According to Samantha Gwinn, former crime analyst with the Federal Bureau of Investigation and San Diego Police Department, anything with a date, time, or a location can be entered into a timeline, and you never know at the beginning of an investigation whether that information will be critical later on to the interview strategy, prosecution strategy, or investigation of additional related cases. Consequently, you should have a way to enter everything into a timeline or case chronology at every step as you proceed through the investigation.
“It’s difficult to envision a major investigation that does not involve the creation of some sort of a timeline,” says Gwinn. “Whether you’re documenting a subject’s movements leading up to his or her encounter with the victim, or creating a comprehensive overview of where that subject has been since they were 18 years old, a good timeline requires data from multiple and varied sources to be presented in a clear and concise way.”
The information that goes into a timeline can come from open source websites, internal case files, NCIC, surveillance logs, and many other common and unconventional sources. For example:
1.) Victim and witness statements
2.) Spouses’ and relatives’ accounts of work history and address history
3.) Suspect statements during the instant case and/or prior police contacts
4.) Cell phone records and call logs, to include call dates/times, tower locations, GPS information (if enabled), and call duration.
5.) Be sure to request records for all phone numbers associated with the subject and his or her associates, if applicable — use public records databases to research phone information prior to writing the warrant.
6.) Land-line phone records
7.) Locations, dates and times of credit card transactions and ATM withdrawals
8.) Data from computer files – including smart phones and tablets — such as locations and times of Wi-Fi access, cached website information, emails sent and received, posts on social networking sites, as well as log-ins and log-outs (consult your agency’s computer forensics expert for more information on what is possible as it relates to your specific investigation)
9.) Geotag data attached to digital photographs
10.) Data from “OnStar” as well as GPS tracking devices and other satellite navigation devices. This is especially applicable if fleet vehicles or long-haul trucks are involved
11.) Vehicle service and repair dates and locations, available via receipts or vehicle history reports such as CARFAX
12.) Insurance claim information for vehicle accidents, worker’s compensation, etc. This information is often available through public records and/or the National Insurance Crime Bureau.
13.) Passport information, including issue date(s) and entry/exit stamps
14.) Flight arrival and departure information, often available via the Treasury Enforcement Communications System (TECS)
15.) NCIC “offline” information, which provides detailed transactional logs for all law enforcement queries on persons and vehicles, regardless of whether an arrest was made (for more information on obtaining NCIC offline data, contact the FBI Criminal Justice Information Services Division, Investigative and Operational Assistance Unit at 304-625-3000)
16.) Dates on licenses and permits, such as hunting and fishing licenses, firearm permits, marriage licenses, as well as professional licenses and the like — this information is typically available via public records databases, licensing boards and county clerk/recorder offices.
17.) Probation and parole records, such as meeting dates/times with officers, therapists and counselors — missed appointments are just as important to include in a timeline, since this could indicate that the subject was out of the area or engaging in criminal behavior at the time
18.) Corrections data, including jail bookings, exact intake and release dates, work furlough history, and escape history — incarceration information should always be verified with the department of corrections that housed the inmate
19.) Court appearances, to include those that were missed by the subject
20.) Work schedule including “clock-in and clock-out” times from the subject’s employer, to include days absent
“As often as possible,” Gwinn explains, “everything within a timeline should be independently verified. This is especially important for open source and public records data, as well as for witness accounts. Consider indicating within your timeline whether the information has been verified, and by whom.”
Gwinn says also that you should always express date and time using the local time zone in which the event occurred. If this becomes cumbersome due to extensive travel by the subject, be sure to specify in which time zone all dates and times within the timeline are being expressed (pilots use “Zulu Time” for this very purpose) so make note someplace that “all times are Eastern” or something to that effect.
“You don’t need expensive software to create case chronologies and timelines,” says Gwinn. You can use free or low-cost solutions from companies like Relavint, SmartDraw, and RFFlow are options and can be downloaded from the Internet. You can also use Microsoft Office products, such as Excel and Visio. SmartDraw, RFFFlow and Visio can also be used to create crime scene diagrams and photo lineups, giving them more than just one use for your agency. Finally, if you’re agency is using i2 for link charts, note that it can also be used to create timelines.
Gwinn offers these final recommendations:
• Always note your sources; use a “source” column in Excel or add source notes to icon captions if using graphics software
• If you’re using spreadsheet software to create timelines, use two columns to indicate date/time ranges. That way, you can sort the data in chronological order by start date or end date
• Include a key at the beginning or end of your timeline, so that readers can easily understand acronyms, abbreviations, notations, and symbols
Add your own thoughts and investigations tips below...
