Using Forensic Intelligence To Combat Serial and Organized Violent Crimes

Long-established forensic techniques and advancements in forensic technologies are making a difference every day in criminal courts. Nascent successes in the implementation of these forensic technologies, as well as software and storage capabilities for large datasets and intelligence-led policing, show equal promise for improvements at the onset of investigations at the state and local levels.

The term “forensic science” describes the place where science and law intersect. Data developed by forensic crime laboratories are called forensic data, and are typically collected, analyzed, and reported on a case-by-case basis for criminal investigations and for presentation in criminal court proceedings.

Forensic intelligence,[1] on the other hand, involves gathering and using data earlier in the criminal inquiry cycle and across cases to help detect, prevent, investigate, and prosecute crime, concentrating mainly on serial and violent crime. Incorporating forensic data into crime analysis can also help identify links, patterns, and trends or correlate other information pertinent to the criminal activity; resulting actionable intelligence can then be used to disrupt and prevent crime, particularly serial and violent crime.

Though well-incorporated and utilized in investigative and intelligence processes at the national level in the United States, forensic case data that are useful for investigative purposes are scarcely integrated at early stages in the intelligence and crime analysis cycle at the state and local levels. There may be instances in which information contained within forensic case data could have been used to solve a case faster or to identify linkages and trends across cases. However, limited collaboration and communication between regional or local forensic laboratories and law enforcement agencies hinders detection and linking of serial crimes and organized crime activities leading to violent offenses.[2]

Research shows that integrating forensic data into the intelligence and crime analysis processes — and using forensics to proactively reduce, disrupt, and prevent crime — could yield a paradigm shift in criminal justice system applications and crime prevention.[3] Forensic intelligence can be integrated into intelligence-led policing and other policing approaches to serve as a force multiplier and help identify people who are responsible for crime as well as illegal tactics, techniques, and procedures. This strategy may be especially helpful in instances of serial violent crimes (e.g., murder, aggravated assault, robbery, and rape) as well as nonviolent offenses such as property crimes (e.g., burglary and arson).

Forensic intelligence approaches can also serve as a feedback loop for crime laboratories to help them identify and prioritize the analysis of certain types of evidence that may best develop investigative leads. Modifying crime lab workflows in this way can make them more efficient, free up resources and personnel, and help reduce backlogs.[4]

Bringing a forensic intelligence approach to state and local law enforcement operations has the potential to advance the detection, investigation, and prosecution of serial and organized violent crimes in jurisdictions across the United States. As part of its mission to reduce crime and advance justice through basic and applied research, particularly at the state and local levels, NIJ is committed to examining and communicating the potential of forensic intelligence tools for law enforcement agencies.

Applying a Forensic Intelligence Approach

In the United States, forensic laboratories typically report results only after they have been fully processed and reviewed for use in court proceedings in accordance with stringent quality management protocols. The forensic intelligence approach, however, provides an opportunity to use existing forensic data (both preliminary and confirmed results) together with existing situational and other pertinent crime data to produce case leads, link cases, or inform investigative and proactive tactical, operational, and strategic policing. The forensic data produced for forensic intelligence may not necessarily be the complete forensic report needed for presentation in court, but it can potentially inform investigations if integrated in a timely manner. For example, an investigator may be able to link crime A to crime B based on a unique modus operandi and further link crime B to crime C based on a similar set of shoe prints. Through the introduction of forensic data, the investigator now has a more holistic view of these crimes.

Federal agencies and other countries are already integrating forensic data into criminal intelligence. Though no rigorous evaluation of this approach has been undertaken to date, some research suggests potential benefits of incorporating forensic intelligence into the daily operations of law enforcement agencies, including:

• Crime disruption and prevention
• Time and cost efficiency
• Early identification of suspects
• More effective use of forensic traces that inform policing and security actions
• General tangible benefits of related intelligence products, such as threat and risk assessments and situation reports
• Better understanding of criminal activity as a whole[5]

Importantly, these activities may enhance situational awareness and help inform strategic planning and resource allocation.[6]

Forensic datasets are typically compared only within their respective discipline, such as DNA, fingerprints/latent prints, firearms, footwear, drugs, and toxicology. However, recent advances in information technology and increased digitization that allow massive quantities of forensic data to be stored, indexed, searched, and cross-referenced have made it possible for some common types of forensic data to be cataloged and compared between cases at an evidence-to-evidence level. This capability is especially valuable for comparing data from cellphone and other digital and multimedia evidence, which may include terabytes of data.

Recent advances in scientific technologies can also provide actionable information at key decision points in the investigation process. For example, more sensitive, field-portable drug detection tools can accelerate the identification of illicit materials. Rapid DNA technology, developed through NIJ-funded forensic science research, processes biological samples and produces DNA profiles in less than two hours, allowing police to search the national DNA databases while a suspect is still in custody at a booking station.[7]

The forensic intelligence approach combines disparate silos of evidence into an integrative dataset that can link series of crimes and organized crime activities through associations based on forensic evidence and other data, such as situational information, in a timely manner. Exhibit 1 shows a model of data integration used by a group of states in western Switzerland. Information from state police and forensic databases is collated into a shared regional intelligence platform that is available to all law enforcement analysts. The platform allows analysts to link situational information (i.e., descriptive and other information provided in a police incident report) and forensic information, including evidence that provides probative value to a singular case and evidence collected for the purpose of potentially identifying connections across cases.

One study examined crime data in Switzerland and the role of forensic data in the intelligence process for serial crimes. The study found that situational information accounted for 62% of case linkages and forensic evidence accounted for 38% of linkages. This highlights how connecting situational evidence with forensic information can further support serial crime investigation.[8]

Intelligence-Led Policing and Forensic Intelligence at the Local Level

The widely used model of intelligence-led policing by state and local law enforcement agencies sets a solid base for incorporating forensic data into data analysis and crime intelligence. The model has been found to be an objective decision-making framework that facilitates crime reduction, disruption, and prevention. This is accomplished through both strategic management and effective enforcement strategies that target individuals who commit prolific and serious crimes, as well as through proactive approaches for combating persistent local and organized crime.[9] Another model of information sharing can be found in the operations of fusion centers. Originally, fusion centers were established as terrorism-only intelligence centers, but many have expanded to detect, prevent, investigate, apprehend, and respond to criminal activities.[10] Thus, fusion centers are well positioned to “provide analytic resources to forensic laboratories that may not otherwise have such a capability.”[11]

As the benefits of linking forensic evidence across cases become increasingly apparent, the forensic intelligence approach could help prevent and solve crimes, including cases of gun violence, sexual assault, controlled substances (e.g., opioids, fentanyl, fentanyl analogues, and other emerging drugs), and human trafficking. Integrating information from readily available, but often disconnected, data sources and linking situational evidence with related forensic data may be particularly beneficial to local law enforcement agencies and adjacent forensic laboratories in identifying organized or serial crimes.

Gun Violence

In 1999, the Department of Justice’s Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) established the National Integrated Ballistic Information Network (NIBIN) to provide an automated ballistic imaging network to local, state, and federal law enforcement partner agencies. This national database consists of digital images of fired bullets and cartridge cases that were found at crime scenes or test-fired from confiscated weapons. Since 2017, the Bureau of Justice Assistance (BJA) has supported a National Crime Gun Intelligence Center Initiative project[12] that allows local law enforcement agencies to collaborate with ATF in gun-related evidence analyses. As part of this project, ATF implemented a model for integrating data from NIBIN into the criminal intelligence process across several jurisdictions in the United States.[13] The goal is to quickly identify armed violent individuals who have committed crimes and suspects, detect potential associations between evidence and seemingly unrelated criminal cases, disrupt criminal activity, and prevent future gun violence through data correlation techniques.[14]

Linking NIBIN data to law enforcement intelligence enabled police in Portland, Oregon, to match shell casings from a gun seized during a traffic violation stop to casings from four previous unsolved shootings. A second gun later recovered from the same owner produced shell casings that matched those from two additional unsolved shootings in and around Portland. To make these connections, the Oregon State Police crime lab analyzed casings from the guns and uploaded digital images of the casings into NIBIN. Analysts from the ATF NIBIN Correlation Center were then able to make direct comparisons in the national database and find links to the other firearm cases.[15]

Additional types of forensic data can be aggregated with situational data to allow for a more extensive investigation of firearm-related incidents. For example, several federal databases track other evidence, such as data on DNA, fingerprints, and other biometric evidence (see exhibit 2). The FBI, with support from NIJ, is currently exploring ways to store and compare footwear datasets with the ultimate goal of creating a national footwear database.[16] Other platforms capture nonforensic data, including situational information, case information, criminal histories, and background checks. Additionally, software can now analyze police incident reports and identify written information that may link different crimes.[17]

Forensic data with great potential utility for crime gun intelligence may include information related to drug cases, local and transnational gang cases, and human trafficking cases (both sex and labor trafficking), along with situational information from incident and investigative reports and gunshot detection data with spatiotemporal evidence. Integrating crime gun evidence with these types of data has the potential to produce comprehensive actionable intelligence on individuals who commit serial crime and organized violent crime rings and can lead to the disruption, prevention, and ultimately, reduction of violent crime.[18]

Applying firearm-related forensics to the criminal intelligence process through correlation techniques can help link crime guns to those committing serial violent offenses and connect seemingly unrelated criminal cases that also involve a firearm (e.g., homicides, aggravated assaults, home invasions, hijackings, and robberies). These connections can mitigate further harm and facilitate prosecutions of firearm-related serial offenses. Although such correlations can be used for tactical or case-specific purposes, they can also be applied to achieve a longer-term strategic outcome — they may help identify crime regions associated with one particular gun market, seller, or distributor, as well as patterns of gun violence outbreaks, allowing for the development of proactive strategies.

Serial Sexual Assault

A sexual assault kit (SAK) contains evidence gathered from a victim, such as swabs of the victim, hairs and fibers found on the victim, and the victim’s clothing. Although analyzing the contents of a SAK can yield DNA evidence from the person who committed the crime, SAKs might not be sent to labs for testing for cases in which the victim knew the person who committed the crime. However, NIJ recommends that when there is victim consent for testing, all SAKs should be sent to labs for DNA analysis, regardless of whether the person who committed the crime is known.[19] Testing these kits may provide a link to an unsolved SAK in which the victim did not know the attacker. Moreover, connecting forensic evidence from SAKs can help identify serial rapists. This type of evidence can be linked in the FBI’s Combined DNA Index System (CODIS), enabling the apprehension of serial criminals. Nonbiological evidence, such as fingerprint, toxicology, or cellphone evidence, can also be used to link sexual assault cases.[20]

Between early 2015 and January 2019, the Sexual Assault Kit Task Force of Cuyahoga County, Ohio,[21] analyzed 7,001 untested SAKs. They found that a small percentage of suspects were implicated in the majority of the analyzed backlogged kits.[22] Out of all the analyzed backlogged cases, 70% of the investigations had been closed and 14% of the closed investigations resulted in the opening of a prosecution.[23] Out of these reopened investigations, 712 defendants were indicted, 61% of the prosecutions reached disposition by the court, and 92% of those dispositions resulted in convictions of the defendants.

Interestingly, 6% of indicted defendants were implicated in two or more of the assault kits, and 24% of those identified through the SAK analysis were both a stranger and an acquaintance to separate victims. Additionally, an examination of criminal records showed that many of the individuals committing serial offenses were generalists with respect to the types of crimes they committed, meaning many had been arrested for crimes such as domestic violence and felony drug charges either before or after the SAK was logged. However, some of them may not appear to be committing serial offenses based on sexual assaults alone. Based on the analysis of other SAKs and other types of forensic evidence, links to other cases may be found. Although such individuals may be linked through the applications of DNA databases such as CODIS, for example, there are limitations to relying on DNA databases alone due to the stringent requirements for uploading DNA profiles. A forensic intelligence approach can make connections between a variety of evidence from various databases and types of crime and can help apprehend these individuals.

The Sexual Assault Kit Initiative (SAKI) is a BJA grant program that began in 2015; it aims to address the issue of unsubmitted SAKs in law enforcement custody. SAKI grantees can inventory, test, and pursue further investigation and prosecution efforts related to previously unsubmitted SAKs when appropriate. In 2018, BJA began requiring SAKI grantees to enter information from opened sexual assault investigations into the FBI’s longstanding Violent Criminal Apprehension Program (ViCAP) database, which maintains the largest investigative repository of major violent crime cases in the United States. The added forensic DNA evidence provided by the kits — in addition to data already commonly found in the ViCAP database, such as descriptive data, court records, and statements — increases the chances of connecting cases, finding criminals, and possibly preventing future offenses. Recently, information from SAKI helped link 34 of prolific serial killer Samuel Little’s confessions to unsolved crime cases.[24]

Similarly, NIJ’s National Missing and Unidentified Persons System (NamUs) offers free tools for storing and sharing information on missing and unidentified persons cases and provides forensic services — such as forensic anthropology and DNA analysis, forensic odontology, and fingerprint examination — to advance investigations. Again, by connecting case information to forensic data and making comparisons across jurisdictions, investigative leads can be provided quickly and crime can be solved, if not prevented.

Illicit Drugs

Linking descriptive information from law enforcement incident reports with the physical or chemical profiles of intercepted drugs, including synthetic opioids and designer drugs or analogues with ever-changing chemical structures, can help uncover the coordinated activities of criminal organizations.

The Drug Signature Programs of the Drug Enforcement Administration’s Special Testing and Research Laboratory and the Australian Forensic Drug Laboratory’s Drug Profiling Program analyze characteristics of high-volume drugs, such as geographical origin, processing method, impurities, and isotope signatures.[25] Seizures with similar characteristics may be traced to the same organization or cartel and may help identify drug trafficking routes and networks. These programs focus mainly on border seizures, but there may be value in establishing similar state or local drug signature programs to identify trends and link seizures within the United States.

Similarly, integrating forensic laboratory data into CompStat could help enhance the capabilities of law enforcement’s performance management system.[26] With opioid abuse at crisis levels, jurisdictions are implementing city and regional data-sharing models that incorporate information from both public safety and public health agencies. These data-sharing models can provide real-time surveillance to detect and respond to patterns of opioid overdose, such as identification of an overdose outbreak epicenter, which can mitigate further harm (e.g., targeted naloxone distribution) and facilitate drug surveillance strategies and fatal overdose homicide prosecutions.[27]

Human Trafficking

The United Nations Office on Drugs and Crime encourages investigators to include forensic personnel early in the investigation of human trafficking cases by seeking technical advice and aligning investigative goals with a forensics strategy.[28] Forensic document examinations, for example, could be critical for human trafficking investigations, and document evidence could include multiple forms of evidence, such as fingerprints, trace (or “touch”) DNA, handwriting or signatures, and unique marks on forged documents that can be traced back to printing machines or typewriters.[29]

Other types of forensic evidence, such as digital and multimedia evidence (including cellphones), could play a role in human trafficking cases, thus making these types of investigations compatible with a forensic intelligence approach. The Center for Forensic Investigations of Trafficking in Persons at the University of New Haven recommends that human trafficking investigations become more proactive and focus on dismantling illicit networks.[30] The forensic intelligence approach aligns with these recommendations, as it incorporates forensic evidence into the early stages of crime analysis to prevent crime, especially in cases of serial and organized crime. Additionally, the forensic intelligence approach can serve as a feedback loop, helping agencies identify the best types of evidence to submit to crime labs for these types of investigations, which may not involve a specific crime scene.

The center also advocates for policies and practices that allow for and expand the use of forensic and biometric tools, such as genealogy databases, Rapid DNA collection for kinship verification and SAKs, iris recognition, and forensic DNA phenotyping (predicting physical appearance and traits). The center further recommends investigating connections between human trafficking crime and other commonly associated types of criminal activity, such as organized crime, money laundering, and transnational crime. A forensic intelligence approach synthesizes forensic evidence from individual cases and various types of crime to identify investigative leads and, when applied at the local level, could advance investigative and intelligence capacities.

Guiding Principles for Forensic Intelligence

Efforts to develop a forensic intelligence approach in Australia and Switzerland have established guiding principles for successful implementation.[31] For example, forensic intelligence involves a collaborative approach to case investigation and may require increased collection and more timely testing of evidence from crime scenes. Reinforcing this effort with appropriate technology that facilitates rapid assessments and comparisons at the crime scene and supports interagency and interdepartmental data integration through the aggregation of information will advance not only the investigation of high-profile cases but also the production of actionable intelligence.

Applying a forensic intelligence approach to preliminary testing protocols (e.g., field screening) can provide timely and actionable information to law enforcement and support investigations. A forensic intelligence approach can also inform laboratory drug confirmations and toxicology testing strategies in illicit drug investigations. Nontraditional investigative techniques, such as pollen analysis, can point to the original geographical source and routes taken for drug trafficking cases and provide additional leads for firearm-related investigations and other homicide, sexual assault, and human trafficking cases.[32]

In addition to applying forensic intelligence to existing datasets, crime and intelligence analysts and crime lab scientists should collaborate to identify analytical testing methodologies that go beyond routine analysis, such as the identification of cutting agents (diluents) and adulterants in seized drugs[33] and trace evidence analysis (e.g., forensic glass analysis for hit-and-run cases or property crimes). These methodologies could provide valuable data to inform the investigative and intelligence processes and link crime patterns, exonerate the innocent, and identify individuals committing crime for cases other than the highest priorities.

Some U.S. jurisdictions have already developed databases that allow analysis of footwear and tire impressions recovered from crime scenes.[34] Crime and intelligence analysts can use these data in a link analysis of high-volume and serial crimes, such as suspect-to-scene and scene-to-scene linkages. Although footwear prints can often be recovered from burglary and violent crime scenes, this tool is underused because investigations tend to focus on the characteristics of evidentiary value to make single-source identifications rather than the class characteristics that are an untapped source of intelligence.[35] The use of footwear class characteristics has the potential to complement closed-circuit TV video or eyewitness statements and connect footwear evidence to an individual committing a crime or series of crimes. Implementation of footwear collection and comparison strategies in the booking station environment can also complement Rapid DNA initiatives and help link persons who committed the crime and cases more quickly and efficiently. As such, NIJ is funding a working group — through an interagency agreement with the FBI Laboratory — to explore the development of a national footwear reference database.[36]

Using forensic evidence in these new ways raises questions about how forensic lab accreditation and quality management system policies will apply to the implementation of forensic intelligence approaches. Forensic accreditation bodies could work more closely with labs to facilitate data access for an authorized law enforcement agency by enabling new types of reporting mechanisms, with an emphasis on preliminary findings that are for investigative or intelligence purposes only and are subject to further quality system reviews and/or confirmatory testing.

The forensic intelligence approach is an innovative method with the potential to aid state and local law enforcement agencies in the United States in criminal investigations and further enhance their crime and criminal intelligence capacities to address local crime issues. Widespread use will transform the intelligence process for investigating crimes, especially violent serial and organized crime, and potentially reduce criminal activities through advanced disruption and prevention strategies.

For More Information

Read Promising Practices in Forensic Lab Intelligence: Sharing Lab Intelligence to Enhance Investigations and Intelligence Operations to learn about promising practices and recommendations on how to build agency intelligence efforts.

About This Article

This article was published in the NIJ Journal Issue Number 282.

This article discusses the following OJP grants:

• “Reducing Gun Violence through Integrated Forensic Evidence Collection, Analysis and Sharing,” grant number 2019-R2-CX-0066
• “The Sexual Assault Kit Initiative: National Training and Technical Assistance,” grant number 2015-AK-BX-K021
• “Cuyahoga County Sexual Assault Kit Task Force Capacity Building Initiative,” grant number 2016-AK-BX-K016
• “Cuyahoga County Sexual Kit Task Force Owed DNA Initiative,” grant number 2016-AK-BX-K011