"One of investigators' biggest and most frequent mistakes is not properly documenting their evidence," says Hugo A. Holland, Jr., J.D., CFE, assistant district attorney in Louisiana's First Judicial District.
Holland, who's also an ACFE faculty member, knows this first hand. With 25 years of experience fighting white-collar crime, including political corruption, he's routinely called on by the state attorney general to prosecute cases in districts throughout Louisiana.
"I often see reports in which the first time an investigator mentions a piece of evidence is when he or she discusses examining it," he explains. "Then I have to ask, ‘Where did you get that evidence, and who's done what to it?' An investigator always should document that, even when the nature of the item makes it unnecessary to trace its movement from each and every custodian to the next."
But wait — the courts don't always call for full documentation of entire chains of custody?
"That's right," Holland says. "If you can easily recognize an item and readily notice any tampering, it's generally not essential to track the chain of custody in detail before attempting to introduce the item into evidence."
For example, each Smith & Wesson Model 66 revolver, because of its serial number, is unique and quickly distinguishable from others. Regardless, it's important to document the source and any analysis of a gun. Likewise, a forged or otherwise fraudulent contract that a CFE has seized, initialed and dated is easily identifiable. For each item, Holland says, the chain of custody is less significant than the CFE's testimony that it's in the same condition now as it was when seized. Unless there's proof to the contrary, a judge would admit the gun and the contract as evidence.
Conversely, an item's unique identifying features might not be readily apparent, and substitutions or material alterations to them could escape detection during an ordinary visual inspection. Holland notes that in such instances, the investigator must establish, maintain and comprehensively document a chain of custody to facilitate admission of the item in court.
To illustrate, he describes a hypothetical situation in which a CFE's client company has been victimized by fraud and received an anonymous letter about the scheme. The CFE realizes that the envelope bears important evidence about its sender, so she brings it to a forensic lab, which is able to obtain DNA samples from the back of the stamp and the envelope's seal. The samples, taken on cotton swabs, are later matched to one from a suspect. Because simple visual scrutiny can't distinguish among such items, it's important to preserve and document the chain of custody — from its seizure, through testing, to its submission as evidence. Thus, when the CFE receives the swabs and lab report, she should seal and label them in preparation for introducing them in court.
The ACFE's new Professional Standards for Certified Fraud Examiners, which have been posted for public comment on ACFE.com and are expected to go into effect in the second half of 2012, provide important guidance on these matters. Section 3.5.1 of the standards defines the chain of custody as "… both a process and a document that memorializes who has had possession of an object and what that party has done with it." And Standard IV-B, Standards of Examination — Evidence, states in part that:
- Members shall endeavor to establish effective control and management procedures for documents.
- Members shall be cognizant of the chain of custody including origin, possession and disposition of relevant evidence and material.
- Members shall strive to preserve the integrity of relevant evidence and material.
PRESERVING EVIDENCE
Holland, on behalf of his state's attorney general, is leading a political corruption case in a district other than his own. He recently charged in that district the elected sheriff with perjury, malfeasance and abuse of office. A reliable informant had alleged to Holland that the sheriff had offered money to a vagrant to plant drugs in the car of the public defender — the sheriff's longtime foe.
"When I told the intended victim about this allegation, he was furious," Holland says. "And he revealed that one of his clients — a renovation contractor in jail awaiting trial — had said he was being forced to recondition the sheriff's home while out of jail on day-long releases arranged for that purpose."
After Holland and investigators from the district sufficiently corroborated the contractor's assertion, they prepared to prove the case in court. They gathered two forms of circumstantial evidence: photographs of the sheriff's new roof and original documentation of the dates when the deputy booked the contractor into jail and subsequently gave him day passes, allegedly to repair the sheriff's home.
With this and other convincing proof in hand, Holland is confident the prosecution will prevail. He's already gotten the photographs admitted as evidence, and at press time he was preparing to request that the judge also enter the jailhouse documents into the record.
"Because the latter are originals, chain of custody is not the main issue," Holland says. "There's no question of their being tampered with; only two people have touched them since I seized them. The important thing is to make sure they don't disappear, so I've locked them away."
DEPENDS ON WHERE YOU ARE
"In most jurisdictions, there's no need to document the chain of custody for photographs, but it is necessary to provide identifying information that authenticates them," Holland says. "Like original documents, their value as evidence primarily depends on whether they are what they purport to be."
For example, he says, in a case where a suspect used a computer to commit fraud, the most important factor governing admissibility of relevant photographs generally would be the CFE's testimony that the photos accurately depict the location of the suspect's PC and its inaccessibility to others. If the judge believes the CFE's statement, he or she will admit the photographs as evidence.
The risk that the judge will not admit photographs is likely minimal. But Holland notes that any user of Adobe Photoshop or similar commercial software can easily alter a photographic image. Such changes, while perhaps not readily noticeable, can significantly affect the image's accuracy and evidentiary value.
To guard against unauthorized manipulation, Holland recommends that when the CFE transfers a photograph from a camera to a hard drive, he or she also copy it to a CD or DVD, documenting the date and other details of this backup.
Later, if a question arises as to whether a photograph provided to the court differs in any way from the original taken by the CFE, a comparison of the two will provide the answer. Widely available tools make it easy to perform such a comparison on the basis of a numeric hash value calculated from each image's digital value.
"Every photograph's hash is its unique 'genetic fingerprint,' " Holland says. "No two are alike. An alteration might be legitimate and benign, for example, sharpening an image of a document to make it more legible. But whoever made such a legitimate alteration should reveal its date and purpose. Changes whose agent and justification are unknown would likely necessitate re-submission of the original, unaltered photograph from the CFE's archive."
Another jurisdictional disparity exists between federal courts and roughly half the states, Holland notes. The former — and jurisdictions that have adopted its position — permit the introduction of a copy of an original document if there's no reason to doubt the copy's authenticity. In other states, only original documents can be entered as evidence.
The Federal Rules of Evidence form the core of every state's chain-of-custody requirements, but differences abound, such as those cited above. Therefore, Holland advises, when a CFE expects to gather evidence for presentation in a legal proceeding, she first should review the applicable rules with counsel for her client or employer.
"In both criminal and civil proceedings, the majority of jurisdictions apply the same criteria for evaluating admissibility," Holland says. "While the burden of proof differs, the amount of it necessary for the judge to admit evidence is generally identical. The only question the judge has to answer is whether the proponent of the evidence has proven that the item is more likely than not what it purports to be."
DOCUMENTING AND CONTROLLING EVIDENCE
Holland, returning to the above hypothetical case of a computer used to commit fraud, describes how an investigator might unwittingly undermine his credibility and that of his hard-won evidence.
"Let's assume he takes 20 photographs, to which his digital camera automatically assigns sequential numbers," Holland says. "But four are fuzzy, so he deletes them — a big mistake whose significance will become apparent when he has to turn the remaining16 photographs over to opposing counsel, who doubtless will ask if he took others. The minute he admits deleting four photographs, that investigator and his evidence will lose their credibility in the eyes of the judge and jury."
To avoid this pitfall, Holland recommends the following best practices to CFEs who handle photographic evidence:
- Never delete any photographs. If you do, the record is incomplete.
- In your evidence summary, state how many photographs you took, and identify any that didn't turn out well.
- Authenticate each photograph by indicating:
- What it purports to represent.
- The date you took it.
- Where you've stored the photograph.
ROLE CALL
"Regardless of how many people had custody of an item, the attorney decides which ones will testify in support of admitting it as evidence," Holland says. "But he or she can't make an informed decision without first learning from the CFE each potential witness's name, address and involvement in the item's chain of custody."
For CFEs gathering evidence for trial, the messages are clear: Familiarize yourself with relevant provisions of the ACFE's professional standards and those of federal and your jurisdiction's rules, understand how chain-of-custody and documentation requirements relate to each type of evidentiary item in various conditions and be mindful of how your handling and reporting of evidence can make or break a case as well as your relationship with counsel and other investigators.
RESOURCES
23rd Annual ACFE Fraud Conference & Exhibition
Session 12B: "What Can a Forensic Lab Do for Your White-Collar Investigation?"
Session leader: Hugo A. Holland, Jr., J.D., CFE
Robert Tie, CFE, is a New York business writer and contributing editor of Fraud Magazine.
The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.fraud-magazine.com or www.ACFE.com. ACFE follows a policy of exclusive publication. Permission of the publisher is required before an article can be copied or reproduced. Requests for reprinting an article in any form must be emailed to FraudMagazine@ACFE.com.