The Police Chief, the Professional Voice of Law Enforcement
Advanced Search
September 2016HomeSite MapContact UsFAQsSubscribe/Renew/UpdateIACP

Current Issue
Search Archives
Web-Only Articles
About Police Chief
Law Enforcement Jobs
buyers Your Oppinion

Back to Archives | Back to December 2005 Contents 

An Analytic Approach to Investigations

By Marilyn B. Peterson, Intelligence Management Specialist, New Jersey Department of Law and Public Safety, Trenton, New Jersey

odern police work is challenging. Criminals have access to advanced technology and methodologies to make them better able to plan and commit crimes. To match the pace of criminal activity, law enforcement's investigative work has become more sophisticated and more agencies are employing analysts to help solve the puzzles of these complex investigations.

This trend began in the 1970s, when analysts were first assigned to newly developed organized crime and criminal intelligence units. In the past 35 years, the function of analysts has been extended to support investigations conducted by homicide, fraud, narcotics, vice, money laundering, and environmental crime units as well as supporting many other police activities. Analysis is now taught not only to analysts but also to investigators, law enforcement managers, and prosecuting attorneys. In fact, more investigators are taught analysis than analysts, simply because there are many more investigators. Those who have taken classes in analysis have said that they view analytic techniques as an important resource.

Approach to Investigations
Although not every agency has an intelligence unit or dedicated intelligence analysts, all agencies can benefit from an analytic approach to investigations. The investigative analytic approach encourages an investigator to work methodically and thoughtfully toward successful investigations and prosecutions.

An eight-step investigative analytic process can be used to organize investigations into criminal activity perpetrated by individuals with varied levels of sophistication. It includes the following eight steps:

1.      Employ strategic targeting
2.      Complete up-front backgrounds on targets
3.      Use investigative plans
4.      Expand the use of critical thinking
5.      Apply problem-solving methods
6.      Organize case data thoroughly
7.      Use data analysis techniques
8.      Develop an analytic case package for prosecution

Employ Strategic Targeting
Strategic targeting is choosing cases based on established criteria that allow agencies to focus efforts on the strongest possible cases that can make the greatest impact in a specific area. Rather than spreading investigative resources thinly over several cases, select the cases whose resolution will have the most effect. Targeting can be based on several factors including public expression of concerns, impact of the crime, monetary thresholds of dollars lost, data mining to predicate targets.

Public opinion will influence targeting by creating the need to address the greatest criminal concerns being expressed by community members. Targeting in response to pressure from the community or news media is reactive policing, responding to a problem or crime after it occurs. Intelligence analysis provides the benefit of being aware of the developing crime problems before they are featured in the media and formulating plans to deal with the problem before there is a public outcry. Thus, the police department can respond earlier and more effectively to prevent crimes.

Targeting can be based on the impact or the number of crimes committed, such as targeting individuals who are responsible for greatest number of narcotics sales in an area. The level of violence in criminal actions can also be a targeting criterion. Police can target the most violent criminal groups or individuals. Victimization classifications can also be used as a targeting factor; that is, police may choose to target perpetrators who prey on some of the most vulnerable citizens, such as juveniles or the elderly.

Targeting based on monetary thresholds is to prioritize cases based upon the dollar amount of the crime. That is, cases are chosen where the criminal profits are known to exceed a certain amount, say, $100,000. Monetary thresholds are commonly used by federal or state agencies that need to limit the numbers and types of cases they work.

Some agencies use combinations of these and other criteria to choose or prioritize their investigation targets. Two examples of multifaceted targeting are Sleipnir,1 the matrix developed by the Royal Canadian Mounted Police to target organized crime, and the matrix created by the California Department of Justice to evaluate extremist groups. Both of these allow the agencies to determine which of the crime groups in their jurisdiction pose the greatest threat so they can focus on them. In the case of Sleipnir, more than a dozen organized crime groups may be evaluated, while only four are chosen for focused action during that year. The groups are then reevaluated ever year.

Agencies may also use data or text mining to choose their cases. Data mining encompasses the process of discovering hidden patterns and relationships in large amounts of information. One example of this would be plumbing millions of records in a very large database (such as all insurance claims made in the state, or all information on previous narcotics seizures along the borders) to identify repeat offenders and patterns (same or similar overseas or U.S. addresses used; similar names, same country of origin, and so on). Choosing people or locations with multiple suspicious transactions can add up to larger forfeiture and restitution amounts.

Data mining is used to discover new patterns or confirm suspected patterns or trends. One of the strengths of data mining, as opposed to more traditional statistical methods, is that it is not necessary to know exactly what you are looking for before you start. Data mining uses powerful analytic tools to thoroughly explore mountains of data and pull out the valuable, usable information. The primary use of data mining is to find something new in the data, to discover a new piece of information that no one knew about before.2

Each of these forms of strategic targeting requires the investigator to have some knowledge of the potential targets and to place that information into a format that allows comparison. The data are then analyzed and synthesized to support decision makers.

Complete Up-Front Backgrounds
One way to ensure that the choice of targets is viable is to complete background investigations on every potential target. These backgrounds include checking local, county, and state police files, Regional Information Sharing System (RISS) program files, deconfliction systems (such as the U.S Drug Enforcement Administration's SPIN), and cognizant federal agency files. Important information can be found through searches of regulatory files (the Financial Crimes Enforcement Network, licensing agencies, Department of Labor, Securities Exchange Commission), judicial filings (civil suits), and property (deeds, tax assessment) and vehicle records.

Today there are even more commercial sources than ever to be tapped, such as ChoicePoint and Accurint and real estate indexes. Specialized databases can give you particular data, such as current cell phone number owners (Entersect). A simple Google search on the Internet can develop information about a person or business, including images, addresses, organizations to which they belong, phone numbers, and other personal data. These searches are computer-intensive but save countless hours of door-to-door investigation. The compiled data can establish what is known and may provide evidence of criminal activity (such as using multiple social security numbers or engaging in financial transactions beyond their means). These searches can give focus to investigative efforts through uncovering leads and provide a solid foundation for the case.

Data available from commercial databases can provide a surprising amount of detail about people that when analyzed presents a detailed profile that may be useful in varying aspects of an investigation. In addition, university libraries offer a wide array of research and resource tools that are often available at no cost. The fact that information is open source should not dissuade an investigator or analyst from using it. There is often high-quality, insightful evidence available from open sources. So much so that the 9/11 Commission, in its final report, recommended that a new open source agency be added to the U.S. intelligence structure.3

Agencies that have used the background approach include the U.S. Department of Labor's Office of Labor Racketeering and the Drug Enforcement Administration, which coined the phrase "intelligence up front" to reflect the importance of this effort. DEA provides in-depth training in its analytic classes on searching databases and varied sources of information for all-source data.

Use an Investigative Plan
Investigative plans help investigators identify and organize what is needed to complete an investigation. The plans can be simple or lengthy, depending upon the complexity of the work being undertaken. In the simplest form, the plan should include the following elements:

  • Objective of the investigation

  • Potential sources of information

  • Investigative resources needed

  • Estimated timeline for completing the work

  • Estimated likelihood of success

The objective in the investigative plan reflects the purpose of the investigation. Is prosecution the sole intention of the investigation? Is future crime prevention part of the desired outcome? Is community mobilization a factor?

Investigative plans are fluid to-do lists that change as the investigation evolves. New sources of information may be uncovered while prospective sources may prove to be dead ends.

The to-do list ensures that all conceivable sources of information are mined for the investigative information needed.

In addition, the investigative plan will reflect the depth of the investigation and the resources to be assigned. Is a search warrant or electronic intercept anticipated? Should an undercover operation be used? What analytic products need to be produced (link charts, indicator listings, flow charts, threat assessments)? The more complex the investigation, the greater the need for a plan to obtain the necessary investigative resources.

Some investigations will take longer and be more complicated than others. The time allocated may expand or shrink as other demands are placed on the investigators or new avenues are opened in the investigation. The investigative plan is useful because the planning process helps organize the resources to get the job done and estimates the amount the time it will take to accomplish the tasks.

Investigative plans are developed by analysts, investigators, and prosecutors. They are reviewed and approved by the department's management. Support from law enforcement managers often depends on the logic and workability of the plan, as well as its likelihood of success. When the plan is written, it should anticipate any pitfalls or problems that might be encountered (such as difficulties in infiltrating a group, or in obtaining records from a distant source) and how those difficulties may be overcome.

Investigative plans are particularly critical when working on a multiagency investigation where assignments cross jurisdiction lines. Having a plan that is known and agreed to by all can eliminate costly duplication of efforts and predicate the likelihood of a successful conclusion.

Expand Use of Critical Thinking
During investigations, critical thinking means taking a thorough look at what is known and determining what still needs to be known; this provides for questioning of investigative assumptions and preliminary conclusions. Critical thinking can be used at every stage of an investigation, from the receipt of the initial complaint through preparing for court. Critical thinking causes analysts to ask, "What's missing?" and then leads the work toward filling in the critical gaps in knowledge or preparatory work. It requires constant questioning of the current information and the facts of the case in a way that allows the analysts to comprehend the criminal actions and actors more accurately.

When thinking critically about what is known and what is not known, questions are generated that may help to explore what is not know. These questions can reflect a range of both knowledge and suppositions that are made. The suppositions may be based on the legal theory of the case; that is, what charges may be brought as a result of the investigation.

Some critical questions in an investigation might be standard, while others are case-specific. The following are a few of the standard questions:

  • Who had a motive to commit the crime?

  • Who had an opportunity to commit the crime?

  • What were the benefits of the crime (money, power, control)?

  • Who benefited from the crime (financially or otherwise)?

  • How was the crime committed?

  • Where was the crime committed?

  • Were weapons involved? If so, what weapons?

  • Were vehicles involved? If so, what vehicles?

  • Was the crime assisted by technology (computers, pagers, PDAs)?

  • Was the crime committed by an individual or a group?

  • Was the crime planned or opportunistic?

  • What is the modus operandi of the crime?

  • Is the modus operandi one used by known criminals?

  • Who were the victims of the crime?

  • Where did the victims and perpetrators meet?

These critical questions may result in rethinking the investigative plan if additional, specialized resources (financial or technological) are needed. Each previous step in the analytic approach to investigations includes an opportunity to use critical thinking.

Apply Problem-Solving Methods
A seemingly discrete criminal incident investigation may be just the tip of the iceberg of a much larger criminal problem. For example, one auto theft or burglary may be the beginning of a series of crimes or may be the first instance perpetrated locally by a ring that has been active in nearby jurisdictions. Likewise, a mugging may reflect an environmental condition that provides opportunity to criminals (such as a secluded alley or a walkway behind large bushes that obstruct view from the street). Changing the environment may lessen or eliminate the crime at that location.

In all cases, the context of the crime should be examined to determine if it is connected in any way to other criminal activity or a particular environment. In this way, the investigator may see the underlying problem, rather than responding solely to a symptom (the criminal incident).

For example, auto thefts in a suburban city might be found to all occur near the train station where commuters leave their cars for 10 hours a day while they are at work downtown. When the station parking lot is not controlled and lacks surveillance or patrol, car thieves have hours to ply their trade before the cars' owners return. Focusing on improving security there may significantly reduce the number of auto thefts in the community. Another way an analyst can view the crime is from the end of the supply chain; there is a wholesaler who is shipping the cars to other locations or breaking them down for parts to resell. Shutting down the shipping or resale end of the operation would also reduce car thefts, as it would leave the thieves without an outlet for their stolen property.

Crime problems come in all shapes and sizes and have a variety of solutions. Some of these solutions may involve enforcement efforts, others legislative changes, still others the involvement of community or business groups. A key to problem-solving policing is analyzing the problem from all angles and considering all options as solutions.

Thoroughly Organize Case Data
Today's investigations may be paper-intensive, or electronic file-intensive. Reviewing the material thoroughly, inventorying it, and organizing it into files with an index will allow investigators to find critical data easily. Knowing case data allows investigators to extract evidence of crimes and to acknowledge any evidence that may disprove the criminal intent. Both need to be considered when forming conclusions about the criminal acts. Another reason to inventory the data is to ensure that all requested information has been received.

Identifying the pieces of evidence that may be needed later will save hours of further review. Making copies of these documents and creating files gives investigators and prosecutors easy access to them.

Computerized databases are the simplest way to take data extracted from paper files and organized them. To organize files, agencies often use database software such as Microsoft Access or another proprietary database software. Investigative databases should be constructed so they allow for the computerization of all critical information, and they should allow users to sort the data and generate reports in formats that will be of the most assistance to the investigation.

Use Data Analysis Techniques
Data analysis tools can be complex analytic products using enhanced proprietary software developed by an analysts, or simpler analytic products prepared by nonspecialists. But the nonspecialist will need some training before using software to create the graphics, spreadsheets, or other visual representations of offenses. To illustrate this point, consider an investigation into an auto theft ring. An investigator can develop a map showing the locations of the stolen autos, along with the dates and times (the time spans) of the thefts. From this graphic a progression may be plotted that could predict the possible location of future thefts.

Likewise, criminal profits can be entered into a simple spreadsheet to show how the money was placed into a bank account and trace where it went from there. Financial information also can be translated into bar or line graphs, again using spreadsheet software. The software can also be used to create timelines, simple link (association) charts, telephone record charts, commodity flow charts, and event flow charts.

The purpose of charts and other graphics is to show complex situations simply. By viewing a graphic, investigators, attorneys, and analysts can readily understand the relationships of events, actions, and people being investigated. A chart summary, conclusions, and recommendations should accompany each graphic.

Conclusions should reflect what is known and what can be inferred from what is known. The recommendations should answer critical questions and relate to the investigative plan indicating what needs to be done for completing the investigation.

Developing an Analytic Case Package for Prosecution
Successful conclusion of the investigation is the starting point of the prosecution of the case and the manner in which the case is presented to the prosecutor communicates the thoroughness of the investigation. A well-organized case file enables the prosecutors to see the value of the case.

Investigators using analytic organization and synthesis skills can help package their cases effectively by preparing the following items:

  • A graphic that explains the case

  • A summary of the case and all the major players

  • A listing of what proofs are currently held by the agency and what further evidence is needed (if any)

  • An inventory of case documents

When organized data are presented to the prosecutor's office, accompanied by a briefing on the investigation, it becomes more likely that the case will be prosecuted. Likewise, if the prosecutor can see that the investigator has used a logical, thorough, and critical approach, the case will more likely be accepted for prosecution.

The Benefits
An analytic approach to investigations is methodical and logical, generates clear products, and provides a well-constructed package for prosecutors. It allows investigators to use the power of analysis without having the resource of analysts in their agency. Investigators who use this approach should have a higher rate of successful prosecutions. ■

The opinions expressed in this article are those of the author and may not reflect the opinions of the New Jersey Department of Law and Public Safety.

1    Sleipnir is the name of the threat criteria tool in assessing organized crime developed by the Royal Canadian Mounted Police. It is named after Odin's eight-legged horse, a symbol of knowledge and enlightenment in Norse mythology. For the RCMP, this instrument allows comparison of organized crime groups using a ranked set of attributes. Each of these attributes is defined, weighted, and assigned a set of defined values. It is considered invaluable in setting priorities related to organized crime because it can compare and rank criminal groups based on the level of threat they represent. Sleipnir has led to a radical change in how the RCMP thinks about and addresses organized crime. See a transcript of RCMP Commissioner Giuliano Zaccardelli's speech on transnational organized crime, delivered at a conference on March 20, 2002, (, October 14, 2005.
2    Colleen McCue, "Connecting the Dots: Data Mining and Predictive Analytics in Law Enforcement and Intelligence Analysis," The Police Chief 70 (October 2003): 115-122; available in the archives at (
3      David L. Carter, "Law Enforcement Intelligence: A Guide for State, Local, and Tribal Agencies" (December 2004); available at (

Crime Analysis for Problem Solvers in 60 Small Steps

The field of crime analysis itself has grown much more sophisticated. The ability to electronically capture, store, and retrieve massive amounts of data that police routinely collect is infinitely greater than it was just a decade ago. The capacity to map crime geographically is stunning, and is now a major, indispensable tool in crime analysis. Standard approaches have been developed for the collection, analysis, and dissemination of intelligence across jurisdictional lines.

In the manual “Crime Analysis for Problem Solvers in 60 Small Steps”, Ronald Clarke and John Eck set out a much more ambitious and potentially productive agenda for the analyst. They outline a role in which the crime analyst invests heavily in seeking new responses to the problems that are diagnosed and participates directly in efforts to test and implement them. The analyst is expected to contribute to exploring new, more creative, and potentially more effective ways of carrying out the police job. Through this manual, Clarke and Eck demonstrate how one analyst, properly trained and utilized, has the potential to increase many times the productivity and effectiveness of perhaps hundreds of police officers. Understood in this way, an investment in crime analysts can be a smart way to increase the return on the substantial investment that communities make in sworn police personnel.

Blending their expertise as researchers and their familiarity with policing, Clarke and Eck have collected all of the knowledge and methodology that is relevant and currently available; organized it in 60 small segments or steps that build logically upon each other; and communicated the material in a style that is both concise and engaging. The volume is packed with vital and sophisticated information that makes it one of the most significant publications addressed to the policing field in the past several decades.

The most immediate goal of the manual is to help the relatively small number of individuals now commonly employed in police agencies as crime analysts to expand their function and thereby contribute more to the effectiveness of their agency’s operations. It is intended, more ambitiously, to contribute to the training of new crime analysts or problem-solvers, to increasing their number, and to their development as a distinct and vital profession. But problem analysis is not the exclusive domain of technicians. We hope that, everyone else in a police agency, from officers on the beat to police executives, and, more broadly, those in both the public and private sector concerned about crime, will incorporate the line of thinking set forth in the manual into the perspectives they bring to their work.

Source: Herman Goldstein’s foreword to U.S. Department of Justice, Office of Community Oriented Policing Services, Center for Problem Oriented Policing, “Crime Analysis for Problem Solvers In 60 Small Steps,” by Ronald V. Clarke and John E. Eck, (2005); complete manual available at (



From The Police Chief, vol. 72, no. 12, December 2005. Copyright held by the International Association of Chiefs of Police, 515 North Washington Street, Alexandria, VA 22314 USA.

The official publication of the International Association of Chiefs of Police.
The online version of the Police Chief Magazine is possible through a grant from the IACP Foundation. To learn more about the IACP Foundation, click here.

All contents Copyright © 2003 - International Association of Chiefs of Police. All Rights Reserved.
Copyright and Trademark Notice | Member and Non-Member Supplied Information | Links Policy

44 Canal Center Plaza, Suite 200, Alexandria, VA USA 22314 phone: 703.836.6767 or 1.800.THE IACP fax: 703.836.4543

Created by Matrix Group International, Inc.®