Investigative Skills Property Management PDF

Police College INV04 INV04 Investigative Skills Property Management Introduction TASK: Refer to Classis online for Forensic Science N.I. (FSNI) Forms. FSNI Glass, FSNI 12A (alcohol/ drugs), FSNI A-E and Fingerprint envelo...

Police College INV04 INV04 Investigative Skills Property Management Introduction TASK: Refer to Classis online for Forensic Science N.I. (FSNI) Forms. FSNI Glass, FSNI 12A (alcohol/ drugs), FSNI A-E and Fingerprint envelope. Print these Forms and bring to class. Police General Responsibilities Each individual has overall responsibility for any property they seize (or receive) and for ensuring that: An accurate property record is created within NICHE. The integrity and continuity of the property is maintained. It is packaged and labelled correctly to ensure: The maintenance of integrity. The prevention of cross contamination. The prevention of loss or damage. The Health and Safety of anyone who may need to handle the item during transit and storage. It is stored securely and safely only in officially recognised storage facilities. It is retained in line with legal requirements of Article 24 of the Police and Criminal Evidence (NI) Order 1989 (PACE), the Criminal Procedures and Investigations Act 1996 (CPIA), and any relevant PSNI directives. Its continued retention is reviewed in line with procedure and it is disposed of as soon as there is no longer any requirement to retain it. This will include appropriate disposal following court proceedings. OFFICIAL [SENSITIVE] Page 35  Police College INV04 INV04 What are the legal reasons why police seize property? a. anything seized for the purposes of a criminal investigation may be retained, i. for use as evidence at a trial for an offence; or ii. for forensic examination or for investigation in connection with an offence; and b. anything may be retained in order to establish its lawful owner, where there are reasonable grounds for believing that it has been obtained in consequence of the commission of an offence. Initial Seizure - Considerations for the Investigating/Seizing Officer The offences are being investigated and amongst other things -whether the property adds to the total knowledge of how the offence was committed, who may have committed it, and why, whether the seizure of property is necessary to prove the case. What property is best to seize, to obtain the best evidence? How much property for analysis purposes, should be seized, given limitations on forensic submissions - particularly in volume crime cases. What the potential consequences will be if the property is not preserved. If material with an evidential value has been destroyed, there is a likelihood that a court may stop the prosecution for abuse of process. It is not necessary to retain every item obtained during the course of an investigation, any doubt should be resolved in favour of retention – this is not the same as ‘just in case’. Consider that, in appropriate cases, material may be photographed, video-recorded, captured digitally or otherwise retained in the form of a copy (if the original is perishable or the original was supplied to the investigator rather than generated by him and is to be returned to its owner) or the retention of a copy rather than the original is reasonable in all the circumstances, (PACE Codes of Practice B) OFFICIAL [SENSITIVE] Page 36  Police College INV04 INV04 Evidence- Related Property Procedure Legislative provision and evidential investigative requirements dictate that police officers have a responsibility to seize, record and retain material obtained in a criminal investigation which may be relevant to the investigation, (PACE and Criminal Procedures and Investigation Act 1996, CPIA). Receiving Property into Property Stores If there is a member available who has the relevant authority (such as an SEA) the property should be logged directly onto NICHE property.If there is no one available to log the items onto NICHE the seizing officer/OR should workflow property staff stating in the OEL all the identification numbers of the property for collection, their location and the ‘Officer Responsible (OR)’ – this will ensure there is some record of the property within NICHE at the earliest opportunity. Officers must not leave evidence- related property with SEAs or in a location which is not secure. Property staff will quality assure the packaging of each item against forensic evidence best practice regardless of whether being submitted to another agency/unit. This includes integrity/continuity and use of correct packaging materials to ensure health and safety and best evidence. Legislation Relevant to Retention and Review of Evidence-Related Property Article 24 of the Police and Criminal Evidence (Northern Ireland) Order 1989: Once something has been seized under Article 21 PACE, it can only be retained so long as is necessary, in accordance with Article 24 of PACE. Article 24 (1) provides a general and wide power for police to retain seized items so long as is necessary in all the circumstances. In practical terms, Article 24(2) (a)(ii) means that if forensics are completed or if there is OFFICIAL [SENSITIVE] Page 37  Police College INV04 INV04 no possibility of gathering evidence from investigating the property in some other way, or if a photocopy, photograph or video could be used for investigative purposes, then property should be returned. If there is any doubt as to whether an item will be needed for use as evidence in trial or is needed for investigative purposes, guidance should be sought from the Forensic Case Manager, an experienced investigator or PPS directing officer. Examples where doubt may arise would include, if there is a co-accused who may wish to inspect the evidence, a defence statement requiring inspection of the evidence, or if it seems that the photograph/copy/video will not sufficiently represent the evidence. In practical terms, Article 24(2) (b) means that any property which has been seized can be retained if the below two criteria are met: The lawful owner is not known or is in doubt; and There are reasonable grounds for believing that it has been obtained in consequence of the commission of an offence. Both these criteria must be met and both are bound by reasonableness. If there is no reasonable prospect of identifying the lawful owner, the property must be returned. This is a test defined in case law and it applies even when there is strong evidence that the person from whom the property was seized is not the lawful owner or they obtained the property in consequence of a criminal offence. Similarly, if a no prosecution decision has been taken, there is no reasonable ground to believe the property has been obtained in the consequence of an offence. Property Retention and Timescales All evidence-related property will be disposed of when there is no further practical or legal requirement for its retention. Evidence-related property (including that connected with a serious or organised crime offence) will be subject to property review by the OR/IO after being retained for 11 months. “The duty to retain under this code [material seized under Article 21 of the Police and OFFICIAL [SENSITIVE] Page 38  Police College INV04 INV04 Criminal Evidence (NI) Order 1989] is subject to the provisions on the retention of seized material in Article 24 of that Order”; and under Article 24(4), nothing can be retained for use at trial or investigation, where a photograph will suffice. When sending instructions/workflow ref disposal or retention of property it is not sufficient to place an entry on the OEL such as “property can be disposed”. Please ensure the relevant property store is work flowed ref disposal or items will remain against your name on Niche. CPIA Considerations – Summary of main points If there is no suspect Until all reasonable lines of enquiry have been exhausted. Review of property after one year in all volume crime cases over and above normal periodic reviews. Formalised “Review” of retained material after 30 years in all Serious and Organised crime cases where property is still retained. If a person is charged At least until conviction or acquittal or the or reported case is withdrawn by PPS. Upon conviction At least until 6 months after conviction. This is also dependent on the offence and whether or not there may be future appeals/ public enquiries. If the suspect is At least until 6 months after the sentence of imprisoned imprisonment ends. (Sentence of 6 months This is also dependant on the offence e.g. murder, sexual or more) assaults etc. and whether or not there may be future appeals/public enquiries. If there is an appeal A least until the appeal has concluded. This is also dependant on the offence e.g. murder, sexual assaults etc. and whether or not there may be future appeals/ public enquiries. If there has been, or is Until any complaint either to PONI or PSD is concluded/ likely to be, a complaint resolved. made (e.g. where PPS have made a no prosecution decision) OFFICIAL [SENSITIVE] Page 39  Police College INV04 INV04 Sudden Death Property Medication recovered from a reported death must be retained, whether as for evidence-related or safe-keeping until at least the conclusion of any inquest proceedings. Only when it is concluded that no crime is suspected should authority for disposal be sought by the officer responsible for dealing with the matter. Volume Crime Property Volume Crime (VC) items account for approximately 70% of all property seized by police in the investigation of potential offences. Present practice has resulted in too many volume crime items being seized and too few being disposed of. Service Instruction introduces a presumption to dispose of Volume Crime items one year from the date the volume crime item was entered onto NICHE where no suspect has been identified. It should be noted that: Property can be photographed and returned to the owner (or disposed of) if that is reasonable in all the circumstances. Forensic submission is expensive – the majority of volume crime exhibits will not be sent for forensic analysis. (See VC submission criteria, below). Property should only be retained until all lines of enquiry are exhausted. Lines of enquiry comprise of – named suspect, witnesses, identification evidence, forensic intelligence/evidence, identifiable property, and intelligence information, part of a hotspot or crime series. Where suspects have not been identified or where they have not subsequently been made amenable volume crime items should be disposed of. If you are unsure if the property is suitable for retention/return or disposal then please speak with your Supervisor for guidance. OFFICIAL [SENSITIVE] Page 40  Police College INV04 INV04 The Volume Crime Forensic Submission Criterion dictates how many seized items will be examined per case and must be considered by the investigating officer when deciding whether a volume crime item should be seized. Blindly seizing and retaining property are indicators of poor performance and may also be contrary to the Victims Charter and other legislation. Strong, well-informed decisions not to seize property or to dispose of it appropriately are more likely to be supported – even if the decision turns out to be wrong in the longer term. Volume Crime Forensic Submission Criteria for cases of car crime, criminal damage, theft, burglary and minor assaults. PSNI Fingerprint Bureau currently restricts the number of items, for each case, for chemical examination to three (3), e.g. three pieces of paper from a burglary. Although from the same burglary they will take all fingerprint lifts presented (fingerprints found by CSI and lifted onto card for recovery). PSNI Forensic Authorisations Unit, FAU, guidelines are that the number of DNA source items will be initially limited to one per volume crime case (e.g. 1 x cigarette butt, 1 x swabs from the neck of a bottle etc.). If the IO makes a case that more than one person was involved in the case due to CCTV or witness testimony then the Forensic Case Manager will consider allowing more than one item. The decision on which item is best should be based on recovery location (e.g. blood inside a house is evidentially more compelling than blood outside the house – although CSI should recover all available evidence or sample a suitable number to enable identification and interpretation if relevant). The number of exhibits recovered by CSI will depend on what they find. CSI will inform the IO of the results via NICHE and include their scene notes. The IO must make the decisions on what to submit based on all available information and evidence– except for fingerprint lifts where the CSI arranges submission. Advice on what should be submitted can be obtained by contacting the Service Forensic Case Manager. OFFICIAL [SENSITIVE] Page 41  Police College INV04 INV04 Taking Firearms/Explosives into Police Possession When a firearm is taken into police possession the person receiving/seizing must ensure that it is cleared/made safe by a qualified person (in appropriate cases this should be the Ammunition Technical Officer, ATO, within the PSNI any Authorised Firearms Officer. If a firearm cannot be safely declared free from ammunition then it MUST be assumed that it is loaded – apply DLF sticker to ensure it is clearly identified/tagged. A receipt (M29 or other) is to be provided to the owner in appropriate case, ensuring that it is correctly packaged when seized for evidence related purposes. Drugs Officers can only be in lawful possession of controlled drugs, as authorised by the Chief Constable under the Misuse of Drugs Act if handled in accordance with Service policies, procedures and guidelines. Therefore all seizures should be accurately entered on NICHE as soon as possible and securely stored. No drugs should be retained in the possession of officers for longer than is absolutely necessary and officers should be prepared to justify any instances where this direction is not followed. It is important to be aware of Health and Safety issues as there can be an allergic reaction to the smell or touch of certain drugs. It is therefore important that consideration is given to being suitably suited and booted in protective clothing when handling significant quantities of drugs. Gloves should be worn when handling small quantities. Storage within Districts The description of drugs on the identification label should be kept generic, such as, suspect white powder, suspect brown resinous substance or suspect green herbal material. OFFICIAL [SENSITIVE] Page 42  Police College INV04 INV04 Responsibilities of the Investigating Officer IOs must have the following information available for inputting the property on NICHE: Field Example Type of Drug Suspect white powder, etc., record on OEL what the officer suspects the drug to be, including control class, (A, B or C). Description/Format Resin/Herbal/Plants/Tablets, markings, etc. Value Not required. Statistics Branch regularly receive updated values and base the value on the information provided concerning the seizure. Weight or Quantity Record on OEL, in the manner described in previous paragraph above. Label description Verbatim of what is on the identification label, Weights should not be included on identification labels. Seized by Officer Service number. Officer Responsible Cash The approach to the storage of cash is to reduce to a minimum the amounts held physically within the property/finance system. Money should not be stored in cash format unless absolutely necessary. It is important that the Officer in Charge provides clear instructions to Finance staff whether the cash is to be held as a sealed package (Inspectors authority required), or lodged in an interest bearing account. Cash must always be stored in a safe. OFFICIAL [SENSITIVE] Page 43  Police College INV04 INV04 Seizure of Cash Cash is normally seized under PACE provisions or Proceeds of Crime Act (POCA) legislation. Where a POCA seizure is made, an application to retain the cash must be made to the local District Court where the seizure was made within 48 hours of seizure. The Magistrates court, upon application, may order further detention of this cash to permit police to investigate its derivation or intended use and, upon application, a Forfeiture Order can be granted by the court if the cash is recoverable property (obtained from unlawful conduct) or intended to be used in crime. When a cash seizure is made under POCA it is important to notify C1 Organised Crime Purple Team. This is required for PSNI to benefit from the Home Office Incentivisation Scheme, ARIS. The Purple Team or District Financial Investigator are available to provide advice on any aspects of cash seizures. If circumstances permit any cash seized after being counted/verified by two members/staff, must be logged or otherwise recorded in an officer’s notebook. This will be countersigned by the second officer/staff and the person from whom seized if possible. The money will be sealed in a tamper evident bag and signed by both persons verifying the amount. It is recognised that this may not always be possible due to a variety of factors. The Officer will need to make a judgement call as to the approach adopted and record their justification for the action taken. If the cash is not counted and verified at the scene it should be bagged and sealed in front of the suspect and they should be asked how much cash is present, with their reply noted. The cash should be labelled with a description of the cash and an estimate or exact amount stated. It is good practice to give the person in possession of the cash a receipt. The receipt should show the total amount seized, whether or not the total amount comprises smaller amounts claimed by different people and its estimated total if not counted. OFFICIAL [SENSITIVE] Page 44  Police College INV04 INV04 The receipt is in addition to any other receipt or form normally issued (e.g. premises search form and items seized receipt). This should be signed by the person found in possession of the cash and a copy retained for the file as well as being scanned onto the Reports tab on the NICHE occurrence. Forensic Submissions Property is submitted to a number of different locations for forensic submission. The majority of submissions go to the Fingerprint Branch and Forensic Services Northern Ireland (FSNI) based at Seapark, Carrickfergus. When seeking submission of property to FSNI for forensic sampling, the following policy has recently been launched which is designed to reduce the time required to make a forensic submission and speed up the delivery of your evidence to the forensic supplier. You are now required to fill in the forensic screening form- Request for Forensic Strategy and/or Submissions with the details of your case and detail what you are trying to prove from the FSNI submission and what items you want to submit. Once completed the form is emailed to zForensicCaseManager who will complete all further forensic submission forms on your behalf and make the submission to Forensic Science Northern Ireland (FSNI) or other appropriate forensic supplier. The forms completed by the FCM on your behalf are: FSNI A - this form will be submitted in all cases and is a background document outlining details of the case and the reason for forensic submissions. FSNI B – this form relates to all items of property removed from the Suspect. These are items physically in contact with the Suspect such as clothing or swabs taken from them. It does NOT relate to their possessions e.g. an item found in the Suspect’s house would not go on the FSNI B. You must outline on this why you wish to submit these items and how they are related to the investigation. OFFICIAL [SENSITIVE] Page 45  Police College INV04 INV04 FSNI C – this form relates to all items of property removed from the Victim or Witness. Again these are item physically in contact with the Victim/Witness such as clothing or swabs taken from them. Again you must outline on this why you wish to submit these items and how they are related to the investigation. FSNI D – this form relates to all other items and as with the B and C forms you must outline why the item is to be submitted. FSNI E – this form is a continuation of FSNI. FSNI 12A (alcohol/drugs). FSNI Glass. Cyber Crime More and more investigations involve the seizure of electronic storage media such as mobile phones, computers, laptops, games consoles, tablets etc. The Cyber Crime Centre is responsible for the evidential examination of these items. Some District Electronic Support Units (DESU) have the facility to triage laptops and other computing equipment. If triage facilities are available they must be progressed prior to the Cyber Crime Centre accepting a request for examination. Similar to other items of property requests must be made to Cyber Crime Centre via a dedicated portal on your desktop called eCop. The application is used to create and manage applications for forensic examination of electronic devices and media including phones and computers. This application is managed by the PSNI Cyber Crime Centre unit. If an examination is agreed via eCop then you will arrange for items to be submitted via your property Manager to the Cyber Crime Centre which is currently based at Lislea Drive, Belfast. Local arrangements apply to DESU and they vary from district to district. You will need to outline your investigation and detail the reasons why you wish the item to be examined. Business and industry can report cyber-crime incidents via the online Cyber Reporting OFFICIAL [SENSITIVE] Page 46  Police College INV04 INV04 Portal available on the PSNI website. Computers, Electronic Organisers, Mobile Phones etc There are general principles to follow when dealing with computer-based electronic evidence at any crime scene and during any investigation that involves such evidence. These are: Principle 1 No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court. Principle 2 In circumstances where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions. Principle 3 An audit trail or other record of all processes applied to computer-based electronic evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result. Principle 4 The person in charge of the investigation has overall responsibility for ensuring that the law and these principles are adhered to. It is important that the data on any computer, electronic organiser or other digital recording device is not damaged, deleted or otherwise compromised. This can occur simply by examining the computer files stored on the equipment. Every action during such an examination will be recorded on the hard drive and may delete vital evidence. If you reasonably believe a computer is destroying evidence, immediately shut down the computer by pulling the power cord from the back of the computer (not the wall socket) or removing the battery pack from a laptop. WARNING, pulling the plug on a business server could severely damage the system, cause the loss of critical evidence and disrupt legitimate business. OFFICIAL [SENSITIVE] Page 47  Police College INV04 INV04 At the point of seizure, the device should normally be switched OFF (except in the case of a PDA). If you reasonably believe that a document currently open or program currently running is likely to contain data of evidential value then DO NOT power the computer down and instead call the Cyber Crime Centre for advice. DO NOT attempt your own search of the displayed material. If you believe that the suspect may be using encryption, if for example he or she has a high level of technical knowledge, call the Cyber Crime Centre for advice before powering down the computer. If an investigating officer decides a device must remain switched on then a thorough written record of this decision should be made detailing the reasons. Useful information/Good to know 1. There is no substitute for having properly trained Cyber Crime personnel immediately available where it is anticipated that IT equipment will be seized and subsequently examined for evidence. Advice may be sought from the Cyber Crime Centre or the District/Departmental E-Crime Support Unit (DESU) or alternatively via the link Cyber Crime. 2. Form CCC 67 can be used to request PIN/PASSWORDS from owners of devices, which will help speed up availability of information and therefore investigations. The form is available on Policenet/POINT Homepage. A revised instruction re handling Apple products involved in Serious Crime Investigations was introduced in July 2019. 3. Note that CCTV must be held for 10 years for volume crime and 100 years for serious crime. 4. When searching for property attached to yourself or for line managers checking for property for their Officers the following search will help: Detailed Find – Property – Stores tab - Staff # (enter service number) This should bring up all property items that the Officer has in the stores. Also tick the “Officer Responsible Box” this should narrow down to items you are responsible for as I/O for the investigation. It will mean that people come up with exhibits that they didn’t seize OFFICIAL [SENSITIVE] Page 48  Police College INV04 INV04 but are responsible. Please conduct your property reviews regularly and work flow the property staff with disposal requests. Stolen items recovered from a suspect and the owner can be identified - consideration should be given to photograph the item and return to the owner. This will require a statement of evidence from the owner and the officer who seized the item and returned to the owner. Damage to property - unless forensic examination is required the damage should be photographed, video taken or photocopied. Again a statement of evidence will be required to account for the item. Clothing - reasons for clothing to be seized might be to link a suspect from CCTV footage or description of the suspect by a witness which only links clothing, again for forensic examination for DNA, etc. OFFICIAL [SENSITIVE] Page 49