READ: Forgeries and Handwriting Analysis

Introduction

Introduction

A questioned document is any document whose authenticity is in question. The questioned documents unit in a forensic lab will conduct examinations of documents and related materials in all types of criminal cases for local, state, and federal agencies. This includes the examination of writing, ink, paper, impressions, typewriting, faxes, photocopiers, alterations, obliterations, charred, forgeries, and counterfeited items to name a few. Another division of Forensics, known as Computer Forensics involves the scientific examination and analysis of data held on, or retrieved from, computer storage media in such a way that the information can be used as evidence in a court of law.

Essential Questions

1. Is handwriting class or individual evidence?

2. How can ransom notes or suicide letters be helpful to forensics scientists?

3. What security measures are taken to prevent counterfeiting?

4. What type of documents can be forged?

5. What is Computer or Digital Forensics?

6. How can incriminating data be found on a computer?

Module Minute

In today's digital age, communication is increasingly dependent upon computers and devices. While not a paperless society, we are certainly much more likely to utilize digital forms of documentation and communication than ever before. While there has been a decrease in the use of paper documentation, it is still the standard in many sectors of society and business, and thus questioned document examiners are needed. Whether it involves a ransom note, an alleged forgery of a will or some other contested document, questioned document examiners' main focus is to evaluate the authenticity of suspicious documents. Document examiners look for signs such as erasures, obliterations or other alterations using various analytical techniques such as chromatography and oblique lighting. Computer or Digital Forensics involves investigating the data stored on computers and devices for evidence of a crime. Ranging from questionable Internet searches about how to dispose of bodies to white collar crimes like embezzlement, Computer Forensics often uncovers important clues that even the most meticulous perpetrators may think are hidden.

Georgia Virtual, Handwriting Analysis and Computer Forensics, CC BY-NC-SA 3.0

Questioned Documents and Handwriting

Questioned Document Evidence and Handwriting

A questioned document, whether a contested will, forged check, or suspicious suicide note, is a part of many forensic investigations. The term "Questioned Document" includes any document whose authenticity is in question. Experts in this field known as Forensic Document Examiners have extensive training that involves the analysis and comparison of questioned documents with known material in order to identify whenever possible, the author or origin of the questioned document. In addition to documents, writing found at a crime scene, such as a message about the crime written on a wall, is also examined by Forensic Document Examiners for clues to the identity of the person who wrote it.

Handwriting Comparison

 In elementary school we all learn to write in the same basic process. Our parent or teacher provides us with an example to copy of each of the letters of the alphabet. We practice copying those letters over and over until we can successfully produce them without needing to reference the example as we write. Thus, learning to write requires a series of deliberate and thoughtful events. As we master the skill, putting pen to paper becomes an almost effortless, subconscious undertaking. When writing becomes a more subconscious process around mid to late adolescence, we each develop writing habits that make the shapes and patterns of our lettering unique. These individual markings are what document examiners look for when they are asked to evaluate handwriting samples. In addition to the way we individualize our letters, most people unconsciously write at a certain angle or with a certain amount of pressure on the paper or document medium. These additional mechanical features make it very unlikely that two individuals will have identical handwriting.

In order to make a handwriting comparison, the examiner must first collect a handwriting sample known as an exemplar. An exemplar is a sample of handwriting whose source is known, such as a dictated passage that a suspect is requested to write in the presence of an officer or Forensic Document Examiner and witness. The purpose of an exemplar is to compare a known document with a questioned document to identify any existing matching characteristics.

 There are several guidelines that should be followed when collecting handwriting exemplars from a suspect:

1. The exemplar should contain the same letters, letter combinations, and words as the material in question, though it does not necessarily need to be in the exact same order or sequence as the original document. In certain cases, however, it can be beneficial to dictate the exact same wording of the questioned document to the suspect.
2. When asking for an exemplar, it is very important to never show the suspect the original document or provide any instruction on spelling or punctuation.
3. Provide the suspect with a similar type writing utensil and paper as the questioned document so that the writing conditions are reproduced as closely as possible.
4. The suspect should also be seated and comfortable when collecting an exemplar.
5. An adequate sample size is imperative so that both qualitative and quantitative data can be collected. When the questioned document is long enough, the text should be dictated to the suspect at least three times for collection. If the questioned document consists of few words or simply a signature, the suspect should be required to write the signature or text at least 20-30 times.

When comparing the questioned document to an exemplar the examiner will look at grammar, punctuation, font size, shape, slant, margins, fluidity, spacing, unusual letter formation, flourishes or embellishments, and pressure.

Spelling, punctuation and grammar can be very useful; in particular if the person is not a native English speaker as in the Lindbergh baby ransom note. The writer of the letter was not a native English speaker and had some peculiar spelling and grammatical patterns consistent with a native German speaker. Later, a German criminal who had recently immigrated to the US named Bruno Richard Hauptmann was arrested for the murder. 

 It is also important to note that there are a few factors that may make a comparison more complex or difficult. Factors that complicate a handwriting analysis include situations in which a suspect is under the influence of drugs or alcohol, as well as cases in which an exemplar is being written with a deliberate attempt to disguise the natural form of the handwriting.

Attempts to disguise the handwriting may be overcome with repetition. This is because a suspect is more apt to revert to some of their natural and subconscious writing habits if they are asked to repeatedly write the same passage over and over. This is a concept known as "Automaticity". Automaticity is the ability to do things without occupying the mind with the low-level details required, allowing it to become an automatic response pattern or habit. It is usually the result of learning, repetition, and practice. Often the mind will, in essence, take a shortcut if the same task is repeated over and over without needing a conscious effort. This is more likely to occur when the same process is requested of the brain over time; it is also the reason that you may have driven to a location and not necessarily remember consciously doing so! You may have even said "I must have been on auto-pilot!" This is the same rationale in taking multiple exemplars.

Forensic Document Examiners are trying to catch the suspect in a moment of automaticity in their writing in which they revert to their usual subconscious writing habits! Ultimately, each case must be considered individually when trying to make a determination of whether an exemplar and a questioned document have a significant number of match points. 

 Typically, a document examiner will give his or her decision on whether a handwriting sample matches a known sample with one of the following designations:

Identification: The writing is consistent with the known sample and has enough identifying characteristics to say that they are from the same writer. There are no differences in the writing outside of normal variation.

May Have: Just as it sounds, the examiner believes enough characteristics of the writing samples are the same that it is plausible that the writings were produced by the same person. However, some variation exists which precludes it from being an identification.

No Conclusion: It could not be concluded that the samples were from the same or different people. This is usually due to the limited size or clarity of the writing samples.

May Not Have: A decision based on the fact that some differences were noted in the writing, but due to some factor (such as a limited sample size or clarity of one of the samples), the writer could not be definitively excluded.

Elimination: A decision that the samples were not produced by the same writer because the samples were so dissimilar and did not have any matching characteristics.

All of these characteristics that are individual to a person and his/her handwriting make handwriting evidence individual evidence.

Georgia Virtual, Handwriting Analysis and Computer Forensics, CC BY-NC-SA 3.0

Analysis of Questioned Document Evidence

Analysis of Questioned Document Evidence

Forensic investigators are trained in a wide range of basic procedures, but when a questioned document is recovered, a Forensic Document Examiner is called in to actually perform the document analysis. Forensic Document Examiners use their extensive training and expertise to make detailed analyses of the document in question and generally provide expert testimony during trials about the documents they analyzed. In this lesson, we will look at some of the methods used in the forensic examination of questioned documents including typewritten, handwritten, printed, copied and faxed documents.

When presenting evidence in court, a document examiner must follow the "Best Evidence Rule". This is a rule that governs the admissibility of document evidence. Generally, only the original document is admissible unless a reasonable explanation can be provided as to why the original document is not available. Therefore, it is imperative that the collection of document evidence be conducted in a precise and cautious manner so that it is admissible to court as evidence.

Questioned Document Collection Guidelines

1. Never mark, fold, staple, clip, trim, annotate or otherwise change anything on a document because it can hinder the document examination!

2. Most paper documents can be submitted in manila evidence envelopes that are slightly larger than the document itself.

3. Always label the evidence envelope with all of the required case identifying information before placing the questioned document into the envelope. If information is written on the envelope after placing the document in it, the writing on the envelope will be indented into the questioned document!

4. If it is too big to submit to the lab, careful photograph and video documentation of the writing should be made. A ruler should be placed next to the writing in the photograph for scale.

5. Wet or bloody documents should be sealed in a plastic, or semi-airtight, container and taken to the lab as soon as possible. The liquid or blood can erode any writing on the document as well as cause the document to stick together. Also, the blood will need to be tested for serological evidence!

Document Analysis Interactivity

 

Alterations, Erasures, and Obliterations

Often times only part of a document is modified. The methods used to change a document are generally called alterations. Alterations are modifications made to a document by physical, chemical, or mechanical means including, but not limited to, obliterations, additions, and erasures.

 Obliterations are a type of alteration involving removal of writing by physical or chemical means. They are made by using a chemical to remove the original text or by blacking out the original text completely. Examples of this include drawing repeated lines through a word or phrase so that it can no longer be read clearly or by writing over an original part of the document to change a letter, number, word or phrase.

 Additions are usually accomplished by adding content with similar ink or print to change the original context. An example would be to change the amount of a $10.00 check to a $110.00 check by adding the extra number one. In the image, one hundred dollars was added to the amount of the check. Under normal lighting, this was not obvious, but when viewed under infrared lighting, it is obvious that the addition was written in a different ink.

Erasures are the most common technique used to modify a document. Erasures are a type of alteration where material has been removed from a document by chemical, abrasive, or other means. Erasing pencil writing with an eraser is an example familiar to nearly everyone, but ink can also be erased chemically by dissolving or bleaching the ink from the paper. Erasures can be detected by either microscope in the case of physical erasures or by using different light sources, such as UV or Infrared light, to detect color differences common in chemical erasures. It is sometimes impossible to detect what was erased from a document, but if the content is only partially erased, a Forensic Document Examiner would most likely be able to recover the content.

 As mentioned above, alterations can sometimes be detected by using an alternate light source such as Ultraviolet or Infrared light. Some inks actually absorb and radiate the infrared light, making the original text legible. Additionally, infrared photography is sometimes useful on documents that have been accidentally or intentionally charred. A charred document is any document that has been darkened and made brittle due to exposure to excessive heat or fire. Documents cast into a fire that are quickly retrieved before they are completely burned or that did not burn completely for various reasons may have recoverable content despite their darkened and fragile appearance. Charred documents are also common in house fires and can yield evidence in cases of arson if a document is dropped by the person committing the arson.

Forgery, Fraud and Counterfeiting

Forgery is the making, adapting, or falsifying of documents or other objects with the intention of deceiving someone. Most often one thinks only of forgery as pertaining to checks, but other documents such as employment records, licenses, wills, and other legal agreements can be forged. Forged signatures are a common issue that document examiners come across; the signatures are most commonly traced or written free hand as seen in the image.

Common types of forgery include:

Counterfeiting - Production of imitation currency, art, documents and products.

Fraud - Forgery done for material gain.

Literary Forgery - Refers to writing, such as a manuscript or a literary work, which is either deliberately misattributed to a historical or invented author, or is a purported memoir presented as genuine.

Counterfeiting

 Counterfeiting is the production of imitation currency, works of art, documents, and name-brand look-alikes for the purpose of deception. Some common items that are counterfeited include:

• Paper currency

• Postage stamps

• Traveler's checks

• Handbags

• Shoes

• Computer Accessories

• Watches/jewelry

• Pharmaceuticals

• CDs/DVDs ("Bootleg")

While counterfeiting of products generally fall under various levels of local and state law enforcement, counterfeiting of currency is actually under the jurisdiction of the Secret Service! The Secret Service works with local, state and national law enforcement agencies to investigate cases of counterfeiting of US or foreign currency because it is seen as a threat to national financial security for currency to be counterfeited. They are also tasked with monitoring investigations and situations involving fraud, identity theft, money laundering, and computer crimes such as hacking of major websites.

How is forgery and counterfeiting detected?

It is estimated that check fraud and counterfeiting costs the United States between 10-14 million dollars per year. The Federal Reserve has published several suggestions that may help prevent such loss. When trying to determine if a check is real, one of the easiest observations is to see if one side of the check is perforated. The numbers at the bottom of the check also have meaning including the bank identification, account number, and a routing number. Also, when checks are printed some prevention methods may include chemically sensitive paper, high resolution borders, and embedded fibers. Counterfeiting of products can be tough to identify as those producing the imitation products have gotten more sophisticated in their methods.

Here are some ways to detect and avoid counterfeit products:

1. Look for security features such as the color changing reflective stickers found on genuine Ugg shoes.

2. Examine the item in person before you buy it rather than relying on someone else's word. If it is an expensive item, you should have an expert inspect it before paying for it.

3. Buy items from reputable stores and dealers, but beware that just because a store posts a sign to say they sell authentic brand merchandise does not mean that all stores are honest in their advertisements!

4. Check reviews and consumer reports for retailers before buying!

5. Avoid items that seem drastically under-priced. An $80 bottle of perfume in the store should not be discounted to $10 online! Customer and consumer report website reviews will often shed light on the "too good to be true" price!

6. Avoid risky sellers such as those going out of business, door to door salesmen, street vendors etc.

7. Purchase the item with a credit card rather than cash or check because you can dispute a charge with the credit card company on the basis that the product was misrepresented.

Checking for Literary Forgery

When trying to determine if a historical document is authentic some things an investigator will look at are:

1. The age of the paper

2. The type of ink that would have been used at the time

3. The style that would have been common at the time

Detecting Counterfeit Money

 Over the years there have been several series of paper currency. With each new series there has been enhanced security features added. Some of the security features of modern US currency include:

1. Red and blue fibers embedded on the currency.

2. Watermark of the historical figure portrayed on the bill.

3. Multi-colored background.

4. Borders and the portrait consist of a very fine print that will become blurred if copied.

5. Lower right corner has the denomination of the bill printed in color shifting ink which changes color when viewed at different angles.

6. All bills printed since 2008 have security strips embedded except the $1 bill. In a five dollar bill, the security strip glows blue in UV light and is used as one of many measures used when evaluating currency for authenticity.

7. Microprinting, or printing of words, numbers or pictures not obvious to the unaided eye, is used in various places on the bill.

8. Federal Reserve Indicators and serial numbers are on each bill.

 One of the most prolific fraudsters was Frank Abagnale Jr. He left home at the age of 16 and used his criminal talents in fraud to alter his driver's license to make him appear older, fabricated various degrees and licenses to obtain jobs as an airline pilot on Pan Am Airlines, as a pediatrician in Georgia and as a lawyer! He wasn't caught until the age of 21 in France where he had schemed and defrauded banks across 12 countries of Europe of more than $300,000! He served his time and was released on parole at the age of 26 after several prison escapes! In exchange for his release, the FBI asked that he teach them his methods of evasion, document forgery, embezzlement, and check swindling so that they could catch others attempting the same crimes. He went on to work for the FBI as an employee for 30 years as an expert in these areas! He wrote a book about his time as a fraudster called "Catch Me If You Can". Steven Spielberg made the book into a movie under the same title in 2002 with Leonardo DiCaprio starring as Frank Abagnale Jr. 

Georgia Virtual, Handwriting Analysis and Computer Forensics, CC BY-NC-SA 3.0