AFOSI Special Agent cheat sheet

Chain of custody: unbroken, documented record of every person who handled evidence from seizure to disposition; each transfer records date, time, purpose, and signatures.

Fourth Amendment seizure standard: evidence is seized when there is meaningful interference with a person's possessory interest; abandoned property generally lacks a reasonable expectation of privacy.

Best evidence rule (FRE 1002): original writing, recording, or photograph required to prove its content unless an exception (FRE 1003-1004) applies.

Authentication (FRE 901): proponent must produce evidence sufficient for a reasonable juror to find the item is what it is claimed to be; chain of custody is one method.

Biological evidence: air-dry before packaging, package in paper, refrigerate; never seal damp biological material in plastic (moisture promotes degradation and mold).

Digital evidence: hash the image at acquisition (e.g., SHA-256), work from a verified copy, and document the tool version and write-blocker use.

Hearsay (FRE 801): out-of-court statement offered for truth; key exemptions include excited utterance, present sense impression, and recorded recollection.

Brady v. Maryland: prosecution must disclose material exculpatory evidence; Giglio extends to impeachment material about government witnesses.

Fifth Amendment custodial interrogation: Miranda warnings required when a reasonable person would not feel free to leave and questioning is designed to elicit incriminating responses.

Sixth Amendment right to counsel attaches at formal initiation of adversarial proceedings (indictment, arraignment, preliminary hearing) and is offense-specific.

Grand jury subpoena: compels testimony or documents; contempt for noncompliance is civil or criminal depending on the order violated.

18 U.S.C. § 1001: false statements in matters within federal jurisdiction; materiality is an element, and the false statement need not be under oath.

18 U.S.C. § 1519: knowingly falsifying or destroying records in a matter within federal jurisdiction, including in anticipation of such a matter.

18 U.S.C. § 371: conspiracy to commit an offense against the United States; requires an overt act by any conspirator.

Bivens and FTCA: constitutional tort claims against federal officers are limited; FTCA covers certain common-law torts but excludes intentional torts with exceptions.

Federal Rules of Criminal Procedure 41: search warrant must be supported by probable cause, describe place and items with particularity, and be executed within the stated time.

Espionage (18 U.S.C. § 794): gathering or delivering defense information to aid a foreign government; intent to aid a foreign nation is central.

18 U.S.C. § 793: unauthorized retention, transmission, or possession of national defense information; gross negligence standard applies to removal of documents.

Executive Order 13526: classification levels Confidential, Secret, Top Secret; derivative classification requires a classified source and proper marking.

Insider threat indicators: unexplained foreign travel, unusual after-hours access, financial distress, unreported foreign contacts, and attempts to bypass security controls.

Foreign Agents Registration Act (22 U.S.C. § 611 et seq.): agents of foreign principals must register with DOJ when acting in a political or quasi-political capacity.

Counterintelligence scope: identify, deceive, exploit, disrupt, or protect against foreign intelligence entities, international terrorist networks, and insider threats.

Need-to-know vs. clearance: a clearance grants eligibility for access; actual access requires both clearance and a validated need-to-know.

Computer Fraud and Abuse Act (18 U.S.C. § 1030): key provisions include unauthorized access to protected computers, exceeding authorized access, and damage to protected computers.

18 U.S.C. § 2703: government access to stored electronic communications requires a warrant for content over 180 days old; subpoena for non-content records.

Pen register/trap and trace (18 U.S.C. § 3121): records dialing, routing, addressing, and signaling information, not content; requires a court order.

Order of volatility: collect from most volatile (CPU registers, cache, RAM) to least volatile (backups, archival media, printouts).

Chain of custody for digital media: record the hash before and after acquisition and verify that the working copy matches the original hash.

Botnet and malware analysis: isolate the sample, document the hash, and avoid executing malware outside a controlled sandbox.

Data breach notification and reporting: preserve logs before remediation; log retention and integrity are essential to attribution.

Fraud elements: a false statement of material fact, knowledge of falsity, intent to deceive, justifiable reliance, and resulting loss.

Procurement fraud indicators: split purchases below thresholds, change orders after award, unusual sole-source justifications, and bidder rotation.

False Claims Act (31 U.S.C. § 3729): knowing submission of false claims; qui tam relators may share in recovery; treble damages plus per-claim penalties.

Anti-Kickback Act (41 U.S.C. § 8701 et seq.): prohibits kickbacks between subcontractors and prime contractors on federal contracts.

Bribery (18 U.S.C. § 201): corrupt intent to influence an official act; gratuity provision covers gifts given for or because of an official act.

Conflict of interest: 18 U.S.C. § 208 disqualifies an employee from participating in matters affecting personal financial interests.

Financial analysis: follow-the-money tracing via bank records, subpoenaed ledgers, and net-worth analysis to establish unexplained income.

Miranda applies only to custodial interrogation; voluntary, non-custodial interviews do not require warnings.

Cognitive interview: reinstate context, report everything, change order, change perspective; designed to enhance recall without suggestion.

Interrogation themes: minimize moral seriousness while never promising leniency or threatening consequences; promises and threats can render statements involuntary.

Document the exact wording of any waiver, invocation, or request for counsel; ambiguity is resolved in favor of the suspect.

Source handling: assess motivation (money, revenge, ideology, coercion), reliability, and access; document with a source debriefing report.

Corroboration rule: source reporting should be corroborated independently before action; single-source uncorroborated reporting is treated with caution.

Entrapment (federal): government inducement plus lack of predisposition; focus on the defendant's readiness before government contact.

Report structure: who, what, when, where, why, and how; chronological narrative with objective, factual language.

Distinguish observation from inference: attribute statements to their source and avoid conclusory characterizations.

Case file organization: investigative plan, chronology, evidence log, interview reports, legal process returns, and disposition summary.

Document legal process: record the warrant or subpoena number, issuing authority, date served, and items returned.

Reports may be discoverable; write as though the defense will read the document and cross-examine on it.

Preserve original notes: do not destroy rough notes after typing the report; they may be subject to production.

Timeliness: document interviews and evidence collection contemporaneously to protect memory and credibility.

AFOSI is a field operating agency of the Department of the Air Force and provides criminal investigative and counterintelligence services to the Air Force and DoD.

Unified Command Plan: geographic combatant commands (e.g., INDOPACOM, EUCOM, CENTCOM) and functional commands (e.g., STRATCOM, CYBERCOM).

Title 10 U.S.C. governs the armed forces; Title 32 governs National Guard in state status; Title 50 governs intelligence activities.

UCMJ (10 U.S.C. §§ 801-946): military justice system separate from federal criminal courts; Article 32 preliminary hearing for general courts-martial.

Posse comitatus (18 U.S.C. § 1385): restricts use of federal military personnel for domestic law enforcement.

Classification and need-to-know govern information sharing across DoD components; foreign disclosure requires proper authority.

Inspector General Act and DoD IG: oversight and whistleblower protection functions that interact with criminal investigations.

Use-of-force and investigative conduct must comply with constitutional standards and agency policy; excessive force can trigger civil and criminal liability.

Brady/Giglio obligations: disclose exculpatory and impeachment information; failure undermines prosecutions and individual credibility.

Whistleblower protections: 5 U.S.C. § 2302 and the Inspector General Act protect disclosures of waste, fraud, and abuse.

Conflicts of interest: recuse from matters involving personal, family, or financial interests; document the recusal.

Evidence integrity: never alter, plant, or destroy evidence; spoliation can result in sanctions, adverse inference, or criminal charges.

Ethical reporting: report misconduct through supervisory, IG, or Office of Special Counsel channels as appropriate.

Professional boundaries in source operations: avoid personal relationships, gifts, or favors that compromise objectivity or create appearance of impropriety.