to believe and take action at a later point in time.

Topic 8: Timeline Evidence

Timeline evidence is any item that demonstrates a time alignment of the suspect to the criminal event or the victim. Spatial relationship evidence comes from items that demonstrate other types of connections, relationships, or associations. Consider for example, the following scenario.


The body of a young woman is found by a janitor in the utility storage area of a local airport at 12 noon. It appears that she was sexually assaulted and murdered shortly after arriving on a domestic flight AC204 from a neighbouring city. This is confirmed by the boarding pass still in her pocket for Seat 16A that shows her arrival time at 10 AM.

Another airport employee is identified as a possible suspect because security cameras show him in the area of the utility storage area at 10:45 AM. Upon questioning, it is determined that he had also been on flight AC204 and that his boarding pass was for seat 16B.

A search of the suspect’s pockets shows that he has a key that opens the utility storage closet where the victim’s body was found. In this case, there is both timeline evidence and evidence of spatial relationships.

Timeline evidence would include:

This timeline evidence provides some significant information, as it establishes a time range when the crime occurred and it establishes that the suspect was at the airport during the possible time of the crime.

Topic 9: Spatial Relationship Evidence

It is important to note here that the items of evid, in this case, ase are not forensic exhibits such as fingerprints or DNA that might draw a definite link between the suspect and the crime. They are instead linkages in times and common locations within those times. These connections within time and locations are spatial relationships, and although this circumstantial evidence from spatial relationships alone is not sufficient to prove guilt beyond a reasonable doubt, it is often sufficient to form reasonable grounds to believe that an individual is implicated in the offence. In this case, the suspect would be detained and cautioned. Additional forensic evidence collection and interrogation would follow to develop reasonable grounds for belief and possibly the grounds to lay a charge, if additional forensic evidence could be developed.


In this chapter, we have worked through some scenarios demonstrating the application of the STAIR tool in both tactical and strategic investigative processes. In working through the strategic process, we have practiced examining the fact patterns of events and making the assumptions to drive theory development directing the engagement of our investigative plans. This is truly the creative art of the investigative process and, as such, it is a process that can be enhanced through practice and experience. This can also be a great opportunity for collaboration and teamwork where brainstorming sessions take place to analyze the facts, develop theories, and develop investigative plans. Along with theory development and investigative plan making, we have examined the ways physical and circumstantial evidence of spatial relationships can be used to confirm, negate, and modify theories and investigative plans.

Study Question

  1. Why must the investigator have the Results in mind at the outset of an investigation?
  2. What are five reasons some people reporting a criminal event lie, fabricate, embellish, or misrepresent the facts?
  3. What are four key questions an investigator should consider in authenticating a crime report?
  4. What is meant by evidence transfer?
  5. What is spatial relationship evidence?
  6. What is timeline evidence?



Chapter 7: Witness Management

Chapter 7: Witness Management

“Different types of witnesses will provide evidence from different perspectives, and these perspectives need to be assessed by the investigator to establish the reliability of the evidence provided.”

For any investigation, the details of events provided by witnesses are a critical element of the evidence gathered. Witness testimony is the verbal account of events or knowledge of the facts relevant to the crime. Witness statements will assist the investigator in forming reasonable grounds to lay a charge and will assist the court in reaching a decision that the charge against an accused person has been proved beyond a reasonable doubt.

As the law has evolved regarding witnesses, many rules of evidence, definitions, and protocols have developed to govern the way witnesses may testify in court. It is important for an investigator to understand these elements as this allows an investigator to evaluate witnesses and collect witness evidence that will be acceptable to the courts. The purpose of this chapter is to discuss the following concepts as they relate to the process of witness management.

  1. Identifying witnesses
  2. Defining witness types
  3. Defining competence and compellability
  4. Identifying the witness/suspect dilemma
  5. Witness credibility assessment
  6. The truthfully-incorrect witness
  7. Recognizing dominant witness influences and conformity
  8. Dealing with uncooperative witnesses
  9. Conducting witness interviews
  10. The field interview

Topic 1: Identifying Witnesses

It is sometimes the case that persons found as apparent witnesses to an event do not always provide accurate information about their identity. The reasons for this deception can vary from actual involvement in the crime to fear of reprisals from the suspect to simply not wanting to become involved with the criminal justice system. Regardless of the reason, it is imperative for an investigator to verify the identity of each witness. This can be best achieved by viewing a valid photo ID or, in the absence of photo ID, by establishing the witness’ identity through other means, such as police records, confirmation of identity, or verification of identity by a credible third party.

Topic 2: Witness Types

Once the identity of a witness has been determined, an investigator needs to establish an understanding of the witness classification. Different types of witnesses will provide evidence from different perspectives, and these perspectives need to be assessed by the investigator to establish the reliability of the evidence provided. This is important for several reasons, including that if charges ever go before the court, a judge will also consider these witness types and apply appropriate rules of evidence and levels of probative value to the evidence each type of witness provides.

Eye Witnesses and Corroborative Witnesses

As discussed in previous chapters, evidence can be classified as either direct evidence indirect circumstantial evidence. An eyewitness is a person who directly saw the criminal event take place, while a corroborative witness is a person who can only provide circumstantial or indirect evidence of the events surrounding the crime. For example, consider two scenarios where a young cashier is shot to death during the robbery of a convenience store. In the first scenario, one witness is found at the scene of the crime when the police arrive. This witness was a customer inside the convenience store. She saw the robber walk up to the counter, raise his handgun, and shoot the cashier. This witness can identify the suspect. In the second scenario, the witness is a customer who was walking up to the front of the store when he heard what sounded like a gunshot. He then saw a man running out the front of the store with a handgun in his hand. Upon entering the store, he saw the cashier had been shot. He can identify the suspect.

In both scenarios, a male suspect is apprehended in possession of a handgun only two blocks away from the scene of the crime. In the first scenario, the witness would be classified as an eyewitness; but in the second scenario, the witness would be a corroborative witness.

In the described scenarios, both witnesses can provide valuable testimony; however, the evidence of the eyewitness in scenario one would be given more weight at trial because there is a direct connection that the accused committed the offence through direct evidence, and the court would not need to make any interpretation on the veracity of any circumstantial evidence. The witness was present and saw the suspect shoot the victim. The corroborative witness in the second scenario provides strong circumstantial evidence to suggest that the man running from the store committed the shooting; however, additional investigation would be needed to support the circumstantial assumption that the person seen running from the store committed the shooting.

Clearly, eyewitnesses are the type of witness that investigators hope to find in their investigative efforts. Any police investigator will tell you, eyewitnesses are frequently not present at the scene of a crime, and therefore investigators need to be skilled at discovering additional physical and circumstantial evidence that can assist the court in reaching its conclusions in relation to the evidence of a corroborative witness.

In the second scenario, additional evidence that might assist the court to reach a conclusion that the suspect running from the store was the shooter might include the following: ballistics from the handgun seized from the suspect matching the fatal bullet found in the body of the accused, gunshot residue from the hand of the suspect showing that he had recently fired a weapon, and/or conclusive information indicating that the suspect and the shooting victim were the only two persons inside the store at the time of the shooting.

This is not to say that these same items of additional evidence would not also be useful to corroborate the witness in the first scenario. The difference is that, in the case of an eyewitness, the additional evidence is a value that is added, while in the case of the corroborative witness, more evidence is required to support the conclusion of guilt beyond a reasonable doubt.

Independent Witness

In addition to considering the evidence of a witness based on being an eyewitness or a corroborative witness, the court will also give additional weight to evidence that comes from a person who is an independent witness. An independent witness is sometimes referred to as a third-party witness. They are characterized as independent because;

In other words, an independent witness is someone with nothing to lose and nothing to gain by the outcome of the case. With this inferred lack of vested interest to either side, the independent witness is seen by the court as providing unbiased testimony. Similar to the court, an investigator can attribute more confidence to statements made by persons who are established to be independent eyewitnesses or independent corroborative-witnesses to an event.         

Topic 3: Competence and Compellability

For a person to be called as a witness to testify in court, that person must be accepted by the court as being both a competent witness and a compellable witness. There are some rules that apply to assessing both competence and compellability of witnesses, and it is important for an investigator to understand these rules and definitions since it can negatively affect a case if key evidence is expected from a witness who is found either not competent or not compellable to testify. The examination here is not intended to be a comprehensive review of the rules of competence and compellability, but an overview of the main statutory issues. Case law relating to the finer points of witness competence and compellability is constantly evolving and, where applicable, may be presented in a court to challenge a witness.

A Compellable Witness

Most of the people an investigator will encounter during their investigations will be considered compellable to testify. Any person can be compelled to attend court as a witness by way of issuing a subpoena. If they fail to attend court after being served with a subpoena, the court may issue a warrant for the arrest of that witness to bring them before the court to testify. That said, once a person is compelled to attend court by either a subpoena or a warrant, there are still certain circumstances under which that person may be considered exempt, or not compellable to provide certain types of testimony. These circumstances relate to when the witness is an accused person or when the witness is the spouse of the accused.

  1. An accused person cannot be compelled. Under Sec 11 of the Canadian Charter of Rights and Freedoms (1982), an accused person cannot be compelled to testify at his or her own trial. However, if the accused person is charged jointly with another person, they may be compelled to testify against their co-accused. Under those circumstances, the witness can be afforded protection under the Canada Evidence Act (1985) and their testimony cannot subsequently be used against them at their own trial for that same offence.
  2. When the witness is married to the accused. To preserve the privilege of communication between two partners in their marriage, legislation and case law provides a protection of privacy, and anything said between two married partners in relation to a criminal event cannot be compelled as testimony in court. This exemption to testify is stated under the Canada Evidence Act (1985). Specifically, Sec 4(3) states:

No husband is compellable to disclose any communication made to him by his wife during their marriage, and no wife is compellable to disclose any communication made to her by her husband during their marriage.

Many people incorrectly believe that this is a blanket protection where one spouse cannot testify against the other. However, the legislation only provides protection to the communication between spouses. It does not restrict a spouse being called to testify regarding observations of physical evidence or relationships. For example, a husband may arrive home covered in blood and carrying a bloody knife confessing to his wife that he just stabbed someone to death. Although the communication of the confession of the crime would not be compellable testimony, the observations of the blood, the knife, the time and location of the observation would be a compellable testimony. On this point, Sec 4(2) of the Canada Evidence Act (1985) also states:

No person is incompetent, or compellable, to testify for the prosecution by reason only that they are married to the accused.

In addition to the ability to call a spouse to testify regarding observations of evidence, the prosecution can compel a spouse to give evidence, including personal communications, for the prosecution in cases that involve an offence of violence against that spouse and certain sexual offence against children.

A Competent Witness

Like the rules of compellability, persons are presumed to be compellable to testify unless they meet the exceptions stated under the Canadian Charter of Rights and Freedoms or The Canada Evidence Act. All witnesses are also considered competent to testify unless it can be shown that they lack certain personal abilities or capacities. Historically, common law barred certain people from testifying. These people included convicted criminals, very young children, the mentally ill, and spouses of an accused person.

Many of these rules have been overturned by statute, for example, the rule against convicts was removed by section 12 of the Canada Evidence Act (1985). The record of a convicted person can still be used as character evidence.

There are three classes of exceptions; children, persons with low mental capacity, and spouses. For each of these classes of people, it is up to the opposing counsel in court to make a challenge and establish the incompetence of the witness.

There is a presumption that the witness possesses both capacity and responsibility to give evidence. To testify, a witness needs only the ability to recall what they have seen and heard, and be able to communicate what they recall. To communicate, the witness must be able to understand and respond to questions, and the witness must demonstrate the moral capacity to tell the truth. Moreover, the determination of competency is guided by the following rules established in case law:

The proof of competency or incompetency is on the balance of probabilities (R v Ferguson, 1996).

Where competency is challenged, it must be established by a voir dire before the witness can be sworn (R v Steinberg, 1931).

A witness who states that they may not tell the truth is still competent to testify. Such issues of truthfulness are factors of credibility for the trier-of-fact (R v Walsh, 1978).

When considering the issues of witness competence and compellability, an investigator must keep in mind that the evidence collected from certain witnesses, such as spouses, children, and persons of low mental capacity, may be subjected to these rules. Exemptions for witness testimony and exclusion of the evidence may occur at trial (R v Khan, 1990; Justice Canada, 2017).

That said, during the investigation, it remains within the purview of the investigator to assess the information and evidence collected, and to consider that evidence when forming reasonable grounds to believe and take action. When considering the nature of the information and evidence received, it is not up to the investigator to assess whether the court will accept the information or not. The investigator’s use of the information and evidence received from a spouse, a child, or a person of low mental capacity should not be discounted in forming reasonable grounds simply in anticipation of a possible exemption of the witness and exclusion of evidence by the court. If the person giving the information or evidence is assessed as being a credible witness, the investigator should consider that material and give it fair weight in forming reasonable grounds for belief.

Topic 4: The Witness/Suspect Dilemma

Although the circumstances vary, it is a common occurrence that crimes are reported by a perpetrator posing as a victim or a witness. Crimes, such as break-and-entry and motor vehicle thefts, are quite often insurance frauds. Other crimes, including murder, have also had the offender make the report as a witness to explain their presence at the crime scene and avoid being considered as a suspect. Being aware of this possibility requires investigators to undertake a process of validating the reported crime and assessing the information being reported by witnesses or victims as a routine part of their investigation. To do this, an investigator should be attentive to questioning the report and the evidence presented to assess:

  1. Did the crime happen at the time being reported?It is often difficult for a person fabricating a report to provide the true timing of the events without implicating themselves as present at the time of the crime. Asking questions that demand timelines accounting for witness activities during the crime time can sometimes detect deception.
  2. Did the crime happen at the place being reported?Persons fabricating a report will sometimes change the location of the reported crime to avoid detection of the true crime scene where incriminating physical evidence may still be present. Carefully assessing the report in comparison to evidence present or not present can sometimes indicate this deception.
  3. Did the crime happen in the manner being reported?False accounts of crime will often exaggerate or over report details of the event. The report will contain some level of fabrication that explains their own connection to the events. Assessing each witness version of the event for consistency or inconsistency with physical evidence and other witness versions can reveal deception.

Even with careful attention to these questions, it may not be immediately possible to confirm the validity of the crime being reported, and the investigation must proceed to take the report as true until other evidence emerges to prove otherwise.

The advantage of investigating this kind of falsely reported crime is that the suspect is presenting themselves as a witness or victim. As such, all of their statements may be taken and will be admissible against them later, without voir dire, if deception in their statement becomes provable. Until some distinct piece of incriminating evidence emerges, the investigator is under no obligation to caution or warn the witness. Each new statement can afford opportunities to investigate further in search of evidence of the lie that will prove deception.

Topic 5: Witness Credibility Assessment

In addition to determining if a person is an eyewitness, a corroborative witness, an independent witness, a competent witness, or a compellable witness, every person who is a witness during an investigation needs to be subjected to a credibility assessment. As information and evidence are collected from each witness, it is part of the investigator’s job to determine the level of confidence that can be attributed to each witness. This is called witness credibility assessment.

One of the most significant issues to be considered in assessing a witness is determining if they are a witness, or if they are a suspect posing as a witness. More likely than interviewing false reporters of crime, investigators find themselves interviewing a variety of ordinary people who truly have been the victim of a crime, have witnessed a crime, or witnessed some aspect of a criminal event. The level of confidence an investigator can have in a witness will be contingent on several factors relating to who the witness is, the abilities of the witness, and the circumstances of the event.

  1. Witness profile. Ideally, every witness would be an upstanding member of the community with a high level of integrity and an outstanding reputation. This is rarely the case. The nature of criminal activity and the natural proximity and association of criminals within a criminal community, often skew the witness list more towards those with more colorful and less upstanding personal profiles. Being part of the criminal community, or having a criminal record, does not necessarily mean that a witness will not be truthful. However, these are factors that an investigator must consider when assessing the value of the evidence being reported. For example, if a witness has a record for perjury, their evidence should be carefully scrutinized and additional corroboration may be required to strengthen the witness’ account of the events to achieve acceptable credibility for the court.
  2. Witness bias – motivation to lie. As discussed earlier in this chapter, independent witnesses who are not connected to the victim, the accused, or the event itself make the most credible witnesses. People close enough to a criminal event to become witnesses are often, in some way, related to the victim, the suspect, or to the event itself. As such, the associated witness may have a bias in making their report of the event. As a friend or foe, the witness may have some motivation to withhold information or to lie to influence the outcome. Understanding how each witness fits into the event, and what their linkages are to other participants or the event itself, is an important dynamic to uncover. In the case of a bias witness, additional corroboration should also be looked for.
  3. Witness involvement – emotional impact of the event. Criminal events can be very stressful and anxiety producing experiences. This is not only true for the victim but for anyone who has been exposed to danger, violence, or situations where threats to personal safety or incidents of injuries or death have occurred. As human beings, we are not conditioned to live through these kinds of events without experiencing some kind of emotional response. Post-Traumatic Stress Disorder speaks directly to the emotional damage traumatic events can inflict (Resnick, Kilpatrick, Dansky, Saunders, & Best, 1993). It is important for an investigator to consider the nature of the event and the exposure of the witness to these dynamics. Extreme post traumatic trauma, such as observing the violent death of a loved one, can sometimes render that witness unable to provide a reliable account of details (Streets, 2011). It may be necessary to give some witnesses time to regain their composure to provide information or evidence. In some cases, the traumatic effect is too significant and the information cannot be recovered. Knowing how a witness is connected to the event and being able to comprehend their potential exposure to emotional trauma provides the investigator with the insight that certain strategies, such as softer interview techniques, flexible timing, and professional support resources that take the emotional trauma of the witness into consideration, may be necessary and appropriate. Another kind of emotional trauma is a witness’ fear for their personal safety. This can be a fear of physical, psychological, or emotional reprisals for the witness providing evidence. In a situation that includes organized criminal groups, this fear is a genuine and understandable concern. In these types of cases, it may be difficult to protect the identity of a witness, and assurances of protection of the witness can be subject to jurisdictional or organizational limitations of witness protection resources.
  4. Location when viewing the event. A witness’ physical location when observing an event can become an important point of evidence, and should be considered and included in the interview and statement of each witness. If a witness is providing details of the event that required them to be in direct proximity of the accused or the event to observe or hear, the physical location of the witness at the time of those observations is a critical element. Physical location can also be important in explaining gaps or differences in witness observations. The fact that one witness to a crime observed certain actions, but another witness did not, can sometimes be explained by the alternate angles of observation of each witness or because of some physical obstruction that affected one witness but not the other. Crime scene photos and diagrams can often help witnesses to demonstrate and describe their distinct perspectives. Returning to the scene of the crime to physically establish these locations and angles of observation can be a useful exercise for investigators to conduct.
  5. Awareness of the crime – intent to observe and recall the occurrence. In most cases where a crime has occurred, a witness will know that the crime is happening, and this awareness will engage their attention to make observations that they can later recall and give an account of. In other cases, where a witness has not been alerted to the crime and is only observing the evolution of events as part of an unremarkable sequence, their memory is not as engaged and their processes of observation may not be as keen. To demonstrate this point, consider an example where a group of three people are standing in the teller’s line at a bank.


    At the front of the line, a young man hands the bank teller a note advising, “This is a robbery. I have a gun. Put all the cash from your till into an envelope and give it to me. Do not press the alarm or I will shoot you.” The bank teller is aware that a crime is taking place; however, the two customers standing in line behind the robber are simply waiting their turn. The customer standing immediately behind the robber suddenly notices that the teller looks frightened and sees she is placing the contents of her cash drawer into an envelope. The third customer in line remains unaware and is talking on the telephone to his wife about their grocery list. The robber grabs the cash-filled envelope from the teller and turns to run out of the bank. The customer immediately behind him steps out of his way, but he bumps into the third customer still talking to his wife. In this scenario, an investigator could expect to get a detailed account of the events from the bank teller who was engaged in the event and aware of the crime from the outset. The customer immediately behind the robber become aware of the crime and was making observations half way into the robbery. This customer could likely provide some significant details. The third customer in line was never aware that a crime was in progress and, other than perhaps providing a limited description of a man who bumped into him, his value as a witness may be negligible. Many witnesses who make observations of a criminal’s activities in the pre-crime stage or in the post crime stage, when they are leaving the scene of the crime, fall into the category of not being aware of the crime. This does not mean these witnesses will be of no value but that their casual observations need to be identified and recorded as soon as possible.

  6. Length of observation time. Very simply, length of observation time is the amount of time a witness had to see the event taking place. This amount of time will vary with circumstances, as there would be a difference in opportunity for observation between one witness standing stationary at the crime scene observing the event, and another driving past the unfolding events at 100 kilometers per hour. This can also be an issue contingent upon the awareness of the event taking place. Some witnesses become aware of the event more quickly and have a longer opportunity to observe. As with our example of the bank robbery, the teller being robbed had the longest observation time, the customer immediately behind the robber became aware that something was happening and had a shorter observation time, but the third customer did not become aware of anything until the robber bumped into him. This scenario demonstrates the value and detail of evidence an investigator might expect from witness with differing levels of observation time.
  7. Time elapsed between the event and the interview. A critical aspect of gaining the best account of events from any witness is making sure that the interview happens at the earliest opportunity. It is a practice in police investigation to make every effort to identify and interview witnesses as soon as possible. As a simple exercise to demonstrate the importance of finding and interviewing witness quickly, take a piece of paper and to the best of your ability, write down the details of your day starting at the beginning of the day three days ago. What did you do? Where did you go? Who did you see? If you are like most people, you have some level of daily structure to your life. From that structure, perhaps you will recall you got out of bed at a usual time. Maybe you went to work or stopped at the gym or at your favourite coffee shop on the way to work. These benchmarks of your daily routine may be easily remembered. But, on your way to work, did you happen to see a green van with extensive damage to the front end on the street near your home? Of course, this is a fictitious question, but this would be the kind of inconsequential daily observation information you might be asked to recall by police canvassing for witnesses to a crime.Understanding this time limited aspect of human memory, investigators need to consider how much weight they can place on the accuracy of information being recounted by a witness. If a witness is providing a remarkably accurate recollection of something being recounted from any distance in the past, it is a good idea to ask that person how they can recall what should be a mundane event with such a degree of accuracy or clarity. If they are correct, the witness will sometimes provide a memory trigger that made them notice and causes them to recall. For example, a witness may answer, “Yes, I remember that green van with all the damage to the front end because my brother has a green van just like that and I looked at the driver and saw that it wasn’t my brother. I looked at it even closer because I had never seen that van on my street before.”
  8. Ability to record or repetitively recount details. If a witness was aware that they had witnessed a crime and they were making a conscious effort to record or otherwise memorize the facts, this is a point that the court will be interested in hearing as part of the witness’ evidence. If, for example, to remember the licence number of a suspect vehicle, the witness repeated the number over and over until they were able to write it down, this is an important detail that should be recorded in the witness statement, and the paper upon which the number was written should be seized and retained as an exhibit that can be shown to that witness on the stand as the note they made at the time of the event. This demonstrated that the witness had intent to recall and record the details of an event, which will contribute in a positive way to the credibility of the witness.
  9. Physical abilities – hearing, sight, smell, touch, taste and cognitive perception. The physical faculties of the senses may be used by a witness in their recollection of the events they are describing. When a witness makes a statement referring to their senses, their credibility in giving that evidence will depend upon the extent to which their senses are working. In taking statements from witnesses, the investigator must be satisfied that a witness who claims to have seen an event has adequate vision to make that observation. Similarly, a person who states that they heard something must be able to demonstrate that they have adequate hearing to have heard it. Speaking very quietly to test the hearing limits of a witness or asking a witness to describe something within the visual ranges of the evidence they saw are both reasonable strategies to informally test a witness’s range or limitations of senses. Asking a witness questions about their use of eyeglasses, contact lens, or hearing aids during their observation of events are all reasonable strategies to establish the credibility of a witness to make the observations they are reporting. Flowing from the use of their senses, witnesses will often provide information and cognitive perceptions of the events they witnessed. The cognitive perceptions of a witness are their own personal interpretation of the information they took in through their senses. As such, they are a subjective analysis of the information being sensed. A witness may provide a statement regarding the age of a suspect, the size of an object, the speed of a vehicle, the smell of alcohol on a person’s breath, or even the distance they stood from the event they witnessed. To a certain degree, the court will allow such evidence and opinions of common knowledge from non-expert witnesses; however, a witness may be challenged on their observations, and it is best to understand any misperceptions in advance. Again, informal testing of a witness to become comfortable that their cognitive perceptions and subject interpretations are accurate and not significantly skewed is a reasonable way to test credibility. For estimating the age of a suspect, an investigator could ask the witness to point out other persons who are approximately the same age. Similar tests could be undertaken in testing perceptions of the size of objects, the speed of vehicles, and the distance to locations. For statements regarding observations, such as the smell of alcohol, the investigator should ask the witness to describe their personal experiences with alcohol to know that it was alcohol they smelt. If the witness had not experienced alcohol or been with people who were drinking alcohol, that opinion of smell would lose credibility.
  10. Cognitive capacity and age of witness. To establish the competency of either a child or a person of limited mental capacity, conducting a careful witness credibility assessment will be helpful for the prosecution in meeting challenges to competency. Part of the initial interview should seek to determine if the child or person of limited mental capacity understands the need to tell the truth. The competency background of the witness should be conducted by interviewing persons, such as parents, caregivers, teachers, or doctors, who know the witness and can attest to their mental capacity and their ability to understand questions and communicate their answers.The actual interview of both children and persons of low mental capacity are a delicate and time-consuming process. They must be conducted in a manner that is both suited to the maturity level of the witness, and structured using non-leading questions to elicit answers. In cases where it is possible, investigators with specialized training in this type of interviewing should be utilized. That said, in the first instance, at the scene of an event, it is important for the responding investigator to understand the special considerations that apply to this type of witness in consideration of their evidence. The goal in these cases is to determine how much weight can be attributed to the evidence being provided by witnesses. An investigator may determine that the evidence of a witness is credible and can be used in the development of forming reasonable grounds or, alternately, they may find that the credibility of the witness cannot be established, and the evidence cannot be used in the development of reasonable grounds to take action.

Topic 6: The Truthfully Incorrect Witness

As much as witnesses are a critical component of the criminal investigation process, they can also become a critical threat to the accuracy and integrity of evidence gathering. This sometimes occurs in an anomaly where an apparently credible, independent witness tells their version of events and they are significantly wrong in what they say they observed. Unlike cases where a witness is motivated to intentionally fabricate or exaggerate their account of events, the truthfully incorrect witness has no malicious intent and will provide their version of the events with a genuine belief that what they are saying is true and accurate. This type of witness is an independent observer with no motivation to lie, and as such the weight of their testimony can carry significant influence for the investigator’s reasonable grounds to believe and eventually carry significant probative value for proof beyond a reasonable doubt in the court. For investigators, the truthfully incorrect witness can become a paradox capable of misleading the outcome of the investigation resulting in a guilty suspect going free or an innocent suspect being arrested and charged. This anomaly of truthfully incorrect witnesses is an issue that investigators must remain mindful of. Witnesses are human and humans are fallible. Even for a witness who appears to be independent and credible, there remains a need to scrutinize and fact check the witness’s version of events against the known physical evidence and the accounts of other witnesses.

The importance of the investigator being mindful of a truthfully incorrect witness cannot be emphasized too strongly. In 1996, for example, the National Institute of Justice in the United States released a report concerning the implications of eyewitness testimony and false memories, and in it, reported that 90% of all DNA exoneration cases defendants were wrongly convicted upon the false memories of eyewitnesses (Brainerd, 2005). More recently, Smarlarz and Wells (2015), citing The Innocence Project, noted that eye-witness testimony was used to convict innocent people in over 70% of DNA exoneration cases. More recently yet, Rose and Beck (2016) note that eyewitness testimony accounts for more wrongful convictions than anything else. Research has shown that false memories in eye witnesses can be created in a number of ways, including through leading questions, reports from others, contact with other people, suggestions, a witness’ own expectations, the expectations of others, other social pressures, and media (Bennett, 2015; Allen, 1991). It has also been established that witness recall can be affected by stress (Morgan et al, 2004) and by alcohol (Oorsouw et al, 2015) in complicated ways.

Topic 7: Dominant Witness Influence and Conformity

One of the negative dynamics that can occur in an investigation where there are multiple witnesses is the contamination or influence of witness statements by a dominant witness. This influence can occur when witnesses to an event have not been separated before any interactions or conversations have occurred between the witnesses. These dynamics are possible in almost all cases, and an investigator must always be mindful that this potential exists. It is also possible that a dominant witness will boldly and sometimes aggressively state their version of the events, which can cause other less confident or less sophisticated witnesses to question their own perspective. In such cases, a less dominant witness may change their version of the events or even omit observations to conform to what the dominant witness stated.

Most susceptible to this kind of influence are very young witnesses, elderly witnesses, or witnesses who have timid personalities. On some occasions, where there is an imbalance of power or status in a personal relationship, or even in a subordinate organizational relationship, witnesses may conform to the more powerful witness out of fear of repercussions or hope of favour. In some cases, the dominant witness has a vested interest in having their version of the events stated their way, and the dominant influence towards the other witnesses is intentional and implicitly threatening in its tone.

In cases where witnesses have interacted prior to being interviewed, each witness should be interviewed in seclusion from the others. Witnesses should be asked if they have discussed the event with anyone else or heard anyone else’s version of what happened. They should be cautioned and encouraged to disregard anyone else’s version of events and limit their version to their own account of what was seen and heard during the event.

Topic 8: Uncooperative Witnesses

One of the many unpleasant dynamics of criminal activity is when the police attend the scene of a crime and witnesses, or even victims, refuse to cooperate with investigators. Sometimes, these uncooperative persons are part of the criminal lifestyle and are not willing or interested in cooperating in the justice system. The only strategy for police in these cases is to gather as much forensic evidence as possible in relation to the event and to seek charges where sufficient evidence can be found.

Although these uncooperative witnesses may believe they are not required to participate in the criminal justice system, it is entirely possible to subpoena an apparent witness to attend court to be questioned regarding the criminal event they witnessed. If that witness refuses to answer questions in court, it is possible for the judge to find them in contempt of the court and to sentence them accordingly. That said, this rarely happens.

Topic 9: Conducting Witness Interviews

Arriving at a crime scene, investigators are often confronted with a cast of characters who may be victims, witnesses, or suspects in the matter to be investigated. In the case of an active event, where immediate in-depth interviews are not possible, it is important to:

  1. Conduct immediate field interviews of each subject at the scene;
  2. Do an immediate preliminary classification of persons found at the scene as victims, witnesses, or suspects; and
  3. Take appropriate measures to separate the persons found at the scene for the purpose of physical security and protection of future testimony from cross-contamination of witness accounts and conformity.

Topic 10: The Field Interview

Attending the scene of an event, the first immediate field interview may be as simple as asking an apparent victim or a probable witness, “What happened here?”. This simple question serves several purposes for the investigator. First, it shows that the investigator is not making any investigative assumptions based on what is visible to him or her at first glance. With this question, the person being asked is prompted to supply their own version of the event, as they saw it. This pure version will assist the investigator in developing a picture of the event, and it will provide a context allowing the investigator to classify the speaker as a victim, witness, suspect, or an uninvolved party.

If the person the investigator questioned turns out to be the perpetrator, and the investigator has no other evidence that suggests this person should be a suspect, any statement made by that person would likely be considered a spontaneous utterance and may be admitted in evidence without a voir dire. For example, consider a situation where an investigator arrives at the scene of a street fight where a man has been fatally stabbed. The investigator asks one of the men standing nearby, “What happened here?” and the man immediately says, “I killed him and he deserved it.” This statement would be considered a spontaneous utterance and would likely be admitted as evidence without the usual voir dire. Once this self-incriminating statement has been made, the suspect would need to be immediately arrested and provided with the Charter warning and caution before any further statements could be pursued through additional questioning. Clearly, once a suspect is identified, they can no longer be considered as a witness.

If no one is immediately identifiable as a suspect at the scene of an event, it is reasonable for the investigator to proceed with classifying the persons present as possible witnesses. As discussed earlier in this chapter, to classify the witnesses, the investigator must consider the nature of the evidence that the witness can provide:

Interviewing a witness is not just a simple matter of hearing their version of the events. There are many factors that can come into play in determining how credible a witness is. Following the initial field interview, and once the event is under control, it is important to take the witness’ formal statement at the earliest available opportunity. Taking the witness statement should be conducted using the best technology available given the circumstances. If audio and or video recording devices are not available, or obtaining them would cause an unreasonable delay in getting the witness statement, a written statement should be taken. No matter how the witness statement is recorded, it should be the goal of the investigator to obtain the best, uninfluenced, and unbiased version of events from a witness.

Like the threat of conformity being induced by a dominant witness, a witness can also be influenced by leading questions asked by an investigator. Some witnesses are so eager to assist in solving the crime that they will attempt to guess the answer to a leading question instead of admitting that they do not know the answer. The caution here is to avoid asking leading questions. Leading questions are questions that a witness might be able to infer the answer by the nature of the wording. An example of a leading question would be:

“Did you see Larry pick up the revolver and shoot Bill in the head?”

This leading double question can be answered yes or no, and it also supplies the witness with a significant amount of information that the witness can infer about the details of the event. These may be details that they would not have previously known. From this question, the witness could infer that Bill was shot in the head, the weapon used was a revolver, the suspect in the shooting was Larry, and the revolver was picked up from somewhere. A better and more appropriate initiation of the statement would be: “Did you witness an event today? Tell me what you saw.”

Although this open-ended approach to statement taking is more time consuming, the investigator at least knows that they are not planting any ideas or words to influence the witness’ account of the event. Taking a statement in this manner is known as taking a pure version statement. A pure version statement needs to be the witness’s best, uninterrupted narration of the events, as they recall it. As the witness recounts their best memory of the event, the investigator must resist the temptation to intervene and ask clarifying questions on the points being revealed. Clarifying questions like the question used to start an interview can be leading and can influence the witness’ statement.

As the witness recounts their pure version of the events, the investigator should be taking notes on points to be clarified once the entire statement is completed. Those questions should remain as open-ended as possible. So, if the witness has stated in their pure version of events, “I walked into the room and that is when I saw the shooting happen”, the clarifying question should be an open-ended prompt, such as, “You said you saw a shooting happen, tell me more about that.”

There are many different techniques and strategies for witness interviewing that cannot be addressed in this short book as part of an introduction to investigations. The best advice for new investigators for the interviewing of a witness is learning to be patient and allow the witness to tell their story in their own time and in their own way. Avoid the human tendency of trying to assist and interact with the speaker by asking questions, filling in the blanks, and clarifying things while the story is being related. The more effective interview technique is one where the witness can exhaust their memory and relate the events to the best of their ability without interference and the contaminating influence of questions that might derail their train of thought.

As discussed earlier, it sometimes happens that a witness or a reporting victim will turn out to be the perpetrator of a crime. In these cases, allowing the person to provide their full uninterrupted statement can produce incriminating indicators or even evidence of involvement. There is a tendency for criminals who fabricate their report of a crime to make sure they are adding information in their statement that helps eliminates them as a suspect. This can include unsolicited alibis for their whereabouts and their activities at the time of the reported event. When a witness supplies this type of information without being prompted, it can be an indicator of personal involvement in the criminal event. Any such voluntary explanations of personal activities should be recorded carefully and closely scrutinized to confirm the validity of facts. Follow up questions to unsolicited explanations should include seeking the names of independent witnesses who might be able to corroborate the witnesses account.

In the case where an investigator suspicious that a reporting witness or victim may be the perpetrator of the crime, there is no obligation to reveal that suspicion until evidence exists that allows the investigator to form reasonable grounds for belief. If further investigation determines that the statement is a fabrication, this may be sufficient circumstantial evidence to require a warning for at least the offence of mischief for making the false report. In such circumstances, a Charter warning and caution are appropriate before additional questioning is undertaken.

Taking the Witness Statement

The written, audio, or video statement of a witness taken by a police investigator will become the permanent record of events as seen by that witness. The police investigator will use the content of that statement as a reference document in the construction of search warrants and in support of reasonable grounds for belief to lay an arrest. The crown prosecutor will use the statement to construct their case for presentation to the court and for pre-trial disclosure of the evidence to the defence counsel. The statement will serve as a document from which the witness may refresh their memory of events to provide accurate testimony to the court.

Considering the foregoing list of uses, the witness statement needs to be as accurate and complete as possible. The standard format used to begin a witness statement is as follows:

This is the statement of witness’s full name taken on date and time atlocation where taken by name of person taking or recording the statement.

At the conclusion of the statement, it must be signed by the witness. If the statement is audio and or video recorded, the foregoing preamble needs to be used to start the statement, and once the statement is transcribed, the witness should sign the hard copy transcription.

Witness Identification of a Suspect – Photo Lineups and Live Lineups

Beyond taking a statement, one of the most common forms of obtaining information from a witness is the practice of having witnesses identify a suspect through the viewing of photographs or photo lineups. This kind of after the fact identification of a suspect will be subjected to scrutiny when it is presented in court. Strict protocols must be followed to demonstrate that the process was conducted in a fair and unbiased fashion. Under no circumstances would an investigator ever present the witness with only a single photograph or a single lineup suspect and ask if this is the suspect. Additionally, under no circumstances should an investigator ever state that the suspect is one of the persons in the lineup.

In the practice of presenting photo lineups, the photos are arranged in a series of eight pictures or more that are permanently mounted into a series of numbered windows of a special photo lineup file folder.


The suspect’s photograph is one of the eight pictures and the remaining seven photos are called “distractor photos”. To be fair, these distractor photos need to be reasonably similar to the suspect photo in terms of gender, age, race, head hair, facial hair, and glasses. When the photo lineup is presented to the witness, there should be instruction by the investigator that the suspect of the investigation may or may not be in this photo lineup (i.e. “please look at all the photos carefully and only select the number of a photo if you are certain it is the suspect you saw at the time of the event”).

Like photo lineups, live persons may be used to conduct a suspect identification or a suspect in custody. These live lineups are more difficult to create because they require the cooperation of the suspect and if the suspect does something during the viewing that could draw attention to him; it could prejudice the lineup process. As with the photo lineup, the distractor subjects need to be selected to be fairly similar to the suspect; however, unlike photo lineups, the live lineup requires the additional elements of ensuring that everyone is of similar height, weight, body shape, and dress. You cannot put the suspect dressed in a shirt and tie into a lineup with distractors wearing blue jeans and tee shirts.

Another means of suspect identification is permitting the witness to page through volumes of criminal file photos that are part of the local police photo collection. This technique is sometimes used when there are no identifiable suspects and the witness is reasonably certain that they will recognize the face of the suspect if they see it again. The negative aspects of this strategy are that it can take a great deal of time, and a witness can sometimes become confused by the process and overloaded with the viewing of too many faces, causing an eventual loss of confidence in making a proper identification.


This chapter examined the broad range of issues that must be considered by an investigator in relation to the collection of information and evidence from witnesses to a crime. These issues range from the way witness evidence is classified and validated to the way witnesses are assessed and evaluated to determine their ability to give evidence and the credibility of the evidence they give.

The chapter illustrated the processes required for proper witness management during investigations. These task processes of witness identification, classification, credibility assessment, and proper interviewing practices in statement taking are all components of witness management that demonstrate professional standards applied by a criminal investigator.

Study Questions

  1. What is a collaborative witness?
  2. What is an independent witness?
  3. Can an accused person be compelled to testify regarding a crime they have been involved in?
  4. Are all persons considered competent to testify?
  5. What is witness credibility assessment?
  6. What concerns should an investigator have about dominant witnesses?
  7. What should an investigator do in the case of an active event where immediate in-depth interviews are not possible?
  8. Is it possible to have a witness statement in something other than written form?
  9. What are two negative aspects of having a witness attempting to identify a suspect by paging through volumes of criminal file photos?


Chapter 8: Crime Scene Management

Chapter 8: Crime Scene Management

“Crime scene management, and evidence management as a critical part of that, must be learned and incorporated into the investigator’s toolkit.”

Crime scene management skills are an extremely significant task component of investigation because evidence that originates at the crime scene will provide a picture of events for the court to consider in its deliberations. That picture will be composed of witness testimony, crime scene photographs, physical exhibits, and the analysis of those exhibits, along with the analysis of the crime scene itself. From this chapter, you will learn the task processes and protocols for several important issues in crime scene management. These include:

  1. Note taking
  2. Securing a crime scene
  3. Evidence management
  4. Scaling the investigation to the event

Topic 1: Note Taking

Although other documents will be created by the investigator to manage the crime scene, no other document will be as important to the investigator as the notebook. The notebook is the investigator’s personal reference for recording the investigation.

Many variations of police notebooks have emerged over the years. The court will sometimes even accept police notes that have been made on a scrap of paper if that was the only paper available at the time. However, beyond extreme circumstances, in operational investigations, the accepted parameters of a police notes and notebooks are:

In court, the investigator’s notebook is their best reference document. When testifying, the court will allow an investigator to refer to notes made at the time to refresh their memory of events and actions taken. When an investigator’s notebook is examined by the court, notes consistent with the investigator’s testimony provide the court with a circumstantial assurance or truthfulness that the evidence is accurate and truthful (McRory, 2014). Alternately, if critical portions of the investigation are not properly recorded or are missing from the notebook, those portions of the evidence will be more closely scrutinized by the defence. The court may give those unrecorded facts less weight in its final deliberations to decide proof beyond a reasonable doubt.

For an investigator, good notes are an overview of the things seen/heard and the actions taken. A chronology of notes demonstrates the investigator’s mental map of the facts that led to forming reasonable grounds for an arrest and charges. Court cases are often extended by adjournments, appeals, or suspects evading immediate capture. This can extend the time between the investigation and the trial by several years. In these protracted cases, it becomes critical for the investigator to have detailed notes that accurately reflect their investigation to trigger their memory of the facts.

As important as the notebook is, note taking skills are often an underemphasized aspect of police training. Most police investigators develop their personal skills and note taking strategies through on the job experience and in the “trial by fire” of cross examination in court. This void in the training of note taking skills is likely due to the broad range of circumstances under which note taking needs to take place and because it is impossible to anticipate what facts will become important in every possible variation of circumstances. Thus, some combination of training, common sense, and experience will come into play for investigators to become proficient in recognizing what to record in their notebook.

The concept of “notes made at the time of an event is a rather misleading definition and requires some explanation. In an ideal world, an investigator would be able to proceed through an investigation with an open notebook and record each fact and each observation of events as they transpire. Of course, the way events unfold is dynamic and unpredictable. Circumstances often require an investigator to be fully engaged in efforts to bring a situation under control, while protecting the life and safety of persons. There is no place for an open notebook in such cases and the investigator is clearly not taking any notes at that time, but will do so after the event is under control, and as soon as it is practical to do so. Although the typical reference in court is to notes made at the time, in actuality, they are notes made as soon as practical under the unique circumstances of the event.

The courts do accept the operational dynamics that exists for investigators, and it sometimes becomes a question at trial to know when the notes were actually composed. As such, an investigator should always be prepared to answer this question. Having a note in the notebook regarding the time when the writing of notes was and finished acts as a reference to demonstrate awareness and attention to this issue.

Another issue related to notes made at the time is the dilemma of facts that were overlooked and then recalled after the initial notes have been completed. The human memory does have its limitations and flaws. On occasion, an investigator will complete the initial draft of their notes, and, at some later time may suddenly recall a point that was missed. On such occasions, returning to the pages of notes made at the time and attempting to insert the recalled facts is not an acceptable practice. The proper way to record these later recollections of fact is to immediately start a new note page, using the current time and date, make a reference to the previous case-notes, previous time, date, and page number, and record the newly recalled fact or facts. These kinds of recalled facts and late entries will be closely examined by defence counsel, and it can sometimes be helpful if the investigator can also make note of the fact or circumstances that led to the recollection of the additional information. Anyone who has ever participated in a critical incident, where life and safety have taken priority, can tell you that once the event is under control, investigators can be seen writing intently to document their recollection of the events.

The following strategies are recommended as a general guide to note taking:

  1. Start notes by creating a big picture perspective and then move from the general to the more specific observations. In this big picture, you are creating a perspective of the facts that you have been made aware of to begin an investigation. These big picture facts become the starting point of your mental map of events, and these facts will be the framework to begin thinking about offence recognition and forming reasonable grounds to believe and take action.
  2. In more specific terms, and to the extent it is possible, begin recording all dates, times, and descriptions of persons, places, and vehicles as they emerge. You may, in fact, have already started a page in your notebook where some exact times, addresses, licence plate numbers, names or persons, and perhaps even blurted statements from a suspect have been jotted down. It is acceptable to use these key pieces of jotted information already recorded to enlarge your detailed notes at the end of the event in a more complete fashion.
  3. Record the identities of persons encountered and how the identity of each person was verified. For example: Witness Jane Doe (DOB: 8 May 64) 34345-8 St Anywhere BC Photo drivers licence ID
  4. Record all statements made by witnesses and victims to reflect an accurate account of the information being conveyed. It is often not possible to record every statement made verbatim in notes, and, in most cases, it is not necessary. Today, technology makes it possible to digitally record the verbatim account being provided by a witness or a victim. But, merely digitally recording a statement is not sufficient, since statements will frequently form considerations in establishing reasonable grounds for belief to take action. Recording the critical details being conveyed will provide a written record of the facts considered to form reasonable grounds for belief.
  5. If a person is a suspect or is a person who may become a suspect, make every effort to record any statements made by that person verbatim. Suspects will often be found at the scene of a crime posing as a witness or even as a victim. Accurately recording the initial statements made by such a person can produce evidence of guilt in the form of statements that are provably false or even incriminating.

It is the personal responsibility of each investigator to document their personal perception and recollection of the event they are witnessing, as it unfolds. In cases where investigators have collaborated on an agreed version of events and authored their notes to reflect those agreed upon facts, the notes are no longer the personal recollection of that investigator and, as such, may be scrutinized as being a collective version of events aimed at producing evidence that does not reflect a true account of the facts as they were witnessed by each individual investigator.

The practice of collaborating and making collective notes is sometimes called “boxing of notes” – this practice can be discovered by defence when the individual notebooks of investigators are identical or close to identical in format and content. The practice of boxing of notes has been identified as one of the flaws in investigative practice that can lead to miscarriages of justice (Salhany, 2008). As such, collaboration between investigators when making notes should be avoided. If, at any point, there is a collaboration to return to an issue together and re-examine physical evidence to clarify the point for each investigator, that collaborative effort should be noted as part of the note making of each investigator.

Despite this caution regarding the collective production of notes, there are occasions where a collective note making process is used and is accepted as reasonable. This occurs during large scale operations involving many participants, sometimes coordinated by an Emergency Operations Command Center. In these cases, there is a need for the command center participants to be completely engaged in handling the event, which may extend over periods of hours or days. The practice of each participant waiting until the protracted event has been concluded to make their individual notes would be impractical and potentially inaccurate. In these cases, it is now accepted operational practice to assign one person in the command center to act as the collective maker-of-notes to substitute for individual note-taking. The note maker in these situations is known as “The Scribe”. For the persons in the command center to be aware of the notes being made, the Scribe does not make notes into a typical notebook. In such cases, the notes are made onto large pieces of flipchart paper and, as each sheet of notes is completed, it is posted onto the wall of the command center where each participant can reference the content of the notes and verify the accuracy of the notes. At the end of the operation, the collective pages of notes are photographed and the note pages are saved by the scribe as an exhibit. Each page is often initialled by the participants. Under this process, each participant in the command center may adopt these notes as a reference document for court purposes.

Topic 2: Integrity of the Crime Scene

As part of crime scene management, protecting the integrity of the crime scene involves several specific processes that fall under the Tasks category of the STAIR Tool. These are tasks that must be performed by the investigator to identify, collect, preserve, and protect evidence to ensure that it will be accepted by the court. These tasks include:

a) Locking down the crime scene

b) Setting up crime scene perimeters

c) Establishing a path of contamination

d) Establishing crime scene security

When an investigator arrives at a crime scene, the need to protect that crime scene becomes a requirement as soon as it has been determined that the criminal event has become an inactive event and the investigator has switched to a strategic investigative response. As you will recall from the Response Transition Matrix, it is sometimes the case that investigators arrive at an active event in tactical investigative response mode. In these cases their first priority is to protect the life and safety of people, the need to protect the crime scene and its related evidence is a secondary concern. This is not to say that investigators attending in tactical investigative response mode should totally ignore evidence, or should be careless with evidence if they can protect it; however, if evidence cannot be protected during the tactical investigative response mode, the court will accept this as a reality.

As soon as the event transitions to an inactive event with a strategic investigative response, the expectations of the court, regarding the protection of the crime scene and the evidence, will change. This change means that there is an immediate requirement for the investigator to take control of and lock down that crime scene.

a)    Locking Down the Crime Scene

Very often, when the change to strategic investigative response is recognized, first responders and witnesses, victims, or the arrested suspect may still be inside the crime scene at the conclusion of the active event. All these people have been involved in activities at the crime scene up to this point in time, and those activities could have contaminated the crime scene in various ways. Locking down the crime scene means that all ongoing activities inside the crime scene must stop, and everyone must leave the crime scene to a location some distance from the crime scene area. Once everyone has been removed from the crime scene, a physical barrier, usually police tape, is placed around the outside edges of the crime scene. Defining of the edges of the crime scene with tape is known as establishing a crime scene perimeter. This process of isolating the crime scene inside a perimeter is known as locking down the crime scene.

b)    Crime Scene Perimeter

The crime scene perimeter defines the size of the crime scene, and it is up to the investigator to decide how big the crime scene needs to be. The size of a crime scene is usually defined by the area where the criminal acts have taken place. This includes all areas where the suspect has had any interaction or activity within that scene, including points of entry and points of exit. The perimeter is also defined by areas where the interaction between the suspect and a victim took place. In some cases, where there is extended interaction between a suspect and a victim over time and that activity has happened over a distance or in several areas, the investigator may need to identify one large crime scene, or several smaller crime scene areas to set crime scene perimeters. Considering the three stages of originating evidence, an investigator may find that pre-crime or post-crime activity requires the crime scene perimeter to surround a larger area, or there maybe even be an additional separate crime scene that needs to be considered.

For some crime scenes where there are natural barriers, such as buildings with doorways, it is easy to create a crime scene perimeter defining access. This becomes more complicated in outdoor venues or large indoor public venues, where fencing and barricades may be needed along with tape markers to define the perimeters.

Once the crime scene perimeter has been established and lock down has taken place, it becomes necessary to ensure that no unauthorized persons cross that perimeter. Typically, and ideally, there will only be one controlled access point to the crime scene, and that point will be at the entry point for the path of contamination.

c)     Path of Contamination

It is not possible to eliminate all potential contamination of a crime scene. We can only control and record ongoing contamination with a goal to avoid damaging the forensic integrity of the crime scene and the exhibits. Once a crime scene has been cleared of victims, witnesses, suspects, first responders, and investigators, it is necessary to record, in notes or a statement from each person, what contamination they have caused to the scene. The information being gathered will document what evidence has been moved, what evidence has been handled, and by whom. With this information, the investigator can establish a baseline or status of existing contamination in the crime scene. If something has been moved or handled in a manner that has contaminated that item before the lock down, it may still be possible to get an acceptable analysis of that item if the contamination can be explained and quantified.

As an example, sometimes in cases of serious assaults or even murders, paramedics have been present at the scene treating injured persons. When this treatment is happening, non-suspect-related DNA transfer between persons and exhibits can occur. Determining those possibilities is one of the first steps in establishing the level of existing contamination at the time of lock down.

With everyone now outside the crime scene and the perimeter locked down, the next step is to establish a designated pathway where authorized personnel can re-enter the crime scene to conduct their investigative duties. This pathway is known as a path of contamination and it is established by the first investigator to re-enter the crime scene after it has been locked down. Prior to re-entering, this first investigator will take a photograph showing the proposed area where the path of contamination will extend, and then, dressed in the sterile crime scene apparel, the investigator will enter and mark the floor with tape to designate the pathway that others must follow. In creating this pathway, the first investigator will avoid placing the pathway in a location where it will interfere with apparently existing evidence and will place it only where it is required to gain a physical view of the entire crime scene. As other investigators and forensic specialists enter the crime scene to perform their duties, they will stay within the path of contamination and, when they leave the path to perform a specific duty of investigation or examination, they will record their departure from the path and will be prepared to demonstrate their departure from the pathway and explain any new contamination caused by them, such as dusting for fingerprints or taking exhibits.

d)    Crime Scene Security

At the same time the crime scene is being defined with perimeter tape, it is also necessary to establish a security system that will ensure that no unauthorized person(s) enters the crime scene and causes contamination. For this purpose, a crime scene security officer is assigned to regulate the coming and going of persons from that crime scene. For the assigned security officer, this becomes a dedicated duty of guarding the crime scene and only allowing access to persons who have authorized investigative duties inside the crime scene. These persons might include:

To maintain a record of everyone coming and going from the crime scene, a document, known as a “Crime Scene Security Log”, is established, and each authorized person is signed in as they enter and signed out as they depart the scene with a short note stating the reason for their entry. Any unauthorized person who enters or attempts to enter a crime scene should be challenged by the crime scene security officer, and, if that person refuses to leave, they can be arrested, removed from the scene, and charged for obstructing a police officer.

The assigned security officer is responsible for creating and maintaining the Crime Security Log, which can take various forms. In short term, small scale investigations, it may only require a single page in the security officer’s note book; however, in a large scale, long term investigation, the log could include volumes of pages under the care of several assigned security officers working in shifts. Whatever the scale or format, the security log records who attended the scene, when they attended, why they were there, and when they left the scene. An example of a crime scene security log is shown in the following example.

Crime Scene Security Log

Crime Scene Security Log.

Topic 3: Evidence Management

As we have already learned in the STAIR tool, analysis is the process that must occur to establish connections between the victims, witnesses, and suspects in relation to the criminal event. The crime scene is often a nexus of those events and consequently, it requires a systematic approach to ensure that the evidence gathered will be acceptable in court.

Exhibits, such as blood, hair, fiber, fingerprints, and other objects requiring forensic analysis, may illustrate spatial relationships through evidence transfers. Other types of physical evidence may establish timelines and circumstantial indications of motive, opportunity, or means. All evidence within the physical environment of the crime scene is critically important to the investigative process. At any crime scene, the two greatest challenges to the physical evidence are contamination and loss of continuity.

Contamination of Evidence

Contamination is the unwanted alteration of evidence that could affect the integrity of the original exhibit or the crime scene. This unwanted alteration of evidence can wipe away original evidence transfer, dilute a sample, or deposit misleading new materials onto an exhibit. Just as evidence transfer between a suspect and the crime scene or the suspect and the victim can establish a circumstantial connection, contamination can compromise the analysis of the original evidence transfer to the extent that the court may not accept the analysis and the inference that the analysis might otherwise have shown.

Contamination can take place in any number of ways including:

Contamination is a fact of life for investigators, and any crime scene will have some level of contamination before the scene becomes an inactive event and the police can lock down the location. While issues of life and safety are at risk, the court will accept that some contamination is outside the control of the investigator. That tolerance for controlling contamination changes significantly once the crime scene is locked down and is under control. Once the scene has been locked down, crime scene management procedures must be put in place. Crime scene contamination presents three challenges for investigators, namely:

  1. Preventing contamination when possible,
  2. Controlling ongoing contamination, and
  3. Recording the known contamination that has taken place

In regards to the phrase “control ongoing contamination”, the word “control” is used because investigators cannot eliminate ongoing contamination, they can only seek to control it. This practice of identifying and recording the known contamination is necessary, and even if contamination has taken place, identifying and explaining that contamination may salvage the analysis of exhibits that have been contaminated.

During the critical period between the lockdown of the crime scene and obtaining a warrant to search the crime scene, investigators need to consider the possibilities for ongoing contamination. If reasonable grounds exist to believe that evidence of the crime will be damaged or destroyed by some threat of contamination, the investigator has the authority, under exigent circumstances, to re-enter that crime scene without a warrant to take the necessary steps to stop or prevent contamination and protect the evidence.

The very act of entering the crime scene to collect evidence, and the process of evidence collection, are forms of contamination. The goal in controlling ongoing contamination is to avoid damaging the forensic integrity of the crime scene and its associated exhibits. It is this goal that makes crime scene management procedures essential to the investigative process.

Loss of Continuity

Like controlling contamination, establishing and maintaining continuity of evidence are protocols that protect the integrity of that evidence. For any evidence to be accepted by the court, the judge must be satisfied that the exhibit presented is the same item that was taken from the crime scene. Evidence must be presented to demonstrate “the chain of continuity”, which tracks every exhibit from the crime scene to the courtroom.

The evidence to show continuity will come from the investigator testifying that the exhibit being presented is the same exhibit that was seized at the crime scene. This testimony is supported by the investigator showing the court their markings on the exhibit or its container. These markings will include the time, date, and investigator initials, as well as a notebook entry showing the time, date, and place when the item was transported and locked away in the main exhibit holding locker. This evidence is further supported by an Exhibit Log that shows the exhibit as part of the crime scene evidence detailing where at the crime scene it was found, by whom it was found, and the supporting initials of anyone else who handled that exhibit from the crime scene continuously to the main exhibit locker. Any process where that exhibit is removed from the main exhibit locker for examination or analysis must be similarly tracked and documented with the initials, time, and date of any other handlers of the item. Any person who has handled the exhibit must be able to take the stand providing testimony that maintains the chain of continuity of the exhibit. These are simple processes yet critical. If they are not followed rigorously, it can result in the exclusion of exhibits based on lost continuity.

Attention to Originating Stages of Evidence

One of the big dilemmas in crime scene management is determining where the criminal event happened or where the event extended to. Making these determinations provides the investigator with the locations where evidence of the crime may be found. This is often not a simple matter of just attending one location or thinking about the criminal event in just a single timeframe. In the investigative process, there are three possible stages of time where evidence can originate. These are the pre-crime stage, the criminal event stage, and the post-crime stage.

These three stages of crime can also mean there could be other locations outside the immediately crime scene area where criminal activities might have also taken place and evidence might be found. The point to remember about the originating stages of evidence is that each of these stages provides possibilities for collecting evidence that could connect the suspect to the crime. When considering theory development or making an investigative plan, each of these stages of the criminal event should be considered.

  1. The Pre-Crime Stage occurs when evidence of preparation or planning can be found during the investigation. It can include notes, research, drawings, crime supplies or pre-crime contact with the victim or accomplices. Sometimes items of pre-crime origin, such as hair and fiber, will be later discovered at the crime scene creating an opportunity to link the suspect back to the crime
  2. The Criminal Event Stage is when the most interaction takes place between the criminal and the victim, or the criminal and the crime scene. During these interactions, the best possibilities for evidence transfer occur. Even the most careful criminals have been known to leave behind some trace of their identity in the form of fingerprints, shoe prints, glove prints, tire marks, tool impressions, shell casings, hair or fiber, or DNA.
  3. The Post-Crime Stage occurs when the suspect is departing the crime scene. When leaving the crime scene, suspects have been known to cast off items of evidence that can be recovered and examined to establish their identity. This post-crime period is also the stage where the suspect becomes concerned with cleaning up the scene. As much as a suspect may attempt to clean up, evidence transfers from the crime scene are often overlooked. These can range from hair and fiber on clothing to shards of glass on shoes. Frequently found post-crime are proceeds of the crime. These are often identifiable articles of stolen property with unique marks, victim DNA, serial numbers, or sometimes even trophies that the criminal takes as a keepsake.


Evidence does not always appear as a fully formed piece of information that offers an immediate connection or an inference to implicate a suspect. It often comes together as fragments of fact in timelines, spatial relationships, and evidence transfers between the originating stages of evidence constructing circumstantial pictures to demonstrate the suspect’s identity, the fact pattern of the crime, opportunity, means, or motive and intent.

Enhancing the Value of Evidence Recovered

Pieces of physical evidence often referred to as exhibits, have investigative values at two different levels for investigators. At the first level each physical exhibit has a face value represented by what it is and where it exists within the context of the crime scene. For example a bloody shoeprint found on the floor of a crime scene tells us that someone transferred evidence of blood onto their shoe from a source and walked in a particular direction within the crime scene. These are first level interpretations of evidence that we can reconstruct with our own observations. At the second level this same bloody shoeprint may be subjected to forensic examinations that could provide additional information. For example analysis of the shoeprint pattern, size, and accidental characteristics may allow a positive match to the shoe of a suspect, or the blood may be examined to match the DNA of a victim or other originating source. Both these first level and second level values can greatly assist in creating a reconstruction and interpretation of what happened at the crime scene.

Physical exhibits that need to be examined, seized, and documented at any crime scene are a major concern for investigators. As mentioned earlier, one of the big challenges for investigators is to identify and document all of the available evidence and information. This raises the important questions of what will become evidence and what is going to be important?

When the suspect and the fact-pattern are not immediately apparent, how does an investigator determine which items within the crime scene need to be considered and taken as possible evidence? There are some general practices that can be followed, but a guiding principle of evidence collection followed by most experienced investigators is to err on the side of caution. More is always better than less. To assist in deciding what could possibly become relevant, investigators need to consider:

Once the crime scene examination has been completed, and the crime scene has been unsecured and abandoned as an open area, returning to collect forgotten evidence is often not possible. It is better to collect everything that could possibly be relevant or could become relevant.

In terms of searching for evidence, once the crime scene has been locked down and secured, the crime scene itself needs to be considered as the first big exhibit. As the first big exhibit, it needs to be subjected to documentation using photography, video recording, measurements, and diagrams. Within this first big exhibit, other smaller and possibly-related exhibit may be discovered. What items are found and where may show spatial relationships of interaction demonstrating proof to support a sequence of events. This physical evidence will become the benchmark of known facts that investigators can use to verify the stories of victims and witnesses, or even the alibi of a possible suspect. Physical evidence at both level-one and level-two becomes the known facts upon which theories of events may be developed and tested. Any item could be considered evidence if it demonstrates a spatial relationship relative to the place, the people, or the times, relative to the criminal event.


The very first step at this point is securing and documenting the crime scene. It is helpful for investigators to recognize that a crime scene is not just a location where exhibits are found, but the crime scene should be considered as a single big exhibit unto itself. Not only will individual exhibits within the crime scene have value as evidence, the spatial relationships between exhibits in the scene may speak as circumstantial evidence to the overall event.

To secure the crime scene as the first big exhibit, investigators will conduct a complete walk-through on the path of contamination completely photographing and videotaping the entire crime scene. This first process is very helpful in demonstrating the exact state of the crime scene prior to things being moved for forensic examination. This should happen immediately after lock down and it will become a snapshot demonstrating the existing spatial relationships at that point in time.

Creating A Field Sketch and Crime Scene Diagram

The next step is to document the crime scene as either a field sketch or a crime scene diagram. Either of these can be done to illustrate the physical dimensions and notable characteristics of the crime scene. The difference between the Field Sketch and the Crime Scene Diagram is that the sketch, as implied by the name, is a quick rough depiction of the event. The field sketch, like notes in an investigator’s notebook, serves as a memory aid. The crime scene diagram is a more formal representation of the same information, but is composed to scale using the assistance of the field sketch and measurements. In either of these drawings of the crime scene similar core information will be represented.

The Exhibit Log

As part of the evidence management process, establishing the first link in the chain of continuity occurs when the crime scene is secured and the assigned exhibit custodian records of the exhibits that have been identified at the scene is created. These items are recorded in a document called an “Exhibit Log” or an “Exhibit Ledger”. This Exhibit Log or Ledger shows an assigned number for each exhibit that is identified and seized. It shows where at the scene the exhibit was located, and the number of that exhibit is place in the corresponding location in the crime scene diagram.

The Exhibit Log shows who seized the exhibit and when it was turned over to the exhibit custodian. The Exhibit Log also shows a time and date when the exhibit was placed into the main secure exhibit storage locker. When the exhibits are taken to court, the court will only accept the exhibits if the secured chain of continuity can be shown to be guarded and unbroken. If an exhibit custodian were to stop and leave the exhibits unguarded in a vehicle or left the exhibit in the office while attending to another matter – that would break the chain of continuity. The following document is an example of a common Exhibit Log Document.

Exhibit Log

Evidence at a crime scene is generally found in two forms. One is evidence of witnesses who can provide their observations of the criminal event. The other is physical items of evidence that can be examined, analyzed, and interpreted to illustrate facts about the criminal event. Each of these forms of evidence present some similar concerns for investigators, and each requires some specific considerations to best search for, collect, and preserve the information that exists.

Searching for Witness Evidence

Identifying and interviewing the witnesses to a criminal event can be as simple as speaking to persons who have remained at the scene of the crime to give statements. Alternately, it can be as difficult as identifying and tracking down a person who saw something or heard something that was part of the criminal event, but they are not even aware that what they saw or heard was important, or they do wish to cooperate with the police.

The process searching for witnesses starts at the crime scene itself. This search will include not only identifying and interviewing the persons who are immediately present, but also determining who else might have been present during the pre-crime and post-crime stages of the event.

In addition to these witness search strategies, another process known as canvassing for witnesses can also be employed. Canvassing is a strategy of conducting door-to-door inquiries in the immediate area of the crime to determine if anything was seen or heard by neighbours. Canvassing can also take the form of structured media releases to request persons with knowledge of the criminal event to come forward. Whatever witness identification strategies are used, time is of the essence. Memories fade and people under normal circumstances only retain day-to-day recollection of unremarkable events for a limited time. Identifying and speaking to the witness, and receiving their best recollection of the events, will be discussed in the chapter on witness management; however, witness evidence can make or break the investigation, and it must be collected quickly, accurately, and effectively.

Searching for and Identifying Physical Evidence

Earlier in this book, we described physical evidence as the buried treasure for investigators and critical when it comes to verifying or discounting various versions of an event in court. Physical evidence is something tangible that the court can examine and consider in making connections and determining proof beyond a reasonable doubt. In contrast, witness evidence does not have a physical quality that the court can observe. It requires the court to accept the perception and interpretation of events being provided by a person and, as such, the court cannot evaluate witness evidence with the same confidence of verification that it uses when considering physical evidence.

In our sub-section on Originating Stages of Evidence, we looked at the timeframes and alternate crime scene venues where evidence of a crime may be found. Now, we are going to consider the physical evidence that investigators should think about when evaluating what might constitute an item of physical evidence. We will consider how evidence can be searched for, how it should be collected, when it should be collected, and how it should be preserved. These processes present several challenges:

  1. Physical evidence can be transient or time sensitive. As part of the big picture search in the first instance, the investigator must be conscious of physical evidence that needs to be immediately recorded and documented.
  2. Physical evidence can be concealed and may not be easily visible. Walking onto a crime scene in the first instance, it would be unrealistic for an investigator to believe they will immediately see all the physical evidence that needs to be collected. Items of physical evidence can exist in many forms and discovering their existence is a matter of careful examination of the entire scene. The idea of conducting a big picture search first allows the investigator to not only discover the immediately apparent items, but also for a survey of the crime scene to determine areas where the small scale and more detailed search might be productive.
    • Doors and windows: open, locked, or unlock can be relevant to time and means of entry or exit from the scene
    • Condition of room lighting: turned on or off can suggest the lighting conditions at the time of the crime
    • Status of appliances in use at the scene can indicate certain activities
    • Last activation of electronic devices can narrow timelines of activity
    • Ambient crime scene temperature and body temperature can be relevant in relation to time of death and the progress rigor mortis or decomposition
  3. The immediate value of an item may not be visible at first glance. Moving from the big picture search to identify items in the smaller scale search, investigators can conduct a detailed grid search of the crime scene to locate items that may be very small or are concealed by other objects. These grid searches can be useful in breaking down the crime scene into smaller search areas to make sure that no area goes unexamined. Along with this detailed search for small or concealed items, the investigator needs to consider enlisting the assistance of forensic specialists to search for items that may require enhanced examination and analysis beyond the bounds of regular human senses and perception. For example, the use of black light can reveal body fluid or stains, and latent fingerprints can become visible after fuming or the application of special powder. In most major criminal cases, forensic specialists will be available to assist in conducting the detailed crime scene search. Every investigator must be proficient in recognizing when to utilise of these forensic tools.
  4. The size or nature of an item of evidence may make it impossible to seize or preserve. Among the challenges of gathering evidence at a crime scene are:
    • Some exhibits are too big to be physically seized and brought to court. As previously noted, the entire crime scene and the inherent spatial relationships of objects within that scene could be considered as one big exhibit that needs to be shown to the court. This big crime scene exhibit is captured and can be presented to the court by way of video recording, photographs, crime scene diagram, or using a sample of smaller exhibits within the scene itself.
    • Some exhibits are perishable and impractical to seize and preserve for court. A good example would be the evidence of the dead body in a murder case. The body itself would be impractical to bring to court. It is considered adequate to have photographic evidence and certificates of analysis on pathology samples.
    • Some exhibits are transient in nature and cannot be permanently seized and preserved for court. For example, ambient room temperature or lighting status at the crime scene needs to be preserved by photographs and measurements in that moment of time and subsequently presented to the court as photographs and readings by the attending investigator.
  5. The collection of certain evidence can cause cross-contamination to other exhibits. A major consideration in the collection of any evidence at a crime scene is to ensure that evidence with any potential for cross-contamination is handled in a manner that takes precautions against this occurring. In most cases, at major crime scenes, physical evidence is collected by forensic experts. However, this does not preclude the need for investigators to understand the dangers of cross-contamination and the precautions required to prevent it. This is particularly true when it comes to the collection of bodily substances where DNA might be collected. DNA analysis is now so advanced that even a small trace of DNA material can be transferred by the careless or inadvertent handling of one exhibit to the next. This cross-contamination can be avoided or prevented by the practice of handling only one exhibit at a time, marking that exhibit, placing into a secure container, and decontaminating the investigator by changing gloves and discarding any item could have come into contact with the previous exhibit. Despite the assurance that forensic specialists will normally attend a crime scene for evidence collection, it is possible that an investigator at the scene will be forced to handle a number of exhibits to protect that evidence from some type of environmental damage or other security threat.

Topic 4: Scaling the Investigation to the Event

Not every crime scene is a major event that requires an investigator to call out a team and undertake the crime scene and evidence management processes that have been described in this book. Often, for minor crimes, a single investigator will be alone at the crime scene and will engage in all the roles described, albeit on a far smaller scale. When this process is being undertaken by a single investigator on a smaller scale, the issues of diagram, security log, and exhibit log may be limited to data and illustrations in the notebook of the investigator.

It is important to stress that each of the tasks below needs to be considered and addressed for every crime scene investigation, no matter how big or how small. Specifically:

Large scale or small scale, all these issues must be considered, addressed, and recorded to satisfy the court that the crime scene and the evidence were handled correctly.


In this chapter, we have discussed the critical issues of crime scene management, evidence identification, evidence location, evidence collection, evidence protection, and proper documentation. These are the most important skills that an investigator can learn and incorporate into their investigative toolkit. As much as these tasks may seem simplistic, ritualistic, and mundane, they are the very foundation of a criminal investigation, and without this foundation of proper evidence practices in place, the case will collapse when it comes to court.

There is a great opportunity on a day-to-day basis for new investigators to begin practicing the protocols of crime scene management on a smaller scale investigating crimes such as break and entry and lower level assaults. Once these skills of crime scene management and evidence management are learned and incorporated into daily practice, they will become the procedural norm and will form the essential operational habits for proper and professional investigative practice.


Chapter 9: Interviewing, Questioning, and Interrogation

Chapter 9: Interviewing, Questioning and Interrogation

“Understanding the correct processes and legal parameters for interviewing, questioning, and interrogation, can make the difference between having a suspect’s confession accepted as evidence by the court or not.”

In this chapter, we will examine the interviewing, questioning, and interrogation of suspects as information gathering techniques police use to aid them in investigations. In modern day policing, interviewing, questioning, and interrogation techniques are measured, objective, and ethical. They are aimed at the goal of discovering the truth; not just getting a confession to a crime. This is a contrast to earlier times of policing, when techniques called the “third degree” sometimes involved threats, intimidation, coercion, and even physical violence. Fortunately, these “third degree” techniques were identified in the United States by the Wickersham Commission in 1931, as being unlawful police practices that caused false confessions and miscarriages of justice, where suspects were sometimes wrongfully convicted and imprisoned (Head, 2010).

Emerging from this, police forces across North America, who were using the “third degree” techniques to varying extents, started moving towards less oppressive and less aggressive methods of interrogating suspects (Gubrium, 2002).

While there has been a significant evolution to more objective and ethical practices, the courts still remain vigilant in assessing the way police interview, question, and interrogate suspects during criminal investigations. The courts expect police to exercise high standards using practices that focus on the rights of the accused person, and minimize any physical or mental anguish that might cause a false confession. In meeting these expectations, the challenges of suspect questioning and interrogation can be complex, and many police agencies have trained interrogators and polygraph operators who undertake the interrogation of suspects for major criminal cases. But not every investigation qualifies as a major case, and frontline police investigators are challenged to undertake the tasks of interviewing, questioning, and interrogating possible suspects daily. The challenge for police is that the questioning of a suspect and the subsequent confession can be compromised by flawed interviewing, questioning, or interrogation practices. Understanding the correct processes and the legal parameters can make the difference between having a suspect’s confession accepted as evidence by the court or not. With the above in mind, this chapter will focus on several salient issues, including:

  1. The progression from interviewing to questioning to interrogating, and how this progression relates to investigative practices
  2. The junctures that demonstrate the need to change from interviewing a witness to questioning a detained suspect to interrogating an arrested suspect
  3. The issues of physical and mental distress, and how to avoid the perception of officer-induced distress during an interrogation
  4. The seven elements to review to prepare an interrogation plan
  5. The five common reasons arrested suspects waive their right to silence and provide statements and confessions
  6. The interrogation strategies to initiate statements using the motivations within the five common reasons
  7. The three types of false confessor and strategies to deal with false confessions
  8. The additional rights of young offenders and practices required to meet the investigative obligations under Canada’s Youth Criminal Justice Act
  9. Ancillary offence recognition

Topic 1: Interviewing – Questioning – Interrogating

Police investigations can be dynamic, and the way events unfold and evidence is revealed can be unpredictable. This premise also holds true for interviewing, questioning, interrogating suspects. Players in a criminal event may be revealed as suspects at different stages of the investigation. To properly secure and manage the statement evidence that is gained during interactions with suspects or possible suspects, it is important for investigators to understand the actions that should be taken at each stage, while remembering that interviewing, questioning, and interrogating are terms that refer to separate stages in the process of gathering verbal responses from a suspect or a possible suspect. But each stage is different in relation to when and how the information gathering process can and should occur. The differences between these three stages needs to be defined in the mind of the investigator since they will move through a process of first interviewing, then questioning, and finally interrogating a suspect. When this progression occurs, the investigator needs to recognize the changing conditions and take the appropriate actions at the correct junctures to ensure that, if a confession is obtained, it will be admissible at trial. Given this, let us examine the operational progression of these three stages and identify the circumstances that make it necessary to switch from one stage to the next.

Interviewing a possible suspect is the first stage and the lowest level of interaction. In fact, the person is not even definable as a suspect at this point. As pointed out in our chapter on witness management, suspects often report criminal events while posing as witnesses or even victims of the crime. The investigator receiving a statement report from such a person may become suspicious that they are not being truthful; however, until those suspicions are confirmed by evidence that meets the test of forming reasonable grounds for belief, the investigator may continue to talk to this possible suspect without providing any Section 10 Charter or cautions. There is a unique opportunity at that point to gather the poser’s version of events, including any untrue statements that may afford an opportunity to later investigate and demonstrate a possible fabrication, which is by itself a criminal offence. The transition point for an investigator to move from interviewing a witness or victim to detaining and questioning the person as a possible suspect should occur when real evidence is discovered giving the investigator reasonable grounds to suspect that the person is involved in the event. Discovering real evidence and gaining “reasonable grounds to suspect” creates an obligation for the investigator to stop interviewing the person who then becomes a suspect. At this point, the person is a suspect a should be detained for the suspected offence and provided the appropriate Section 10 Charter and Statement Caution before proceeding with the questioning of the suspect.

Questioning a suspect is the next level of interaction. For a suspect to be questioned, there will be some type of circumstantial evidence that allows the investigator to detain that suspect. In our previous scenario of the young man found at 3AM standing under the tree in a residential area at the boarder of an industrial complex one block away from the building where a break-in was confirmed to have taken place, that young man was properly detained, chartered, and warned for the investigation of the break-in. However, there was no immediate evidence that could link him to that actual crime at that point. He was only suspected by the circumstantial evidence of time, conduct, and proximity to the event. He was obligated to provide his name and identification. If he had tried to leave, he could have been arrested for obstructing a police officer in the execution of duty. The investigator at the scene of that incident would have questioned this suspect, and by his rights under the Canadian Charter of Rights and Freedoms, the suspect would not be obliged to answer questions.

This right to not talk does not preclude the investigator from asking questions, and the investigator should continue to offer the suspect an opportunity to disclose information that may be exculpatory and enable the investigator to eliminate that person as a suspect in the crime being investigated. As an example of this, again, consider our young man who was detained when found standing under the tree near a break-in. If that man had answered the question what are you doing here by stating that he lived in the house just across the street, and when he heard the break-in alarm, he came outside to see what was happening, this would greatly reduce suspicion against the young man once this statement was confirmed. Subsequent confirmation by a parent in the home that they had heard him leave when the alarm sounded could eliminate him as a suspect and result in his release.

Interrogation is the most serious level of questioning a suspect, and interrogation is the process that occurs once reasonable grounds for belief have been established, and after the suspect has been placed under arrest for the offence being investigated. Reasonable grounds for belief to make such an arrest require some form of direct evidence or strong circumstantial evidence that links the suspect to the crime. Of course, where an arrest is made, the suspect will be provided with their charter rights and the police caution, as per the following:

Charter Warnings

Section 10(a)

“I am arresting/detaining you for: (State reason for arrest/detention, including the offence and provide known information about the offence, including date and place.)”

Section 10(b)

“It is my duty to inform you that you have the right to retain and instruct Counsel in private, without delay. You may call any lawyer you want. There is a 24-hour telephone service available which provides a legal aid duty lawyer who can give you legal advice in private. This advice is given without charge and the lawyer can explain the Legal Aid Plan to you. If you wish to contact a legal aid duty lawyer, I can provide you with the telephone number.

Do you understand?

Do you want to call a lawyer?” (Canadian Charter, 1982, s 10(a,b))

Police Warning

“You are not obliged to say anything, but anything you do say may be given in evidence.” (Transit Police, 2015)

If the suspect has already had communication with the police in relation to the offence being investigated, they should be provided with the secondary caution. This secondary caution serves to advise the accused person that, even if they have previously made a statement, they should not be influenced by that to make further statements.

Secondary Police Warning

“(Name), you are detained with respect to: (reason for detainment). If you have spoken to any police officer (including myself) with respect to this matter, who has offered you any hope of advantage or suggested any fear of prejudice should you speak or refuse to speak with me (us) at this time, it is my duty to warn you that no such offer or suggestion can be of any effect and must not influence you or make you feel compelled to say anything to me (us) for any reason, but anything you do say may be used in evidence” (Transit Police, 2015).

Once the accused has been afforded the opportunity to speak with a lawyer, the caution obligations of the police to the accused have been met, and the suspect may be questioned with respect to their involvement in the offence. These cautions and warnings may sound like a great deal of effort aimed at discouraging a suspect from saying anything at all to the police, and, in many cases that is the result. However, if the cautions are properly administered, and the opportunities to speak with counsel are properly provided, a major obstacle to the admission of any future statements has been satisfied.

Interrogation generally takes place in the formal environment of an interview room and is often tape-recorded or video-recorded to preserve the details of what was said. A video recording is the preferred means because it accurately represents the environment of the interview room in which the interrogation was conducted. In challenging the processes of an interrogation where a statement has been made by an accused, defense counsel will look for anything that can be pointed to as an oppressive environment or threatening conduct by the investigator. Within the appropriate bounds of maintaining an environment of safety and security, the investigator should make every effort to demonstrate sensitivity to these issues.

Seating in the room should be comfortable and balanced for face to face contact. The investigator should not stand over the suspect or walk around the room behind the suspect while conducting the interview. More than one investigator in the room with the suspect can be construed as being oppressive and should be avoided. The suspect should be offered a beverage or food if appropriate and should be told that a bathroom is available for their needs upon request. The demeanor of the investigator should be non-aggressive and calm, demonstrating an objective professional tone as a seeker of the truth. Setting a non-aggressive tone and establishing an open rapport with the suspect is not only beneficial to demonstrate a positive environment to the court, it also helps to create a positive relationship of openness and even trust with the suspect. This type of relationship can be far more conducive to gaining cooperation towards a statement or even a confession.

Prior to beginning the actual interrogation, the investigator should prepare an interrogation plan by:

  1. Reviewing the suspect’s profile, criminal record, and past investigations
  2. Reviewing the full details of the existing investigation to date
  3. Determining the elements of the offence that will need to be proved
  4. Determining if sufficient evidence has already been obtained to submit a prima facia case to Crown
  5. Examining evidence that demonstrates motive, opportunity, and means
  6. Determining what evidence was located and considered in forming reasonable grounds to arrest the suspect
  7. What physical evidence has been found that may yet be analyzed to prove the suspect’s involvement

Preparing the interrogation plan can assist the investigator in developing a strategy to convince the suspect to answer questions or confess to the crime. Those uninitiated to the process of interrogation might wonder why anyone would possibly choose to answer questions or confess when they have been provided with their Charter of Rights and Freedoms and the standard caution that they are not obliged to say anything, and anything they do say may be used as evidence. There are several reasons that can motivate or persuade a suspect to answer questions or confess. Statements or confessions are often made despite the warnings that would seemingly deter anyone from saying anything. These reasons include:

Investigators who are familiar with these reasons and motivations can utilize them in assessing their suspect and developing a strategy for their interrogation plan.


After making an arrest, an objective investigator must always be prepared to hear an explanation that will challenge the direct evidence or the assumptions of the circumstantial evidence that led to the reasonable grounds for belief to make that arrest. The best reason an arrested suspect can be offered to answer questions is to be exonerated from the crime. It is possible, and it does occur, that persons are arrested for a crime they have not committed. Sometimes, they are wrongly identified and accused by a victim. Other times, they are incriminated by a pattern of circumstantial evidence that they can ultimately explain. The interrogation following the arrest is an opportunity for the suspect to put their version of events on the record, and to offer an alternate explanation of the evidence for investigators to consider. Exoneration is not just an interrogation strategy; it is the duty of an objective investigator to offer a suspected person the opportunity of make an explanation of the evidence that led to their arrest. This can be initiated by offering the suspect the proposition, “This is the evidence that led to your arrest. If there is an alternate explanation for this evidence, please tell me what that is.” In some cases, the statements made by the suspect will require additional investigation and confirmation of facts to verify the exoneration. Conducting these investigations is also the duty of an objective investigator.

Deception to Outsmart the System

Some experienced criminals or persons who have committed well-planned crimes believe that they can offer an alternate explanation for their involvement in the criminal event that will exonerate them as a suspect. An investigator may draw answers from this type of suspect by offering the same proposition that is offered for exoneration. This is the opportunity for a suspect to offer an alibi or a denial of the crime and an alternate explanation or exonerating evidence. It can be very difficult for a suspect to properly explain away all the evidence. Looking at the progression of the event, an interrogator can sometimes ask for additional details that the suspect cannot explain. The truth is easier to tell because it happened, and the facts will line up. In contrast, a lie frequently requires additional lies to support the untrue statement. Examining a statement that is believed to be untrue, an interrogator can sometimes ask questions that expose the lies behind the original lie.


As much as the good guys versus the bad guys’ concept of criminal activity is commonly depicted in books and movies, experienced investigators can tell you that people who have committed a criminal offence often feel guilt and true regret for their crime. This is particularly true of persons who are first-time offenders and particularly young offenders who have committed a crime against a person.

Suspects fitting this category may be identified by their personal profile, which typically includes no criminal record, no police record or limited police record of prior investigations, evidence of poor planning, or evidence of emotional/spontaneous actions in the criminal event.

Suspects who fit this profile may be encouraged to talk by investigators who have reviewed the effect that the criminal act has had on the victim or the victim’s family. Following this review of victim impact, the investigator can accentuate the suspect’s lack of past criminal conduct, while making the observation that the suspect probably feels really bad about this. Observing the suspect during this progression, a suspect affected by guilt will sometimes exhibit body language or facial expressions of concern or remorse. Responses, such as shoulders slumping, head hung down, eyes tearing up, or avoiding eye contact, can indicate the suspect is ashamed and regretful of the crime. Observing this type of response, an investigator may move to a theme of conversation that offers the suspect the opportunity to clear their conscience by taking responsibility for their actions and apologizing or by taking some other action to right the wrong that has been done.

Explanation to Minimize Involvement

Suspects who have been arrested will sometimes be willing to provide an additional explanation of their involvement or the events to reduce their level of culpability or blame for the crime. In cases where multiple suspects have been arrested for a crime, one of those suspects may wish to characterize their own involvement as peripheral, sometimes as being before the fact or after the fact involvement. Examples of this would be a person who left the door unlocked for a break-in to take place or merely driving the getaway car. These less involved suspects hope to gain a reduced charge or even be reclassification as a witness against their co-accused. In such cases, where multiple suspects are arrested, the investigator can initiate this strategy by offering the proposition, “If you have only a limited or minimal level of involvement in this crime, you should tell me about that now.”

Surrender to Overwhelming Evidence

The arrested suspect in a criminal investigation waiting in custody for interrogation has plenty to think about. Even the most experienced criminals will be concerned about how much evidence the police have for proving their connection to the crime. In the process of presenting a suspect with the opportunity to address the evidence that has been collected, an additional strategy can sometimes be engaged where there is a large volume of incriminating evidence or undeniable direct evidence, such as eyewitnesses or strong forensic evidence for circumstantial connections of the suspect to the crime. In such cases, if the interrogator can reveal the evidence in detail to the suspect, this disclosure may result in the suspect losing hope and making a confession to the crime. Although this tendency to surrender to overwhelming evidence may seem illogical, it does happen. Sometimes, this surrender has more to do with conscience and shame of the crime, but other times, the offender has just lost the energy to resist what they perceive to be a hopeless fight. As counter intuitive as this may seem, research has found that the suspect’s perception of the strength of police evidence is one of the most important factors influencing their decision to confess to police (Gudjonsson & Petursson, 1991). More recent research has shown that the stronger the evidence, the more likely a suspect was to confess (Gudjonsson, 2015 ).

Topic 2: Dealing with False Confessions

As noted at the beginning of this chapter, the goal of ethical interviewing, questioning, and interrogation is to elicit the truth, and the truth can include statements that are either inculpatory confessions of guilt or exculpatory denial of involvement in a crime. Whenever an investigator has interrogated a suspect, and a confession of guilt has been obtained, that investigator needs to take some additional steps to ensure that the confession can be verified as truthful before it goes to court. These additional steps are required because, although the investigator has not used any illegal or unethical techniques, the court will still consider whether the accused, for some reason, has confessed to a crime they did not commit. A skilled defense lawyer will often present arguments alleging that psychological stresses of guilt or hopelessness from exposure to overwhelming evidence have been used to persuade a suspect to confess to a crime they did not commit. In such cases, it is helpful for the court to hear any additional statements made by the accused, such as those that reveal that the suspect had direct knowledge of the criminal event that could only be known to the criminal responsible.

In police investigations, there are many details of the criminal event that will be known to the police through their examination of the crime scene or through the interview with witnesses or victims. These details can include the actual way the crime was committed, such as the sequence of events, the tools used in the crime; or the means of entry, path of entry/exit, along with other obscure facts that could only be known by the actual perpetrator. There are opportunities in a crime scene examination for the investigator to observe one or more unique facts that can be withheld as “hold back evidence”. This hold back evidence is not made part of reports or media release, and is kept exclusively to test for false confessions. Confessing to the crime is one thing, but confessing to the crime and revealing intimate details is much more compelling to the court. Regardless of the effort and care that investigators take to not end up with a false confession, they still occur, and there are some more common scenarios where false confessions happen. It is important for an investigator to consider these possibilities when a confession is obtained. These situations are:

  1. The confessor was enlisted to take the blame – On occasions where persons are part of organized crime, a person of lower status within the group is assigned or sacrificed to take the blame for a crime in place of a person of higher status. These organizational pawns are usually persons with a more minor criminal history or are a young offender, as they are likely to receive a lesser sentence for the offence.
  2. The Sacrificial Confessor – Like the confessor enlisted in an organized criminal organization, there is another type of sacrificial confessor; the type who steps forward to take the blame to protect a friend or loved one. These are voluntary confessors, but their false confession can be exposed by questioning the confessor about the hold back details of the event.
  3. The Mentally Ill False Confessor – This type of false confessor are encountered when there is significant media attention surrounding a crime. As Pickersgill (2015) noted, an innocent person may voluntarily provide a false confession because of a pathological need for notoriety or the need to self-punish due to guilt over an unrelated past offences. Additionally, those suffering from psychosis, endogenous depression, and Munchausen Syndrome may falsely confess to a crime they did not commit (Abed, 2105). As with other false confessors, these people can be discovered using hold back detail questioning.

Topic 3: Interviewing, Questioning, and Interrogating Young Offenders

Over the past century, with the Juvenile Delinquents Act (1908), the Young Offenders Act (1984), and the Youth Criminal Justice Act (2003), there has been an increased recognition in Canada of the need to treat young offenders differently than their adult counterparts. Recognizing the special needs of youth, each of these acts moved to treat young offenders less punitively and with a greater attention to rehabilitation. Further, under the Youth Criminal Justice Act (YCJA), young offenders are regarded as a special category of suspect, and some very strict rules apply to the process of arresting, questioning, or interrogating a young offender. For instance, the YCJA requires the notification and inclusion of parents or guardians in situations where a youth is being subjected to action for an investigation or a charge for an offence. As well, any young persons must have their Charter Rights explained by the investigator with language appropriate to their age and level of understanding. This means that the officer must talk with and assess an accused youth to determine their ability to understand their rights before taking their statement.

The officer’s process of assessment will be questioned and examined by the court before any statement made by a youth is admitted as evidence. During this examination, the court will determine from the evidence whether the youth fully understood the rights being explained to them. An officer presenting evidence of having conducted a proper assessment of an accused youth should have notes reflecting the conversations and specific observations of the youth’s responses to satisfy the court that adequate efforts were made to ensure that the youth did understand their rights. Good evidence of understanding can be achieved by asking the youth to repeat, summarize, or paraphrase their understanding of the rights that were explained to them.

In addition to the right to instruct counsel, as afforded to any adult under the Canadian Charter of Rights and Freedoms, a youth must also be afforded the additional right of being given a reasonable opportunity to consult with a parent or, in the absence of a parent, an adult relative or any other appropriate adult chosen by the young person, as long as that person is not a co-accused or under investigation for the same offence.

Further, in addition to this right, there is also an obligation on the police investigator to provide independent notice to the parent of a detained young person as soon as possible. The requirement for notice to the parent is a separate obligation for police, and it requires specific notification of (a) the name of the young person, (b) the charge against the young person, and (c) a statement that the young person has the right to be represented by counsel. If a parent is not available to receive this notice, it may be given to a person whom the investigator deems appropriate. In the case of some young people, this could be an older sibling, an adult caregiver, or, for those in the care of Social Services, a social worker in charge of the young person care. In any case, these requirements and others specific to young offenders are spelled out under Sec 146 of the Youth Criminal Justice Act:

Youth Criminal Justice Act (Section 146)

(1) Subject to this section, the law relating to the admissibility of statements made by persons accused of committing offences applies in respect of young persons.

(2) No oral or written statement made by a young person who is less than eighteen years old, to a peace officer or to any other person who is, in law, a person in authority, on the arrest or detention of the young person or in circumstances where the peace officer or other person has reasonable grounds for believing that the young person has committed an offence is admissible against the young person unless

(a) the statement was voluntary;

(b) the person to whom the statement was made has, before the statement was made, clearly explained to the young person, in language appropriate to his or her age and understanding, that

(i) the young person is under no obligation to make a statement,

(ii) any statement made by the young person may be used as evidence in proceedings against him or her,

(iii) the young person has the right to consult counsel and a parent or other person in accordance with paragraph (c), and

(iv) any statement made by the young person is required to be made in the presence of counsel and any other person consulted in accordance with paragraph (c), if any, unless the young person desires otherwise;

(c) the young person has, before the statement was made, been given a reasonable opportunity to consult

(i) with counsel, and

(ii) with a parent or, in the absence of a parent, an adult relative or, in the absence of a parent and an adult relative, any other appropriate adult chosen by the young person, as long as that person is not a co-accused, or under investigation, in respect of the same offence; and(d) if the young person consults a person in accordance with paragraph (c), the young person has been given a reasonable opportunity to make the statement in the presence of that person.

(3) The requirements set out in paragraphs (2)(b) to (d) do not apply in respect of oral statements if they are made spontaneously by the young person to a peace officer or other person in authority before that person has had a reasonable opportunity to comply with those requirements.

(4) A young person may waive the rights under paragraph (2)(c) or (d) but any such waiver

(a) must be recorded on video tape or audio tape; or

(b) must be in writing and contain a statement signed by the young person that he or she has been informed of the right being waived.

(5) When a waiver of rights under paragraph (2)(c) or (d) is not made in accordance with subsection (4) owing to a technical irregularity, the youth justice court may determine that the waiver is valid if it is satisfied that the young person was informed of his or her rights, and voluntarily waived them.

(6) When there has been a technical irregularity in complying with paragraphs (2)(b) to (d), the youth justice court may admit into evidence a statement referred to in subsection (2), if satisfied that the admission of the statement would not bring into disrepute the principle that young persons are entitled to enhanced procedural protection to ensure that they are treated fairly and their rights are protected.

(7) A youth justice court judge may rule inadmissible in any proceedings under this Act a statement made by the young person in respect of whom the proceedings are taken if the young person satisfies the judge that the statement was made under duress imposed by any person who is not, in law, a person in authority.

(8) A youth justice court judge may in any proceedings under this Act rule admissible any statement or waiver by a young person if, at the time of the making of the statement or waiver,

(a) the young person held himself or herself to be eighteen years old or older;

(b) the person to whom the statement or waiver was made conducted reasonable inquiries as to the age of the young person and had reasonable grounds for believing that the young person was eighteen years old or older; and

(c) in all other circumstances the statement or waiver would otherwise be admissible.

(9) For the purpose of this section, a person consulted under paragraph (2) (c) is, in the absence of evidence to the contrary, deemed not to be a person in authority. (Government of Canada, 2015)

Topic 4: Ancillary Offence Recognition

Criminal acts can be complex and persons committing crimes can be devious. For every law prohibiting a criminal act, there are those who seek to avoid prosecution or to subvert the law completely. Criminal law has evolved into the current model to reflect the different types of crimes that are possible, and this evolution now includes laws known as ancillary offences. For an investigator, part of the investigative skill set is learning to recognize the evidence and fact patterns that constitute these ancillary criminal acts. These offences include:

For any of these offences, an investigator needs to be aware of the types of information and evidence that will support these charges. Sometimes an investigation will identify a suspect participant where there appears to be a nexus of involvement to the crime, but that nexus is not sufficient evidence of a criminal act to support an arrest or a charge. In these cases, an ancillary offence may be appropriate.

Conspiracy to Commit an Offence

A conspiracy to commit any offence requires an agreement between two or more persons to commit a criminal act.

Conspiracy Offence Criminal Code of Canada

(1) Except where otherwise expressly provided by law, the following provisions apply in respect of conspiracy:

(a) every one who conspires with any one to commit murder or to cause another person to be murdered, whether in Canada or not, is guilty of an indictable offence and liable to a maximum term of imprisonment for life;

(b) every one who conspires with any one to prosecute a person for an alleged offence, knowing that he did not commit that offence, is guilty of an indictable offence and liable

 (i) to imprisonment for a term not exceeding ten years, if the alleged offence is one for which, on conviction, that person would be liable to be sentenced to imprisonment for life or for a term not exceeding fourteen years, or

(ii) to imprisonment for a term not exceeding five years, if the alleged offence is one for which, on conviction, that person would be liable to imprisonment for less than fourteen years;

(c) every one who conspires with any one to commit an indictable offence not provided for in paragraph (a) or (b) is guilty of an indictable offence and liable to the same punishment as that to which an accused who is guilty of that offence would, on conviction, be liable; and

(d) every one who conspires with any one to commit an offence punishable on summary conviction is guilty of an offence punishable on summary conviction. (Dostal, 2012)

The offence that is being conspired upon is called the “target offence”, and that offence does not need to be carried out to constitute the offence of conspiracy. All that is required to establish the offence of conspiracy is evidence that two or more persons conspired together and formed a common intent to commit the targeted offence.

As an interesting side note to the conspiracy charge: if two persons conspire together to commit any offence outside of Canada and that offence would be an offence if committed in Canada, they may be charged with conspiracy (Government of Canada, 2017). In other words, two persons may conspire in Canada to commit a murder in the United States, and, even if that murder is not committed, they could be charged with conspiracy to commit murder.

Conspiracy opens the door to many possibilities where persons not otherwise chargeable may be held accountable for their part in a criminal act or in a proposed criminal act.

Consider the situation where an armed robbery of a bank occurs and three suspects flee the scene as police respond. The last suspect to exit the bank, William Tooslow, is stopped and arrested by police responding to the alarm, but the other two suspects escape. As the investigation proceeds, no additional evidence is found to identify the two robbers who escaped, but searches of Mr. Tooslow’s cell phone reveal book messages and emails with another male, Iben Faster, where plans to rob this bank were clearly being made over the past week.

Although there is not enough evidence to place Mr. Faster in the bank at the time of the robbery, he could still be charged with conspiracy to commit armed robbery, while Mr. Tooslow is charged with the actual offence of armed robbery. During an interrogation, a suspect may attempt to minimize their involvement in the crime and admit only to participating in making the plan. An investigator needs to recognize that this is still a chargeable offence.

Attempting to Commit an Offence

Like conspiracy, attempting to commit an offence does not require that the offence is committed.

Attempts – Criminal Code of Canada

24. (1) Every one who, having an intent to commit an offence, does or omits to do anything for the purpose of carrying out the intention is guilty of an attempt to commit the offence whether or not it was possible under the circumstances to commit the offence. (Dostal, 2012)

Unlike conspiracy, attempting to commit an offence only requires one person planning the crime to commit the target offence. For the offence of attempting to commit an offence to be completed, there must be evidence to show that the accused went past the point of mere planning and did something or omitted to do something in the furtherance of their plan. This attempting to commit provision can be a useful strategic tool for investigators because it provides the option to intervene before an offence in the planning stage takes place.

Consider the scenario where a suspect, Franky Yapsalot, tells a friend that he is planning to do a home invasion at the residence of a wealthy local businessman on Saturday night. The friend informs to the police and investigators conduct surveillance on Mr. Yapsalot. On Saturday night, Mr. Yapsalot is observed wearing dark clothing and gloves and gets into his car with a sawed off shotgun. As he drives into the residential area of the businessman’s home, police stop his car and make the arrest. In this case, sufficient evidence would exist to make a charge of attempted break and enter with intent to commit an indictable offence.

The offence of attempting to commit an offence can sometimes allow police to take effective enforcement action and intervene before the target offence occurs, without endangering the proposed victim of the planned offence. At the interrogation stage of an investigation, a suspect wanting to minimize his culpability may admit to sufficient planning and action to make out the offence of attempting to commit.

Being an Accessory After the Fact to an Offence

Accessory after the fact is another offence where a person can be charged with participating in a crime, even if they were not directly involved in planning or carrying out the primary offence.

Accessory after the fact – Criminal Code of Canada

23. (1) An accessory after the fact to an offence is one who, knowing that a person has been a party to the offence, receives, comforts or assists that person for the purpose of enabling that person to escape. (Dostal, 2012)

A person can be charged as an “accessory after-the-fact” to an offence, if evidence is discovered to show that they knew that another person had committed the primary offence and they received, comforted, or assisted that person to enable them to escape justice. An example of this offence could be where a person receives a phone call from a friend asking to be transported and hidden away after escaping from prison. If the friend complies with this request, they would become an accessory after the fact to the offence of escaping lawful custody.

Counselling a Person to Commit an Offence

In this type of ancillary crime, the person providing the counseling becomes a party to the offence if it is committed.

Person counselling offence – Criminal Code of Canada

22. (1) Where a person counsels another person to be a party to an offence and that other person is afterwards a party to that offence, the person who counselled is a party to that offence, notwithstanding that the offence was committed in a way different from that which was counselled.


(2) Every one who counsels another person to be a party to an offence is a party to every offence that the other commits in consequence of the counselling that the person who counselled knew or ought to have known was likely to be committed in consequence of the counselling.

Definition of “counsel”

(3) For the purposes of this Act, “counsel” includes procure, solicit or incite.
R.S., 1985, c. C-46, s. 22; R.S., 1985, c. 27 (1st Supp.), s. 7. (Dostal, 2012)

Like conspiracy and aiding/abetting, it is not necessary for the person providing the counselling to participate in the offence, and the offence does not even need to be committed following the exact instruction of the counsellor. A condition to this offence is that the counsellor will only be a party if they knew or should have known that the other person was likely to commit that crime in consequence of the counseling. An interrogator recognizing this offence would seek to draw out admissions of what the counselling suspect knew or should have known about the likelihood of the perpetrator committing the offence.

Parties to an Offence

The ancillary offence of being a party to an offence, under section 21(1) of the Criminal Code is also often referred to as aiding and abetting.

Parties to offence – Criminal Code of Canada
21. (1) Every one is a party to an offence who

(a) actually commits it;

(b) does or omits to do anything for the purpose of aiding any person to commit it; or

(c) abets any person in committing it.

Common intention

(2) Where two or more persons form an intention in common to carry out an unlawful purpose and to assist each other therein and any one of them, in carrying out the common purpose, commits an offence, each of them who knew or ought to have known that the commission of the offence would be a probable consequence of carrying out the common purpose is a party to that offence. R.S., c. C-34, s. 21. (Dostal, 2012)

Aiding and abetting is different from other ancillary offences in that it does not become a separate charge from the primary offence. In the cases of conspiracy, counselling, and accessory after the fact, persons are charged with those ancillary offences; however, in the case of aiding and abetting an offence, the person is charged with the primary offence. So, where evidence shows that a person purchased the weapons to enable an armed robbery to take place, that person would be charged under the section for armed robbery proper.


In this chapter, we have defined the stages and discussed the issues surrounding the investigative tasks of interviewing, questioning, and interrogating suspects in criminal investigations. We have also called attention to the specific change obligations that must be recognized and responded to by an investigator as the investigation progresses. In terms of the interrogation of suspects, this chapter examined the process of developing an interrogation plan by considering the variety of motivations that might cause a suspect to make a confession to a crime, and the additional protections afforded to youth was also discussed. In this chapter’s final section, definitions and examples of hybrid ancillary offences was presented, as was the need to interrogate suspects and investigate for additional evidence in support of proving the unique elements of ancillary offences, if they have occurred.

Study Questions


  1. At what point would an investigator move from interviewing a person to questioning them?
  2. At what point would an investigator move from questioning a suspect to interrogating them?
  3. What are three common scenarios where an investigator is likely to come across a false confession?
  4. What are two ways in which young offenders must be treated differently than adults by an investigator in the process of questioning them about involvement in a crime?
  5. What are six examples of ancillary offences that investigators need to be aware of?
  6. What evidence must be provided to show that a person can be charged with being an “accessory after the fact”?
  7. How is “aiding and abetting” different from other ancillary offences?



Chapter 10: Forensic Sciences

Chapter 10: Forensic Sciences

“Knowledge of forensic tools and services provides the investigator with the ability to recognize and seize on evidence opportunities that would not otherwise be possible.”

In this chapter, we examine various forensic sciences and the application of forensic sciences as practical tools to assist police in conducting investigations. The chapter is not intended to be a comprehensive dissertation of the forensic sciences available. Rather, it is intended to be an overview to demonstrate the broad range of forensic tools available. As we noted in Chapter 1, it is not necessary for an investigator to be an expert in any of the forensic sciences; however, it is important to have a sound understanding of forensic tools to call upon appropriate experts to deploy the correct tools when required. The forensic analysis topics covered in this chapter include:

  1. Physical Matching
  2. Fingerprint Matching
  3. Hair and fibre analysis
  4. Ballistic Analysis
  5. Blood Spatter Analysis
  6. DNA Analysis
  7. Forensic Pathology
  8. Chemical Analysis
  9. Forensic Anthropology
  10. Forensic Entomology
  11. Forensic Odontology
  12. Forensic Engineering
  13. Criminal Profiling
  14. Geographic Profiling
  15. Forensic Data Analysis
  16. Forensic Document Analysis
  17. Forensic Identification Sections
  18. Crime Detection Laboratories

Various types of physical evidence can be found at almost any crime scene. The types of evidence and where it is found can assist investigators to develop a sense of how the crime was committed. Tool marks where a door was forced open can indicate a point of entry, shoe prints can show a path of travel, and blood stains can indicate an area where conflict occurred. Each of these pieces of physical evidence is a valuable exhibit capable of providing general information about spatial relationships between objects, people, and events. In addition, the application of forensic examination and analysis could turn any of these exhibits into a potential means of solving the crime.

Topic 1: Physical Matching

If we think back to the example in Chapter 1 where the Bow Street Runners (McCrery, 2013) made a physical match from the torn edges of one piece of wadding paper to the original sheet from which it was torn, we can appreciate that physical matching is a forensic technique that can be applied, to some extent, by the investigator personally viewing and studying details of the evidence. At this level, physical matching can be used by investigators to do on site analysis of evidence. That said, the more sophisticated aspects of physical matching do require the expertise of a person trained in the techniques to form and articulate an opinion that the court will accept as expert evidence.

During a crime investigation, physical matching is typically conducted on items, such as fingerprints, shoe prints, tire prints, glove prints, tool impressions, broken glass, plastic fragments, and torn edges of items, such as paper, tape, or cloth. In these physical matchings, there are two levels of examination that are typically considered; an examination for class characteristics and an examination for accidental characteristics.

Level One – The Examination of the Item for Class Characteristics

Determining class characteristics takes place in relation to items, such as shoe prints, tire prints, glove prints, and tool impressions. At the first level of examination, these items can be classified and sorted based on type, make, model, size, and pattern. For example, if a shoe print is found at the scene of a crime and is determined to be a left shoe of a size 9, Nike brand, Air Jordan model, running type shoe with a wavy horizontal sole pattern, these class characteristics collectively provide a description of the suspect’s shoe based on five defined descriptors.

In turn, these class characteristics may allow the investigators to narrow their focus to suspects having that class description of shoe. It is not a positive identification of the shoe to any particular suspect, but it does allow the potential elimination of suspects who wear different sizes, brands, and sole patterns of running shoe. Using this Level One examination, an investigator at the crime scene may find a suspect shoe print showing a distinct size and sole pattern. If a suspect with a matching size and sole pattern is found near the crime scene, this Level One observation would provide strong circumstantial evidence to assist in forming reasonable grounds to suspect that this person was involved in this crime.

A Level Two examination may be able to produce a conclusive match. Positive identification requires this next level of examination, namely the examination for accidental characteristics.

Level Two – Accidental Characteristics

Accidental characteristics are the unique marks and features that develop on any item resulting from wear and tear. Looking back at the Nike Air Jordan Running Shoe, to make a positive match of a suspect’s shoe to the impression found at the crime scene, the crime scene impression would be examined for nicks, gouges, and wear patterns typically present on a worn shoe. These features would then be compared to a rolled impression of a suspect’s shoe, and if the same nicks, gouges, and wear patterns could be shown in all the same locations on the suspect’s shoe, a positive match could be made.

This Level Two method of comparison for things, such as shoes prints, tire prints, glove prints, and tool impressions, is the practice for physical matching. Investigators can often use these physical matchings to link the suspect back to the crime scene or the victim. Finding a suspect in possession of a shoe, a tire, or a tool that is a positive match to an impression at the criminal event is a powerful piece of circumstantial evidence.

With items, such as broken glass and plastic fragments, the process of physical matching requires significantly greater levels of expertise. At Level One, these items are first matched for general characteristics, such as material colour and thickness; however, the process for making the comparison of broken edges requires microscopic examination and photographic overlay comparison of broken edge features to demonstrate a positive match. For investigators, these kind of comparisons can be called upon where there is broken glass at a crime scene and fragments of glass have been found on a suspect’s clothing, or in cases where glass or plastic fragments are left at the scene of a hit-and-run car crash and a suspect vehicle is found with damage that includes similarly broken items. Glass fracture analysis can also be used to demonstrate which side of a piece of glass received the impact that caused the fracture. This can be a helpful tool in confirming or challenging a version of events, such as insurance fraud, break-in reports, and motor vehicle crashes where the damage has been exaggerated or staged. Glass fracture analysis can also be used to demonstrate the sequence and order in which a series of bullets have passed through the glass of a window. This can be helpful for an investigator to establish the origin location of the shooter, and, in cases of a drive-by shooting, the direction of travel.

Topic 2: Fingerprint Matching

The forensic science of fingerprints has a longstanding history in policing. Fingerprints have been accepted as being individually unique to each person. The courts frequently accept positive fingerprint matches conducted by an expert witness, as proof of identity beyond a reasonable doubt (Jain, 2010).

Prior to the modern advent of DNA analysis and biometric scanning technologies for positive identification, fingerprints and dental record x-rays were the only truly positive means of making a conclusive identification.

Fingerprints are unique patterns of lines and ridges that exist on the areas of our hands and fingertips, known as the plantar surfaces. These unique patterns have been classified in categories and features since the late 1800’s (Dass, 2016). The various categories and features allow each digit of a person’s fingers to be catalogued in a searchable system or database. These unique categories and features do not change throughout a person’s life, unless they are subjected to damage through physical injury or intentional abrasion. The impressions of our fingerprints are often left on items we touch because the oils our bodies produce act like an invisible ink adhering to smooth surfaces we touch, thus transferring these fingerprint impressions to those surfaces. These virtually invisible image transfers are commonly called latent fingerprints, and they are easily made visible on most surfaces through the application of colored fingerprinting powder that adheres to the oils left by our fingers. The powder sticking to the oil reveals the image of lines and ridges that make up the fingerprint. It is also possible for a fingerprint impression to be exposed on surfaces, such as plastic, dry paper, or paint though a process of chemical fuming that reacts with the oils of the fingerprint changing their color, thereby exposing the image. Fingerprints are sometimes also visible when they are transferred to an object because the finger has some foreign material on it, such as ink or blood. Other forms of visible fingerprints can be found as an actual moulded impression of the fingerprint when a person touches a malleable surface, such as clay or cheese.

The unique lines and ridges of an unknown fingerprint can be searched in a database of known criminal fingerprints for identification. Today, this type of search is done electronically using a biometric scanning process known as Automated Fingerprint Identification System (AFIS). For smaller partial prints, identification of a suspect requires sorting through possible suspects and conducting specific searches of print characteristics to make a match. If the person who left the print does not have a criminal record or their fingerprints are not on file, the only way a comparison can be made is to obtain a set of fingerprint impressions from that person. When this is done, the print examination will be conducted by a trained fingerprint expert who will search the print to establish as many points of comparison between the suspect print and the known-print as possible. The general accepted standard for accepting a match is to find ten points of comparison.

The location and identification of a suspect’s fingerprint at the scene of a crime, or on some crime-related object, is strong circumstantial evidence from which the court can draw the inference that the suspect is, in some way, connected to the crime. The investigative challenge of finding a suspect’s print is to eliminate other possible ways that the print may have been left at the scene, other than through involvement in the crime.

Topic 3: Hair and Fibre analysis

In considering once again “Locard’s Theory of Evidence Transfer”, (Petherick, 2010) it was suggested that a person cannot be at the scene of a crime without leaving something behind, and cannot leave the scene of a crime without taking something with them. Exhibits of hair and fibre fit support this theory well. As humans, we are constantly shedding materials from our bodies and our clothing. We enter a room and we leave behind strands of hair that fall from our heads, oily impressing of our fingerprints as we touch objects, and fibres of our clothing materials. As we leave a room, we take away hairs from other occupants of the room or fibres from the carpet and furniture adhering to our clothing. The analysis of hair and fibre, although not an exact science, can provide corroborative evidence. Hair samples can be compared taking a shed sample at the crime scene to the hair from a suspect to establish a similarity within a limited degree of certainty. If the hair happens to have been pulled out and still has root tissue, there is a possibility for more positive identification using DNA analysis. Somewhat more identifiable than hair samples, fibre samples can often be narrowed down to make a higher probability comparison using microscopic examination for size, color, and type between an unknown sample and control sample.

Topic 4: Ballistic Analysis

Given the number of gun-related crimes, the understanding of ballistic analysis is important for investigators. Ballistics is the study of all things that are launched into flight, how they are launched, and how they fly. In most cases, investigators find themselves dealing with several common types of firearms.

  1. Handguns as either semi-automatic pistols or revolvers
  2. Long rifles that are single shot bolt action, automatic, or semi-automatic
  3. Shotguns that are breach loading or chambered pump action

There are techniques in ballistic science that address the unique aspects of firearms and bullets. Because ballistic comparisons seek to determine if a particular gun was the originating source of an unknown bullet or cartridge casing, this examination process is sometimes referred to as ballistic fingerprinting. The analogy being that if a particular gun touched a particular bullet or cartridge-casing, it will leave behind some unique identifiable marks or a ballistic fingerprint.

Ballistic Fingerprints

When a modern day firearm is being loaded to fire, the cartridge loaded into the gun is composed of several components. The bullet portion of the cartridge is tightly pressed into a brass tube, called the casing. At the bottom of this brass casing is a round, flat base slightly larger than the casing, and this base prevents the casing from sliding completely into the cartridge chamber of the gun when being loaded. On the bottom of this flat base of the cartridge is the primer. When the trigger is pulled, the primer is the portion of the cartridge that will be struck by the firing pin of the gun. When struck, the primer ignites the gun powder contained inside the brass casing with an explosion that causes the bullet to leave the casing, travel down the gun barrel, and exit the gun.

Each of the components of the cartridge casing can be examined forensically and comparisons can be made to suspect guns. In some instances, it is possible to determine if a cartridge has been fired from the chamber of a specific gun. This can be done by examining the unique and identifiable marks left by four aforementioned components of the gun. Like the process of physical matching, this is also a two-level process.

At Level One, cartridges are classified by the calibre, which is the size of the bullet, the maker of the cartridge, and the primer location; either a centre-fire or a rim-fire cartridge on the cartridge base.

For ballistic purposes, guns are classified by their calibre, chambering and ejector mechanisms, and firing pin, namely either centre-fire or rim-fire. Eliminations of suspect weapons can often be made at Level One. For instance, a .38 calibre bullet removed from a crime scene cannot have been fired from a .22 calibre weapon. Or, that same .38 calibre bullet showing marks from an ejector mechanism could not have been fired from a .38 calibre revolver that does not have an ejector mechanism.

At Level Two, the more decisive ballistic fingerprint comparisons are often made using the following methods:

  1. Striations Matching;
  2. Chamber Markings;
  3. Firing-Pin Comparison; and
  4. Ejector markings.


  1. Striations Matching. Bullets fired from either a handgun or long rifle, other than a shotgun, fire a single projectile each time. This fired projectile is a lead or lead-composite bullet. When fired, this bullet travels down the barrel of the gun and begins to spin because the inside of the gun barrel has been intentionally machined with long gently turning grooves, called rifling. These grooves catch the soft-lead sides of the bullet spinning it like a football, and this spinning makes the bullet travel more straight and true to the target. As a result of these grooves designed into gun barrels, every bullet fired will arrive at its target with markings etched into the bullet material from contact with the grooves in the barrel. These etched markings are call striations, and they are uniquely identifiable back to the gun they were fired from. For an investigator, these striations create an opportunity to match the bullet to the gun that fired it. Recovered bullets can be recovered and compared to test bullets fired from a suspected gun. When striations of a recovered bullet are compared to known samples fired from a suspected gun, a side-by-side microscopic technique is used to match striation markings. An expert ballistic examiner can sometimes identify and illustrate matches in the striations to make a positive match.
  2. Cartridge Chamber Markings. When a cartridge is loaded into the chamber of a gun, the shiny brass casing comes into contact with the hard steel sides of the chamber. This chambering of the cartridge can leave unique and identifiable scratch marks on the side of the casing. A cartridge casing ejected or unloaded from a weapon and left at the crime scene can sometimes be matched to the suspect gun by comparing these markings.
  3. Firing Pin Comparison. When the firing pin of any gun strikes the primer on the bottom of a cartridge, it leaves an indentation mark. This firing pin indentation can sometimes be matched to the firing pin of a suspect weapon. This requires microscopic examination that looks for the unique characteristics of the firing pin that become impressed into the soft metal of the primer when the firing contact happens.
  4. Ejector Mechanism Markings. Methods for loading and unloading weapons have evolved considerably due to different gun designs. The simplest guns allow the user to open the breach of the gun exposing the cartridge chamber to manually insert the cartridge and close the breach to make ready for firing. There is no ejector mechanism for these guns, so there will be no ejector marks left on the base of a cartridge when it is unloaded from the weapon. Other guns have a variety of different ejector methods, including ejectors that catch the base of the cartridge casing to physically pull it from the breach and eject them away from the gun. In cases where a gun does have an ejector mechanism, these mechanisms leave very distinct and unique marks on the soft brass cartridge base. These markings can sometimes be compared and matched back to the ejector of a suspect weapon. With this broad variety of ballistic comparison techniques, an investigator has a significant number of tools that can be deployed and strategies that can be engaged to assist in matching a bullet to the gun that fired it. Considering these tools, the cartridge casing left at the scene of a shooting can be as important as a bullet removed from the body of a shooting victim. An investigator needs to keep this in mind when seizing cartridge casings as evidence. Great care needs to be exercised to document the location where each individual casing was found, and to preserve each casing in a manner that does not degrade the possible markings that could enable a match to be made. Damage can be done by placing casings into a common bag where they can rub against each other causing more characteristics and obliterating existing marks.

Trajectory Analysis

In addition to the ballistic fingerprinting examinations, another area of ballistic science is known as trajectory analysis. The trajectory of a bullet is the path it travels from the time it leaves the barrel of the gun to the point where it finally loses the propulsion energy of the gunpowder and comes to rest. The flight of a bullet can be very short, as in the case of a point blank shooting, where a victim is shot at very close range, or it can be very distant where the target is one mile away or more, as in the case in some sniper shootings.

When the bullet is traveling a longer distance, it travels that distance in an arched path or trajectory of travel as it is pulled towards the ground by gravity. When the bullet arrives at its destination, it will have a distinct angle of entry into the target. This angle of entry can sometimes be calculated as trajectory to estimate the geographic location of the originating shot. In cases where a bullet passes through several objects, such as two walls of a house, the trajectory of the bullet can be used to determine where the shooter was located. In cases of drive-by shootings, for example, where several shots are fired, the pattern of trajectories can show if the shooter was moving and, if so, demonstrate the direction of travel.

Topic 5: Blood Spatter Analysis

Blood spatter analysis, also known as blood stain pattern analysis, is a relatively new forensic specialty. The purpose of this analysis is to determine the events of a crime where blood has been shed. This is accomplished through the careful examination of how blood is distributed inside the crime scene. Studies have shown that when blood is released during an attack, certain patterns of distribution can be expected (National Science Forensic Technology Center, 2012). For instance, a person being struck with a baseball bat will begin to bleed, and blood will be distributed in a droplet spatter pattern in the direction of the strike behind the victim. These droplets of blood will have a direction of travel that will be indicated by the directional slide of each droplet as the bat hits objects in its path. Blood from the victim adhering to the bat can also be distributed when the bat is on the upstroke for the next strike. This blood will be distributed in an upward directional slide pattern, for example, up a wall, onto a ceiling, or behind the attacker. Calculations of how many strikes were made may become evident from the tracking of multiple streams of droplets behind the victim and behind the attacker. Given this developing science, blood spatter analysis can be useful in criminal event reconstruction.

Topic 6: DNA Analysis

DNA, or deoxyribonucleic acid, is a molecule that holds the genetic blueprint used in the development, functioning, and reproduction of all living organisms. As such, it carries the unique genetic information and hereditary characteristics of the cells from which living organism are formed. Except for identical twins, the DNA profile of each living organism is unique and distinct from other organisms of the same species. There are some rare cases where one person may carry two distinct types of DNA, known as Chimera (Rogers, 2016) where paternal twin embryo merge during gestation, or in cases where a bone marrow transplant enables the production of the marrow donor DNA in the recipient’s blood. In these rare cases, a person may test for two distinct DNA profiles for different parts of their body.

In human beings, DNA comparison can enable high probability matches to be made between discarded bodily substances and the person from whom those substances originated. Bodily substances containing cellular material, such as blood, semen, seminal fluid, saliva, skin, and even hair root tissue can often be compared and matched back to its original owner with high statistical probabilities of comparison (Lindsey, 2003). Sometimes, even very old bodily substances, such as dried blood, dried saliva, or seminal stains, can be analyzed for a DNA profile. The introduction of DNA analysis has allowed investigators for advocates to re-examine historical evidence and exonerate persons wrongfully convicted and imprisoned for criminal offences (Macrae, 2015).

DNA is a very powerful tool for investigators and can be considered anytime discarded bodily material is found at a crime scene. Even very small amounts of material can yield enough material for DNA comparison. Importantly, DNA data-banks of known criminals and unsolved crimes are now becoming well established in North America (Royal Canadian Mounted Police, 2006). When a person is convicted of certain criminal offences, DNA is collected and submitted to these databases.

Topic 7: Forensic Pathology

Forensic Pathology is the process of determining the cause of death by examining the dead body during an autopsy. An autopsy generally takes place in the pathology department of a hospital. In the case of a suspicious death or a confirmed homicide, police investigators will be present at an autopsy to gather information, take photographs, and seize exhibits of a non-medical nature, such as clothing, bullet fragments, and items that might identify the body. These items would include personal documents, fingerprints, and DNA samples.

During an autopsy, a forensic pathologist dissects the body carefully examining, documenting, and analyzing the body parts to determine the cause of death. In the first stage of an autopsy, the pathologist examines the body for external injuries and indicators of trauma that may provide a cause of death. In this first stage of examination, the pathologist will make an estimate of the time-of-death by observing evidence of four common post-mortem (after-death) indicators. These are body temperature, the degree of rigor mortis, post-mortem lividity, and progress of decomposition.

Body Temperature

Algor Mortis is the scientific name given to the loss of body temperature after death which can sometimes be used to estimate the time of death (Guharaj, 2003). This is a viable technique in cases where the body is being examined within 24 hours following death. This method of estimating time of death can vary significantly dependent upon many possible variables, such as:

Considering a normal body temperature of 37° Celsius at the time of death, it can be estimated that the body will cool at a rate of 1° – 1.5° Celsius per hour. This calculation is known as the Glaister Equation (De Saram, Webster, & Kathirgamatamby, 1956). So, taking an internal rectal temperature and subtracting that from 37° Celsius will provide an estimate of the number of hours that have passed since the time of death. For example, a dead body with a measured temperature of 34° Celsius would provide a time range of 3 to 4.5 hours since the time of death.

Rigor Mortis

Rigor mortis is a term used to describe the stiffening of the body muscles after death. A dead body will go from a flaccid or limp muscle condition to one where all the muscles become contracted and stiff causing the entire body to become constricted into a fixed position. After being in a constricted and fixed position, the muscles eventually become flaccid again (Advameg, Inc., 2017). In normal room temperatures, this stiffening of muscles and the relaxing again has a predictable time progression of approximately 36 hours. In this progression, the stiffening of muscles will take approximately 12 hours, the body will remain stiff for 12 hours and will progressively become flaccid again over the next 12 hours.

Stiffening of muscles begins with the small muscles of the hands and face during the first 2 to 6 hours, and then progresses into the larger muscle groups of the torso, arms, and legs over the next 6 to 12 hours. These are general rules; however, the rate of rigor mortis can be different for infants, persons with extreme muscle development, or where extensive muscle activity precedes death, such as a violent struggle (Cox, 2015).

In determining the time of death in average environmental temperatures, Cox (2015) recommended that:

  1. If the body feels warm and is flaccid, it has been dead for less than 3 hours
  2. If the body feels warm and is stiff, it has been dead for 3 to 8 hours
  3. If the body feels cold and stiff, it has been dead for 8 to 36 hours
  4. If the body feels cold and is flaccid, it has been dead more than 36 hours

Post-Mortem Lividity

Post-mortem lividity refers to a discoloration or staining of the skin of a dead body as the blood cells settle to the lowest part of the body due to gravity. This discoloration will occur across the entire lower side of a body; however, in places where parts of the body are in contact with the floor or another solid object, the flesh compresses and staining will not occur in that area. The staining is a reddish-purple coloring, and it starts to become visible within 1 hour of death, and become more pronounced within 4 hours. Within the first 4 hours, lividity stains are not fixed and, if the body is moved, the blood products will shift and stain the part of the body that has become lower. In most cases, these stains become fixed between 12 and 24 hours. As such, they can be viewed as an indicator of how the body was left at the time of death. Importantly, if a body is found with post-mortem lividity stains not at the lowest point in the body, it can be concluded that the body has been moved or repositioned after the 12 to 24 hour stain setting period (Cox, 2015).


This is the final indicator a pathologist can look at to estimate the time of death. Sometimes, dead bodies are not discovered in time to use body temperature, rigor mortis, or early lividity indicators to estimate a more exact time of death. In these cases, assessing the progress of decomposition becomes important. Decomposition starts as soon as the body ceases to be alive. Subject to environmental conditions of extreme heat or cold, the readable signs of decomposition will become apparent 36 to 48 hours after death (EnkiVillage, 2017). These signs include bloating of the body and a marbling discoloration of the skin in a spider web pattern along surface blood vessels. As the body continues to decay, the skin surface will open and body fluids will begin to seep out. In advanced stages of decomposition, the body is often no longer identifiable by facial recognition, and DNA testing or dental records become the tools to determine identity. At very advanced stages of decomposition, flies and maggots begin to emerge, and the number of life cycles of the maggot-to-fly can be estimated by a forensic entomologist to provide the amount of time that has passed since these insect life cycles began.

Once these preliminary examinations have been made, the pathologist will cut the corpse open to conduct a detailed internal examination of each organ to look for signs of trauma, disease, or external indicators that might explain the cause of death, such as water in lungs or toxins in blood.

Causes of Death

There are a wide range of possible causes of death and pathologists are trained to look for these indicators, gather the evidence, and develop an expert opinion regarding the cause of death. Causes of death can include:

In cases of laceration or stabbing, wounds are inflicted by a sharp weapon or pointed object. The pathologist will attempt to determine if the death was caused by damaging a vital organ or by blood loss. The distinction here is that a person may be cut or stabbed in a way that causes them to bleed to death, which will be indicated to the pathologist by only a small amount of blood remaining in the body. Alternately, a laceration or stab wound may penetrate the heart, lungs, or the brain in a way that causes the organ to stop functioning and causes death. In these cases, the pathologist will make a determination and render an opinion of fatal organ damage.

In cases of stabbing, the pathologist can sometimes illustrate the entry point of the wound and trace the wound path to determine an angle of entry indicating how the stab wound was inflicted. The size, depth, and width of the wound may indicate the size and type of weapon used to create the injury. Similarly, examining the characteristics of the wound can provide information to allow the pathologist to offer an expert opinion on the direction of a laceration or cut wound by illustrating the start point and the termination point. This information can be helpful for investigators in reconstructing or confirming the actual actions and weapons used in a criminal event.

In cases of shooting, the pathologist will make a determination of whether death was caused by the fatal destruction of a vital organ or by blood loss. Recovery of a bullet or fragments of a bullet from inside the body can be helpful in ballistic analysis. Examining the entry wound can sometimes indicate the distance from which the wound was inflicted. In cases of point blank or direct contact shootings, gunshot (burned gun powder) residue will be present at the entry point of the wound. As with stab wounds, the pathway that the bullet travelled from the entry point into the body to where it came to rest can sometimes be identified by a pathologist to determine the angle of entry. For investigators, this information can be helpful in reconstructing the criminal event and determining the location of the shooter. In cases of self-inflicted gunshot wounds, a point blank entry point and a bullet path indicating a logical weapon position in the hand of the victim can provide some confirmation or contradiction of the self-inflicted wound theory.

In cases of blunt force trauma, the pathologist will look for indications of organ destruction or massive internal bleeding causing death. Blunt force trauma can be inflicted in many ways, such as massive sudden trauma from a fall from a great height, or a high-speed car crash that can immediately damage the brain, the heart, or the lungs to the point where they cease to function resulting in death. Other blunt force traumas, such as a strike to the head with a weapon, may not immediately cause death, but result in massive bleeding and internal accumulation of blood that can cause death. In cases of head injuries pathologists will sometimes be able to determine the contact point where the injuries were inflicted, and they will be able to point to the contre coupe injury effect, which happens when the head is struck on one side and the brain is so traumatically moved inside the skull that it also become damaged on the opposite side and bleeding occurs at the top of the brain. This bleeding inside the skull can sometimes cause death.

In a similar effect, Shaken Baby Syndrome (SBS), (Elsevier, 2016) occurs when an infant child is violently shaken by a person and the baby’s brain moves back and forth traumatically inside the skull causing bruising and sometimes fatal bleeding at the front and back of the brain. An examination by the pathologist for the contact points and internal bleeding can provide valuable clues to the manner in which the blunt force trauma was inflicted. According to An Investigator’s Manual for Shaken Baby Syndrome, studies indicate that SBS is the leading cause of death in children under two years of age and research studies the United Kingdom and the United States indicate that SBS may occur each year in as many as 24 to 30 per 100,000 children under two years of age (Smith, 2010).

In cases of asphyxiation, a pathologist will look for indicators of how the body was deprived of oxygen. Several common means include strangulation, suffocation, smoke inhalation, or drowning. For strangulation, the pathologist will look for bruising around the neck inflicted by choking hands or by a ligature. A ligature is any item, such as a rope or a belt, which could be used to restrict breathing and stop oxygenated blood going to the brain, thus causing death. If a ligature has been used and removed, it will leave a distinct abrasion line. If a dead body is found with a ligature in place, investigators should take great care to not untie the ligature, but cut it off of the victim, as this allows the ligature size to be measured and compared to the size of the neck to determine the amount of breathing that was restricted. Once the ligature is removed from a dead body, a distinct ligature mark or a groove in the flesh will sometimes be visible.

To determine strangulation, the pathologist will examine the eyes of the victim for the presence of small ruptured blood vessel that appear as red spots on the white of the eyeball. These spots are known as petechial hemorrhage, and will often be visible in victims of strangulation (Jaffe, 1994).

Suffocation as a cause of asphyxiation occurs when a victim’s breathing is stopped by an object, such as a pillow or a plastic bag, which restricts the ability of a victim to breath, thus causing death. Unlike strangulation, suffocation has fewer indicators of violent trauma. Suffocation deaths are sometimes accidental and are harder for pathologist to conclusively determine. The presence of a suffocation device at the scene of the death is sometimes a first clue to this cause. Other contributing causes can be the limited ability of a victim to remove the device that accidentally obstructs their breathing, as may be found with a very young child, a handicapped person, or a frail elderly victim.

Another unique type of asphyxiation death is Auto Erotic Asphyxia (AEA). This occurs when a person is attempting to enhance their sexual arousal or pleasure while masturbating and apply self-strangulation with a ligature device. Their goal in AEA is not suicide but rather to reach a state of extreme oxygen deprivation and euphoria at the time of orgasm. This strategy can go wrong when the individual passes out and their ligature does not release causing continued strangulation and death. These cases can resemble suicide; however, they are really death by misadventure because the victim had no intent to kill themselves. AEA can sometimes be distinguished from suicide by the existence of apparent masturbation, pornography at the scene, and ligature devices that have releasable controls.

In cases where asphyxiation is caused by smoke inhalation, a pathologist can find signs of soot blackening in the lungs and, if the air containing the smoke was sufficiently hot, the lungs will also show signs of burn trauma. Because arson is sometimes used as a means of disguising a homicide, finding a dead body in a burning building, and not finding signs of smoke in the lungs, is a red flag for possible death by homicide.

In cases where asphyxiation is caused by drowning, a pathologist will find signs of water present in the lungs. If there is a question as to the location of the drowning, it is possible to have a diatom test conducted on the victim’s tissue. If the victim was drowned in fresh water, the diatom material, which is microscopic algae, will have migrated from the water in the lungs to the blood and tissue of the victim. These microscopic algae are species unique to a particular body of water. Diatom material found in a victim’s lungs should match the diatom sample from the water where the body was found. If it does not match, this suggests that the victim drowned elsewhere.

In cases of toxic substances, a pathologist will test the stomach contents, the blood, eye fluid known as vitreous humor, and tissue samples from various organs in the body for poisons, drug overdose, the ingestion of toxic chemicals, or toxic gas inhalation. Any of these substances can cause death if ingested or inhaled in sufficient quantities.

In cases of electrocution, a person dies because of an electrical current passing through their body that stops the heart. A pathologist will look for signs to confirm that a current passed through the body, including contact burns where a person has touched a source of power that entered their body and existed to a grounding point. This grounding point is often at the ground through the feet, but can be through a shorter contact pathway, if another hand or part of the body was in contact with a grounded object. Burns will also be visible where the electrical current exited the body.

Cases where the necessities of life have been deprived generally occur where there is a dependent relationship between a caregiver and a victim. The victims in these cases are typically very young or very elderly persons who are unable to take care of their own needs. These cases often take place over and extended periods of time and may include other types of physical neglect or abuse. Failing to provide necessities of life is such a significant issue that the Criminal law in Canada makes provision for this as an offence.

Duty of persons to provide necessaries

215 (1) Everyone is under a legal duty

(a) as a parent, foster parent, guardian or head of a family, to provide necessaries of life for a child under the age of sixteen years;

(b) to provide necessaries of life to their spouse or common-law partner; and

(c) to provide necessaries of life to a person under his charge if that person

(i) is unable, by reason of detention, age, illness, mental disorder or other cause, to withdraw himself from that charge, and

(ii) is unable to provide himself with necessaries of life.

Marginal note: Offence

(2) Every one commits an offence who, being under a legal duty within the meaning of subsection (1), fails without lawful excuse, the proof of which lies on him, to perform that duty, if

(a) with respect to a duty imposed by paragraph (1)(a) or (b),

(i) the person to whom the duty is owed is in destitute or necessitous circumstances, or

(ii) the failure to perform the duty endangers the life of the person to whom the duty is owed, or causes or is likely to cause the health of that person to be endangered permanently; or

(b) with respect to a duty imposed by paragraph (1)(c), the failure to perform the duty endangers the life of the person to whom the duty is owed or causes or is likely to cause the health of that person to be injured permanently. (Justice Laws Canada, 2017)

Marginal note: Punishment

(3) Every one who commits an offence under subsection (2)

(a) is guilty of an indictable offence and liable to imprisonment for a term not exceeding five years; or

(b) is guilty of an offence punishable on summary conviction and liable to imprisonment for a term not exceeding eighteen months. (Justice Laws Canada, 2017)

If the death of a person is found to be the result of failing to provide the necessities of life, the responsible caregiver can ultimately be charged with criminal negligence causing death.

Topic 8: Chemical Analysis

There are a wide range of chemicals and usages that can be used in the commission of a crime or found at the scene of a crime. In addition to general chemical analysis, there are several sub-areas for analysis in cases of:

Topic 9: Forensic Archeology

Relatively new in the forensic world, forensic archeology is the use of archeological methods by experts to exhume crimes scenes, including bodies. These forensic experts are trained to methodically excavate and record their dig. They document the recovery of artifacts (evidence), such as human remains, weapons, and other buried items, that may be relevant to the criminal event. Forensic archeologists will often work in concert with other forensic experts in DNA, physical matching, forensic entomology, and forensic odontology in the examination of evidence.

Topic 10: Forensic Entomology

Forensic entomology is a very narrow field of forensic science that focuses on the life cycle of bugs. When a dead body has been left out in the elements and allowed to decompose, the investigative challenge is not only to identify the body, but to establish the time of death. Once a body has decomposed, the process of determining time of death can be aided by a forensic entomologist. As discussed in a previous chapter, these experts look at the bugs that live on a decomposing body through the various stages of their life cycle. From these life-cycle calculations, scientists are sometimes able to offer and estimate relative time of death.

Topic 11: Forensic Odontology

To paraphrase the description provided by Dr. Leung (2008), forensic odontology is essentially forensic dentistry and includes the expert analysis of various aspects of teeth for the purposes of investigation. Since the advent of dental x-rays, dental records have been used as a reliable source of comparison data to confirm the identity of bodies that were otherwise too damaged or too decomposed to identify through other means. The development of DNA and the ability to use DNA in the identification of badly decomposed human remains has made identity through dental records less critical. That said, even in a badly decomposed or damaged corpse, teeth can retain DNA material inside the tooth, allowing it to remain a viable source of post-mortem DNA evidence (Gaytmenn, 2003).

Beyond the identification of dead bodies, forensic odontology can sometimes also provide investigators with assistance in confirming the possible identity of a suspect responsible for a bite mark. This comparison is done by the examination and photographic preservation of the bite mark on a victim or an object, and the subsequent matching of the details in that bite mark configuration to a dental mould showing the bite configuration of a known suspect’s teeth. Although bite mark comparison has been in practice for over fifty years there remain questions to the reliability for exact matching of an unknown bite mark to a suspect (Giannelli, 2007).

Topic 12: Forensic Engineering

Forensic engineering is a type of investigative engineering that examines materials, structures, and mechanical devices to answer a wide range of questions. Often used in cases of car crashes, forensic engineers can often estimate the speed of a vehicle by examining the extent of damage to a vehicle. They can also match damage between vehicles and road surface to determine the point of impact and speed at the time of impact. Many police agencies now have specialized traffic personnel trained in accident analysis and accident reconstruction. These officers utilize a variety of forensic engineering techniques to examine and document the dynamics of car crashes to establish how and why a crash occurred.

In cases of building collapses, forensic engineers can conduct analyzes to determine the cause of a structural failure and, in the case of an intention explosion, such as in acts of terrorism, this can point to the location of the planted explosive device. The investigative possibilities for forensic engineering are too extensive to elaborate here, but if damage to a building, an object, or a piece of equipment poses an investigative question, the tools of forensic engineering should be used to seek answers.

Topic 13: Criminal Profiling

Criminal profiling, also referred to as psychological profiling, is the study of criminal conduct to develop the most likely social and psychological profile of the person who may have committed the crime based on the actions of known criminals who have committed that same type of crime in the past (Royal Canadian Mounted Police, 2015). Criminal profiling draws on information from many sources, including historical criminal statistics of known criminals. Additionally, other information is collected about violent criminals and their modus operandi. This kind of information can shed light on details, such as preferences for luring victims, taking trophies, abduction methods, bondage preference, torture methods, means of killing, and displaying a dead body after death. With information and specific data collected from a wide assortment of offenders, psychological profilers work with investigators to examine the details of a criminal investigation, and, based upon the known historical criminal conduct data, they determine probable descriptors and characteristics that might be expected in a current suspect’s profile.

For investigators, this kind of profiling can be helpful in focusing the investigation on the most likely persons. As an extension of these profiling techniques, a database known as Violent Crime Linkage Analysis System (ViCLAS) has been in place in Canada since the 1990s. This system documents the criminal conduct of convicted violent offenders and sex offenders, as well as certain unsolved cases, with a goal of documenting crime types and criminal conduct into a searchable database where unsolved crimes can be linked to offenders with matching profiles. According to the ViCLAS system web page, “Since the implementation of ViCLAS across the country, the database continues to swell with cases. As of April 2007, there were approximately 300,000 cases on the system and over 3,200 linkages have been made thus far,” (Royal Canadian Mounted Police, 2015). Criminal profiling provides a valuable tool for sorting and prioritizing suspects identified for further investigation. In some cases, a new suspect may even be identified through the existing data within the ViCLAS database.

Topic 14: Geographic Profiling

Geographic profiling is similar to psychological profiling in that it seeks to focus on the possible conduct of an unknown criminal based on the data collected from the known past criminal conduct of others. Unlike psychological profiling, geographic profiling is focused specifically on where a suspect might reside relative to the location where his or her crimes are currently being committed.

In the late 1980’s, police Detective Inspector Kim Rossmo developed a mathematical formula that began the evolution in the new forensic science of geographic profiling. Dr. Rossmo validated his mathematical formula from his observation that criminals generally seemed to live within an identifiable proximity to the chosen locations where they committed their crimes (Rossmo, 1987). Applying this method, when a criminal is suspected of committing a series of offences, it is possible to have the locations of those offences examined by a geographic profiler to estimate where that suspect most likely resides. This assessment can be helpful in searching for and identifying new suspects by prioritizing suspects based on the location of their residence relative to the identified area with the highest probability for a suspect to be found.

Topic 15: Forensic Data Analysis

In today’s digital world, criminal conduct frequently includes evidence in the form of digital data. The collection of data from cellular phones as proof of a criminal conspiracy, or the message tracking of images passed in the distribution of child pornography, all require significant levels of specialized technological knowledge to collect, preserve, and analyze the exhibits. Some crimes, such as identity theft and the subsequent fraudulent misappropriation of funds, are almost entirely digital data crimes, and they cross over several fields of technological expertise. It is now incumbent upon ordinary investigators to understand the basics of how to preserve digital evidence, and to know when and if digital evidence may be present. An ordinary investigator without forensic data skills and qualifications should never attempt to recover digital data evidence without help. The destruction of evidence would be like an untrained investigator trying to lift fingerprints at a crime scene.

Topic 16: Forensic Document Analysis

Forensic document analysis is typically done by certified forensic document examiners working as independent contractors or as employees within the service of government funded crime detection laboratories. Most often tasked within the scope of fraud investigations, these specialists examine items, such as wills, land titles, contracts, deeds, seals, stamps, bank checks, identification cards, handwritten documents and documents from photocopiers, fax machines, and printers. These documents are often examined to authenticate them as genuine or unaltered original documents where an allegation of misrepresentation or fraud has been made. Original signatures are also sometimes called into question, and these examiners can make a determination of authenticity by comparing the signature sample to samples known to be genuine. Forensic experts are also called upon to analyze threatening letters, ransom letters, or hold-up notes to make a connection to an identified suspect.

Topic 17: Forensic Identification Sections

Forensic identification sections are the frontline forensic specialists typically working within their own police agency. Usually, these specialists are experienced police officers who have taken forensic training in photography, fingerprint examination, physical matching, evidence collection, and crime scene management to work within this type of section. The daily work of forensic identification sections involves attending crime scenes, and conducting a variety of examinations using special fingerprint dusts, chemical fuming agents, and ultraviolet light sources to uncover impressions of fingerprint, shoeprints, tool marks or even body fluid stains not visible to the naked eye. Once the stain or the image of a forensic impression is found, these specialists can record, preserve, and recover the exhibit using photography and specialized tools for lifting the exhibit from a surface or removing the entire imprinted surface as an exhibit.

Topic 18: Crime Detection Laboratories

Crime Detection Laboratories, such as the RCMP labs across Canada, provide a range of specialties, including;

Scientists hired to work in these crime detection laboratories require a four year specialized degree in the field of their choice. Once hired, they undergo an understudy period of 12 to 18 months in a laboratory with an expectation that they will become proficient enough in their chosen field to achieve expert qualification from the court. This expert status will allow them, on a case-by-case basis, to render expert opinion evidence on their examination of forensic exhibits.

For an investigator wishing to engage the services of the Crime Detection Laboratory, it is necessary to complete a request for analysis of the exhibit they wish to have examined and deliver that exhibit, either in person or by double registered mail, directly to the Crime Detection Laboratory to ensure continuity of the exhibit. Once examined, the analyst will return the exhibit again either by calling for a personal pick up or by double registered mail along with a certificate of analysis detailing the result of the examination. The certificate of analysis can become an exhibit for disclosure to the defense in a criminal case, and, if uncontested, will be accepted by the court as evidence. If contested, the Crime Detection Laboratory Scientist will be called to attend court and provide testimony of the examination and the results as an expert witness. They are generally cross examined by the defense to validate their expert qualifications and analyzes.


This chapter outlined a wide variety of forensic tools and services available for criminal investigators. For any investigator, knowledge of forensic tools and services provides him/her with the ability to recognize and seize on evidence opportunities that would not otherwise be possible. The picture of physical evidence found at any crime scene only has face value as a collection of objects to be viewed and considered in their existing connection to the event. Analysis of those same objects using forensic tools can add significant information, making a circumstantial connection between the players and the event, and adding new insights. Forensic analysis can make the difference between solving a crime and it becoming a cold case.

Study Questions

  1. In terms of a physical matching, what is the difference between a Level One and a Level-Two examination?
  2. How are latent fingerprints made visible?
  3. What is the difference between a Level One and Level Two ballistics examination?
  4. What is blood spatter analysis?
  5. What are four common post-mortem indicators considered in an autopsy?
  6. How else can a pathologist be helpful to police besides being able to speak to cause of death?
  7. What is forensic archeology?
  8. What is forensic entomology?
  9. What is criminal profiling?
  10. What is ViCLASS?



Chapter 11: Summary

Chapter 11: Summary

The goal of this book has been to provide a new student of investigation with an overview of the skills required by a criminal investigator. As an introduction to criminal investigation, this overview has intentionally avoided delving into many areas of specialized criminal investigation. Some of these areas of investigation, such as financial crime, criminal profiling, and computer crime, are so unique and focused, that they cannot be adequately summarized here. That said, persons seeking to move into these specialized areas of investigation are well served to properly learn the core skill that are presented here.

This book has outlined the task skills and thinking skills required to guide the process of investigation. Presented here as a structured investigative model, the STAIR tool brings together the task skills relating to gathering, preserving, and documenting evidence with the thinking skills of analysis, theory development, investigation and fact validation. This structured system is intended to help new investigators achieve a personal awareness of their own investigative thinking, and create their own mental map for an investigative process that can be followed, documented, repeated, and enhanced through professional experience.

In the past, learning the necessary investigative skills and thinking were expected to evolve and develop in a model where the learner received basic police training, and was then exposed to progressively more complex investigations. This allowed the investigator to evolve their-own mental map for a functional investigative process. In this traditional learning model, investigators were expected to make mistakes and learn from their mistakes to evolve their personal learning of the investigative process. Often under the guidance of mentors and field trainers, good criminal investigators developed their skills and reach high levels of professionalism and competency. This book is not intended to take issue with the traditional learning model, but to suggest a means where new investigators are provided a thinking perspective and tools that enable them to enhance their learning process in ways other than exclusively through personal experience.

The intent of this book has been to provide readers with a head start in their investigative learning process by discussing the need to be aware of their own thinking process and to create a mental map. The STAIR tool has been developed to provide a guide to this mental mapping process. In doing so, this book discussed criminal law, witness management, interviewing and interrogation, crimes scene management, and forensic sciences. Many of these topics are sufficiently complex that entire books have been written about them. In this book, the treatment of these topics has been intentionally introductory to provide the reader with a basic awareness of each topic in its specific relationship to the criminal investigative process. As a very broad overview of these key issues, the new investigator will only have a generalist understanding of these topics and can use this book to assist them in evolving their ongoing learning in a self-directed mode relative to their perceived needs as the complexities of their new investigations might demand.

Investigative Learning Going Forward

Many topics relative to investigative practices have not been covered as part of the core knowledge requirements for a new investigator. These topics include:

  1. Major Case Management
  2. Informant and confidential source management
  3. Undercover investigations
  4. Specialized team investigations

While we cannot consider these topics in any depth, it will important for the new investigator to at least know about them with respect to more advanced practices of criminal investigation.

Topic 1: Major Case Management

A contemporary practice for the handling of major criminal investigations involving multiple jurisdictions, multiple investigative agencies, and often serial criminal events, Major Case Management is a system designed to achieve order, cooperation, and information sharing between police agencies. In Canada, creating and adopting the practices of Major Case Management was driven by the 1995/1996 report and Commission of Inquiry recommendations of Justice Archie Campbell examining the various police agency investigations into the activities of Paul Bernardo, who was a serial rapist and murderer whose activities between 1987 and 1992 included the rape or sexual assault of at least eight women in the areas of Scarborough, Peel, and St Catharines, Ontario, and the murder of three women in St. Catharines and Burlington, Ontario (Campbell, 1996). To quote directly from the Campbell’s report:

The Bernardo case, like every similar investigation, had its share of human error. But this is not a story of human error or lack of dedication or investigative skill. It is a story of systemic failure.

It is easy, knowing now that Bernardo was the rapist and the killer, to ask why he was not identified earlier for what he was. But the same questions and the same problems have arisen in so many other similar tragedies in other countries.

Virtually every interjurisdictional serial killer case including Sutcliffe (the Yorkshire Rapist) and Black (the cross-border child killer) in England, Ted Bundy and the Green River Killer in the United States and Clifford Olsen in Canada, demonstrate the same problems arise and the same questions. And always the answer turns out to be the same – systemic failure. Always the problems turn out to be the same, the mistakes the same, and the systemic failures the same.

What is needed is a system of case management for major interjurisdictional serial predator investigations. As system that corrects the defects demonstrated by this and so many similar cases.

A case management system is based on co-operation, rather than rivalry, among law enforcement agencies. A case management system is needed that depends on specialized training, early recognition of linked offences, co-ordination of interdisciplinary and forensic resources, and some simple mechanisms to ensure unified management, accountability and co-ordination when serial predators cross police borders. (Campbell, 1996)

From the recommendations of the Campbell Report, the Canadian Police College in Ottawa, Ontario took a leadership role in working with police agencies and investigators from across Canada to develop a major case management system and training that would address the concerns raised by the Campbell report. The major case management system allows for the creation of case specific major case management teams when it is determined that a serious criminal investigation crosses jurisdictional boundaries. In this system, the major case management team operates as an autonomous case specific unit, led by a command group comprised of a team commander, a primary investigator, and a file coordinator. In this structure, the team is staffed with experienced investigative personnel from each of the partner agencies, and no single partner agency has control over the conduct of the investigation.

Partner agencies receive reports on the investigative progress and provide their collective input to the team through contact with only the team commander. The major case management team handles the specific case, receiving all evidence and incoming information through the file coordinator as TIPS and each TIP is assigned by the primary investigator for follow up by the investigators on the team. The team follows a strict regime of daily information sharing through a process of daily briefings, and all team members are encouraged to share their investigative progress and to assist in the creation and development of investigative strategies. New or inexperienced investigators are not assigned to duties as part of a Major Case Management team. Being selected to participate as an investigator on one of these team means that your investigative skills have reached the point where you can be counted on to perform at a very high level.

Topic 2: Informant and Confidential Source Management

Informants and confidential sources often provide police investigators with information to solve a single crime or to investigate a criminal organization. In court cases, such as R vs Basi (2009), the courts have recognized that confidential informants are a critical tool for effective police work. Given this, the court provides privilege for the police and Crown to not reveal the identity of a source in court, particularly in cases where that privilege has been asked for by the source and agreed to by the police as a condition of providing information (Dostal, 2012).

Even with the condition of anonymity, experienced source handlers know that if their informant participates in the criminal event as an agent of the police, the source can be classified by the courts as an “agent provocateur”, and may not claim the privilege of anonymity. These complexities of confidentiality make source and informant management a very sensitive matter. Failure to manage the informant or their information properly can result in the identity of the person being revealed with the risk of deadly consequences or having to put the informant into a witness protection program.

The field of informant management and protection requires trust building and communication skills that will be effective with persons who are part of the criminal community. This is sometimes achieved by using discretion, not pursuing the more minor criminal activities of an informant, or even trading away certain criminal charges against the informant in exchange for specific information on a more serious crime. These strategies can be very delicate, and often require the collaboration with Crown Prosecutors in cases where the administration of justice may be compromised by an investigator acting independently.

A new investigator would not become involved in these higher level informant management cases, but could start building the framework and network of street-level contacts to learn the skills of informant management. The first stages of building the skill set to manage informants and confidential sources starts with learning to have non-judgemental conversations with members of the criminal community. When persons in the criminal community see a police investigator as fair, friendly, and approachable, this opens the door for the investigator to approach those contacts for specific inquiries when an occasion presents itself.

Topic 3: Undercover Investigations

An undercover investigation is the practice of a police officer posing as someone other than a police officer for the purpose of collecting evidence of criminal activity that would otherwise be difficult to acquire. The possible personas of the undercover investigator are almost limitless and can range from posing as a person seeking to purchase drugs from local traffickers to impersonating a vulnerable elderly citizen in a park to capture a purse snatcher preying on the elderly. There are also deep undercover strategies that may include establishing a longer term identity with the purpose of infiltrating a criminal organization or a dissident political group to gain internal intelligence of organizational activities, culture, and membership.

Police investigators often find undercover strategies successful because criminal activity can be witnessed firsthand, and admissions of guilt made to undercover operators by criminals can be admitted to court without the need of the usual voir dire to test for admissibility. When conducting undercover operations, investigators must be careful to ensure that their presence and communication with the suspect is not the catalyst that causes that person to initiate a crime or carry through with a crime they would not otherwise have done. If these dynamics of initiating the crime occur, a defence of entrapment can sometimes be made on behalf of the accused person. New investigators may be given the opportunity to participate in minor undercover roles fairly early in their careers, and these can be valuable learning experiences.

Topic 4: Specialized Team Investigations

The urbanization of communities and the evolution of fields of specialized policing have created new opportunities for officers. Where it was once the case that a police officer was expected to be a generalist capable of working across a wide range of policing fields, the level of expertise now expected in many fields is such that specialized investigative teams have become the norm. Specialized investigative duties now include:

For a new investigator, each of these specialities offers an area and a direction where they may decide to direct their career, and it is not uncommon for a police officer to move through several specialized sections over the course of their policing career. What each of these specialized teams does have in common is that investigators on these teams have all achieved the level of basic investigative task skills and thinking skills required to make them a valuable asset to their team and their organization.

As new investigators continue to develop their investigative knowledge applying the task skills and thinking skills presented in this book, it is important to remember that practice and experience are critical components of the ongoing investigative learning. Many police organizations have carefully developed field training programs where new recruits are challenged to engage and demonstrate investigative skills within a set schedule of tasks to complete the compulsory training.

Once this set schedule is completed, it is then incumbent upon the new investigator to become a more self-directed learner. In most policing organizations the path to ongoing investigative duties and the associated experience and skills development that come with those duties, is only available to those who actively seek that experience.

The secret to continued development as an investigator is a simple one; become a self-directed learner and seek out investigative experience and learning at any and all levels available. These work experiences may seem mundane and tedious at times, but every witness interviewed, every search completed, each piece of evidence properly collected and marked, every report written, and every experience testifying in court, is part of the ongoing experience and learning.



Abed, R. (2105, November 14). Irish Journal of Psychological Medicine, 12. Retrieved from

Allen, R. J. (1991). The Nature of Judicial Proof. Cardozo Law Review, 373-422 .

Arcaro, G. (2009). Criminal Investigations: Forming Reasonable Grounds (Fifth ed.). Toronto, Ontario: Emond Montgomery Publications Limited.

Bennett, M. (2015). Unspringing the witness memory and demeanor trap: What every judge and jury needs to know about cognitive psychology and witness credibility. Wahington: American University of Law.

Brainerd, C. J., & Reyna, V. F. (2005). The Science of False Memory. Oxford, UK: Oxford Universtiy Press. 

Britannica, E. O. (2015). DNA Chemical Compound . Retrieved from Enclyclopedia Britannica:

Byrnes, T. (2015). Professional Criminals of America (1886). Retrieved from Online at

Campbell, J. A. (1996). Bernardo Investigation Review. Toronto: Solicitor General and Minister of Correctional Services.

Cox, W. A. (2015). Early Postmortem Changes. Retrieved from

Dass, S. C. (2016). Classification of Fingerprints. Retrieved from Department of Statistics & Probabilities:

De Saram, G.S.W., Webster, G., Kathirgamatamby, N. (1956). Post-Mortem Temperature and the Time of Death. Crim. L. Criminology & Police Science, 46.

Dostal, P. (2012). Accessory After the Fact. Retrieved January 15, 2017, from The Canadian Criminal Law Notebook:

Dostal, P. (2012). Attempts. Retrieved January 15, 2017, from The Canadian Criminal Law Notebook:

Dostal, P. (2012). Conspiracy (Offence). Retrieved January 15, 2017, from The Canadian Criminal Law Notebook:

Dostal, P. (2012). Counselling. Retrieved January 15, 2017, from The Canadian Criminal Law Notebook:

Dostal, P. (2012). Informer Privilege. Retrieved January 16, 2017, from The Canadian Criminal Law Notebook:

Dostal, P. (2012). Parties to an Offence. Retrieved January 15, 2017, from The Canadian Criminal Law Notebook:

Dostal, P. (2012). Principled Exception to Hearsay. Retrieved January 12, 2017, from The Canadian Criminal Law Notebook:

Dostal, P. (2012). Principles of Fundamental Justice. Retrieved January 20, 2017, from The Canadian Criminal Law Notebook:

Elsevier, B. (2016). Coup contrecoup injury. Retrieved January 27, 2017, from Science Direct:

Advamag, Inc. (2017). Rigor Mortis and Other Postmortem Changes. Retrieved January 16, 2017, from Encyclopedia of Death and Dying:

EnkiVillage. (2017). How Long Does It Take for a Body to Decompose? Retrieved January 16, 2017, from EnkiVillage:

Fookes, S. A. (1973). Patrol Sergeant. (A. GEHL, Interviewer)

Gaytmenn, R. S. D. (2003). Quantification of forensic DNA from various regions of human teeth. Journal of Forensic Science, 48(3), 622-625.

Gecker, R. A. (1989). The Doctrine of Necessity and Its Parameters. Marquette Law Review, 1 – 39 Volume 73 Article 1.

Giannelli, P. C. (2007). Faculty Publications Paper 153. Retrieved Janauary 27, 2017, from Case Western University School of Law:

Gibson, D. (2014). The Kennedy Assassination Cover-up. New York City, NY: Kroshka Books .

Goff, L. (2015). Early post-mortem changes and stages of decomposition. Retrieved from Springer Science+Business Media B.V. 2009:…/post-mortem-changes.pdf

Government of British Columbia. (2015, Nov 27). British Columbia Police Act. Retrieved from

Government of Canada. (2015, November 13). Canada Evidence Act. Retrieved from

Government of Canada. (2015). Youth Criminal Justice. Retrieved from Justice Laws Website – Youth Criminal Justice:

Government of Canada. (2015). Your Guide to the Canadian Charter of Rights and Freedoms. Retrieved from

Government of Canada. (2017). Canada Evidence Act (R.S.C., 1985, c. C-5). Retrieved January 23, 2017, from

Government of Canada. (2017, January 14). Conspiracy. Retrieved January 11, 2017, from

Gubrium, J. F., & Holstein, J. A. (2002). Handbook of Interview Research: Context and Method. Thousand Oaks: Sage Publications Inc.

Gudjonsson, G. H., & Petursson, H. (1991). Custodial interrogation: Why do suspects confess and how does it relate to their crime, attitude and personality?. Personality and Individual Differences12(3), 295-306.

Guharaj, P. V. (2003). Forensic Medicine 2nd Edition. Hyderabad: Longman Orient: Sangam Books Ltd.

Head, T. A. (2010). Crime and Punishment in America. New York, NY: Infobase Publishing.

Henry, E. R. (1900). Classification and Uses of Fingerprints. Routledge.

Hill v Hamilton-Wentworth Regional Police Services Board, 2007 SCC 41

Hitchcock, T. S. (2015, June 05). The Proceedings of the Old Bailey, 1674-1913. Retrieved from

Irwin Law. (n.d.). Prima facie case. Retrieved January 14, 2017, from The Canadian Online Legal Dictionary:

Jaffe, F. A. (1994). Petechial Hemorrhages: A Review of Pathogenesis. The American Journal of Forensic Medicine and Pathology, 203-207.

Jain, A. F. (2010). Fingerprint Matching. Biometrics, 36-44.

Justice Canada. (2017, January 14). Rules of Evidence in Canada. Retrieved January 14, 2017, from Canada Evidnce Act:

Justice Department Canada. (2017, January 02). Rules of Evidence. Retrieved from

Justice Laws Canada. (2017). Duty of persons to provide necessaries. Retrieved January 16, 2017, from

Kaufman, F., & Morin, G. P. (1998). The Commission on Proceedings Involving Guy Paul Morin: Report. Ministry of the Attorney General.Legal Information Institute. 

Lindsey, S., Hertwig, R., & Gigerenzer, G. (2003). Communicating Statistical DNA Evidence, 43 Jurimetrics J. 147-163.

MacCallum, E. P. (2008). Report of the Commission of Inquiry into the Wrongful Conviction of David Milgaard. Regina, SK: Saskatchewan Government.

MacDonell, J. (1820). Report of State Trials Volume 1. London: The State Trial Committee.

Macrae, M. (2015). Is the Science of DNA Wrongful Conviction-Proof? Retrieved January 17, 2017, from Innocence Canada:

McCrery, N. (2013). Silent Witnesses. London: Random House Books.

McRory, S. (2014). Introduction to Criminal Process for Inspector. Compliance Assurance Learning and Development Program, 43. Edmonton, AB: Alberta Energy Regulator.

Morgan, C. H. (2004). Accuracy of eyewitness memory for persons encountered during exposure to highly intense stress. International Journal of Law and Psychiatry, 265-279.

National Science Forensic Technology Center. (2012). A Simplified Guide To Bloodstain Pattern Analysis. National Science Forensic Technology Center. Retrieved January 15, 2017, from

Oorsouw, K. M. (2015). Alcohol intoxication impairs memory and increases suggestibility for a mock crime: a filed study. Applied Cognitive Psychology, 29, 293-501.

Oppal, W. (2013). The report of the mission women commission of inquiry. British Columbia Government.

Pennington, M. (1999). Miscarriages of Justice: A call for continued research focussing on reforming the investigative process. Journal of Forensic Practice, 13, 61-71.

Petherick, W. A. (2010). Forensic Criminology. London: Elsevier Academic Press.

Police Executive Research Forum. (2014). The Police Response to Active Shooter Incidents. Critical Issues in Policing Series, 1-46.

R v Abernathy, 2002 BCCA 8

R v Basi, 2009 SCC 52, [2009] 3 SCR 389

R v Beare, 1988 2 SCR 387

R v Beaudry, [2007] 1 SCR 190, 2007 SCC 5

R v Briscoe, 2010 SCC 13, [2010] 1 SCR 411

R v Ferguson, 1996 BCCA 342

R v Gagnon, 2006 MBCA X at 13 

R v Godoy, 1999 1 SCR 311

R v Graham, 1974 S.C.R. 206

R v Grant, 2009 SCC 32 

R v Khan, 1990 2 SCR 531

R v Kowlyk, 1998 2 SCR 59

R v Lifchus, 1997 3 SCR 320 

R v Mann, 2004 3 SCR 59

R v Perka, 1984 2 SCR 232

R v Schell, 2004 188 CCC (3d) 254 (ABCA)

R v Smith, 1992 2 SCR 915

R v Starr, 2000 2 S.C.R. 144

R v Steinberg, 1931 SCR 421

R v Stinchcombe, 1991 3 SCR 326 

R v Storrey, 1990 1 SCR 241

R v Terrence, 1983 1 SCR 357

R v Walsh, 1978 48 CCC (2d) 199 (ONCA)

R v Woodcock, 1789 168 E.R. 352 (K.B.) 

Reith, C. (1943). Preventive Principle of Police. Journal of Criminal Law and Criminology, 34, 206-209.

Resnick, H. S., Kilpatrick, D. G., Dansky, B. S., Saunders, B. E., & Best, C. L. (1993). Prevalence of civilian trauma and posttraumatic stress disorder in a representative national sample of women. Journal of Consulting and Clinical Psychology, 984-991.

Rex v. Burdett, 1820 4 B. & Aid

Rogers, K. (2016). Chimera Genetics. Retrieved from Encyclopedia Britanica:

Rose, C. & Beck, V. (2009). Eyewitness accounts: False facts, false memories, and false identification. Journal of Crime and Justice, 39(2), 243-263.

Rossmo, D. K. (1987). Geographic Profiling Target Patterns of Serial Murderers. Burnaby: Simon Fraser University.

Rossmo, D. K. (2009). Criminal Investigative Failures. Bocal Raton: CRC Press Taylor & Fransis Group.

Royal Canadian Mounted Police. (2006, September 01). National DNA Data Bank. Retrieved January 16, 2017, from

Royal Canadian Mounted Police. (2015, Nov 27). Criminal Investigative Analysis . Retrieved from

Salhany, R. (2008). Taman Inquiry into the Investigation and Prosecution of Derek Harvey-Zenk. Winnipeg: Government of Manitoba.

Sansregret v The Queen, 1985 1 SCR 570

Savino, J. O., Turvey, B. E., & Freeman, J. L. (2011). Rape investigation handbook. Waltham: Academic Press – an imprint of Elsevier.

Sebetic, E. (1950). Marquette Law Review 128. Retrieved from

Shah, A. K. (2008). Heuristics Made Easy: An Effort-Reduction Framework. Psychological Bulletin, 134(2)207-22. doi: 10.1037/0033-2909.134.2.207

Smalarz, L., & Wells, G. L. (2015). Contamination of eyewitness self-reports and the mistaken-identification problem. Current Directions in Psychological Science24(2), 120-124.

Smith, C. (2010). Shaken Baby Syndrome – An Investigator’s Perspective. Abbotsford: University of the Fraser Valley.

Sopinka, J. (1999). The Law of Evidence in Canada 2nd ed. Toronto, Ontario: LexisNexis Canada.

Streets, M. D., & Gerald, M. (1990). The homicide witness and victimization; PTSD in civilian populations: a literature review. Jefferson Journal of Psychiatry8(1), 12.

Taber, K. (2006). Beyond Constructivism: the Progressive Research Programme into Learning Science. Studies in Science Education, 42, 125-184.

Thomas, S. A. (2000). JonBenet: Inside the Ramsey Murder Investigation. New York, NY: St Maritn’s Paperback.

Thompson, R. (2013, September 11). Hearsay and Exceptions to Hearsay Rule. Retrieved from

Transit Police (2015, November 14). Police Warnings – Transit Police. Retrieved from

Varney, C. A. (2009). Procedural Fairness. 13th Annual Competition Conference of the International Bar Association. Fiesole, Italy: Antitrust Division United States Department of Justice.


About the Authors

About the Authors

Rod Gehl, is a retired police Inspector, and an instructor of criminal investigation for International Programs and the Law Enforcement Studies Program at the Justice Institute of British Columbia. These ongoing teaching engagements are preceded by 35 years of policing experience as criminal investigator and a leader of multi-agency major case management teams. From his experiences Rod has been a keynote speaker at several international homicide conferences and has assisted in the development and presentation of Major Case Management courses for the Canadian Police College. For his contribution to policing he has been conferred the Lieutenant Governor’s Meritorious Service Award for homicide investigation.   Rod’s published research on the “The Dynamics of Police Cooperation in Multi-agency Investigations”, was followed by his article, titled, “Multi-agency Teams, A Leadership Challenge”, featured in the US Police Chief Magazine. Rod retains a licence as a private investigator and security consultant and continues to work with regulatory compliance agencies in both public and private sector organizations for the development of their investigative training and systems.


Darryl Plecas is Professor Emeritus at University of the Fraser Valley where he worked for 34 years, most recently holding the Senior University Research Chair (RCMP) and Directorship of the Centre for Public Safety and Criminal Justice Research. As Professor Emeritus he continues to co-author work with colleagues and supervises graduate students. He also serves as Associate Research Faculty at California State University – Sacramento, and as an annually invited lecturer to the Yunnan Police College in Kunming, China. He is the author or co-author of more than 200 research reports, international journal articles, books, and other publications addressing a broad range public safety issues. He is a recipient of numerous awards, including UFV’s Teaching Excellence Award, the Innovative Excellence in Teaching, Learning and Technology Award from the International Conference on College Teaching and Learning, the Order of Abbotsford, the CCSA Award of Excellence, and the British Columbia Lieutenant Governor’s Award for Public Safety. His most recent co-authored book “Evidenced Based Decision Making for Government Professionals” was awarded the 2016 Professional Development Award from the Canadian Association of Municipalities.




“A thoughtful, well designed, and very cleaver guide to investigation as a thinking process. While reading the book, I kept wondering “why did it take so long for someone to finally produce such as useful teaching tool? It is long overdue. ”

Professor Yvon Dandurand, School of Criminology and Criminal Justice, University of the Fraser Valley, and Fellow, International Centre for Criminal Law Reform and Criminal Justice Policy.

“This is an outstanding book that should be read by everyone interested or committed to excellence in police investigation. The book details an innovative model to guide criminal investigations, and the methodical way investigators must think and work when investigating crimes.

Dr. Irwin Cohen, Senior University Research Chair (RCMP), School of Criminology and Criminal Justice University of the Fraser Valley

As a former Major Crime detective I know that training is critical to becoming a well-rounded investigator. Reading this book would have been beneficial before starting on my career. Rod and Darryl have nicely laid out what is required in the investigative process, as well as what is required to conduct thorough and ethical investigations

Inspector Steve McCartney, Program Director, BC Police Academy

Investigators constantly face complexity in the investigation of criminal offences, and analytical thinking skills are critical to the investigative process. That is what this text is about. It provides a sound framework for conducting investigations within the context of Canadian laws of evidence and police procedure. It provides thinking practices for evidence analysis, to avoid the pitfalls that can contribute to investigative failures and wrongful convictions.

Stuart K Wyatt, (Ba, MA, Asc Forensic Identification Officer Retired)

“A much needed insight into investigators, their thinking, and investigative processes in Canada. This primer should appeal to law enforcement, college professors, and the curious public alike. I encourage you to read this book and you will gain knowledge and respect for investigations – and never watch crime dramas the same way again.”

Dr. Tim Croisdale, Associate Professor, Division of Criminal Justice, California State University, Sacramento.





R v Ferguson , 342 (BCCA) (British Columbia Court of Appeal 1996).

R v Perka , 2 S.C.R. 232 (Supreme Court of Canada 1984).

Abed, R. (2105, November 14). Irish Journal of Psychological Medicine, 12. Retrieved from

Allen, R. J. (1991). The Nature of Judicial Proof. Cardozo Law Review, 373-422 .

Arcaro, G. (2009). Criminal Investitgations Forming Reasonable Grounds (Fifth ed.). Toronto, Ontario: Emond Montgomery Publications Limited.

Bennett, M. (2015). Unspringing the witness memory and demeanor trap: What every judge and jury needs to know about cognitive psychology and witness credibility. Wahington: American University of Law.

Brainerd, C. &. (2005). Oxford Universtiy Press. Retrieved from Science of False Memory: science+of+false+memory&ots=zK_bzllYlF&sig=XlOTss2QP35m2GieECfX3eGQVuc#v=on epage&q=the%20science%20of%20false%20memory&f=false

Britannica, E. o. (2015, MAY 15). DNA Chemical Compound . Retrieved from Enclyclopedia Britannica :

Byrnes, T. (2015, November 09). Professional Criminals of America (1886). Retrieved from Online at

Campbell, A. (1996). Bernardo Investigation Review. Toronto: Ontario Lieutenant Governor .

Campbell, J. A. (1996). Bernardo Investigation Review. Toronto: Solicitor General and Minister of Correctional Services.

Canada, G. (2015, November 14). Youth Criminal Justice . Retrieved from Justice Laws Website – Youth Criminal Justice:

Canada, Government. (2015, November 05). Your Guide to the Canadian Charter of Rights and Freedoms. Retrieved from Canadian Heritage:

Canada, L. B. (2015). Criminal Code of Canada. Aurora: Martin’s.

Canada, S. C. (2009). R. v. Basi. 2009 SCC 52, [2009] 3 SCR 389

Cox, W. A. (2015, November 14). EARLY POSTMORTEM CHANGES. Retrieved from…/early-postmortem-changes1.pd…

Dass, S. C. (2016). Classification of Fingerprints. Retrieved January 15, 2017, from Department of Statistics & Probabilities:

De Saram G.S.W., W. G. (1955 -1956). Post-Mortem Temperature and the Time of Death. Crim. L. Criminology & Police Science, 46.

Dictionary, Legal. (2015 – 2, November 05). Duhaime’s Law Dictionary. Retrieved from

Dictionary, Legal. (2015, November 05). Duhaime’s Law Dictionary. Retrieved from

Dostal, P. (2012). Accessory After the Fact. Retrieved January 15, 2017, from The Canadain Criminal Law Notebook:

Dostal, P. (2012). Attempts. Retrieved January 15, 2017, from The Canadian Criminal Law Notebook:

Dostal, P. (2012). Conspiracy (Offence). Retrieved January 15, 2017, from The Canadian Criminal Law Notebook:

Dostal, P. (2012). Counselling. Retrieved January 15, 2017, from The Canadian Criminal Law Notebook:

Dostal, P. (2012). Informer Privilege. Retrieved January 16, 2017, from The Canadian Criminal Law Notebook:

Dostal, P. (2012). Parties to an Offence. Retrieved January 15, 2017, from The Canadian Criminal Law Notebook:

Dostal, P. (2012). Principled Exception to Hearsay. Retrieved January 12, 2017, from The Canadian Criminal Law Notebook:

Dostal, P. (2012). Principles of Fundamental Justice. Retrieved January 20, 2017, from The Canadian Criminal Law Notebook:

Elsevier, B. (2016). Coup contrecoup injury. Retrieved January 27, 2017, from Science Direct:

Encyclopedia of Death and Dying. (2017). Rigor Mortis and Other Postmortem Changes. Retrieved January 16, 2017, from Encyclopedia of Death and Dying:

EnkiVillage. (2017). How Long Does It Take for a Body to Decompose? Retrieved January 16, 2017, from EnkiVillage:

Fookes, S. A. (1973). Patrol Sergreant. (A. GEHL, Interviewer)

Gaytmenn R, S. D. (2003, May). Quantification of forensic DNA from various regions of human teeth. Journal of Forensic Science, 48(3), 622 to 625.

Gecker, R. A. (1989). The Doctrine of Necessity and Its Parameters. Marquette Law Review, 1 – 39 Volume 73 Article 1.

Giannelli, P. C. (2007). Faculty Publications.Paper 153. Retrieved Janauary 27, 2017, from Case Western University School of Law:

Gibson, D. (2014). The Kennedy Assasination Cover-up. New York: Kroshka Books .

Goff, L. (2015, November 14). Early post-mortem changes and stages of decomposition. Retrieved from Springer Science+Business Media B.V. 2009:…/post-mortem-changes.pdf

Government of British Columbia. (2015, Nov 27). British Columbia Police Act. Retrieved from

Government of Canada. (2015, November 13). Canada Evidence Act. Retrieved from

Government of Canada. (2017, January 16). Canada Evidence Act (R.S.C., 1985, c. C-5). Retrieved January 23, 2017, from Justice Laws Website:

Government of Canada. (2017, January 14). Conspiracy. Retrieved January 11, 2017, from Justice Laws Website:

Gubrium, J. &. (2002). Handbook of Interview Research: Context and Method. Thousand Oaks: Sage Publications Inc.

Gudgonsson, G. H. (2015 , November 14). Custodial interrogation: Why do suspects confess and how does it relate to their crime, attitude and personality. Retrieved from

Guharaj, P. V. (2003). Forensic Medicine 2nd Edition. Hyderabad: Longman Orient: Sangam Books Ltd.

Head, T. a. (2010). Crime and Punishment in America. New York: Infobase Publishing.

Henry, E. R. (1900). Classification and Uses of Fingerprints. Routledge.

Hill v Hamilton-Wentworth Regional Police Services Board, SCC 41, [2007] (Supreme Court of Canada 2007).

Hitchcock, T. S. (2015, June 05). (searched June 2015). Retrieved from The Proceedings of the Old Bailey, 1674-1913:

Irwin Law. (n.d.). Prima facie case. Retrieved January 14, 2017, from The Canadian Online Legal Dictionary:

Jaffe, F. A. (1994). Petechial Hemorrhages: A Review of Pathogenesis. The American Journal of Forensic Medicine and Pathology, 203- 207.

Jain, A. F. (2010). Fingerprint Matching. Biometrics, 36 -44.

Justice Canada. (2017, January 14). Rules of Evidence in Canada. Retrieved January 14, 2017, from Canada Evidnce Act:

Justice Department Canada. (2017, January 02). Rules of Evidene. Retrieved from Canada Evidence Act:

Justice Laws Canada. (2017). Duty of persons to provide necessaries. Retrieved January 16, 2017, from Justice Laws Website:

Kaufman, F. (1998). Report of the Kaufman Commission on Proceedings Involving Guy Paul Morin. Toronto : Ontario Government.

Legal Information Institute. (2016, December 31). Wex Legal Process. Retrieved from Legal Information Institute :

Lindsey, S. H. (2003). COMMUNICATING STATISTICAL DNA EVIDENCE. Jurimetrics, 43(Winter 2003), 147 to 163.

MacCallum, E. P. (2008). Report of the Commission of Inquiry into the Wrongful Conviction of David Milgaard. Regina: Saskatchewan Government.

MacDonell, J. (1820). Report of State Trials Volume 1. London: The State Trial Committee.

MacDonell, J. (n.d.). Report of State Trials .

Macrae, M. (2015, April 17). Is the Science of DNA Wronful Conviction-Proof? Retrieved January 17, 2017, from Innocence Canada:

McCrery, N. (2013). Silent Witnesses. London: Random House Books p.51.

McRory, S. (2014, May). Introduction to Criminal Process for Inspector. Compliance Assurance Learning and Development Program, 43. Edmonton, Alberta, Canada: Alberta Energy Regulator.

Morgan, C. H. (2004). Accuracy oof eyewitness memory for persons encountered during exposure to highly intense stress. International Journal of Law and Psychiatry, 265-279.

National Science Forensic Technology Center. (2012). A Simplified Guide To Bloodstain Pattern Analysis . Retrieved January 15, 2017, from National Science Forensic Technology Center:

Oorsouw, K. M. (2015). Alcohol intoxication impairs memory and increases suggestibility for a mock crime: a filed study. Applied Cognitive Psychology, 29, 293-501.

Oppal, W. (2013). The report of the mission women commission of inquiry . Vancouver: British Columbia Government.

Pennington, M. (1999). Misscarriages of Justice ; A call for continued research focussing on reforming the investigative process. Journal of Forensic Practice, 61 – 71 Volume 13.

Petherick, W. A. (2010). Forensic Criminology. London: Elservier Academic Press.

Police Executive Research Fourm. (2014, March 14). The Police Response to Active Shooter Incidents. Critical Issures in Policing Series , pp. 1 – 46.

R v Abernathy, BCCA 8 (2002).

R v Beaudry , 1 SCR 190 (Supreme Court of Canada 2007).

R v Gagnon, MBCA X at 13 (Manitioba Court of Appeal 2006).

R v Godoy, 1 S.C.R. 311 (Supreme Court of Canada 1999).

R v Grant , SCC 32 (Supreme Court of Canada 2009 ).

R v Lifchus, 3 S.C.R. 320 (Supreme Court of Canada 1997).

R v Schell, 188 CCC (3d) 254 (ABCA) (2004).

R v Starr, 2 S.C.R. 144 (Supreme Court of Canada 2000).

R v Steinberg, SCR 42 (Supreme Court of Canada 1931).

R v Stinchcombe, 3 S.C.R. 326 (Supreme Court of Canada 1991).

R v Storrey , 1 S.C.R. 241 (Supreme Court of Canada 1990).

R v Walsh , 199 (ONCA) (Ontario Court of Appeal 1978).

R v. Mann , 3 S.C.R. 59 (Supreme Court of Canada 2004).

  1. v. Beare, 387 (S.C.RL December 17, 1988).
  2. v. Briscoe, SCC 13 (Supreme Court of Canada 2010 ).
  3. v. Graham, SCR 206 (1974).
  4. v. Khan, 2 SCR 531 (Supreme Court of Canada 1990).
  5. v. Kowlyk, 2 S.C.R. 59 (Supreme Court of Canada 1988).
  6. v. Smith, 2 S.C.R. 915 (Supreme Court of Canada 1992).
  7. v. Terrence, 1 S.C.R. 357 (Supreme Court of Canada 1983).
  8. v. Woodcock, 168 E.R. 352 (K.B.) (Court of Kings Bench 1789).

Ratten v R, 3 AllER 801 (Court of Queens Bench 1971).

Reith, C. (1943). Preventive Principle of Police . Journal of Criminal Law and Criminology, 206 – 209 Volume 34.

Reith, C. (n.d.). Preventive Principle of Police . Journal of C.

Resnick, H. S., Kilpatrick, D. G., Dansky, B. S., Saunders, B. E., & Best, C. L. (1993). Prevalence of civilian trauma and posttraumatic stress disorder in a representative national sample of women. . Journal of Consulting and Clinical Psychology, 984-991.

Rex v Burdett:, 4 B & A 95 (Court of Kings Bench Nov 27, 1820).

Rogers, Kara. (2016, May 27). Chimera Genetics. Retrieved from Encyclopedia Britanica:

Rose, C. &. (2009). Eyewitness accounts: False facts, false memories, and false identification. Journal of Crime and Justice, 39(2), 243-263.

Rossmo, D. K. (1987). Geographic Profiling Target Patterns of Serial Murderers. Burnaby: Simon Fraser University.

Rossmo, K. (2009). Criminal Investigative Failures. Bocal Raton: CRC Press Taylor & Fransis Group.

Royal Canadian Mounted Police. (2006, September 01). National DNA Data Bank. Retrieved January 16, 2017, from Royal Canadian Mounted Police:

Royal Canadian Mounted Police. (2015, Nov 27). Criminal Investigative Analysis . Retrieved from Royal Canadian Mounted Police:

Salhany, R. (2008). Taman Inquiry into the Investigation and Prosecution of Derek Harvey-Zenk. Winnipeg: Government of Manitoba.

Sansregret v. The Queen, 1 S.C.R. 570 (Supreme Court of Canada 1985).

Savino, J. &. (2011). Rape Investigation Handbook. New York: Elsevier.

Sebetic, E. (1950, Fall). Marquette Law Review 128. Retrieved from Law Commons:

Service, S. C. (2015, November 14). Police Warnings – Transit Police. Retrieved from…/transit%20police/…/od170%20%20police%20

Shah, A. K. (2008). Heuristics Made Easy: An Effort-Reduction Framework, . Psychological Bulletin, Princeton University.

Smarlarz, L. &. (2015). Contamination of eyewitness self-reports and the mistaken identification problem. Association of Psychologoical Science, 24(2), 120-124.

Smith, C. (2010). Shaken Baby Syndrom An Investigator’s Manual. Abbotsford: University of the Fraser Valley.

Sopinka, J. (1999). The Law of Evidence in Canada 2nd ed. Toronto, Ontario: LexisNexis Canada.

Streets, G. M. (2011). The Homicide Witness and Victimization; PTSD in Civilian Populations: A Literature Review. JEFFERSON JOURNAL OF PSYCHI ATRY, 59 – 65.

Taber, K. (2006). Beyond Constructivism: the Progressive Research Programme into Learning Science. Studies in Science Education, 42,, pp 125-184.

Thomas, S. a. (2000). JonBenet: Inside the Ramsey Murder Investigation. New York: St Maritn’s Paperback.

Thompson, R. (2013, September 11). Hearsay and Exceptions to Hearsay Rule. Retrieved from Law Society of Saskatchewan Continuing Professional Development:

Varney, C. A. (2009). Procedural Fairnesss. 13th Annual Competition Conference of the International Bar Association (pp. 1 – 13). Fiesole Italy: Antitrust Division United States Department of Justice.