What the 10 New Auditing Standards Mean for Forensic Accountants

Posted by admin | Edit Published in THE FORENSIC EXAMINER Winter 2007

THE FORENSIC EXAMINER Winter 2007 www.acfei.com

CE Article: (CERTIFIED FORENSIC ACCOUNTANT, Cr.FA) 1 CE credit for this article

This article is approved by the following for continuing education credit:

(ACFEI) The American College of Forensic Examiners International provides this continuing education credit for Diplomates.

(Cr.FA) The American College of Forensic Examiners International provides this continuing education credit for Certified Forensic Accountants.

Recently, the American Institute of Certified Public Accountants (AICPA) issued 10 new Statements on Auditing Standards (SASs). One of the standards addresses audit documentation and another discusses professional requirements. The remaining eight are conceptually related and are known as the Risk Assessment Standards.

Forensic accountants should become familiar with the new standards. While the SASs are issued for external auditors, the requirements in the SASs impact the work of forensic accountants as well. Forensic accountants should understand how the new mandates affect and expand the work performed by the external auditors in the examination of the financial statements. The enhanced work performed by the external audit team may unearth clues that forensic accountants can use in their work.

Overview

The guidance in the standard addressing audit documentation expands and clarifies the items that must be memorialized by the auditor in the workpapers. Also, the time frame related to various documentation requirements is discussed. The verbiage used to indicate mandates versus recommendations is noted in another of the new SASs.

The eight Risk Assessment Standards serve to enhance the assessment of risks that is performed on every audit engagement. A deep understanding of the client as well as the operational environment, including its internal control, is to be obtained. Using the understanding, the external auditor makes a rigorous assessment of the risks of material misstatements in the financial statements.

Once the risks of material misstatements are assessed, the auditor develops a response to the risks. An overall response may be deemed appropriate. Another possibility is that the auditor might elect to adjust the nature, timing, and extent of audit procedures that are to be performed in response to the risks. The Risk Assessment Standards call for improved linkages between the assessed risks of material misstatements and the audit procedures planned in response to those risks.

Each of the 10 new SASs is discussed in more detail below. Understanding the requirements in the standards will help forensic accountants comprehend the work performed by the external auditor and enable forensic accountants to more efficiently and effectively plan their own procedures. The titles of each standard, and their corresponding numbers, are shown in Exhibit 1.

SAS 102

SAS 102 is entitled “Defining Professional Requirements in Statements on Auditing Standards.” The standard explains that mandates in some SASs are unconditional, while others are presumed to be required. If the language in the standard reads “must” or “is required,” the auditor is unconditionally required to perform the procedure noted in situations in which it is relevant. When the language used includes the word “should,” the task discussed is a presumptively mandatory requirement. For the latter, the auditor may, in rare situations, depart from the mandate if alternative procedures can supply the needed evidence. Provided this is the case, the justification for the departure from the mandate must be documented.

SAS 103

The standard discusses the contents of the documentation of the engagement. Also, several important dates related to documentation are noted.

Per SAS 103, the auditor’s documentation must include a description of both the work performed and the evidence gathered. Also, the conclusions reached by the auditor should be noted.

The standard discusses three important dates relative to audit documentation. They are the audit report date, the report release date, and the documentation completion date.

The audit report should be dated no earlier than the date that sufficient and appropriate audit evidence has been obtained. At that time (or after), the auditor can release the report to the client. The date of release to the client is significant because the documentation completion date is dependent upon it. Specifically, audit documentation is to be assembled within 60 days of the report release date.

Risk Assessment Standards

SASs 104 through 111 were issued as a suite. They are interrelated and both the forensic accountant and auditor should consider their requirements together.

SAS 104

SAS 104 is the first of the eight Risk Assessment Standards. The concepts of reasonable assurance and evidence are addressed in this statement.

According to the standard, the auditor must obtain sufficient appropriate audit evidence in order to support the audit opinion. As the auditor gathers this evidence, audit risk must be restricted to an appropriately low level. The concept of reasonable assurance relates to this low level of audit risk. SAS 104 explains that the level of assurance corresponding to a low level of audit risk is that which is high enough to meet the minimum required for reasonable assurance. The standard explains that “reasonable” implies a high, although not an absolute, level of assurance.

SAS 105

SAS 105 impacts the second standard of fieldwork. Also, the third standard of fieldwork is revised by this statement.

Previously, the second standard of fieldwork required the external auditor to gain an understanding of internal control. The understanding was to be used for the purpose of planning the nature, timing, and extent of evidential matter to gather.

With the issuance of SAS 105, the external auditor is broadening the understanding obtained. Under the new mandates, the entity and its environment, including its internal control, must be understood. The auditor then uses the understanding for two purposes. First, the auditor employs the expanded understanding to assess the risks of material misstatement. Further, the understanding is used to design audit procedures that address the risks of material misstatement.

Under the previous third standard of fieldwork, the auditor was required to gather sufficient, competent evidential matter to support the opinion. That mandate is now amended by SAS 105. With the issuance of the new standard, the auditor is to gather sufficient appropriate audit evidence. The results of procedures used in obtaining such evidence form a reasonable basis for the audit opinion.

SAS 106

The standard supersedes an earlier SAS, number 31, “Evidential Matter.”

SAS 106 reiterates the concept of sufficient appropriate evidence introduced in other Risk Assessment SASs. Also, audit evidence is defined in the statement. Further, the topic of relevant assertions is discussed, as are the use of relevant assertions in the process of assessing risks and designing audit procedures. The SAS goes on to address the qualitative aspects of audit evidence. The two characteristics that make up the qualitative nature of audit evidence are sufficiency and appropriateness. Finally, descriptions of various audit procedures are provided and the purposes of performing each are discussed.

Audit Evidence. All of the information used by the external auditor to arrive at the conclusions that support the opinion on the financial statements is audit evidence. Data underlying the financial statements are also part of audit evidence.

Besides the evidence obtained during the current engagement, audit evidence may be obtained in several other ways. Work that had been performed on previous audits, as well as procedures completed during the acceptance or continuance decision process, are part of audit evidence. Finally, other sources may yield audit evidence.

Assertions. As previous standards did, SAS 106 emphasizes the significance of gathering audit evidence to support management’s assertions regarding the financial statements. In the newer standard, the five management assertions presented in prior statements are expanded. Also, the enhanced assertions are organized into three groups: assertions applicable to the income statement, those related to the balance sheet, and those addressing presentation and disclosure issues.

Management makes five assertions related to the income statement and four assertions each relating to the balance sheet and to presentation and disclosure. The management assertions in each of the three categories are displayed in Exhibit 2.

Sufficiency and Appropriateness of Evidence. As discussed, the external auditor is required to gather sufficient and appropriate audit evidence. Sufficiency measures the quantity of audit evidence, while appropriateness relates to the quality of the evidence.

Two characteristics impact the appropriateness, or quality, of evidence. The first is relevance. To be considered appropriate, audit evidence must relate to management’s assertions. For example, the confirmation of a client’s accounts receivable balance relates well to both the existence and valuation assertions; it does not provide relevant evidence regarding completeness.

The second aspect of appropriateness is reliability. This attribute is impacted by the source of the evidence. Also, the nature of the evidence has an effect on reliability.

Audit Procedures. As noted, the external auditor performs audit procedures in order to reach conclusions on which to base the audit opinion. The procedures performed may be divided into three categories: risk assessment procedures, tests of controls, and substantive procedures.

In the first category, risk assessment procedures, the external auditor obtains an understanding of the entity and its environment, including its internal control. The understanding is then used to assess the risks of material misstatements. Such risks occur at two levels, the financial statement level and the relevant assertion level.

Test of controls is the second category of audit procedures. Such tests are performed at the relevant assertion level. There are two conditions under which testing of internal control occurs. First, if the external auditor expects internal controls to be effective and plans to place reliance on them, control tests must be performed. Further, in those circumstances in which substantive procedures alone do not provide sufficient appropriate audit evidence, testing the effectiveness of controls is necessary.

The final category of audit procedures is substantive procedures. Like tests of controls, such tests are performed at the relevant assertion level.

The focus of substantive procedures is the detection of material misstatements. Substantive analytical procedures are one of the two types of substantive procedures. The other involves tests of details. Classes of transactions, account balances, or disclosures might all be examined by using tests of details.

SAS 106 presents eight specific procedures that the auditor might use. The external auditor may employ these procedures as risk assessment procedures, tests of controls, or substantive procedures. The eight audit procedures are displayed in Exhibit 3.

SAS 107

SAS 107, “Audit Risk and Materiality in Conducting an Audit,” supersedes SAS 47, which bore the same title. The new statement groups misstatements into two types. Also, the audit risk model of SAS 47 is updated.

Misstatements. Per SAS 107, misstatements are classified as either known misstatements or likely misstatements. The first category encompasses those misstatements arising from the incorrect selection of accounting principles. Further, misapplication of accounting principles may yield known misstatements. Also, misstatements of facts, including misstatements from mistakes in gathering or processing data, as well as those which occur as a result of overlooking or misinterpreting facts, may give rise to known misstatements.

There are two sources of likely misstatements. First, management’s estimate of a financial statement element may fall outside of the range the external auditor considers reasonable. The difference between management’s estimate and the nearest endpoint of the range developed by the external auditor is considered a likely misstatement. Extrapolation may also lead to a likely misstatement. For example, when sampling, the auditor projects the known misstatement to the population. The extrapolated amount, less the known misstatements, is the second type of misstatement classified as likely.

Audit Risk Model. SAS 107 describes audit risk as a function of two other risks. These include the risk that the financial statements are materially misstated and the risk that the auditor will not detect the misstatements. The first is known as the risk of material misstatements (RMM), while the second is termed detection risk (DR).

When performing an engagement, the external auditor considers audit risk at two levels. To aid in evaluating audit risk, risk assessment procedures should be performed at both the overall financial statement and the relevant assertion levels. The results of the risk assessment procedures are used by the external auditor as the RMM is assessed.

At the level of the individual account balance, class of transactions, or disclosures, audit risk is composed of RMM and DR. In turn, each of these has two components.

RMM is made up of inherent risk (IR) and control risk (CR). The entity owns these risks; the external auditor assesses them but cannot control them.

Detection risk is comprised of substantive analytical procedures risk (AP) and tests of details risk (TD). The external auditor adjusts the nature, timing, and extent of analytical procedures and tests of details in response to the RMM. Exhibit 4 shows the audit risk model as presented in SAS 107.

SAS 108

The standard supersedes the section in SAS 1 addressing the appointment of the auditor. Also, the newer statement supersedes standard SAS 22, which bore the same title as 108.

Per SAS 108, the auditor is to develop an overall audit strategy when planning the engagement. Such a strategy is necessary to effectively organize, staff, and conduct the audit. The statement explains that a strategy is different than an audit plan. That is, a strategy is at a higher, more conceptual level than a plan; a plan is more detailed.

The standard goes on to reiterate that the auditor is to obtain an understanding of the entity and its environment, including its internal control, during the planning stage. This requirement expands the previous mandate of the second standard of fieldwork, which had focused exclusively on internal control.

SAS 108 reaffirms the requirement from previous standards that the auditor obtain an understanding with the client of the nature of the engagement. While formerly the understanding could be either in writing or made orally, this new standard states that a written understanding is mandated.

While planning the engagement, the auditor may consider whether professionals possessing specialized skills will be needed. Such individuals may include those with information technology (IT) expertise. If such help is needed, the auditor should begin making arrangements and scheduling their work.

SAS 109

SAS 55, “Consideration of Internal Control in a Financial Statement Audit,” is superseded by this standard together with SAS 110.

The guidance regarding understanding the entity and its environment, including its internal control, is expanded upon in SAS 109. The standard explains that one objective of obtaining the understanding is to identify and assess the risk of material misstatement. A second objective is to use the understanding in designing and performing additional audit procedures that are responsive to the assessed risk.

Audit procedures for obtaining the understanding are noted in SAS 109. The procedures to be used include inquiries and observation. Also, inspection and analytical procedures might be employed.

This standard also explains that the auditor is to assess the risk of material misstatements at two levels, the financial statement level and the level of the relevant assertions. The assertions relate to classes of transactions, account balances, and disclosures.

SAS 110

As noted, SAS 110, together with SAS 109, supersede SAS 55, which addressed internal control. Further, the section of SAS 45 entitled “Substantive Tests Prior to the Balance-Sheet Date” is superseded by 110.

Per the new standard, responses to the assessed risk of material misstatement are made at two levels. The auditor may choose to respond at the overall level. Also, responses may be made at the level of the assertion.

When responding at the overall level, the auditor may elect to assign more experienced staff or individuals with specialized skills. Also, plans may be made to perform tests that are less predictable, the timing of the tests may be adjusted, or professional skepticism may be increased. Further, a decision on a substantive approach or a combined approach will be made.

At the assertion level, the nature, timing, and extent of audit procedures can be adjusted in response to the risk of material misstatement. SAS 110 notes that inquiries and observation are audit procedures, as are confirmations and inspection of tangible assets. Also, recalculation, reperformance, analytical procedures, and inspection of records or documents are procedures the auditor might use to respond to the risk of material misstatement at the assertion level.

SAS 110 emphasizes the importance of documentation, noting that the overall response as well as the nature, timing, and extent of audit procedures must be memorialized. Also, the linkage between the risk of material misstatements and the planned procedures should be recorded. Finally, both the results of the procedures and the conclusions reached are to be included in the audit documentation.

SAS 111

SAS 111, updates the guidance regarding both statistical and nonstatistical sampling previously found in SAS 39, entitled “Audit Sampling.” The standard addresses tolerable misstatement, which is used in sampling models as well as components of the audit risk equation.

Tolerable misstatement should be established at a level that is below materiality for the financial statements. By following this guidance, the auditor is allowing for the aggregation of the tolerable misstatements from the various accounts.

Like other standards in the Risk Assessment group, SAS 111 discusses the risk of material misstatement (RMM). The statement reiterates that RMM is composed of inherent risk (IR) and control risk (CR). To facilitate the application of sampling models, the risks in the audit risk equation should be quantified. The auditor makes such quantifications subjectively.

For Forensic Accountants

When performing their own procedures, forensic accountants must comprehend the work that has been performed by the independent auditor. One of the 10 new external auditing standards explains the documentation requirements to which auditors must adhere. Forensic accountants may well be privy to the auditor’s workpapers; thus, an understanding of the mandates for memorializing the engagement is essential to their work. Another SAS discusses terminology related to professional requirements—comprehending whether a certain procedure is unconditionally required of the auditor, is presumed mandatory, or is simply discussed in the statement as critical for the forensic accountant.

The remaining standards, those known as the Risk Assessment Standards, are conceptually related. The audit work resulting from the requirements of these eight SASs should be particularly useful to forensic accountants as they consider areas that are especially prone to misstatements and the results of the procedures already performed by the external audit team. An understanding of the procedures completed aids the forensic accountant both in interpreting the auditor’s findings, and in planning forensic work that delves deeper into the financial aspects of the entity. n

By Jan Colbert, PhD, CPA, DABFA, DABFE, Cr.FA

Abstract

The American Institute of CPAs issued 10 new standards for external auditors. The standards address both documentation requirements for the audit and terminology used in professional mandates. Eight of the standards are collectively known as the Risk Assessment Standards; they focus on assessing the various risks in the audit engagement and on the procedures used by the auditor to address those risks.

The forensic accountant should gain a thorough understanding of the requirements of these new external audit standards. The work completed by the external auditor will be substantially enhanced under these mandates and thus, will yield more information useful to forensic accountants.

Key Words: risk assessment standards, audit evidence, sufficient appropriate evidence

(800) 423-9737 Winter 2007 THE FORENSIC EXAMINER

missing image file

Published by Dr. O’Block

no comment

Mar

Books by ACFEI Members

Posted by admin | Edit Published in THE FORENSIC EXAMINER Winter 2007

(800) 423-9737 Winter 2007 THE FORENSIC EXAMINER

missing image file

Books by ACFEI Members

Physical Abusers and Sexual Offenders

By Scott Allen Johnson, MA, LP

The fields of sexual violence and domestic abuse have long been considered by professionals to be both separate and distinct. However, recent studies have indicated that these two fields are not as divided as previously thought. In his book Physical Abusers and Sexual Offenders, Scott Allen Johnson discusses the similarities between the two fields. Using the cognitive-behavioral approach, he presents issues important to mental health, as well as to investigative and forensic professionals when they assess, investigate, and treat abusers and sexual offenders. He discusses the psychological, emotional, physical, and sexual facets of the abuse cycle from name-calling to complete psychological deconstruction, rape, and homicide.

In his book, Johnson also offers extensive advice on the differing interview methods relative to interrogation or treatment. Additional subjects include the profile of the offender and different types of offenders, the influence of drugs and alcohol, pornography, and genuine mental incapacity. Highly detailed in subject matter, Physical Abusers and Sexual Offenders is the most comprehensive and exhaustive work on the subject to date.

Scott Allen Johnson, MA, LP, is a counseling and forensic psychologist, with extensive experience working with abusers, sexual offenders, and victims of violence. He is a Diplomate of the American Board of Psychological Specialties in Forensic Psychology and an Academy Certified Diplomate of the American Academy of Certified Consultants and Experts. He has been a member of ACFEI since 1998.

Offender Profiling

By George B. Palermo, MD, and Richard N. Kocsis, PhD

The controversial topic of criminal profiling brings to mind mixed reactions, as the field seems to lack a working model on which profiling decisions are based. In their book, Offender Profiling, George B. Palermo and Richard N. Kocsis explore a holistic approach to profiling as they delve into historical, social, and psychological factors.

The book is comprised of three parts. The first part discusses the psychosocial substrate of criminal profiling and includes historical views on the topic. The second part addresses the crime scene and the crime investigator. This section also includes a special chapter on staged crime scenes written by former FBI agents Robert R. Hazelwood and Michael R. Napier. The third part discusses the main approaches to profiling and includes criticisms of the major theoretical research on profiling.

Offender Profiling is easy to read, and the depth of knowledge the authors present is enlightening and of use to any professional involved in criminal work.

George B. Palermo, MD, is a clinical professor of psychiatry and neurology at the Medical College of Wisconsin and an adjunct professor of criminology and law studies at Marquette University. He is the director of the Center for Forensic Psychiatry and Risk Assessment in Milwaukee, Wisconsin. Dr. Palermo is a Fellow of the American College of Forensic Examiners and has been a member since 1994.

Richard N. Kocsis, PhD, is a forensic psychologist in Sydney, Australia where he is active in clinical and research work.

Handwriting & Drawings of Death Row Prisoners

By Kimon Iannetta, DABFE, FACFEI

Careful evaluation of the handwriting of serial killers and other violent offenders can lead to a better understanding of the criminal mind. Kimon Iannetta reviews this theory and explains it in further detail in her book, Handwriting & Drawings of Death Row Prisoners. Iannetta’s premise is that no one is born bad or evil. The author’s research would indicate that violent criminals may have a combination of causes for their behavior, including genetic makeup and emotional trauma. By studying the handwriting of these criminals, the minute details can reveal much about the inner-workings of their brains. Analysis can shed light on the self-image and motivation of offenders. Iannetta even asserts that handwriting can give clues as to what type of murderer the person is. She provides handwriting samples and case studies of criminals throughout her book.

The book includes analyses of various criminals’ handwriting along with what kinds of answers each sample can provide. Criminals include serial killer Christine Falling and Oklahoma City bomber Timothy McVeigh. Additional sections include a project study and a review of literature on psychopathology in handwriting by three major authorities. The intriguing subject matter Iannetta takes on makes this book an interesting read for a variety of audiences.

Kimon Iannetta, DABFE, FACFEI, has been a member of ACFEI since 1996.

no comment

Mar

Investor Turned Murderer: The Story of Albert Walker

Posted by admin | Edit Published in THE FORENSIC EXAMINER Winter 2007

Investor Turned Murderer: The Story of Albert Walker

By Kristin Crowe, Associate Editor

This is a story of deception, denial, false identity, and murder—the stuff novels are made of. In fact, a book, movie, and play have all been created from this story. However, this trail of deception is more than a “good” story. It is the real account of a Canadian man whose tale is finally coming to a close after 17 years.

In 1990, Albert Walker left Paris, Ontario, with his daughter and flew to Britain after embezzling between $2.5 and $3.2 million from his investment clients, many of whom were friends and fellow church members. After fleeing to Britain, he was charged in Canada with 18 counts of fraud, theft, and money laundering in 1993. However, in 1992 he had taken the identity of Ronald Platt, an Englishman who wanted to go back to Canada, where he had spent his youth. Walker paid for Platt’s move to Canada in exchange for Platt’s birth certificate and driving license. It seemed for a while that Walker had disappeared with the money and would get away with his fraudulent activity. However, Walker had not counted on Platt coming back to England. Dissatisfied with the Canadian economy, Platt returned to Britain in 1995, presenting Walker with a dilemma: now, there were two Ronald Platts in Britain. Further, the real Platt had decided to live near where Walker was living with his daughter, who was posing as his wife. In an effort to escape detection, police allege that Walker took Platt sailing, knocked him unconscious, and threw his body overboard after weighting it with an anchor, effectively murdering Platt to cover his fraudulent activity. Platt’s body was discovered when caught in some fishing nets, and police were able to identify the body through a serial number on the Rolex watch Platt was wearing.

In the month between the time that Platt’s body was identified and Walker was found, Walker had bought over 67,000 pounds in gold bullion and seemed to be preparing to run again. British police interrupted his plans, however. He was sentenced to life in prison by a British court in 1998 for the murder of Ronald Platt, although he maintained his innocence of the murder throughout the trial. That same year the Canadian court charged Walker with 37 counts of fraud, which was to replace the 18 counts he had been charged with in 1993. After his conviction of murder, he was sent to a British facility in 1999. He requested transfer to a Canadian prison in 2005 to finish the remainder of his life sentence (without parole for at least 15 years), which was granted. Now 61 years old, he appeared in court again in April of 2007, pleading guilty to 20 theft and fraud-related charges. In July of 2007, Justice Rommel Masse sentenced Walker to 4 years for 19 fraud-related crimes and an additional year for violating the Bankruptcy Act.

Fear of being caught in his fraud led Walker to flee to Britain, and fear of his fraud being uncovered led him to murder Platt. Fraudulent-investor-turned-murderer, Walker’s misdeeds were discovered, and $1 million of the at least $2.5 million has been recovered. It has, however, taken 17 years and almost half a million dollars to do so.

References

Babbage, M. (2007). Convicted killer Albert Walker pleads guilty to 20 theft, fraud-related charges. thespec.com. Retrieved October 3, 2007, from http://www.thespec.com/article/188093

Babbage, M. (2007). Former fugitive Albert Walker expected in Ontario court on fraud, theft charges. thespec.com. Retrieved October 3, 2007, from http://www.thespec.com/article/187485

Biography Channel, The. (n.d.). Biography: Albert Walker. Retrieved October 3, 2007, from http://www.thebiographychannel.co.uk/biogphy_story/978:1144/1/Albert_Walker.htm

Canadian Press, The. (2007, July 24). Albert Walker gets four more years. thespec.com. Retrieved October 3, 2007, from http://www.thespec.com/article/223211

CBC News. (2007, April 26). ‘Fugitive financier’ turned killer pleads guilty to fraud, theft. CBC. Retrieved October 2, 2007, from http://www.cbc.ca/canada/ottawa/story/2007/04/26/walker-fraud.html n

no comment

Mar

The Sub-Classifications of Criminal Enterprise Homicide

Posted by admin | Edit Published in THE FORENSIC EXAMINER Winter 2007

The Sub-Classifications of Criminal Enterprise Homicide

Contract killing: A contract killer is one who kills by secret assault or surprise for profit. There is usually an absence of relationship between the killer and victim.

Gang-motivated: A gang is an organization, association, or group that has as one of its primary activities the commission of antisocial behavior and criminal acts, including homicide. Homicides are associated with territorial struggles.

Criminal competition: Death in this type of homicide is a result of organized crime over control of territory.

Kidnap murder: Kidnap murder designates persons taken against their will and for a variety of motives, such as a demand for ransom.

Product tampering: Death results from contact with a commercial product that has been sabotaged by the offender whose motive is financial gain.

Drug murder: Defined as the murder of an individual deemed an obstruction in order to facilitate the proliferation of an illegal drug business.

Insurance/Inheritance: The victim is murdered for insurance and/or inheritance purposes.

Commercial profit: Murder to gain control of a business or to profit from the business.

Felony-murder: Property crime (robbery, burglary) is the primary motivation, where during the commission of a violent crime, a homicide occurs.

(800) 423-9737 Winter 2007 THE FORENSIC EXAMINER

White-collar criminals are not people who are threatening the lives of others. They are not violent people.”

Inaccurate statement of a Federal District Court Judge commenting on white-collar criminals (Wheeler, Mann & Sarat, 1988).

There were several email correspondences between Porco and his parents that exemplified the tension between the parties when the parents confronted him about his fraudulent behavior and threatened to go to the authorities to take action against him. In one email, his father wrote: “Did you forge my signature as a co-signer? What the hell are you doing? You should have called me to discuss it … I’m calling Citibank this morning to find out what you have done and am going to tell them I’m not to be on it as co-signer” (Lyons, 2005).

The next day, Citibank informed an amazed Peter Porco that his son had also obtained a line of credit to purchase his new Jeep Wrangler. Again, Christopher had used his father’s name as co-signatory to secure the auto loan. The parents tried to contact Christopher via the phone, but Christopher would not talk to them. In another email, the father wrote, “I want you to know that if you abuse my credit again, I will be forced to file forgery affidavits in order to disclaim liability and that applies to the Citibank college loan if you attempt to reactivate it or use my credit to obtain any other loan” (Lyons, 2005).

missing image file

Table 1: Perri’s Red-Collar Matrix

Pattern

Characteristics

THE FORENSIC EXAMINER Winter 2007 www.acfei.com

Underlying

White-collar Crime

Idolatry

Mental Disorder

Weapon Used

Source of Violence

Place of Murder

Fraud Detection by Victim/3rd Party?

Victim participate in WCC?

Victim (Gender)

Victim (Age)

Victim Injury

Victim (Race/Ethnicity)

Victim’s Body Found?

Victim’s Occupation

Victim Occupational Status

Victims Related to Each Other?

Victim Related to Defendant?

Victim Debt Problems

Victim have a Prior Criminal Record?

Defendant (Gender)

Defendant (Age)

Defendant (Race/Ethnicity)

Defendant’s Occupation

Defendant’s Occupational Status

Defs. Related to Each other?

Defendant Debt Problems?

Defendant Prior Criminal Record?

Defendant Relationship to Victim

Found Guilty by Jury?

Offense (Murder)

Defendant Admit to Murder?

Overkill?

Incriminating Statements?

Concealment of Evidence?

Blood Splatter Evidence?

Computer Evidence?

DNA Evidence?

Murder Plan?

Shoe Print Evidence?

Case 1

Hansen

Embezzlement

Fraud

Mafia

Hammer

Defendant

Victim Office

Victim

Female

Head

White

Yes

Bookkeeper

White-collar

Unknown

Male

White

Salesperson

White-collar

Yes

Coworker

Yes

1st Degree

Yes

Case 2

Dyleski

Credit Card

Fraud

Jack the Ripper

Unknown

Blunt/knife

Defendant

Victim Home

3rd party

Female

Head

White

Yes

Executive

White-collar

Unknown

Male

White

Student

Unknown

None

Yes

1st Degree

Yes

Case 3

Fawaz

Mortgage

Fraud

Unknown

Blunt object

Defendant

Victim Office

3rd party

Unknown

Male

Head

Arabic

Student

White-collar

Unknown

Male

Arabic

Loan Proc.

White-collar

Unknown

Coworker

Yes

2nd Degree

Yes

Unknown

Yes

Unknown

Case 4

Farraj

Mortgage

Fraud

Unknown

Blunt object

Defendant

Victim Office

3rd party

Unknown

Male

Head

Arabic

Student

White-collar

Unknown

Male

Arabic

Loan Officer

White-collar

Unknown

Coworker

Yes

2nd Degree

Yes

Unknown

Yes

Unknown

Case 5

Porco

Loan

Fraud

Unknown

Defendant

Victim Home

Victim

Male

Head/body

White

Yes

Executive

White-collar

Yes

Male

White

Student

Yes

Son

Yes

2nd Degree

Yes

Unknown

Case 6

Bernal

Mortgage

Fraud

Unknown

Gun

Defendant

Victim Home

Victim/3rd

Female

Head

White

Yes

Bus. owner

White-collar

Yes

Unknown

Female

Hispanic

Real Estate

White-collar

Yes/Cousin

Unknown

Bus. Assoc.

1st Degree

Yes

Unknown

Yes

Unknown

Case 7

Bernal

Mortgage

Fraud

Unknown

Gun

Defendant

Victim Home

Victim/3rd

Male

Head

White

Yes

Bus. owner

White-collar

Yes

Unknown

Male

Hispanic

Real Estate

White-collar

Yes/Cousin

Unknown

Bus. Assoc.

1st Degree

Yes

Unknown

Yes

Unknown

Case 8

Barajas

Mortgage

Fraud

Unknown

Gun

Defendant

Victim Home

Victim/3rd

Female

Head

White

Yes

Bus. owner

White-collar

Yes

Unknown

Male

Hispanic

Handyman

Blue-collar

Yes/Cousin

Yes

Unknown

None

Yes

1st Degree

Yes

Unknown

Yes

Unknown

Case 9

Barajas

Mortgage

Fraud

Unknown

Gun

Defendant

Victim Home

Victim/3rd

Male

Head

White

Yes

Bus. owner

White-collar

Yes

Unknown

Male

Hispanic

Handyman

Blue-collar

Yes/Cousin

Yes

Unknown

None

Yes

1st Degree

Yes

Unknown

Yes

Unknown

Case 10

Johnson

Insurance

Fraud

Unknown

Gun

Defendant

Victim Home

Victim/3rd

Yes

Male

Unknown

Head

White

Yes

Editor

White-collar

Unknown

Male

White

Lawyer

White-collar

Unknown

Yes

Co-conspir.

Yes

1st Degree

Unknown

Off-Book

Fraud

Unknown

Gun

Defendant

Victim Home

Victim

Male

Head

White

Yes

Music Tracker

Unknown

Male

White

Record Promoter

White-collar

Unknown

Coworker

Yes

1st Degree

Unknown

Case 11

D’Antonio

Case 12

Petrick

Check/Credit

Card Fraud

Unknown

Tape/Chains

Defendant

Unknown

Victim

Female

Asphyxiated

White

Yes

Musician

White-collar

Yes

Unknown

Male

White

Consultant

White-collar

Yes

Husband

Yes

1st Degree

Yes

Unknown

Yes

Unknown

Land

Fraud

Unknown

Bomb

Defendant

Public

Victim

Male

Body

White

Yes

Reporter

White-collar

Unknown

Male

Unknown

White

Business Owner

White-collar

Unknown

None

Yes

2nd Degree

Yes

Unknown

Yes

Unknown

Case 13

Adamson

(800) 423-9737 Winter 2007 THE FORENSIC EXAMINER

Case 14

Dunlap

Land

Fraud

Unknown

Bomb

Defendant

Public

Victim

Male

Body

White

Yes

Reporter

White-collar

Unknown

Male

White

Land Developer

White-collar

Unknown

None

Yes

1st Degree

Yes

Unknown

Yes

Unknown

Case 15

Gaede

ID Fraud

Unknown

Gun

Defendant

Defs. Home

3rd Party

Male

Unknown

Body

White

Yes

Painter

Blue-collar

Unknown

Male

White

Manager

White-collar

Unknown

Friend

Yes

1st Degree

Yes

Unknown

Yes

Unknown

Case 16

Basile

Insurance Fraud

Unknown

Gun

Defendant

Victim Home

Victim

Female

Body

White

Yes

Unknown

Male

Unknown

White

Unknown

Yes

None

Yes

1st Degree

Unknown

Yes

Unknown

Case 17

S. Kimes

Mortgage Fraud

Unknown

Yes

Gun

Defendant

Victim Home

Victim

Yes

Male

Head

White

Yes

Businessman

White-collar

Unknown

Female

White

None

Yes

Unknown

Yes

Friend

Yes

1st Degree

Yes

Unknown

Yes

Unknown

Case 18

K. Kimes

Mortgage Fraud

Unknown

Gun

Defendant

Victim Home

Victim

Yes

Male

Head

White

Yes

Businessman

White-collar

Unknown

Male

White

None

Yes

Unknown

Yes

Friend

Yes

1st Degree

Yes

Unknown

Yes

Unknown

Case 19

Hanson

ID Fraud/

Forgery

Unknown

Gun

Defendant

Victim Home

Male

Head

White

Yes

Bus. Owner

White-collar

Yes

Unknown

Male

White

None

Unknown

Father

Pending

1st Degree

Unknown

Case 20

Hanson

ID Fraud/

Forgery

Unknown

Gun

Defendant

Victim Home

Female

Head

White

Yes

Unknown

Yes

Unknown

Male

White

None

Unknown

Mother

Pending

1st Degree

Unknown

Case 21

Hanson

ID Fraud/

Forgery

Unknown

Blunt Force

Defendant

Victim Home

Male

Body

White

Yes

Unknown

Yes

Unknown

Male

White

None

Unknown

Brother-in-Law

Pending

1st Degree

Unknown

Case 22

Hanson

ID Fraud/

Forgery

Unknown

Blunt Force

Defendant

Victim Home

Female

Body

White

Yes

Unknown

Yes

Unknown

Male

White

None

Unknown

Sister

Pending

1st Degree

Unknown

Case 23

Gamov

Money Laundering

Unknown

Arson

Unknown

Victim Home

Victim

Male

Unknown

Body

White

Yes

Gov. Employee

White Collar

Unknown

Yes

Unknown

Case 24

Kholodov

Off-Book

Fraud

Unknown

Bomb

Unknown

Victim Office

Victim

Male

Unknown

Body

White

Yes

Reporter

White-collar

Unknown

Yes

Unknown

Yes

Unknown

Case 25

Klebnikov

Money

Laundering

Unknown

Gun

Unknown

Public

Victim

Male

Head

White

Yes

Reporter

White-collar

Unknown

Yes

Unknown

Yes

Unknown

Case 26

Hovasapian

Tax

Fraud

Unknown

Bomb

Unknown

Victim Home

Victim

Male

Unknown

Body

White

Yes

Gov. Employee

White-collar

Unknown

Yes

Unknown

Yes

Unknown

Case 27

Kozlov

Tax

Fraud

Unknown

Gun

Unknown

Public

Victim

Male

Head

White

Yes

Gov. Employee

White-collar

Unknown

Male

Unknown

Banker

White-collar

Unknown

None

Unknown

Pending

Yes

Unknown

Yes

THE FORENSIC EXAMINER Winter 2007 www.acfei.com

Exhibit 1: The Personality and Behavioral Traits Identified by Hare (1991).

Psychopathy Personality Traits & Behavioral Characteristics

Glibness/superficial charm
Grandiose senses of self-worth
Need for stimulation/proneness to boredom
Pathological lying
Conning & manipulative
Lack of remorse or guilt
Shallow affect
Callous & lack of empathy
Parasitic lifestyle
Poor behavioral controls
Promiscuous behavior
Early behavioral problems
Lack of realistic short-term
goals
Impulsive
Irresponsible
Fails to take responsibility for
one’s actions
Many short-term marital/inter-
personal relationships
Juvenile delinquency
Revocation of conditional
release
Criminal versatility

To view additional articles offering CE credits, visit http://www.acfei.com/onlinece.php?section=Articles

(800) 423-9737 Winter 2007 THE FORENSIC EXAMINER

There are, perhaps, those who are simply born with psychopathic traits and who conceal them until the proper factors converge and reveal those traits.”

Exhibit 2: Fraud-Detection Homicide Investigation Profile

I. Employment of victim

II. Business owner or employee

III. Victim occupational status:
blue-collar or white-collar

IV. Criminal history of victim

A. White-collar crimes

B. Violent crimes

V. Victim’s source of income (tax
returns, bank statements, etc.)

VI. Fraud detection by victim

A. Was the victim in a

position to detect fraud?

B. Notice to defendant of
the detection by victim

C. Did the victim cooperate
and/or give notice to a third
party concerning defendant’s

fraud?

VII. Third party detection of the
defendant’s fraudulent behavior
without victim’s assistance

VIII. Fraudulent behavior of the victim

A. Would the victim have had
a reason to commit fraud?

1. Support lifestyle

2. Debt problems

3. Addiction issues

B. How would the victim
commit the fraud?

IX. Type of fraud involved

X. Potential fraud co-conspirators
(examine computer evidence
such as email)

XI. Did the victim have reason
to fear retaliation by the

defendant for fraud detection
or disclosures to witnesses?

XII. History of business conflicts
between victim, customers,
or business associates

XIII. Third party business records
indicating fraudulent behavior
(fraudulent loan applications, etc.)

This article published by Dr. Robert O’Block

no comment

Mar

Faud Detection Homicide

Posted by admin | Edit Published in THE FORENSIC EXAMINER Winter 2007

missing image file

Abstract

Behavioral data were located from 27 homicide cases in which fraud, a white-collar crime, occurred either prior to or contemporaneously with each homicide. The homicide cases in this study were classified as fraud-detection homicides because either white-collar criminals themselves, or assassins they hired, killed the individuals suspected of detecting their fraud. The white-collar criminals who committed murder were sub-classified as red-collar criminals.

Both the descriptive homicide data and the literature review lend support to three overriding impressions: red-collar criminals harbor the requisite mens rea, or state of mind, to physically harm someone that may have detected, or is on the verge of detecting, their fraudulent behavior; the victim of a red-collar crime does not have to be someone who profiteered, aided, or abetted in the fraud; and red-collar criminals have a history of antisocial and psychopathic tendencies. Given these conclusions, advocacy for consideration of forensic accountants and fraud examiners as members of homicide investigation teams to assist in the development of a motive to support the prosecution of red-collar criminals is in order.

Data gathered in the course of this study indicate the presence of a sub-classification of white-collar criminals who are violent and the need for a new homicide classification to be referred to as fraud-detection homicide for inclusion in the FBI’s Crime Classification Manual (Douglas, 1992) as an appropriate system for classifying and profiling these murders.

missing image file

CE Article: (CERTIFIED FORENSIC CONSULTANT, CFC) 1 CE credit for this article

I would have had the

[expletive] wasted, but I’m not sorry for feeling this way. I’m sorry that I didn’t rub her out, real sorry.”

Statement of a convicted white-collar criminal regarding the woman who disclosed his fraud crimes to the authorities (Addis, 1986).

Criminal Classification Manual:

Fraud-Detection Homicide

THE FORENSIC EXAMINER Winter 2007 www.acfei.com

This article is approved by the following for continuing education credit:

(ACFEI) The American College of Forensic Examiners International provides this continuing education credit for Diplomates.

(CFC) The American College of Forensic Examiners International provides this continuing education credit for Certified Forensic Consultants.

(CBBS) The American College of Forensic Examiners International is an approved provider of the California Board of Behavioral Sciences, approval PCE 1896. Course meets the qualifications for 1 hour of continuing education credit for MFTs and/or LCSWs as required by the California Board of Behavioral Sciences.

(APA) The American College of Forensic Examiners is approved by the American Psychological Association to sponsor continuing education for psychologists. ACFEI maintains responsibility for this program and its content.

(NBCC) The American College of Forensic Examiners International is an NBCC Approved Continuing Education Provider (ACEP) and may offer NBCC approved clock hours for events that meet NBCC requirements. The ACEP soley is responsible for all aspects of the program and its content.

By Frank S. Perri, JD, MBA, CPA, and Terrance G. Lichtenwald, PhD, FACFEI

One of the misconceptions commonly held of white-collar criminals is that they are not like criminals who lash out violently. In part, this perception is supported by a legal system that classifies white-collar crimes as non-violent. For example, the Dictionary of Criminal Justice Data Terminology, published by the Federal Bureau of Justice Statistics, defines white-collar crime as “non-violent crime for financial gain committed by means of deception . . . irrespective of the person’s occupation” (1981). The study at hand examined types of white-collar crime involving issues of fraud-based crime.

The descriptive data indicates that a sub-group of violent white-collar criminals exists and, moreover, that certain behavioral factors motivate a white-collar criminal to resort to violence. The data has been examined with a single question in mind: Is imminent threat of detection a sufficient motive for the white-collar criminal to respond violently?

The Perri Red-Collar Crime

Matrix (RCM)

Examining 27 murder cases revealed that for this sub-group of violent white-collar criminals, threat of fraud detection is a motive to kill—hence the name, fraud-detection homicide. This sub-group is referred to as red-collar criminals because they straddle both the white-collar crime arena and, eventually, the violent crime arena. In circumstances where there is threat of detection, red-collar criminals commit brutal acts of violence to silence the people who have detected their fraud and to prevent further disclosure.

First, information was assembled from murder cases where fraud pre-dated the murder, and second, for the purpose of visual comparison, information from each case was broken down into identifiable variables (i.e., type of fraud, age and gender of defendant, relationship to victim, etc.). The Perri-RCM was developed to distinguish behavioral inferences from other evidence gathered during both the investigation and subsequent trials. Clearly, the pattern characteristics in the Perri-RCM are not all-inclusive, and as more cases are analyzed, the Perri-RCM can be modified to accommodate additional characteristics that may be useful for profiling.

Third, the information was structured into a matrix. In each case where the murderer (defendant) was involved in the fraud, the case is identified by the defendant’s last name, which appears at the top of the matrix (see Table 1). For example, Case 1 is titled “Hansen.” George Hansen served as the initial case study, thus the case is identified by his last name. The only cases not listed by the name of the defendant (but include the names of the victims) are the Gamov (23), Kholodov (24), Klebnikov (25), Hovasapian (26), and Kozlov (27) cases. In these cases, the killers have not been brought to justice.

To begin, the proposed crime classification, fraud-detection homicide, is compared to the existing FBI homicide classification to illustrate why fraud-detection homicide should be considered as a separate classification. Secondly, where the behavioral aspects of red-collar criminals are compared to those of non-violent white-collar criminals, the focus is limited to concerns of psychopathy, societal misconceptions of murder defendants, ideation factors, and actual homicide case studies illustrating fraud-detection homicide.

In an interesting aside, red-collar Russian cases are compared to American murders. And finally, the role of forensic investigators in uncovering homicidal motive and its importance in the prosecution of these defendants is discussed.

Fraud-Detection Homicide and Criminal Enterprise Homicide: A Distinction

A literature review does not reveal any classification or definition for white-collar criminals who murder due to their fraud crimes being detected; further, the FBI Crime Classification Manual (CCM) (Douglas, 1992) does not include an appropriate category for the murder cases scrutinized in this study.

The FBI classification most similar to the homicides presented in this study was the criminal enterprise homicide classification; however, the classification does not fit this study’s fact patterns. Criminal enterprise homicide “entails murder committed for material gain.”

A review of the nine definitions of the criminal enterprise homicide sub-classifications demonstrates the distinctive nature of fraud-detection homicide cases—cases that do not fit into any of the sub-classifications for criminal enterprise homicide most significantly because the killer’s motive in fraud-detection homicide does not parallel the motives in the criminal enterprise homicide sub-classifications. None of the sub-classifications offers fraud detection as a motive to kill.

Secondly, by the sub-classification definitions, in order to receive the hoped-for material gain, the murder must first occur. However, in fraud-detection homicide, the material gain pre-dates the murder—it is the threat of detection that motivates the kill. For example, in insurance/inheritance homicide, the murder is the conditional antecedent event that must take place in order to receive the gain; whereas, in the fraud detection homicide case, the killer already has received the material gain, and murder is not a pre-condition for its receipt.

A new homicide classification system is recommended to categorize the type of murders presented in this study, and the FBI Crime Classification Manual would seem an appropriate forum for categorizing and profiling these homicides. With the inclusion of fraud-detection homicide in the manual, collected data on these killers can be further researched and the traits attributed to red-collar criminals can be refined.

The Threat of Fraud Detection—A Motivation for Murder

In each of the 27 cases presented, the murderer(s) belonged to the sub-group of red-collar criminals, and each demonstrated the capability of unleashing heinous and brutal violence toward individuals they believed had detected, or were in a position to detect, their fraud schemes and potentially reveal such information to third parties.

Initially, and prior to any violent act, the white-collar criminal characteristics were predominant in each murderer. As white-collar criminals, they wished to divert attention from their fraudulent schemes. Unlike other homicides, violent white-collar criminals who turn red prefer to operate clandestinely without attracting attention to themselves, though it is fair to suspect that each red-collar murderer realized that in committing a violent act, he or she was potentially increasing the risk of exposure.

The data reveal the following: each murderer had fraud detection as a motive to kill; a blitz-style attack occurred in 21 out of 27 murders; and the killers demonstrated sadistic tendencies—overkill occurred in 19 out of the 27 murders. In referencing the Perri-RCM, it is interesting to note that in the majority of the American cases revealing overkill, the defendant intimately knew the victim; for example, the victim was either a relative or had been a coworker.

The behavioral data raises questions about the extent to which red-collar criminals are willing to assume risk of detection (both for the violent act and for the underlying white-collar crime) in order to maintain anonymity. In some respects, the suggestion that the red-collar criminal is willing to risk exposure in order to maintain anonymity appears contradictory. Yet, the inclination to physical violence as a solution distinguishes these fraudsters from non-violent white-collar criminals.

Psychological Factors

The misconception that white-collar criminals are not like violent criminals is widely held. Those who hold this view argue that white-collar criminals experience a moral lapse, and then engage in fraudulent behavior. The misconception of nonviolence and moral lapse is reflected in our legal system where crimes involving fraud are referred to as crimes of moral turpitude. Crimes of moral turpitude reflect behavior that violates moral sentiment or accepted moral standards of the community. Although street criminals are assumed highly likely to recidivate, white-collar offenders are thought to be “one-shot” criminals, not likely to be processed into the justice system following an initial brush with the law.

Weisburd, Chayet, and Waring (1990), however, provide data that does not support this popular belief regarding the limited criminal activity of white-collar criminals. They found that adult defendants convicted under white-collar crime statutes are often repeat offenders. The results of the Weisburd et al. study contradict the prevailing notion that if white-collar criminals do engage in violent acts such as murder, the act is, somehow, a fluke—an act analogous to a crime of passion where the person’s state of mind would normally not commit such vicious violence, and where there is little or no likelihood for relapse.

Both literature and data suggest that the red-collar sub-group is capable of functioning in conventional society, to a large measure, because so few grasp, until a murder arrest is made, that red-collar criminals are truly different from both white-collar criminals and ordinary people. It is incorrect to assume that both white-collar and red-collar criminals share the same value system with the majority of society solely on the basis of the observation that they engage in many of the same “normal” societal activities—they work, go to school, have families—in other words, they “blend in” (Hare, 1993).

Many cannot resolve the cognitive dissonance that occurs among members of a community who are asked to believe that a red-collar criminal who has assimilated so well—wearing suits and ties and belonging to many of the same social groups as they do—is capable of murder. In short, we resist the notion that people who look like “us” behave brutally. Red-collar criminals feed upon this misconception to create smoke screens about their motives.

A background investigation of the red-collar criminals identified on the Perri-RCM does not support the suggestion that these persons somehow acted out of character when they committed murder. In fact, quite the opposite holds true: the capacity to kill without remorse was a seed inherent in the red-collar criminal that germinated when the proper conditions surfaced.

Psychopathy

As suggested by the Hare Psychopathic Checklist (see Exhibit 1), the defendants listed in the Perri-RCM had documented histories of exhibiting both antisocial behaviors as well as moderate to above-moderate psychopathic traits—such as being superficially charming, egocentric, insincere, manipulative, and exploitative—all for the sake of self-gratification. For example, the forensic psychologist in the Sante Kimes cases, Dr. Arthur Weider, stated that Sante demonstrated psychopathic personality features with “no guilt, conscience, remorse, or empathy;” adding that Sante was “socially charming, arrogant, full of herself, [and] egocentric coupled with a superiority complex” (King, 2002). In the Hansen (1), Porco (6), and Kimes cases (17–18), professionals knowledgeable in psychopathy agreed that all these defendants exhibited psychopathic traits.

The murderers cited in the Perri-RCM are persons who considered themselves extremely clever and who rarely learned from past negative experiences. Prior police encounters had no bearing on their current antisocial behavior, as in the Petrick case (12), where the defendant had numerous prior convictions for fraudulent behavior. Even though many of the red-collar criminals did not have criminal histories, they had exhibited antisocial behavior—they simply had not been caught. A unifying characteristic of the defendants in the Perri-RCM was the ability to assess the vulnerabilities of both the organizations and individuals from whom they stole.

On the May 4, 2005, CNN airing of the Larry King Show titled, “Inside the Mind of a Psychopath,” veteran FBI profiler Gregg McCrary said, “I think psychopaths are the best natural psychologists out there . . . they read vulnerabilities, they read people, and they can exploit those things fairly well” (CNN, 2005). Another member of King’s panel, Dr. Martha Stout, psychologist and instructor at Harvard Medical School noted, “a psychopath doesn’t have to fit all of the traits. I think three or more [traits] begins to make you suspect that you’re dealing with a sociopath or a psychopath” (CNN).

The criminals studied demonstrated an inability to accept defeat and had little remorse or guilt for their predatory attitudes. In some respects, the red-collar criminal exhibits reptilian qualities of deception and attack; they are true “intra-species predators” that use violence to control others (Hare, 1993). The presiding judge in one of the Sante Kimes cases stated, “It is clear that Ms. Kimes has spent virtually all of her life plotting and scheming, exploiting, manipulating, and preying upon the vulnerable and the gullible at every opportunity” (King, 2002). As for her son Kenny, he too was a “remorseless predator” (King).

In the case of fraud detection, red-collar criminals perceive the fraud detection as an existential threat, a blow to their self-concept, and, consequently, as an act of “self” preservation, they are willing to resort to violence. As the threat of detection increases, so does the probability that the individual will rationalize murder as a solution to his or her problems. In the Hanson case (19–22), when the sister had detected her brother’s fraud, he threatened to kill her if she told their parents that he was stealing thousands of dollars from them through fraud schemes (Rozek, 2007).

In the Hansen (1), Porco (5), Dyleski (2), Bernal (6 & 7), Barajas (7 & 8), and Petrick (12) cases, sadistic violence was unleashed shortly after these criminals realized that their white-collar behavior might be exposed to the authorities. Either they had been confronted by the victim about their wrong-doing or the probability of detection was very high. The red-collar criminal’s sudden outburst is a response to perceived provocation and is enough to propel him or her to commit violence (Hare, 1993). The case histories in the Perri-RCM further bear this out, and this is why so many of the murders have a “blitz-like” quality.

Poor behavioral controls and poor planning abilities also explain why the red-collar criminal is incapable of becoming a successful violent criminal (Perri & Lichtenwald, in press, b). For example, Christopher Porco used an axe to kill his sleeping father in bed, but tried and failed to murder his mother, who was sleeping next to her husband.

Warning signs of the younger Porco’s psychopathic qualities were later confirmed by professionals evaluating the case. He had left a trail of deceitful behavior: he was known to have manipulated college transcripts, he had burglarized both his parents’ home and that of his former employer, and he had fraudulently obtained loans using his parents as co-signers without their knowledge. During a six-hour police interview, he revealed further traits associated with psychopathy: lying, impulsivity, grandiosity, callousness, lack of remorse, and no emotional response to the murder (Porco, 2005).

Behavioral Distinctions between Red- and White-Collar Criminals

Non-violent psychopathic white-collar criminals share similar psychopathic attributes with red-collar criminals, however, the distinction for the red-collar criminal lies in the factors that contributed to and defined their personalities and allowed them to perceive violence as a viable solution (Belmore & Quinsey, 1994). In an email to the lead author of this project, Dr. Willem Martens (2003) wrote, “the internal world of the psychopath is very complex and is determined by many dimensions.” Many white-collar psychopaths exhibit antisocial traits, but not violent traits, as verified by their criminal histories. What might be an explanation for the distinction?

Although not specifically referring to violent white-collar criminals, Martens’ (2003) research indicates that violent psychopaths may have determinants such as deep-rooted antisocial coping strategies as a result of past negative environmental factors. Thus, if an individual already harbors psychopathic traits, being raised in an extremely antisocial environment may solidify the use of violence as a solution. Violence is perceived as an effective strategy to reach goals, especially if the psychopath perceives the world as a snake pit where there are only winners and losers. Psychological restraints on their criminal behavior are weakened by their jungle view of society (Stotland, 1977). In addition, research has shown certain neurobiological factors to be linked to impulsivity, recklessness, and violence; further, violent psychopaths may also have a need to restore their sense of self by silencing the victim whom they believe is threatening to them in some manner (Martens, 2003).

Dr. Martens’ research is supported by other researchers who consider dysfunctional environment a factor to consider; however, one is compelled to examine cases where there is no evidence of a negative environment. Take, for example, the Porco case where all indicators pointed to anything but a poor environment. He came from an upper-middle class home, received quality parenting, and had siblings who were well-adjusted. Chris Porco had the upbringing of a privileged child.

The Porcos of the world force researchers to consider that there are, perhaps, those who are simply born with psychopathic traits and who conceal them until the proper factors converge and reveal those traits.

Mal Animo: “Evil Mind”

One must consider what lies at the core of the violent psychopath’s personality structure: red-collar criminals do not reject violence as a solution to a perceived problem, so killing is just as viable a solution as using deceptive and manipulative characteristics to satisfy their needs. At their core, they harbor a toxicity that does not exist in, or is not as pronounced in, the non-violent psychopathic white-collar criminal. The red-collar criminal is capable of hiding his or her “core” from others by relying on psychopathic traits such as charm and manipulation as an interpersonal strategy.

A case (not included in the Perri-RCM as information is still being collected on the case) deserving of disclosure as a bona-fide fraud-detection homicide case representative of the pure evil of the defendant’s “core” is the Fredric Tokars case.

In this case, a prominent defense attorney in Atlanta, Georgia, hired one of his clients to kill his wife Sara because she had discovered documents concerning Fredric’s tax fraud and drug money laundering. Fredric told one of his associates, “[Sara] knows too much . . . I’m going to have to have her taken care of” (McDonald, 1998).

One of the prosecutors in the case stated that Sara could have destroyed Fredric with the fraud she had detected. “Sara,” he said, “was a ticking time bomb” (McDonald, 1998). Consequently, one of the hired killers shot Sara with a shotgun blast to her head while she was in the family car—their two young sons were in the backseat. Fredric’s response to an associate who asked how his children would react to their mother’s death was, “They’ll be alright . . . they’re young, they’ll get over it.” Dr. Katherine Ramsland noted in the Larry King interview, “we don’t know this for sure yet, but it may be the case . . .[that some who commit evil] are born to be that [psychopaths]” (CNN, 2005).

The non-violent psychopathic white-collar criminal also has a core that is destructive, but one could, perhaps, characterize it as bitter, rather than evil. According to Martens (2003), fraudsters sublimate their aggression into conning activities to avoid physical violence that might cause a negative consequence, such as getting arrested. Moreover, the non-violent psychopath may be able to better assess the risk-reward tradeoff associated with committing a violent act. Yet, Martens (2003) acknowledges that, although psychopathic white-collar criminals are non-violent, this does not imply that they are not destructive in their own way, but that they manifest their destruction differently. Their methods might be characterized as a “slow bleed.” Thus, we have psychopathic white-collar criminals who bring down organizations that are forced to claim bankruptcy, leaving hundreds without livelihoods and/or investments.

In one white-collar crime study known as the Maxwell Scandal, Dr. Basia Spalek (1999) examines the impact of white-collar crime on the victims. In this case, the white-collar criminal, Robert Maxwell, had stolen countless millions of dollars from investors. In the study the author was able to reveal through interviews with the victims that they experienced psychological, emotional, physical, behavioral, and financial harm.

The results of the study revealed that the harmful impact of fraud is similar in its force to the experience of victims of physical violence and property offenses. Some had, in fact, been the targets of other property and assault crimes unrelated to the fraud, and they stated that the impact the fraud had on their lives in terms of victimization was worse than the impact of assault and property crimes (Spalek, 1999).

Too often the “non-violent” quality of white-collar crime is what incorrectly distinguishes between types of criminals; that somehow white-collar criminals are inherently different from other criminals. Yet, such may not be the case. A study by Walters and Geyer (2004) found that male white-collar criminals with a criminal background exhibited the same level of deviant criminal thinking as other criminals.

The Devil’s Trident

Trying to categorize the seriousness of the criminal’s harms into violent versus non-violent is incomplete, overly simplistic, and ignores the true social harms that non-violent white-collar criminals perpetrate on society. Examining the level of aggression as a continuum of social harm offers a more well-rounded approach in observing the extent and depth of a person’s sense of malice, whether based on a violent crime or fraudulent crime.

Interestingly, the legal concept of malicious injury as defined by Black’s Law Dictionary (1999) takes into account the evil aspect of one’s intent not only as it applies to violent acts, but also as it applies to fraudulent behavior. The essentially different forms of harm by which the psychopath can manifest his or her aggression may be visualized in terms of a devil’s trident. There is a prong on the trident used to harm someone emotionally, another prong that can be used to harm someone financially, and another prong that can be used to harm someone physically. Some individuals use all the trident’s prongs to impale a victim. Some choose to impale a victim using only the emotional and financial prongs; such is reflective, for example, of a non-violent fraudster. The predatory quality of some white-collar criminals resembles an exploitive nature analogous to a violent predatory criminal, yet manifested in a different form.

Ideation as an Influencing Factor

It has yet to be determined in what ways ideation can be a factor in the acceleration of violence as a solution for red-collar criminals. Two of the cases in the Perri-RCM appear to represent red-collar criminals who harbored an idealization of extremely antisocial characters. In the Hansen case, the defendant appeared to romanticize the idea of the mob. He associated with members of the Chicago Mafia and enjoyed their company (People v. Hansen, 2004). Scott Dyleski enjoyed lifestyles associated with goth music, had a fascination with serial killers, idolized Jack the Ripper (Lee, 2006), drew “bloody death scenes” (Sweetingham, 2006c), and wrote dark poetry that included such troubled lines as “Live for the kill” (“Court TV News,” 2006).

The behavioral data for the cases in the Perri-RCM does not include movies, books, music, clothing, posters, or other symbolic items that might link the murderers to those whom they may have imitated as a form of hero worship, but such material may be of interest in future cases of fraud detection homicide.

Ideation as idealization of mafia or Jack the Ripper legends may have further defined, solidified, and strengthened these killers’ core personality structures, where these types of symbols represent a form of empowerment. In Scott Dyleski’s mind, if Jack the Ripper had been a successful killer, then he too could emulate that success.

Societal Misconceptions of Murder

The question surfaced in the scrutiny of the Dyleski case as to how his anger at the possibility of not receiving the goods he had fraudulently ordered could escalate to the degree that he would commit murder (Sweetingham, 2006b), and herein lays the misconception. For Scott Dyleski, the issue was not about anger, but about using murder as a solution to a problem.

The fact that he performed the murder in a sadistic manner does not correlate the act to the amount of anger he felt. One observes how societal perception incorrectly projects a non-psychopathic explanation onto the murder by attempting to inure an emotion to the killer to suggest that, somehow, the defendant’s anger was the impetus for the killing. The data suggest that the killers had no doubt that the solution to their perceived problem of fraud detection would be successful, and like a reptile, emotions did not play a part in their decision-making process.

Fraud-Detection Homicide Case Studies

The following case studies, which can be found in the Perri-RCM, provide detailed information concerning specific red-collar crimes that were committed.

Sante and Ken Kimes

After having detected that both Sante and Ken Kimes had committed mortgage fraud by attempting to obtain a loan in his name, the victim, David Kazdin, began to receive threatening telephone calls from the killers demanding that he cooperate with the fraud scheme. After speaking to Kazdin on several occasions, Sante told her son, “He knows too much and we got to do something about him” (Sweetingham, 2004a). “We’re gonna have to kill him” (Sweetingham, 2004b). As Kenny was heading out the door she said, “Good luck. Do a good job” (Sweetingham, 2004b).

Ken Kimes said in a statement to authorities that he shot the victim in the back of the head because he and his mother believed that their fraud scheme to obtain $280,000 was about to be exposed and that the victim had, in fact, notified the lenders (Sweetingham, 2004b).

George Hansen

During the Christmas holiday season of 2004, 69-year-old Mary Anne Clibbery died, having been bludgeoned in the head with a hammer by her business partner George Hansen. According to both the court record and police reports, prior to the murder, Hansen had misappropriated more than $50,000 from the business that year.

Throughout 2004, as Clibbery’s detection of financial irregularities increased, a series of incidents began to surface; apparent attempts at drug-laced food, arson, and tampering with car brakes lent support to Mary Anne Clibbery’s suspicion that George Hansen was trying to kill her. One of the toxicology reports had determined a pink substance found in her coffee to be a sleep aid known as Zolpidem, a generic form of Ambien.

After the coffee incident, Clibbery revealed to her doctor and a police officer that she believed her business partner had committed fraud and was trying to kill her. Witnesses who were interviewed after her murder stated that Clibbery had told them she suspected George Hansen was taking money from the business and that she had begun to fear for her safety (People v. Hansen, 2004).

Eric Hanson

In this case, the defendant, Eric Hanson was charged with the murder of his mother, father, sister, and brother-in-law. According to the prosecution, the defendant is responsible for the theft of tens of thousands of dollars from his parents through forgery and identity-theft schemes.

After his sister discovered his fraud schemes, he threatened to kill her if she disclosed what she knew to their parents. The prosecution believes that the defendant killed as a means to avoid discovery for his fraudulent schemes. The parents had been shot in the head, and the prosecution claims that he carried the bodies to his sister’s home where he killed both his sister and brother-in-law (Rozek, 2007).

Comparison between the Russian Homicides and the American Homicides

In contrast to the American murders (Cases 1–22), the Russian murders (Cases 23–27) were largely committed on a contract basis, also known as “murder-for-hire.” The contract killings are not to be confused with the criminal enterprise homicide sub-classification. It is the motive behind the contract killings that is the important differential.

The motive for the Russian murders is no different than the American murders: all had fraud detection as the motive to kill. The difference lies in the fact that in the majority of American murders, the red-collar criminal was, him- or herself, willing to commit the murder, while in the Russian murders, the red-collar criminal hired someone to do the killing.

The Russian murderers had the markings of skilled professionals who were capable of avoiding detection by developing and executing a murder plan with surgical precision. It is not a coincidence that such murders go unsolved. As stated by Russian prosecutors in the Klebnikov murder (Case 25), the killing was “carefully planned” (Yasmann, 2004). To date, there is not even sufficient circumstantial evidence to bring a suspect to trial. In contrast, all of the American defendants in the study were found guilty of murder.

Furthermore, the foreign murderers go beyond silencing the victim that may have revealed their fraud. The murders were committed in such a way as to send a message to other potential victims who were in a position to detect and reveal fraud. The Perri-RCM notes that some of the Russian murders occurred in public, a distinction not evident in the American murders. The American murders appear to be restricted to silencing the intended victim without sending a message to anyone else (Perri & Lichtenwald, in press, b).

In the Kozlov murder (Case 27), the victim was gunned down in public where he and other co-workers were playing soccer in a stadium. As the Deputy Chairman of the Russian Central Bank, Andrei Kozlov played a leading role in efforts to stamp out white-collar crime in Russian banks. In 2002, he was quoted as saying, “I am being observed very closely and very seriously right now” (Chazan, 2006). The Perri-RCM notes that three out of five Russian murders were perpetrated against government officials.

The Perri-RCM further reveals the ineptitude of the American red-collar killers. The American murderers lacked skills in planning a murder that could not be connected to them (Perri & Lichtenwald, in press, b). For example, in both the Dyleski and Petrick cases, the prosecution uncovered written murder plans. Dyleski had written: “Knock-out/kidnap; Keep captive to confirm PINs; Dirty Work; Dispose of evidence; Cut up and bury” (“Court TV News,” 2006). And in the Petrick case, the prosecution recovered a murder plan from the defendant’s computer searches (Lewis, 2005b, c).

The data reveal certain behavioral traits that explain why red-collar criminals believe their white-collar crime skill-set can be duplicated as violent criminals, behavioral traits that are a result of their psychopathic natures. Most significantly, their illusions of grandeur hinder their ability to foresee the consequences of their behavior. The inability of the red-collar criminal to think through a plan that would take into account the potential risks of being caught and the evidence trail left behind is another hallmark of their behavior.

The judge presiding over one of the Sante Kimes cases stated, “Sante Kimes had grossly overestimated her own cleverness. The stupidity of a criminal keeping a to-do list added one more extraordinary note to this bizarre case” (King, 2002).

In further contrast to the American murders, the foreign killers left key forensic evidence behind to make it clear that the death was not an accident or some innocuous random act. In the Hovasapian murder (Case 26), the victim, the Head of the State Taxation Service, was in his vehicle when it exploded. The investigators found an explosive device planted under the passenger seat where the victim was seated (“Russia: High profile killings,” n.d.). In Case 24, the victim, Kholodov, was a journalist specializing in exposing white-collar crime in the Russian Defense Ministry. After receiving certain information, he had gone to the Moscow train station to pick up a suitcase. Upon returning to his office, the suitcase exploded (“Russia: High profile killings,” n.d.).

The Role of Forensic Investigators in Uncovering Motive

Forensic accountants or fraud investigators should be considered part of all homicide investigation teams where the evidence infers that fraud detection may have been the motive for the murder. Given that occupational fraud alone, according to a recent report, has exceeded $650 billion dollars (BackCheck, 2007), it is reasonable to infer that fraud-related murders are not an anomaly. Although other types of physical evidence may assist in developing possible suspects, these examiners may be in a unique position to uncover a motive that the physical evidence is unable to reveal.

Many of the cases revealed little in terms of motive until the Perri-RCM revealed evidence exposing an underlying fraud scheme that pre-dated the murder. Furthermore, by uncovering fraudulent behavior that pre-dated the murder, forensic examiners may be able to narrow the potential field of suspects. Given the behavioral and accounting data presented in the Perri-RCM, the information presented in the Fraud Detection Homicide Investigation Profile (Appendix C) may prove beneficial to forensic accountants during an investigation.

The link to fraud detection has been crucial in establishing a motive for murder where the prosecution has had weak direct evidence, but supportive circumstantial evidence of guilt. The case facts reveal that the victims were in a unique position to detect fraud, which explains why they were the homicide targets. It would behoove forensic accountants to examine what areas of the victim’s occupation or personal life would have placed them in a position to detect fraud.

Forensic accountants must attempt to put themselves in the victim’s shoes and ask themselves what the victim knew that could have been considered threatening to someone; for example, “Did the victim do anything with his or her knowledge of the defendant’s fraud activity that increased the probability that he or she would be a target of violence?” For example, in the Hansen, Porco, Bernal, Barajas, Johnson, Kimes, and Hanson cases, the victims had gone, or threatened to go, to the authorities and expose the fraud upon detection of the defendant’s behavior.

In the George Hansen case, the victim-bookkeeper was in a unique position to observe financial irregularities. A forensic accountant would have discovered not only the fraud from the defendant’s bank statements and the company records, but also a correlation between the defendant’s fraud and attempts to silence the bookkeeper as her suspicions of fraud increased.

In the Christopher Porco case, the family members would have been in a unique position to detect fraud because their personal financial positions were being used by the killer to advance his schemes. In the Bernal (Case 6 & 7) and Barajas (Case 8 & 9) cases, the business owners were in a unique position to detect the fraud of their agent.

However, in the process of discovering a potential suspect, it may be necessary for the forensic investigator to consider whether the victim was involved in the underlying fraud. For example, in the Kimes and Johnson murders, the victims had been co-conspirators in the killers’ fraud schemes.

Establishing Motive in the Prosecution of Fraud-Detection Homicide

Many of the homicide cases in the Perri-RCM indicate that the red-collar criminals harbored an inflated belief in their own competencies, and in fact, the majority of them left a trail of evidence that clearly identified them as the killer. However, the link to each fraud detection was crucial in establishing a motive for murder when the prosecution had weak direct evidence, but supportive circumstantial evidence of guilt. Establishing fraud detection as a motive is especially important when the psychopath will attempt to use his or her lack of violent criminality as an advantage when the case against him or her may be entirely circumstantial.

For example, the defense attempted to use Scott Dyleski’s (Case 2) non-violent, even gentle, background to suggest that he was not capable of such brutality (Sweetingham, 2006a, c; “Court TV News,” 2006). Defendant Christopher Porco advanced the same philosophy: “A matter of dispute between my father and me was taken completely out of context and then multiplied by the police and the prosecution because they needed to invent a reason as to why a person who has never been violent in his entire life would randomly decide one day to partake in an unspeakable destruction of life” (“Transcript,” 2006). Some of the jurors in the Porco murder were hesitant to find the defendant guilty given that he had no documented history of violence (Lyons, 2006).

Porco’s statement is demonstrative of how he tried to use his non-violent background as a strategy to convince others that he was not capable of such acts. Porco attempted to “blend in” by creating the perception that he was like most normal people who have no violence in their backgrounds and who lack the ability to commit such unspeakable violence. He went on to say, “By caving in to public pressure to hold the most convenient suspect responsible, the police deprived all of us the justice we are entitled to” (“Transcript,” 2006). His ploy was clearly to craft the perception that if he had been denied justice, then all the people with whom he “blended in” would suffer the same fate, should they be charged with a crime. The red-collar criminal’s resort to chameleon strategy is not unexpected (Perri & Lichtenwald, in press, a).

The prosecution must be cognizant of the fact that the defendant is attempting to bond with the jury by putting forward the message that “because I look like you, behave like you, and have no background in violence as you (the jury), I am not capable of such brutality.” Though motive is not necessary to prove a murder case, without motive, the jury may have only a sterile circumstantial evidence case, which is one of the most difficult types of cases to prosecute, even when the circumstantial evidence is strong. Establishing a motive for the murder neutralizes the defendant’s bonding strategy with the jury. A motive demonstrates the decision-making process that propelled the defendant to commit the heinous act.

Conclusion

Exhaustive review of cases where white-collar criminals were arrested and convicted for murder reveals that in each of the murder cases, fraud either preceded or occurred at the same time as the murder. The data gathered from the murder cases did not support the position that the killer had merely experienced a ‘lapse’ in moral judgment.

Although fraud detection may not be an apparent motive for a homicide, law enforcement and prosecutors would benefit from considering the detection of an underlying white-collar crime as a possible motive to commit homicide. It is suggested that homicide detectives consider either consulting with or including forensic accountants and certified fraud examiners as part of their investigation teams.

Further, the FBI Crime Classification Manual should offer an appropriate system for categorizing these murders for profiling reasons. For descriptive purposes, the 27 murder cases have been given the general classification of fraud-detection homicides and the perpetrators who meet the criteria of having committed a fraud-detection homicide have been classified as red-collar criminals. Other forensic examiners are welcomed to submit further findings and additions to the Perri-RCM. This matrix should be viewed as a work in progress.

Key Words: red-collar crime, white-collar crime, fraud, motive, detection, homicide, murder, psychopath, Perri’s Matrix, the Perri-RCM

no comment

Mar

Steps Taken by Computer Forensics Specialists

Posted by admin | Edit Published in THE FORENSIC EXAMINER Winter 2007

Steps Taken by Computer Forensics Specialists

missing image file

THE FORENSIC EXAMINER Winter 2007 www.acfei.com

1. Protect the subject computer system during the examination

2. Discover all the files on the subject system

3. Recover all deleted files

4. Reveal hidden or temporary files

5. Access protected or encrypted files

6. Analyze all relevant data

7. Print out an overall analysis of the examination

8. Provide expert consultation and/or testimony

Robbins, J. (no date). An explanation of computer forensics. Retrieved Sept. 5, 2007, from www.computerforensics.net/forensics.htm

Investigating Digital Devices

(Handout/MCT 2007)

Digital communications seem anonymous, but quite the opposite is true. Experts are able to investigate user activity through such applications as email, instant messaging, text messaging, and even Internet telephone conversations. Some commonly investigated devices by digital forensics experts are as follows:

• computers

• Blackberries

• iPods

• automobiles

• cell phones

(800) 423-9737 Winter 2007 THE FORENSIC EXAMINER

missing image file

Although many attorneys and investigators have yet to use the

services of digital forensics experts, digital information can assist

in almost any case.”

Earn CE Credit

To earn CE credit, complete the exam for this article on page 76 or complete the exam online at www.acfei.com (select “Online CE”).

About the Author

Gavin W. Manes, PhD, brings extensive knowledge in the field of digital forensics to his position of president of Oklahoma Digital Forensics Professionals Inc. Manes received his doctorate in computer science from the University of Tulsa (TU), where he now works as a research assistant professor. Since 1996, Manes has specialized in the fields of information assurance, computer security, and digital forensics at the Center for Information Security at TU. He has also published papers and journal articles and delivered congressional testimony in the areas of information assurance, digital forensics, and telecommunications security.

Manes has briefed the White House, National Security Council, and the Pentagon. For the last 2 years, he has given presentations on digital forensics at the ACFEI National Conference. In addition, he has all five National Information Assurance Education and Training Program federal information assurance certifications from the Committee on National Security Systems and the National Security Telecommunications and Information Systems Security Instruction. Manes has also worked closely with many local, state, and federal law enforcement agencies.

Manes maintains memberships in the High Tech Crime Investigation Association, Digital Forensics Working Group, Association of Computing Machinery, Oklahoma Infragard, Information Systems Security Association, and the American College of Forensic Examiners Institute. For additional information, please visit
www.okdfp.com.

Published by Dr. Robert O’Block

no comment

Mar

Digital Forensics in the Twenty-first Century

Posted by admin | Edit Published in THE FORENSIC EXAMINER Winter 2007

Abstract

Digital forensics experts are called on to collect and analyze digital information from electronic devices such as computer hard drives and cell phones. Electronic evidence is used in a wide variety of cases, ranging from corporate espionage to employee separation or divorce. Recent changes to the Federal Rules of Civil Procedure have legitimized the use of digital evidence in court, making this new field of forensics more relevant than ever.

CE Article: (CERTIFIED FORENSIC CONSULTANT, CFC) 1 CE credit for this article

Digital Forensics in the Twenty-first Century

This article is approved by the following for continuing education credit:

(ACFEI) The American College of Forensic Examiners International provides this continuing education credit for Diplomates.

(CFC) The American College of Forensic Examiners International provides this continuing education credit for Certified Forensic Consultants.

By Gavin W. Manes, PhD

An increasing number of business and legal investigations include evidence extracted from digital devices such as computer hard drives, PDAs, and cell phones. When it becomes apparent that digital information must be used in the course of an investigation or discovery process, digital forensics experts must be employed to carefully gather pertinent evidence.

Digital forensics professionals are responsible for the collection, analysis, and investigation of electronic evidence from digital devices. The gathered “snapshot” of information must be collected in a detailed, methodical, and scientific manner, as any or all evidence can be used in discovery, in depositions, or in trial.

Historically, paper documents have been the mainstay of evidence production in the court system. However, a standard computer hard drive contains enough easily readable information to fill hundreds of thousands of sheets of paper, making the court’s reliance on paper imprudent. Digital documents in their native formats also contain information that their paper counterparts do not, such as user access dates and editing information. This type of information, called “metadata,” can offer valuable clues regarding user interaction with documents and files. For example, Microsoft Word can capture important information such as edits made using the track changes feature of the program. The production of digital documents during court proceedings is important to ensure all necessary information has been preserved.

Case Study

John Smith has a wife of 10 years and two young children and lives in the suburbs. He likes golf and the occasional fishing trip and owns his own business. And he has been cheating on his wife with an Internet girlfriend for 2 years.

They have chatted on an instant messenger at work, emailed pictures and jokes, and even planned weekend getaways to Louisiana. When she did not show up for the first trip, Smith was worried. But when she did not arrive at the prearranged hotel for the next two trips, he became suspicious. He could not imagine why someone who wrote such heartfelt emails would treat him with such disregard.

Tired of waiting for an answer, Smith hired a private investigator to identify his mystery woman. Internet searches were inconclusive, and the service provider would not give the woman’s personal information without the threat of legal action and a subpoena. After striking out on all of the usual investigative avenues, the investigator told Smith that he was not finding any significant information.

But fortunately for Smith, the private investigator had close connections with a digital forensics company that helped him identify Smith’s girlfriend through email communications.

The forensics investigators began by targeting the general area where the girlfriend was sending emails by investigating the address-like information embedded in the email. All emails contain “headers” with destination and return addresses, much like envelopes. Headers also include addresses from each routing point that the email passes through on the Internet, showing the path taken to reach a destination.

Ironically, the email headers led the forensics experts to a computer in the same city as Smith—something that came as quite a surprise to him. He could not believe that he had scheduled trips out of state and spent hours chatting with someone that might be living on the same street.

Like Smith, the private investigator found the situation suspicious. Why would someone so close and invested in a relationship want to hide her location?

The forensics experts investigated all of Smith’s emails and compared all email headers. Suspicious that Smith might be ‘dating’ someone he already knew, the investigators looked to see if any emails sent from Smith’s girlfriend matched an email sent from someone else in his mailbox.

Both the forensics experts and the private investigator were correct. After making a careful comparison and double-checking the results, the forensics experts found that the girlfriend’s emails were being sent from the same address as Smith’s home computer. They concluded that Smith had been cheating on his wife with his wife for more than 2 years.

Smith was understandably shocked! Although forensics cannot answer all the questions that would naturally follow such a revelation, it did catch a woman who believed she was anonymous on the Internet.

Common Forensics Investigations

Two surprisingly common misconceptions are that emails cannot be traced and that chat room participants cannot be found. As a result, people often do and say things online that they would not in a face-to-face conversation. The impersonal nature of email and instant messaging can lead to problems, both personal and professional.

The majority of forensics cases involve employee separation and discrimination issues. Most often, an employee exits a company with proprietary information and uses it to establish a competing business.

Some are brazen enough to email themselves client lists, engineering specifications, and account information. Others are more discreet, preferring to burn such information to a CD or download it to a flash drive. Fortunately, forensics experts can not only examine system files to determine whether a transfer has been made to external media, but also conduct thorough examinations for email attachments.

Forensics experts are often called to examine computers from employment lawsuits, such as discrimination, sexual harassment, and wrongful termination. In these cases, the investigated computer has often been used for several months since the employee’s departure, presenting challenges to forensics examiners. This is particularly true if the key information has been deleted.

Deleted Information Is Not Gone

When information is deleted from a digital device, the file itself is not erased but, rather, the computer’s reference point for the file is erased. It is much like removing a card from the library’s card catalogue, but not taking the book off the shelf. The computer then marks the space containing the file as available. If a large amount of data is added to the drive, there is a chance that the “deleted” file can be overwritten. However, the use of very large hard drives in most current computers makes the chance of overwriting unlikely, and fragments of documents can often be found even a year after normal computer use.

Another recent forensics case involved a wrongful termination suit brought against a construction company by a former employee. He had been fired due to cost overruns on the company’s biggest project. The employee’s suit claimed his superior directed the project into overruns and blamed the results on other employees. The documents produced by his lawyers included emails sent to the superior, which cited warnings of overruns and suggestions to avoid them.

Forensics experts were asked to investigate the former employee’s computer for evidence of these emails, which the superior claimed never to have received. Examination of the computer showed pieces of the email text within the hard drive’s “unallocated space,” the areas where deleted information is sent. Yet the text did not appear in the former employee’s email folders.

The forensics company recommended a review of the company’s email servers through which the emails would have passed if they had been sent. No evidence of the emails was found.

Later, evidence of a forgery was discovered on the employee’s new office computer. He had used an engineering tool to fabricate documents to look like the printout of an email. The presentation of this evidence was the turning point in the case, which was summarily dismissed.

Recent Changes to the Rules of Civil Procedure

Both law makers and policymakers at the national level recognize the involvement of digital devices in modern-day litigation. Recent changes to the Federal Rules of Civil Procedure indicate that the court system is recognizing the crucial importance of electronic information in the process of investigation and litigation. While the Federal Rules of Civil Procedure have changed the production of electronic information, most decisions related to its evidentiary value are defined under the Federal Rules of Evidence. These rules apply to both civil and criminal proceedings, but most challenges and decisions related to digital evidence have been made in criminal courts.

In particular, the new rules indicate that digital documents are given the same weight and status as paper documents in terms of production. These rule changes underscore the fundamental shift of modern litigation toward the inclusion of electronic information in the legal process. Although the implications of these rule changes will not be clear until they are tested in the courts, it is expected that demand will increase for properly performed data collection and digital forensics investigations. As always, the admission of digital forensics evidence into cases will continue to be governed by the Daubert rules.

Licensing Requirements

Licensing requirements for forensic examiners have yet to be standardized on a national level, but most states require some level of certification to handle evidence and perform investigations. In the majority of states, digital forensics professionals are required to obtain a private investigator license; however, three states (Alabama, Alaska, and Wyoming) have licensing requirements only in certain cities, and others (Colorado, Idaho, and South Dakota) have no licensing requirements whatsoever. Given that this is a relatively recently established field, it is likely that a national certification for digital forensics examiners is on the horizon, particularly with Federal Rule changes that all but mandate the use of such experts to handle digital information.

Most licensing organizations impose both penalties and fines if examiners do not follow the proper evidentiary handling rules. The specific injunctions vary by state but typically include both financial sanctions and the revocation of licenses. It is important to investigate the certifications required by your state when seeking a digital forensics examiner. Knowingly hiring an unlicensed person can be punished through sanctions, fines, or worse: inadmissible evidence.

As digital devices become more pervasive in the modern world, the amount of electronic information processed into the legal landscape will continue to increase. Although many attorneys and investigators have yet to use the services of digital forensics experts, digital information can assist in almost any case. The complexity of such devices and the changeable nature of such information necessitates the establishment of digital forensics examiners as a crucial addition to the forensics field.

References

Arkfeld, M. (2003). Electronic discovery and evidence. Phoenix, AZ: Law Partner Publishing.

Daubert v. Merrell Dow Pharmaceuticals, 509 U.S. 579 (1993).

Mac Avoy, J., & Eng, G. (2006, June 19). Litigation: Forging ahead on e-discovery [special issue]. New York Law Journal.

Ryan, D. J., & Shpantzer, G. (2005). Legal aspects of digital forensics. Retrieved April 12, 2007, from http://
www.danjryan.com/Legal%20Issues.doc

Zubulake v. UBS Warburg (S.D.N.Y. 2002-2005). n

This article published by Dr. Robert O’Block

no comment

Mar

Letters to the Editor

Posted by admin | Edit Published in THE FORENSIC EXAMINER Winter 2007

Letters to the Editor

Dear Editor,

We read with interest “Antidepressant Withdrawal Syndrome and DUI Evaluation” by Drs. Spiller and Sawyer in the Fall 2007 issue of The Forensic Examiner. The article points out the effects of drugs on the neurotransmitter system of the body and how alterations can take place so that the withdrawal syndrome can be created. This is the normal homeostatic reaction of the body when a drug disrupts the body’s normal state of function for that person. The sudden withdrawal of a drug will disrupt the body’s adjustment to the drug and can cause the withdrawal syndrome, which leads to an impaired state for that person.

We would like to discuss the statement, “this produces the paradox of a potentially impaired driver not under the influence of any drug or alcohol.” It is because of the drugs and the homeostatic reaction of the body that the syndrome is produced. The officer has the responsibility to remove an impaired driver from the road, whether a medical call, reckless driving, or DUI. The SFSTs are tools for making decisions for substance impairment. If four or more clues from the HGN exam are present, drugs such as alcohol, dissociative anesthetics, depressants, inhalants, or a combination are the likely cause. Breath testing determines alcohol levels. In many states a Drug Recognition Expert evaluation aid in determination if alcohol, drugs or substance is the cause or a medical call. If drug/substance is indicated, then blood urine, or other biologic specimen may be analyzed for toxicology. Standard field sobriety tests (SFSTs) were designed to help remove the impaired driver from the road. It does not matter how someone becomes impaired—they are impaired. SFSTs do what they are designed to do: take impaired drivers off the road.

The article mentions the already existing jerking eye movements. If there is existing nystagmus prior to the administration of the HGN exam, it is typically congenital, an existing condition or of recent occurrence, in which case it may show the need for a neurological evaluation, possibly saving the person’s life. Nystagmus from HGN does not present itself in the resting position; it is manifest while following a target that is presented during the HGN exam. Therefore, an existing nystagmus is of interest but is not confused with the eye movements observed during HGN testing.

Prescribing doctors must be vigilant in educating their patients about the effects of using prescription drugs, discontinuing prescription drugs, and drug interactions, especially when driving and operating power tools or machinery. The patient must follow instructions and be responsible for his or her decision to drive or not drive. In many states, the physician is responsible for communication with DMV if a patient is not fit to safely drive a motor vehicle, for whatever reason.

Law enforcement officers often encounter individuals who exhibit behaviors consistent with impairment. Regardless of reasons, impaired drivers have failed to stop themselves from being a danger to themselves and others. Officers are trained to observe potentially impaired drivers, and SFSTs are not the only information officers use when deciding to remove drivers from the road. If not alcohol or drugs, a medical problem may be responsible for the impairment. For the safety of the driver and the safety of the public, any impairment cannot be ignored.

Dominic R. Pannone, OD, CMI-V, CHS-III and Eugene R. Bertolli, OD, FACFEI, DABCHS, CMI-V, CHS-V

Dear Editor,

We thank Drs. Pannone and Bertolli for their comments, but respectfully disagree and appreciate the chance to respond. Our review “Antidepressant Withdrawal Syndrome and DUI Evaluation” was intended to bring to light a potential problem: that the absence of a drug may produce an impaired driver.

As we stated “while there may be significant impairment, the term driving under the influence may be inappropriate for these cases” (pages 52–53). Following evaluation by a field officer using the SFST, there may be a suggestion that the driver is under the influence of either drugs and/or alcohol. Follow-up testing, in these specific SSRI withdrawal cases, would show no drugs or alcohol detected. This follow-up testing is often a critical part of evidence in prosecution of these cases.

A similar situation might occur if a diabetic patient becomes hypoglycemic while driving. During a moderate-to-severe hypoglycemic episode, the driver may become confused and be “impaired” by his or her low blood sugar. But again, “driving under the influence” may be inappropriate, as no drugs or alcohol involved.

In reference to the concept of “impaired but not under the influence,” these patients have not taken any medication and that is, in fact, their problem. They do potentially pose a risk to themselves and other drivers and we stated so in our review: “patients should be warned about the dangers of operating a motor vehicle if they begin experiencing moderate-to-severe withdrawal symptoms” (page 52). We agree that prescribing doctors must be vigilant in educating their patients about the effects of using prescription drugs, discontinuing prescription drugs, and drug interactions, especially when driving and operating power tools or machinery, and that patients should be vigilant in following such instructions.

Henry A. Spiller, MS, DABAT, DABFE and Tama Sawyer, PharmD

no comment

Mar

Editor’s Note: Pictoral review of the Forensic Examiner since 1992

Posted by admin | Edit Published in THE FORENSIC EXAMINER Winter 2007

Editor’s Note

The Forensic Examiner started as a 3-page newsletter in August of 1992.

Viewing past covers of The Forensic Examiner demonstrates how much the journal has evolved.

missing image file

THE FORENSIC EXAMINER Winter 2007 www.acfei.com

missing image file

Love our New Look!

The Forensic Examiner, nearing the end of its 16th year, has come a long way. From the three-page letter that Founder Dr. Robert O’Block created and sent to a few members from his tiny home office back in 1992, to the 88-page, 4-color, peer-reviewed journal that you have before you now, The Forensic Examiner has become a prestigious publication of which our entire staff is extremely proud.

Our most recent achievement has us all beaming especially brightly. The Forensic Examiner is now on newsstands across the United States and in Canada, including Barnes and Noble, Borders, Hastings, and many other independent bookstores! Joining the ranks of esteemed magazines such as Scientific American and The Economist, we are one of the only academic peer-reviewed journals to be featured on the newsstands of major bookstores. And just to put any fears immediately to rest, an academic journal is how we will always remain.

There is no doubt that long-standing members have noticed the changes in design over the past few years. We’ve encouraged our art director, Brandon Alms, to be creative with layout and cover designs, and we have not been disappointed. Our editorial staff has also put forth a lot of effort to maintain a level of discourse within the journal that is accessible to individuals outside the field. However, we would never dream of compromising our scholarly standards. Our goals do not include catering to people looking for sensational stories similar to those found on popular television networks, but we do want to appeal to a broader audience.

As the cover states, we want to show the general public real cases, real experts, and real science. Offering subscriptions and selling on limited newsstands over the past couple of years has made us aware of a growing population of individuals who are not formally educated in forensic science, but who are fascinated with the field. By sharing academic articles with these individuals, we plan to show them that true forensics, though not nearly as glamorous, can be just as interesting and dynamic as any hour-long drama.

By expanding our audience, we hope to inspire more young readers to pursue careers in forensics and to bring a higher level of awareness to the importance of forensics funding. Our authors have the chance not only to reach a larger audience, but also to influence a new demographic in a way they never before imagined.

ACFEI Members: It goes without saying that the journal wouldn’t be anywhere near what it is today if it weren’t for the dedication and loyalty of you, our members. Above all else, this is your journal, and its main purpose is to serve you. Thanks for helping make The Forensic Examiner the world’s leading forensic journal!

New Readers: We’re thrilled you have chosen to explore the real world of forensics with us. We have no doubts that you will love learning about the science behind forensics and enjoy discovering areas of the field new to you!

We’re delighted to be the first journal able to maintain high academic standards while appealing to the general public, and we plan to take full advantage of our opportunity to disseminate knowledge to a larger and more diverse audience. This issue in particular reflects a lot of design changes that we hope will be more inviting to all readers. If all goes according to plan, forensic accountants just might find themselves reading forensic engineering articles, and visa versa.

missing image file

Monday, March 31, 2008

4 Types of Terrorists - with Dr. Hamden

Wednesday, March 26, 2008

Books by members

Thursday, March 20, 2008

Forensics News on CNN.com

Don't Miss

Thursday, March 13, 2008

The Forensic Examiner - selected articles

What the 10 New Auditing Standards Mean for Forensic Accountants

Books by ACFEI Members

Investor Turned Murderer: The Story of Albert Walker

The Sub-Classifications of Criminal Enterprise Homicide

Faud Detection Homicide

Steps Taken by Computer Forensics Specialists

Digital Forensics in the Twenty-first Century

Letters to the Editor

Editor’s Note: Pictoral review of the Forensic Examiner since 1992

ACFEI.com

Links

Blog Archive

Quick Linker

Subscribe via email

FeedBurner FeedCount