Evidence Tags

Investigators should prepare evidence tags for all collected items. All items are tagged whether retained or returned to the owner. These are generally small gummed or self-adhesive tags that can be secured to outside of the item. Evidence tags may be attached to heat-sealed, electostatically neutral plastic bags containing magnetic media or other types of digital evidence. Storing media in this fashion secures it from static electricity, the elements, and tampering. Sealing the bag with two witnesses present signing the chain of custody schedule avoids future legal arguments challenging changes and custody.

Evidence tags should have the case number, an item number, and date-time-place information as well as the name and initials of the collecting person. In some cases, investigators have a policy that two individuals must witness the collection of evidence. Many law enforcement officers use scribes or markers placing their initials, date, time, and place on the evidence, in addition to the evidence tag, so they can positively identify it in the future. Some investigators think evidence handling is a tedious process. It is. But conscientious attention to details, accompanied by intelligent redundancy, has successfully defused many legal challenges.

Activity Log

On receiving a critical incident notification, the person receiving the call should begin an activity log. It is a complete responder activity log and includes all activities such as:

• Initial notification (Who, What, When, Where, How, Why)

• Interviews

• Management contacts and interaction

• Law enforcement contacts

• Evidence searches, seizures, and inventory

• On-the-spot evidence analysis

• Tools and commands used by responders

• Any other relevant responder activities

This log is a flowing document kept by individuals and later compiled as a single document encompassing all activities by all relevant persons. Notes should be kept, as they will be necessary as part of future legal discovery processes.

Witness Reports

Everyone that is interviewed should have his or her comments noted by the investigator and documented in the form of a written report after the interview is completed. Notes should be made of every person who is interviewed whether they have anything of value or not. Interviewees should answer the questions: who, why, when, where, what, and how. Direct the interview addressing those facts that are known to the witness directly leaving conjecture, speculation, guessing, and "gut-feelings" to the end of the interview. Witness interview reports are not supposed to be verbatim transcripts of the interview, rather they are summaries of important details. Investigators should take careful notes, because from these notes the witness' statement will be formalized into a report. Witness interview reports should be reduced to a formal document reflecting the following information:

• Witness' full name

• Witness' address and identifying information such as the beginning date of employment, business unit, supervisor, duties, etc.

• Purpose of the interview should be briefly explained to the interviewee and documented in the interview

• Identity of the investigators

• Information provided by the witnesses

• Time-date-location of the interview (It is possible that the interview report should mention the specific location of the interview such as a conference room. Current court rulings have made interviews held in hostile locations excludable.)

• Case file number

• Any evidence or materials delivered to the investigators by the witness

If the interview is very important and it is possible the witnesses may later change or recant their statements, witnesses may be requested to reduce their statements to writing. This can be accomplished in several ways, but one of the most successful is to have the witnesses write their statements in their own words. It is a prudent step to have the witnesses review their statements, making any changes they wish as to reflect their recollection of pertinent events.

Signed witness statements should be signed by the interviewee, dated, noting the time and place, and witnessed by at least two other people that must have been present during the entire interview and written statement process.

Some interviews are noted in logs where details of the interview are documented:

• Time of first contact with interviewee

• Place of interview

• Identities of those present during the interview

• Times of any person leaving or entering the interview

• Any requests from the interviewee, for example, food, restroom, union representation, or attorney

Statements used in criminal court proceedings must pass the test of "voluntariness." For example, if an employee were threatened with dismissal if she did not describe how she stole proprietary information from the company and she made a statement admitting it. It is likely this statement will not be admissible in criminal proceedings due to the coercive circumstances under which the statement was obtained.

Recorded Statements

Other types of recordings may be acceptable to memorialize witness statements. Under some circumstances, audio and video recordings may be used documenting interviews. Record the entire interview from start to finish if investigators are going to use audio/video media. This step eliminates arguments that the witness was forced or intimidated while the recording device was not operating. The recording media of the witness' statement is evidentiary. It is handled exactly like all evidence. There should be a chain of custody, evidence identification tag, and storage. In some cases, there are laws regulating audio/video recordings; consult with legal counsel before proceeding.

Hostile Interview Environments

Environments can be considered hostile and intimidating to the witness:

• Was the interview site one where the witness was in a small room with two interviewers? Was the witness advised that they were free to leave the room/building?

• Was the witness under arrest?

• Was the witness threatened with dismissal if they did not cooperate?

• Were the interviewers acting as law enforcement agents?

• Was the witness physically searched before being interviewed?

• Was the interview tone conversational or was it an interrogation where the tone was accusatory?

• Was the witness physically touched in any way?

• Was the witness' liberty significantly impeded in any way?

• Was the room temperature comfortable?

• Were the room's furnishings or lighting unusual or intimidating?

Legal challenges have been successfully filed eliminating witness interviews as it was decided that the surroundings were inherently coercive and intimidating to the witness. For example, investigators should be mindful that unless a person is under arrest, the witness is free to depart the interview at any time. Failing to allow the witness to leave the interview or denying access to medications, food, or restrooms, will likely precipitate a lawsuit and possible criminal charges against the investigators and their employer.