NCIS Special Agent cheat sheet

Case management follows the investigative cycle: complaint → preliminary inquiry → assignment → investigation → case file → disposition (federal, military, or declination).

NCIS jurisdiction: felony crimes involving Navy/Marine Corps personnel, property, or operations; concurrent jurisdiction with FBI for terrorism and espionage.

Chain of custody begins at seizure and must be documented on evidence tags and property receipts; any break must be explained in reports.

Investigative plan components: case theory, elements of proof, witnesses, evidence, resources, and timeline.

Solvability factors include witness availability, physical evidence, identifiable suspect, and modus operandi links.

Victim/witness coordination: separate interviews, no contact between witnesses, and documentation of any coercion or intimidation.

Case file organization: chronological investigative activity reports, evidence inventory, interview summaries, and legal process returns.

Disposition options: referral for prosecution (UCMJ or federal), administrative action, or closure with justification.

Fourth Amendment: searches require warrant, probable cause, or a recognized exception (consent, exigency, incident to arrest, automobile, plain view).

Fifth Amendment: custodial interrogation requires Miranda warnings; waiver must be knowing, voluntary, and intelligent.

Sixth Amendment: right to counsel attaches at formal charging (indictment, information, arraignment) for all critical stages.

Federal statutes commonly used: 18 U.S.C. § 641 (theft of government property), § 111 (assault on federal officer), § 922 (firearms), § 1343 (wire fraud).

UCMJ offenses: Article 86 (AWOL), 92 (failure to obey), 120 (sexual assault), 121 (larceny), 134 (general article).

Chain of custody and legal process: subpoenas duces tecum, search warrants (Fed. R. Crim. P. 41), and court orders for stored communications (18 U.S.C. § 2703).

Brady v. Maryland requires disclosure of exculpatory evidence; Giglio requires disclosure of impeachment material.

Statute of limitations: generally 5 years for federal felonies, except capital offenses and specific statutes (e.g., child exploitation).

Interview vs. interrogation: interviews are non-custodial and information-gathering; interrogations are accusatory and require Miranda if custodial.

Custody determination: objective reasonable person standard; factors include location, duration, number of officers, and freedom to leave.

Miranda warnings: right to remain silent, anything said can be used, right to counsel, appointed counsel if indigent.

Waiver must be voluntary; invocation of right to silence or counsel must be honored (Edwards v. Arizona for counsel).

Cognitive interview technique: free recall, then specific questions, avoid leading questions, and document verbatim statements.

Deception detection: no single behavioral cue is reliable; evaluate verbal and nonverbal clusters in context.

Juvenile and vulnerable subject interviews: age-appropriate language, parent/guardian notification per policy, and recorded documentation.

Documentation: time, date, location, participants, warnings given, waiver, and summary of questions and answers.

Crime scene priorities: render aid, secure scene, preserve evidence, document, collect, and maintain chain of custody.

Evidence packaging: paper for biological evidence (allows drying), plastic for non-biological, separate containers to prevent cross-contamination.

Chain of custody form must include item description, collector, date/time, location, and every transfer with signatures.

Forensic disciplines: DNA, latent prints, firearms/toolmarks, trace, toxicology, digital, and questioned documents.

Biological evidence: avoid heat, sunlight, and moisture; air-dry before packaging; maintain temperature logs.

Photography and sketches: overall, mid-range, and close-up with scale; sketch includes measurements and reference points.

Evidence integrity: unique item numbers, tamper-evident seals, and secure storage with limited access.

Forensic testing requests require legal authority (consent, warrant, or court order) and documented chain of custody.

Reports must be factual, concise, chronological, and free of opinion or speculation; use active voice and past tense.

Essential report elements: who, what, when, where, why, how, and investigative actions taken.

Use objective language: avoid adjectives like 'obviously' or 'clearly'; quote witnesses verbatim when possible.

Include case number, date, time, location, persons involved, and disposition on every report.

Proofread for spelling, grammar, and consistency; use standard agency forms and templates.

Confidentiality: mark reports appropriately (e.g., law enforcement sensitive) and follow release procedures.

Supplemental reports document follow-up actions, interviews, and evidence results; reference original report number.

Digital report systems: ensure accurate data entry, attachments, and audit trail.

Deductive reasoning: apply general rule to specific case; inductive reasoning: derive general rule from specific observations.

Logical fallacies to avoid: ad hominem, straw man, false dilemma, appeal to authority, and hasty generalization.

Hypothesis testing: gather evidence, evaluate alternative explanations, and avoid confirmation bias.

Evidence evaluation: relevance, reliability, and weight; distinguish direct from circumstantial evidence.

Problem-solving models: identify problem, gather information, generate options, evaluate, choose, implement, and review.

Decision-making under uncertainty: use probability estimates, base rates, and Bayesian updating.

Cognitive biases: anchoring, availability heuristic, and tunnel vision; mitigate with peer review and red teams.

Timeline analysis: sequence events, identify gaps, and corroborate with multiple sources.

Ethical standards: NCIS agents adhere to federal law, DoD directives, and the agency's code of conduct.

Conflict of interest: disclose any personal or financial relationship that could affect objectivity.

Use of force: only that which is objectively reasonable, necessary, and proportional; report all incidents.

Handling sensitive information: need-to-know basis, secure storage, and proper classification markings.

Whistleblower protections: report waste, fraud, or abuse through appropriate channels without retaliation.

Off-duty conduct: avoid actions that discredit the agency or compromise operational security.

Gifts and gratuities: prohibited if they could influence official actions; follow federal ethics rules.

Accountability: document decisions, seek supervisory guidance when uncertain, and cooperate with audits.

UCMJ applies to active duty, reservists on duty, and certain retired personnel; jurisdiction extends to offenses punishable by court-martial.

Article 15 nonjudicial punishment: commanding officer imposes punishment for minor offenses; member may demand trial by court-martial (except in certain cases).

Courts-martial: summary (minor), special (bad-conduct discharge possible), general (felonies, punitive discharge).

Rights at court-martial: presumption of innocence, right to counsel, right to present evidence, and appeal to Court of Criminal Appeals.

NCIS investigates felony-level UCMJ offenses and provides evidence to convening authorities and trial counsel.

Military justice process: preferral of charges, Article 32 hearing (for general courts-martial), referral, arraignment, trial, and review.

Victim rights under UCMJ: right to be informed, present, and heard; protections under Article 6b.

Coordination with civilian authorities: concurrent jurisdiction, memoranda of understanding, and status of forces agreements (SOFA).

Digital evidence is fragile and volatile: preserve original media, use write-blockers, and maintain chain of custody.

Order of volatility: collect from most volatile (RAM, network connections) to least volatile (disk, backups).

Legal process for digital evidence: search warrant, subpoena, or court order under Stored Communications Act (18 U.S.C. § 2703).

Forensic imaging: create bit-for-bit copy, verify hash (MD5/SHA-1), and document tool used.

Chain of custody for digital evidence: include device serial number, storage media, and hash values.

Cyber incident response: identify, contain, eradicate, recover, and document lessons learned.

Common cybercrimes: unauthorized access (18 U.S.C. § 1030), identity theft, phishing, and ransomware.

Mobile device evidence: isolate from network, use Faraday bag, and obtain legal authority for extraction.