FLINTS, a Tool for Police Investigation and Intelligence Analysis: A project by Richard Leary explained by its author

Abstract

This chapter presents and discusses, in 28 sections, a link analysis tool for the British police, FLINTS. The chapter considers, in turn, the motivations and history of the project; the early beginning resulting in FLINTS 1; identifying “unknown” offenders, and systemising it; link detection; more about the first generation of FLINTS; integrations, linking and analysis tools; expanding FLINTS to other police areas; volume crimes and volume suspects; performance monitoring and system identification; a tour of FLINTS as the user sees it; the intellectual foundations; and what stands out in FLINTS. We turn to a case study in linked burglary. We then discuss forensic decision-making; second-generation FLINTS; access to the system (searching vs. surfing); asking questions about people and suspects; asking questions about crimes and events; displaying modified Wigmore Charts, and the graphical results in FLINTS; geographical analysis; temporal analysis; prolific (volume) offenders search; using geography to identify prolific offenders; hot spot searches; vehicle searching; and analytical audit trails.

These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

7.1 Introduction: Motivations and History of the Project

This chapter is the result of research conducted by myself into the benefits that can be gained by the application of a general theory and methodology for the process of obtaining, managing and using evidence in police investigation and intelligence analysis. Central to this thesis are methods and processes that help investigators and intelligence analysts to ask better questions. This introductory section presents a brief chronology of the development of those ideas and research. My standpoint was informed by having been a Detective Police Officer for a number of years in the United Kingdom.

My original ideas about improving police investigation and intelligence analysis came from ideas that involved the combination of different types of evidence. Furthermore, I had experimented with ideas about how we could improve police investigation and intelligence analysis by developing a better understanding about techniques for the reduction of “uncertainty” as presented in a paper at the First World Conference on Criminal Investigation and Evidence at the Hague in 1995. Uncertainty reduction (entropy) for me is at the heart of all good science and is the bedrock of rational systems of discovery. Something I remain convinced upon to this day.

In 1996, two additional papers were published in the Police Research Group’s publication, Focus. The first was entitled A Revolution in Criminal Investigation, and concerned extending the application of forensic principles and genetic evidence within policing. The second was entitled DNA: The Promise; it challenged the traditional use of evidence, and proposed new ways for the systematic management and use of evidence in the investigation of multiple cases rather than solely of single cases. These three papers provided the ideas behind the systematic use of large collections of evidence, and helped I to formulate the original ideas underpinning a prototype system of software (called the “Forensic-Led Intelligence System”, FLINTS) that became adopted by West Midlands Police. Prior to this, forensic evidence was almost exclusively used in the investigation of single, isolated events such as a burglary, a murder, or a rape, rather than in the routine investigation of linked series of crimes.

In 1996, I developed an interest in the methods of analysis and synthesis of evidence developed by John Henry Wigmore.¹ Although this approach was exclusively concerned with single, isolated cases, and was intended primarily for use by advocates preparing for court, it provided a foundational methodology for the charting of logical relations between evidence as an aid to developing powerful arguments. I also developed an interest in the science of complexity, which provided valuable ideas about how complex systems function and the way in which information in such systems behaves and can be used. That same year, I won the Forensic Science Society Scholarship and used that funding to continue this research into new ways of using and managing forensic evidence. Systemizing the combination of different evidence types and developing intelligence from forensic evidence were the focus of this work.

At this time, I was seeking to operationalise my research findings in the form of a system so as to accomplish two goals: to overcome five weaknesses identified in police investigation and practice, and to draw on the lessons learned from Wigmore, molecular biology, and complexity theory.

In 1998, I was appointed Scientific Officer to West Midlands Police and tasked to implement new methods of managing and using forensic evidence. In 1999, for the first time in the world, I and scientists from the Forensic Science service experimented with the use of highly sensitive technology for recovering DNA from surfaces that had merely been touched by humans. Although it was usual to recover DNA from visible samples, the experiment focused on material that was invisible to the human eye. The intelligence gained from this evidence was used to identify groups of criminals operating in networks. At this time, there was a national crime problem involving the defrauding of elderly citizens. Confidence tricksters were gaining access to the homes of elderly people on the pretext of being public officials, and using the opportunity to steal cheque books and other valuables. Using “supersensitive” recovery techniques, DNA was successfully recovered from door knockers, handles and other objects that had merely been touched by offenders. Applying new policy, procedures and techniques in accordance with the general theory and methodology described in this thesis, evidence was recovered that resulted in the detection of networks of criminals and crimes. This was later responsible for the prosecution of key people involved in organizing and committing these offences. The technique subsequently became a forensic service offered to investigators.

As a result of this work over a number of years I decided to implement some the main themes of the work into a software system. The resulting software was FLINTS. Mark Compton programmed the computer code under my guidance; I provided domain expertise that shaped how the programmer embodied the conceptual foundations behind my new approach to evidence management and implement it into the software.

In 1999, Nick Tofiluk, Chief Superintendent (later, Assistant Chief Constable) of the West Midlands Police, developed an interest in FLINTS and offered strategic assistance in overcoming organisational barriers to implementation of the system in the West Midlands Region. This resistance was an interesting reaction which I learnt greatly from. In essence, the resistance emanated from protectionist attitudes amongst some Detectives, Managers and the IT Department because adopting FLINTS meant (A) admitting that we could do things faster, cheaper and more effectively and (B) it involved the use of modern computing power and threatened job security. Whilst the former was true the latter was not. FLINTS merely ensured that humans could achieve more and be employed in the things they do best; reasoning, deciding, evaluating and decision making whilst the computer could access, count, sift, sort and process information at breath-taking speed. I and Nick agreed to work together and I was given great assistance in overcoming these organizational barriers. Responsibility for the development of the methodology and conceptual underpinnings continued to remain my own.

In 2002, I began work on a case study intended to develop a new approach to managing the problem of shifting contexts and standpoints in evidence management. In 2003, the first iteration of a new case study was programmed and used to simultaneously manage and analyse evidence in hundreds of cases of fraud. Lawyers involved in the original litigation had been unable to manage these cases without the application of the approach because the body of evidence was too vast for manual methods to succeed. Although the system, called MAVERICK, is outside the scope of this chapter, it uses a unique methodology to manage the way in which evidence is perceived and managed.

In 2004, using MAVERICK, I responded to requests in the provision of two important areas of assistance to law enforcement and financial organizations: First, I provided assistance in meeting the compliance obligations laid down by the Proceeds of Crime Act and Terrorism Act of 2000. This assistance was in terms of “disclosures” of material to the National Criminal Intelligence Service about suspected terrorist funding and financial crimes committed during organised crime involving fraud and deception. These disclosures were made on behalf of U.K. lawyers representing large corporate organisations who had been targeted with fraud. Second, I provided assistance in the management of a mixed mass of evidence concerning 2 million financial transactions suspected to contain material subject to the above legislation. My methodology and the MAVERICK software were used throughout.

7.2 Early Beginnings

The traditional approach to the management of evidence in policing has involved narrow conceptions of the way evidence is managed, analysed and used. My experience demonstrated that practitioners² adopted narrow views as well as uninspired approaches³ towards the study and use of evidence as a science. This included the way that evidence should be collected and the many uses to which it could be put. A common experience was that whilst cases may appear to be overwhelming proven “on paper”, by simply adopting another standpoint or considering an alternative explanation about some aspect of the case, an alternative view could be deemed not only plausible, but often persuasive. Often, this was the result of investigators treating and interpreting evidence only in the light of the hypothesis they were pursuing. Evidence is too often seen in light of the support it can give to a narrow or single hypothesis. Alternatives are not considered, or, if they are, they are dismissed too readily. Narrow or single hypotheses often appear in the form of a case theory. For example, the theory may propose that a particular act had been perpetrated by a particular individual, or that an event took place “in the following way”, thereby favouring a particular explanation. This narrow view has implications not only for single cases, such as the investigation of historical events or crimes, but also for intelligence analysis and predictive enquiry. In terms of single cases, it creates barriers to the consideration of alternative explanations.

Evidence that may support an alternative theory may be ignored, resulting in the wrong conclusion being drawn. In terms of intelligence analysis, the narrow focus can prevent users of evidence from considering fruitful lines of enquiry that would potentially prevent a threat from becoming a reality. Simple explanations or those that appear obvious are considered at the expense of those more difficult to uncover. Collections of evidence often contain many layers of information in which indirect links and associations may not be immediately obvious. Accessing and testing these areas of our collections of evidence present many opportunities for the discovery of new knowledge.

This insight provided valuable lessons about the way evidence is sought, collected and used, and seemed crucial to developing a better approach. What seemed to be missing was the development of a truly systematic forensic⁴ attitude towards the management and use of evidence.

7.3 FLINTS 1

FLINTS is a modernised neo-Wigmorean approach to the management, analysis and use of evidence in pre-trial criminal fact investigations. It was designed on the basis of the methodology in this thesis to model the relationships between people, crime, locations, times and evidence in ways useful to analysts, investigators and policy makers. This kind of Wigmorean evidence modelling serves a number of purposes in the generation and discovery of knowledge. However, there are two principal purposes it is concerned with: first, the provision of understanding of the attributes of evidence we already possess about events that have already take place, and second, the provision of insights into evidence we do not yet possess, but need, and into events that may yet take place. At the end of this chapter, a case study in “linked burglary crime” is described, and the methodology and use of FLINTS are demonstrated.

Policing has suffered⁵ from a lack of knowledge about the structural and intellectual questions surrounding the collection and use of evidence as a discipline and has therefore been unable to construct a conceptual framework and a set of operating principles that would allow police organisations to gain maximum knowledge from their collection of evidence.

The mechanisms I put forward in my doctoral dissertation to aid the modelling of relationships within networks of evidence are achieved by organising the systems and structures under which evidence is discovered, collected, considered and stored so that links and connections inherent in the evidence can be speedily established. This in turn aids the formation of new hypotheses and the elimination of old hypotheses. Questions can be asked of the system to draw on the complex combinations of evidence that already exist, but that are perhaps not readily known, as well as those combinations and connections not known to exist but that are strongly suspected to exist.

This demonstrates that although we may be in possession of information, we are often unaware of the evidence’s existence, or, if we are aware of its existence, we are sometimes oblivious to its meaning and the links that exist within the information. The contribution that approaches like this can make to developing our understanding of the environment in which we operate is underestimated. What we “possess” and what we “know” are often very different. Establishing the difference between what we possess and what we know provides the ability to establish what we “do not possess” and “do not know”. Optimising systems to undertake this function is crucial in getting the most benefit from the evidence collections we have. Applications for use of this approach are many.

Identifying links and connections between crimes and events that we know⁶ have taken place and people that we believe are connected to these occurrences helps us to identify links and connections with other crimes, events and people that may be linked, but for which evidence is currently not available to justify, negate or sustain that belief.⁷ Investigators can set out to establish whether sufficient evidence, even if not presently available, does exist in some form, somewhere, to justify or negate the hypothesis. This helps us to investigate crime not only on the basis of single events in time, but also on the basis of chains of events in time and space, and thus represents a whole new way of thinking about crime investigation and intelligence analysis. Let us imagine a series of ten crimes of burglary linked on the basis of DNA evidence.

Let us consider an example: a series of 10 crimes linked by a single DNA profile. Figure 7.3.1 illustrates that at each of the 10 crimes, DNA evidence in the form of a crime stain⁸ was recovered. The hypothesis is formulated that these 10 events are linked because DNA recovered at each crime scene has produced the same genetic profile, namely that of suspect “A”.

Fig. 7.3.1

A hypothetical series of 10 crimes linked by a single DNA profile

We can formulate a hypothesis that the donor of the DNA at each of the scenes of crime is the same person, even though we do not yet know their name.⁹ In an effort to identify the donor of the DNA, we might search for any matching DNA profiles from former suspects and convicted persons stored in the National DNA Database. However, it is possible that after the search, despite our establishing that the crimes appear to be linked, no profiles from suspects and convicted persons matched Profile A. We would then be left with the task of identifying the offender by other means.

7.4 Identifying “Unknown” Offenders

How can we set about identifying “unknown” offenders? We could sit around and hope that we “get lucky” or we could appeal for witnesses to the events in the hope that someone, somewhere, might have the evidence we need. One effective approach is to explore methods that reduce the level of uncertainty associated with the number of people in the database that could account for the DNA profile.¹⁰

We can create a “virtual offender” to account for the presence of DNA Profile A at the scene of each of the crimes and await other evidence that might indicate a legal identity. This can be done by systematically exploring the information we already possess to ascertain whether there are any indications anywhere in our systems as to the possible identity of the individual who possesses DNA Profile A. Not only might this produce a suggestion of their identity, it might also lead us to search for additional information in areas where we are likely to find useful indicators of the offender’s true identity.

So far we have only considered DNA evidence recovered from each of the 10 crimes. There may be other evidence available that we have not considered. Fingerprints, footwear, tool marks, handwriting, hairs, fibres, witness evidence and other clues may provide a suggestion about the likely identity of the suspect if we consider this evidence alongside the DNA.

Imagine that a fingerprint found at burglary 4 is identified as the index finger on the right hand of a known former burglar called Mr. George Smith. The question then arises: “Does George Smith have DNA profile A?” If he does, fingerprint evidence has suggested a method to establish the identity of the original donor of DNA profile A – possibly Mr. George Smith. If the answer affirms this, then Mr. George Smith may be asked to provide a DNA sample for comparison and, if matched to DNA recovered from one or more burglary scenes, asked to account for the presence of his DNA at each of the 10 scenes. Other evidence types can also be used in this way.

Many types of evidence can help us to identify people that we know exist in the population but for whom we have no means of distinguishing them as individuals. Used in combination, these sources of evidence present us with a range of possibilities to identify individuals uniquely. Some involve direct and some involve indirect chains of reasoning.

7.5 Systemising the Identification of Unknown Offenders

Policing and intelligence work has for too long approached the identification and elimination of suspects in a conceptually narrow way. The focus of attention has been on the use of names rather than a wider concept involving the use of indicators of identity.¹¹ Intelligence systems employed in law enforcement use names as the key identifier. The same is true of evidence systems used in fingerprint and other forensic databases.

The ability to systematically (and routinely) identify persistent offenders has great potential for decision-making and for optimising investigative effectiveness. Identifying those persons who commit most of the crimes in our systems offers greater returns on the investments we make in the deployment of staff and financial resources.

The use of a wide range of indicators of identity can be used rather than narrow, single indicators (typically only a name) to provide a more inquisitive methodology for identification. Rather than simply referring to offenders by either their name or as simply “unknown”, they can be referred to as “virtual unknowns”. They can be classified and catalogued in a database alongside indicators of the characteristics we do know. As the investigation of crime continues over time, we can explore different combinations and different inferential chains of links by using these indicators in combination to help us set about filling in the gaps in our knowledge. Researching direct and indirect chains of links may eventually produce or suggest a possible indicator as a means of identification.

Let us consider this approach in detail. If we are satisfied from the available evidence that a crime has been committed, we can infer that someone who may (as yet) be unknown committed the crime. Unknown persons can be classified as “virtual suspects” simply by giving them a unique number to act as an identifier until their true identity is discovered. Once we have allocated a unique number to the “unknown”, we can then think about them as a “virtual unknown” person. This provides us with a whole new way of thinking about the problem of identification. We can use a range of indicators about their characteristics, their identity or their personal circumstances to do so. Taken together, these indicators can provide the means to link different aspects of identity until one or more of those indicators provide a suggestion of a name.¹²

It is the ability to develop and navigate direct and indirect chains of inference between indicators that presents the opportunity to identity individuals. This is an example of a broader use of the concept of evidence and the wider uses to which it can be put to.

Table 7.5.1 is a multidimensional identification index designed to present a systematic approach to the use of a range of indicators to identify people.

Table 7.5.1 A multidimensional identification index

Referring to Table 7.5.1, let us imagine that Event 2 was a burglary in which the offender shed hair. Subsequent DNA analysis of the hair produced a DNA profile. However, no reference sample of the offender existed in the National DNA Database, therefore the offender cannot be immediately identified by name. Genetic information gained from DNA profiling of the hair provided further information about the person’s physical characteristics: their hair colour, eye colour, ethnic ancestry and height. These additional indicators are used to begin to fill gaps in the virtual persons record that may become useful to us.

The same DNA profile is found at Event 4, the theft of a motor vehicle. A witness to Event 4 states that the offender was seen to have a distinctive tattoo on his right forearm: an eagle and sword. He was aged between thirty and forty years, was a white European and had brown to red hair.

Because Event 4 revealed the same DNA profile as Event 2, we can begin to cross-reference specific details of indicators from Event 4 to Event 2.¹³ The index demonstrates how we can use a method of cross-referencing evidence from one event to another so as to provide us with a system to navigate inferential links, gaining clues to the identification of individuals and even groups of individuals as we progress. In this example, it can be seen that the DNA recovered in Events 2 and 4 provided us with genetic information about the offender’s physical characteristics and ancestral ethnicity, and these become a part of the index.

A search of the tattoo file in the multidimensional index reveals that two people are known to have a tattoo of this description: a male aged sixty-five years, of West Indian appearance and with a recorded name of Charles, and a thirty-two-year-old male of White European appearance called Finney. Neither had previously provided DNA profiles. The system could be automated to check for those persons within the population with indicators that match a tattoo as well as any other indicators available. This narrows down those in the system that could potentially match with the available information.

Computers can be used to manage and track the chains of connections produced by this kind of cross-referencing. Although the methodology is simple, the potential links involved soon become complex and require an efficient means of tracking and cross-referencing. This process helps us to eventually establish an identity using the conventional method of a legal name, ultimately reducing the uncertainty about the legal identity of the person of interest to us. Another useful attribute of this method is that the indicators of identity can be searched in predetermined ways involving one indicator or a combination of indicators to “cleave out” of the system configurations of information of interest to us. We may need to identify a white male, aged fifty to fifty-five years, with brown hair and blue eyes, and who drives a white BMW car. This may produce a range of potential suspects, some with known legal names and others still classified as “virtual unknowns”. Again, the process of cross-referencing indicators, combining indicators and exploring inferential routes between records may produce an indicator of interest in determining a true identity.

Let us consider another aspect to this process. The evidence we have does not mean that the virtual suspect or offender was alone when the crimes were committed; they may have committed any one or any combination of these crimes with any number of other individuals. The index may provide evidence of links between individuals and hence their potential identity. Even the notion of virtual criminal networks can be used in this way. For example, we may have evidence in our system to suggest that a number of crimes have been committed, and by means of a range of indirectly linked indicators, a complex network of links between a group of people may be suggested. These groups can be used as sources of suggested names for elimination purposes. As with the fingerprint evidence at burglary 4 in Table 7.5.1, if we can establish an accomplice of our “virtual offender” acting in concert at (say) burglary 6, that evidence (whatever it may be)¹⁴ may suggest a potential name for the donor of the DNA found at each of the 10 crimes.

7.6 Link Detection

Modelling networks of offenders can assist in the identification of suspects and groups of suspects for crimes that may already have occurred and for crimes that are yet to occur if action is not taken. Let us consider how this can be done and how FLINTS can assist in this. Searching each of the 10 crimes for additional evidence types such as a fingerprint or tool mark or footwear impressions may give rise to suspicion about a group of suspects or even an additional single suspect who may also have been involved.

Figure 7.6.1 demonstrates how a multidimensional approach to evidence management and analysis can aid in the detection of links between series of crime evidence and people. The same approach can be used to detect links between groups of people, geographic locations and chronologies using different mixtures of evidence. Figure 7.6.1 is an illustration of a database of crimes that can be examined for linkages on the basis of different evidence types. Each square in the illustration represents one crime. Each blue square is a crime scene from which DNA of type A has been recovered. As already stated, these 10 crimes are potentially linked.

Fig. 7.6.1

A multidimensional approach to evidence management and analysis¹⁵ Footnote

A finger mark at linked crime 6 suggests the name “George Smith” as a suspect. Smith may possess DNA profile type A. If so, we can connect him with the series of 10 linked crimes. If he does not, one of his associates may. Other evidence types may indicate additional links between other crimes and Smith as well as other series of crimes and other suspects. Some of the new suspects may be connected to Smith as associates.

A useful question might concern which of the remaining crimes in the database are linked based on an analysis of a variety of evidence types and, importantly, which are linked on the basis of combined evidence types. If any other evidence type (for example, those listed in the illustration) can provide a suggestion of a linked suspect, then we can set out to implicate or eliminate that suspect based on the DNA evidence.

Inferential links may be discovered on the basis of high frequencies of offending in particular geographic areas or where a crime bears a particular modus operandi. These observations may reveal interesting patterns to consider as hypothetical links within the original linked series. This may reveal evidence that suggests suspects for consideration in the original series linked by means of DNA.¹⁶ Using this idea, a search of the FLINTS system may reveal potential suspects on the basis of the frequency of crimes bearing striking similarities to the series of 10 that are believed to be linked.

Investigators and analysts can begin to discover and understand complex networks and connections between people, events, locations, times and evidence in ways not previously possible. FLINTS not only allows this to be done – it allows it to be done speedily, efficiently and with reliable and actionable results. In Foucault’s Pendulum, Umberto Eco (1988, p. 225) describes an innate characteristic that exists in databases of information. This description by Eco could well have been a description of FLINTS:

No piece of information is superior to any other. Power lies in having them all on file and then finding connections. There are always connections you have only to want to find them.

FLINTS is designed to act as an evidence integrator that brings together collections of evidence and arranges them in such a way that users can formulate questions. The principal objectives are to enable the marshalling of substance-blind sources of evidence that enable links between people, events, locations, times and evidence to be discovered by the process of analysis and questioning.

Figure 7.6.1 demonstrates the fundamental principle of integration, management and analysis of evidence around the key attractors of people, events, locations, times and evidence. If we begin from the left-hand side and work through the chart, we see that evidence is put into the system from various sources. These may be sources such as fingerprints and DNA, but in fact can be any class of information that we determine as reliable. Accepted fact, a concept well understood in law, has great potential in intelligence analysis. There are many facts about the way we live, work, behave and communicate that are generally available. These characteristics can be used as evidence in the form of accepted fact and treated in much the same way as DNA, fingerprints and other forensic evidence types.

Evidence of many kinds is integrated in the FLINTS database around the key attractors of people, events, locations, times and evidence so that links, associations and connectivity within the data can be detected. The system allows questions to be formulated in a structured way by investigators and analysts using a conventional computer that runs Microsoft Windows. Figure 7.6.2 is an illustration of the flow of evidence through FLINTS.

Fig. 7.6.2

The flow of evidence through FLINTS

7.7 The First Generation of FLINTS

The prototype FLINTS system began managing forensic evidence matches in the West Midlands Police department in April 1999 following a request from the force to use the system.¹⁷ The system had been designed to demonstrate the benefits of its underlying concept¹⁸ and used fingerprint and DNA evidence to do so. Evidence based on footwear, handwriting, tool marks and drugs were soon to follow. The system provided for the integration, management, analysis and performance measurement assessments as well as for the systematic allocation and management of enquiry work.¹⁹ Protocols designed for key managers and key analytical tasks became part of the West Midlands Police strategic policy.

Forensic matches reported by departments for specific evidence types are input into FLINTS by means of a standard formula. For example, DNA matches reported by the National DNA Database, fingerprint matches reported by the West Midlands Fingerprint Bureau²⁰ and physical evidence matches such as footwear and tool marks reported by forensic laboratories are brought together in the FLINTS Bureau for entry into the underlying databases.

Strategic and analytical management tasks can be undertaken for a wide variety of purposes. Some of the tasks undertaken: maintaining a “tracking system” for the enquiry work allocated, assessing the performance of operational police areas by individual evidence types as well as by individual scene examiners, comparing evidence yields by operational areas and individuals, managing information about suspects identified, and comparing operational areas for trends.

7.8 Integration, Linking and Analysis Tools

From the initial implementation, it became apparent that FLINTS gives the user access to ranges and classifications of intelligence data about people, events, locations, times and evidence. The system enables the user to “visualise” the evidence in a number of ways that provides a range of perspectives on the data. Geographical visualisation, network visualisation and spreadsheets of varying kinds can be requested and presented in user-friendly ways. Wigmore recognised the power of visualising evidence for temporal analysis and the synthesis of arguments. FLINTS thus uses a Wigmorean approach in the development of scenarios of interest to the analyst and investigator.

Arthur Conan Doyle gave Sherlock Holmes a number of attributes important to his task that are rarely all seen at once in analysts and investigators in real life: keen curiosity, high native intelligence, a fertile imagination, powers of perception, a superb stock of knowledge and extreme ingenuity. In Arthur Conan Doyle’s 1887 novel A Study in Scarlet, the first story to feature the character of Sherlock Holmes,²¹ Holmes explains to Watson the difference between some of these attributes:

I have already explained to you that what is out of the common is usually a guide rather than a hindrance. In solving a problem of this sort, the grand thing is to be able to reason backwards. That is a very useful accomplishment, and a very easy one, but people do not practice it much. In the every-day affairs of life it is more useful to reason forwards, and so the other becomes to be neglected. There are fifty who can reason synthetically for one who can reason analytically.

In The Five Orange Pips, Arthur Conan Doyle has Holmes explain to Dr. Watson the importance of understanding how chains of events can be studied and reasoned about. He says:

The ideal reasoner would, when he has once been shown a single fact in all its bearings, deduce from it not only all the chain of events which led up to it, but also all the results which would follow from it.

There are no formal rules in existence for reasoning and, if they did exist, they would represent a logic of discovery. Schum (1994, p. 479) believes that this illustrates what he calls bottom up and top down reasoning.²² These are useful metaphors because they can aid investigators and analysts in understanding the frame of thinking in which they are operating.

FLINTS goes some of the way towards helping analysts and investigators develop their curiosity; because they are provided with high-quality data, and the system operates on the basis of questions, the user’s imagination and perception of events, people, locations and times are important. This mass of knowledge and data is stocked, awaiting enquiry by users. Although FLINTS can never replace human powers of reasoning, it does provide a foundation and system from which users can access evidence, analyse it, synthesise questions and hypotheses, and visualise results in ways that are easily understood. In addition, the system then allows the results of those queries to be entered into the system as new inputs in the form of new questions in a circular and almost endless quest for new knowledge. The analyst and investigator can access substance-blind evidence about series of crimes, series and networks of active criminals, crime patterns, and areas where the frequency of crime is high. It can also identify travelling criminals. The system concentrates the mind of the user on using the weight of the evidence to link nodes rather than on the type of evidence involved.

Although by 2001 the Home Office was considering the potential of FLINTS and the approach underpinning the software to enhance the use and management of forensic evidence and intelligence nationally), a report from that year acknowledged that much more could be done to train users to get the best from the system.²³

The FLINTS system has the potential to support substantial improvements in police efficiency and effectiveness in West Midlands. However, the force is far from using the system to its full capability. This includes the as yet untapped potential for FLINTS [to be used] as a senior strategic management information tool. West Midlands should therefore refine its FLINTS Project Plan so as to maximise its beneficial impact […] This national potential includes the opportunity for forces to improve detection of crimes²⁴ committed by offenders across policing boundaries.²⁵

7.9 Expanding FLINTS to Other Police Areas

In April 2001, following a recommendation from the Regional Forensic Science Group,²⁶ FLINTS began to manage forensic matches for West Mercia, Warwickshire and Staffordshire by means of a wide-area computer network linking the forces together. FLINTS gave the forces access to all West Midlands databases dealing with crime, incident handling²⁷ and custody data via FLINTS computer terminals of the type described towards the end of this chapter. In the future, it is predicted that each of these forces will also integrate all their current non-forensic databases of police information into FLINTS so as to realise the benefits that the West Midlands region is seeing. At present, the Midland Region communicates using high-bandwidth networking technology and shares all forensic intelligence data. It is the first Region to have adopted this approach. In Fig. 7.9.1, the current FLINTS communication channels are indicated by red lines; these represent the flow of data as in the original installation of FLINTS, at the West Midlands Police. However, note that these lines do not yet make for a complex system whereby each force can communicate with any other force or combination of forces as needs arise.²⁸ The next stage was to envisage an expanded capacity whereby each force would effectively input its data into one system, communicate in complex ways and make thorough use of feedback looping (the blue lines in Fig. 7.9.1).

Fig. 7.9.1

Original (red) and envisaged (blue) communication channels

In addition to these police services, a number of others expressed an interest in inputting their forensic match data into the system so that it can be shared in exchange for the improved analytical capability they would obtain.²⁹ This will enlarge the network and database, and will extend the system’s analytical capability. The benefits of extending the system to other police forces will be the wide-scale integration of evidence managed in those force areas. As of April 2002, with the exception of the Midland Region and Hampshire, each evidence type was managed within isolated systems. The benefits of a substance-blind integration and treatment of evidence has yet to be realised in those areas. For example, police forces outside the Midland Region cannot manage matches from their diverse evidence types within one system, they cannot access management information about matches with other evidence collections and they have yet to automate the preparation of Evidence and Intelligence “action packages”. In short, Wigmorean approaches have yet to be adopted, but the tide is beginning to turn and FLINTS, with its ancestral foundations in Wigmorean analysis, is proving to be the catalyst for this change.

Access to accurate intelligence is central to being able to exercise good decision-making in policing. FLINTS provides this access through the integrated management of evidence as well as through a structured approach to the asking of questions of and about the evidence itself. Wigmore knew even in 1913, when he published his first edition of the Principles of Judicial Proof (Wigmore, 1913, 3rd edn. 1937) that the visualisation of evidence is crucial to gaining an understanding of the complex relationships and dependencies that exist in evidence. The ability to visualise links and networks is central to the ability to generate new knowledge about the evidence we possess and the hypotheses we are constructing by asking questions.

7.10 Volume Crimes and Volume Suspects: Not Single Events and Single Suspects

Police forces in the United Kingdom are based on geographical and political boundaries. Though there are benefits to the geographic organisation of the 43 police services in England and Wales, one drawback is the fragmentation of intelligence. Criminals can travel from one force area to another to commit crime, often frustrating intelligence strategies thereby. By identifying series of crimes linked on the basis of their rationale, the gathering and linking of provable evidence across wide geographical areas by means of intelligence networks enables the police service to operate in a target-rich environment and circumvent the problems brought on by geographical boundaries. Instead of second-guessing where crime is emerging, FLINTS can give up-to-date and reliable indications of areas where activity is likely to be most prolific and of those persons who are likely to be most active. FLINTS can also give its users specific as well as linked cases in which evidence exists to arrest offenders and often charge them with crimes. It can also be used to analyse, disrupt, fragment and control organised networks of criminals. FLINTS is proving to be a useful tool not only for crime detection in the Midlands but also nationally, serving as a targeting tool for the identification and disruption of criminal networks. Her Majesty’s Inspector of Constabulary reported in 2000 that nationally:

FLINTS has the capacity to link suspects with crimes that would not otherwise have been linked, for example, linking chequebook evidence from frauds with that from stolen vehicle crime […] there is real potential for this system to be developed nationwide in the future… As FLINTS is developed it should be possible to utilise it to help identify series of offences which can then help to inform the tasking process. Potentially this database provides an exciting tool for crime investigation […]

7.11 Performance Monitoring and System Identification

Identifying the outcomes of those processes by which evidence is managed and generated provides insights into new methods of generating and using evidence. As well as identifying outcomes of evidence generation processes such as fingerprint collection and DNA swabbing at scenes and classifying these outcomes by evidence type, FLINTS enables more complex configurations to be identified.

In 1999, as part of developing the treatment of evidence as a complex substance-blind commodity,³⁰ it became apparent that if DNA could be extracted from objects merely touched by humans,³¹ it could also be extracted from objects merely touched by persons committing crimes. This minute trace evidence had traditionally been thought to be beyond the ability of forensic science, but possible application areas now include crimes such as thefts of motor vehicles, deception, and fraud against elderly victims, in which offenders produce false identification papers and pose as government or public utility officials to gain access to the victim’s home³² to steal.

If DNA could be extracted from minute sources,³³ in this case faint and smudged fingerprints, it was proposed to the Forensic Science Service that in partnership with the West Midlands Police, an experiment should be run to recover minute traces by swabbing objects at crime scenes for DNA. These swabs would include DNA from objects merely touched by humans. For example, vehicle crimes would provide sources such as gear levers and steering wheels touched by the thieves. Thirty cases of burglary were targeted for the use of the Low Copy Number DNA technique and each involved elements of distraction tactics exercised against elderly victims.³⁴ National covert intelligence sources indicated³⁵ that a number of active individuals were involved. As a result of using the Low Copy Number technique, DNA profiles were recovered from objects merely touched by the offenders that had committed the crimes. These were places such as door handles, door knockers, bells and so forth. As a result, 80% of the identified suspects were matched against DNA traces and later convicted and given prison sentences.³⁶

7.12 Using FLINTS: A Tour of the System as the User Sees It

Here are three simple examples of the questions we might ask the system to deal with at the start of an exploration of the evidence. The precise nature of the question is a matter for the user to define, and will be determined by the type of problem and enquiry they face. This problem or enquiry might be very focussed and might search for particular items of information about specific people, events or locations. However, it might also be quite broad and search for strategic masses of data that could be used to formulate more focussed questions:

• 1. “Show me any links between suspect Mark Smith and any crimes.”

• 2. “Show me robbery events over three months in Wolverhampton along with any links between those events and people.”

• 3. “Show me a list of prolific offenders³⁷ and list them alphabetically.”

The first two questions allow us to simply link people with crimes on the basis of evidence that we can prove to high standards of reliability, and the latter question enables the identification of those persons who repeatedly offend. Faced with answers to questions like these, we can set about deciding the most appropriate response to take in a rational and reliable way. The options may be to arrest the suspect, use covert surveillance, investigate the crimes or the people involved in detail, or engage in ampliative discovery by asking further questions to expand our field of knowledge around the people, events, locations, times and evidence itself. Let us look at the results of the questions we have posed above by accessing the FLINTS system. The illustrations below (Figs. 7.12.1 and 7.12.2) are taken from real questions asked of the database.

Fig. 7.12.1

An example of framing a question in FLINTS

Fig. 7.12.2

A second example of framing a question in FLINTS

QUESTION 1

“Show me any links between suspect Mark Smith and any crimes.”

QUESTION 2

“Show me all the robbery events in the last three months in Wolverhampton, along with any links between those events and people.”

FLINTS has answered the question by presenting us with a modified Wigmorean chart illustrating the inferential dependencies by means of simple nodes and lines (arcs). We can see a node (“Smith”) in the centre of the chart surrounded by seven other nodes around the outside of the chart that depict links to events (crimes) and other people (suspects). The arcs depict the inferential evidence – in this case, fingerprints and DNA. The dotted line depicts a partial fingerprint match.

Two charts result from this question. In the first (Fig. 7.12.2) we see that an individual called “James” has been selected by the database as the centre of an interesting network of four robbery offences and one burglary at a factory. Furthermore, one of the links is between the node for James, currently the centre of the network, and another individual node with a target sign adjacent to it. This indicates that there is a second network of links to be investigated in addition to those in the first chart. By asking the database for further information, we see in the second chart (Fig. 7.12.3) a set of links between the James node and another node bearing the name Massey. This tells us that James and Massey are implicated in yet another robbery.

Fig. 7.12.3

Links being formed in FLINTS

The detection of volume offending is greater than expected. In another chart (Fig. 7.12.4), we can see that the node “Ford” has been identified by the system as a volume offender on the basis of forensic fingerprint evidence and DNA. He has been linked to twelve burglary offences at houses based on fingerprint evidence, to one offence of theft of a car based on fingerprint evidence, to three offences of burglary at houses based on DNA evidence, and to one offence of burglary at a dwelling house based on fingerprint and DNA evidence. If other evidence types such as footwear, tool marks, drugs, handwriting and so forth were added to the list, the volume and frequency might be even higher. Without FLINTS, it would not be possible to detect such complex linkages over time and geography by different evidence types.

Fig. 7.12.4

The network of links around Ford

The information contained in the charts presented thus far has been detailed at a micro level, with illustrations of links between certain sets of nodes. However, it is useful to be able to switch between a macro and micro view in the same way that we read a text – sometimes quickly, by scanning the text looking for key areas of interest, then slowly, reading the same text carefully, noting detailed meanings, relationships, connotations and implications. In the chart below (Fig. 7.12.5), we see a depiction of a “syllogistic tree” of all links in the database involving the node “Smith”. This chart can help the analyst and investigator to understand networks of links that we should know already exist and networks of links that may exist but that have not yet been discovered. It can act as a prompt for asking further and better questions. For example, we can now ask ourselves a question such as:

Faced with the following tree of links, and based on my knowledge of the prevalence and geography of crime elsewhere in the system [Fig. 7.12.6], what other links may exist between these nodes for which we do not yet have evidence?

Fig. 7.12.5

Confirmed and rejected links in FLINTS

Fig. 7.12.6

A regional pattern of incidents and potential links

Searching our database may begin with a simple question such as the one depicted for the node “Smith”. The scenarios around Smith and other nodes of interest may begin to develop as we begin to ask further questions and receive answers to them that we can in turn use to formulate further questions. From this process, we begin to see emerging items and combinations of evidence.

The locations of events and crimes, as well as the locations that suspects and victims habitually go to or reside at (Fig. 7.12.6) should be regarded as prime material for intelligence generation. In this chart, the yellow dots refer to scenes of crimes and the red dot refers to the location or last known residence of the suspect for those crimes. Adding the dimensions of space and time to the range of tools provided by FLINTS has enabled analysts to examine crimes from the standpoint of the geographer. Clustering events by their locations begins to give us insights into the movements and activities of suspects and thus lets us synthesise potential as well as real links, raise propositions about events that suspects may have been involved in as well as events that are still emerging, look for crimes where there are elements of outstanding forensic evidence which we may use to either implicate or eliminate our sets of currently interesting suspects, and even identify vulnerable areas where victims are at greater risk. The chart containing the map (Fig. 7.12.6) illustrates these points.

In the illustrations in Figs. 7.12.6 and 7.12.7, and 7.12.8, we can see how we can adopt macro and micro views of geography to help us gain a better understanding of the characteristics and prevalence of the events and suspects we are currently interested in, or perhaps that we should be interested in given the emergence of new and interesting networks. Here, in our quest to gain insights into the activities of a node called “Miller”, we learn that the suspect’s links to crime span almost the length of the United Kingdom, notwithstanding the fact that his residence is in Liverpool. In this case, the events are burglary offences at factory premises from Liverpool in the northwest to the Midlands and on to London in the southeast. From this we may infer that the suspect has been using either the motorway network or the rail system to travel between events and crimes. Interestingly, one of the events in the series involves the theft of a car, so we may also infer that Miller has been stealing vehicles to undertake the journeys. Our next enquiry may be about vehicles stolen at or near the crimes in and around Liverpool, the Midlands and London.

Fig. 7.12.7

A georeferenced view of forensic links to a suspect

Fig. 7.12.8

Sample performance reports that can be generated by FLINTS

One specific function the system undertakes is performance management by using various measures and indicators. In the following illustration (Fig. 7.12.8) we can see the way in which a variety of categories of data can be drawn together to allow managers to assess the relative performance of police departments. On the left-hand side can be seen a series of preformatted questions from “Unresolved Actions by OCU”³⁸ to “Crime Type Distribution by OCU”. The dates between the times of interest can be selected for the analysis and the resulting chart will reflect these dates.

The chart shown in Fig. 7.12.9 is the result of asking the system to measure and present the number of crime scenes, by operational area, in which matches³⁹ have been successfully achieved. Differences between areas can be evaluated, the way that scenes of crime examiners are used between different areas can be assessed, and the relative efficiency of staff in recovering evidence between different areas can also be assessed. If one area is achieving a high success rate, the others can examine the practices being adopted and try to emulate those achievements.

Fig. 7.12.9

A histogram of hit OCUs, by evidence type

Other questions can be formulated to identify repeat offenders, and these questions can be used for strategic analysis and offender targeting. Offender targeting can be the concentration of both overt and covert means of monitoring the activities of key suspects within a population strongly suspected of involvement in series crime. One of the benefits of this function in FLINTS is the auditing and tracking capability that results from the analysis. This can help to justify decisions to third parties in later debates. In Table 7.12.1 we can see the answer to a question (where ‘hits’ means ‘matches’):

Show me the evidential hits in FLINTS for 1.6.1999 for suspects with more than one hit.

Table 7.12.1 Answers to a question concerning evidential hits in FLINTS

In reality, the list in Table 7.12.1 would run to many pages. Lists can be prepared for different police areas and over different time spans, thereby giving different perspectives on the evidence. Note the squares filled in blue: for these squares, the crime reference numbers are the same, therefore Kelly and Jones may have committed this crime as accomplices. Fig. 7.12.10 illustrates how this correlation can be identified and brought to the attention of investigators.

Fig. 7.12.10

A conclusion generated by FLINTS that calls a key finding (correlation) to the investigator’s attention

In Table 7.12.2, we can see the result of asking the system to prepare a list of those scenes of crime that have been matched against suspects and list them by operational area. In this case, we can see a list of persons identified as being suspects for single crimes as well series-linked crimes, along with the evidence type involved for the Sutton Coldfield area. The list has been abbreviated for illustration purposes.

Table 7.12.2 A listing of suspects with more than one hit

Analysts, investigators and scene examiners can access their own reports as well as those of other areas to help formulate hypotheses about active offenders, crime types and the prevalence of particular suspects by area, crime type and density of offending.

The integrated approach to the management, analysis and synthesis of evidence now seen in the FLINTS system is enabling the police service to take a more sophisticated yet still pragmatic approach to the management and use of the evidence contained in police data systems. This approach permits analysts to solve problems that were known to exist yet that were too complex to tackle in the past.

A good example is the relationship between the incidence of crime and the illegal use of drugs, which has until now been assumed rather than proven. No reliable evidence has been produced to date to demonstrate this relationship, although intuitively many governments and police sources have claimed it to exist. Whilst there is evidence that many persons arriving in police custody are under the influence of drugs, the evidence to explain the networks of people and crimes involved has been too complex to even bring together let alone to analyse. FLINTS treats evidence and crimes in a substance-blind way. It is thus as applicable to the investigation of drug offences as it is to the investigation of burglary, rape, theft or homicide. Likewise, the evidence types it draws on are treated as “fuzzy” categories rather than “strictly deterministic” categories, and are equally applicable to DNA, fingerprints, footwear and a whole range of other forensic evidence types. Persuading the police service to treat evidence generically, in a substance-blind way, would pave the way to accessing a rich matrix of linked networks of people, events, times, locations and evidence.

A joint Government and Police Committee⁴⁰ chaired by a Minister asked early in 2001 that FLINTS be used to assist in identifying markets for the distribution of illegal drugs in the United Kingdom. Identifying those who travel across boundaries to commit a crime and who deal in drugs will aid the identification of travelling networks of criminals involved in drug trafficking or related offences. For example, at present there is no evidence available about those persons who engage in the illegal trafficking of drugs between the coastal towns of Sussex and the middle counties of England and Wales, yet there are data available that drug importation does take place on the southern coast and that the drugs arrive in the Midlands Region in smaller consignments. One way to tackle the problem of gaining a better understanding and real knowledge about this would be to apply the methods embodied in FLINTS.⁴¹

We can see how FLINTS, using a substance-blind approach to evidence, enables the system to be used for the analysis of drug networks. In this example (Fig. 7.12.11) we can see that the node “Castle” is linked to one offence of illegal possession of drugs on the basis of fingerprint evidence rather than a chemical drug analysis. Using fingerprint evidence in this way is an example of the substance-blind approach, and serves to illustrate how the use of one evidence type can inform the use of another. The fingerprint evidence involved came from the examination of paper wraps used to store the individual packs of drugs. The imaginative decision to use fingerprint analysis in this way was central to the ability to create a link to the networks.

Fig. 7.12.11

Link between one suspect and evidence

However, we should also note from the chart that another network is operating behind the one visualised here. It is depicted by the “target” appearing against the crime node on the right of the screen. The system is telling us to look further because there are additional interesting links. In Fig. 7.12.12, the result of asking the system to present us with those additional links is illustrated. What we then see is that the node “Castle” is also linked to a node called “Kosko” and another node called “Castle”. This latter node is in fact a brother of the first Castle. Probably the most interesting aspect of this analysis is not that we have fingerprint evidence presenting us with a scenario linking three formerly unknown associates but rather proving that none of the people involved in the network reside in the West Midlands Police area, where the drugs offence was committed.

Fig. 7.12.12

Additional links suggested by FLINTS

An overview of the links between these nodes quickly demonstrates the extent of the network based solely on fingerprint evidence. Chemical analysis of the drug may reveal evidence of its source and original consignment. The use of evidence about telephone traffic among Castle, Kosko and Castle may reveal evidence of linked communications before, during and immediately after the events involving the handling of illegal drugs.

Figure 7.12.13 demonstrates how complex links between different people and different crimes can be identified using different but integrated evidence types and by using FLINTS in this way. These links would take very long periods of time to identify using conventional investigations. In this illustration, Williams has been linked to two offences of burglary at factory premises, three burglary crimes at domestic dwellings, one robbery and one theft of a car. It can also be seen that Kennedy and Tennison have been linked to the node marked with a large “X”. This is, in fact, the same crime as the node marked with a “Y”. This visual approach is thus a method to indicate quickly that Williams, Kennedy and Tennison may have committed at least one crime together whilst Williams has been implicated in another six crimes. The hypothesis suggests to the analyst that all three may have been operating together. Further links can then be explored by pressing the target icons depicted next to certain nodes. These indicate further lines of immediate enquiry available to the analyst. In this way, FLINTS allows the user to “surf” the connections and links inherent in the evidence. Figure 7.12.14 shows the police intelligence picture generated by FLINTS.

Fig. 7.12.13

Identification of complex links by FLINTS

Fig. 7.12.14

The intelligence picture generated by FLINTS

7.13 The Intellectual Foundations of FLINTS

Large corporate bodies such as police forces have become far better at generating, transmitting, storing, and retrieving information than they have at making use of it to expose useful configurations and scenarios that can withstand repeated challenges and tests about the data’s credibility and legality. Storing masses of data is in itself an unproductive pursuit because this does not automatically translate into masses of knowledge. Strategies and tools are needed to help the investigator and analyst make use of the evidence known to exist in order to discover evidence that may exist but that has not yet been discovered. One useful tool that will be described in detail later in this chapter is the ability to formulate useful questions. Good questions aid in the discovery of interesting configurations of evidence and chains of inferential reasoning from which useful conclusions can be drawn. Another useful tool that I will deal with later in this chapter is the formulation of stories to act as a mechanism for providing a structure in which configurations of evidence can be presented in a useful way. No matter how far-ranging and how thorough our search for evidence is, there will always be gaps and there will always be a degree of doubt. That doubt may be small and unpersuasive, but it will always be there to some degree.

In addition, strategies and tools are needed to aid us in the identification of known or suspected gaps in our knowledge as well as areas of weakness in our chains of reasoning. Circumstances often exist in which it is useful to be able to corroborate or negate an inference that we have drawn or are preparing to draw based upon evidence we currently possess. In this regard, we may see the following simple chains of reasoning (Figs. 7.13.1 and 7.13.2) depicted with black nodes and arcs that need to be tested by the search for evidence that will either corroborate or negate the node or arc. Corroborative evidence is depicted by red nodes and arcs, an approach borrowed from Schum (1994).

Fig. 7.13.1

Simple chain of evidence generated by FLINTS

Fig. 7.13.2

Corroborated chain of evidence generated by FLINTS

A number of the problems that policing faces in terms of the analysis and synthesis of evidence involve the manner in which evidence is managed and organised. Twining, Anderson and Schum are committed to the view that how well an organisation manages its existing thoughts and evidence will ultimately influence how well the organisation is placed to generate or discover new thoughts and new evidence that will prove useful to the problems they face. The strategies an organisation adopts in evidence management play a key role in its ability to discover new evidence, new scenarios and new explanations. In addition, drawing defensible conclusions from databases will depend upon the quality of the information, its inherent credibility and the probative force it delivers. Dealing with evidence in systems for multiple-case analysis, as depicted so far, is subject to the same tests as dealing with evidence handled in single cases in a traditional way. Successful investigation and discovery depends not only upon strategies and methods designed to marshal our information in ways useful and meaningful to solving our problems (as stated here), but also upon the ability of the user of the evidence to keep in mind and continually test for the evidence’s credibility, relevance and reliability. Inference chains are only as strong as their weakest link.

FLINTS symbolises a novel approach for marshalling evidence in pre-trial criminal investigations. The opportunity to exploit complex relationships and networks of links between people suspected of involvement in criminal activity allows the investigator at a tactical level and the police manager at a strategic level to identify threats and marshal finite resources more effectively and in direct response to identified problems. Identifying the problems we face is the first step in solving them. The deployment of resources and time is evidence-led and directed to specific needs. Events can be connected or associated by virtue of their characteristics and typology, which allow investigators to link events into chronological series. This is not simply a matter of macro-level linking of high volumes of events over extended time periods – it also enables investigators to undertake the micro-level analysis of single events in the search for evidence. An item of evidence in one case may fill a gap or even a series of gaps or part of a chronology in another case.

7.14 What Is It About FLINTS That Makes It Different?

FLINTS uses a modified form of Wigmore’s method for the analysis and synthesis of evidence in pre-trial investigations. The aim of the FLINTS approach and software is to introduce and develop a systematic method for the management of facts founded upon the rational traditions of Francis Bacon, John Locke, John Stuart Mill and Stanley Jevons.

A frequent observation by practitioners using FLINTS for the first time is that it makes great use of “hard” evidence as opposed to the traditional approach in intelligence work, which relies more on the use of “soft” evidence. Though this description is useful, it can be misleading and problematic. The FLINTS approach and software was designed to make a distinction between tangible evidence such as fingerprints, blood samples, DNA profiles, footprints, drugs, firearms, and so on, and testimonial evidence from human witnesses. Examples here would be witnesses observing events and intelligence reports from informant agents.

This distinction is an important feature of the FLINTS approach. It draws on the differences between the attributes of the credibility of tangible evidence that differ from the attributes of the credibility of testimonial evidence in a number of ways important to this thesis. In the case of tangible evidence, we can draw on its authenticity and chain of custody as well as on the accuracy and reliability of the collection and sensing devices we use. Examples here might be DNA swabbing kits, electronic sensors, cameras, electrostatic lifting devices and sound recordings. In addition, we have the competence of those persons who operate and interpret these devices to draw upon. For testimonial assertions, we have to keep in mind the difficulties that surround the veracity, objectivity and observational sensitivity of human sources of evidence. Although this distinction is important, it does not mean that one form of evidence is naturally superior to another.

In its present form, FLINTS overcomes many of the investigative difficulties associated with attempts to link together different criminal activities, different people and different sources of evidence. One way of describing the utility of FLINTS is to say that it provides an elegant means for forming audit trails of related criminal activities.

7.15 A Case Study in Linked Burglary

One cannot overstress the importance of developing the capacity to ask good questions and how this differs from a protocol for asking good questions. Checklists for questions in the form of a protocol provide a good method of checking that certain things have been done, but investigators and analysts cannot operate effectively without basic training in good thinking. Evidence arrives in our hands from diverse sources, in diverse conditions and with varying levels of reliability. A modernised neo-Wigmorean approach has been incorporated in the form of computer software called FLINTS. Now let us explore a real-world scenario and the investigation of a series of burglary crimes using the methodology and software developed in this thesis.

This example is a real case of burglary, but with some fictional and additional hypotheses and evidential scenarios used to illustrate the potential of the methodology and of the use of FLINTS. The burglary scene depicted in the photograph (Fig. 7.15.1) presents many opportunities to recover physical, forensic and trace evidence. The scene examination reveals that the door is open, having previously been left locked and secured by the victim earlier that day. There is also clear physical evidence of damage on the inside of the door, where some kind of tool appears to have been used. The lock has been forced open, which would allow an intruder to exit the premises. This evidence raises a hypothesis that the door could have been used as a point of exit and is therefore an ideal location for seeking contact trace material, but the question arises early on as to where the alleged offender entered the premises.

Fig. 7.15.1

Annotated photograph of a burglary scene

This question is central to our ability to detect the crime, because when people enter and leave premises, especially by the use of force, they may leave contact trace material behind as a result of their physical contact and proximity with objects that make up the fabric of the building. Windows, doors, furniture and objects that the intruder has touched provide excellent opportunities to recover evidence. Opportunities are presented to target searches for contact trace material that could provide evidence of the identity of the intruder, the clothes they were wearing and the kind of contact they had with the premises.

In the real case (the subject of the photograph), a search of the premises and grounds was made and the lower ground-floor casement window in the foreground of the photograph was found open and damaged. This raised a hypothesis that entry was gained by means of the open casement window. The hypothesis was supported by evidence that the owner of the property had left the premises locked and secured when she left for work earlier that day. There was no damage to the window locks when she had left home earlier that day and her jewellery and cash was now missing from a bedroom. Damage had been caused to furniture inside and a message in lipstick had been left on the dresser mirror that read “It is not over yet – we’ll be back.” Footwear marks were apparent in the soil below the window. On the kitchen work surface near the window that was believed to be the point of entry, there was a small smudge of red fluid that appeared to be blood. The fluid was located on the glass close to the forced lock. Another red fluid that may be blood was apparent on the kitchen work surface. A red fibre was snagged on the window ledge alongside some scuff marks, and was thought by the Scene of Crime Examiner to have been made by gravel embedded in the sole of a shoe when the intruder(s) entered.

Initially, the geography and extent of the scene of crime were thought to be the boundary of the premises. However, there was circumstantial evidence that the intruder(s) must have left the garden area by some means. On the pathway in the garden, a metal pole was found that the victim said was foreign to the scene. A hypothesis was raised that this might have been delivered into the scene by the intruder(s) as a tool to assist their entry into the building; as a result, the pole was recovered for examination at a laboratory.

The intruder(s) were not within the boundary of the property at the time the search was undertaken, and the gate remained locked and secure. It was hypothesised that they left by climbing the fence. A damaged shrub pointed out by the victim revealed a damaged fence panel. Directly above the panel, a fibre was found snagged on the top of the fence, but this time it was blue in colour. This gave rise to a series of new hypotheses: were there one, two or more offenders? If a single offender, were they wearing a red and a blue garment? Where did they go after climbing the fence?

Our observations of the scene should not be restricted to the house and garden. We can infer from the evidence available that the intruders probably left by climbing the fence. The scene now needs to be extended to encompass further pathways outside the perimeter of the garden. A “scene” can incorporate any place, any person or any “thing” that has been party to the events prior to, at the time of and even after the event under investigation.⁴² The combination of events and times serves a number of purposes. One of them is the construction of stories to help us glue together the events we know about in a meaningful way that helps us to explain the events we do not know about but need to understand. The construction of stories such as these helps us to search for evidence to either confirm or negate the evidence we will produce to fill in our knowledge gaps. In addition to helping us tell stories and discover new evidence, the stories provide an ideal form of classifying our search for and interpretation of evidence. Figure 7.15.2 shows a Chronological sequence of events.

Fig. 7.15.2

A chronological sequence of events

A whole series of events can go into making up a “scene”. People suspected of involvement in the crime can and should be treated as potential crime scenes in themselves, especially if they’re a suspect or a victim, because they may have played star roles as “actors” in the theatre of the crime. Victims in particular can provide good evidence from their direct knowledge for two reasons: First, they have knowledge of events either before the crime was committed, at the time the crime was committed, or some time after the crime was committed. Second, they often have domain knowledge of the place, the time, the prevailing circumstances and even the people who may have been involved and those who may not have been involved. Victims often have a stock of ancillary knowledge useful to the provision of contextual evidence about the commission of the crime. Sometimes this knowledge will be small, but often it will be more extensive than one might expect.

In the case we are investigating in the present example, the victim provided important evidence about the condition of the premises before the crime was committed, and about how an intrusion and entry had changed the physical condition of the building. She had also pointed out that the metal pole was foreign to the premises and thought to have possibly been used as a tool to effect entry and discarded when the intruders left. It is crucial that investigators and Scene of Crime Examiners fully understand that the relevance, credibility and weight of any physical, forensic and contact trace material will be directly conditioned by this type of evidence from a victim or a witness. If a suspect is arrested as a result of fingerprints being identified on the tool, that suspect might find it difficult to persuade us that the tool did not belong to them but rather belonged to the owner of the premises or the victim.

It was decided that residents in houses opposite the “scene” may have witnessed activity before, during or after the crime was committed. Perhaps they saw strangers to the area loitering or climbing the fence, or heard the sounds of the window and door being forced. We formed a hypothesis that the offender(s) had at some point climbed the fence, and that asking questions of residents near the scene could provide additional evidence. Who could have seen the offender(s) leaving or even entering the premises?

As a result of asking residents opposite the scene about the events of that day, we discovered an elderly lady who claimed to have seen two men climbing the fence and leaving the garden during the afternoon. She had been suspicious, so had watched them run, walk, then run again along the street towards a car parked nearby. One of them was carrying a black bag and she saw one of the men drop something. When he returned to pick it up, the other man forced him to carry on and leave the object. He threw it over the fence into the garden he had climbed out of, and that object appeared to be the pole found in the garden. The witness pointed out in the garden the direction in which the “pole” had been thrown and identified the metal tool in the garden on the pathway as being similar to the object she had seen thrown.

The object was recovered for forensic analysis, with emphasis placed on DNA and fingerprints in an attempt to identify the persons in possession of it earlier that day. Evidence was sought about the credibility of the witness. She said she had never experienced serious difficulties with her sight other than short-sightedness, but felt she could be sure of what she had seen. She did wear glasses for short-sightedness and had been wearing them at the time of the incident. The investigator might have chosen to question and confirm the credibility of the witness’s evidence by asking her to repeat a car registration plate or some other unique object in the street under similar conditions to those under which the events were seen to unfold.

Control and elimination samples of DNA and of fingerprints were taken from the elderly witness and the victim to distinguish them from any foreign DNA and finger marks found on any of the exhibits recovered from the scene. During this exercise, the witness said that she had subsequently thought about the incident and now thought that she recognised the car the men had got into as one very similar to the car owned by the previous owner of the house. Also, one of the men appeared familiar in appearance, as if she had seen him before in the area. On being asked why she had not said so earlier, she replied that she had been concerned that she might have been wrong. This provides us with a good example of Schum’s equivocation testimony.⁴³

This gives rise to another hypothesis: that one of the offenders may have been the previous owner returning to the house to commit the crime. An enquiry with the victim reveals that she was involved in a dispute with the former owner about an outstanding sale of some of the contents that she had refused to pay for because they were substandard and faulty. She said that the dispute had become acrimonious, but did not believe that the former owner would burgle her home, even though she had been threatened on a previous occasion when she refused to withdraw her legal action. Instead, she had put this down to frustration about the legal action. However, as a precaution, she had reported it to her lawyer and he had written a letter to the former owner warning him about the consequences of any further actions involving threats and intimidation. This might provide important evidence about “motive”.

Enquiries revealed that the former owner of the premises had a number of convictions for burglary of dwelling houses, two of which were offences similar in nature to the present crime – lower ground-floor windows had been forced open, escape was by means of a door to the rear, and there had been episodes of climbing on both occasions. He also had other convictions for violence and damage to property.

The items of physical, forensic and contact trace material recovered included photographs of the suspected point of entry (the lower ground-floor window), the work surfaces in the kitchen (with suspected blood stains present), the footwear scuff mark to the window sill, damage inside the premises and the writing on the dresser mirror, the damage to the door suspected to be the point of exit, the garden area (including the metal pole on the pathway) and the fence suspected to have been climbed as an escape route. A photograph was also taken of the place at which the elderly witness said she saw the people climbing out of the garden. This provided evidence that she could indeed have seen what she claimed to have seen. Other items recovered included the suspected blood stains, the debris from the scuff marks, the metal tool, the fibre snagged on the window and the fibre snagged on top of the fence. A single footmark was found in the soil outside the casement window, and this was identified by the victim as a foreign mark. It was photographed and cast to reveal the size and weight of the shoe that created it to serve as evidence for comparison with any shoes later recovered from suspects. All the victim’s shoes were examined for the presence of similar patterns to those in the flower bed in an attempt to eliminate extraneous evidence and reduce the potential number of sources of the mark.

Control samples were taken from all surfaces from which items had been recovered. For example, a control sample of soil from near the footmark, a sample of debris from the path, a control sample swab from the kitchen surface and glass (where the suspected blood was recovered) and a sample of wood from the window and fence for comparison with any clothing taken from suspects.

7.16 Forensic Decision-Making

The objective of the investigation was to discover the identity of the person(s) who committed the crime as well as the identity of the people seen climbing out of the garden. This was done to try to reduce the suspect population to as small a number as possible. From the available items of evidence the following hypotheses were constructed:

• 1. The premises had been entered by force, possibly via the casement window and by use of the metal tool recovered on the garden path.

• 2. One or both of the intruders had cut themselves in forcing the casement window, had bled onto the work surface inside the premises, and had scuffed the window sill with a shoe and grit from outside.

• 3. The premises had been searched and the mirror had been written on by the intruders with a message bearing relevance to an ongoing dispute.

• 4. The intruders had left by the open but now damaged door and climbed the fence to escape.

• 5. One of the intruders had thrown the metal tool away; it landed in the garden on the path.

Of prime interest was the identity of the former owner of the premises and whether he had both a motive⁴⁴ and the opportunity to commit the crime. In addition, it was important to determine whether there was any physical, forensic or contact trace material available to connect him to the enquiry or eliminate him. He was identified by the victim and her lawyer, and from this information his convictions were found, including the fact that he was already registered in the National DNA Database following a conviction three years previously for violence. This meant that simply submitting the suspected blood from the scene to the National DNA Database for profiling and comparison would provide valuable evidence about whether he had had an opportunity to commit the crime. Also, the elimination sample of the victim, who lived alone, would also have to be submitted to ensure that the suspected blood did not originate from her, however unlikely that might seem. Also of concern was the fact that a false positive might result in linking the former owner of the premises to the crime solely because he had lived there previously.

The DNA profiling process is very sensitive, and it could potentially pick up old genetic material from when the suspect was resident there. In an attempt to clear up this point, the victim reported that she had cleaned the surfaces almost daily with a surface cleaner and that the previous owner had not been present for eighteen months.

Whilst DNA profiling was being undertaken, including a comparison of the scene stains and the control samples from the witness and victim, enquiries were conducted into the background of the former owner of the burgled premises. Intelligence was received and later confirmed that at the time when the crime had been committed, the previous owner of the premises had been in police custody and then remanded to prison to await trial for a theft that was not connected with the burglary. This effectively provided an alibi for him and challenged the basis of the enquiry. There was no reason to question the honesty and credibility of the victim and the elderly witness, so the police were left with the task of identifying (from the population) who else might have committed the crime.

It was decided not to interview the former owner in prison on the following grounds. A hypothesis was considered that although he could not have committed the crime personally, he might know who had and might have been involved as a conspirator in arranging the crime. If questioned, then, he might forewarn the intruders so they could dispose of valuable forensic and trace evidence. No evidence was available to indicate who might have committed the crime, but blood recovered from the scene might link to someone already in the DNA database.

Five days after the submission of the suspected blood to the National DNA Database, the initial results were received by the police. The suspected blood from the kitchen work surface was confirmed to be blood, and wholly different from the victim’s and witness’s control samples, but it did not match with any person in the Database, including the former owner of the premises (the prime suspect). However, the FLINTS Co-Coordinator contacted the officer and informed him that one of the blood stains, although not matched to any person in the National DNA Database, did match with seven other DNA samples submitted from seven other crimes of burglary in the last two years as well as with samples from an offence of car crime.

Whilst no person had been matched, FLINTS now gave grounds for believing that the offender was a serial burglar responsible not only for this crime but for seven others. The problem now was to identify the offender. The National DNA Database was contacted and asked to confirm the gender⁴⁵ of the donor of the scene’s blood samples and whether the two stains emanated from different donors. The Database confirmed that the donors were both male and were different people.

FLINTS was consulted in an effort to assist in identifying potential suspects for the series of nine crimes (eight burglary crimes and a car crime). In the mind of the investigator, the previous owner still had reason to be involved in the main burglary, so it was decided to begin the enquiry by identifying his network of associates. The investigator asked the system to follow five lines of enquiry and constructed the following questions:

• 1. Show me the links between the former suspect and any other known criminals in the system: what is the extent of his criminal network and who is in it?

• 2. Show me the geography of the nine crimes: where were they committed?

• 3. Show me a time line of the crimes: what is their chronology?

• 4. Show me all the burglary crimes committed in the area of the main crime: is any physical, forensic and contact trace evidence available in any of them?

• 5. Show me the current keeper of the car formerly owned by the former suspect: who has it now?

• 6. Show me the most prolific offender for burglary [in cases bearing the following features] in the area of… and over the time period of…

The answers to the questions provided the investigator with new evidence and emergent lines of enquiry. In answer to Question 1, it was revealed that the former suspect had a primary network of ten links to other criminals, all of whom he had been arrested with on previous occasions. In answer to Question 2, FLINTS told the investigator that the nine crimes fell within a radius of a spate of burglary crimes extending to 35 offences, all of which bore distinctive signatures in terms of the modus operandi. The answer to Question 3 was that all 35 offences had a regular pattern in that each was committed between 3.15 and 5 pm on a Tuesday or Thursday afternoon. The answer to Question 4 was that eleven of the crimes had various items of outstanding physical, forensic and trace evidence that could be submitted for analysis and comparison with reference databases of people. Blood and finger marks were also available.

The answer to Question 5 gave the hoped-for breakthrough: the car was now registered to one of the associates in the primary network of the former suspect. He had incurred a Fixed Penalty Ticket for a parking violation on the day the main crime had been committed, and only three streets away near a shopping precinct. The payment of the Fixed Penalty Ticket had been made in the name of the current keeper of the car and via a bank account in the shopping precinct three streets away from the scene of the burglary. His DNA profile was not present in the National DNA Database. Two days before the burglary crime being investigated, he had visited the former suspect in prison.

Tangible grounds now existed to formulate a hypothesis that the current keeper of the car had committed the crime. This conclusion was reached on the basis of his former convictions for burglary in houses, his presence in the vicinity at the time the crime had been committed, the fact that he was the keeper of the vehicle seen by the witness in the same street the crime had been committed, and that he had no legitimate reasons for being inside the premises. The vehicle was now parked regularly outside his home address and used by him in the area. The decision was made to arrest the suspect (the current keeper of the car) in an attempt to recover evidence that would either eliminate or incriminate him. On arrest, his wardrobe was searched and a pair of blue denim trousers was found. These were bloodstained (Fig. 7.16.1); moreover, he had a cut to his right hand, and a red jumper was found along with a pair of shoes similar in pattern to that in the foot mark found in the soil outside the window.

Fig. 7.16.1

Bloodstained denim trousers. Are these consistent with having bled after climbing through a casement window?

At interview, he denied being involved in any burglary crimes at any time other than those of the crimes for which he had been convicted. He agreed to supply a DNA sample in the form of a mouth swab to eliminate him from the enquiry. The DNA process would take five days, so it was important whilst he was in custody to use other evidence available to either eliminate him or implicate him.

The blue denim jeans were sent to the laboratory, and under microscopic analysis the fibres appeared similar to the fibre recovered from the fence, but because denim is a common fabric in clothing, a definitive conclusion of identity would be unlikely. The red fibre also resembled that recovered from the scene, but was a rare fibre and thus more discriminating than the denim. However, one pair of shoes was examined by a forensic scientist and compared with the shoe mark recovered from the soil bed (Fig. 7.16.2). The scientist reported that it was very similar (a close match), that there appeared to be blood on the shoes and that there were traces of debris in the sole. The scientist made a detailed examination and produced a statement identifying points of similarity in the pattern and distinguishing damaged sections that she said made the shoes unique.

Fig. 7.16.2

Footwear mark in blood suitable for DNA swabbing and profiling

Figure 7.16.2 shows footwear mark in blood, suitable for DNA swabbing and profiling. This may reveal the identity of a victim or the attacker who bled during the crime. The question arises whether the shoe was placed into the blood already present or blood was delivered to the floor from traces already on the shoe. Figure 7.16.3 shows the footwear used as evidence.

Fig. 7.16.3

Footwear used as evidence

Those same damage marks on the sole were present in the soil cast taken at the scene. The suspect was later charged with the burglary on the basis of his presence in the area at the time the crime was committed as well as the fact that his shoes matched the foot mark outside the casement window at the point of entry. He continued to deny involvement, although he admitted that he had knowledge of the dispute between his associate (as former owner of the property) and the victim. Faced with this evidence, he still declined to state who he had been with the day the crime had been committed and had no alibi evidence to offer.

His car was examined by a Scene of Crime Examiner, who revealed a number of finger marks in the front passenger area. These were sent for fingerprint examination with a suggestion that they be searched against the marks of the ten associates identified by FLINTS. One set of marks was identified as those of a third male. These in turn matched some outstanding finger marks at one of the linked burglary crimes. The third man was also arrested, and admitted his involvement in the original crime, saying that he had been recruited to settle a dispute between the former owner and the current owner of the premises.

Five days later, the National DNA Database reported that the DNA taken from the first man arrested and in custody matched that in all nine linked burglary crimes, including (based on the blood found on the kitchen work surface) the main crime and an additional theft of a motor vehicle. Furthermore, FLINTS now reported an additional link by means of fingerprint and handwriting evidence to a deception practised in a department store, where a cheque from a stolen book of 25 cheques had been used and presented fraudulently. The cheque book had been stolen during a car theft. The damage to the door in the main crime that was believed to have been the point of exit matched the edge of the metal pipe recovered from the garden path (Fig. 7.16.4).

Fig. 7.16.4

Tool mark from the point of entry at the burglary scene. Microscopic comparison used to compare the tool mark in the paint with the tool recovered from the garden at the scene

The chart shown in Fig. 7.16.5 illustrates the crimes linked by forensic evidence to the suspect. The burglary and theft of the motor vehicle are linked by DNA evidence and the deception is linked by handwriting and fingerprint evidence. This chart demonstrates the links to those crimes that were the subject of a forensic link as well as links to an additional 35 potential offences of burglary that may have been linked to the suspect, depending upon the available evidence. Each of these crimes may have outstanding forensic material available for comparison with reference evidence against the main suspect as well as his associates. These could be DNA, fingerprints, footwear, tool marks, firearms, handwriting, drugs, or, indeed, any forensic or physical contact trace material.

Fig. 7.16.5

Chart of links for the linked crimes and offender. This graph shows the topology of what can be interpreted as a Bayesian belief network

Analysis of the damage to the casement window and the door used to escape the premises revealed that the damage matched with the tip of the metal tool recovered from the path. A similar length of pipe was found in the boot of the car belonging to the suspect, and a comparison of the cut end sections of the two pieces revealed that they had once been a single pipe.

7.17 Second-Generation FLINTS

The discussion so far has centred on the conceptual ideas underpinning FLINTS and the prototype version built to prove those concepts in practice. The remainder of the chapter will be devoted to developments since testing of the prototype and a description of the newer version, now called FLINTS 2.

FLINTS 2 utilised the conceptual foundations of FLINTS 1, namely the systematic integration, analysis and use of information to inform the investigation and intelligence process. FLINTS 2 is an enhanced version of FLINTS 1 that allows access to information from a wider range of sources and allows this information to be manipulated in different ways. For example, new data sources include tables of information about arrested persons, about persons stopped and searched, and about vehicles. The new version also allows access to Command and Control⁴⁶ logs, and this enables information about incidents and crimes to be directly viewed and read on the screen.

FLINTS 2 was also built to incorporate advanced mapping software so that geographical analysis could be undertaken at a more atomistic level. Geographical analysis provides useful insights into the way in which information about events, people and time can be marshalled.

Two specific features of FLINTS 1 were enhanced because they have great potential for the future. The first, a “prolific (volume) offender search”, offers the ability to analyse the activity of persistent offenders. The second, a crime “hot spot search”, allows us to monitor the frequency with which crime occurs in different geographic areas. These functions allow the investigator or analyst to generate hypotheses about who in the known criminal population may be offending repeatedly and about the locations where crime seems to happen most. By combining these functions, the investigator or analyst can contemplate both detection and prevention strategies. Interventions can then be targeted more acutely and the results measured over time.

Two new search and analysis functions were added. The first allows a search to be made for addresses of interest, and the second allows searches to be conducted for vehicle license numbers and partial numbers. These searches can be used to answer obvious questions about people, addresses and vehicles, but they can also be used to answer less-obvious questions. For example, if we want to know the name of a man but all we have is a partial registration number of what is believed to be his brother’s car, we can set about identifying the car, then the owner, then the owner’s family members. We could use the address search to provide lines of enquiry to establish which family members live where and whether any of those addresses are of interest to us. Using these search functions together or in chains of questions, we are able to navigate around the data warehouse in search of information to substantiate or negate hypotheses or to open up and test new hypotheses. It is the interplay of good questions and thoughtful analysis that allows the system to be used to best effect.

Figure 7.17.1 is an illustration of the main functions of FLINTS 2. The key list in Table 7.17.1 identifies the functions which in Fig. 7.17.1 correspond to numbers. Another new feature is the ability to use electronic mail (e-mail) to communicate intelligence findings to other personnel. Actioning forensic matches between people and crimes can be done instantaneously, thereby informing staff of a developing hot spot or the identify of a prolific offender in real time. Just as importantly, the results of this communication can be received in real time.

Fig. 7.17.1

The main functions offered by the FLINTS 2 toolbar

Table 7.17.1 Key list for Fig. 7.17.1

FLINTS 2 is a “tailor made” system designed to support the West Midlands Police in undertaking their investigations and intelligence work. It is built on the same conceptual foundations as FLINTS 1, but uses wider sources of information. Links between people, crimes, locations and times are primarily based on forensic evidence, but incorporated into FLINTS 2 is the ability to use “accepted fact”. Here, the term “accepted fact” refers to information that is collected in the course of routine work and that would not normally be challenged. For example, the following are examples of accepted facts: that Frederick James owns a Ford Fiesta with license number X123 GHF, and that Hugh Flannery was arrested with Frederick Prosser on 15 November 1999. Another accepted fact might be the details about a “stop and search” conducted by a police officer under the Police and Criminal Evidence Act. The fact that these events happened at a particular place, at a particular time, and involved particular people is not normally challenged. These sorts of facts therefore provide important links in chains of reasoning and seemed ideal for inclusion in the system. Introducing the term “accepted fact”, which has been borrowed from the terminology of law, into intelligence work is an important step forward for law enforcement. It allows us to explain to intelligence personnel that the collection, analysis and use of everyday information can be extremely effective if the information is systemised and managed carefully; this is especially true where there is a mixed mass of information. However, the terminology also allows us to but remind personnel that information of any kind is always subject to tests of credibility, relevancy and probative force.

7.18 Access to the System: Searching or Surfing?

The traditional approach taken by intelligence organisations in Europe and North America has been based on a policy of a “need to know”. This means that only those persons who “need to know” are allowed access to intelligence information. This has been an openly accepted policy, but one might ask “how do you know if you need to know before you have access to the information?” Evidence is only as good as the uses found for it, so giving wider and more open information access to staff offers a greater potential for the evidence contained in a database to be put to good use. That is, staff accessing the system will potentially discover new scenarios and combinations of evidence that in turn can be fed back into the system as new inputs. Wide-ranging and open access offers high-quality feedback benefits, but has to be balanced against the risks of misuse.

FLINTS may thus create a measure of tension because the very opportunity and ability to access the complexity inherent in combinations of evidence will nearly always justify the user in claiming that they have a “need to know”. The nature of the policy currently operating in the West Midlands Region is currently classified as “sensitive”, so it is not possible to publish it in this thesis. However, what can be said is that success was gained by applying for a policy of very wide-ranging access for users in order to ensure sufficient access to the complexity of linkages in the system. FLINTS now presents so many opportunities for linking that it is feasible to literally “surf” the system to discover links between crimes and suspects based on evidence that can be immediately acted upon. This is compatible with what Peirce ([1901] 1955, pp. 150–155) termed abductive reasoning and equates to acting on the basis of hypotheses that are mere hunches or insights, then recognising evidential opportunities presented as tests of their justification. The ability to formulate and ask questions speedily, then bring together the answers equally speedily while bearing in mind both what we have learnt and what we may want to learn if the opportunity presents itself is an example of Peirce’s reasoning. The process is similar to the asking of questions followed by seeking evidence to either refute or confirm the hypothesis embedded in the questions.

Sir Edward Crew, the Chief Constable of the West Midlands region, commented about FLINTS that “the system is beginning to produce so many cases that a wholesale re-evaluation needs to be taken about deployment of staff across the West Midlands. In some areas so many evidence leads and cases are being produced that there are insufficient staff in current structures to manage the arrests.”⁴⁷

Inappropriate access could present opportunities for corrupt practices and illegitimate use of the evidence. This problem has to be balanced against the need for wide-ranging and (as far as possible) open access to the system by investigators and analysts. The philosophy of this thesis and the design of the access system is therefore intended to support broad access but with security levels and passwords incorporated to prevent misuse.

Access to the FLINTS system cannot be gained until the user completes a log-in procedure, as shown in Fig. 7.18.1. Having negotiated the log-in procedure, users enter the system and gain access by negotiating a unique (individualised) password screen (Fig. 7.18.2). Passwords can be changed at regular intervals by the user or by system administrators to protect against security breaches. All changes are logged and tracked by means of audit trails. The toolbar at the top left corner of Fig. 7.18.2 is used to navigate through the system and to select the relevant options.

Fig. 7.18.1

Logging into the FLINTS system

Fig. 7.18.2

The Toolbar in FLINTS 2

Once the user has negotiated the password and security system, they see the basic operating desktop (Fig. 7.18.3). This desktop gives the user the tools to undertake searches, analyse results and navigate the system.

Fig. 7.18.3

The FLINTS 2 desktop environment

7.19 Asking Questions About People and Suspects

Figure 7.19.1 illustrates the results of entering a suspect’s name (here, “Tyler”) into the system. Tyler may be of interest as part of an enquiry or in response to a request for intelligence information as part of someone else’s enquiry.

Fig. 7.19.1

The results of searching on a suspect name

In terms of suspects, any single field or combination of fields can be used to construct a search. Searches can be made by reference to surname, forenames, date of birth, criminal record number and DNA sample reference number. Names or identifying features (in any of the fields) can be selected and analysed further as the user’s interest is raised.

7.20 Asking Questions About Crimes and Events

Crime types are coded into the system for ease of retrieval. Figure 7.20.1 illustrates the result of a search for burglary dwelling crimes. (These are coded as crime type BDW.) Once found, crimes on the list can be selected, viewed, cross-referenced and searched again to provide more details about each crime as progress is made. This search could result from trying to locate a crime of particular interest based on its modus operandi or other discriminating features.

Fig. 7.20.1

The results for searching by code (here, for Burglary Dwelling Crimes)

Searches can also be done by geographic police area, such as a town, village, city or the whole of a police area. Geographic criteria entered into a search can change the results enormously. Figure 7.20.2 illustrates a search of a police area called 20L2.⁴⁸ Again, crimes can be selected and analysed further as the user’s interest is raised.

Fig. 7.20.2

The results of searching based on a police area

In terms of crimes, any single field or combination of fields can be used to construct a search. Searches can be made by reference to crime reference numbers, crime types, geographic locations and even laboratory references for forensic samples.

7.21 Displaying Modified Wigmorean Charts: Graphical Results in FLINTS

One of the most powerful intellectual tools that FLINTS 1 possessed was the ability to visually display links within the evidence stored in the system. This feature has been retained and enhanced in FLINTS 2. Having obtained a list of search results, the user can select the required entry, and the links within the evidence in the system will be illustrated. Figure 7.21.1 demonstrates this feature.

Fig. 7.21.1

Graphical display of the results of a search

Prior to FLINTS, the task of bringing together the evidence to construct such a chart would have been very time-consuming. It would involve accessing many systems, as well as the arduous task of drawing a chart encompassing all the nodes and all the arcs. Apart from being time-consuming, the many actions required of the user to obtain the information and then construct the chart would involve the risk of error. The automated system in FLINTS 1 and 2 speeds this process up and reduces the risk of error. In addition, the process can be repeated time and time again as new and interesting scenarios or links are discovered. This means that immense amounts of information can be marshalled and tested in different ways as the process of discovery unfolds. Users can combine different strategies and different functions⁴⁹ to analyse, synthesise and hypothesise about relationships, links and networks of people and crimes of interest to the investigator’s particular tasks. This process is unique to FLINTS 1 and 2.

Figure 7.21.1 provides an example of a search of the system and a graphical display of the result. Let us imagine that we have decided that a suspect called “Tyler” is of interest to us. In the top portion of the chart, we can see links between Tyler and his former associates. These are people he has previously been arrested with or prosecuted with as a co-accused person. In the lower portion of the screen, we can see links to crimes based on inferences from forensic evidence. These present us with hypotheses about opportunity and will need to be tested alongside additional evidence. The different coloured lines refer to different evidence types or links.

I would like to stress my claim that the ability to manage, juxtapose and ask questions of evidence in a variety of ways provides valuable insights into interesting scenarios and possibilities. In Fig. 7.21.1, each forensic link is colour-coded and can be identified by placing the cursor on top of a line linking two objects or nodes together. Further information about each crime scene or person may be obtained by placing the cursor on top of the relevant icon. Additional information will appear that can then be presented in another graphical view.

On the left side of Fig. 7.21.1, the user can make use of a series of functions on a toolbar. This has been designed to display the evidence in a number of ways and to reveal interesting combinations of the evidence. Figure 7.21.2 is an expanded illustration of the toolbar itself. A key list is provided in Table 7.21.1.

Fig. 7.21.2

Enlarged view of the results toolbar of FLINTS 2

Table 7.21.1 A key list for Fig. 7.36

The presence of evidence is not always the same as evidence of the validity of the inference one can draw from it. Checking evidence for authenticity is as important in FLINTS as it is in the management of evidence in single cases. Figure 7.21.3 is an illustration of the warning system that instructs the user to check the validity of the evidence before acting upon it.

Fig. 7.21.3

A sample warning to confirm the validity of links

This approach helps to eliminate errors in recording and in evidence interpretation, as well as false positives. Imagine the presence of a DNA match demonstrated visually to an investigator on a chart. Before the investigator decides to take action, they are prompted to check on the validity of the match by checking secondary systems such as the National DNA Database or the Custody Records System in an attempt to uncover corroborative evidence.

As in Fig. 7.21.4, any available photographs of a suspect who appears in the chart can be viewed instantaneously. If there are a number of photographs available, they can be viewed chronologically. This has many uses, but one important one is the identification of unknown suspects.

Fig. 7.21.4

FLINTS provides immediate access to photographs of suspects in its database

7.22 Geographical Analysis

Figure 7.22.1 provides an enlarged view of the toolbar icons in Fig. 7.21.2, plus explanations of the features. Figure 7.22.2 provides an example of the map that can be generated by clicking the second map icon in Fig. 7.22.1.

Fig. 7.22.1

Icons for geographic analysis. (1) Icon for selecting geographic overview. (2) Icon for selecting a subset Area. (3) Icon for displaying the results for a selected view

• (1) This icon can be selected to view a network of suspects geographically. In addition, links between suspects and crimes across England and Wales can be identified. The links are then presented in the graphics screen.

• (2) This icon can be selected to view the West Midlands Region and surrounding areas.

• (3) This icon can be selected to view the graphics screen.

Figure 7.22.2 is a map of the West Midlands Region and surrounding county police forces of Staffordshire, West Mercia and Warwickshire. Crimes committed by a network of linked offenders are plotted on the map to give an impression of the distribution of the crimes. This display can give analysts insights into the places where suspects and their associates habitually offend, and compare these locations with each person’s place of residence. This chart could then be compared with and indeed overlaid by another chart dealing with undetected crimes. There may be some correlation between those crimes known to have been committed by the identified network of persons and those crimes as yet undetected.

Fig. 7.22.2

Map of locations within the West Midlands region

Figure 7.22.3 illustrates crimes that have been recorded across two police areas. This map display presents an opportunity to identify travelling criminals. Cylinders of various heights are used to give an impression of the number of crimes in each area. In this illustration, we have a hypothesis that a known offender, identified by means of DNA evidence, has been linked by forensic evidence to one crime in the West Midlands Region and another crime on the southern coast of England. Without FLINTS technology, these links could not be speedily identified during routine analytical work.

It illustrates crimes that have been recorded across two police areas.

Fig. 7.22.3

Map of the West Midlands region and of crimes within the region

7.23 Temporal Analysis

FLINTS results can also be subjected to temporal analysis using the toolbar icon in Fig. 7.23.1.

This icon can be selected to display a chronology of events, which can then be presented on the graphics screen.

Fig. 7.23.1

Icon used to select a chronological display

The use of temporal analysis in intelligence work can provide useful evidence to infer “opportunity” and assess how groups of crimes may be connected with each other. This assists in the provision of hypotheses and ranges of questions that can be explored elsewhere in the system.

Linking these types of hypotheses with those connected with “virtual offenders and suspects” provides additional insights into the identification of those in the population who ought to be considered as more likely offenders and those who perhaps should not be so considered. Reducing the certainty attached to some suspects in the database is a useful method of indicating those who should be considered for further inductive eliminative exercises.

Figure 7.23.2 illustrates a chronology of crime for the suspect Tyler identified earlier in this chapter.

Fig. 7.23.2

Example of a typical chronology of crime for a suspect

7.24 Prolific (Volume) Offenders Search

The prolific offender search function (Fig. 7.24.1) allows the user to ask the system questions designed to elicit information about persons who repeatedly commit crimes – that is, persons identified by evidence as doing so. The police, acting under Home Office instructions, classify these as “detections” and refer to them in a number of ways. Figure 7.24.2 illustrates the various ways in which these classifications are listed. These ways are called disposal types.

Fig. 7.24.1

Searching for prolific (volume) offenders

Fig. 7.24.2

Disposal Types Used by FLINTS

Prolific offenders can be identified by crime type, geography, and disposal type, as well as by reference to time. The results of searching under these criteria can be presented graphically in the form of a chart. This view has many uses in the construction and testing of hypotheses about crime and offenders.

7.25 Using Geography to Identify Prolific Offenders

In the West Midlands Region, operational areas are known as Operational Command Units (OCUs). These OCUs are listed in groups or clusters called Divisions, and coded from A to M. Any one or a number of these areas can be selected to provide the basis for a geographic query. Figure 7.25.1 illustrates this.

Fig. 7.25.1

List of available Operational Command Units (OCUs)

In addition, a single description or group of descriptions of crime can be selected to provide the offence type, as shown in Fig. 7.25.2.

Fig. 7.25.2

List of available offence types

For example, looking at Figs. 7.25.1 and 7.25.2 shows that we can select the E Division, the E2 OCU, and burglary crime during the last ninety days, by reference to where the crime was committed. This query (Fig. 7.25.3) would give us information about burglary crimes committed in E Division’s E2 OCU during the last ninety days and let us view the information graphically. We could also select any one of the crimes to view the original report on screen directly to access additional information.

Fig. 7.25.3

The query definition dialog box

Figure 7.25.3 demonstrates the way in which the user is presented with a textual version of the question. This approach reminds the analyst at regular intervals about the question they are asking.

Figure 7.25.4 shows the results of a search. This screen allows the user to select items of interest from the results of the search for further searching or viewing in the graphical viewer.

Fig. 7.25.4

The results of specifying a date range in a query

Figure 7.25.5 is an example of the type of report that can be accessed using FLINTS 2 technology. The first illustration is a report concerning a crime included in the Crimes System and the second is a report concerning a Command and Control entry.

Fig. 7.25.5

The results of a query

A map can be presented to display the relationships between crimes committed and events (indicated by black crosses) and the offender’s address (indicated as a red cross). See Fig. 7.25.6 for an example.

Fig. 7.25.6

Graphical depiction (map)

By integrating searches between functions, detailed information about individuals and crimes can be accessed speedily. This feature can again include photographic details, as shown in Fig. 7.25.7.

Fig. 7.25.7

Summary of crime results plus photograph of suspect

All the links to this individual can displayed using the graphical viewer along with information on their geography, chronology and associates.

7.26 Hot Spot Searches

As illustrated in Fig. 7.26.1, the hot spot search function allows users to identify geographic areas where the frequency of crime is high. This can be done by reference to times, locations, and crime types, and can be compared with address details for prolific offenders. This provides a powerful analytical tool for strategic analysis of crime frequencies as well as a briefing tool for patrolling officers and investigators.

Fig. 7.26.1

The FLINTS search function for identifying hot spots

Figure 7.26.2 illustrates an example of using the hot spot feature to search for incidents rather than crimes. The address, the day, the date, the time, the reference number of the incident, the type of incident and any notes made by the reporting office can be accessed remotely by the analyst.

Fig. 7.26.2

Results of a hot spot search based on incidents rather than crimes

7.27 Vehicle Searching

FLINTS also offers a powerful tool for searching for vehicles (Fig. 7.27.1). The tool offers a range of options (Fig. 7.27.2). The results of vehicle searches appear in the form of lists from which the analyst can select those vehicles that appear to be of interest (Fig. 7.27.3).

Fig. 7.27.1

The FLINTS vehicle search dialog box

Fig. 7.27.2

Options available in the FLINTS vehicle search

Fig. 7.27.3

The results of a vehicle search

7.28 Analytical Audit Trails

Using FLINTS 1 and 2 can involve navigating many inferential links between people, crimes, events, places and times. For example, a user may begin by searching for a suspect for a series of crimes but soon find themselves navigating links that change their priorities or produce unexpected opportunities to discover new issues of interest. The speed with which the system searches, retrieves information and then presents graphical charts can result in users “losing their way”. Users can navigate so many links and find so many opportunities within charts that it can be difficult to know where the evidence trail started and how they arrived at a particular conclusion.

An audit trail has been built into the system to help users manage this potential confusion. This function can be activated by the user and will record as well as present audit trails. Figure 7.28.1 is an illustration of a simple audit trail. Audit trails can become long lists of links, depending on the analysis.

Fig. 7.28.1

The hierarchy of links in a network of associates

The function serves two purposes: First, it helps the analyst to maintain a log of analytical activity that allows the user to “backtrack” through the analysis. The analysis can also be repeated by following the audit trail if the occasion arises. Second, the function can help others to check how a particular conclusion was arrived at. For ease of interpretation, the example presented here is a simple one – but is nonetheless a real audit trail from FLINTS. In Fig. 7.28.2 we can see an example of a complex network of links between 37 suspects. The suspect at the centre of the chart is called “Barker”. The chart represents a series of links beginning with Hudson, then Smythe, Arnold, Chance and finally Barker. The original search began with Hudson, but by navigating only three more steps the analysis ended with an extensive network of linked criminals and crimes.

Fig. 7.28.2

List of links and hypothesis summary

A valid question at this point might be: “What benefit has been gained by this approach?” The answer is that at each level of search, a different chart was viewed (similar to the one in Fig. 7.28.2). This approach can give many different perspectives and insights into many networks involving suspects, crimes, locations and chronologies. Each of the five suspects from Hudson to Barker was viewed as a separate step in an analytical chain of reasoning. Each suspect, from Hudson through to Barker, became a central node at each stage in the process. That is, they became a central focus of the analysis, and all links known to exist between crimes and suspects were displayed in a chart.

Those charts also appear similar to the one illustrated in Fig. 7.28.2. At each stage, therefore, the analyst can decide where the analysis will journey next, and by which route. Different routes will provide different results and different links. Many unknown features and characteristics of networks between suspects and crimes could be discovered in this manner.

Another answer to the question would be that Fig. 7.28.2 has four links between suspects and burglary crimes (indicated by arrows). The suspects linked to these crimes have been linked by means of forensic evidence and are thus liable to be arrested on suspicion of committing those crimes. The hypothesis is that they had the “opportunity” to commit those crimes. However, there are indirect links between other suspects and these crimes that may indicate different hypotheses. We could, for example, draw inferences about which suspects might be acting together in crime and which are not. These hypotheses can then be tested by performing other analytical work. This is an example of the way in which the system acts as a generator and tester of hypotheses. Some may be substantiated and some may not, but the important thing is the ability to ask the question. In this example (Fig. 7.28.2), we could formulate a hypothesis that Barker, Chance and Arnold have been acting together as burglars. There is direct evidence of a link between Chance and Arnold and one burglary. Other hypotheses of equal validity could also be formulated, but from even this brief analysis, Barker has already become a suspect of great interest to us.

There are seven links to crimes of burglary in this chart, of which three are linked directly to Barker and four are linked indirectly via another suspect. The chart presents many hypotheses for testing the possible involvement of Barker and others in crime as well as many opportunities for intelligence generation. Recording the way in which the chart was navigated might prove important to those we seek to persuade subsequently of the validity of our logic.

The potential to develop evidence marshalling can be appreciated if Fig. 7.28.2 is considered in the light of potential developments. In FLINTS 1 it was already possible to have a snapshot of all the links in FLINTS 1 at a given point in time using a set of predetermined attractors. For example, it was already possible to ask FLINTS 1 a complex question using several objects as attractors in a truncated chain.

The ability to navigate very complex layers of information and follow direct and indirect links like these using the powerful visualisation techniques demonstrated by FLINTS 1 and 2 provides great potential for the development of future systems.