Analytic Investigations (Investigative Timeline Analysis)

Hello and welcome to the Investigative Timeline analysis. I'm Dr. Matthews,

In this course I'll explain:

• What a timeline is

• How and when analysts, investigators and others might use them

• The four key questions a timeline can answer

• How an investigative timeline can help in an investigation

• How to generate a timeline, manually and using automation 

An investigative timeline analysis is a tool used by analysts and investigators to graphically and chronologically depict incidents or events across a continuum. It can be measured in seconds, minutes, hours, days, etc. As you can see in these  examples, there are multiple ways to display the information.

However, before you can display information, you first have to find it, collect and collate it. The four basic questions, who, what, when and where are used to ensure the information that is gathered can be included in a timeline.

For instance, in an ATM withdrawal you can typically verify who conducted the transaction, what type of transaction took place, transfer, deposit, withdrawal, etc.

A credit or debit card transaction can answer the same questions, as can closed circuit television (CCTV). These and similar systems are often some of the first places investigators look to verify timeline information as they are largely considered "Silent witnesses".

Conversely victim, witness, or bystander statements, while often sought and collected during an inquiry are known to be notoriously inaccurate and unreliable.

How can a timeline help in an investigation or inquiry?

Much like other analytic investigative tools, the timeline can help prove or disprove information regarding the whereabouts of entities of interest. For example, an individual can't have been at the scene of an incident, if their is photographic evidence of them making an ATM withdrawal several miles away.

A well-developed timeline provides clarity to a complex case.

By examining events on the timeline, you can gain an understanding as to the patterns or typical behaviors of an entity of interest, and identify changes in that pattern. For example, if it is typical for the individual to take lunch at a local coffee shop every day, and on the day in question they deviate from their pattern, it would be worth learning "why". 

Further, the timeline can allow you to validate the truthfulness of an entity by comparing what you know to be factual with their statement of events, regarding their movements relevant to the incident. For example, an individual might say "they had to work late, due to a power outage in the building' - you may already know that ongoing construction inadvertently severed the buildings' power for 45 minutes. Thereby at least tacitly confirming the individual's statement.

It is important, however, not to speculate aloud to as to why an individual did or did not take a particular action. Instead.

                                       "Let evidence speak for itself"

If the individual is unable to explain why they did or did not take an action, don't provide an explanation for them. Simple add it as a follow-up question to fill out your timeline. Such questions might include:

• How did the person get to the location?

• Who can confirm what the person's statement?

• What did the person do afterwards?

• When did they arrive at the workplace; to the store; home, etc.?

  These types of questions focus on the physical location and movements of the individual, and the answers will contribute to the investigative timeline.

                           (Download the AIT+Bonus and learn how to get your free trial copy of RFFlow)

So then, what is a timeline and how do you build it?

After years of investigations I've found this quote answers the questions nicely, regardless whether they are asked by a lawyer, doctor, analyst or investigator; 

                      "The timeline is your friend. Always feed the timeline."

In an investigation the timeline is a living document. As such, it requires feeding, and the food for the timeline is information. Regardless how small or seemingly insignificant, every scrap of information will help feed your timeline. It is understood that there will be gaps in every timeline, and the goal of the investigator, analyst, lawyer etc, is to fill in the gaps with information. Initially, the information may not seem connected. But you can't know what is or isn't relevant until the case is closed. So, the fewer gaps in the timeline the clearer the picture of what happened will be developed.

Lastly, the timeline requires a patient methodical process. Depending on the type of investigation, the timeline might include dozens of interviews, hours of video, or mounds of documents. By piecing fragmentary information together a picture will inevitably develop.

Let's explore the Manual Timeline Method for a moment.

When collecting information it helps to view item as an event. Thus the timeline is a collection of Events in time. Much like a collection of 3x5 index cards, each with a separate event recorded. This is especially helpful when there are multiple individuals assisting in collecting the information at different times and locations.

When all the cards "Events" are brought together and laid out chronologically, a clearer picture of the time frame begins to resolve into focus.

Following the manual timeline method a few additions will serve to provide some clarity in the timeline.

A card with a triangle might be used to show the beginning and end of the timeline as well as alternate lines of inquiry.

Consider the following scenario: Imagine the incident under investigation was  a recent increase in vehicle thefts. During the initial investigation it was discovered that the vehicle owner in the latest theft was behind on their auto payments and had significant debt. An alternate line of inquiry might be to more closely examine the owner's actions and whereabouts before, during and after the reported theft. A possibility exists the theft was arranged to take advantage of known incidents of car thefts in the area. (Interestingly enough, this was an actual case I worked.)

While each card would be used to briefly record the information on the event or activity, a card with an "X" through it might be used to draw attention to a significant event or activity. In the scenario above, it could be a witness who saw the owner changing the expensive tires on his new vehicle and installing used and worn ones the day prior to the reported theft.

Arrows, can be used to direct the chronology of the inquiry as it develops. While numbering each card could be done to maintain the time flow, I don't encourage it. Remember the timeline is a living document, so you are apt to discover additional information that might appear between two or more cards. It would then be necessary to either renumber the cards or add something like 24.1.1a to keep the information organized.

As with all analytic investigative methods, there are pros and cons to consider.

Some of the benefits of Pros for using this manual method include the fact that it is a time tested and reliable technique. It is simple and relatively inexpensive to implement. If the information has already been collected, for example a finalized investigation or unsolved closed case, the manual method can be applied with the goal of identifying investigative leads. In an active investigation the manual method could be used to triangulate (verify) previously identified or recorded information. And of course the level of technical knowledge needed to construct the timeline is low.

On the other hand, the manual method is, well, manual. It will require reporting conventions to be established so that information is recorded in a consistent manner, for example: Last name, First name, Middle Name of individuals supplying information; times and dates should be consistent is 12pm noon or is 12PM midnight? Is it day / month / year or month / day / year (what is 7 / 6 / 2020? There must be a repository for the cards to be stored, with access to those working the case. There may need to be duplicate of the cards as a back-up. Consistency, continuity, and commitment are the hallmarks of the manual method.

For the person who is more comfortable with a visual and hands on access to information, the manual method allows for a simplified layout that can help identify larger-scale patterns of activities or missing or conflicting areas of information.

Now, let's consider how we might automate a timeline using the RFFlow Timeline Module. The standards, techniques, and conventions for collecting the information are largely unchanged, however integrating technology to display and analyze the information can improve the timeline results.

The following is a step-by-step tutorial, where I use a sample scenario to generate the timeline.

Well done, you are halfway through!