“From where we stand, the rain seems random. If we could stand somewhere else, we would see the order in it.” — Tony Hillerman, Coyote Waits

Patterns and habits exist not only in the lives of those we investigate, but also within our own investigative tactics, techniques and procedures. A keen eye for both will improve your investigative insight. However, pattern recognition is not only limited to what we see in an investigation; it also means being aware of our own potential investigative biases, which hopefully will induce a certain level of skepticism. For a brief exercise in introspection and pattern recognition, consider the following scene.

Early in the morning, the alarm played a distinct audible tone. I rose, made coffee, ingested coffee and repeated those necessary steps. I then got dressed, talked to my wife, hugged my son and headed out the door. I continued this pattern the following day, and the next day, and the next day. I carried out this routine for a few years, unless there was an interruption or deviation. What caused the deviation? Perhaps the catalyst was a sick child, a family emergency, a call for service or a crime that was investigated the day or night before. An added influence in all the cases? In this initial dissection of my morning routine, which many of you will recognize as your own, several key elements were missed or overlooked. Identifying those elements can help us consider our investigative bias. 

I encourage any individual tasked with any type of investigation to think critically, outside of the box, to fight their investigative bias. This may be a challenging task, as bias can manifest and prove to be a hindrance in investigations. For us to hunt for it, we must first define it. Psychology Ph.D. candidate Chris Sanders defines investigative bias as follows: “Bias is a predisposition towards a certain way of thinking, and it can be the difference in a successful or failed investigation. In some ways, bias is good when it allows us to learn from our previous mistakes and create mental shortcuts to solving problems. In other ways, it’s bad and can lead us to waste time pursuing bad leads or jump to conclusions without adequate evidence” (chrissanders.org/2017/01/know-your-bias-1-foundations).

Investigative bias can be as drastic as an example of manifest destiny. Often investigative bias is one we are familiar with: “This is the way we do it,” “This is the way I was taught” or “This is how I saw someone do it.” These statements are not meant to draw away from valuable experience and training; to the contrary, they are meant to instill awareness and skepticism. I have found the common theme in any battle with my own investigative bias has been because of previous mentoring with great intentions. To garner some introspection about investigative bias, let us retrace the morning routine mentioned above and break down each piece. 

Early in the morning, the alarm played a distinct audible tone. What defines early in the morning? Is this statement an example of bias within the investigation? Am I predisposed to judge what is early? If this tone had come from a Timex watch, not a smart watch, would you have thought to record all the settings and user inputs? If this were your investigation, would you do the same on the timepiece worn by your alleged suspect(s) or victim(s)? This is even more critical in 2021, as the timepiece may be a smart device, a fitness tracker, or a potentially standalone cellular or Wi-Fi-serviced device. 

I then got dressed, talked to my wife, hugged my son and headed out the door. Did getting dressed involve the use of an iron? If it did, was the iron returned to its original place? Was it left plugged in and turned off, or plugged in and turned on? Do any of these show a potential deviation from your perceived understanding of normal? Does my home have more than one door? Did I exit through the door I normally use? Where did I park? Am I checking my mobile device during this time? Have I began communicating with other parties? Do the utility companies with whom I am a customer have detailed metrics of energy usage by legal process? Does my wife have an alarm set? Is there any sign the alarm was silenced, or did it complete its programmed sequence? If the alarm was silenced, was there a later alarm set? Did everyone appear to wake up on time? Does a perceived deviation exist in what you may think is normal? 

Your definition of normality may be a form of investigative bias. Did you bother to serve legal process because in the past it did not prove fruitful? Have you or a member of your investigative team received professional training in investigations? Was the training approached with the same bias-fighting mentality to search for fact, rather than opinion?

While these questions may appear odd as a direct interrogation of a morning routine, it is when we stand somewhere else that we begin to see the order in the raindrops. Often, the recognition of our own investigative bias must occur prior to beginning to recognize the deviations in someone else’s routine. What is more common among humans than the routine we welcome the day with?

While this is not an exhaustive and all-inclusive review of all nuances and avenues within an investigation scenario, consider it a 20% completed exercise reminiscent of Highlights magazine’s “spot the difference” puzzles. While analyzing the nuances used to help solve investigations, always remember to take cognitive steps to ward off your own investigative biases. Only when we realize our own biases can we induce skepticism about our own practices and notions. Subtle changes are only visible when we allow ourselves and other members of our investigative team to see them. Keep your eyes open, allow your investigation to be driven by unbiased facts, and follow sound practices in the execution of tactics, techniques and procedures. Stay safe, act with the highest ethics and always stand on fact. 

---

Chris Atha is a high-tech crime specialist with the National White Collar Crime Center (NW3C) focusing on research, technical assistance and training for advanced digital forensics topics. Previously, he served as an electronic crime detective for a large law enforcement agency. Chris has been disclosed as an expert witness in cases in multiple federal court districts in various states throughout the East Coast, and has spoken at a variety of information security conferences, including BSides Charleston and Hackercon. He is a Certified Information Systems Security Professional (CISSP).