CID 311A Special Agent cheat sheet

Investigative process sequence: preliminary investigation, case screening, investigative plan, evidence development, suspect identification and apprehension, case resolution, and post-case review.

Reasonable suspicion (Terry v. Ohio) permits a brief investigative stop; probable cause is required for arrest and for search warrants.

The three investigative questions: has a crime occurred, who committed it, and can it be proven in court beyond a reasonable doubt.

Solvency of a case rests on corpus delicti (body of the offense) plus admissible evidence linking a specific person to each element.

Modus operandi is behavior repeated because it worked; signature is behavior repeated because it satisfies an emotional need; the two are analyzed separately.

Linkage analysis compares crime scene behavior, victimology, and physical evidence to determine whether a series of offenses shares one offender.

Investigative plan elements: offense elements to prove, evidence already held, evidence gaps, leads ranked by solvability, resources, and timeline.

Case screening triage typically weighs solvability factors (witness availability, suspect named, physical evidence, identifiable property) over offense severity alone.

UCMJ Article 120 (sexual assault) requires proof of a sexual act, lack of lawful consent, and the requisite intent; consent is evaluated on the totality of circumstances including incapacity.

UCMJ Article 118 (murder) requires intent to kill or inflict great bodily harm, or wanton disregard of human life; Article 119 (manslaughter) covers lesser culpability.

UCMJ Article 121 (larceny) requires wrongful obtaining or withholding of property with intent to permanently deprive; Article 121a covers fraud.

UCMJ Article 134 is the general article covering disorders and neglects prejudicial to good order and discipline, and offenses not otherwise punishable.

Article 31(b) requires rights warnings before custodial questioning of a suspect by military or DoD personnel; it predates and parallels Miranda.

Article 15 nonjudicial punishment is administrative, not a criminal conviction, but it requires notice, an opportunity to present matters, and appeal rights.

Court-martial jurisdiction rests on the member's status at the time of the offense; the Manual for Courts-Martial supplies the Rules for Courts-Martial and Military Rules of Evidence.

Elements of an offense must each be proven; a conviction requires findings by the military judge (or panel) beyond a reasonable doubt under Article 51.

Fourth Amendment baseline: searches and seizures require a warrant supported by probable cause, unless an established exception applies.

Warrant exceptions: consent (voluntary, scope-limited, revocable), search incident to lawful arrest, plain view, exigent circumstances, automobile, inventory, and Terry frisk.

Plain view requires lawful vantage, immediately apparent incriminating character, and lawful right of access to the object.

Consent must be voluntary under the totality of circumstances; apparent authority controls whether an officer may reasonably rely on a third party's consent.

Fifth Amendment privilege against self-incrimination protects testimonial communication; it does not protect blood, handwriting exemplars, or fingerprints.

Sixth Amendment right to counsel attaches at the initiation of adversarial judicial proceedings and applies to counsel-related interrogation, not pre-charge investigation.

Military Rule for Courts-Martial 305 governs apprehension and custody; Military Rule of Evidence 311 governs motions to suppress evidence.

Exclusionary rule bars use of evidence obtained in violation of the Fourth Amendment, subject to exceptions such as inevitable discovery and attenuation.

Chain of custody documents every transfer: who collected, date/time, location, description, packaging, storage location, and each subsequent handler.

Biological evidence: air-dry before packaging, use paper containers, avoid heat and sunlight, and submit to the lab promptly; never seal damp items in plastic.

Digital evidence: photograph the screen before seizure, use write-blocking for analysis, hash (SHA-256) for integrity, and document device state (powered on or off).

Latent prints: powder for non-porous surfaces, cyanoacrylate fuming for large or porous objects, ninhydrin for paper; photograph before lifting.

Packaging rules: paper for biological and arson evidence, sealed metal cans for fire debris, rigid containers for sharps, individual packaging for each item to prevent cross-contamination.

Evidence integrity requires unique item numbering, tamper-evident seals, and a property/evidence log reconciled on every transfer.

Firearms evidence: unload and render safe, record serial number and condition, package with the magazine separate, and preserve for fingerprints and DNA.

Spoliation occurs when evidence is lost or destroyed; document all handling and preservation steps to rebut claims of bad faith.

Crime scene priorities: render aid, secure and preserve the scene, detain witnesses, identify and separate suspects, and establish a single entry/exit path.

Scene documentation sequence: photographs (overall, midrange, close-up, with scale), sketch (baseline, rectangular, or triangulation), and written narrative.

First responder duties: preserve life, secure the scene, prevent contamination, record personnel entering, and start the scene log.

Physical evidence classes: transfer (trace), associative, and reconstructive; each supports a different inference.

Forensic disciplines include DNA, latent prints, firearms/toolmarks, questioned documents, toxicology, digital forensics, and forensic pathology.

Contamination control: PPE, gloves changed between items, single-use tools, and separate packaging; controls and reference standards are collected alongside questioned samples.

Reconstruction uses bloodstain pattern analysis, trajectory analysis, and scene geometry to test witness and suspect accounts.

Chain of custody for forensic submissions includes laboratory accession numbers and tracking of testing and disposition.

Interview is non-custodial questioning to gather information; interrogation is questioning designed to elicit admissions from a suspect in custody.

Custody plus interrogation triggers Miranda warnings; custody is determined by whether a reasonable person would feel free to leave.

Cognitive interview techniques: reinstate context, report everything, change perspective, and reverse order to enhance recall.

Statement reliability factors include lighting, distance, duration of observation, stress, weapon focus, cross-racial identification, and post-event contamination.

Eyewitness identification: use double-blind sequential lineups, unbiased fillers, and a standard instruction that the perpetrator may not be present.

Document the interview with a verbatim or near-verbatim account; note date, time, location, persons present, and any rights advisement.

Confessions must be voluntary; coercion, promises of leniency, and threats render statements inadmissible.

Interviewing vulnerable populations requires age-appropriate language, trained interviewers, and often recorded forensic interviews.

Crime analysis products: tactical (pattern and series), strategic (trends and resource allocation), administrative, and investigative (case linkage and suspect prioritization).

Intelligence cycle: planning and direction, collection, processing, analysis and production, dissemination, and evaluation/feedback.

Link analysis charts relationships among persons, places, and events; telephone toll analysis maps call patterns to establish associations.

Pattern analysis tests for temporal, geographic, and modus operandi clustering; a series requires more than coincidence.

Reports must separate fact from inference, cite source reliability, and state confidence levels for assessments.

Dissemination controls govern who may receive intelligence, and need-to-know limits distribution within the organization.

Geographic profiling estimates offender residence based on crime locations and travel behavior; it is an investigative aid, not evidence.

Investigative reporting requires traceable sources, accurate names and dates, and a record of the report's distribution.

Victim rights typically include notification, protection, restitution, and the right to be present at proceedings; military victims have rights under Article 6b of the UCMJ.

Special victim categories include domestic violence, child abuse, sexual assault, and elder abuse; each has specific reporting and support protocols.

Mandatory reporting laws require certain personnel to report suspected child abuse or neglect to designated authorities.

Trauma-informed practice: prioritize safety, choice, and collaboration; avoid re-traumatization through repeated questioning.

Child forensic interviews are conducted by trained specialists using structured protocols, often recorded, and minimize leading questions.

Victim advocates coordinate services, explain the process, and accompany victims through investigation and prosecution.

Protective orders and safety planning address retaliation risk; confidentiality of victim information is protected by policy and law.

Witness intimidation and retaliation are separate offenses and require immediate documentation and reporting.

Brady v. Maryland requires disclosure of exculpatory evidence; Giglio requires disclosure of impeachment material about government witnesses.

Exculpatory evidence must be preserved and disclosed even if the investigator believes it is unimportant.

Misconduct categories: fabrication of evidence, false statements in reports, coercive interrogation, unlawful search, and bias-based investigation.

Conflicts of interest must be disclosed; an investigator with a personal relationship to a party or witness should be reassigned.

Use of force is judged by objective reasonableness under Graham v. Connor, considering the totality of circumstances.

Professional standards require truthful reporting, complete documentation, and separation of personal opinion from factual findings.

Whistleblower and anti-retaliation protections apply to personnel reporting misconduct; retaliation is itself a violation.

Investigators are bound by privacy and data-protection rules when handling personal information and evidence.

Case file components: offense report, investigative supplements, evidence inventory, witness statements, photographs, lab results, and disposition record.

Reports should answer who, what, when, where, why, and how, and should be written so a reader without prior knowledge can follow the case.

Court testimony preparation: review the case file, evidence, and prior statements; anticipate cross-examination on inconsistencies.

Testimony rules: answer only the question asked, do not guess, and state clearly when you do not know or do not recall.

Lay opinion testimony is limited to opinions rationally based on the witness's perception and helpful to the factfinder; expert testimony requires qualification.

Subpoenas compel attendance and production; failure to appear may result in contempt.

Discovery obligations require timely production of reports, evidence, and statements to the defense.

Case disposition codes and closure procedures require documentation of the outcome and retention of records per policy.