Introduction

Identity is a key personal element that found everybody’s rights and duties. The ability to establish or prove someone’s identity with confidence is critical to potentially all aspects of social, political and economical activities (UNODC, 2010a). Since the twelfth and thirteenth centuries, official identity and travel documents are one of the privileged means to prove one’s identity in a wide variety of contexts (Groebner, 2007). Criminals have as such long understood that false identity and travel documents (hereafter FITDs) would be a useful means to support their actions and lifestyle (Lloyd, 2003; Groebner, 2007). Viewed by some circles as a minor crime problem, such fraudulent documents nonetheless foster organised crimes and terrorist activity (Gordon and Willox, 2003; Miro and Curtis, 2003; The 9/11 Commission, 2004), and have been ranked among the 10 most prominent ‘crime enablers’ in a recent European serious and organised crime threat assessment (Europol, 2013). The manufacture, diffusion and use of FITDs should be considered as a threat common to all elements of security, given that they have been described as ‘a horizontal facilitator touching upon all criminal markets’ (Europol, 2009).

FITDs are indisputably a critical tool to criminals and organised crime, and congruently should be perceived as a highly exploitable element. Forensic scientists, law enforcement, criminology and security stakeholders all may utilise such an element not only to understand and monitor this form of crime, but also those which it supports and their actors. Indeed, like any other forensic trace (Locard, 1920; Margot, 2014), fraudulent documents constitute the physical remnant of a criminal activity, in this case their manufacture. Once properly processed within a systematic forensic intelligence approach, these physical remnants can provide a wealth of information on criminals, criminal activities and criminal markets (Ribaux et al, 2003, 2006, 2010, 2013; Ribaux and Margot, 2008; Milne, 2012). Furthermore, forensic data being fundamentally material, it has the advantage of being objective, measurable, available for scientific exploitation and it can limit infringements to privacy (Margot, 2014; Ribaux, 2014). Building on that starting point, a systematic forensic intelligence process applied to treat FITDs can tell a lot about their production process as well as on the organisation and choices of criminals involved in that form of crime. Following the perspective of previous articles (Baechler et al, 2011, 2012, 2013; Morelato et al, 2014), this article considers that the elicitation of forensic science-based knowledge may contribute to provide an overview and understanding of criminal activities, networks and markets related to FITDs.

The forensic intelligence perspective developed here is more phenomenological. It does not follow the traditional investigative approach, or established reactive approaches that engage crime on a case by case reactive basis (Delémont et al, 2014). It proposes to complement and assist in shifting from the overwhelming technology-driven security strategies used nowadays to fight against FITDs, which puts a strong, if not an exclusive, focus on developing new security features and technical norms (such as security inks, automatic control devices or norms on the use of biometrics) (Lloyd, 2003; Ombelli and Knopjes, 2008; Hodgson, 2010). We propose to move the focus to the implementation of data processing from identified criminal use of FITDs to support proactive strategic and operational analyses, in a problem-oriented and intelligence-led policing perspective (Goldstein, 1990; NCIS (National Criminal Intelligence Service), 2000; Ratcliffe, 2008, 2009).

Theoretical Framework

Criminological literature on the manufacture, diffusion and use of FITDs is very limited (Steinmann et al, 2013). Inspired by environmental criminology (Wortley and Mazerolle, 2008) and the strategic approach defined by Cusson and Cordeau (1994), a traceological model was therefore initiated to consider how criminals (that is, forgers, workshops or organisations) manufacture FITDs, a criminal action from which physical remnants may result, and how these traces could be used in a forensic intelligence perspective (Baechler et al, 2012). According to that model and as illustrated in Figure 1, FITDs are traces that result from a combination of what the forger(s) knows (his/her method, techniques, pieces of knowledge and know-how), what he/she has (his/her material and equipment) and what he/she is (his/her physiological characteristics). Through an abduction and hypothetico-deductive process (Peirce, 1931; Crispino, 2008; Ribaux and Talbot-Wright, 2014), the observation and interpretation of these traces enable inference on the source or kind of source that produced the FITD, primarily its method and equipment, which describe the modus operandi used by the forger(s) (Baechler et al, 2012).

Figure 1
figure 1

Schematisation of the genesis of traces.

Notes: False identity documents are traces that result from a combination of what the forgers have, know and are. The observation and interpretation of these traces enable inference on their sources through an abductive inference process.

Full size image

Besides these considerations on the genesis of traces, the action of forgers is conditioned by routine activities and rational choices (Cohen and Felson, 1979; Cornish and Clarke, 1986). Indeed, knowing that no rational reason impels to change regularly their equipment and method, which would mean additional costs and efforts, forgers use a repetitive modus operandi in producing FITDs and specialise themselves. As a result, the documents manufactured by a same forger or according to a same modus operandi will exhibit common features, like a trademark, while documents produced by different sources will exhibit different features. The observation and examination of FITDs using forensic science methods thus enable the extraction of visual, physical or chemical features in order to draw, recognise and compare profiles. In agreement with the common cause explanation stated by Cleland (2013), as soon as FITDs with similar profiles are observed, it can be hypothesised that they have been produced according to a same modus operandi, and eventually by the same forger, workshop or organisation (Baechler et al, 2011, 2012).

The next section exposes a method that was developed to manage profiles and detect similarities among them. The section that follows presents how that method and its results may foster security by enabling the identification and characterisation of links between cases as well as patterns and trends associated with repetitive crime problems.

Profiling Method and Data

The method was extensively and recently described (Baechler et al, 2013), and has been used to profile more than 300 FITDs detailed below. This method allows the systematic and scientific extraction, processing and management of forensic science data. A visual examination of each FITD is performed in order to codify its profile, which comprises between 20 and 40 features such as for instance what are the printing processes used to manufacture the false document, if and how security elements are imitated (UV features, watermarks, security threads, Optically Variable Devices, embossing stamp, perforations and so on), the serial number, what are the fonts used to write different text zones and what errors are in the Machine Readable Zone. Profiles of all documents are memorised in a database and systematically and automatically compared using specific metrics, resulting in a similarity score (ranging from 0 to 100 per cent) that measures the extent to which each pair of profiles matches. Depending on a decision threshold selected by the operator, similarity scores are interpreted either as the presence or absence of a link between the pair of documents considered – the presence of a link meaning that the documents are considered to have been produced according to a same modus operandi. Considering all the links detected, a classification process is then performed to group within a class documents that are interlinked and form, therefore, a cliqueFootnote 1 (Baechler et al, 2012). This profiling method has been validated and assessed against controlled data sets, which showed that Type I and Type II error rates are less than 1 per cent when operating in optimised conditions (Baechler et al, 2013). Validation and assessment enabled to select the decision threshold that best balances Type I and Type II error rates.

For the present study, the profiling method was performed on a data set made up of 363 documents distributed among three types, namely 170 counterfeit Portuguese identity cards (paper version), 129 counterfeit French identity cards and 64 stolen blank French passports. A counterfeit document is defined as a false document that was entirely produced by one or more forgers; a stolen blank document is defined as an authentic document that was stolen before personal data could be integrated by the regular authority and that was subsequently personalised by one or more forgers. These 363 documents had been seized in different jurisdictions in France and Switzerland between 2000 and 2012 and were made available by police authorities. According to the Swiss national database on FITD seizures (Fedpol, 2013), the three types of documents studied are respectively the 19th, 12th and 79th most frequently seized in Switzerland among the 1008 types comprised in the statistics between 2007 and 2013.

In addition to the examination of the 363 FITDs, circumstantial casework data associated to the seizures could be collected, including the jurisdiction and date of seizure. The next section details profiles, similarity scores, links and classes resulting from the forensic profiling process along with circumstantial data that were used to perform different forms of analysis.

Forms of Analysis and Results

At the beginning of the forensic intelligence process, FITD can be considered as traces (raw data) that become signs (information) through the above-mentioned profiling method. These signs have to be analysed and interpreted in order to produce new pieces of knowledge that, in turn, may influence decision makers (Aepli et al, 2011; UNODC, 2011; Margot, 2014). The purpose here is not to define analysis and its specific methods in a forensic intelligence environment, namely link and trend analysis, since they have been described in a previous paper (Morelato et al, 2014). Rather, the following sections empirically explore and illustrate several forms of analysis that may provide novel, relevant and useful knowledge on crime to a variety of policing and criminology stakeholders. Leveraging different dimensions of forensic science case data, they clarify what kind of data is needed to perform the analysis, how to perform it, as well as its contribution and limits. This formalisation effort initiates the construction of a typology or catalogue of forms of analysis whose aim is to guide and foster the derivation of knowledge on crime from forensic science data.

Considering that forms of analysis and their potential are of a greater interest than specific results and considering the article length limitations, all forms will not be illustrated using the three above-mentioned data sets.

Investigating the structure of FITDs markets

Evaluating and understanding the structure of crime markets is of prime interest for law enforcement, security and criminology (Morselli et al, 2008; Morselli, 2009). On the basis of relationships established through the profiling method, the next sections investigate the markets structure through the three remaining dominant dimensions of analysis, namely quantitative, temporal and spatial dimensions (Rossy and Ribaux, 2014).

Quantitative analysis of forensic science relationships

Several indicators reported in Table 1 have been developed to measure the structure related to the data sets of counterfeit Portuguese ID cards, counterfeit French ID cards and stolen blank French passports. Quantitative analysis of links shows that about two-third of documents are linked to at least one other document (67.1, 69.0 and 62.5 per cent, respectively), which demonstrates that markets are not an accumulation of isolated cases and are rather structured. This also shows that if a new document has to be profiled, it has a two out of three chances to get linked with one document or more, thus encouraging forensic science profiling efforts. The fact that documents linked to four documents or more represent 30–45 per cent of the market gives another indicator of its underlying structure, larger networks making up a significant part of the crime problem.

Table 1 Number and proportion (in percentage) of documents with 0, 1, 2, n links to other documents for the three types of documents studied, as well as four social network analysis indicators
Full size table

Considering the network resulting from the links detected between FITDs (nodes), Social Network Analysis indicators (Morselli, 2009; Corazza and Esseiva, 2013) have been evaluated using the software Gephi 0.8.2. Average degree corresponds to the average number of links per document, and density measures the cohesion of the network. Both indicators indicate that the counterfeit French ID cards market tends to be more structured than the other two. According to the density indicator, counterfeit Portuguese ID cards could be the market with the least concentration of modus operandi and sources. Density measures may seem to be low, but are of the same magnitude as those usually measured for criminal (McGloin, 2005; Morselli, 2009; Corazza and Esseiva, 2013) and terrorist networks (Medina, 2014). A diameter of 5 or 6 links indicates that the extent of networks is rather limited, their shape being structured around clusters and cliques1 rather than rhizome-like structures (Lima, 2011; Rossy, 2011).

These quantitative results are advantageously completed by visualisations that facilitate perception and analysis of the market structure (Lima, 2011; Rossy, 2011; Rossy and Ribaux, 2012, 2014). Visualisations have been realised based on post-classification results of the profiling method and according to Rossy’s prescriptions to optimise diagrams integrity and efficiency (Rossy, 2011). Figure 2 illustrates the result for counterfeit Portuguese ID cards.

Figure 2
figure 2

Visualisation of the 114 counterfeit Portuguese ID cards that are linked to at least one other document through a class.

Note: The flag of the jurisdiction (Swiss canton or France) indicates where each document was seized. For readability reasons, only links established between document and the class or classes to which it has been connected are mapped, links between individual documents are not mapped. White circles represent classes. Documents connected on the base of circumstantial police information or seized at the same time regroup in boxes.

Full size image

From a strategic point of view, such visualisations offer an overview that enables the mapping of the criminal market structure at stake and monitoring of its evolution. At operational and tactical levels, it enables the detection and follow-up of prolific sources and organised groups in comparison with more anecdotal cases. Such forensic intelligence can assist in fixing priorities in a problem-oriented or intelligence-led policing perspective. For instance, the biggest group, which forms a clique1 on the top right of Figure 2, comprises 40 counterfeit Portuguese ID cards, or 23.5 per cent of the market. What appears to be a major source on the market would be shut down if this specific criminal network is targeted and neutralised. Figure 2 also shows that no police information existed before forensic analyses to associate or group these 40 counterfeit Portuguese ID cards seized at different time and places, which underlines the potential of forensic intelligence to increase law enforcement knowledge.

Temporal analysis

In order to explore the temporal dimension of links and classes resulting from the forensic profiling method, the data sets had to be limited to the documents for which the date of seizure was known. 111 out of 170 Portuguese ID cards, 121 out of 129 French ID cards and 56 out of 64 French passports remained. These data sets cover, respectively, 130, 309 and 57 links comprised in 41, 30 and 28 classes. The date of seizure may be very distant from the date of manufacture of the FITD. This would be most interesting for temporal analysis, but unfortunately cannot be ascertained. Dates written in the documents by forgers (date of issue, date of expiry or border stamps) can be completely bogus, so the only reliable date is the date of seizure. Of course, this limits the validity of the analysis form and is discussed below.

Analysing forensic science relationships over time enables the assessment of modus operandi longevity through the measurement of duration over which classes are observed. Class duration is determined by the time difference (in days, months or years) between the earliest and most recent date of seizure among the documents comprised in each class. Table 2 reports the mean, median, minimum and maximum classes durations for the three types of documents studied, and altogether.

Table 2 Mean, median, minimum and maximum durations of classes for the three types of documents studied and altogether
Full size table

Median durations are constantly inferior compared with mean durations, indicating the influence of very high values. This is demonstrated by maximum durations that are significantly higher than mean values, ranging from 2.5 to 6 years. Minimal durations systematically equal to zero, meaning that at least one class comprises documents seized the very same day. Results reported in Table 2 show that forensic science links can be drawn over extremely variable periods, ranging from 0 days (within 1 day) to 6 years, which may reflect a forger or source period of activity. The market is however essentially structured around classes persisting 10–20 months. These results indicate that modus operandi are not transient and that forgers do not seem to feel the need to modify or adapt their methods and equipment on a regular basis (the next form of analysis below and the section ‘Quality index of documents’ investigate that point further). However, knowing that the analysis is based on the date of seizure rather than on the date of manufacture of the document, it might also be possible that all these documents were created at the same time and were then seized at different times. These results also demonstrate the ability of the profiling method to link documents seized at very distant points in time, which is pivotal to perform a sustained monitoring of crime markets enabling to detect and follow-up phenomena on the mid to long term.

The assessment of the simultaneous or successive character of modus operandi permits to evaluate the number and concentration of sources within a crime market. Inspired by Gantt and activity diagrams (Rossy, 2011), the distribution of classes over time has been visualised, as illustrated in Figure 3 for French stolen blank passports.

Figure 3
figure 3

Visualisation of 56 French stolen blank passports over time and the interconnecting classes.

Note: The flag of the jurisdiction (Swiss canton or France) indicates where each document was seized and its place in the diagram depends on its date of seizure. White circles represent classes and horizontal lines their extent over time.

Full size image

The graph does not show a stairway appearance at all and horizontal lines superimpose over time. This indicates that classes tend to be simultaneous rather than successive, meaning that the market is comprised of several modus operandi existing in parallel. In order to assess how many of them are concomitant at a certain point in time, a vertical line can be drawn to count the number of classes crossed. According to Figure 3, 4–12 classes are concomitant most of the times, 19 being the maximum. This does not allow direct determination of the number of sources (forgers, workshops or organisations) involved in the market, but indicates that several sources are active at the same time and each uses quite a constant modus operandi. The hypothesis of a very limited number of sources repeatedly changing their modus operandi can be rejected on that basis.

Interestingly, an analogy can be drawn between that form of analysis and what Girod et al proposed regarding the analysis of shoe marks collected at burglary crime scenes: if shoe mark patterns are observed within simultaneous time frames, it means that several burglars are active in parallel in the region considered; if shoe mark patterns are successive, it may indicate that one offender or a very limited number of offenders are changing their shoes on a regular basis to disrupt the traceability of their criminal activities (Girod et al, 2008).

Spatial analysis

This form of analysis explores the spatial dimension of data sets. It considers the 349 FITDs for which jurisdiction of seizure could be determined, namely 156 counterfeit Portuguese ID cards (62 seized in Switzerland and 108 in France), 129 counterfeit French ID cards (89 seized in Switzerland and 40 in France) and 64 stolen blank French passports (all seized in Switzerland). Four indicators have been measured to assess the nature of crime markets, and the associated results are reported in Table 3:

  • The proportion of links out of the total that are transjuridictional, meaning that the linked documents were seized in different jurisdictions (cantons in Switzerland and départements in France)

  • The proportion of classes out of the total that comprise at least two documents seized in different jurisdictions (cantons in Switzerland and départements in France)

  • The proportion of links out of the total that are transnational, meaning that the linked documents were seized in different countries (Switzerland and France)

  • The proportion of classes out of the total that comprise at least two documents seized in different countries (Switzerland and France)

Table 3 Proportion (in percentage) of relationships (links or classes) that are transjuridictional or transnational
Full size table

Results reported for classes are systematically higher than those for links because of the less restrictive definition criterion. Transjuridictional relationships represent a significant part of the market lying between 20 and 44 per cent when considering links, and 56–60 per cent when considering classes. Consequently, if profiling was limited to the seizures made within a given jurisdiction, fifth to half of relationships would be omitted, affecting proportionally the integrity of how crime markets are perceived. The lower values observed for counterfeit French ID cards can be explained because this data set comprises three groups of 16, 11 and 10 documents, each seized at the same locations following the dismantling of three counterfeit workshops. The proportion between transjuridictional and transnational relationships is about 10:1. However, this must not be interpreted as the sign of a crime problem limited to each country. On the contrary, these results demonstrate that FITDs result from a cross-border crime phenomenon, and these proportions should be considered as a low estimate of the real situation. The structure of the available data sets certainly contributed to lower the number of transnational relations, the overlap between Swiss and French seizures was far from optimal since the first occurred mainly between 2000 and 2011, while the latter occurred mainly between 2008 and 2011.

Knowing that very limited conventional information is available to quantify the transjuridictional and transnational nature of FITDs markets, forensic intelligence results prove highly relevant to confirm or contradict tacit and experience-based specialists’ knowledge, and to enable objective comparisons between markets. Such results foster collaboration and information sharing between stakeholders located in different jurisdictions and countries. In fact, the profiling method demonstrates its ability to unveil links and classes across jurisdictions and country borders, which may not be immediately perceived in operational activities or only much later. This promises to overcome the usual limitations associated to circumstantial police information exchange mainly because of language, formats, sensitivity and/or reliability of information issues. The use of forensic intelligence facilitates the building and strengthening of an objective, common and cross-border perception of crime problems.

Investigating the quality of FITDs and its evolution over time

Quality of FITDs can be measured by their degree of congruence to the features of a corresponding official document. The development of a quality index is useful to measure and monitor quality as well as its evolution over time in order to assess risks posed by FITDs. It is proposed the quality index can be calculated at three different levels, namely:

  • Quality index of a document, or the percentage of its features that are non-differentiable from the corresponding official document

  • Quality index of a class of linked documents, calculated by the mean quality index of the documents comprised in the class

  • Quality index of a feature, or the percentage of documents registered in the database for which the given feature is non-differentiable from the corresponding official feature

The higher the quality index, the higher the quality of the document/class/feature considered and the higher the threat. The notion of non-differentiation is understood by considering an authentication realised by a moderately trained operator with a standard equipment (UNODC, 2010b). Therefore, quality index does not represent the ability of advanced document examiners to recognise a FITD, but rather the ability of a lambda agent to do so.

Quality index of documents

Table 4 reports quality index obtained for the 299 counterfeit French and Portuguese ID cards examined within this study.

Table 4 Mean, maximum and minimum quality index as well as relative standard deviation (RSD) resulting from the examination of 170 counterfeit Portuguese ID cards and 129 counterfeit French ID cards
Full size table

About half of the features examined on counterfeit Portuguese ID cards cannot be differentiated from an official document, while it is the case for only a third of counterfeit French ID cards features. Variations within the data sets are however important as evidenced by the difference between maximum and minimum values as well as the extent of relative standard deviations. The difference in a proportion of about 2:1 can be explained by the fact that paper versions of the Portuguese ID card are less secured than the French document, thus making it easier for forgers to avoid mistakes. However, the difference of quality index could also be explained by the implication of better-qualified and equipped forgers. These results show globally that FITDs exhibit many defects and their quality is rather weak. Therefore, they should be easy to detect even for a moderately trained operator. The maximum quality index of 82.4 per cent means that no perfect or almost perfect counterfeit was observed among the available data sets.

In order to monitor the evolution of quality index over time, the documents of the original data sets for which the date of seizure was known were plotted in a chronological graph, as Figure 4 illustrates for counterfeit French identity cards. The regular distribution of points, as well as the very low linear regression slope indicates no significant evolution of quality over a 13-year period. A similar evolution was noticed for counterfeit Portuguese ID cards over an 11-year period. From a criminological point of view, this means that forgers do not feel the need to improve their modus operandi, which may question the results of the technology driven-approach to combating FITDs. Results obtained on two different types of document over more than 10 years contradict the mainstream view that the quality of false documents is constantly growing, thus requiring to pursue the technological race against forgers (Pfefferli et al, 1999; Estabrooks et al, 2004; Ombelli and Knopjes, 2008; UNODC, 2010a). The challenge posed by FITDs could then be a more methodological than technical issue, requiring a better knowledge and understanding of criminals practice to tailor control and security strategies. Here again, the fact that the analysis is based on the date of seizure rather than on the date of manufacture of the document could influence the results, but that argument seems unlikely considering the 11 and 13-year periods during which the documents were seized.

Figure 4
figure 4

Chronological graph where counterfeit French ID cards are plotted depending on their quality index and date of seizure.

Note: The linear regression is showed with its function. A group of 11 documents seized in 2011 with a significantly higher-quality index is highlighted by an arrow.

Full size image

This form of analysis can also have a more tactical or operational interest in its ability to point to FITDs potentially produced by better-equipped or better-talented criminals. For instance, a group of 11 documents highlighted by an arrow on Figure 4 and seized in 2011 exhibit a quality index significantly higher than the average value. These documents have been produced by one or more sources that obviously have access to more professional methods and equipment. Such a piece of knowledge may guide investigations and impact the perception that this case is more serious, and thus deserves more attention and policing resource.

Quality index of classes

When only considering the classes comprising more than one document, the mean quality index for counterfeit Portuguese ID cards is 58.4 per cent (67 classes) and 28.8 per cent for counterfeit French ID cards (32 classes). These values are similar to those obtained when considering documents (see previous section). Figure 5 represents through boxplots the distribution of quality index of classes for both document types. Distributions appear to be rather homogeneous, a few lower-quality outliers being noticed for Portuguese ID cards classes, and only one higher-quality outlier for French ID card classes (this class comprises documents highlighted by the arrow on Figure 4 and the class has an index of 63.1 per cent).

Figure 5
figure 5

Boxplots depicting quality index measured for the 67 classes comprising counterfeit Portuguese ID cards (PRT) and the 32 classes comprising counterfeit French ID cards (FRA).

Full size image

When considering the quality index as a function of the size of the class (measured by the number of documents that it includes), the Pearson correlation coefficient is 0.062 and 0.099, respectively, for Portuguese and French ID cards, which means that bigger classes do not have a significantly higher-quality index than others. This tends to prove that quality is independent from the size of the production and that, in contradiction to a common preconception, prolific sources (that is, highly active forgers and crime groups) do not seem to put more effort into quality than sources producing a limited number of FITDs.

Quality index of features

Evaluating the quality index of document features provides objective and original information to assess which security features are efficient and which are not in the dection of FITDs. As results of such an analysis are sensitive, they cannot be reproduced extensively here. However, the study of features across available data sets revealed important variations among features and document types. For instance, the printing technique of personal data exhibits a quality index of 0.8 per cent for counterfeit French ID cards, while it is 36.5 per cent for counterfeit Portuguese ID cards and 92.2 per cent for stolen blank French passports. These significant differences can be explained by the use of a secured printing technique in the official French ID cards, while mainstream techniques like laser or inkjet printing are used for the two latter types of documents. It means that checking this feature is a very good authentication point when facing a French ID card, but is a much less efficient element to look at when considering French passports. This is not the only feature showing such differences. It indicates that performing a quality index analysis is a necessity to providing reliable intelligence. Indeed, it seems difficult to predict the exact efficiency of security features on a further type of document. A sustained analysis of the quality index of features is necessary to relevantly guide decisions and actions of security stakeholders, especially in terms of training and informing agents in the field. For instance, analysis indicates that the quality index of ultraviolet security printing is about 70 per cent for counterfeit Portuguese ID cards. This means that if a bank clerk, a border guard or an automatic device only performs the control of documents under a source of UV light, they will be deceived in about two cases out of three. When made knowledgeable of this, they should adapt their control methods and equipment. On the basis of that kind of forensic intelligence, the control strategy can be tailored and proactive, preventive measures can be designed. This form of analysis is also useful to inform official document designers, providers of security features and organisations that enact norms, about which features to prioritise when conceiving future identity and travel documents.

Investigating manufacture and diffusion pathways

Blank documents are highly valued by criminals since they make for very high-quality false documents. Once authentic blank documents are stolen during the burglary of an embassy, the attack of a convoy leaving an official printing office or by a corrupt official, forgers only have to fill in their customer personal data (photograph, name, date of birth and so on). In particular, French blank passports used to be stolen in large batches during several spectacular attacks that occurred mainly in 2003 and 2004 in France. These attacks aimed convoys transporting blank documents from the central national printing office to the local prefectures responsible for officially personalising the passports. Several thousands of blank passports belonging to different batches were thus stolen by what is thought to be organised crime groups (Revault d’Allonnes, 2004). The situation and context within which blank documents are stolen is generally reported to law enforcement agencies. However, the path they follow afterwards remains completely ignored until they re-emerge during an identity control often very distant in time and space from the point where blank documents disappeared in the first place. This form of analysis shows that the forensic science processing of the seized stolen blank passports available can shed some interesting light on their manufacture and diffusion pathways.

Thanks to the serial number of the 64 French passports seized between 2006 and 2010 in seven Swiss jurisdictions, it was possible to determine to which stolen batch they belonged and if these batches were stolen during a same attack or not. The 64 passports were distributed among five batches made up of 37, 13, 11, 2 and 1 documents, respectively. Using the forensic science profiling method, similarity scores were computed by comparing the profiles of each pair of passports. These scores were plotted in two distributions corresponding to intra-batch (800 scores) and inter-batches comparisons (1216 scores), as shown in Figure 6.

Figure 6
figure 6

Intra-batch (grey) and inter-batches (black) distributions of similarity scores computed between French stolen blank passports.

Note: An arrow highlights the peak corresponding to the intra-batch comparisons of a specific batch.

Full size image

Intra- and inter-batches distributions are very similar and almost superimposed. Mean and median scores are 62.6 and 61.5 per cent for intra-batch comparisons with a relative standard deviation of 23.0 per cent, while these values are 60.5, 59.0 and 22.2 per cent for inter-batches comparisons. These intra-batch similarity scores can be considered as very low compared with those resulting from the comparison of documents known to originate from a common source, expected mean and median scores being higher of more than 30 per cent. Rather, scores around 60 per cent correspond to similarity scores obtained for documents known to originate from different sources (Baechler et al, 2013). These results support only one hypothesis among the three possible manufacture and distribution pathways followed by stolen blank documents (Figure 7), namely the third (that is, the stolen batch is distributed to several sources who supply themselves in one or several batches).

Figure 7
figure 7

Schematisation of the three alternative hypotheses on the manufacture and distribution pathways followed by stolen blank documents.

Notes: A stolen batch can be distributed to one or more sources (forgers, workshops or organisations) that will personalise the blank documents. These sources can supply themselves in one or more batches.

Full size image

According to that hypothesis, criminals who steal a batch of blank French passports will distribute it to several sources (forgers, workshops or organisation), a situation that does not support the proposition, which implies that criminals who attack documents convoys work on command of FITDs producers. If it were the case, Hypothesis 1 would be supported by the observation of intra-batch similarity scores ranging much higher than inter-batches scores. The only difference between the two distributions, highlighted by an arrow on Figure 6, illustrates to a certain extent this first hypothesis. The peak ranges between 80 and 90 per cent scores and is because of intra-batch comparisons of the 37 French stolen blank passports batch. Then, this batch has more likely been distributed to only one source, and underlines a stronger relationship in that case between forgers and those who attacked the documents convoy. The implication of a specific crime group or network could explain why this batch distinguishes itself from the rest of the market, which is an interesting finding from a tactical and operational intelligence point of view.

More generally, this form of analysis produces intelligence that unveils steps of the trafficking of FITDs about which only very limited information is usually available.

Performing trend analysis to uncover changes in modus operandi

This last form of analysis does not rely on the specific profiling method neither on the data set described above. Rather, it uses surface forensic science features to treat data sets at a more general level in a trend analysis perspective (Milne, 2012; Morelato et al, 2014). The purpose is to monitor the many different types of FITDs seized nationwide to identify potential trends, thus revealing decreasing or increasing crime problems.

To illustrate how this form of analysis may be performed and how it can contribute to crime monitoring, the content of the Swiss national database on FITD seizures (Fedpol, 2013) from January 2007 to July 2013 was used. In that database, each false document seized in the country or at the border by the police or border guards is described by its date of seizure and its type. The latter depends on the country and sort of document (for instance American passport, Swiss ID card, Chinese driving license, Greek visa and so on) and the kind of false document (counterfeit, forgery or stolen blank – for definitions, see Mathyer, 1980; Levinson, 1984; Ombelli and Knopjes, 2008).

The evolution over time of the number of seizures corresponding to each type of document can be monitored using statistical analysis, visual representations or even data mining techniques (Grossrieder et al, 2013; Rossy and Ribaux, 2014). This may reveal interesting trends such as what was observed with forged and counterfeit Swiss residence permits (Figure 8). The total number of seizures is about the same (228 and 244) over the period considered, but these two types of false documents exhibit opposite trends. While forged Swiss residence permits (that is, originally authentic documents that have been altered by one or more forgers through a photograph substitution or a modification of the expiry date for instance) have a marked growth between 2007 and beginning of 2010, the slope decreases drastically afterwards. As regards counterfeit Swiss residence permits (that is, documents integrally produced by one or more forgers), they exhibit a limited growth until mid-2010, then the slope increases markedly towards mid-2013.

Figure 8
figure 8

Evolution between January 2007 and July 2013 of the accumulated number of seizures of counterfeit and forged Swiss residence permits according to the Swiss national database on FITD seizures.

Note: The respective trends are opposite and are likely caused by a displacement of modus operandi from forgery to counterfeiting happening in mid-2010.

Full size image

Knowing that a change in law enforcement priorities is not a valid explanation here, this evolution may rather indicate the occurrence of a transition of modus operandi or displacement from forgery to counterfeiting (Clarke and Eck, 2005). These trends could be explained by the progressive introduction since December 2008 of a new official model of the Swiss residence permit (Federal Department of Justice and Police, 2013). The new model is a credit card format document made of plastic with laser engraved photograph and personal data, thus making the content very hard to forge. The older model is a paper-based document that can be altered by scraping written information or by substituting the glued photograph. It is however not that easy to counterfeit since the paper is secured with a watermark. This likely modus operandi displacement shows that forgers have the ability to adapt their methods and equipment to the emergence of a new situation. Such a displacement would have been particularly difficult to predict since the new model is supposed to be better secured than the older version, which should have diverted forgers from ‘attacking’ the new model. This example highlights that technology on its own is not a sufficient solution. Besides the criminological and strategic interest of observing such trends, it provides key intelligence to proactively train and alert agents in the field. Indeed, from mid-2010, their attention should rather be focused on detecting counterfeits than forgeries since the respective detection points are not the same. Such knowledge may prove useful to official document designers as well in order to perform risk analysis and tailor their products to actual threats.

Through its ability to detect trends and crime problems among very large data sets (such as a national database), this form of analysis can be useful to target forensic profiling efforts on identified problems or sub-problems. Indeed, the forensic profiling of 20–40 material features is more resource-intensive than treating the surface features of FITDs (that is, their document type). Both levels of generality have their significance and they have to be articulated properly in a global forensic intelligence model, as proposed earlier (Baechler et al, 2012).

Discussion and Conclusion

When considered as the physical remnant left by their manufacture process, FITDs can become subjects of a forensic intelligence processing that may assist in understanding forgers, their patterns and organisation. Such a traceological approach, rooted in forensic science examinations, is not aimed primarily at assisting criminal justice, but brings rather phenomenological food for thought and decision making for criminology, security and law enforcement. This article illustrates the potential of forensic science methods to explore, and systematically and scientifically structure criminal data sets made up of hundreds of FITDs, enabling in turn the interpretation of resulting signs through different forms of analysis. These forms demonstrate their ability to detect and follow-up crime problems and patterns in the long term, and over borders, which may assist the allocation of resource and priorities in a problem-oriented and intelligence-led policing perspective. The forensic intelligence-based knowledge generated here is transversal since it can sustain intelligence processes at different levels of generality, that is, strategic, operational and tactical levels, and support proactive and preventive approaches to crime solving. From a more methodological point of view, results gathered here indicate that the technology paradigm, that presently drives and focuses the efforts of security features providers and forensic science research, should be questioned and complemented. To guide policing efforts, a great but maybe unseen potential lies in the analysis of FITDs that have been detected in the past and that are detected today. In a more general manner, Ribaux and Talbot-Wright (2014) expressed the very same diagnosis concerning forensic science, suggesting a need to refocus the discipline on problem solving rather than on technology.

Besides its advantages, forensic intelligence also raises some issues since traces are fragmented, incomplete and their relevance can sometimes be questioned (Ribaux et al, 2013). To reach its goals, forensic intelligence requires a sound understanding of the genesis and nature of traces (Champod, 2014), as well as a comprehension of inference processes that the examination and processing of traces may support. Limits and pitfalls must be made explicit. For instance, forensic intelligence starts exclusively from traces that have been detected. Ignoring undetected FITDs introduces a bias whose extent remains unknown, but it could have a strong impact on analyses results. For instance, one can legitimately imagine that top-quality FITDs will be less detected than low- or middle-quality false documents, thus influencing the inferences and hypothesis based on quality index measurements. The same goes for temporal analysis based on FITDs date of seizure. Such date could reflect more upon law enforcement behaviour than criminals’ activities. In the end, forensic intelligence depends tightly on the past and present policing strategy and the ability of security stakeholders to detect traces in the first place. These parameters influence when, where, how and why seizures of FITDs occur. To minimise the effect of that bias, part of the solution lies in at all time maintaining an open-minded stance and in allowing the system and its operators to think out of the box (Morelato et al, 2014; Ribaux, 2014). From time to time, random controls have to be conducted in order to potentially unveil new and unexpected crime problems. The modus operandi displacement of forgery to counterfeiting Swiss residence permits illustrates an unpredicted change of pattern for which an exploratory and systematic analysis of forensic data enabled the rapid detection.

Another part of the solution lies in the necessary leveraging of forensic intelligence with alternative information, such as police and criminological data. The processing of forensic data does not reveal everything about criminals and their practices, and a combination of various sources and pieces of information is pivotal to analysing comprehensively crime and its various evolving patterns (Ribaux et al, 2013; Ribaux and Talbot-Wright, 2014). In that regard, the fusion of forensic intelligence with situational analysis based on circumstantial information, as proposed by Steinmann et al (2013) for instance, is thought to be promising. Integrating forensic science data into crime intelligence may shed light on areas of crime that are difficult to access otherwise, and suffering from a paucity of knowledge. This form of analysis dealing with manufacture and diffusion pathways of stolen blank passports is a strong example in that regard. Relationships between FITDs detected by forensic intelligence methods can also support Social Network Analysis approaches to investigating criminal networks and markets (Morselli, 2009), as was shown regarding illicit drugs trafficking for instance (Corazza and Esseiva, 2013).

The successful implementation of forensic intelligence also requires the identification of stakeholders that may make the most of intelligence products. Regarding FITDs, models such as the crime problem analysis triangle (Clarke and Eck, 2005) are conducive to the identification of a wide variety of guardians, either human or machine, who perform identity and travel documents controls and who may take advantage of timely and targeted intelligence products: police, border guards, administrations, private companies (banks, transport and rental companies for instance) or even automated control devices that become extensively widespread. The same goes for the many identity and travel documents managers, such as official document designers and providers, organisations that enact norms like the International Civil Aviation Organisation (ICAO (International Civil Aviation Organisation), 1980), or companies who design and produce security features. As shown in the section ‘Forms of analysis and results’, forensic intelligence could help those managers in tailoring their technical and normative counter-measures in a preventive approach to combating the manufacture and use of FITDs.

Another critical success factor to the implementation of forensic intelligence is the proper formalisation of its principles and integration within the broader security and policing picture. The generalisation of specific developments realised regarding various types of traces, such as FITDs or illicit drugs, is in that regard necessary and underway (Morelato et al, 2014; Ribaux, 2014; Baechler et al, 2015). The typology of forms of analysis that was initiated here contributes to this formalisation effort. Such a typology or catalogue aims to enhance the reusability and transparency of analysis forms. It shall facilitate their implementation in practice, in computerised systems as well as in education and training (Baechler et al, 2015). The analogy between shoe mark patterns and FITDs analyses highlighted in the section ‘Temporal analysis’ is a telling example that these forms of analysis have a general character. This typology will assuredly enrich itself with further forms of analysis, such as those that have been investigated but are not reported here. For instance, the comparative examination of FITDs features that relate to different manufacture stages (production of background, numbering and personalisation) can provide assertions as to the production pathways and the organisation of sources across these different stages (that is, determine if FITDs are produced in a one-stage process or through separate steps possibly located in different places).

Ultimately, for traceology to find its place at the crossroads of forensic science and criminology and to deploy its full potential in fostering security, it needs to express and recall that traces are not only the remnant of a punctual criminal action or source, as classically viewed in forensic science and criminal justice, but also the perceivable and exploitable remnant of crime phenomena, and, in particular, organised crime-related activities. This article aimed to contribute to this end and explored how to derive knowledge on crime from forensic science data using the example of turning false identity documents into forensic intelligence.