manageing a multijurisdictional case · 2014-01-06 · and perf fellow mike adams of the...

GERARD R. MURPHYCHUCK WEXLER

WITH

HEATHER J . DAVIES

MARTHA PLOTKIN

1120 Connecticut Avenue, NW Suite 930Washington DC, 20036Phone: 202-466-7820 Fax: 202-466-7826www.policeforum.org

Managing A

Multijurisdictional C

ase

80828_Cover R5 10/7/04 11:40 PM

Managing a Multijurisdictional Case: Identifying the Lessons Learned

from the Sniper Investigation

G E R A R D R . M U R P H Y A N D C H U C K W E X L E R

W I T H

H E AT H E R J . D AV I E S A N D M A R T H A P L O T K I N

A Report Prepared by thePolice Executive Research Forum

for the Office of Justice ProgramsU.S. Department of Justice

OCTOBER 2004

80828_i-200.R7 10/8/04 12:07 AM Page i

This project, conducted by the Police Executive Research Forum (PERF), was supported by CooperativeAgreement #2003-DD-BX-0004 by the U.S. Department of Justice, Office of Justice Programs’ Bureau of JusticeAssistance. Points of view or opinions contained in this document are those of the authors and do not necessar-ily represent the official position or policies of the U.S. Department of Justice or the members of PERF.

Websites and sources listed provide information useful at the time of this writing, but the authors do not endorseany information of the sponsor organization or other information on the websites.

© Police Executive Research Forum,U.S. Department of Justice

Police Executive Research ForumWashington, DC 20036United States of America

October 2004

ISBN: 1-878734-82-2

Library of Congress: 2004109330

Photos courtesy of AP Worldwide Photos and the Bureau of Alcohol, Tobacco, Firearms and Explosives Cover design and layout by Nelson Design Group, Inc.

80828_i-200.R7 10/8/04 12:07 AM Page ii

C O N T E N T S ■ iii

FOREWORD..............................................................v

ACKNOWLEDGMENTS..............................................vii

INTRODUCTION ........................................................1

PROLOGUE ..............................................................7The Sniper Investigation: A Timeline of Events

CHAPTER ONE .......................................................13High-Profile Investigations

CHAPTER TWO .......................................................19Leadership

CHAPTER THREE....................................................35Federal Law Enforcement Resources

CHAPTER FOUR .....................................................49Managing Investigations

CHAPTER FIVE .......................................................61Information Management

CHAPTER SIX.........................................................77Local Law Enforcement Operations

CHAPTER SEVEN....................................................89Media Relations

CHAPTER EIGHT...................................................103Community Issues

CHAPTER NINE ....................................................113Final Thoughts

REFERENCES.......................................................119

APPENDIX A.........................................................121Individuals Interviewed During the Project by PERF Staff

APPENDIX B ........................................................125List of Focus Group Participants

APPENDIX C ........................................................127SNIPEMUR Task Force Recommendations for State and Local Law Enforcement Agencies

APPENDIX D ........................................................133Serial Sniper Law

APPENDIX E.........................................................135Chief Charles A. Moose’s Letter Requesting Federal Assistance

Appendix F ..........................................................137Joint Operations Center Floor Plan Template

Appendix G..........................................................139Fairfax County (VA) and Prince William County (VA) Police Department Briefings Provided to Officers

APPENDIX H ........................................................151Arlington County (VA) Police Department Special Order

APPENDIX I..........................................................157Montgomery County (MD) Police Department Press Pass #1341

APPENDIX J .........................................................159Montgomery County (MD) Police Department: How To Be a Good Witness

APPENDIX K.........................................................161Prince William County (VA) Community Services Board: Dealing with the Sniper Attacks

APPENDIX L .........................................................165Montgomery County (MD) Public Schools,Emergency Response Plan

APPENDIX M ........................................................193Arlington County (VA) Public SchoolSuperintendent Robert G. Smith’s Letter to Parents

ABOUT THE AUTHORS...........................................195

ABOUT THE OFFICE OF JUSTICE PROGRAMS ..........198

ABOUT THE POLICE EXECUTIVE RESEARCH FORUM...............................................200

C O N T E N T S

80828_i-200.R7 10/8/04 12:07 AM Page iii

iv

80828_i-200.R7 10/8/04 12:07 AM Page iv

F O R E W O R D ■ v

With the Washington, D.C. region stillreeling from the September 11 terror-ist attack on the Pentagon and the dis-

covery of anthrax-tainted letters in the area,another form of terrorism swept through thenation’s capital in October 2002: a killing spreethat targeted victims indiscriminately. The sniper’svictims were shot with a high-powered rifle fromlong distances, leaving no eyewitnesses and verylittle information for law enforcement.

The shootings spanned eight local jurisdictions,and involved more than a thousand investigatorsfrom local and state agencies, as well as membersof the Federal Bureau of Investigation (FBI);Bureau of Alcohol, Tobacco, Firearms andExplosives (ATF); the U.S. Marshals Service; theU.S. Secret Service and other federal law enforce-ment agencies. The result was what some believe isthe largest multijurisdictional, multi-agency inves-tigation in our country’s history—an investigationthat can serve as a case study of cooperationamong local, state and federal law enforcement.While the chief executives most affected by thesniper case—and those under their command—developed ad hoc protocols for working together,other agencies now have in this report the compre-hensive information to help them anticipate andresolve many obstacles to future collaboration.Law enforcement agencies at every level of govern-ment must learn from the sniper investigationteam’s successful approaches, and address themany issues it identified that require a thoughtfuland thorough strategy for performing a complex,

high-profile investigation in the future—a strategythat can be tailored to the unique needs andresources of the agencies’ communities.

It was for this reason that the Office of JusticePrograms (OJP) contracted with the PoliceExecutive Research Forum (PERF) to conduct anexhaustive review of the events of October 2002, col-lecting information from the law enforcement pro-fessionals who were on the front lines of the investi-gation—information about the critical lessons theyfeel could benefit other agencies in the future.

Managing a Multijurisdictional Investigation:Identifying the Lessons Learned from the SniperInvestigation serves as a guide for law enforcementexecutives, managers and investigators who mustbe prepared to address key problems and concernsshould a similar incident occur in their jurisdic-tion. Moreover, with local and state law enforce-ment assuming a larger responsibility in the fightagainst terrorism, we hope this manual can assistevery agency in the country in preparing for anyhigh-profile multijurisdictional criminal investi-gation, including one that involves terrorism. Thisreport provides law enforcement agencies withrecommendations for solving both technical andpractical problems such as coordinating investiga-tive resources, fostering communication withinand between departments, accessing federal lawenforcement resources, releasing information tothe community and the media, and turning rawdata into meaningful intelligence.

F O R E W O R D

80828_i-200.R7 10/8/04 12:07 AM Page v

PERF, with funding from the Bureau of JusticeAssistance (BJA), Office of Justice Programs, con-ducted more than 100 interviews with representa-tives of every law enforcement agency that wasprominently involved in the investigation, as wellas with prosecutors, government officials andschool leaders. The purpose of the project was toidentify the “lessons learned” from the task forceinvestigation by detailing the successful strategiesit used for resolving problems, as well as discussingthe challenges that were never fully met. The resultis an unparalleled and comprehensive guide forhow to successfully plan and manage a high-pro-file investigation that crosses multiple jurisdic-tional lines. The report does not second-guess theactions or decisions of officials, but relies on their

vi ■ F O R E W O R D

experiences to inform other authorities of thechallenges they might face in a similar investiga-tion. OJP believes this crucial report will enablelaw enforcement agencies to respond swiftly, cohe-sively and effectively when managing high-profile,multi-agency criminal investigations.

Deborah J. Daniels Assistant Attorney GeneralOffice of Justice ProgramsU.S. Department of Justice

80828_i-200.R7 10/8/04 12:07 AM Page vi

A C K N O W L E D G M E N T S ■ vii

We want to thank the many individualswho contributed to this Bureau ofJustice Assistance-supported report.

Every individual who participated in this projectsaw its potential to assist other law enforcementleaders in preparing their agencies for a multijuris-dictional investigation, and advanced this projectin that spirit.

First and foremost, we must thank those lawenforcement executives of the local agencies thathad to respond to and investigate sniper homi-cides and shootings: Montgomery County (MD)Police Chief Charles Moose,1 Washington (DC)Metropolitan Police Chief Charles Ramsey,Spotsylvania County (VA) Sheriff Ronald Knight,Prince George’s County (MD) Police Chief GeraldWilson, Prince William County (VA) Police ChiefCharlie Deane, Fairfax County (VA) Police ChiefThomas Manger, Ashland (VA) Police ChiefFrederic Pleasants, Jr., and Hanover County (VA)Sheriff Stuart Cook. During 23 days in October2002, those agencies faced enormous challenges tocapture the suspects, minimize community fearand provide routine law enforcement services. Forthis project, these executives allowed us to inter-view them and granted us access to any personnelwho could help provide insight into their experi-ences. Clearly, this report would not have beenpossible without their cooperation and assistance.

During the investigation, an extensive number oflaw enforcement agencies without shootingsallowed us to interview staff and review records.

The Maryland State Police and the Howard County(MD) Police Department provided valuable infor-mation. In Virginia, the State Police, the ArlingtonCounty Police Department, and the ChesterfieldCounty Police Department also opened their doorsand their records to the project team.

The Federal Bureau of Investigation (FBI) and theBureau of Alcohol, Tobacco, Firearms andExplosives (ATF) provided support throughout theproject. The FBI’s Gary Bald,2 the Special Agent inCharge of the Baltimore Field Office, and the ATF’sMichael Bouchard,3 Special Agent in Charge of theBaltimore Field Office, stood shoulder to shoulderwith local law enforcement during the investigationand ensured that PERF staff members were able tointerview key personnel for this effort. Federal agen-cies that contributed critical support and back-ground on their significant roles include the DrugEnforcement Administration, Federal ProtectiveService, Immigration and Naturalization Service,U.S. Capitol Police, U.S. Customs Service, U.S.Marshals Service, U.S. Park Police, U.S. PostalInspectors and U.S. Secret Service.

We especially thank Assistant Attorney GeneralDeborah Daniels who early on had the vision tosee the importance of this project for law enforce-

A C K N O W L E D G M E N T S

1 At this writing, Chief Moose has left the MontgomeryCounty Police Department and Chief Manger has sincetaken his position.

2 Gary Bald, at this time, is an Assistant Director of the FBI.

3 Michael Bouchard is now the Assistant Director of the ATF.

80828_i-200.R7 10/8/04 12:07 AM Page vii

ment. She has been an invaluable contributor, pro-viding advice from beginning to end. BJA’s SteveEdwards played a key role in determining the pro-ject’s scope and provided support and guidance ashe reviewed drafts of the report.

We also thank the participants of the PublicInformation Officers’ and Investigators’ focusgroups listed in Appendix B, including representa-tives of the Metropolitan Police of London(Scotland Yard), the Baton Rouge Task Force, theGreen River Task Force, investigators from theWashington, D.C. Starbucks murder case, theBaltimore County Police Department and the FBICritical Incident Response Group.

As for PERF staff, the project would not have beenpossible without Heather Davies, Bryce Kolpackand PERF Fellow Mike Adams of the Charlotte-Mecklenburg Police Department. Heather wasinstrumental in managing the project, draftingsections of this report and overseeing its produc-tion. Bryce and Mike conducted dozens of pivotalinterviews with law enforcement personnel, iden-tified critical issues and provided structure for thefinal report. Other key staff included TerryChowanec and Alex Hayes, who provided valuableassistance to the project and contributed impor-tant content to this report.

Lorie Fridell, Corina Sole Brito, Gail Love, TonyNarr, Cliff Diamond, Stacy Osnick Milligan,Deirdre Mead and Chief James Burack of theMilliken, Colorado, Police Department reviewedearly drafts of the report and provided guidance.

viii ■ A C K N O W L E D G M E N T S

Martha Plotkin edited the report. She also wroteand rewrote sections of the report to make it a bet-ter product. Along with her considerable editingskills, she contributed sage advice, born of rareinstincts and years of dedicated service toAmerican law enforcement.

Ultimately, we take responsibility for the contentof the report. We are enormously grateful to themembers of the law enforcement community whorisked their lives to keep our communities safe,and who were so supportive of this project. Wededicate this report to those officers and to the vic-tims of the sniper attacks.

Gerard R. MurphyPolice Executive Research Forum

Chuck WexlerPolice Executive Research Forum

80828_i-200.R7 10/8/04 12:07 AM Page viii

I N T R O D U C T I O N ■ 1

For 23 days in October 2002, a sniper teamterrorized the Washington, D.C. and CentralVirginia regions, challenging the area’s law

enforcement agencies in ways never before seen. Themanhunt and investigation that led to the capture oftwo suspects eventually included more than 20 local,two state and at least ten federal law enforcementagencies. The sniper investigation provides anunparalleled learning opportunity for other lawenforcement agencies. This report distills critical les-sons and strategies that police professionals acrossthe nation can apply to their unique requirements.In the end, readers should be able to better assesstheir agencies’ ability to participate in complex, mul-tijurisdictional investigations.

Very little exists in the way of “best practices” tohelp agencies initiate, manage and conduct amulti-agency investigation. This report is meant toenhance readers’ understanding of how to leadthese investigations. It identifies the challengesencountered by those who were involved in thesniper case, as well as lessons learned and recom-mendations to guide law enforcement executivesand managers who might have to conduct similarinvestigations one day. It emphasizes the positiveand negative aspects of the investigation that havesignificant implications for how other police agen-cies can prepare for and respond to serial crimesthat cross multiple jurisdictional boundaries.

A R E A D E R ’ S R O A D M A PWhile this report is meant primarily to help and pre-pare law enforcement executives, investigators andmanagers who may one day find themselves in the

national spotlight as the next sensational crimecrosses their jurisdictional boundaries, other policeprofessionals, policy makers and stakeholders cangain a better understanding of the complexity of thetasks and the need for support. It is not a detailedrecipe, but rather general guidance to better under-stand what questions to address before investigatingany high-profile crimes involving several lawenforcement agencies—whether they are gangcrimes, serial killings or acts of terrorism.

While the appendices include many useful docu-ments, it was difficult to develop organizationalcharts and schematics of exactly how the case pro-gressed. Some sniper case reviewers have asked fora comprehensive graphic of how many resourceswere infused, and from what sources, or even atwhat times in the case, but there was no such stat-ic structure. The reality is that this was a tremen-dously fluid case. Resources from federal, state andlocal agencies ebbed and flowed, sometimes tomeet specific needs and sometimes unsolicited.Perhaps more important than documenting thesedetails is the need to fully grasp the overall themes,challenges, approaches and actions that can begeneralized to other agencies. In the end, thisreport was structured to meet any law enforce-ment agency’s needs by providing the kind ofadvice that can be tailored to any highly complexcase in which there is concurrent jurisdiction.

So How Do We Get There?This report is divided into the following chapters:

• Prologue: The Sniper Investigation:A Timeline of Events

I N T R O D U C T I O N

80828_i-200.R7 10/8/04 12:07 AM Page 1

• Chapter One: High-Profile Investigations• Chapter Two: Leadership• Chapter Three: Federal Law Enforcement

Resources• Chapter Four: Managing Investigations• Chapter Five: Information Management• Chapter Six: Local Law Enforcement

Operations• Chapter Seven: Media Relations• Chapter Eight: Community Issues• Chapter Nine: Final Thoughts

Each chapter begins with some of the fundamen-tal questions that law enforcement leaders, man-agers and investigators considered throughout theinvestigation. The chapters then address problemsor challenges that arose during the investigationfor individual agencies as well as for task forces.Many of the chapter discussions, including exam-ples and lessons learned, detail individual agen-cies’ encounters and efforts during the sniperinvestigation. The materials are meant to betterprepare law enforcement agencies for a majorinvestigation either solely within their jurisdictionor as a member of a multijurisdictional task forceinvestigation.

The following sections of this Introductionexplain the methods used to collect informationfor the project, as well as what kind of case wouldbe similar enough to warrant the kind of respons-es and efforts made in Montgomery County,Maryland. While most people feel they will knowa high-profile, multi-agency effort when they seeone, it can be helpful to note the common ele-ments that such cases share. These elements eachproduce their own challenges, and to view themseparately allows decision makers the perspectiveto take them on one at a time, if they choose.

To provide readers with some context in which toview law enforcement actions in the sniper case, andto instill some sense of order in what was an admit-tedly chaotic case, Chapter One outlines four basicthemes that are repeated and reflected in many ofthe chapters that discuss the decisions and actionstaken in the sniper case as well as other complexinvestigations. The four themes revolve around

planning and preparation; defining roles andresponsibilities; managing information efficiently;and maintaining effective communications.

Having developed a common framework in whichto view the sniper case and other multijurisdiction-al efforts, the reader can then determine what typesof scenarios in his or her jurisdiction would benefitfrom the kind of preparation and responses outlinedin the report. The remaining chapters can be viewedwith an eye toward which methods and resourcescould be used, and where there are gaps.

The prologue timeline is meant as a reference tokeep the overall response in focus. With the manyefforts by local, state and federal agencies, it is easyto lose sight of the fact that they all took placewithin 23 days, and without warning. The reporttakes those events and swivels them on an axis,allowing readers to glimpse them through differ-ent lenses: The first two chapters provide insightinto how a high-profile investigation is identifiedand started. They also present the events throughthe eyes of an effective leader, and examine the fac-tors that determine good leadership in unchartedwaters. It is not easy to determine which jurisdic-tion should take the lead in an investigation inwhich every move is scrutinized by the nationalmedia. The challenges of how to coordinate multi-ple task forces and define meaningful roles andresponsibilities are among the many issuesrevealed and addressed.

In Chapter Three, the investigation is viewed fromthe perspective of what federal law enforcementagencies can contribute. Their support includes themany types of resources (personnel, equipment,forensic expertise and more) that federal agencieshave to offer, and they are considerable. But how and when does a law enforcement agency ask forthese resources? Who defines the duties that eachagency will take on to ensure effective and fullyinformed responses? This chapter details these andother issues, such as setting up joint operationscenters and other interagency structures.

Chapter Four provides a closer look at some of thespecifics of case management—whether it is deter-

2 ■ I N T R O D U C T I O N

80828_i-200.R7 10/8/04 12:07 AM Page 2

mining the size of a crime scene, deciding whichlabs are best qualified to handle different types offorensic evidence, or figuring out how to managetruly massive amounts of leads and follow-ups.

Chapter Five follows on the heels of these issues bypicking up the topics related to information man-agement and intelligence analysis. It also tacklessuch practical issues as how to set up effective com-munication plans and tip-line centers. Among themany significant difficulties discussed in this chapterare those related to staffing a hotline and managingthe information that is developed from those tips.

Perhaps the most detailed chapter on practicalaction is Chapter Six: Local Law EnforcementOperations. This chapter demonstrates how draw-ing on the expertise of every division in a localagency is necessary to keep pace with a high-pro-file investigation. Some of those resources will besolely in support of the operation, while othersmaintain the necessary work of addressing thedaily business of dealing with other crimes. Thischapter demonstrates how patrol, traffic, evidenceand forensics, tactical, aviation, administrative andother functions are critical to such an investiga-tion. Officer safety, morale and support are essen-tial. And as the chapter describes, resource alloca-tion is a dynamic and difficult process.

Chapters Seven and Eight turn the focus to mediaconcerns and community issues, respectively.Some commentators have speculated that theunprecedented media coverage helped to makenews, rather than just report it. The media investi-gated the case aggressively, helped police commu-nicate with the suspects, and have alternately beencredited with both keeping on edge and reassuringa frightened public. Some claim the sensational,around-the-clock coverage contributed to thecommunity’s tremendous feelings of vulnerability.Certainly, journalists had an impact on the inves-tigation and public response. These issues areexplored in Chapter Seven, as are those related tomanaging the public information function: howand when to hold press conferences, what to doabout information leaks and the essentials forplanning and preparing for high-profile cases.

Community fears were so extreme during thethree-week shooting spree that residents were hid-ing in their homes, afraid to go to gas stations andmalls where the majority of attacks were clustered.The chapter on community issues discusses whatlaw enforcement can do to guide and reassure thepublic through outreach, victim assistance andworking with schools. Evident from this chapter isthat these types of crimes can be every bit as desta-bilizing to a community as an act of terror.

Of course, not every challenge or problem wasfully resolved during the 23-day series of shoot-ings. The final chapter highlights some of the mostsignificant lessons learned from the sniper caseand prompts readers to consider their readinessshould a multifaceted case occur in their region.The need for shared intelligence, secure communi-cation, effective leadership, solid interagency rela-tions and collaborations are some of the manythemes discussed in Chapter Nine.

In all, it is important to remember that the lawenforcement personnel involved in the sniperinvestigation overcame tremendous obstacles toresolve the case. They also sometimes made deci-sions or took actions they may not have if they hada second opportunity. Based on their collectiveexperiences and valuable insights, this reportoffers advice and examples of successful collabora-tion across jurisdictional lines.

P R O J E C T S C O P EThis report is based on the findings of a Bureau ofJustice Assistance (BJA)-supported study thatincluded a review of how eight jurisdictionsresponded to the October 2002 shooting inci-dents,4 and how they joined other agencies towork in a task force investigation. The projectfocused on identifying the key organizational andpolicy areas for which “lessons learned” and recom-mendations could benefit the law enforcement pro-fession. The project team concentrated on identify-


4 The sniper team shot individuals in seven jurisdictions, butone of those jurisdictions—Ashland, Virginia—relied uponthe Hanover County Sheriff ’s Office to conduct the criminalinvestigation.

80828_i-200.R7 10/8/04 12:07 AM Page 3

ing and analyzing the major challenges and obsta-cles confronted by the multi-agency task force, aswell as how those agencies overcame them. ThePERF project staff asked law enforcement officialsto evaluate what worked well, what did not, andwhat should have been done differently.

The project focused on law enforcement opera-tions from October 2–24, 2002. It did not addressany law enforcement actions prior to October 2,nor did it examine prosecutorial or judicial pro-ceedings after the suspects’ arrests on October 24.5

The project was not meant to create an exhaustiverecord. It is important to recognize what the majorfocus of this report is and what it is not. This reportis not an after-action analysis or a debriefing. It doesnot critique the decisions or actions of anyoneinvolved in the investigation. It also does not focuson evidence or evidentiary matters. Simply stated,the report is a case study of organizational manage-ment and decision making that identifies those issuescritical to developing sound law enforcement policiesand procedures.

D E F I N I N G S I M I L A R C R I M E SThe project goal was to advance law enforcement’spreparedness for conducting investigations of sim-ilar crimes. Project staff struggled to define thenature and breadth of events similar to the snipercase, and identified four characteristics thatdeserve consideration:

• community fear coupled with media coverage• type of crime • suspect leads• investigative complexity

For the purposes of this project, a “similar crime”that might warrant a multijurisdictional responselike the sniper case would, at minimum, include acrime that induces significant public fear andevokes considerable media attention. This couldinclude a particularly heinous crime against a childor young person (e.g., JonBenet Ramsey, ChandraLevy) or the assassination of a political leader.Other similar crimes include mass murders, serialmurders, sprees involving violent crimes (e.g.,Andre Cunanan), or even prolonged hostage/barri-

cade incidents (e.g., Ruby Ridge, Waco).Community fear and media coverage of any ofthese crimes would obviously escalate if there werea sense that the police have few leads or have madelittle progress in apprehending the suspects.Complex investigations, such as those that includemultiple agencies as well as federal-local task forces,may well follow the sniper case approach. Finally,those responding to acts of terrorism (e.g., bomb-ings, anthrax contamination) could draw on manyof the lessons learned in the sniper case.

P R O J E C T D E S I G N /I N F O R M AT I O N C O L L E C T I O NThe project team6 relied on several data collectiontechniques, including conducting interviews;observing activities, facilities and locations;reviewing documents and policies; and conduct-ing focus groups.

InterviewsInterviews were conducted with more than 100 lawenforcement personnel who played key roles in pre-venting, responding to, and investigating the snipershootings, as well as apprehending the suspects. Theproject team focused on gathering information andinterviewing chief executives and key decision mak-ers from the agencies that investigated the snipershootings in their service area: the MontgomeryCounty (MD) Police Department, Washington(DC) Metropolitan Police Department,Spotsylvania County (VA) Sheriff ’s Office, PrinceGeorge’s County (MD) Police Department, PrinceWilliam County (VA) Police Department, FairfaxCounty (VA) Police Department, and Ashland (VA)Police Department in conjunction with the HanoverCounty (VA) Sheriff ’s Office.

4 ■ I N T R O D U C T I O N

5 Following their arrests on October 24, 2002, law enforcementofficials were able to link the suspects to a number of homi-cides, shootings, robberies and other crimes dating back toFebruary 16, 2002. All told, the suspects have been linked to22 shootings (Cannon et al. 2003).

6 The project team was comprised primarily of Project DirectorGerard Murphy, Project Manager Heather Davies, andExecutive Director Chuck Wexler. Bryce Kolpack, MikeAdams and Terry Chowanec conducted countless interviewsand provided useful insights. The following PERF staffprovided assistance by documenting interviews: JasonCheney, Alex Hayes and Steve Loyka.

80828_i-200.R7 10/8/04 12:07 AM Page 4

The PERF project team also spoke with all local,state and federal agencies that were represented onthe Montgomery County task force. They inter-viewed the Special Agents in Charge of theBaltimore Field Office of the ATF, the BaltimoreField Office of the FBI, the FBI’s Critical IncidentResponse Group, and the Washington, D.C. FieldOffice of the U.S. Secret Service. In addition, PERFinterviewed chief executives from other agenciesthat provided assistance to the primary lawenforcement agencies, including the MarylandState Police and Virginia State Police. The projectteam interviewed current and former staff mem-bers of the respective law enforcement agenciesinvolved, including command staff, middle man-agers, investigators, patrol officers, emergencyservice/tactical officers, civilian specialists, prose-cutors, government leaders and school officialswho played important roles in the events.

Though unable to interview all of the many hun-dreds of individuals involved in the investigation,those that were conducted represent a full range ofperspectives, accounts and lessons learned. (SeeAppendix A for a list of individuals interviewed.)7

Focus GroupsInvestigations. This project included a compre-hensive examination and analysis of the forma-tion, operation and sustainability of a task forcelike the one used in the sniper case. PERF hosted afocus group of representatives who had handledother highly visible multijurisdictional, multi-agency and/or serial killer investigations to identi-fy the similarities and differences among thosecases. Tw ency: the street-level investigator, theinvestigative manager and the chief executive.Individuals in these roles perform very differentfunctions during an investigation that, taken as awhole, are critical to an agency’s overall ability toeffectively manage an investigation. The grouprepresented agencies of various sizes and with dif-ferent investigative experiences in multijurisdic-tional or serial crimes. A representative fromLondon’s Scotland Yard participated in the sessionas well.

The two-day meeting was organized as a facilitat-ed discussion focusing on specific investigativeissues. Before the session, PERF staff provided theparticipants with a list of issues and questions toconsider. The session provided an invaluableopportunity to discuss focused responses to thesekey issues as well as experiences of those involvedin the sniper and other complex cases.Participants’ answers to the facilitators’ directedquestions revealed many lessons learned in theirinvestigations, including recommendations formanaging a multi-agency criminal investigation.Additional findings from this group are pepperedthroughout this document.

Public Information. Few investigations inAmerican law enforcement history have everreceived the amount and type of media coveragegenerated by the sniper case. The 24-hour newscoverage, reporters following investigators, uncor-roborated media stories, and editorials critical oflaw enforcement reflected the media’s intimateinvolvement in this investigation. The mediaplayed a critical role in the case and can be expect-ed to do the same in future cases.

PERF project staff held a second focus group forpublic information officers from some of the stateand local law enforcement agencies involved in thesniper task force to discuss their experiences withthe media. The public information officers dis-cussed practical steps for addressing reporters’questions, determining the media relationsresponsibilities of key agency personnel and beingresponsive to community concerns.


7 Though most of the interviews were conducted in person,some individuals were interviewed by telephone. Staff used asemi-structured protocol for every interview to ensure theintegrity of the process.

80828_i-200.R7 10/8/04 12:07 AM Page 5

6

80828_i-200.R7 10/8/04 12:07 AM Page 6

P R O L O G U E ■ 7

The following is a chronological account ofthe events surrounding the sniper case—one of the largest multijurisdictional

criminal cases in the country’s history. The eventsbegan on October 2, 2002 with what investigatorsperceived to be a random act of vandalism andculminated on October 24, 2002 with the arrest oftwo men believed to be responsible for 14 areashootings, 10 of which resulted in the victims’deaths.

DAY 1: Wednesday, October 2, 2002Shooting 1: Approximately 5:20 P.M., MichaelsCraft Store, Northgate Plaza, Aspen Hill,Maryland: no injuries. A bullet shatters a win-dow, barely missing cashier Ann Chapman andembeds into a rear wall. No one is hurt.

Shooting 2: Approximately 6:04 P.M., ShoppersFood Warehouse, Georgia Avenue, Wheaton,Maryland: James Martin, 55, is shot and killedwhile crossing the parking lot of the discount gro-cery store. Security cameras record him grabbinghis chest, but nothing useful to the investigation.The crime scene offers no leads and there are noeyewitnesses. By all accounts, Martin is an idealcitizen.

DAY 2: Thursday, October 3, 20029

Shooting 3: Approximately 7:41 A.M., FitzgeraldAuto Mall, Rockville, Maryland: James L.Buchanan, 39, is shot and killed while mowingthe lawn surrounding the auto mall. Discoveredby a parking lot attendant, he is rushed to nearbySuburban Hospital where he is pronounced dead.

Initially, doctors classify the death as an “indus-trial accident.” Apparently, passers-by thoughtBuchanan had slipped and fallen under themower’s blade. There was also information thathe may have been struck by a projectile or that thelawn mower engine had exploded.

Shooting 4: Approximately 8:12 A.M., Mobil gasstation, Aspen Hill, Maryland: PremkumarWalekar, 54, is shot and killed while filling histaxicab with gas. A Montgomery County PoliceDepartment officer, patrolling the area just a fewblocks away, is first on the scene after beingflagged down by a civilian. This call was trans-mitted over the police radio before the call report-ing the Buchanan shooting.

Shooting 5: Approximately 8:37 A.M., Crisp andJuicy Chicken restaurant, Silver Spring, Maryland:Sarah Ramos, 34, is shot in the head and killed witha high-powered bullet while waiting for her boss. Amotorist reports a suicide. A detective arrives onthe scene and quickly ascertains the death to be a

P R O L O G U E 8

8 This prologue was compiled by Alex Hayes based on informa-tion from sources for this report and the following materials:23 Days of Terror: The Compelling True Story of the Huntand Capture of the Beltway Snipers (Cannon et al. 2003),Sniper: Inside the Hunt for the Killers Who Terrorized theNation (Horwitz and Ruane 2003), Three Weeks inOctober: The Manhunt for the Serial Sniper (Moose 2003)and various articles found in the Baltimore Sun and TheWashington Post.

9 After each shooting, ATF forensics experts analyzed the pro-jectiles and, when possible, linked the shooting to other shoot-ings. It was important to get the message out quickly in orderto deem cases linked or unrelated.

The Sniper Investigation: A Timeline of Events

80828_i-200.R7 10/8/04 12:07 AM Page 7

homicide. A landscaper working nearby reportswhat he believes to be a white box truck with blacklettering and a damaged lift gate with two peopleinside that exited the parking lot and headed northon Georgia Avenue.

Shooting 6: Approximately 9:58 A.M., Shell gasstation, Kensington, Maryland: Lori Ann Lewis-Rivera, 25, is shot and killed while vacuuming theinterior of her minivan. Officers review a videoshot by a security camera positioned on the firestation across the street but gain no relevantinformation or useful leads.

• Montgomery County Police Department(MCPD) establishes temporary commandpost.

• Chief Moose Press Conference: “Our homi-cide rate just increased 25 percent in one day.”

• Montgomery County Public School System(MCPS) declares a Code Blue.

• Maryland State Police (MSP) deploys over100 troopers to assist the MCPD.

• MCPD asks the Bureau of Alcohol, Tobacco,Firearms and Explosives for assistance. Inresponse, the ATF provides personnel, assis-tance for laboratory work and access to theFirearms Technology Branch.

• First “Be-on-the-Lookout” (BOLO) alert isissued for a white box truck apparentlyobserved fleeing the scene.

• FBI Special Agent in Charge (SAC) Gary Baldcalls Chief Moose and offers assistance.

• Local, state and federal officials establish acombined tactical operation.

Shooting 7: Approximately 9:20 P.M., GeorgiaAvenue, Northwest, Washington, D.C.: PascalCharlot, 72, is shot and killed by a single bullet ashe walks up Georgia Avenue. Witnesses claim theshot came from across the street on Kalmia Road.One claims to have seen a dark four-door ChevyCaprice parked along the 7800 block of GeorgiaAvenue 10 minutes before the shooting. Yetanother witness says the Caprice headed west onKalmia with its lights off seconds after the shoot-ing. The description of the Caprice is put out bythe Metropolitan Police Department.

• Chief Ramsey of the Metropolitan PoliceDepartment (MPD) assigns investigators tojoin Chief Moose’s growing task force.

DAY 3: Friday, October 4, 2002• The ATF concludes that fragments recovered

from four of the initial seven shootings indi-cate that the bullets were fired from the sameweapon.

• FBI Supervisory Special Agent (SSA) GeorgeLayton responds with additional agents toassist the MCPD.

• Chief Moose press conference: He announcesthat the high-speed bullets being used arefrom an assault-type weapon. He also appealsto the public to continue to call the tip line.

• Authorities disseminate handouts ofdescriptions of the possible types offirearm(s) being used.

• ATF Special Agent in Charge Mike Bouchardjoins the case.

• FBI deploys its Rapid Start computerprogram.

Shooting 8: Approximately 2:30 P.M., MichaelsCraft Store, Spotsylvania Mall, Fredericksburg,Virginia: Caroline Seawell, a 43-year-old femaleis shot in the back and wounded while loadingbags into her minivan. Again, a witness claims tohave seen a white van fleeing the scene. Anotherwitness saw a dark older-model Chevrolet slowlyexiting the mall’s parking lot moments after theshooting.

• Spotsylvania County Sheriff Ronald Knightjoins the sniper task force team accompaniedby Richmond FBI SAC Don Thompson.

DAYS 4–5: Saturday–Sunday, October 5–6, 2002No shootings

• Case name SNIPEMUR is approved andMCPD immediately receives support to leasespace and equipment.

• Chief Moose press conference: He rules out asuspect leaked to the media and announcesthat, along with the MSP, they will be increas-ing visibility at area schools.

8 ■ P R O L O G U E

80828_i-200.R7 10/8/04 12:07 AM Page 8

• FBI Director Robert Mueller calls ChiefMoose to let him know he has the Bureau’sfull support and that any and all resourceswill be at his disposal.

• FBI Behavioral Science Unit supervisorsarrive at MCPD and begin profiling efforts.

DAY 6: Monday, October 7, 2002Shooting 9: Approximately 8:08 A.M., BenjaminTasker Middle School, Bowie, Maryland: IranBrown, 13, is shot in front of his school whilewalking to class. He is quickly driven to BowieHealth Center by his aunt and then airlifted toChildren’s Hospital. Witnesses claim to have spot-ted a white van parked outside the school. Theshooters leave a tarot card containing the firstmessage for law enforcement.

• Chief Moose press conference: “Shooting a kid.I guess it’s getting really, really personal now.”

• Prince George’s County schools declare aCode Blue.

• Chief Moose sends a letter to U.S. AttorneyGeneral John Ashcroft requesting federalassistance.

• Prince George’s County Police Chief GeraldWilson and investigators join the sniper taskforce.

• FBI Director Mueller informs SAC Gary Baldthat he will lead the FBI’s role in the investi-gation.

DAY 7: Tuesday, October 8, 2002• WUSA Channel-9 leaks the existence of the

tarot card.• FBI SAC Gary Bald arrives at MCPD and

accompanies Chief Moose and ATF SACMichael Bouchard to the podium for the day’spress conference.

• Maryland State Police Superintendent DavidMitchell assigns more than 140 state troopersto work with the Montgomery and PrinceGeorge’s County Police Departments.

• Moose, Bald and Bouchard decide to repre-sent and speak on behalf of law enforcementas “one voice.”

• Profilers of the FBI’s Behavioral Science Unitjoin the case.

DAY 8: Wednesday, October 9, 2002• Chief Moose press conference: “I have not

received any messages that the citizens ofMontgomery County want Channel 9 or TheWashington Post or any other media outlet tosolve this case.”

• FBI SSA George Layton asks the headquartersfor funds to help construct the JointOperations Center (JOC) at a location adja-cent to police headquarters.

• FBI Assistant Director Van Harp confers withMoose and Bald and offers to run a telephonetip line out of the Washington, D.C. FieldOffice.

Shooting 10: Approximately 8:18 P.M., Sunoco gasstation, Manassas, Virginia: Dean Meyers, 53, isshot and killed after filling his car with gas. He diesinstantly. A witness report prompts Prince WilliamCounty Police to issue an all-points-bulletin for awhite Dodge Caravan with two men inside.

• Prince William County Police Chief CharlieDeane and investigators join the sniper taskforce.

• Between 200 and 300 investigators swarm thecrime scene.

• Roads are closed, as are entrance ramps toInterstate 66.

• Rapid Start is ready to receive sniper investi-gation data.

DAY 9: Thursday, October 10, 2002• The FBI tip line has received 8,000 calls by

this time.

DAY 10: Friday, October 11, 2002Shooting 11: Approximately 9:30 A.M., Exxon gasstation, Fredericksburg, Virginia: Kenneth Bridges,53, is shot and killed only 50 yards from a VirginiaState trooper working a traffic accident. The troop-er rushes to aid Bridges, but there is nothing he cando. Witnesses describe a white Chevrolet Astro vanwith two men inside heading toward Interstate 95.

• Authorities shut down Route 1 and entranceramps to Interstate 95.


80828_i-200.R7 10/8/04 12:07 AM Page 9

• Virginia State Police Superintendent GeraldMassengill urges people not to focus only onwhite vans.

• ATF agents conduct a grid search of the crimescene.

• D.C.-area police chiefs meet to discuss a uni-fied approach to the shootings.

DAY 11: Saturday, October 12, 2002• Sheriff Ronald Knight press conference: He

refers to the shootings and resulting fear levelsas a form of terrorism.

• Outdoor events are cancelled and schools areput on lockdown.

• Chief Moose releases composites of white boxtrucks.

• Chief Ramsey tells the press that his patrol offi-cers and detectives are looking for an older-model, burgundy-colored Chevrolet Caprice.

DAY 12: Sunday, October 13, 2002• Besides tip lines being inundated with calls,

the day is relatively quiet.• Moose, Bouchard and Bald appear on CNN’s

Late Edition where they discuss the BOLO forthe Caprice but remain focused on a whitebox truck.

DAY 13: Monday, October 14, 2002• President Bush calls the sniper(s): “A sick

mind who obviously loves terrorizing society.”

Shooting 12: Approximately 9:15 P.M., HomeDepot, Seven Corners, Falls Church, Virginia:FBI Analyst Linda Franklin, 47, is shot and killedby a single gunshot to the head while loading sup-plies into her car with her husband. Franklin’sshooting takes place in the most populated areayet. A witness, Matthew Dowdy, tells investigatorshe saw a gunman with an AK-74 assault riflesome 100 yards away.

• Fairfax County Police Chief Tom Manger andhis investigators join the sniper task force.

• Another dragnet ensues, as does another gridsearch of the area surrounding the crimescene.

DAY 14: Tuesday, October 15, 2002• Chief Moose and Spotsylvania County

Sheriff ’s Major Howard Smith release twoFBI-prepared witness-generated compositesof the suspicious white van: most closelyresembling a Chevrolet Astro and FordEconovan.

DAY 15: Wednesday, October 16, 2002• MCPD Captain Nancy Demme advises citi-

zens on how to react should they be near ashooting. Demme tells reporters of MatthewDowdy’s (false) eyewitness account claimingto have seen a man fire an AK-74.

• The FBI signs an agreement with theDepartment of Defense for deployment ofsurveillance aircraft.

• Media outlets report that the Pentagon hasdeployed RC-7 reconnaissance planes to assistlaw enforcement.

DAY 16: Thursday, October 17, 2002• Chief Tom Manger discredits Dowdy’s story.

DAY 17: Friday, October 18, 2002• Fairfax County Police arrest false witness

Dowdy.• Chief Moose press conference: He says that

many people were very disturbed that a wit-ness gave false information to police.

DAY 18: Saturday, October 19, 2002Shooting 13: Approximately 7:59 P.M., PonderosaSteakhouse, Hanover County, Ashland, Virginia:Jeffrey Hopper, 37, is shot and critically woundedin the abdomen while leaving the restaurant withhis wife. The shooters leave a second written com-munication.

• Ashland, Virginia Police Chief FredericPleasants, Jr. joins members of the HanoverCounty Sheriff ’s Department in the task forceinvestigation.

• Virginia State Police block every exit of theinterstate from Richmond to Washington,D.C., including long stretches of I-95.

• Investigators find a letter from the sniper(s)tacked to a tree.


80828_i-200.R7 10/8/04 12:07 AM Page 10

DAY 19: Sunday, October 20, 2002• A call is made to authorities directing them to

the woods behind the Ponderosa where theywould find a letter. (Investigators had alreadydiscovered the letter the night before.)

• The snipers had given authorities a 6 A.M.deadline to respond to their demands. Lawenforcement was checking the letter for evidence.

• U.S. Secret Service crime lab technicians con-firm that the letter was written in the samehandwriting as that on the tarot card.

• Investigators compare calls from the snipers,the Montgomery County tip line, theRockville Police Department, and a priest inAshland, Virginia, who had received a strangephone call from a person who boasted ofbeing the sniper. That caller also suggestedthat investigators look into a liquor store rob-bery-homicide in Montgomery, Alabama.

• Chief Moose press conference: “To the personwho left us a message at the Ponderosa lastnight, you gave us a phone number. We dowant to talk to you. Call us at the number youprovided.”

DAY 20: Monday, October 21, 2002• Task Force investigators contact authorities in

Montgomery, Alabama to learn more aboutthe robbery-homicide case.

• The sniper(s) call(s) from a pay phone inGlen Allen, Virginia, outside of Richmond.

• Investigators swarm the Exxon station wherethe call was traced only to discover and arresttwo illegal immigrants.

• Hanover County Sheriff Stuart Cook holds apress conference saying that the suspects werebeing questioned about the sniper shootings.The two illegal immigrants are later turnedover to the Immigration and NaturalizationService (INS).

• A fingerprint lifted off a magazine recoveredafter the Montgomery, Alabama liquor storeshooting is linked by the FBI to Lee BoydMalvo, whose prints were taken a year earlierwhile in INS detention.

• Chief Moose press conference: “The personyou called could not hear everything you said.

The audio was unclear; we want to get itright. Call us back so that we can clearlyunderstand.”

• Investigators in Washington State determinethat Malvo was last seen traveling with a mannamed John Muhammad. Investigators dig upevery record of Muhammad as well.

DAY 21: Tuesday, October 22, 2002Shooting 14: Approximately 5:56 A.M.,Montgomery County Ride-On Bus, Route 34,Silver Spring, Maryland: Conrad Johnson, 35, isshot and killed standing on the top step of his buswhile it sits idling. A witness tells police that amasked man, with what appeared to be a rifle,ran from a grassy area into an apartment com-plex. Investigators scour the grounds and findanother letter.

• The letter reads: “Your incompetence has costyou another life.”

• All highway exits, side streets and interstatebridges connecting Maryland and Virginia areshut down.

• Chief Moose press conference: “We have notbeen able to assure anyone of their safety.”And at another one later in the day, ChiefMoose releases the letter’s postscript: “Yourchildren are not safe anywhere at anytime.”

• Asked about the possibility of the FBI takingover the case, Gary Bald responds: “This con-tinues to be a joint investigation by a largenumber of state, local and federal agencies . . .the cooperation that we have is unprecedent-ed in this case.”

• Chief Moose press conference (to snipers): “Itis not possible electronically to comply in themanner that you have requested. You indicat-ed that this is about more than violence. Weare waiting to hear from you.”

DAY 22: Wednesday. October 23, 2002• A picture of John Muhammad (from an out-

of-state Department of Motor Vehicles office)is faxed to the sniper task force.

• Investigators identify the make, model and tagnumber of the Chevrolet Caprice Muhammadis driving.


80828_i-200.R7 10/8/04 12:07 AM Page 11

• Investigators in Tacoma, Washington begin agrid search of Robert Holmes’ house whereMuhammad and Malvo had stayed and donesome target shooting in May 2002.

• That night, a BOLO alert is issued for bothMuhammad and Malvo and their Caprice.

• CNN is the first to pick up on the BOLO andthe Caprice’s tag number. Almost two hoursafter the BOLO is issued over the police radio,FOX News releases the make, model and tagnumber of the Caprice to the nation’s public.

• Chief Moose press conference: He announcesthat the police want to speak withMuhammad about the “alleged violation offirearms law” and that he is “armed andextremely dangerous,” but that he merely“may have information material to our inves-tigation.” Also, at Muhammad’s request, ChiefMoose announces (to the sniper), “You’veasked us to say, quote, ‘We have caught thesniper like a duck in a noose,’ end quote.”

• The ATF issues an arrest warrant forMuhammad based on federal firearms viola-tions.

DAY 23: Thursday, October 24, 2002Approximately 12:54 A.M., Interstate 70, West-bound Rest Stop, Mile Marker 39, Myersville,Maryland. Suspects Lee Boyd Malvo and JohnMuhammad are spotted sleeping in the Capriceby a civilian who heard the suspects’ vehicle andtag descriptions over his van radio. MarylandState Troopers immediately shut down I-70 inboth directions. Federal, state and local lawenforcement officers converge on the rest area.More than two hours later, a combined SWAToperation of officers from the Maryland StatePolice, Montgomery County Police and the FBItake Malvo and Muhammad into custody.

• A citizen, Whitney Donahue, having heardabout the Caprice on a radio talk show, spotsthe car at a rest stop near Frederick,Maryland.

• Tactical officers from the MCPD, MSP andFBI extract Muhammad and Malvo from thecar and take them into custody at approxi-mately 3:30 A.M.

• The Bushmaster rifle is discovered in thetrunk of the car.

• Chief Moose press conference: He introducesthe top ranking members of the Task Force,saying, “Certainly this team is larger [thanthose standing here] but its unprecedentedcooperation has made this case [resolution]possible.”


80828_i-200.R7 10/8/04 12:07 AM Page 12

C H A P T E R O N E ■ High-Profile Investigations ■ 13


LOCAL LAW ENFORCEMENT AGENCIEShave long been scrutinized for how theyhandle large-scale, complex criminal inves-

tigations—often those involving serial, spree ormass murderers or violence against national lead-ers or celebrities. Many of these notorious crimeswere investigated within a task force structure,involving multiple agencies, jurisdictions or levelsof government. These crimes shared a number ofcharacteristics that called for complicated,demanding investigations that challenged theagencies tasked with solving them in unprecedent-ed ways. Crimes that draw intense media andpolitical attention often are deemed to be “high-profile cases,” creating significant internal andexternal pressures.

T H E S N I P E R C A S E 10

The Sniper Case has become one of the best knowncomplex, multijurisdictional investigations. Whilethe case had many of the characteristics thattypically place substantial demands on law enforce-ment agencies engaged in a multi-incident investiga-tion, there were unique elements that exacerbatedthe many challenges they faced. Some of the factorsthat made this case so difficult include the following:

• Sniper—Homicides and shootings occur everyday in large metropolitan areas. Killing spreesand serial murders are also committed,although far less frequently.11 The sniper casewas unusual, in part, because of the nature ofthe shootings—a series of seemingly randomattacks from concealed locations and at

distances of about 100 yards, with six homicidesin one 24-hour period. Law enforcement hashad to respond to and investigate “sniper”shootings before, but their rarity alone madethis case unusual.

• Multi-agency and multigovernmental—Multiplelaw enforcement agencies were involved in theinvestigation. Dozens of local agencies fromMaryland, Virginia and the District ofColumbia responded, as well as two state policeagencies and virtually every major federal lawenforcement agency. The complexity of this casegrew as numerous agencies with overlappingjurisdiction became engaged at every level ofgovernment—each with significant capabilitiesand resources.

• Ongoing—The initial killing spree was fol-lowed by a series of shootings over a three-week period in several jurisdictions. Lawenforcement agencies had to simultaneouslyconduct criminal investigations of the shoot-ings, try to prevent additional shootings andrespond to the scenes of new incidents as theyoccurred, along with managing the day-to-dayoperations of the agency and calls for service

C H A P T E R O N E

High-Profile Investigations

10 A number of different names have been associated with thisinvestigation, including “Serial Sniper,” “D.C. Sniper,”“Beltway Sniper,” and even “SNIPEMUR,” which was thecase name assigned by the FBI.

11 At this writing, definitions of serial, spree and mass murderscan be found at the following websitehttp://www.wordiq.com/ definition/Serial_killer.

80828_i-200.R7 10/8/04 12:07 AM Page 13

not associated with the investigation. Thismultifaceted and dynamic law enforcementoperation required flexibility that most after-the-fact investigations do not.

• Media sensation—Media coverage of the eventescalated from routine local coverage to exten-sive reporting in three local media markets12

and then to national and international mediaoutlets. On-site media totaled more than 1,300individuals, and included print journalists,television and radio reporters as well as talkshow hosts and Internet entrepreneurs. Themedia significantly influenced agency strate-gies and operations, particularly when theycreated their own news stories by revealinginformation they uncovered about the investi-gation on their own, in addition to updatesreleased by police and other spokespersons.

• Community fear—At times, community fearwas so great it seemed to verge on panic. Thefear grew stronger each day, fueled by the ran-dom nature of the shootings and frequentlyexacerbated by constant, and sometimes sensa-tional, media coverage. Many residents said inmedia interviews during the case that whenventuring out of their homes they felt likepotential victims.

• External pressures—Local law enforcementleaders and their agencies were under intensepressure to end the shootings. These demandswere driven by constant media attention andcriticism, community fear and suggestionsfrom government leaders to transfer responsi-bility for the investigation from local to feder-al law enforcement. In addition, many nation-al government leaders live in the jurisdictionsin which the shootings occurred.

• Terrorist threat—Many commentators dis-cussed the possibility that the shootings couldbe the work of terrorists, both because of thenature of the attacks as well as their proximityto the nation’s capital. In the aftermath ofSeptember 11, and facing ongoing threats ofterrorism, the investigators had to consider

whether the shootings could be a terrorist tac-tic. And, while authorities did not deem theshootings to be terrorism in the conventionalsense,13 they did effectively terrorize threemajor metropolitan areas as schools wereclosed and outdoor activities cancelled, citi-zens avoided gas stations and parking lots, andothers simply hid in their homes.14

The sniper case clearly goes far beyond a routineinvestigation, a major case investigation, or evenmost multi-agency investigations. This case was socomplex that the term “investigation” does notfully reflect the challenge that law enforcementfaced. Cases like this are more than criminal inves-tigations; they are “events.” While the criminalinvestigation is an essential element, it representsonly a small part of the law enforcement responsein these intricate cases.

The sniper case required those local agenciesaffected by shootings to engage simultaneously inemergency management, case management andincident management. The emergency manage-ment component comprised the on-sceneresponse to the shootings; the case managementcomponent included the criminal investigation;and the incident management component consist-ed of coordinating the resources of dozens ofagencies, reducing public fears and working withthe media. The ultimate goal, of course, was tosolve the case—requiring the majority of resourcesto be devoted to the criminal investigation. At thesame time, agency resources were used to managecrime scenes, close roads, calm the communityand construct a well-supported task force of thou-sands of local, state and federal law enforcement

14 ■ High-Profile Investigations ■ C H A P T E R O N E

12 The three media markets were Washington, D.C.;Baltimore, Maryland; and Richmond, Virginia.

13 The FBI cites the Code of Federal Regulations in definingterrorism as “[t]he unlawful use of force against persons orproperty to intimidate or coerce a government, the civilianpopulation or any segment thereof, in furtherance of politi-cal or social objectives (28 C.F.R Section 0.85).”

14 Sniper suspect John Allen Muhammad was prosecuted andconvicted under a new Virginia law that classified him as aterrorist because of the fear inflicted on the community, cou-pled with his demands for $10 million.

80828_i-200.R7 10/8/04 12:07 AM Page 14

officials. Law enforcement executives (i.e., policechiefs, sheriffs, and special agents in charge) foundthat nearly every one of their agency’s units orfunctions were drawn on to deal with the impactof the shootings.

M A J O R T H E M E SHow other agencies will prepare for and respond tothese complex cases in the future is a significantchallenge facing law enforcement—whether theyare acts of terrorism or a series of violent crimesthat destabilize entire communities. The professionmust hone its expertise in each of the three compo-nent areas (emergency management, case manage-ment and incident management) to manage thesedemanding, high-profile events successfully. It isimportant to blend these different componentsinto one coherent strategy that allows law enforce-ment agencies to conduct an effective criminalinvestigation.

We know that cases similar to the sniper case willbe fast-paced. They will be full of surprises, delays,confusion and problems that will test the patienceand expertise of law enforcement officials. A sig-nificant factor in being effective in these complexcases is realizing that fully ”taking charge” may notbe possible. Rather, executives will need to focuson creating order out of chaos and keeping theiragencies flexible in order to respond quickly andeffectively to unexpected developments.

“Don’t be bound by traditional structures, mechanisms

and resources.”Chief Charles Moose,

Montgomery County Police Department

While there is much we cannot anticipate aboutfuture multijurisdictional cases, there are somemeasures that executives now know are crucial tosuccess. As a result of the interviews with lawenforcement officials involved in the sniper caseand other similar investigations, PERF project staffidentified dozens of “lessons learned” and recom-mendations to help other agencies prepare for

similar investigations. From these lessons and rec-ommendations, four significant factors emergedas crucial to an effective law enforcementresponse. They represent overarching themes dis-cussed in more detail and illustrated with specificexamples throughout the report. While theseefforts do not account for all of the successes inthis investigation, they were the cornerstones.

• Careful Planning and Preparation• Defining Roles and Responsibilities• Managing Information Efficiently• Maintaining Effective Communication

Careful Planning and PreparationPreparation and pre-event planning can be criticalto mobilizing resources when they are needed. In thesniper case, for instance, the Central Virginia(Richmond area) police and sheriffs agenciesobserved how other nearby agencies responded tothe shootings, and then developed plans based onwhat they saw unfold in Northern Virginia andMontgomery County. Even with this assistance, theycould not fully anticipate the extent to which feder-al agencies would participate in decision makingand providing resources. Yet the preparation stillallowed the Central Virginia agencies to developoperations orders, coordinate tactical operationsand review staffing requirements in the event of ashooting. In another example, Spotsylvania Countymade preparations (though not derived from othersniper sites) that enabled the Sheriff ’s Office to makeimmediate progress in its two shooting investiga-tions. That success was based on relationshipsformed with federal officials in a previous task forceinvestigation of a serial homicide case.

As much as possible, agencies should developplans and policies before an incident. (See ChapterTwo for more information on Memoranda ofUnderstanding (MOUs) and other mechanismsfor building relationships.) For example, agenciesshould determine ahead of time how they willmanage crime scenes, implement roadblocks andinterview suspects. Even if those plans and policiesare not perfectly suited to the investigation thatunfolds, they provide a foundation upon whichmodifications or additions can be easily made.


80828_i-200.R7 10/8/04 12:07 AM Page 15

“Expect the unexpected. A script cannotbe written. The lesson from this

case is that we can identify issues that might arise, but we cannot

predetermine the answers.” SAC Gary Bald, FBI

Agencies should develop agreements with otheragencies likely to provide resources and assistanceduring a crisis. This process helps officials betterassess the nature and scope of their collectiveresources. These agreements can address how theagencies will interact beyond resource sharing.Some officials from some of the smaller agenciesinterviewed, for instance, felt that the larger agen-cies did not afford them professional respectbecause they could not contribute as manyresources. In addition, agency officials need tothink about issues such as officer overtime, line-of-duty injuries and use-of-force policies and howthey apply to loaned officers from other agencies.These types of concerns can and should be proac-tively addressed in a less stressful environment sothat when a crisis occurs, response can be immedi-ate. When agencies develop MOUs and responseplans, they must ensure that key personnel areaware of them and know how to implement them.

According to those officials who were involved inthe sniper case, agencies should not only developresponse plans, but also practice them. Just assome agencies conduct mock exercises for criticalincidents, they should hold exercises for complexinvestigations, and should include those agencieswith which they would likely partner. Neighboringagencies could form a working group that wouldmeet regularly to discuss multi-agency responsesand even arrange mock exercises. Any plansshould address how resources from each agencywill be integrated as well as how key personnel willwork with each other.

Defining Roles and ResponsibilitiesDuring complex investigations, law enforcementpersonnel from chiefs to officers need to understandtheir roles and responsibilities and adhere to them.

The unique demands of these types of cases, however,can pressure individuals to modify traditional rolesor to develop new ones. For example, many investi-gators in the sniper case found it unsettling whenmanagers and executives became involved in inves-tigative responsibilities. Managers began performinginvestigator’s tasks, which left detectives uncertainabout their role and how to make a meaningful con-tribution to the investigation.

New roles and responsibilities will almost certain-ly arise during these investigations, and agenciesmay find they lack either the positions to assumethese responsibilities or the personnel to fill them.Temporary positions may need to be created, espe-cially when operating a multi-agency commandcenter. Planning and preparation can surely helpmitigate confusion about roles and responsibilitiesfor such crucial personnel as executives and inves-tigators, as well as define new positions or duties.

Federal law enforcement officials may participate inhigh-profile investigations, and certainly will partic-ipate if the crime is a terrorist act. The involvementof federal investigators can cause anxiety amonglocal and state officials who may not want to cedeauthority over the investigation, thereby creatingresistance among investigators working leads. Thishappened in the sniper case, but the initial frictionquickly dissipated to the point that “everyone worethe same badge,” according to several individualsinterviewed for this project.

“Before September 11, federal agenciesand local law enforcement worked

together halfheartedly. This investigationis an example of how law enforcement

will be done in the future.” SAC Michael Bouchard, ATF

Clearly defined roles and responsibilities can alsohelp personnel from different agencies identifywith whom they should develop relationships.Some of those relationships should be built beforea crisis occurs, though others will certainly devel-op during an event. Pre-existing relationships are a


80828_i-200.R7 10/8/04 12:07 AM Page 16

critical component to effective crisis managementand event response, and their importance cannotbe overstated.

Managing Information EfficientlyReliable information flow is crucial to the successof any major investigation. The ability to collect,analyze and disseminate tips, leads, intelligenceand criminal histories can mean the differencebetween a quick apprehension and a prolonged,frustrating effort.

Involving multiple agencies in an investigationcomplicates the management of information sig-nificantly. While the amount of potentially valu-able information may increase substantially witheach agency that joins the investigation, there is acommensurate increase in the demand for effi-cient analysis. The sheer amount of material canoverwhelm investigative personnel. Incompatibleinformation management systems impede thesharing of raw information or intelligence. Forexample, in the early stages of the sniper case,many of the telephone tips had to be hand-carriedto command posts just to be entered into a cen-tralized management system for leads becausethere was no integrated system that call takerscould use for one-time data input.

Similarly, successfully assigning and trackingthousands of investigative leads requires sophisti-cated investigative management systems. Withoutthose systems, leads can be lost, investigatedrepeatedly when unnecessary or simply forgotten.Law enforcement needs systems that allow multi-ple agencies in complex investigations to exchangeand analyze information. In the sniper case, talent-ed and dedicated information systems specialistsand crime analysts were forced to patch togetherportions of different systems to create an informa-tion analysis system that eventually provided theinvestigation with robust intelligence capabilities.

Even with a state-of-the-art automated system,however, effective information managementrequires compliance with consistent protocols andthe ability to overcome institutional barriers toinformation sharing.

Maintaining Effective CommunicationVirtually every person interviewed during thisproject stressed the importance of constant com-munication by law enforcement leaders.Representatives involved in such multifacetedinvestigations need to communicate daily on a tac-tical and a strategic level. They need to communi-cate with personnel in their own agency and withofficials from other agencies. Leaders must strivefor continual information exchanges and feed-back. Some police leaders argued that any infor-mation is better than none at all, while othersinsisted that information must be accurate beforeimparting it to others.

Regardless of the amount or quality of informa-tion that agencies disseminate, some individualswill still believe they are not receiving enough. Inthe sniper case, many patrol officers thought thatlaw enforcement leaders were withholding infor-mation, leading the officers to misperceive thatthey were inconsequential to the investigation.Leaders found it difficult to correct that miscon-ception, and felt particularly frustrated when themedia reported officers’ beliefs that executiveswithheld information they should have sharedwith them.

Agencies need a mechanism for providing a dailybriefing to staff. In the absence of official informa-tion, rumors will proliferate and, if left unabated,will require agency officials to spend significanttime trying to convince personnel of the facts.

Agency leaders also must communicate with resi-dents, government leaders and the media. Thedemands for information from these externalsources will be tremendous, and each will requirea different strategy for effectively meeting theirneeds. In the sniper case, residents were terrified ofbecoming the next victim and feared for the safetyof loved ones. The fear was palpable. Residentswanted reassurances and looked to law enforce-ment leaders for information that would ease theirconcerns. They wanted specific directions aboutwhere it was safe to venture out and what types ofactivities should be avoided. Government leaderswanted information for many of the same person-


80828_i-200.R7 10/8/04 12:07 AM Page 17

al reasons, but also so they could provide leader-ship for their communities. Some law enforcementprofessionals interviewed indicated that govern-ment leaders wanted information but were not ina “need to know” position. The media wanted bothto inform the public and to outshine their com-petitors. Many reporters did not wait to receiveinformation from law enforcement, but aggres-sively sought it from many sources, which oftenput law enforcement officials on the defensive.

Communication was clearly the most compellingconcern in the sniper case. Investigations of thiskind succeed or fail based on executives’ ability toeffectively manage and communicate informationin a timely manner.

C O N C L U S I O NThe sniper case was one of the most infamouscrimes in the recent history of American lawenforcement, instilling fear in thousands of peo-ple. The law enforcement response and investiga-tion were unparalleled. Agency officials learnedvaluable lessons from their experiences, some-times because they did the correct thing andsometimes because they discovered more effectivestrategies and approaches after the fact. Severalagencies identified additional lessons by conduct-ing debriefings and writing after-action reports.From those efforts, they realized the importance ofcareful preparation, clear roles and responsibili-ties, integrated information systems and effectivecommunication.


80828_i-200.R7 10/8/04 12:07 AM Page 18

C H A P T E R T W O ■ Leadership ■ 19


Multijurisdictional crimes involve myri-ad law enforcement executives whomust manage the chaos and provide

the leadership needed to reduce fear, supportpolice personnel and coordinate complex efforts.The sniper case demanded effective leadership ontwo levels—at the task force level and at the indi-vidual agency level. The seven local jurisdictionsthat experienced a homicide or shooting investi-gated the incidents as they would any other localcrime. Yet, each of the seven agencies also com-bined resources to form a parallel investigativetask force that eventually included several dozenlaw enforcement agencies. Achieving the properbalance between providing leadership for an indi-vidual community and contributing to theMontgomery County task force was an ongoingchallenge for law enforcement executives. Thischapter describes the challenges and responsibili-ties the executives faced in the sniper case, whichunderscore the importance of applying soundleadership principles in any similar investigation.The chapter contains two main sections, TaskForce Leadership and Agency Leadership, thatfocus on the following matters:

• Determining the Task Force Leader• Coordinating Multiple Task Forces• Structuring a Task Force• How To Be an Effective Task Force Leader• Working with Other Law Enforcement

Executives• Defining Executive Roles and

Responsibilities

During the three-week sniper investigation, lawenforcement executives, as well as government lead-ers at the local, state and national levels, grappledwith numerous questions about leadership and itsrole in solving the crimes and addressing communi-ty fear about the shootings. Some of the more chal-lenging questions included the following:

• How is the leader of a multi-agency task forcedetermined?

• Where should a task force be headquartered?• Under what circumstances, if ever, does task

force leadership change?• How do multiple task forces coordinate

investigations?• Is there one best model for task force

leadership?• How do task force members make key decisions?• What is the role of executives who are not the

leader of the task force?• What are the characteristics of an effective

task force leader?• How can an executive provide effective leader-

ship for his or her agency and community whileparticipating in a multi-agency task force?

Answering these questions while the investigationwas underway sometimes proved difficult, espe-cially in the face of criticism by the media, govern-ment leaders, community members and evenother law enforcement professionals. For the mostpart, however, law enforcement officials answeredthe questions satisfactorily, and those answers pro-vide valuable lessons for how others mightapproach similar investigations.

C H A P T E R T W O

Leadership

80828_i-200.R7 10/8/04 12:07 AM Page 19

T A S K F O R C E L E A D E R S H I P

Determining the Task Force LeaderWho is in charge? If the investigation is limited toone jurisdiction, the answer is obvious—the chief,sheriff or other top local law enforcement execu-tive of that jurisdiction. But if the investigationcrosses jurisdictional or state lines, or involves lawenforcement agencies from other levels of govern-ment, the answer may not be so self-evident.Determining who is in charge will also influencewhere the task force will be located. Attempting toanswer one without considering the other maycreate significant problems.

“Someone has to ultimately be in charge.”

Colonel Gerald Massengill, Virginia State Police

The sniper task force was headquartered inMontgomery County because it was the site of thefirst shooting, as well as four homicides on Day 2,and ultimately had the most incidents. Even when ashooting occurred in the District of Columbia onthe evening of Day 2, Chief Ramsey of theWashington Metropolitan Police Department didnot question that the task force was headquarteredin Montgomery County, agreeing that it was the log-ical location.

“No one had a problem folding into theTask Force once they had a shooting.”

Chief Charles Ramsey, Washington Metropolitan Police Department

The Sniper Task Force leadership rested with threeindividuals—Montgomery County Police ChiefCharles Moose, FBI SAC Gary Bald and ATF SACMichael Bouchard.15 Chief Moose was the pri-mary spokesman because of his agency’s legalauthority to investigate the murders. These threemen were the chief executives of the law enforce-ment agencies that initially dedicated the mostresources to the investigation. They did not pre-

plan a shared leadership role, but quickly foundthat it was the most logical arrangement. Indeed,Moose and Bald had never met, for Bald had beenin his position just a few weeks when the firstshooting occurred. (Bouchard and Bald also hadnot met.) They quickly recognized the need towork together as a team and to always show a unit-ed front to the public.

“We should have communicated earlierand more clearly with local chiefs in

surrounding agencies.”SAC Michael Bouchard, ATF

At times, however, some law enforcement person-nel expressed concerns about whether the leader-ship was united or who, in fact, was the “true”leader. These uncertainties grew stronger as theinvestigation wore on, and as the distance fromMontgomery County of the subsequent shootingsincreased. During the second week, as the toll ofvictims grew and as the shootings moved intonorthern and central Virginia, some law enforce-ment and government leaders questioned whetherthe leadership should be changed. Various politicalleaders, noting the multistate impact of the sniperincidents, suggested through the media that theFBI should assume control of the investigation. Inretrospect, each of the three leaders interviewedsaid they could have communicated more clearlyto other law enforcement leaders and governmentofficials their process for making decisions, whichmay have silenced some of the questions aboutwho was in charge.

20 ■ Leadership ■ C H A P T E R T W O

15 Gary Bald was the Special Agent in Charge of the FBI’sBaltimore Field Office and Michael Bouchard was theSpecial Agent in Charge of the ATF’s Baltimore FieldOffice. They each represented their agencies in this investi-gation because Montgomery County, despite its shared bor-der with Washington D.C., is in the State of Maryland andthus the responsibility of the Baltimore—not Washington,D.C.—field offices.

As stated earlier, Chief Moose has since left the MontgomeryCounty Police Department and Chief Manger has taken hisposition. Gary Bald is an Assistant Director of the FBI, andMichael Bouchard is the Assistant Director of the ATF.

80828_i-200.R7 10/8/04 12:07 AM Page 20

The number of agencies involved in an investiga-tion and the geographic range of crimes can com-plicate decisions about the location of the taskforce headquarters. Had the snipers moved 500miles from the D.C. region and continued theirrampage in another metropolitan area, for exam-ple, the task force leadership might have facedadditional questions about maintaining its loca-tion and leadership. As it was, a single shooting inAshland, Virginia (100 miles south ofMontgomery County) caused some to challengethose decisions.

Although some executives considered the possibil-ity of moving the task force or changing its leader-ship, they made it clear during interviews that,ultimately, the Montgomery County task forceshould not have been dismantled because it wouldhave disrupted the investigation. TheMontgomery County Police Department still hadunsolved murders to investigate, and transferringan investigation from one agency to another isanathema to law enforcement.

“Investigations cannot be run fromremote locations.”

Chief Carl Baker, Chesterfield County, Virginia, Police Department

Another major challenge in multijurisdictionalinvestigations is establishing the command centerquickly and in the correct location so that it doesnot have to be moved. Moving a command centeror a Joint Operations Center (JOC)16 after it hasbeen up and running could destroy public confi-dence by sending the message that law enforce-ment is incapable of managing the investigation,and wasting valuable investigative time in movingto a new location. And, from a strictly practicalperspective, JOCs are difficult to move once theyhave been constructed.

Although the decision to headquarter the taskforce in Montgomery County was relativelystraightforward, in future cases the decision maynot be so easy. Some of the factors that could

influence task force location or leadership includethe following:

• The agency with the first shooting• The agency with the most shootings• The agency with the highest profile or most

critical shootings• The agency with the most or best evidence• The agency with the most investigative

expertise• The agency with the most experience in

multi-agency investigations• The agency with a pre-existing JOC or local

command center• The jurisdiction that will prosecute the case• The extent of federal involvement and the

location of federal resources

Some law enforcement organizations abide bygeography as the primary determinant for taskforce location. The FBI designates the lead FieldOffice and SAC based on the location of thecrime—the “office of origin.” The exception to thiswould be terrorist activity and other “major”investigations, which would be run from FBIheadquarters. (By contrast, project staff learnedthat in the United Kingdom, the chief constablesof agencies working together decide who will bethe lead chief constable, and then designate anoverall officer-in-charge. Other constabularies oragencies that join the task force after this decisionis made must abide by the existing structure.)

Coordinating Multiple Task ForcesIf the need arises, complementary task forces maybe established as well. There need not be a singletask force subject to transfer. In fact, the snipercase may have provided a model for multiple taskforces since there were not just one task force, butfive. They included the following:

• Montgomery County Task Force• Spotsylvania County Task Force


16 A JOC is a command center protocol used by the FBI andATF. The primary JOC in this investigation was inMontgomery County, Maryland, across the street from theMontgomery County Police headquarters. More informa-tion about JOCs is in Chapter Three.

80828_i-200.R7 10/8/04 12:07 AM Page 21

• Prince William County Task Force• Fairfax County Task Force• Central Virginia Task Force

Each of the four task forces located outsideMontgomery County had its own leadership andcommand center. They worked in consultationwith the Montgomery County task force, andmany of the agencies participating in these fourtask forces sent representatives to MontgomeryCounty. But they also operated independently—though some more than others. They also sharedmany common characteristics with theMontgomery County task force. For example, theCentral Virginia task force relied on a committeeof executives, rather than one person, to provideleadership. As in Montgomery County, the chiefs,sheriffs and SAC there believed the committeestructure was the most effective leadership choicefor their group.

“We didn’t need more control of the taskforces, we needed better coordination.” Chief Terrance Gainer, U.S. Capitol Police Department

Some officials believe multiple command centerscreated problems for exchanging information andcoordinating operations during the sniper investi-gation. They believe that only one command cen-ter should have existed, and it should have beenthe hub for receiving all information, coordinatingresources and making decisions. They contendthat greater efficiency would have been possiblewith just one command center. Other police pro-fessionals, however, argued that this arrangementdoes not account for the individual agencies’ needto maintain responsibility for investigating andprosecuting shootings that occur in their commu-nity. That is to say, it is possible and in fact recom-mended that agencies both investigate their ownhomicide(s) as well as participate in the larger taskforce investigation. These roles and responsibilitiesare not mutually exclusive.

This investigation showed that multiple task forcescan operate simultaneously. However, their overall

effectiveness may be improved when they fully col-laborate, especially by emphasizing interpersonalcommunication and investigative informationsharing. A number of officials from local, state andfederal agencies talked about the need for sometype of task force coordinator to facilitate commu-nication, investigative management and informa-tion sharing. At a minimum, task forces need tointeract regularly, and when multiple task forcesoperate they should each send representatives toother task forces.

Structuring a Task ForceGoverning a task force in a high-profile case can be a significant challenge, especially when the taskforce contains a large number of agencies. Lawenforcement agencies are quick to provideresources and assistance to their colleagues. These“assisting” agencies may then be absorbed into anyexisting task forces. The challenge for task forceleaders is to include these agencies but, at the same time, maintain an effective system forproviding direction, making decisions and sharinginformation.

“I don’t remember a conflict that we couldn’t resolve.”

SAC Gary Bald, FBI

The task force leadership (whether it is one personor a committee) will face enormous challengesthat may impede its capacity to move an investiga-tion forward. The ability to provide direction andmake decisions can be confounded by enormouspressures, either by assisting agencies or some out-side stakeholders. Several executives spoke aboutthe importance of establishing priorities to organ-ize resources and assist with decision making. Inthe sniper case, executives most frequently men-tioned the following priorities:

• Catch the sniper• Manage the resources (i.e., officers/

investigators, materials, facilities)• Maintain personal relationships


80828_i-200.R7 10/8/04 12:07 AM Page 22

• Work with the public (i.e., community andmedia)

• Communicate with government leaders

The task force leaders need to remain focused onall priorities, periodically emphasizing certainones over others to meet changing demands andconditions. The challenge is to balance these com-peting priorities while continuing to provide effec-tive leadership for other agencies, including delin-eating their roles, responsibilities and duties. Someofficials suggested the use of a unified commandsystem as the basic model for consensus decisionmaking, especially when working with multiple orsatellite task forces.17

“We built the task force as it moved forward. No one had a chance to step back and critically assess

what we were doing.” SAC Michael Stenger, U.S. Secret Service

To assist leaders in making decisions and provid-ing direction, the task force should be organizedby criteria that determine agency participation.That is, some agencies will participate in the taskforce because one of the criminal acts has occurredin their jurisdiction, and others will be involvedbecause they can provide assistance and resources.Still other agencies will join because, while theyhave not yet had an incident, they want to be pre-pared. Recognizing these differences in orientationand needs will facilitate effective leadership, com-munications and decision making, and will enableleaders to retain tighter control over the dissemi-nation of information.

For example, a task force could be structured torecognize three different tiers for involvement:

1. Law enforcement executives who hadincidents in their jurisdiction and/or theauthority to investigate those incidents

2. Law enforcement executives from agenciesbordering jurisdictions with incidents

3. Law enforcement executives from agenciesoffering assistance and resources, or whowant to be prepared for an incident in theirjurisdiction

The executives in the first tier could comprise anexecutive committee and be responsible for develop-ing consensus and making decisions. Those in theother tiers would be vital members of the task force,but might not receive all investigative informationor participate in all decision making. If their agen-cies subsequently had an incident in their jurisdic-tion, they would then become part of the executivecommittee. Absent some type of governing struc-ture, high-profile task forces may find it exceptional-ly difficult to reach consensus and share informationto the satisfaction of all participants.

Considering the Needs of Individual Agencies Whenever new agencies join a task force, officialsfrom that agency must understand the leadershipstructure, decision-making protocols and inves-tigative methods. This is crucial to reducing uncer-tainty, confusion and even reluctance to fullycooperate. In an effort to help other agenciesunderstand protocols, the Montgomery Countytask force developed guidelines. (See Appendix C,SNIPEMUR Task Force Recommendations, for acopy of these guidelines that were distributed toagencies when a sniper shooting occurred in theirjurisdiction.) Whenever possible, task force leadersshould provide written guidelines and protocols tohelp agencies assimilate into the existing structure.

Chiefs and sheriffs who were interviewed for thisproject expressed a deep, personal sense of respon-sibility for their jurisdiction’s residents. When ashooting (or other traumatic event) occurs in acommunity, that chief or sheriff will want toinform the residents about the incident and reas-sure them. When formulating communicationand media protocols, task force leaders mustbalance the needs of the entire investigation withthe obligations of participating local executives to


17 The Incident Command System (ICS) is a standardizedmethod of managing emergency incidents, relying on com-mon terminology, common organizational structure andcommon operating procedures.

80828_i-200.R7 10/8/04 12:07 AM Page 23

be responsive to their citizens. In the words of onechief, “You cannot expect leaders to stop leading.”

In fact, it is possible and advisable for executives toboth contribute to the work of the task force andbe leaders in their own community. When theshooting occurred in Fairfax County, Virginia,Chief Tom Manger recognized the need to publiclybrief Fairfax County residents (and the largercommunity) as well as the need to participate inthe Montgomery County task force. These roleswere not mutually exclusive and, in fact, over-lapped to better serve the residents of the localcommunity and the multijurisdictional task force.

Not achieving that balance between communityresponsibility and task force allegiance can createtension among task force executives.

Being an Effective Task Force LeaderLeading a task force can be quite different from lead-ing an agency. Very few law enforcement personnelhave been trained to lead a task force, and very fewhave experience actually doing it. Yet to be effective,the leader must be respected for his or her skills andknow what to do. Many officials interviewed duringthis project identified four principles that can helptask force leaders be successful:

• Task force leaders must balance the needs ofindividual agencies with those of the entiretask force.

• They must make key decisions in consultationwith leaders from participating agencies.

• Task force leaders must relinquish somecontrol to obtain widespread support fromparticipating agencies.

• They must distinguish between executive andoperational responsibilities.

Most law enforcement executives will agree to recog-nize another agency head as the task force leader,and will provide him or her with the informationand resources to be effective. Those participatingagencies will contribute information with the expec-tation that the lead organization will reciprocate:Information must flow in both directions, or endan-ger support from participating agencies.

“Don’t manage the other task forces.Rather, make certain that every task

force leader knows his or her obligations, which are to manage information, keep chiefs informed

and follow up on leads.” Chief Charles Ramsey,

Washington Metropolitan Police Department

Task force leaders have to ensure that communica-tion channels remain open in order to facilitate theexchange of information. Otherwise, individualsin participating agencies may very likely perceivethey are not receiving enough information fromthe task force leaders, regardless of the amount orquality of information. This perception may bedifficult to fully dispel, but task force leaders mustwork to overcome it.

Individual agencies’ needs and concerns cannot bedisregarded. A task force leader should not makedecisions that affect participating agencies withoutconsulting their leaders and including them in thedecision-making process. Similarly, leaders of fed-eral agencies should not make unilateral decisionsabout how they will operate or what they will doin a local jurisdiction.

Individuals who participated in the project’sInvestigative Focus Group18 also explored whatskills are required to lead a task force, andexpressed a need to develop training and educa-tion programs to develop those skills in leaders. Asa starting point, this group identified the followingcharacteristics of an effective task force leader:

• Thinks in terms of “we”• Is receptive to involving other agencies• Is open to new ideas• Puts the goal of solving the case first• Is willing to change/improve when necessary• Is willing to support staff


18 This two-day Investigative Focus Group was discussed previously on page 5.

80828_i-200.R7 10/8/04 12:07 AM Page 24

• Publicly recognizes the good job people aredoing

• Does not micromanage• Lets competent people do their jobs• Remains calm under pressure; even has a

sense of humor under stress

The focus group emphasized that, in addition tothese traits, law enforcement must work on identi-fying and fostering other requisite skills ineffective task force leadership. Even the best lead-ers will be challenged to meet all agencies’ needs,particularly when serving as a co-leader of a taskforce. When multiple individuals share leadership,they must be aware of the benefits and pitfalls ofsuch an arrangement. Each of the leaders willbring a different perspective to the investigation,not only because of personality differences butalso because of the sometimes-disparate interestsof their organization. Ultimately, effective taskforce leaders will understand the differencesbetween leading an individual agency and a taskforce. In particular, they will be able to integratethe various agencies, law enforcement resourcesand perspectives.

“You can’t deny, or ignore, the value oftrust and longstanding friendships.”

Chief Charlie Deane, Prince William County Police Department

Working with Other Law EnforcementExecutivesAnother lesson that emerged from this investiga-tion is that local, state and federal agencies willwork alongside one another, but the extent of theircollaboration and the level of success they achievewill depend on several factors. Pre-existing rela-tionships and partnerships, for instance, facilitatetask force operations. Interviews revealed that, inthe few situations in which agencies from thesniper case did not work well together or disagreedabout strategies, it was due primarily to the lack ofprevious contacts with each other and the lack of abasis for trust. Geography was also a leading factorin how well agencies worked with one another

during the sniper case. The agencies in the D.C.suburbs had previously collaborated on opera-tions or investigations, and the same held true forthose agencies in the Richmond suburbs. As com-fortable as these agencies were with their neigh-bors, unfamiliarity with their counterparts inother metropolitan areas contributed to theirwariness about sharing information and decisionmaking.

Of all the keys to success during this investigation,the one mentioned—indeed, strongly emphasized—by every executive was the importance of pre-exist-ing relationships.

Building RelationshipsDeveloping relationships prior to crises is crucialto fostering communication, coordination and theexchange of resources. A pre-existing relationshipprovides a foundation for agencies that may needto enter into a joint operation in response to anincident and engenders a basic level of trust—trust that can facilitate meshing resources. In theRichmond, Virginia area, eight chiefs and sheriffs,as well as their seconds-in-command, have a long-standing practice of meeting quarterly to discusscommon problems and develop operationalresponses and policies that reflect the combinedstrengths of their organizations.

“We try to build relationships with local officials whenever we can.

Just four weeks before the first snipershooting, I was in Montgomery County

and met with Chief Moose and Assistant Chief Walker to discuss some joint gun investigations.”

SAC Michael Bouchard, ATF

Most of the D.C.-area executives spoke of the highlevel of cooperation that existed among theiragencies before the sniper case. These relation-ships were not limited to just a few agencies, butspanned across local, state and federal agencies.Several reasons were cited for these close relation-ships:


80828_i-200.R7 10/8/04 12:07 AM Page 25

• Washington, D.C. is the site of large publicgatherings, such as marches and protests.Surrounding local and federal agencies rou-tinely engage in mutual aid with theWashington Metropolitan Police Departmentto help handle these events.

• When the Pentagon, which is located inArlington, Virginia, was attacked onSeptember 11, every agency in the D.C.metropolitan area provided assistance to theArlington County Police Department and thefederal agencies that responded to andinvestigated the incident.

• After September 11, executives from local andfederal agencies began a weekly conferencecall to discuss the aftermath of the Pentagonattack as well as potential terrorist activitythat could threaten the D.C. area. This weeklycall was initiated by the FBI’s D.C. Field Officeand used telephone technology provided bythe Washington Metropolitan PoliceDepartment. After the sniper investigationbegan, law enforcement officials increased thefrequency of these calls to at least once a dayto exchange information.

• Many of these law enforcement organizationswork closely with the MetropolitanWashington Council of Governments (COG),a regional organization of D.C.-area localgovernments. COG is composed of 18 localgovernments surrounding the nation’s capital,and area members of the Maryland andVirginia legislatures, the U.S. Senate, and theU.S. House of Representatives. COG providesa forum for action and develops regionalresponses, including public safety andtransportation.

“We have close relationships in thisarea. It doesn’t exist like this

elsewhere. People pitch in with a good degree of comfort.”


Previous task force experience was a key buildingblock for agencies that had to work together again.In Spotsylvania County, the Sheriff ’s Department,the Virginia State Police and the FBI had just com-pleted a task force investigation into the Silva andLisk murders.19 This multi-year investigationemployed a command center that was still func-tional at the time of the sniper shootings in thatcounty. Relationships developed during that taskforce enabled executives, managers and investiga-tors to reestablish connections immediately.

“The cooperation in the D.C. area is as good as anywhere in the country.

We all know each other.” SAC Michael Stenger, U.S. Secret Service

Building relationships with all task force agenciesmay not be immediately possible, but agencies willfind that they can rely on their counterparts inother individual agencies, taking advantage of long-standing relationships or natural alliances for shar-ing resources and exchanging information.Neighboring jurisdictions can easily conduct con-ference calls or meet with each other to developcommon tactics or share what has worked and whathas not. For example, just minutes after learningabout the homicide in his jurisdiction, PrinceWilliam County Police Chief Charlie Deane tele-phoned Chief Tom Manger in neighboring FairfaxCounty to invite personnel to the crime scene inManassas. The purpose of the invitation was toallow Fairfax County investigators to observe theoperation and gain insights that they could apply ifa shooting were to occur in their jurisdiction. Thesetwo jurisdictions had also jointly pre-planned tacti-cal operations should either one have a shooting.


19 In the fall of 1996, Sofia Silva, 16, and sisters Kristin andKati Lisk, 15 and 12, were abducted from their homes inSpotsylvania County, Virginia. All three girls’ bodies werediscovered shortly after their abduction. In June 2002,suspect Richard Marc Evonitz fatally shot himself followinga police pursuit. He was later linked to the Silva-Liskmurders. At the time of this writing, more information onthe Silva-Lisk murders can be found athttp://www.angelfire.com/va2/kkscases.

80828_i-200.R7 10/8/04 12:07 AM Page 26

“You have to know your limitations. If you don’t ask for help when it is avail-able, you shortchange your community.”

Sheriff Ronald Knight, Spotsylvania County Sheriff’s Office

Agencies cannot be reticent about asking otheragencies for help, resources and ideas. At the sametime, agencies must realize they may receive moreassistance than needed, and it may even come unso-licited. A significant investigation like this can createan unusual condition—seemingly unlimitedresources—in which agency personnel may find itdifficult to integrate and adjust to the abundance.

When agencies request assistance or resourcesfrom each other, they have to ask at the propertime. That is, agencies cannot ask for help toosoon. It is especially important that loaned per-sonnel have meaningful tasks to perform upontheir arrival at another agency. When agencies askfor assistance, they must have a clear need for spe-cific resources, and a plan for using thoseresources the moment they arrive. In addition,they may want to designate an individual to beresponsible for making those requests for assis-tance and for managing the logistics associatedwith the arrival of loaned personnel or resources.

Regular CommunicationPossessiveness is a common behavior in many gov-ernmental agencies, and law enforcement is notimmune. Sharing resources and especially informa-tion is not always practiced. Indeed, safeguardinginformation is such a high priority in law enforce-ment that even units within the same agency oftendo not share information. So it may be unrealisticto expect agencies working together for the firsttime to freely exchange criminal information andintelligence. Yet, effective multi-agency investiga-tions will require agencies to carefully consider howthey can overcome these barriers.

During multi-agency investigations law enforce-ment executives should develop and adhere to reg-ularly scheduled briefings, and should engage in

strategic assessments of the investigation’sprogress, success and obstacles. One of the waysthis was done in the sniper case was through con-ference calls. Building on existing weekly confer-ence calls among area law enforcement executivesto discuss terrorism, the calls occurred at leastevery morning, and then sometimes several timesa day. The conference calls helped agenciesexchange important information, and their quali-ty improved over time as participants becamemore focused on critical issues. Interviewsrevealed, however, that one problem with the con-ference calls was the large number of participants.Because it was unclear who had access codes, andbecause participants could conference in and outof the call, no one ever knew exactly who was onthe call at any given time.

Particularly troubling for many conference callparticipants were the frequent leaks that resultedin “news flashes” on cable news stations containingconfidential information discussed during theconference call. These updates occurred right afteror sometimes even during the calls, suggesting thatsomeone was either leaking information or thatunauthorized individuals were on the calls.Although access codes were changed several times,leaks persisted. Participants hesitated to shareextremely sensitive information, and fueleddoubts about whether those on the call wereimproperly sharing crucial information. Forexample, one agency withheld the true name ofwitnesses and suspects, relying on fictional aliasesinstead. Within a few days, reporters had learnedthe aliases and used them in conversations withlaw enforcement personnel.

“Everybody can’t know everything all the time.”


In an effort to build more open and better-man-aged communications, two strategies were used:face-to-face meetings and invitation-only confer-ence calls. While the latter can be helpful and nec-


80828_i-200.R7 10/8/04 12:07 AM Page 27

essary to discussing certain issues, the downside isthat some individuals can perceive them asexclusive, and therefore divisive. Agencies need tofind a middle ground that allows them to havesecure communication with relevant stakeholderswhile at the same time not alienating other partic-ipating officials. Similar or like-minded agenciesmay be tempted to have secret communications,while objecting to their counterparts in otheragencies doing the same. All agencies need to con-sider how these private communications mayundermine trust and cooperation, and shouldassess the appropriateness of invitation-onlycommunications.

“You just can’t do it all through conference calls.”

Chief Charles Moose, Montgomery County Police Department

During the sniper investigation, face-to-face meet-ings were extremely beneficial although infrequentbecause of the amount of time they required. Ontwo occasions, once in Maryland and once inVirginia, executives and agency representativesconvened in larger groups in auditoriums to dis-cuss case developments, plan coordinated opera-tional responses and air differences. Most otherface-to-face meetings involved only a small num-ber of executives and were used to discuss criticalissues. A number of executives stressed that thesein-person meetings were helpful in resolving con-flicts and addressing confusion and uncertainty.

Memoranda of Understanding and Joint PoliciesWhenever possible, agencies should develop mutu-al aid agreements prior to any major incident orinvestigation. Local law enforcement agencies needto determine the extent to which they can providemutual aid to other agencies, and developMemoranda of Understanding (MOUs) to formal-ize those agreements. Some states may have limita-tions on mutual aid. In Virginia, until just a fewyears ago, mutual aid agreements were possible onlyif local departments shared a common border.

“A history of joint pre-planning allowedus to set aside turf concerns.”

Colonel Gerald Massengill, Virginia State Police

In central Virginia, the Ashland Police Departmentand the Hanover County Sheriff ’s Office had amutual aid agreement in place that contained proce-dures for the Sheriff ’s Office to assume control ofinvestigations of serious crimes, such as shootings.20

Agencies should work with statewide or regionalchiefs/sheriffs associations to identify resources inlarger departments or those with a special expertisethat could benefit other agencies. If those associa-tions do not exist, executives should form regionalgroups designed to engage agency representatives inmeaningful discussions about policy, practices,operations, plans and mutual aid.

Any MOUs that include provisions for detailing per-sonnel to other agencies must stipulate the policiesand work conditions that will govern the conduct ofloaned employees. Personnel who work in anotheragency and use that agency’s equipment should beprovided with and abide by that agency’s policies andleadership structure. Legal representatives from thelaw enforcement agency or governing body shouldbe involved in developing MOUs.

I N D I V I D U A L A G E N C Y L E A D E R S H I P

Defining Executive Roles and ResponsibilitiesA police chief or sheriff provides public safetyleadership to his or her agency and community.The duties and burdens of a complex investigation,such as the sniper case, can overwhelm and hinderthe ability of executives to provide that leadership. A


20 The Town of Ashland is an independent town located with-in Hanover County. The Ashland Police Department is a full-service law enforcement agency, but only has 22 swornmembers. The Hanover County Sheriff ’s Office has 180sworn officers, and has concurrent jurisdiction in the town.Due to the intensity of the sniper investigation and theneed for significant investigatory help, the Ashland Chief ofPolice and the Hanover Sheriff agreed that the HanoverCounty Sheriff ’s Office would be the lead investigativeagency for this case.

80828_i-200.R7 10/8/04 12:07 AM Page 28

crucial part of successfully leading these investiga-tions is for executives to determine when and wherethey should devote their attention. Executives inter-viewed for this project stressed the importance ofthinking carefully about their roles and responsibil-ities and adhering to them during the investigation.In separate interviews, Chiefs Deane, Moose andRamsey, and Sheriff Cook identified very similarresponsibilities for chief executives to consider,including the following:

• Make order out of chaos • Remain flexible and help others be flexible• Focus on the entire agency• Let a competent workforce do its job• Get personnel the resources they need• Work with external stakeholders

Chaos and FlexibilityEvery chief, sheriff, and law enforcement profession-al knows that managing a complex, high-profileinvestigation is very different from the day-to-dayrunning of an organization. Executives operate in acrisis management role fraught with uncertaintyand fast-paced developments. In all likelihood, otheragency personnel will be operating in the same envi-ronment. Executives know that staff and officers willlook to them for leadership and guidance, and canmeet this need only by quickly and continually mak-ing order out of chaos. By drawing on past experi-ences, conferring with executives in other jurisdic-tions, or using tailored organizational plans, execu-tives can create structure.

“While someone had to be in chargethere was leadership at every level.

People stepped up and all felt a responsibility to contribute. An incredible team effort.”

Chief Thomas Manger, Fairfax County Police Department

At the same time, executives need to be flexible inorder to deal with the uncertainties of the case.Chief Charles Ramsey recommended that whenconfronted with unfamiliar problems or decisions

for which chiefs do not have previous experience,they should consider a perspective different fromthe typical law enforcement paradigm and look forcreative solutions. They may find it helpful to relyon experts in other fields—maybe a businessleader or a school administrator. During stressfultimes, it can be difficult to try a new approach tosolving problems and making decisions. However,it might be the one thing that makes an executivemore effective than he or she might otherwise be.

FocusBecause chief executives will encounter competingdemands for their time and attention, they may findit difficult to fulfill all responsibilities equally. Someof the executives spoke about how they caught them-selves spending too much time on one responsibilityat the expense of others. The challenge for manyexecutives will be to consider what is occurring in theentire organization, and not become preoccupiedwith the media, the investigation or any one aspect ofthe case. Executives should not become so focused onthe initial incident that they lose sight of the fact thatthe investigation could go on for days, weeks andeven months. They must realize that their agenciesmay have to respond to and investigate multiple inci-dents, as was the case in Montgomery andSpotsylvania Counties. The ability to effectively leada complex investigation is dependent on how wellexecutives see the big picture.

“Chiefs have to be willing to give up somecontrol. Admittedly, this is difficult for

chiefs, sheriffs and SACs, but unless it isdone the investigation won’t succeed.”


At the other extreme, executives can take on toomany responsibilities or work too long. A number ofsubordinates and outside observers stated that manyof the executives became highly fatigued as theinvestigation wore on, mainly because they tried todo too much. Montgomery County Assistant ChiefDee Walker, for one, described in an interview how,by trying to keep others from doing too much, lead-ers assumed too many responsibilities themselves.


80828_i-200.R7 10/8/04 12:07 AM Page 29

Competent WorkforceAn important part of seeing the “big picture” is torely on subordinates by delegating responsibilitiesto them. Effective leaders do this in non-crisistimes, and will probably find that the need for thisis greater during complex investigations. The con-sensus among those interviewed for the projectwas clear: Executives should let competent peopledo their jobs.

Executives can also rely on commanders to helptake the pulse of the law enforcement personnel intheir agencies by soliciting comments from a widerange of individuals about the case, regardless oftheir rank or function. Many rank-and-file per-sonnel in several agencies spoke about how thelack of face-to-face contact with supervisorsdiminished their morale. This need for close com-munication was corroborated by such agencies asthe Prince William County Police Department,where officers spoke about how personal contactand constant communication (even if there wasnothing significant to report) was reassuring andmade them feel connected to the rest of the agencyand the investigation.

“The chief needs the discipline to notmicromanage.” Chief Charles Moose,


Another way that subordinates can help a chiefexecutive is to serve as a sounding board for thechief. An executive officer or a trusted subordinatecan help the executive stay focused and providefeedback on difficult issues.

The executive should monitor the investigation,but not get involved in the daily activities of man-aging it. This project’s investigative focus grouprevealed that in the 2003 Baton Rouge, Louisianaserial murder case, the police chief delegated keydecisions to investigative coordinators and provid-ed them with the resources they needed to do thejob, a fact corroborated by the coordinators.Executives should push responsibilities down, give

personnel the resources they need and then holdthem accountable. At the same focus group, theBaltimore County police chief, who led his agencyduring a 10-day investigation of a case involvingmultiple murders, kidnappings and a hostage/bar-ricade incident, described how he attended inves-tigative briefings to assess his team’s progress, butremained prepared to make changes to the inves-tigative team if the job was not getting done.

“The investigation succeeded becauseeverybody did their job.”

SAC Gary Bald, FBI

ResourcesBy monitoring the entire agency, executives arewell positioned to reallocate existing resources oracquire new ones as the case progresses.Investigative developments, additional crimes, orcommunity apprehension may require an agencyto shift resources from one challenge to another,sometimes with little warning. The role of theexecutive is to monitor all developments andensure that commanders have the personnel andequipment to be effective.

Once the investigation is concluded, or at leastwinding down, executives may find that agency per-sonnel need a transition period or even the oppor-tunity to vent frustrations or other feelings.Executives should ensure that adequate resourcesare available to support personnel during this criti-cal stage of wrapping up an investigation. InVirginia, the Arlington County, Fairfax County,Prince William County and Hanover County agen-cies conducted after-action reviews to learn whatworked and what did not during the sniper investi-gation, and to give employees an opportunity todiscuss frustrations or contentious issues that hadto be shelved during the heat of the investigation.Executives should also ensure that personnel getsupport for any trauma or stress associated with theincident. This was done in Montgomery and PrinceWilliam Counties where personnel had access tocrisis counseling services from in-house resourcesor through county mental health agencies.


80828_i-200.R7 10/8/04 12:07 AM Page 30

Individual agencies can also benefit from after-action retreats such as the one hosted by the FBIthat involved the principal participating agencies.

External StakeholdersExecutives should anticipate increased interactionwith external stakeholders during a high-profileinvestigation. A significant part of letting a compe-tent workforce do its job is shielding it from dis-tractions. Personnel investigating the case shouldbe removed from interactions with governmentleaders, the media and others. A number of super-visors and investigators spoke about how one ofthe most crucial responsibilities an executive canassume is to absorb and address all externalsources of pressure.

“The County Executive21 shouldn’t cometo all the law enforcement briefings. He needs to maintain some distanceshould he have to eventually judge

whether I was effective.” Chief Charles Moose,


Police chief executives must not forget the need toremain responsive to elected or appointed localleaders. Although in the middle of an investigationit may be difficult, chiefs must communicate withtheir bosses about how and why the police depart-ment is operating as it does. This will be easierearly in a relationship, and before a crisis, if thechief has fully briefed his or her boss. An informedmayor, county administrator or governor may beable to provide support and not feel the need toget involved in decisions best left to law enforce-ment leaders.

All executives need to consider how they will workwith government leaders to provide them withinformation and include them in decision making.Government leaders need to take a visible leader-ship role, which may create challenges for lawenforcement executives. In the sniper case, lawenforcement executives held conference calls withgovernment leaders and school officials to help

keep them informed and solicit their views ondecisions that affected them.

C O N C L U S I O NEffective leadership in a multijurisdictional inves-tigation is essential to a successful conclusion. Yet,determining who should be the leader, as well asthe protocols for how law enforcement agenciesshould interact with one another, can be exceed-ingly difficult. No template exists to guide lawenforcement, although the sniper case has provid-ed a number of lessons for how other executivesmay want to approach leadership challenges in anyfuture high-profile investigation.

Law enforcement needs to explore how to bettermanage investigations and task forces involvingmultiple agencies and levels of government, espe-cially in light of possible terrorist activity. Lawenforcement should consider varying task forcestructures for different levels of government. Astructure developed by, and appropriate for, feder-al agencies may not always be the best structure forlocal law enforcement. In addition, law enforce-ment needs to think about varying task forcestructures for different phases of investigations.One structure may be appropriate for an initialresponse, which is primarily a local function, andanother structure may be more effective for inves-tigative follow-up and management, whichincludes state and federal agencies.

L E S S O N S L E A R N E D

Determining the Task Force Leader• Executives should clearly establish who is in

charge, as well as the scope and nature oftheir authority, including which decisionsthey will make on their own and which deci-sions will require consultation with others.Executives should engage in candid and cleardiscussions as early as possible in an investi-gation about who is authorized to make deci-sions on behalf of the task force.


21 The county executive is the elected chief administrativeofficer of the county, analogous to a city mayor.

80828_i-200.R7 10/8/04 12:07 AM Page 31

• Multi-agency task force leaders should alwaysspeak with one voice throughout the courseof the investigation.

Coordinating Multiple Task Forces• When possible, a task force coordinator

should be used to facilitate communication,investigative management and informationsharing among complementary efforts.

• At a minimum, task forces need to interactregularly and should exchange representatives.

Structuring a Task Force• To assist the task force leader, the participants

should establish criteria and be organized in away that accounts for why particular agenciesare involved and that defines their level ofinvolvement.

• Recognizing the differences in agencies’involvement will facilitate effective leadership,communications and decision making, as wellas enable the leaders to retain necessary con-trol over the dissemination of information.

• The task force governing structure must beflexible enough to balance its many differentpriorities and adjust to the investigation’schanging demands and conditions.

• The task force should also have a clear delin-eation of roles, responsibilities and duties foreach agency.

• A unified command structure, such as that usedin the Incident Command System, can be usedas a model for consensus decision making.

• One approach to governing task forces is toestablish an executive committee consisting ofthose law enforcement chief executives who hadshootings in their jurisdictions (primary agen-cies). A second level would include those depart-ments that bordered agencies with shootings,with a third tier for those agencies that want toprovide assistance. Information sharing andother protocols could vary by task force level.

• Agencies that join the investigation need towork with the existing leadership structure inplace at that time.

• When formulating communication andmedia protocols, executives participating in ashared leadership arrangement must balance

the needs of the entire investigation with theobligations of local executives to remainresponsive to their own communities.

Being an Effective Task Force Leader• Law enforcement needs to further identify

and create training and education programsto teach executives the skills that will makethem effective task force leaders.

• The key to effectiveness in complex cases isrealizing that taking full control may not bepossible. Rather, executives will need to createorder out of chaos and keep their agenciesflexible to adapt to changing developments.

• Task force leaders have to ensure that com-munication and meaningful information flowboth into and out of the task force.

• Task force leaders must work to overcomeparticipating agencies’ perceptions of unequalor untimely information sharing.

• Neither task forces nor individual agenciesshould make decisions affecting other juris-dictions without involving them in the deci-sion-making process.

• Task force leaders must balance the needs ofindividual agencies with those of the task force—even if that means relinquishing some control.

Working with Other Law EnforcementExecutives

• Developing interagency relationships before acrisis is crucial to effective coordination, com-munication and resource sharing.

• Agencies must not be reticent about askingother agencies for help, resources and ideas.They must be prepared for the possibility thatthey will get more assistance than needed,sometimes even unsolicited.

• Because loaned personnel must have meaning-ful tasks to perform upon their arrival, whenone agency asks another to loan personnel, therequesting agency should have a plan in placefor the personnel when they arrive, and a clearorganizational structure for managing them.

• During multi-agency events, law enforcementexecutives should develop and adhere to regu-larly scheduled briefings and engage in strate-gic assessments of the investigation’s progress,


80828_i-200.R7 10/8/04 12:07 AM Page 32

success and obstacles. This could include con-ference calls or face-to-face meetings to devel-op common tactics to share lessons learnedwith another agency.

• Executives should schedule conference callswith government leaders, school officials andother relevant stakeholder groups to keepthem informed and involved in key decisionsthat will affect them.

• Scheduling conference calls and meetingsrequires a dedicated staff. This task cannot beperformed ad hoc. It requires planning, com-mitment and follow-up. All conference callsshould be on secure phones and measuresshould be taken to track who is on the phoneat all times.

• Local law enforcement agencies need to deter-mine the extent to which they can developMemoranda of Understanding (MOUs) ormutual aid agreements with other agencies.Whenever possible, these agreements shouldbe formed prior to a major incident or inves-tigation.

• Executives should encourage regional orstatewide law enforcement associations toengage in meaningful discussions about poli-cies, practices, operations, plans, and mutual aidin the anticipation of a multijurisdictional inci-dent. Agencies should work with these associa-tions or create groups to identify resources inlarger departments and special expertise inother agencies that could be of benefit.

Individual Agency Leadership: Defining Executive Roles and Responsibilities

• Executives must swiftly determine their rolesand responsibilities and focus on addressingthe following six immediate tasks:

° Make order out of chaos

° Remain flexible and help others to beadaptable

° Focus on the entire agency

° Let a competent workforce do its job

° Provide personnel with the resourcesthey need

° Work with external stakeholders• Executives must recognize that the investigation

may become a long-term endeavor, especially in

the case of a high-profile crime when the agencyresponds to and investigates multiple incidents.

• Executives must make a concerted effort notto neglect the entire agency when focusing onthe media, the investigation or any one aspectof the case. The executive should monitor, butnot get involved in, the daily activities of theinvestigation and other key operations.

• Executives should use personnel to assumeresponsibilities, and may want to rely on anexecutive officer or trusted employee to serveas a sounding board and to address any con-cerns about his or her performance.

• Executives should pay attention to what ishappening throughout the organization bysoliciting comments from personnel in theagency, regardless of rank, and checking onthe personal well-being of agency members.Executives should also ensure that those insupervisory positions do the same.

• Executives should push responsibilities downand give personnel the resources they need todo their job. This duty, however, does not endwhen suspects are arrested. For example, it isimperative to conduct after-action reports tosee what worked and what did not, and toensure that personnel get support for traumaor stress associated with the incident.

• Executives cannot forget their responsibilitiesto interact with and manage external stake-holders. Police chiefs must remain responsiveto elected or appointed local leaders, themedia and the community.

• Law enforcement executives should shield theworkforce from external pressures and dis-tractions, allowing a competent work force toconcentrate on its responsibilities.

The Future of Task Forces• Law enforcement should determine the appro-

priateness of different task force models for dif-ferent levels of government (a federal modelmay not always be appropriate for state andlocal agencies), as well as different task forcemodels for different phases of an investigation(initial response may be handled locally whileinvestigative follow-up and management maycombine local, state and federal resources).


80828_i-200.R7 10/8/04 12:07 AM Page 33

34

80828_i-200.R7 10/8/04 12:07 AM Page 34

C H A P T E R T H R E E ■ Federal Law Enforcement Resources ■ 35


This chapter discusses how federal lawenforcement agencies can assist local andstate agencies in high-profile investiga-

tions, including these matters:

• Accessing federal resources• Coordinating federal resources• Understanding federal expertise• Engaging the Critical Incident Response

Group (CIRG)• Working with the Critical Incident

Management Response Team (CIMRT)• Setting Up Joint Operations Centers (JOCs)• Employing military assets

Because of the incredible array of federal resources,and because a number of the local agencies involvedin the sniper case had never worked with federalagencies so extensively, law enforcement officials hada number of questions to consider during the inves-tigation, such as the following:

• When do the FBI, ATF and other federal lawenforcement agencies become involved inlocal criminal investigations?

• What is the role of these federal agencies andwhat resources would they bring?

• When does federal involvement in an investi-gation become federal control?

• What is a Joint Operations Center and howdoes a local agency implement one?

• What is the division of labor in a JointOperations Center?

This chapter will answer these questions by describ-ing the decisions and actions of law enforcementofficials during the sniper investigation.

“We created a new corporation, complete with mergers and

acquisitions.” Assistant Chief William O’Toole,


BackgroundSome local law enforcement agencies may simplylack the resources or means to fully conduct ahigh-profile investigation and/or manage the asso-ciated activities. In some cases this may be a reflec-tion of the size or function of a local agency—itmay simply not have enough personnel, or per-sonnel with the right expertise. Jurisdictions thatare not located in such resource-rich regions asMCPD and other D.C.-area agencies will not nec-essarily have access to as many federal and otherlaw enforcement assets. Even for agencies withhundreds of personnel and seasoned investigators,local agencies may find they are somehow hin-dered from conducting a comprehensive investiga-tion. For example,

• local agencies face significant obstacles to con-ducting investigative or law enforcement opera-tions outside their jurisdiction. Federal agenciescan help simply because they have a nationalnetwork of field offices throughout the countrythat can assist with communication or coordi-

C H A P T E R T H R E E

Federal Law Enforcement Resources

80828_i-200.R7 10/8/04 12:07 AM Page 35

nation, or apply federal laws and different pro-cedures to aid a criminal investigation (e.g.,obtaining search warrants in another state);

• local agencies may lack a mechanism forsearching for and identifying criminal infor-mation and intelligence outside their jurisdic-tion that can help them with their case; and

• local agencies sometimes lack specializedexpertise or resources (e.g., forensic laborato-ries or electronic surveillance equipment) thatcan be crucial to an effective investigation.

“Our role is to support the localagency’s homicide investigation.”


Each federal agency possesses its own unique set ofresponsibilities and expertise. This was madeabundantly clear during the sniper case when fed-eral law enforcement responded in force and pro-vided a variety of assistance to local agencies.Indeed, some of the federal resources seeminglyappeared out of nowhere, without ever beingsolicited. The following agencies participated insome aspect of the operation:22

• The Bureau of Alcohol, Tobacco, Firearmsand Explosives (ATF)

• The Drug Enforcement Agency (DEA)• The Federal Bureau of Investigation (FBI)• The Federal Protective Service (FPS)• The Immigration and Naturalization Service

(INS)• The U.S. Capitol Police• The U.S. Customs Service (USCS)• The U.S. Marshals Service (USMS)• The U.S. Park Police• The U.S. Postal Inspectors• The U.S. Secret Service (USSS)

In addition, the U.S. Department of Defense pro-vided technology and equipment for surveillanceoperations. Local law enforcement must under-stand how to access and when to employ theseavailable resources. These issues are addressed inthe following section.

A C C E S S I N G F E D E R A L R E S O U R C E SPolice chiefs, sheriffs and investigators in thesniper case spoke in grateful terms of how theresources and expertise provided by federal agen-cies contributed to a successful conclusion of theinvestigation. However, not everyone at the locallevel had a clear understanding of the role offederal agencies. The FBI obviously has protocolsfor its own investigations, but local officials werenot clear about whether similar protocols appliedwhen federal agencies assist local law enforcement.After the investigation, local executives recom-mended that federal agencies delineate anddisseminate their protocols for providing assis-tance in high-profile, complex or multi-agencyinvestigations.

“I learned a long time ago thatrelationships—both professional and

personal—are the key to building trust.When the sniper incident hit we

had already established close workingrelationships built on personal trust so it was easy to know what each of our

resources and strengths were and what we could all contribute. It made

all the difference.” Assistant Director In Charge Van Harp,

FBI Washington Field Office

A number of federal law enforcement agenciesparticipated in the sniper investigation. They cameto be a part of the investigation because of theircommitment and unique expertise to assist otherlaw enforcement agencies.

ATF was one of the three lead agencies. Its role didnot end there, however, as it provided hundreds of

36 ■ Federal Law Enforcement Resources ■ C H A P T E R T H R E E

22 Since the conclusion of the sniper investigation, the enforce-ment arm of the INS was transferred from the U.S.Department of Justice to the U.S. Department ofHomeland Security (DHS) and renamed the Bureau ofImmigration and Customs Enforcement (ICE). Readersshould note that several other agencies have also beentransferred to DHS.

80828_i-200.R7 10/8/04 12:07 AM Page 36

agents who worked investigative leads with locallaw enforcement officers, formed tactical teamsthat handled high-risk calls for service, conductedsurveillance, assisted with suspect negotiationsand filled key roles in the organization and run-ning of the JOC. ATF’s expertise in conducting themajority of the fingerprint analyses of all firearms-related evidence, as well as trajectory analysis, wascrucial, ultimately linking the projectiles fired bythe snipers. ATF provided ballistics and explosive-detecting canines and other resources for identify-ing and collecting evidence.

The be-on-the-lookout (BOLO) alerts for thesnipers were based on a federal firearms warrant.Muhammad was prohibited under law from pos-sessing a firearm because of a previous domesticviolence complaint in Washington State, and Malvowas sought as a federal material witness. Whenthese warrants were obtained, sufficient probablecause did not yet exist for state murder warrants.

Like other federal agencies, the U.S. Secret Serviceassigned agents to track investigative leads. Agentsalso lent their unique expertise in the areas ofdignitary protection and site security, assumingmany of the responsibilities for protecting partici-pants in the outdoor press briefings, issuing cre-dentials to the hundreds of media representativesas well as to the law enforcement personnel withaccess to the JOC. Finally, the Secret Serviceprocessed and analyzed the notes left by thesnipers at the shooting scenes, using handwriting,paper and ink analysis to link the different notesleft by the snipers.

The U.S. Marshals Service provided investigativeresources consistent with its mission of trackingand apprehending fugitives. Agents were assignedto work with local law enforcement officers in tac-tical teams that responded to calls for service inhigh-risk areas, such as in Prince William County.The Marshals Service relied on its extensive accessto criminal and public records to obtain photo-graphs of the snipers. In addition, the marshalsused their sophisticated electronic and telephonesurveillance resources to help track the location oftelephone calls made by the snipers.

Other federal agencies contributed investigators,such as the DEA and the INS. And, while theiroverall contribution may not have been on thesame scale as other agencies, their resources andexpertise played crucial roles in solving the case,such as the identification of suspect Malvothrough a fingerprint taken by the INS almost ayear before the shootings. The task force was alsograteful for the significant contributions of theU.S. Customs Service, Federal Protective Service,U.S. Capitol Police, U.S. Park Police, U.S. PostalInspectors and others.

Local, state and federal officials agreed that morework is needed to ease the integration of federalagencies and resources into ongoing investiga-tions. This is especially true because of the chang-ing nature of cases and the varying arrangement offederal, state and local resources required forresponse and investigation. In the sniper case,Montgomery County Police Chief Charles Mooseformally requested assistance from the U.S.Department of Justice through Title VII, Section701—the “Serial Killing Law.”23 Prior to this inves-tigation, Chief Moose was unaware of the statuteand its ramifications. Chief Moose’s letter ofrequest led to investigative resources from the FBIand prosecutorial assistance from the U.S.Attorneys Office (see Appendices D and E for theserial sniper law and the letter of request). Localexecutives need to improve their understanding offederal resources and how to access that assistance.This is especially true in light of the threat ofterrorism.

Chief Moose was challenged to balance the needfor assistance from the FBI and other federalagencies against the need to keep control of theinvestigation. Before asking for federal help, he


23 The Bureau of Justice Statistics defines a serial killing as:"[involving] the killing of several victims in three or moreseparate events. This definition is especially close to that ofa spree killer, and perhaps the primary difference betweenthe two is that a serial killer tends to ‘lure’ victims to theirdeath; whereas, a spree killer tends to go ‘hunting.’” At thetime of this writing, these definitions could be found athttp://www.wordiq.com/cgi-bin/knowledge/lookup.cgi?title=Serial_killer.

80828_i-200.R7 10/8/04 12:07 AM Page 37

consulted with his assistant chiefs and investiga-tive managers—all agreed that the size and com-plexity of the case warranted federal assistance.Other chiefs interviewed for this project statedthat they did not see a request for federal assis-tance as relinquishing control, but also said theircomfort working with federal authorities was afunction of long-standing relationships withthem. If faced with a similar multijurisdictionalcase, law enforcement executives will wrestle withdetermining the best timing for requesting outsideassistance. If the request comes too late, the chiefsmay look like they cannot succeed. If they ask tooearly, they look like they do not have faith in theskills of their own people to handle the case. It is adelicate balancing act.

“Ask for federal assistance early in the investigation. If you ask too late

you look like a failure.” Chief Charles Moose,


If the sniper case had been identified as a terroristact,24 the complexion of the entire case wouldhave changed. The relationships between localagencies and the FBI would have been very differ-ent. For example, the FBI would have assumedcontrol of the investigation, just as it would for anyterrorist act. Federal intelligence agencies wouldhave become involved, which would have dramat-ically affected the dynamic for exchanging infor-mation between federal and local agencies.Classified information would have beenexchanged with local and state law enforcementofficials consistent with security clearances andthe need-to-know doctrine. Clearly, some of theworking relationships in the sniper case stood outas a study for symmetrical relationships and shar-ing of investigative information—a study thatcould also be applied to a terrorist investigation.

“Unless the legal authority rests with the federal government, the role of

federal law enforcement is to complement local law enforcement

and not compete with it.” SAC Michael Stenger, U.S. Secret Service

If a sniper case scenario were to happen elsewhere,it could also have dramatic effects on the relation-ships among law enforcement agencies.Accordingly, local, state and federal agencies needa plan for determining responsibilities, integratingresources and sharing information in a variety ofpossible scenarios.

C O O R D I N AT I N G F E D E R A LR E S O U R C E SIn the sniper case, local agencies were inundatedwith resources from neighboring jurisdictions andstate authorities. Similarly, federal resources oftenarrived in abundance—sometimes in overabun-dance. To a certain degree, when it came to feder-al resources, local agencies faced a conundrum.They wanted the assistance federal agencies couldprovide, but they did not always have the resourcesto manage those assets.

Not only did local executives and managers needto coordinate the many different federal resources,but they sometimes had to deal with the fallout ofdisagreements among federal agencies. Local andstate agencies learned that, much like local andstate law enforcement, federal agencies operateindependently. Local officials interviewed aboutthe sniper case said federal law enforcementagencies need to give more thought to how theyshould coordinate with each other to best helplocal agencies.


24 At the time of the investigation, federal law enforcementofficials determined that the crimes did not rise to the levelof terrorism as defined in 28 C.F.R. Section 0.85 (seeChapter One for additional discussion of this issue). Thesuspects were charged and prosecuted as terrorists, however,under a State of Virginia law enacted after September 11,2001, addressing acts of terrorism.

80828_i-200.R7 10/8/04 12:07 AM Page 38

“The level of trust between agencies and individuals affects coordination.

Prior history and relationships on other cases allowed for the seamless

integration of agency resources.” SAC Don Thompson, FBI

Local agencies need to plan for how they will man-age the large number of investigators that couldarrive from the FBI, ATF, U.S. Secret Service andMarshals Service. In Prince William County alone,almost 50 marshals from around the countryarrived within two days of a request by ChiefCharlie Deane. Many officials at all levels of gov-ernment suggested that multiple federal lawenforcement agencies should be placed under theleadership of one federal agency or person duringthese complex investigations. This would facilitatecoordination and control, especially for the leadlocal agency. Determining which federal agencywould lead could be difficult, but it need not bethe same federal agency every time. Rather, thetype of case, the extent of initial federal involve-ment and even pre-existing relationships betweena local and federal agency could determine whichfederal agency takes the lead. To the extent possi-ble, at least an informal understanding among fed-eral agencies on this subject should be developedwell before the inception of any such investigation.

U N D E R S T A N D I N G F E D E R A LE X P E R T I S E

ForensicsOne area in which federal law enforcement canprovide valuable expertise is forensics. Federalagencies often have the country’s best experts andfacilities, but their forensic expertise may be inspecific specialty areas. They also may have differ-ent approaches to, and protocols for, managingcrime scenes and collecting evidence, as well asvery different capabilities in their laboratories. Inthe sniper case, the Montgomery County PoliceDepartment had to learn about the different feder-al agency capabilities, and then work with thosefederal agencies to develop evidence collection and

analysis protocol (learning points of contact, chainof evidence protocols, etc.). As mentioned earlier,the following agencies handled specific forensicresponsibilities:

• ATF processed and analyzed ballistics andfirearms

• FBI processed and analyzed DNA; hairs andfibers; trace evidence; fingerprints; audio andvideo enhancements; as well as conductedcomputer forensics examinations and finan-cial forensic analysis

• Secret Service processed and analyzed hand-writing, paper and ink

External forensic expertise should be brought—asit was in the sniper case—into an investigation assoon as possible to ensure that the proper evidenceis collected, analyzed and shared. For instance, theMontgomery County Police Department did nothave a firearms analysis unit capable of conduct-ing projectile and shell casing analyses. Thedepartment had several options for obtaining thisanalysis, including the Maryland State Police or alocal agency with the necessary expertise. Yet, thedepartment turned to the ATF because of itsexpertise and because of familiarity—one of itstwo national laboratories was within two miles ofMCPD headquarters.

Federally Deputizing Local and State OfficersDuring task force investigations involving federal,state and local agencies, it may be necessary to feder-ally deputize non-federal officers. Deputized statusallows non-federal officers to participate in federallaw enforcement efforts, including serving searchwarrants and making arrests. The status also pro-vides officers and agencies with legal protections.

Any federal law enforcement agency can requestthe authority to provide federal deputy status fromthe U.S. Marshals Service (U.S. Code, Title 28,Section 566(c)). The following matters should beconsidered when seeking deputy status for locallaw enforcement officers:

• A federal law enforcement agency mustsponsor the officer.


80828_i-200.R7 10/8/04 12:07 AM Page 39

• The U.S. Marshals Service has to receive a let-ter from the sponsoring federal agencyrequesting deputization.

• U.S. Marshals Service personnel have to per-sonally swear in the officer(s).

• Length of term of service would normally notexceed one year or the completion of the per-tinent investigation.

• With appropriate documentation and concur-rence, deputization can be accomplishedwithin 24 hours.

E N G A G I N G T H E C R I T I C A L I N C I D E N TR E S P O N S E G R O U P ( C I R G )The FBI’s Critical Incident Response Group (CIRG)facilitates the Bureau’s rapid response to, and man-agement of, crisis incidents. CIRG was established in1994 to integrate tactical and investigative resourcesand expertise for critical incidents that require animmediate law enforcement response. Located inQuantico, Virginia, CIRG can deploy investigativespecialists to respond to terrorist activities, hostagetakings, child abductions and other high-risk, repet-itive, violent crimes. Other major incidents CIRGmay respond to include prison riots, bombings, air-plane and train crashes, and natural disasters.25

CIRG has three major branches: OperationsSupport, Tactical Support and The National Centerfor the Analysis of Violent Crime. Each branch pro-vides distinct operational assistance and training toFBI field offices as well as state, local and interna-tional law enforcement agencies. CIRG personnelare on call around the clock, seven days a week, torespond to crisis incidents. Listed below are some ofthe units that might provide valuable assistance tostate and local law enforcement during a high-pro-file investigation or critical incident.26

Operations Support Branch• The Crisis Negotiation Unit (CNU) main-

tains an around-the-clock, immediate opera-tional response capability to conduct andmanage on-scene negotiations during any sig-nificant crisis in which the FBI is involved.CNU negotiators also routinely provide tele-phonic assistance to both FBI field negotiatorsand domestic police negotiators during crisis

situations. The FBI has approximately 340crisis negotiators in the 56 field offices. TheCNU is responsible for managing these assetsand providing whatever training and equip-ment is necessary for the field office negotia-tors to successfully resolve crisis situations.27

• The mission of the Crisis Management Unit(CMU) is to operationally support FBI head-quarters and field entities during critical inci-dents or major investigations by establishingJoint Operations Centers. The CMU also con-ducts crisis management training and relatedactivities for the FBI, and other international,federal, state and local agencies or depart-ments. In support of this mission, the CMUconducts several regional field-training exer-cises each year. Each exercise involves multiplefield offices and hundreds of employees.

• The Rapid Deployment Logistics Unit(RDLU) is responsible for the coordination ofall Rapid Start Information ManagementSystem (RSIMS) matters in support of majorinvestigations and operations. This system isdesigned to provide law enforcement person-nel with the capability to manage large vol-umes of investigative leads in major cases andcrisis incidents. It allows the user to build acase-specific database and track leads into avariety of reports. The RDLU manages acadre of RSIMS data loaders, Rapid Start spe-cialists and systems facilitators for the CIRGto augment offices during crisis incidents,major training exercises and special events.


25 The ATF Critical Incident Management Response Team(CIMRT) has similar types of assets that were deployedduring the sniper case.

26 These descriptions of FBI resources are adapted frommaterial found on the FBI’s website at www.FBI.gov.

27 According to ATF, the Negotiations Operations Center(NOC) located in the JOC was staffed by a combination ofFBI, ATF and MCPD personnel. The ATF CrisisNegotiation Unit‘s CIMRT representatives, as well as ATFcrisis negotiators from the field, provided an ATF presencein the NOC. There was an orderly division of labor and allthree entities provided necessary personnel and expertiseduring all shifts.

80828_i-200.R7 10/8/04 12:07 AM Page 40

Tactical Support Branch• The Hostage Rescue Team (HRT) is a full-

time, national-level tactical team, headquar-tered in Quantico, Virginia. The mission ofthe HRT is to be prepared to deploy to anylocation in the nation within four hours ofnotification by the Director of the FBI or hisdesignated representative, and conduct a suc-cessful rescue of U.S. persons and others whomay be held illegally by a hostile force, be itterrorist or criminal in nature. The HRT isalso prepared to deploy to any location and toperform other law enforcement activities asdirected by appropriate authorities.

National Center for the Analysis of ViolentCrime (NCAVC)28

• The mission of the Behavioral Analysis Unit(BAU) is to provide behavioral-based inves-tigative and operational support by applyingcase experience, research and training to com-plex and time-sensitive crimes, typicallyinvolving acts or threats of violence. The BAUreceives requests for services from federal,state, local and international law enforcementagencies. BAU services are provided for on-site case consultations, telephone conferencecalls, and/or consultations held at the BAUwith case investigators.

BAU also provides assistance to law enforce-ment through “criminal investigative analy-sis,” a process of reviewing crimes frombehavioral and investigative perspectives. BAUstaff—commonly called profilers—assess thecriminal act, interpret offender behaviorand/or interact with the victim for the pur-poses of providing crime analysis, investiga-tive suggestions, profiles of unknown offend-ers, threat analysis, critical incident analysis,interview strategies, major case management,search warrant assistance, prosecution andtrial strategies, and expert testimony.

• The Child Abduction and Serial MurderInvestigative Resources Center (CASMIRC)provides investigative support by coordinatingand providing federal law enforcement

resources and training. It applies other multi-disciplinary expertise, and assists federal, stateand local authorities in cases involving childabductions, mysterious disappearances ofchildren, child homicide and serial murderacross the country. Along with establishing anational database and training programs,CASMIRC can coordinate the investigation ofmajor or violent crimes with federal, state andlocal authorities by providing on-site consul-tation and advice.

• The Violent Criminal ApprehensionProgram’s (VICAP’s) mission is to facilitatecooperation, communication and coordina-tion among law enforcement agencies andprovide support in their efforts to investigate,identify, track, apprehend and prosecute vio-lent serial offenders. VICAP is a nationwidedata information center designed to collect,collate and analyze crimes of violence—specifically murder (additional informationon VICAP is in Chapter Five).

Behavioral Sciences29

Although FBI profilers and negotiators work inCIRG, they can take different approaches to com-municating with suspects during an investigationor a hostage/barricade incident. For some cases,profilers’ and negotiators’ approaches may be thesame, but for many others they will pursue diver-gent strategies. As one federal manager said,“negotiators want to engage the suspects, and pro-filers want to determine the suspects’ next move.”It is important for local law enforcement to under-stand these differences and how they can affectdecision making. For example, when advising theleadership on how to communicate with theshooters, negotiators may stress a firm approachwith the suspects, and even suggest language thatcould be considered confrontational. Profilers,however, may encourage the use of low-key lan-guage that would suggest to the shooters that the


28 Two ATF profilers have been assigned to this unit.

29 At the time of this writing, information on the FBI’sBehavioral Science Unit could be found athttp://www.fbi.gov/hq/td/academy/bsu/bsu.htm.

80828_i-200.R7 10/8/04 12:07 AM Page 41

leadership is approachable and willing to talkthings through. These different strategies may nothold true in every case, but law enforcement lead-ers must realize they may receive conflicting advicefrom profilers and negotiators.

W O R K I N G W I T H T H E C R I T I C A LI N C I D E N T M A N A G E M E N T R E S P O N S ET E A M ( C I M R T )In 1995, the ATF took measures to enhance itscapabilities and readiness regarding critical inci-dents, both proactive and reactive. After muchresearch and development, the ATF established aCritical Incident Management Systems (CIMS)Program to train a broad spectrum of ATF person-nel in crisis management and critical incidentresolution.

The Special Operations Training Branch, CareerDevelopment Division, Office of Training andProfessional Development developed a long-rangecrisis management training program, which wasinstituted in 1998. The training consisted of bothclassroom instruction and practical exercises, all ofwhich provided employees with a sound founda-tion for establishing and maintaining CriticalIncident Command Post operations, whether inan ATF-specific environment or as part of a JOC.Additionally, a Critical Incident ManagementResponse Team (CIMRT) consisting of speciallytrained Headquarters personnel was established.This team, consisting of personnel from the ATFTraining Division and Special OperationsDivision, is available to respond to the field andassist in command post operations as well as tacti-cal responses during critical incidents. Commandpost operations specialists as well as SpecialResponse Team personnel (including a crisis nego-tiations and medic component) are available.

The ATF Critical Incident Management Systemhas been implemented on numerous occasionssince its inception. The ATF response to the attacksof September 11, 2001 provided ATF entitiesthroughout the country with a coordinated andproactive response to this catastrophic event.

S E T T I N G U P J O I N T O P E R AT I O N SC E N T E R S

Location and FacilityThe FBI and ATF were responsible for establishinga Joint Operations Center in Montgomery Countyto better coordinate the law enforcement effortsduring the sniper case. Logistical support was pro-vided by the Montgomery County PoliceDepartment. In Richmond, the FBI and ATFestablished JOCs, and in Spotsylvania County atask force was re-established that previously inves-tigated a serial homicide case.

By October 4 (Day 3), hundreds of investigatorswere assigned to the sniper case, operating out ofthe Montgomery County Police DepartmentMajor Crimes Division on the first floor of head-quarters. Constrained by space for equipment andpersonnel, Incident Command decided that it wasessential to establish a JOC suitable for managingsuch a complex case. In order to accomplish thistask, the leadership determined that members ofthe FBI’s Critical Incident Response Group fromQuantico and those of the Critical IncidentManagement Response Team from ATFHeadquarters would coordinate the establishmentand maintenance of a JOC. In part, this decisionwas based on the FBI’s previous experiences inOklahoma City in 1995 and the Pentagon onSeptember 11. It should be noted that the MCPDrepresentatives associated with the OperationsGroup were initially unfamiliar with the JOC con-cept as envisioned by the CIRG and CIMRT per-sonnel. However, federal personnel stressed thatthe MCPD’s decision to include innovative andexperienced middle managers among theOperations Group allowed them to become fulland essential participants in the Operations Groupactivities.

This JOC was meant to provide more suitablespace for the current group of investigators, and toaccommodate the influx of command staff, patrolofficers, investigators and equipment that wouldstill arrive. Unfortunately, the MCPD lacked afacility with the necessary space for a JOC.


80828_i-200.R7 10/8/04 12:07 AM Page 42

“The JOC was built without our fullunderstanding of what it was.

We had never been trained in how to establish or operate a JOC for a

case of this magnitude.” Chief Charles Moose,


MCPD personnel were able to secure vacant officespace adjacent to their headquarters. Once thespace was leased, members of CIRG and CIMRTset about designing and constructing the JOC.Encompassing an open space of some 5,000 squarefeet on three levels, the building was divided intodifferent workspaces. This task was accomplishedin just over 24 hours. An integrated team of CIRGand CIMRT, along with personnel from MCPD,formed the JOC Operations Group. Working inshifts, this group maintained the operationalintegrity of the JOC through the duration of thecritical incident.

The FBI agreed to pay for the building rental,tables and equipment, including projectionscreens, fax machines and telephones.30 Miles oftelephone line and computer cable were strungfrom the ceilings. Nextel donated cell phones withwalkie-talkie functions. The FBI and ATF con-tributed substantial resources and equipment forthe JOC. The MCPD made use of 800 MHZ radiosalready purchased that were still in the box, pend-ing training of personnel. Other computers andradios were taken from the MCPD’s inventoriesand added to the JOC. The ATF provided a serverthat held all of the data collected from the case andacquired a satellite television system to monitormedia coverage. In just four days, the Sniper TaskForce went from cramped hallways to a relativelyspacious office building. Within just one week,however, the task force realized that even 5,000square feet was not enough space.31

As mentioned earlier, on Day 3 the SpotsylvaniaCounty Sheriff ’s Office and the FBI reconvenedtheir recently disbanded Silva-Lisk serial murdertask force in the FBI’s Fredericksburg Resident

Office using the FBI’s Rapid Start lead managementsystem as the centerpiece. This Spotsylvania Countytask force then coordinated the investigation of thetwo sniper shootings in that jurisdiction.

On October 19 (Day 18), the central Virginia exec-utives and the FBI set up a JOC in the FBI’sRichmond Field Office. This newly constructedbuilding was centrally located, familiar to theusers, and had ample space for conference roomsand executive meeting rooms, which facilitated theimplementation of Rapid Start.

In each of these locations, the ability to gather per-sonnel from different agencies in one space wascritical to the effectiveness of the task forces,according to officials who worked in them.

“Federal resources were forthcomingwithout delay or questions.”

Chief Carl Baker, Chesterfield County Police Department

Ideally, a JOC would be established after the initialcritical incident is over and would be used to helpsupport the investigation. Because the MontgomeryCounty JOC was established in the midst of theevent, not everything went as smoothly as it mighthave. Many individuals, especially those in localagencies with no experience in a JOC, went througha rigorous on-the-job-training program in com-mand center management.

To help aid in the management of commandcenters, whether they are JOCs or local structures,local law enforcement must identify ways to


30 Federal agencies may not always be able to provide theresources provided in the sniper case for all complex, multi-jurisdictional investigations.

31 For information on how to construct an IncidentCommand Center, see Shores, Lisa. (forthcoming).Planning an Incident Command Center: The Value ofCross-Agency Comparisons, An example from theCharlotte-Mecklenburg (NC) Police Department,Prepared for the Department of Homeland Security, Officeof Domestic Preparedness.

80828_i-200.R7 10/8/04 12:07 AM Page 43

develop training for command post managers,including functional organization, responsibilitiesof key personnel, room and space requirementsand more.

Every agency executive should ask where and howa JOC should be established if such a need arises,and develop a plan for quickly operating the facil-ity. Having to begin the planning process in themiddle of an active investigation wastes valuabletime that could be better spent focusing on theinvestigation than on building the infrastructure.

Agencies need to be able to identify a minimum of5,000 square feet of space for an effective com-mand post. Having one primary and several sec-ondary sites is preferable. Facilities such as highschool gymnasiums, community centers, NationalGuard armories, theaters, firehouses, or even aparking garage are possibilities. To the extent pos-sible, the space should allow all the participants tobe visible to each other, but should also include anumber of private rooms for meetings.

When choosing potential sites, agencies shouldconduct a security survey of the facility and sur-rounding areas to assess the ease in which unau-thorized personnel or the press could enter.Agencies need to have, or develop, a plan for sitesecurity, including access and identification cre-dentials for such individuals as investigators, sup-port staff and media. The Secret Service and ATFprovided this function for the MontgomeryCounty task force.

Prior to an incident, agencies should develop plansthat consider how they will obtain resources nec-essary to operate a command center. Agenciesshould acquire, or know where to acquire, criticalresources such as phone lines, computers, genera-tors, tables, flip charts, chalk boards, paper, pens,food and beverages.

Managing Human ResourcesThe JOC was the second level of management,directly below the three executives who led the taskforce. An Operations Group ran the JOC on a dailybasis. Like the three executives who led the task

force, the JOC operations group consisted of threeindividuals, one each from the MCPD, FBI andATF. These individuals worked together, using aconsensus model of decision making. To assistthem in assigning work, the space in the JOC wasdivided according to function (see Appendix F fora floor plan template), and included a number oftables and desks arranged by focus. The primaryfunctions in this JOC were the following:

• Intelligence• Investigations• Logistics• Evidence• Liaison• Rapid Start• Crime Analysis• Tactical• Negotiations• Legal Team• Command

Several hundred law enforcement personnel oper-ated out of the Montgomery County JOC. Few ofthem had ever worked together before, and aneven smaller number had ever worked in a JOC.Those who were responsible for creating order inthe JOC pointed to the need to establish a divisionof labor and to staff all positions adequately.

A division of labor, based on functional responsi-bilities, is crucial to effective command post man-agement. Individuals who will assume key respon-sibilities need to be assigned full time to the JOCand relieved of their routine responsibilities.Leaders have to ensure that no one person is tak-ing on too much responsibility or stretching him-or herself too thin. To help with this, primary, sec-ondary and relief positions are necessary forsupervisory and coordinating functions.

Those working in the JOC need regular breaks toguard against burnout. It is imperative that peoplebe sent home for rest, sleep, food and days off. Allshifts should be fully staffed and provided a relieffactor. Supervisors should remain on the sameshift to ensure consistency with personnel. Whenchanging shifts in the command center, managers


80828_i-200.R7 10/8/04 12:07 AM Page 44

must ensure that the outgoing shift briefs theincoming shift. These briefings are paramount andmust be held regardless of what else is occurring.

Liaisons or representatives from participatingagencies stationed at the command center need tobe at least middle managers, capable of makingdecisions for their agencies. This is especially trueonce an agency has initiated an investigation.Conversely, command center leaders must wel-come all liaisons from those agencies with inci-dents and include them in briefings and decisionmaking.

Whenever agencies send investigators to a com-mand center they must also send an appropriatenumber of supervisors to accompany them,preferably adhering to ratios currently used bytheir agency. These visiting supervisors shouldhave a point of contact in the host agency, presum-ably a supervisor of equal or greater rank.

Security and LogisticsThose interviewed for the project identified a num-ber of helpful considerations when establishing ormanaging a command post. Though not exhaus-tive, this list provides a range of helpful suggestionsthat can guide others undertaking a JOC:

• The command post should not be in a facilityused for normal resident walk-in business,such as obtaining traffic crash reports.

• A controlled front gate and badge system areneeded to allow access into parking facilities.

• Limit access to only those individualsrequired to be in the command post.

• Set up a separate staging area and room forofficers who will work surveillance andoperational details.

• Designate a space that investigators can use toconvene by themselves to review and discussleads.

• Limit phones and radios in rooms duringbriefings as phones can be used as listeningdevices. This will limit distractions andopportunities for leaks.

• Compile a phone book of key people in thecommand post.

• Catered foods are essential for staff, but keepthem out of the central command post. Thishelps staff take breaks away from their desksand keeps work areas clean.

• Wait a few days after the end of an event tobreak down the command post, just in case ithas to go back into operation.

E M P L O Y I N G M I L I T A R Y A S S E T SThe unusual nature of the sniper case led to theinvolvement of unique federal resources—assetsdesigned for military missions. The U.S. Army’sRC-7 Airborne Reconnaissance Low Aircraft wereused to provide aerial surveillance with nightvision capabilities in an attempt to detect muzzleflashes from guns. The decision to use the militaryin a criminal case was highly unusual, notablybecause of the separations required by the PosseComitatus Act that prohibits the military fromperforming civilian law enforcement functions.The separation was maintained in the sniper caseby stationing law enforcement personnel in theaircraft to conduct analyses of surveillance resultsand make decisions about subsequent law enforce-ment operations. The request for the equipmentcame from the task force leadership through theFBI, and was authorized by Secretary of DefenseDonald Rumsfeld.

C O N C L U S I O NLocal and state law enforcement agencies need tobe aware of available federal resources and how toaccess them. Agencies also need to consider howcommand centers should be managed and howthey will function in the overall investigation.Implementing a large command post, like a JOC,will be a new experience for many law enforce-ment agencies. The command post may not be ausual part of how the organization does business,and it will pose challenges and demands neverbefore encountered. One manager posed the ques-tion, “Does creating a JOC create the perceptionthat the JOC is the most important element in theinvestigation?” In much the same way that an exec-utive can spend too much time on one aspect ofthe investigation, agencies can become fixated onthe centrality of the command post. An FBI officialcharged with establishing and managing a JOC


80828_i-200.R7 10/8/04 12:07 AM Page 45

stated that the function of the JOC is to “manage,support and coordinate, but not take over theinvestigation.”


Accessing Federal Resources• Federal law enforcement resources can

augment those of local and state agencies,especially in multijurisdictional investiga-tions, without having to take control of theinvestigation.

• Local, state and federal law enforcement offi-cials should work to develop a better under-standing of how federal resources can assiststate and local agencies. Federal agencies canhelp by delineating and disseminating theirprotocols for providing assistance in high-profile, complex, or multi-agency investiga-tions. Federal officials must explain theirresponsibilities in the event a local crime isjudged to be a terrorist act. Federal and localofficials may need to consider a seminar forlocal executives on the Serial Killing Law andother federal resources.

Coordinating Federal Resources • Federal law enforcement agencies need to coor-

dinate their own responses when assisting localor state agencies. State and local law enforce-ment felt that federal agencies should considerbeing under the leadership of one agency orperson during these complex investigations.

• To facilitate coordination and control, localagencies need to incorporate into their pre-planning how they will manage the largenumber of investigators that could arrivefrom the FBI, ATF, U.S. Secret Service, U.S.Marshals Service, other federal agencies, statelaw enforcement agencies and other localjurisdictions.

• Local, state and federal officials should meetduring non-stress times to develop bothinformal and formal working relationships.

Understanding Federal Expertise• The FBI, ATF, DEA and Secret Service, as well

as other federal law enforcement agencies,

have specialized forensic abilities. Local lawenforcement should understand these areas ofexpertise and draw upon those that matchtheir forensic needs.

• The U.S. Marshal’s Service has the legalauthority to federally deputize local and statelaw enforcement officers.

• Other federal agencies can also request thatlocal law enforcement be deputized to assistin serving warrants outside the jurisdiction orstate, making arrests and more.

Engaging the Critical Incident Response Group• The FBI’s Critical Incident Response Group

(CIRG) facilitates the Bureau’s rapid responseto, and the management of, crisis incidents.CIRG integrates tactical and investigativeresources and expertise for critical incidentsthat demand an immediate law enforcementresponse. CIRG assistance can be requestedthrough FBI Field Offices’ Special Agents inCharge.

Working with the Critical Incident ManagementResponse Team (CIMRT)

• State and local law enforcement should beaware of the resources that the ATF’s CIMRTcan contribute to a multijurisdictional investi-gation. Personnel on this team have beentrained in crisis management, critical incidentresolution and joint operations.

Setting Up Joint Operations Centers (JOCs) andCommand Centers

• Local agencies need to consider how com-mand centers should be managed, and howthey should function in the overall investiga-tion. Implementing a large command post,like a JOC, may be a new experience for manylaw enforcement agencies. Command postsmay not be a part of how the organizationnormally conducts business, and they willpose challenges and demands never beforeencountered.

• Local law enforcement should develop orobtain training in managing command posts,including the federal JOC, with particularemphasis on functional organization, responsi-


80828_i-200.R7 10/8/04 12:07 AM Page 46

bilities of key personnel, room and spacerequirements, and other basic decision making.

• Local and state agencies should identify aminimum of 5,000 square feet of space for aneffective command post. One primary andseveral secondary sites are preferable andthese may include high school gymnasiums,community centers, National Guard armories,theaters and even parking garages.

• To the extent possible, the space should allowall of the participants to be visible to eachother, but should also include a number ofbreakout rooms for meetings as well as stag-ing areas for officers working surveillance andoperational details.

• Identify any security concerns for the facilityand the surrounding areas. Agencies shoulddevelop a plan for site security, access and cre-dentials for people who will be on site.

• Prior to an incident, agencies should engagein a planning process that considers how theywill obtain resources necessary to operate acommand center. Agencies should be pre-pared to acquire critical resources such asphone lines, computers, generators, tables, flipcharts, chalk boards, paper, pens, food andbeverages.

• A division of labor ensuring that no one per-son is taking on too much responsibilityshould be set in place with the requisite pri-mary, secondary and relief positions necessaryfor supervisory and coordinating functions.

• A full-time staff for the JOC should be set upwith officers receiving regular breaks, time forrest, sleep, food and days off to help guardagainst burn-out.

• Supervisors should remain on the same shiftas investigators to ensure consistency.

• When changing shifts in the command center,ensure that the outgoing shift briefs theincoming shift no matter what is happening.

• Representatives from participating lawenforcement agencies must be included inbriefings and decision-making meetings.

• When participating agencies detail investiga-tors to a command center, they must alsosend the appropriate number of supervisorsto ensure adequate staffing.

Employing Military Assets• U.S. military assets can provide law enforce-

ment with sophisticated technology, but canonly be used in accordance with the PosseComitatus Act.


80828_i-200.R7 10/8/04 12:07 AM Page 47

48

80828_i-200.R7 10/8/04 12:07 AM Page 48

C H A P T E R F O U R ■ Managing Investigations ■ 49


This chapter focuses primarily on the expe-riences and lessons learned from the waysinvestigative resources were organized and

how the investigations were managed during thesniper case. The following topics will be covered:

• Defining the roles and responsibilities ofinvestigative personnel

• Controlling and coordinating investigativeresources

• Securing and processing the crime scene• Managing leads• Integrating the role of prosecutors

This chapter does not discuss evidentiary mattersor assess investigative personnel’s decisions oractions. Rather, it identifies organizational andprocedural challenges that law enforcement agen-cies will encounter when conducting an investiga-tion of a highly visible crime or when partneringwith other agencies to conduct combined investi-gations. It attempts to address some of the chal-lenges that investigative personnel encounteredduring the three-week sniper spree:

• How should agencies manage a complexcriminal investigation?

• How can officials focus on the investigation inthe face of significant distractions?

• What are the roles and responsibilities forinvestigators, managers and executives incomplex investigations?

• How can managers coordinate investigativeresources?

• What should the size of the crime scene be? • What are the obstacles to effectively managing

crime scenes?• How should investigative managers assign and

track leads?

For the sniper case investigative personnel, thesequestions were not always anticipated or easilyanswered. For example, regarding the size of thecrime scene, Prince William County PoliceDepartment officials had the foresight to pre-planfor an unusually large crime scene in the event ofa sniper shooting in their jurisdiction. Despitetheir best efforts to predetermine an appropriateperimeter, officials were forced to increase the sizeof the crime scene once a shooting occurred.

“Whatever the size of the crime scene,double it.”


In another example, Fairfax County PoliceDepartment officials, who also engaged in carefulplanning for a potential shooting, never expectedseveral hundred law enforcement officers (many ofwhom were federal agents) to show up at theircrime scene. As with other efforts in this case, toomany local, state and federal personnel acted inde-pendently, believing their presence would make orbreak the investigation. So, while Fairfax Countyofficials had planned for a big turnout of lawenforcement personnel, they did not anticipate

C H A P T E R F O U R

Managing Investigations

80828_i-200.R7 10/8/04 12:07 AM Page 49

having to assign extra patrol officers to manage allthose who showed up at the scene.

“When I arrived at the Home Depotcrime scene, I looked at the parking

lot and saw in excess of 200 lawenforcement personnel and thought,

this is going to be a challenge.”Chief Thomas Manger,

Fairfax County Police Department

Based on the sniper case experiences, as well as theopportunity for law enforcement officials to retro-spectively evaluate what worked and what did not,it is possible to extract lessons for other agencies toconsider when investigating a high-profile crime.Of course, a complete appreciation of the chal-lenges of such an investigation needs to be consid-ered in conjunction with other aspects of agencyor task force operations, such as leadership andtask force governance (Chapter Two) and infor-mation management (Chapter Five).

BackgroundThe following timeline shows the sequence of shoot-ings in the jurisdiction in which they occurred.

Day 1: one homicide in Montgomery County.

Day 2: four homicides in Montgomery County.

Day 2: one homicide in Washington, D.C.

Day 3: one critical shooting in Spotsylvania County.

Day 6: one critical shooting in Prince George’s County.

Day 8: one homicide in Prince William County.

Day 10: one homicide in Spotsylvania County.

Day 13: one homicide in Fairfax County.

Day 18: one critical shooting in Hanover County.

Day 21: one homicide in Montgomery County.

Day 23: two suspects arrested in Frederick County.

Seven agencies had to investigate a shooting orhomicide in their own jurisdiction. Consistent

with existing protocols, each agency conducted itsown investigation, but coordinated that investiga-tion with the Montgomery County Task Force.These agencies sent information to and receivedinformation from this task force. Not every agencysent or received all information about their inves-tigation, but selectively sent information accord-ing to their assessment of whether it would bene-fit the greater task force investigation. In an effortto enhance coordination, Montgomery Countytask force-based FBI, ATF and local investigatorswere assigned to each shooting regardless of loca-tion to review evidence and investigative results.

D E F I N I N G T H E R O L E S A N DR E S P O N S I B I L I T I E S O FI N V E S T I G AT I V E P E R S O N N E LOne of the striking differences in high-profileinvestigations like the sniper case is that the inves-tigations were conducted in a “top-down manner.”Virtually every other law enforcement investiga-tion, including homicides and other seriouscrimes, are “bottom-up”—that is, a detective hasprimary responsibility for conducting the investi-gation, making many of the decisions regardingcollecting and analyzing evidence, managing leadsand interviewing witnesses and suspects. In top-down investigations, law enforcement executivesand managers primarily control the investigation.The best method will reflect a balancing of the twoapproaches—with executives providing leadershipsupport and resources to the investigators whospecialize in this work every day.

InvestigatorsBecause it is so radically different from standardprocedures, the top-down approach can create sig-nificant confusion in the management of theinvestigation. In particular, this approach playshavoc with the roles and responsibilities of keyindividuals. Investigators who are usually incharge of case investigations may find their roleschanged in high-profile cases. Agency executivesor investigative managers may take control, orexert substantial influence over the case; and pri-mary investigators may have to accept that high-profile cases belong to everyone.

50 ■ Managing Investigations ■ C H A P T E R F O U R

80828_i-200.R7 10/8/04 12:07 AM Page 50

“As much as possible, I tried to treat this as a normal investigation.”

Captain Barney Forsythe, Montgomery County Police Department

Because of the pressures they feel from externalstakeholders during a high-profile case, executivesand managers will want to get more involved inthe decisions usually left to primary investigators.One manager also noted that the size and high-profile nature of the sniper investigation led to theinvolvement of hundreds of investigators, creatinghuman resource management problems that pri-mary investigators do not routinely handle.

Having to share decision-making responsibilitieswith others, or actually losing those responsibili-ties, may be difficult for local investigators to com-prehend, and may leave them unsure of what todo. In the sniper case, several investigators saidthey were stuck handling administrative and evenclerical duties. “We were told what to do ratherthan deciding what to do,” one investigator said.Not surprisingly, investigators who frequently hadconsiderable autonomy in conducting an investi-gation felt their expertise was not used fully.Investigators interviewed for the project expressedtheir frustration at the uncertainty over their rolesand the inability to contribute to the investigation.Some local investigators said their motivationsometimes waned because they could not be moreproactive or could not receive vital information.

While investigators and managers acknowledgedthe human resource management challenges ofsuch a large investigation, they insisted that agen-cies must begin with the principle that the primaryinvestigator must have the support and latitude tobe effective. To be a lead investigator requires acertain amount of skill, training and experience—experience gained by investigating crimes overseveral years. As one investigator said, “This iswhat we do every day. Why wouldn’t a chief wantus to lead the investigation?”

Yet, in speaking to some of the chiefs and sheriffsinvolved, they indicated that because of the enor-mous public pressure and community fear theyneeded to be more involved than they normallywould be in a homicide investigation. Other chiefs,however, felt it was critical to delegate authority tothose who act as investigators day-in and day-out.The investigators may be most successful when theyare given both the authority and resources to dowhat they do on a daily basis. This does not meanthat the chiefs or sheriffs abdicate their roles; rather,like any effective leader, they need to manage allaspects of the investigation while not gettingbogged down in the minutia of the investigation.

“Not every police official is capable ofbeing a primary investigator.”

Sergeant Roger Thomson, Montgomery County Police Department

Many investigators stressed their need to stayinformed about developments in the case. This isespecially important when other agencies getinvolved, and points to the need to develop proto-cols for sharing information with all key personnel.Some individuals believed that there were person-nel from law enforcement agencies who withheldinformation from others because they thought theycould make better use of that information or tocontrol leaks. Information cannot be withheld frominvestigators for these reasons.

Investigators from different jurisdictions mustcommit to regularly communicating with oneanother to improve cooperation and informationexchange. Sniper case investigators organized theirown conference calls, separate from the executives’conference calls. However, because of fears thatreporters might gain access to the calls, they laterorganized face-to-face meetings. Both the confer-ence calls and the in-person meetings proved valu-able in keeping the investigators informed aboutcase developments. A number of the investigatorsknew one another from working on previous casestogether, while others were first-time collabora-tors. Those interviewed stressed that pre-existing


80828_i-200.R7 10/8/04 12:07 AM Page 51

relationships among task force investigators can bevital to the investigation’s success.

Building these relationships can be difficult becauseof regular turnover among investigative personnel.Law enforcement agencies must make the necessaryeffort to foster these positive relationships amongkey personnel and counter the effects of turnover.

Agencies must consider how they will use all inves-tigators to achieve optimum effectiveness, whichin many investigations will begin with their shar-ing information.

ManagersInvestigative managers, like other key personnel,found that this high-visibility case placed enor-mous demands on them. The amount of work wasoverwhelming, and unfamiliar duties and respon-sibilities challenged even the most resourcefulcommander. However, managers believed theywere well served by focusing on the tasks they nor-mally fulfill in any investigation—manage work-load, provide oversight and coordinate resources.

“Chiefs and managers need to realizethey may never have a good feeling

about these major investigations simplybecause they are so difficult to control.”

Chief Terrence Sheridan, Baltimore County Police Department

A particular challenge for managers was to carefullyassess how much work they assumed and the extentto which they became involved in tasks they do notnormally perform. Many tried to adhere to proto-cols for other investigations. For example, a numberof local agency commanders who did not normallyinvestigate crimes said they tried not to get involvedin investigative functions. Their true value, theybelieved, was to facilitate and coordinate the investi-gation, and procure resources for investigators.

The focus group revealed that in multijurisdic-tional cases in the United Kingdom, the investiga-tive case manager is the primary investigator and

relies on a team of investigators to track leads andinterview people. When several agencies joinforces in a multi-agency investigation, case man-agers from those different agencies designate alead chief investigator. American law enforcementagencies may want to adopt this protocol byappointing a supervisor or manager as the pri-mary investigator. The primary investigatorshould have an executive or resource officer tohelp manage and follow up on details, such asmaking staffing charts, briefing executives andcoordinating resources with other agencies. Theprimary investigator should focus on the work ofdetectives and the crime scene. Further, they couldemploy investigative coordinators to superviseseveral primary investigators and coordinateefforts with those in other agencies. These coordi-nators can ensure that support personnel andother resources are available to investigators.Coordinators may also act as a “buffer” betweeninvestigators and other agency personnel whowant or need answers to questions or additionalinformation.

“To be effective, a manager must seethings through different eyes.”

Captain Barney Forsythe, Montgomery County Police Department

Managing investigators’ assignments and work-load can be especially demanding when theydemonstrate a strong personal commitment tosolving the crime. Commanders must strike a bal-ance between keeping a critical investigator inplace for the duration of the investigation andensuring that all investigators get rest and time off.Managers should come down on the side of pro-viding adequate relief and replacement, especiallyif the investigation shows any signs of being pro-longed. To prevent burn-out, managers mustmonitor investigators’ workloads and any otherdemands on them, and get people the time off theyneed—even if they say they do not want it. As withinvestigator relief and back up, managers shouldensure that crucial managerial and decision-mak-ing positions are adequately staffed.


80828_i-200.R7 10/8/04 12:07 AM Page 52

Because the pace of these investigations can be sofast and the workload so taxing, even commanderswith extraordinary recall may find that they sim-ply cannot remember everything that has hap-pened. For example, several managers from theMontgomery County Police Department spokeabout how decisions were made and orders givenwithout them ever being put in writing. While thispractice was needed to keep pace with events, itmade it difficult to recall later when and how deci-sions were made.

To guard against this, managers should task sup-port personnel with maintaining an investigativelog. The log should be a timeline of significantevents, information developed, received and actedupon. Not only will it help managers rememberwhat has transpired, it will facilitate informationsharing among investigators. Commanders shouldroutinely review this log.

An important lesson from the sniper case is thatmanagers should avoid the tunnel vision that mayaccompany stressful investigations. One way toavoid this is to determine specific roles and dele-gate responsibilities. The overworked manager isfar less capable of seeing the entire investigation.Another way is to rely on the expertise of investi-gators. Managers should be briefed by severalinvestigators and not become too dependent onone or two investigators when staying apprised ofcase developments.

C O N T R O L L I N G A N D C O O R D I N AT I N GI N V E S T I G AT I V E R E S O U R C E S

Maintaining Control in One AgencyInvestigative coordination and control is crucialwhen so many resources from one agency aredevoted to an investigation. The effect of a notori-ous crime and the resulting investigation can havean immediate and significant impact on an agency.In the sniper case, the Montgomery County PoliceDepartment reorganized criminal investigativeunits, sections, divisions and entire bureaus tomeet the increased workload. Investigators werereassigned to handle the existing workloads ofmajor case investigators who were focused on the

sniper shootings. Investigative policies and proce-dures were changed to reflect the reorganizationsand reassignments. In addition, some ongoing butless critical investigations were suspended. TheFairfax County Police Department reassignedinvestigative personnel as well. However, FairfaxCounty (with just one shooting) did not have toreorganize as extensively as Montgomery Countyand left investigators in specialized investigativeunits (i.e., sex crimes, auto theft) to retain someinvestigative expertise in each unit to handle rele-vant cases.

“In retrospect, I would have initially sent only half the resources I did

to avoid cluttering.” Superintendent David Mitchell,

Maryland State Police

Coordinating Multiple AgenciesWhen several agencies are investigating relatedcrimes, and when federal agencies provideresources and assistance, coordinating theseresources can be an overwhelming task. Area agen-cies that are not immediately involved in a devel-oping crisis can help a task force operation bydeveloping a list of resources that are available todeploy if needed, advise the task force of them andthen wait to be contacted.

In addition, to maintain control of investigatorsand coordinate among agencies, the leadership canform investigative teams comprised of two detec-tives from different agencies. The MontgomeryCounty task force paired a local officer with a fed-eral officer; and matched an “out of town” investi-gator with someone familiar with the area.

“We could not have solved this case as quickly as we did without the involvement of the FBI, ATF and

other federal partners.”Chief Charlie Deane,

Prince William County Police Department


80828_i-200.R7 10/8/04 12:07 AM Page 53

Investigators and managers from local agenciesspoke about the coordination challenges in thesniper investigation. As previously stated, some ofthose challenges included investigators from otherlocal agencies being involved in the case. Theseextra personnel had an enormous positive effecton those agencies’ ability to investigate the homi-cides and shootings. A number of these investiga-tors, however, arrived without supervisors.Officials from every agency with a homicide orshooting praised the help of these “loaned” offi-cers, but also pointed out how the lack of supervi-sory staff and a vague chain of command createdcontrol and coordination problems.

Federal investigators created other challengesbecause of their latitude to travel and work freelyamong the local jurisdictions, unlike investigatorsfrom the local agencies. Local agency personnelcan “travel” anywhere, but lack authority to act inother jurisdictions. This distinction is important,as federal investigators may show up during simi-lar investigations unexpectedly. According tomany local and state representatives interviewed,federal law enforcement agencies provided valu-able assistance and resources. Indeed, some ofthem believed the case might not have been solvedso quickly without the help of federal agencies.Nonetheless, the presence of several hundred fed-eral investigators challenged local investigativemanagers from a coordination standpoint. Someother related challenges for local managers includ-ed the following:

• Determining the roles of so many unexpectedagents/investigators

• Duplicating investigative efforts• Addressing agents’ inexperience with

homicide investigations or unfamiliarity witha particular local jurisdiction

“The investigative command and control in our task force went about

as smooth as it could.” Colonel Gerald Massengill, Virginia State Police

Both local and federal officials cited numerousinstances of a few federal officers (i.e., investigators,tactical teams conducting surveillance and counter-sniper operations) operating in local jurisdictionswithout the knowledge of the JOC, the respectivelocal agency and even federal supervisors. Theseactions had no long-term detrimental effect on theinvestigation, but they did create work for localmanagers who were trying to coordinate local, stateand federal resources. Perhaps more important, itgave the perception that not every federal officer wascommitted to the “team” approach that ultimatelydrove this investigation’s success. This problem wasnot unique to federal agencies but was a concernwith some local personnel as well.

“Everyone had good intentions for cooperating, but sometimes actual behavior complicated

investigative operations.” Sheriff Stuart Cook, Hanover County Sheriff’s Office

S E C U R I N G A N D P R O C E S S I N G T H EC R I M E S C E N EAs any law enforcement officer knows, a crimescene can provide a wealth of information that canhelp investigators solve a case. In the sniper case,the shooters left written messages at three of thecrime scenes—messages that proved instrumentalin solving the crimes, but also had significanteffects on other aspects of the investigation, suchas media relations and suspect negotiations.

Monday, October 7, 2002Benjamin Tasker Middle School,Prince George’s CountyBowie, MarylandIn the surrounding woods 150 feet from the school,Prince George’s County Police officers discover adeath card from a tarot deck with a written mes-sage: “For you Mr. Police…Code: ‘Call me God.’Do not release to the press.” On October 8,local news station WUSA-Channel 9 and TheWashington Post report the tarot card’s existence,which led to a contentious press conference atwhich Chief Moose chastised the media.


80828_i-200.R7 10/8/04 12:07 AM Page 54

Saturday, October 19, 2002Ponderosa Steak House, Hanover CountyAshland, Virginia Investigators conduct a grid search of the areaand discover an envelope containing a letter fromthe shooters. They bag the envelope as evidenceand send it to the FBI lab for analysis. To pre-serve critical DNA and fingerprint evidence,investigators needed to wait until the envelopewas processed before opening and examining itscontents. Had investigators opened the envelopeimmediately, the critical link would not havebeen made between the forensic evidence on theletter and the suspects. The letter would laterreveal the shooters’ message that they would calllaw enforcement at 9:00 A.M. the following day ata pay phone. Telephone contact was establishedlater that day with the snipers.

This was the same letter that contained the post-script, “Your children are not safe anywhere atanytime” that caused Richmond-area schools toclose for two days while those in northernVirginia and Maryland remained open.

Tuesday, October 22, 2002Montgomery County Ride-On Bus, Route 34,Grand Pre RoadSilver Spring, MarylandThe shooters leave a third message. In addition toother requests, it states simply: “Your incompe-tence has cost you another life.”

Establishing, securing and managing crime sceneswere enormous challenges for the local lawenforcement agencies. The demands grew witheach successive shooting, and seemed to be espe-cially difficult for those shootings that occurredafter sunset, perhaps because agents and investiga-tors who were already home for the eveningresponded to the scene. The three greatest chal-lenges for agencies were determining the size ofthe crime scene, managing/controlling lawenforcement personnel and the media, and coor-dinating the resources of different agencies.

“Managing a crime scene consists ofbriefing bosses and providing leadership

for investigators. Too often, these areconflicting responsibilities.”

Lieutenant Bruce Guth, Fairfax County Police Department

The weapon used in the shootings, the possible dis-tances between the shooter and the victim, anduncertainty over the shooter’s location created chal-lenges for local agencies in determining the size ofthe scene. They quickly discovered the importanceof establishing perimeters far enough out from thevictim to ensure that the crime scene was largeenough to allow for unimpeded processing. Severalof the agencies had never managed such a largescene before, primarily because they had neverinvestigated this type of long-range shooting.

While trying to determine the size of the crime scene,agencies also had to control access to and managethose people and resources that were allowed in thescene. These challenges were daunting.

“One of the most useful experiences for our agency was when [Chief]

Charlie Deane invited our detectives to observe how [the Prince William

County Police Department] was managing their scene.”

Chief Thomas Manger, Fairfax County Police Department

Pre-incident planning by the Fairfax CountyPolice Department allowed its officers to designatethe lead detective, crime-scene technician and on-scene supervisor ahead of time. However, asmentioned earlier in this chapter, more than 200law enforcement personnel came to the scene ofthe Home Depot shooting, which was overwhelm-ing despite preparation. Other agencies relatedsimilar experiences about the number of people atthe scene.


80828_i-200.R7 10/8/04 12:07 AM Page 55

A few agencies said that, in hindsight, they let toomany people into the crime scene. For other agen-cies, their attempts to limit access to the scene werehindered by law enforcement personnel circum-venting controlled access points.

Too many agencies drove their mobile commandposts to the crime scenes. This created confusionand overcrowding, and frustrated efforts to com-municate with agency representatives. Too often,personnel from other agencies did not gather atthe primary crime scene command post, butstayed in their mobile command posts.

“You only get one opportunity to process the crime scene.”

Captain R.T. Colgan, Prince William County Police Department

As part of any pre-incident planning efforts, agen-cies need to develop procedures to establish and pre-serve the crime scene. Procedures should includemanaging visiting agency personnel. Agenciesshould establish security for the crime scene andlimit access to only those who need to be there. Atleast two, and maybe more, perimeters may berequired. One suggestion is for visiting agencies todesignate first-line supervisors to serve as commu-nications liaisons to their personnel. Visiting super-visors could remain in the second perimeter andbrief their investigators who would be in the outsideperimeter. This would help to keep the scene clear ofunnecessary people and enhance communication toinvestigators while assignments are determined.Agencies should also implement a secondary com-mand post well outside the crime-scene perimeter asa staging area for non-essential staff.

Every agency involved in the investigation has tomaintain discipline among its employees.Personnel have to realize that not everyone has togo to the scene, and not every person at the scenehas to be briefed.

“Police work is local. Crimes are solvedby a cop on the street or a vigilant

citizen who passes on a lead, and not bya ‘super sleuth’ in a remote location.”

Sheriff Stuart Cook, Hanover County (VA) Sheriff’s Office

M A N A G I N G L E A D S

Too Much InformationLeads are the lifeblood of any investigation. In eachagency that had a homicide or shooting, investiga-tors tried to manage leads according to standardprocedures. Agencies attempted to conduct andmanage the investigation as they would any othermajor case. For example, in the WashingtonMetropolitan Police Department (MPD), all tipsand investigative leads were filtered through oneinvestigative supervisor. Internal tips and leads wereassigned to MPD investigators who entered notesand details on a “lead sheet” that was then enteredinto an internal database. Tips that had implicationsfor other agencies’ investigations were forwarded tothe Montgomery County JOC after being enteredinto the MPD database.

In the Montgomery County JOC, however, man-agers had to consider the enormous number of leadsand the large number of investigators when devel-oping procedures. The basic JOC process consistedof supervisors distributing leads to 120 investigators,who then followed up on the leads, prepared noteson their findings and gave the notes to supervisorsfor review. Even with this process, investigatorsfound that it was difficult to keep pace with the leadsas they poured in. In virtually no time, the JOC wasfilled with boxes of reviewed but uninvestigatedleads. For investigative personnel, lead managementwas a never-ending process.

“It was tempting to read every fieldinterview card, but every time I havetried to micromanage something it

has been a failure.” Chief Charles Moose,



80828_i-200.R7 10/8/04 12:07 AM Page 56

Sharing InformationAn important part of a multi-agency investigationis keeping all agencies informed about develop-ments. Criminal leads and suspect informationmust be disseminated to affected agencies asquickly and accurately as possible. Not only is thisinformation essential to the criminal investigation,it also can help to counter perceptions that infor-mation is being withheld. The sharing of informa-tion can be a delicate issue, but the eventual suc-cess of any multi-agency investigation may hingeon whether information is shared—or, the percep-tion of whether information is being shared.

“Let the detectives be involved in the information analysis and

sharing process.” Detective June Boyle, Fairfax County Police Department

Some investigators (and patrol officers) believedthat information was deliberately withheld fromthem. Some investigators said the leads theyreceived were often missing critical informationthat would provide a context for the lead. But theJOC managers insisted that there was no intent towithhold information from investigators. Becauseinformation came in from multiple sources, andwas not always available at the highest levels, thechallenges to disseminating information to allinvolved was considerable. In fact, every effort wasmade to share information with investigators.Nonetheless, the perception remained throughoutthe investigation and, for some investigators, evenafter the arrests of the suspects. An important les-son from this case is that—rightly or wrongly—task forces have to recognize that some personnelwill perceive that information is being “held back”and they need to proactively address those con-cerns early and often.

“The bottom line is that this case had very little investigative information

to pass around.” Lieutenant Philip Raum,


Eventually the JOC came to rely on anInvestigative Team, comprised of seasoned andexperienced investigators who examined and eval-uated leads before assigning them, and then againwhen investigators returned them. This teambecame adept at seeing the big picture and deter-mining what actions were needed beyond currentefforts. In essence, it performed a quality controlfunction over field investigations by viewingdevelopments perhaps more objectively than thoseso intimately involved in following up leads. Alongwith seasoned investigators (i.e., homicide, rape,robbery, violent crime task force), investigativeteams like this can be more effective when theyinclude intelligence personnel and crime analysts.

ProtocolsWhen dozens or hundreds of investigators fromdifferent agencies work together, it will be neces-sary to develop protocols for investigative tactics.For example, investigators should follow the sameprotocol for verifying suspects’ alibis. These stan-dard procedures help investigators do their jobs,and help supervisors or quality control personneldo theirs. Supervisors also need protocols forreviewing investigators’ work and making deci-sions about rechecking a lead, investigating otherleads that grew from the first or moving in a dif-ferent direction.

“We thought more and more alike thefurther we got into the investigation.”

SAC Gary Bald, FBI

Similarly, a task force should develop protocols forinterviewing and interrogating suspects, includingassigning investigators. While investigators fromdifferent agencies and jurisdictions were assignedto work together on investigating leads and forsurveillance, several investigators said that wheninterviewing significant suspects, familiaritybetween investigators was important. An interro-gation is not the time or place for investigators totry to develop a rapport. Instead, pairs or teamsused to working with each other should conductthe interviews.


80828_i-200.R7 10/8/04 12:07 AM Page 57

“Key suspects should be interviewed by a team of investigators that work

together on a daily basis.”Detective June Boyle, Fairfax County Police Department

The overwhelming number of leads caused someproblems for investigators in the MontgomeryCounty task force, and likely will do so for any sim-ilar investigation. These problems became obviousonce the investigation was well underway, and pro-cedures were then implemented to correct them. Forexample, the volume of leads contributed to redun-dancies, such as two or more investigators unknow-ingly interviewing the same person.

Managing the assignment of leads is essential, andinvestigators need to report to supervisors about theresults of following up on leads, even when the effortproves fruitless. Unlike a “routine” investigation inwhich a lead would sit while an investigator was notworking, in significant investigations, leads have tobe worked around the clock. Informally handing offa lead to another investigator is not the solution.Rather, all leads have to be channeled through a leadmanagement system for tracking and transferring.

I N T E G R AT I N G T H E R O L E O FP R O S E C U T O R SDuring an ongoing multijurisdictional investiga-tion, structured communication and coordinationbetween law enforcement and prosecutors is critical.In the sniper case, law enforcement and prosecutionofficials consulted with each other. In PrinceWilliam County, police and prosecutors remained incontinuous contact, beginning with the police chiefcalling the commonwealth’s attorney while at thecrime scene. Throughout the investigation, policeinvestigators and prosecutors discussed legal issuesand investigative tactics. In Montgomery County,the JOC set aside a room for federal and local pros-ecutors. Prosecutors communicated with each otherat the local and federal level as well as with prosecu-tors across jurisdictional lines.

Although these arrangements enhanced commu-nication, in hindsight, those interviewed for this

project said a formal prosecution task force andconference call schedule early in the investigationwould have enhanced information exchange andcoordination between law enforcement and prose-cutors. Prosecutors should be brought into a caseas early as possible to facilitate cooperation andassist in an impartial and thorough investigation.

“It is essential for future cases of thismagnitude that prosecutors have a

structure in place to work together.” Paul McNulty, U.S. Attorney, Eastern District of Virginia

One example of collaboration between law enforce-ment and prosecutors on high-profile cases isWashington State’s Most Dangerous OffenderProgram, which involves prosecutors early in aninvestigation. Prosecutors are provided pagers andrespond to crime scenes along with investigators,allowing officers to continually consult with prose-cutors and investigate cases consistent with bothlaw enforcement and prosecutorial protocols. Earlyand continuous consultation between investigatorsand prosecutors is crucial to effective long-termcase investigation.

A prosecutor task force may not require the samestructure and leadership as a law enforcement taskforce. For example, the leader of a prosecutor taskforce does not have to be from the same jurisdic-tion as the leader of the law enforcement taskforce. The prosecutor who is least likely to prose-cute the case may have the time and ability to serveas a strong facilitator.

During an ongoing multijurisdictional investiga-tion, prosecutors in all affected jurisdictions need tocommunicate and coordinate resources in a struc-tured manner. Prosecutors at the local, state and fed-eral levels may have different views on legal issuesthat could assist others with their legal strategies andthe ultimate prosecution of the suspect(s).Prosecutors also can provide resources such as inves-tigative tools and even pre-trial investigators.


80828_i-200.R7 10/8/04 12:07 AM Page 58

“Juries are the ultimate judges of aninvestigator’s work, but investigators

don’t always look at the case from that perspective.”

Special Agent Brad Garrett, FBI

C O N C L U S I O NThe successful investigation of major crimes is afundamental function of local law enforcementagencies. In high-profile cases, the investigativefunction can undergo significant changes or it mayeven be neglected because of other case demands. Tothe extent possible, law enforcement agencies shouldtry to use the same investigative model and proce-dures used every day for other investigations.Certainly, the creation of task forces and the atten-dant demands associated with coordination ofresources and personnel will strain the investigativefunction even more. The pressures of the case anddemands from external stakeholders will causeagency officials to bring every resource to bear toachieve a successful conclusion. All agency person-nel must be aware of these forces at work, yet remainfocused on how to maintain a carefully orderedapproach that can be sustained over a long term.

“It’s not a question of if there will beanother multi-agency investigation; it’s a question of when and where.

Law enforcement needs to get ready for the next one.”

Detective James Trainum, Washington Metropolitan Police Department


Defining the Roles and Responsibilities ofInvestigative Personnel

Investigators• Primary or lead investigators who are accus-

tomed to taking ownership of their homicidecases should be prepared to accept that, inhigh-profile cases, managers or executives willhave a greater need to be kept informed of theprogress of the case and may from time to

time exert direction over the case.• Agencies must support the primary investigator.• Individual agencies and task forces need to

assign investigators capable of handling com-plex or high-profile investigations.

• Agencies and investigators should establish aninformation protocol for following up leads atthe outset of a multi-agency investigation.

• Information should not be withheld from pri-mary investigators in an attempt to controlmedia leaks.

• Conference calls and face-to-face meetings canhelp investigators from all involved agenciesexchange notes and plan investigative tactics.

• Agencies should designate someone to serve asa liaison between the investigators and otheragency personnel. This could be the role of aninvestigative manager or a resource officer.

Managers• Managers must strike a balance between keep-

ing critical investigators in place for the dura-tion of the investigation and ensuring thatthey get rest and time off.

• Managers should carefully assess how muchwork they take on and the extent to whichthey get involved in tasks they do not usuallyperform. Investigators need a certain degreeof freedom and independence to investigate acrime methodically.

• Individual agencies, and especially task forces,should consider appointing a supervisor ormanager as the primary investigator.

• Supervisors who act as the primary investiga-tor should have an executive or resource offi-cer to help manage and follow up on details,and coordinate resources with other agencies.

• The lead manager should focus on the workof detectives and the crime scene.

• Managers should ensure that crucial oversightand decision-making positions are adequatelystaffed.

• Managers should seek the observations ofmany investigators, not just one or two.

• Managers should ensure the maintenance ofan investigative log to record significantevents, as well as what information isreceived, developed and acted upon.


80828_i-200.R7 10/8/04 12:07 AM Page 59

Controlling and Coordinating InvestigativeResources

• In dealing with high-profile incidents, special-ized investigative unit expertise (e.g., gangs,drugs) should be retained to the extent possible.

• Assign investigators from different agencies towork as teams when investigating leads (i.e., alocal officer with a federal officer, an out-of-town investigator with someone familiar withthe area).

• When an agency loans personnel to anotheragency, it should send its own supervisorswith its patrol officers and investigators.

• Task forces need secure communication capa-bilities for conference calls.

• Investigators should not leave their jurisdic-tion or track a lead in another jurisdictionwithout first discussing the matter withauthorities in that jurisdiction.

• Federal investigators cannot “freelance” inlocal jurisdictions without first alerting locallaw enforcement and coordinating with com-mand centers.

Securing and Processing the Crime Scene• Be prepared to expand, sometimes dramati-

cally, the size of the crime scene in the eventof a long-range shooting.

• Designate a lead detective, crime-scene tech-nician, and on-scene supervisor prior to anincident occurring in your jurisdiction.

• Develop procedures for establishing and pre-serving the crime scene, including managingvisiting agency personnel.

• Establish security for the crime scene and limitaccess to only those who need to be there.

• Visiting agencies should designate supervisors toserve as communications liaisons to their per-sonnel. They should also discourage their per-sonnel from just showing up at a scene. Com-mand and control structures exist to ensure thatappropriate resources are obtained quickly anddeployed effectively. An unexpected resourcegenerates unplanned work for crisis managers.

• A secondary command post should be estab-lished well outside the crime-scene perimeteras a staging area to address any non-essentialstaff at the scene.

Managing Leads• Leads and suspect information must be dis-

seminated to affected agencies as quickly andaccurately as possible.

• Officials should recognize and plan for thesituation in which some task force memberswill perceive that information is being with-held, whether it is or not.

• Create an investigative team that serves aquality control function and views develop-ments objectively.

• Investigators should report the results of investi-gations to their supervisors, even when the leaddoes not produce useful follow-up information.

• Agencies will need a comprehensive leadmanagement system that includes trackingprocedures for receiving, assigning, reviewingand transferring leads.

• Supervisors should not filter information(even in an effort to prevent media leaks)before passing it along to investigators.

• Supervisors need protocols for reviewinginvestigators’ work and making decisionsabout re-checking a lead, investigating otherleads that grew from the first or moving in adifferent direction.

• Task forces should develop protocols forinterviewing and interrogating suspects.

• Investigators who are not accustomed toworking together should not jointly conductinterviews of significant suspects.

(See Chapter Five for more on information man-agement.)

Integrating the Role of Prosecutors• Law enforcement should invite prosecutors

into an investigation as early as possible toanswer questions, assist with search warrants,and provide guidance for what will eventuallylead to a successful prosecution.

• Prosecutors should explore how prosecutiontask forces can influence high-profile investi-gations and determine the protocols necessaryfor effective coordination with law enforce-ment agencies.


80828_i-200.R7 10/8/04 12:07 AM Page 60

C H A P T E R F I V E ■ Information Management ■ 61


This chapter discusses the collection,analysis and dissemination of informationduring the sniper case, and how these

functions influenced that high-profile investiga-tion. It is meant to be instructive for any agencyfacing a multijurisdictional effort. Specifically, thechapter focuses on the following:

• Ensuring telephone and radio communications• Setting up tip lines and call center management• Using case management systems• Enhancing information management and

intelligence analysis• Accessing criminal information databases

These functions are so closely related, indeedinterrelated, that determining where one systemends and another begins can be difficult. Thesefunctions also can have significant effects on anentire investigation, influencing the work of inves-tigators, patrol officers and crime analysts.Organizing and coordinating these functions canbe incredibly challenging, especially when a case isongoing and dynamic.

“The sniper case started and ended with a call to 911.”

Assistant Chief William O’Toole, Montgomery County Police Department

In fact, during the sniper case, not all of these sys-tems were integrated to the degree that everyone

would have liked. The “1-800 Tip Line,” for instance,was never fully integrated with the FBI’s leadmanagement system. This created considerabledifficulties for tracking information during theinvestigation, including being able to identify whichjurisdictions had leads and the progress they weremaking on them. Some of the questions that lawenforcement officials tried to answer during thethree-week shooting spree included the following:

• How can agencies handle the increased call vol-ume associated with a significant investigation?

• Should telephone tip lines be established inone call center or multiple centers?

• How can agencies implement, staff and man-age a tip-line call center?

• How should agencies collect, analyze and dis-seminate telephone tips?

• How do agencies synthesize information—motor vehicle, criminal, suspect—acrossjurisdiction and state lines and use it in ameaningful way?

• How can agencies analyze the vast amounts ofinformation collected during an investigation?

• How can criminal and information databasesbe used during an investigation?

The information management challenges duringthis investigation were unprecedented. Thoughsome individuals have criticized law enforcementagencies involved in the sniper case for failing tomanage the extraordinary volume of informationthat this case generated, they often overlook thatthere was no capable information managementsystem that could have accomplished those tasks.

C H A P T E R F I V E

Information Management

80828_i-200.R7 10/8/04 12:07 AM Page 61

E N S U R I N G T E L E P H O N E A N D R A D I O C O M M U N I C AT I O N SAs with virtually any multijurisdictional, intergov-ernmental law enforcement operation, telephoneand radio communications presented significantchallenges for officials involved in the sniper inves-tigation. Perhaps the largest telephone equipmentconcern occurred in the Montgomery CountyJOC. While the command center was housed in anexisting office building, it lacked an electronicinfrastructure. Thousands of yards (if not miles)of telephone and computer cables had to be pulledthrough the building, and telephones had to beinstalled.

The telephone system used in the MontgomeryCounty JOC lacked an in-house switching capabili-ty and limited the ability of personnel to transfercalls within the JOC. The JOC would have benefit-ed from a private branch exchange (PBX) phonesystem, which provides significant efficiencies inrouting phone calls into the center. PBX is an in-house telephone switching system that connectstelephone extensions to each other, as well as to theoutside telephone network. It would usually includefunctions such as routing outside calls, call forward-ing, conference calling and call accounting.

In addition to telephone problems, the lack of inter-operability created significant radio communicationissues among many local, state and federal agencies.A notable exception was the combined radio systemused by virtually every local law enforcement agencyin the Richmond area. But even this system did notpreclude radio communication problems betweenlocal, state and federal agencies.

Interoperability among law enforcement agencieswas limited in the Washington, D.C. area despiteseveral efforts to improve communications. TheMCPD distributed more than 40 800MHz radiosto Maryland State Police troopers. Federal agenciesdistributed some portable radios with encryptioncapabilities to provide secure communications,but local clear channel radios could not beencrypted. Nextel wireless phones and BlackberryPDAs were also widely distributed and used forvoice and e-mail communications.

S E T T I N G U P T I P L I N E S A N D C A L L C E N T E R M A N A G E M E N T

BackgroundThe Montgomery County Emergency Commun-ication Center (ECC), the 911 center, answered cit-izen calls reporting the shootings on the first andsecond days. During the second day, the ECCbegan answering citizens’ calls about tips andpotential leads even before a tip-line was adver-tised. The county moved quickly to establish a sep-arate call center to handle tips, but the volume ofcalls quickly overwhelmed the call-takers and theinitial eight telephones, as well as a subsequentincrease to twelve.

With assistance from the FBI and ATF, an ad hoccall center consisting of 15 and then 25 phone lineswas next established in the JOC, but that, too,proved inadequate to handle the call load.

Eventually, the FBI’s Washington Field Office(WFO) offered to assume responsibility for thetoll-free tip line and established a stand-alone callcenter in the WFO, a 20-minute drive from theMCPD. The call center was not located in the JOCor any task force office. The field office relied on itsexperience running a tip line in the aftermath ofthe September 11 attack on the Pentagon and theanthrax letters sent through the U.S. PostalService. The call center continually expanded untilit was using 100 telephones. Throughout theinvestigation, the rate of telephone tips increaseddaily. However, the times and sequencing of thecalls was unpredictable, although the calls alwaysspiked in the hours after a shooting. Overall, thenumber of calls was staggering:

• On many days, more than 5,000 calls a daycame into the call center.

• On one day, the center received 10,000 calls.• On Friday, October 11, the center received

more than 1,000 calls in one hour.• During the course of the investigation, the

telephone tip lines received more than100,000 calls generating some 16,000investigative leads.

62 ■ Information Management ■ C H A P T E R F I V E

80828_i-200.R7 10/8/04 12:07 AM Page 62

“Along with sending agents to the affected jurisdictions, I volunteered

my office to stand-up the call center. It was a difficult operation, but I felt our recent experience with tip lines

could make a difference.” Assistant Director In Charge Van Harp, FBI

Many of the calls did not provide credible infor-mation, although the call-takers tried to writedown as much information as they could on thestandardized forms. When a call produced credibleinformation, the “tip sheet” was sent to theMontgomery County task force, one of the localtask forces or directly to an agency, depending onwhere follow-up should occur. Most tip sheetswere either hand-carried or faxed to the task forcesor agencies because of an inability to network withthe computerized lead management system, RapidStart. Some of those interviewed indicated that thecall center did not always document where theinformation went or note its eventual disposition.

A variety of individuals from the WFO answeredcalls. Some were FBI and ATF agents, but many morewere secretaries, clerical workers, agents-in-trainingor civilian analysts. Most had never done this type ofwork before and some even had reservations aboutanswering the calls. Eventually, a small number ofretired FBI agents answered calls too. Because of howquickly this investigation developed, none of theseindividuals were provided any significant training asa call-taker. It was suggested that future operationsshould, at minimum, provide written instructionsthat can be shared with all call-takers.

Despite the centralized 1-800 number, many of thelocal agencies that investigated shootings estab-lished their own telephone tip lines and ran themfrom local facilities. Many local and state 911 cen-ters received calls from citizens with potential tipsduring the three-week episode, even in jurisdic-tions without a shooting. In those jurisdictionsthat had a shooting, the volume of calls to the 911centers increased in the immediate aftermath ofthe shooting, and then spiked again whenever

another shooting occurred. For example, on Day10, when Kenneth Bridges was murdered, theSpotsylvania County Sheriff ’s Office receivedsome 1,900 tip calls. At one point, the calls arrivedat a rate of 40 per minute. The same spike could beobserved even in agency call centers in jurisdic-tions neighboring one where a shooting occurred.

Single or Multiple Call CentersThere were varying opinions about whether oneor multiple centers are preferable. Many officialsbelieve that telephone tip call centers should notbe run from a centralized location far from localagencies, as this creates a disconnect between localdemands and the resources (in this example,information) required to meet those demands.Others believe one centralized call center is moreeffective, as multiple tip centers in local agenciesimpede the ability of a task force to centrallymonitor tips and leads.

The number and location of telephone tip centerswill probably be a function of the number of agen-cies involved in the investigation as well as the geo-graphic scope of the crime. A series of crimes inclose proximity might only require one telephonetip center, while a series of crimes spread over alarge area might require several call centers to han-dle the volume of calls. In the sniper case, residentssaid that when calling the toll-free tip line, theyreceived a busy signal, which caused them to call911 or even non-emergency numbers at local lawenforcement agencies. Also, multiple call centersmay be necessary to meet the desire of residentswho, in the sniper case, expressed an outright pref-erence for calling their local law enforcementagency rather than a centralized tip line or the FBI.If residents decide to call local agencies, thoseagencies have to be prepared to answer those callsby having protocols to collect information fromthe callers and forward it to the relevant task force.Finally, choosing where to locate multiple call cen-ters may reflect the respective ability of call centersto collect the information and forward it to a localtask force or agency. If a particular call center isunable to do that, agencies may feel compelled toestablish another center with a different telephonenumber to receive and manage the calls.


80828_i-200.R7 10/8/04 12:07 AM Page 63

Managing Telephone TipsClosely related to the number of and location ofcall centers are the procedures for analyzing, dis-seminating and monitoring the informationreceived from telephone tips. In the sniper case,the WFO call center’s primary responsibility wasto collect information from the callers and for-ward that information to the appropriate taskforce or agency based on a determination by callcenter managers. The call center personnel werenot supposed to analyze the tips and develop aninvestigative strategy, nor were they to monitoraction taken on the tips by other agencies. Whenan agency or task force received the telephone tip,staffers reviewed it and assigned it to an investiga-tor for follow-up.

According to officials interviewed as part of thisproject, a call center would ideally be located inclose proximity to the primary JOC, and would beunder the control of the task force leadership orthe primary agency. This would allow for a tighterconnection between the call center and the leadmanagement operation, eliminating problemssuch as incomplete tip sheets, tips going to multi-ple agencies and redundant investigations of thesame tips. Preferably, this would be a seamlessoperation in which one command would monitorand track all telephone tips, leads and other infor-mation. A local or state agency, for example, hasthe potential to use a computer-aided dispatch(CAD) capability to integrate electronic tips into acase management system, eliminating the need torecord tips on paper and then have someone elselog information into a database. In the sniper case,however, that was difficult because of the geo-graphic scope of the crimes.

As the investigation consumed more land area,some of the agencies felt their distance from theWFO call center constrained their ability to receivetimely telephone tip information consistently. Thisbecame a frustrating challenge to the investigators.Many officials interviewed believe every telephonelead should be controlled and disseminated fromone command-and-control center, assigned to anappropriate investigative team and tracked cen-trally. In essence, this is what each of the task

forces tried to do with every telephone tip and leadit received.

Coordinating multiple call centers and the leadmanagement process creates a variety of problems.One of the most vexing is whether local agenciesshould be sending telephone tips they receive to acentral lead management center. The preference ofmany local agencies would be to control all locallygenerated tips. The tip would be screened by thelocal agency, and if it affected another jurisdiction,it would be forwarded to the task force commandcenter or a central lead management center. If thetip required investigation by the agency that firstreceived it, then that agency would investigate thetip, and at least notify the central command of itsactions. Ideally, all agencies receiving calls shoulduse standard computer screens that could beshared via electronic file. Then, personnel couldconsolidate the data and include informationabout to whom each tip was referred for investiga-tion. It is critical to organize this information.

Staffing Call CentersTelephone tip calls require significantly more timeto handle than the typical 911 call, which takesabout 40 seconds, according to officials in theMontgomery County Emergency CommunicationsCenter. This extra time requirement has significantimplications for using 911 operators to answer tele-phone tip calls while still expecting them to providethe usual level of service on routine calls.Maintaining an ordinary level of service in extraor-dinary times requires new strategies for handlingcalls. The 911 centers will need a significant numberof additional operators and dispatchers, as well asadditional supervisors, as they will undoubtedlyreceive some of the calls not answered by other callcenters.

In the sniper case, several call centers, including911 centers and dedicated tip centers, were unableto keep pace with the workload and may haveinadvertently disregarded calls from the suspectsbecause call-takers were overwhelmed, inade-quately equipped or trained. Rockville, Maryland,for example, is an incorporated city withinMontgomery County and has its own independent


80828_i-200.R7 10/8/04 12:07 AM Page 64

police department. The Montgomery County taskforce and JOC were headquartered within theRockville city limits. Consequently, the Rockvillepolice emergency operators received hundreds oftelephone tips, but could only advise the callers tohang up and phone the toll-free tip line becausethey lacked a mechanism for transferring the calls.

Call-takers may require reassurance to deal withhigher levels of anxiety associated with theincreased call workload and the stress of the entireinvestigation. Call-takers must have the propertraining and be given procedures to follow. Retiredpolice officers may be able to staff call centers dur-ing a high-profile investigation or critical incident.(The National Center for Missing and ExploitedChildren and the United Kingdom have success-fully employed protocols for using a cadre ofretired officers who have passed backgroundchecks and may be available to assist.)

Agencies may want to consider using a privatecompany to handle a telephone tip line and shouldexplore that option before a crisis occurs. In theBaton Rouge serial murder case, the law enforce-ment agencies contracted with a private telephonecommunications company to run their tip lines.The primary reason for this decision is that thecompany had the expertise to handle the calls,including sufficient telephones, the capacity todigitally record every call, and trained and experi-enced call-takers. The law enforcement agenciesinvolved in the investigation developed protocolsfor the company to use when answering calls,including how to handle “hot calls” that requiredimmediate law enforcement attention.

In Montgomery County, a privately operated tipcenter offered to establish the telephone hot linefor the Sniper Task Force. The offer was consid-ered, but declined when an agreement could notbe reached concerning continued use of a dedicat-ed phone line and the need to properly vet call-takers needed for a potential trial, as well asissues regarding tip sheet retention. Obviously,these are only some of several considerations indetermining whether to use a third party to oper-ate a call center.

Preparation and PlanningGenerally, law enforcement lacks coherent plans forstaffing telephone tip lines and training call-takers,as well as procedures for answering calls and collect-ing actionable information. Running a tip-line oper-ation out of an Emergency Communications Centerrequires a dedicated block of non-emergency tele-phone lines, as well as an appropriate physical spacefor call-handlers and equipment. Agencies shouldidentify a location that could be used as the tip linecenter and have an incoming toll-free number inreserve, or have specific contacts with communica-tions companies and a plan for installing such lineson short notice. Similarly, communication centermanagers would benefit by knowing at least thenames of, if not having relationships with, key man-agers in cell phone companies. Invariably, it seems,agencies will find that they will have to request thoseresources in the middle of the night.

If possible, agencies should have pre-existing pur-chase orders, or at least procedures for emergencypurchase orders, for equipment that will be need-ed in a crisis. Agencies should also predeterminehow to create budget line-item codes for majorevents. This allows almost immediate tracking ofexpenses related to the event.

The Montgomery County Police Department didnot have mutual aid agreements with other localcommunication centers. The primary reason citedby emergency communications managers is the dif-ficulty, even impracticality, of learning differentphone and radio systems, especially in light of thelimited opportunities for mutual aid. Additionally,many agencies do not use a standard 10-code lan-guage, which just increases the learning curve fordispatchers detailed to another emergency commu-nications center. To avoid these types of difficulties,a federally established center may be the best option.As with all law enforcement functions, the key tomaintaining effective tip-line centers is to plan for allcontingencies and make appropriate preparations.

T R A C K I N G L E A D SThe FBI’s Rapid Start was used as a tracking systemand repository for telephone tips and other leadsfor the Sniper Task Force. Rapid Start was set up in


80828_i-200.R7 10/8/04 12:07 AM Page 65

the Montgomery County JOC. A second RapidStart was set up by the FBI’s Richmond Field Officein Fredericksburg, VA, in response to the shootingsin Spotsylvania County. The system was latermoved to the Richmond Field Office after theshooting in Hanover County. Rapid Start is a stand-alone system, thus the two Rapid Start systems werenever networked, nor were they connected to anyother information management system.

“Even though it had its problems, RapidStart was better than anything we had.”


The raw data for Rapid Start includes telephonetips, leads and other information, such as licenseplate numbers. All information entered into RapidStart must first be entered by hand onto a RapidStart Information Control Form. That form isthen manually delivered to data entry operators, inthis case FBI civilian analysts and MCPD civilians(who received a 2-hour crash course in RapidStart), who keyed the information into the sys-tem.32 As mentioned earlier, in the sniper case alltelephone tips from the WFO call center had to behand-carried or faxed from Washington, D.C. toMontgomery County. Once information wasentered, Rapid Start had the ability to generate,assign and track investigative leads.

Rapid Start’s LimitationsIt is important to note that Rapid Start was devel-oped as a system for assigning and tracking leads,and was not designed to function as a comprehen-sive case management system. Consequently, itwas unable to meet the demands of the snipercase. The complexity and scope of the investiga-tion generated so many tips and leads that dataentry operators were overwhelmed by the amountof information involved. Indeed, in the centralVirginia JOC, license plate information was col-lected at roadblock checkpoints with the intentionof it being entered into Rapid Start, but the pace ofthe investigation and the amount of informationcollected kept it from ever being entered.

In addition, because Rapid Start is a lead-trackingsystem, it has no basic analytic capabilities. It cannotidentify and analyze possible patterns of suspectactivity. Some investigators said that an over-relianceon Rapid Start caused the case managers to focus toomuch on individual leads, at the expense of investiga-tive perspective and sophisticated analyses.

Other agencies have had similar experiences withRapid Start’s limitations. In the Baton Rouge seri-al murder investigation, law enforcement agenciesoverloaded Rapid Start with too much informa-tion and rendered it unable to provide meaningfulanalyses. Consequently, the Baton Rouge task forcecreated its own database using a Structured QueryLanguage (SQL) server with a search capability.

“Information systems do not solve murders, investigators do.”

Captain A.J. McAndrew, Maryland State Police

In fairness, however, law enforcement’s expecta-tions for Rapid Start frequently exceed its intend-ed capabilities. Its protocols are as much for evi-dentiary and prosecutorial needs as for analyzinginformation to create credible leads for investiga-tive follow-up. It is a stand-alone system designedto be used in one site, and is not capable of man-aging information for major investigations inmultiple sites. Its software is not compatible foruse with modems or networks.

But, Rapid Start can be left with a local agency forcontinued use for case follow-up and prosecutori-al assistance. Another advantage is that a greatnumber of leads can be entered into the system.

The FBI recognizes Rapid Start’s limitations and isdeveloping a new generation of lead-tracking sys-tems. ICON Plus, which will replace Rapid Start, isbuilt on an Oracle database. It is a paperless system,


32 The FBI holds regional training seminars with coordinatorsfrom law enforcement agencies who could then train others.Two training programs are available at this writing: a two-to-three hour overview and a full weeklong program.

80828_i-200.R7 10/8/04 12:07 AM Page 66

eliminating the need for handwritten informationcontrol forms. ICON Plus will be able to operatewith connectivity to a main server, and will have asearch capability from remote locations.

Building a Better Case Management SystemRapid Start, ICON or any system not routinely usedin the day-to-day operations of an agency will createproblems when people try to use it for the first time.Lack of experience with a system makes people reti-cent about trying it, especially during a high-profileinvestigation. It is unrealistic to expect personnel tolearn a new system in the middle of a crisis.Ultimately, agencies must try to make their casemanagement systems more robust, so they can han-dle the demands of a complex investigation.

The effectiveness of law enforcement task forceinvestigations will be enhanced by a case manage-ment system that

• serves as the electronic repository for all tips,leads and other information related to a caseincluding, for example, the capability to storeand analyze 100,000 telephone tips;

• achieves portability;• remains compatible with systems in other

agencies;• has a web-based system accessible to

authorized agencies;• feeds multiple information systems based on

one-time data entry;• performs sophisticated data analysis, such as

cross-checking and soundexing; and• provides action tasks for investigators to

consider.

E N H A N C I N G I N F O R M AT I O NM A N A G E M E N T A N D I N T E L L I G E N C EA N A LY S I SThe Maryland State Police created and staffed anintelligence center for the sniper investigation.Using State Police resources, as well as those fromthe Washington/Baltimore High Intensity DrugTrafficking Area (HIDTA), the State Police wereable to mobilize an array of intelligence and analy-sis resources that eventually used more than 140different databases.

When the sniper investigation began, theWashington/Baltimore HIDTA was in the processof completing or installing a new case manage-ment/crime analysis software package called CaseExplorer. Full presentation and implementation ofthe software was not scheduled to occur for two tothree more weeks, but the crisis engendered by thesniper shootings prompted its immediate rollout.Word of the capabilities of Case Explorer hadalready spread throughout the local law enforce-ment intelligence community, so some of the man-agers on the Task Force Intelligence Committee33

were marginally aware of its usefulness.

“There are no perfect machines to do this analysis; it still comes

down to people.” Chief Charles Moose,


Case Explorer is a case management applicationdeveloped for law enforcement and other publicsafety organizations. It provides basic case man-agement features, information sharing functional-ities and analysis capabilities—allowing multiplegroups to manage case data within a shared data-base. The software enables analysts to conduct linkanalysis and create a variety of charts and maps.The general consensus of the IntelligenceCommittee was that Rapid Start was likely moreuseful as a telephone tip database managementtool but not as a viable case management applica-tion. They looked to Case Explorer to manage themassive amount of information coming inthrough tips and investigative processes.

ImplementationThe task force intelligence component formed theAnalytic Center. The intelligence center initiallywas housed in the Montgomery County Police


33 A number of committees were created as part of the taskforce to manage specific aspects of the investigation, such aspublic information and intelligence. The Task ForceIntelligence Committee was composed of intelligence ana-lysts and investigators from law enforcement agencies in theregion.

80828_i-200.R7 10/8/04 12:07 AM Page 67

Training Academy, an off-site location from theJOC. The training academy provided sufficientworkspace for the analysts as well as networkedcomputers. State police managers assumed respon-sibility for the staffing, daily management and over-sight of the Analytic Center. (The Analytic Centerwas ultimately relocated to the JOC.)

HIDTA program managers prepared an intensivebut brief training session for all analysts and datainput personnel, and remained onsite to resolveany operational difficulties with the software forthe duration of the investigation. By Wednesday,October 9 (Day 8), the system was ready to receivesniper investigative data. (Agencies interested ininstalling Case Explorer prior to an incident wouldhave to allow HIDTA access to criminal suspectinformation.)

Analytic Center Work Process• Data Input. Data were entered into the Case

Explorer system based on information gath-ered from the first series of shootings, result-ing investigations and telephone tips.

• Hit Identification and Review. Software gen-erated numerous matches based on searchcriteria, and analysts reviewed those matches.

• Investigative File Development. Valid hitswent to a “Work-Up Group” of analysts whoprepared all necessary background informa-tion for an investigator’s file.

• Investigative File Review and Assignment.The Analytic Center supervisor reviewed theinvestigator’s file, and assigned it for analyticfollow-up.

• Database Integration. As the system beganworking, the Analytic Center imported datafrom a variety of information systems, (e.g.,state criminal information databases, motorvehicle departments, and courts). An intelli-gence manager contacted the respectiveinformation system manager, identified thedata needed and the format, and providedinstructions for securely sending the data to

the intelligence center. Data updates into CaseExplorer occurred several times daily throughonline data transfers or on CDs that weredelivered to the Analytic Center.

• Investigative Hits. As investigative parametersexpanded, the number of hits quicklyapproached several hundred thousand, andeffectively overwhelmed the investigativecapacity of the task force. Consequently, theAnalytic Center modified its definition of avalid hit as a circumstance in which individu-als, places or things would arise out of theconvergence of two or more data elements.For example, a person owning a white van,living in the area of the shootings, and regis-tered as the owner of a .223 rifle constituted avalid hit. Simply being an owner of a whitevan would no longer place the person into aninvestigative file.

Coordinating Intelligence and InvestigationsIntegrating the analytic and investigative functionswere complicated by the distance separating themand lack of face-to-face communication. While thepolice training academy enabled the quick estab-lishment of the Analytic Center, the off-site loca-tion created communication problems betweenthe analytic, investigative and operational com-mand components of the task force. The commu-nication of real-time information to the JOCoccurred through the standard reporting process-es (several daily meetings at the supervisory lev-els). As a result, many investigators did not evenknow the Analytic Center existed—they would gettheir files, conduct follow-up investigations andthen return their findings to supervisors. Feedbackfrom the investigators to the intelligence analystsdid not exist on a file-by-file basis. Analysts main-tained several open files because they rarely heardback from investigators.

Recognizing these limitations, the intelligence com-ponent secured the space for the Analytic Centerinside the JOC. Computer equipment set-up andnetwork integration occurred during the transitionfrom the Academy to the JOC, allowing the analyticcomponent to operate without interruption.


80828_i-200.R7 10/8/04 12:07 AM Page 68

Once located in the JOC, analysts noted an imme-diate and vastly improved flow of informationbetween investigators and operational commandstaffs. The analysts felt they were more “in theloop.” Feedback from investigators became moreconsistent, as investigators made a point of brief-ing analysts on their findings. Often, commentsfrom investigators prompted the analysts to view alead from a different perspective, generating abroader range of hits and supplemental follow-up.Investigative files generated by the hits from CaseExplorer were now regularly closed once investiga-tors reported back, both formally and informally.

Case Explorer and other systems were also dis-cussed in the investigative focus group convenedby project staff in July 2003. There it was learnedthat law enforcement agencies in the UnitedKingdom have grappled with how to coordinatethe array of information needed in an effectivehigh-profile investigation. The U.K.’s current sys-tem, called Home Office Large Major EnquirySystem (HOLMES), incorporates elements of casemanagement, information analysis, and intelli-gence-investigative coordination that could beinstructive for those studying systems in theUnited States.


Prior to 1986, crucial information on major crime investiga-tions was stored in a manual index card system, usually by asenior investigating officer from Scotland Yard. With loads ofinformation slowly accumulating on investigators’ desks, lawenforcement in the United Kingdom sought a computerizedversion of the index card system. The result was HOLMES, asystem developed as both an investigative tool and an infor-mation management system.

In the 1970s, the United Kingdom began seeing more serialoffenders, most notably, the Black Panther and the YorkshireRipper. Before HOLMES had been implemented, the Ripper’sname (Sutcliffe) had surfaced several times in the card sys-tem, but due to the lack of searching facilities, his name wasnot brought to the forefront of the investigation until muchlater. By 1986, all 56 police forces in the United Kingdom usedHOLMES, a computerized system used for the investigation ofmajor offenses such as murder, rape, kidnapping and terror-ist attacks. HOLMES increased the ability of investigators tostore, identify and share data. The need for more efficientinteroperability and compatibility required the design andconstruction of a new system.

Though the original HOLMES system provided effective adminis-trative support for investigating major crimes, the expansion oftechnology revealed some weaknesses, especially with investiga-tion support and linking separate incidents. In 1994, the PoliceService introduced a plan to replace the existing HOLMES with anew system. This new system became known as HOLMES 2.

Currently operational in all of the United Kingdom’s police forcesand contracted through the information technology companyUnisys, HOLMES 2 provides one system for both major investiga-tions and major disasters as well as a unified system for use byall police departments throughout the United Kingdom. HOLMES2 has the ability to link systems together within different policeforces in a real-time secure environment; this assists in inves-tigations that cross county boundaries and allows the provisionof mutual aid to a force in a major disaster situation.

HOLMES 2 offers greater capabilities than the original, usingboth an Incident Room for major investigations (similar to theJOC) and a Casualty Bureau for major disasters. In a majorinvestigation, the main function of HOLMES 2 is to recordinformation from various sources, provide research facilities,manage information and resources and provide a paper flowsystem for documents to ensure that no document or piece ofinformation is overlooked in an investigation.

HOLMES 2 facilitates the ability to manage both documentsand actions when conducting an investigation. It also pro-

HOLMES: Home Office Large Major Enquiry SystemThe United Kingdom’s Law Enforcement Data Infusion Structure34

34 The information on HOLMES was compiled by AlexHayes based on information from the Unisys-HOLMESwebsite and materials provided by DetectiveSuperintendent Mark Warwick of the Thames ValleyPolice in the United Kingdom. At the time of this writing,more information on HOLMES could be found atwww.holmes2.com.

continued on page 70

80828_i-200.R7 10/8/04 12:07 AM Page 69

A C C E S S I N G C R I M I N A L I N F O R M AT I O ND AT A B A S E SIn the sniper case, it was not difficult to see the con-nection among the 13 shootings. Since the methodwas so unusual, and because four shootings tookplace within 90 minutes on Day 2, the crimes imme-diately attracted the attention of law enforcementand the media. The connection was ultimately estab-lished and confirmed through ATF ballistics analyses.

How would law enforcement establish connectionsamong murders that were not so high profile, orwere more geographically dispersed? It is likely thata connection might not have ever been made, or itwould have been made by happenstance rather than

by any systematic analysis. For instance, law enforce-ment officials might see a story on television news orin a newspaper, investigators might compare notesin informal conversations or monthly meetings ofinvestigators from nearby departments, or crimeanalysts might make a link if they are sharing agencydatabases. However, an investigator or analyst mightalso never be able to make the link because there isno single national information system for homi-cides, shootings or ballistics.

Law enforcement agencies in the United States useseveral different databases, such as the ViolentCriminal Apprehension Program (VICAP),Automated Fingerprint Identification System


vides a Windows-based environment, which is used by every-body working in an Incident Room to perform particular rolesincluding queuing systems for documents as well as foractions—making certain each task is accomplished beforeanother can begin. Conveniently, all documents and actionsform a Free Text Database, which is searchable across theboard for all those with access. HOLMES 2 provides complexsearching tools such as a provision to enable automatic noti-fication when particular information is entered into any of theeight structured indexes.

The first index involves nominal searches, a record of eachname that has surfaced throughout the course of the investi-gation. The second search is by location, in which investiga-tors can search by address or other type of locale includingrivers and motorways. Searches on vehicles can be made,including different types with unique registrations like cara-vans or helicopters. Telephone searches may also be conduct-ed including fax, mobile and pager numbers. Searches can bemade by organizations or businesses that may be underinvestigation for fraud. Another search index is by sequence ofevents, allowing investigators to access data pinpointed froma specific increment of time. Additional searches includethose by category, a general search with the ability to groupinformation not suitable for other indexes, as well as byexhibits, a database recording all of the evidence seizedthroughout the course of the investigation. All of the aboveindexes (except for sequence of events) have unlimited cross-referencing abilities, including all documents and actions.

This provides possible links between individuals, phone num-bers, addresses, whereabouts and other elements.

A number of unresolved murders (or cold cases) entered onthe original HOLMES system have been transferred to HOLMES2 and continue to be investigated and are now able to beprosecuted. The Casualty Bureau has also successfully usedHOLMES 2 to provide the Metropolitan Police Service on behalfof the Foreign Commonwealth Office information for identify-ing British citizens involved in the terrorist attack ofSeptember 11. The pilot testing of remote access is currentlyattempting to enable police officers to enter informationdirectly into a hand-held device from remote locations, whichcan be automatically transferred to the main system.

The introduction of the original HOLMES system to agencies inthe United Kingdom greatly assisted police officers in prevent-ing, investigating and responding to crimes. And with everypolice organization now equipped with the improved HOLMES 2system, law enforcement’s ability to investigate crime and com-bat terrorism remains on the forefront of technologicaladvances. Much like the systems created in the United Statessuch as Rapid Start and Case Explorer, the HOLMES 2 systemcan also be an effective case management tool. Its ultimateeffectiveness, however, is reached when implemented national-ly. While local police departments can use it to catalogue andinvestigate common offenses within their jurisdiction, its query-ing capacities work best when conducting multijurisdictionalinvestigations or responding to a major disaster.

HOLMES continued from page 69

80828_i-200.R7 10/8/04 12:07 AM Page 70

(AFIS), Combined DNA Index System (CODIS)and National Integrated Ballistics IdentificationNetwork (NIBIN), to query about serious crimesand suspects. Each of them, however, provides onlya partial picture of criminal and suspect activity.VICAP, however, offers perhaps the greatest poten-tial for providing law enforcement with a nationaldatabase on homicides and other crimes of violence.

Violent Criminal Apprehension Program (VICAP)VICAP is a nationwide data information systemdesigned to collect, collate and analyze crimes ofviolence—specifically murder. The VICAP missionis to facilitate cooperation, communication andcoordination among law enforcement agencies andsupport their efforts to investigate, identify, track,apprehend and prosecute violent serial offenders.

The FBI administers the stand-alone system,which is dependent on local agencies providingcase information. Participation in the system isfree, and the FBI provides the necessary softwareto local agencies. The time required to enter caseinformation takes between 20 and 60 minutes percase, depending on the complexity of the case.

Along with being an information-sharing tool forinvestigators, VICAP is a resource for FBI profilerswhen making court-accepted behavioral linkagesbetween cases for prosecutors and local investigators.

VICAP has received mixed reviews from local andstate officials. One of the challenges with usingVICAP is that the reporting forms are different fromthose used in local agencies, which forces investiga-tors to complete an additional set of reports.Another criticism is that local and state agenciescannot query the national database directly, but haveto submit their query to the FBI, which does it forthem. An additional concern is the lag time betweenwhen crimes are committed and when informationis entered into VICAP, which has no established timerequirements for entering case information.

Making VICAP More EffectiveIt is important to recognize that while theMontgomery County task force and this reportfocused on the incidents that occurred on and

after October 2, 2002, the snipers were involved ina series of similar crimes across the country priorto this date. Links to these other cases were madeonly after the shootings in the D.C. area becamenationally known, highlighting the importance ofrapid entry of time-sensitive criminal informationinto VICAP—information that is critical to identi-fying similar patterns, trends and evidence. VICAPhas the capacity to serve as an early warningsystem to spot commonalities and stop futurecriminal acts.

In 2005, VICAP is expected to exist as a web-basedsystem on Law Enforcement On-Line (LEO),allowing local investigators to not just enter caseinformation but to search the system. Eventually,VICAP will have the capabilities to gather and dis-seminate sexual assault case information as well.

For VICAP to succeed, local and state law enforcementagencies will need to significantly increase their partic-ipation in VICAP by making it a priority, traininginvestigators in its use and ensuring that case informa-tion is entered in a timely manner. Officials inter-viewed for this project stressed that VICAP, and allnational database systems, have to be as user-friend-ly as possible if investigators are to employ them.Suggested improvements include the following:

• Build a technology bridge between VICAPand other data systems to reduce multipleentry of the same information

• Allow investigators to enter all caseinformation at one time

• Place the national database terminals oninvestigators’ desks

Those interviewed for the project proposed that toimprove reporting by local and state agencies,VICAP should place staff or fund personnel inlarge local agencies to enter information into thesystem. For example, law enforcement in theUnited Kingdom uses “contact officers” to obtaincase information and enter it into national data-bases. Contact officers are responsible for a certainnumber of departments and work with them tocollect the raw information for the system ratherthan merely waiting for it to arrive.


80828_i-200.R7 10/8/04 12:07 AM Page 71

Several states, including New York and Nevada,have legislated mandatory reporting by all localagencies or have required data entry within 30days of the incident. Other states may be consider-ing mandatory reporting to VICAP, and couldpromote participation in other national databases,such as AFIS, CODIS and NIBIN. Increased fund-ing for these national databases at the federal, stateand local levels would facilitate greater use of thesesystems.

Other Information DatabasesIt should now be obvious that law enforcementneeds a secure network for sharing criminal infor-mation and intelligence. It must be a national sys-tem of interconnected resources that would enableinvestigators to identify linkages between violentcrimes in different jurisdictions and fully leverage

and utilize information sharing. Volumes could bewritten about the myriad systems and theirstrengths and weaknesses. For the purposes of thisreport, only a few examples of well-known effortsfollow to provide the reader with context in whichto assess the relevant recommendations.

Because funding constraints continue to plaguelaw enforcement at the local, state and federal lev-els, care should be taken not to duplicate “new”systems or capabilities when the same capabilitiesalready exist in case management and informationsharing networks. Current systems that can beadapted to meet investigative, intelligence or casemanagement needs should be prioritized, net-worked and leveraged to their fullest potential.


Another tool used is Citizen Law Enforcement Analysis andReporting (CLEAR).35 CLEAR is a dynamic, relational databasethat was custom designed to sift through large amounts of datain order to provide Chicago Police Department (CPD) memberswith the tools they need to fulfill their primary mission: publicsafety. CLEAR was designed with four high-level goals in mind:1) improve the management of the department, 2) reduce crime,3) improve information sharing with the community to build bet-ter relations and 4) integrate information with other criminaljustice agencies to enable unified strategies. The focus was tomake better use of the large amounts of data that are collectedevery day and to be able to transcend geographical and institu-tional barriers to public safety.

The CPD has capitalized on the power of using one relationaldatabase to drive all business processes. This enables offi-cers and management to identify patterns such as burglariesin different neighborhoods by instantly comparing more than100 million data variables. More than 200 federal, state andlocal agencies use CLEAR in their day-to-day operations.

According to the CPD, the following is a brief overview of theinformational capacity of CLEAR:• A criminal history system that tracks more than 3 million

offenders and associates those individuals with more than2 million criminal case files.

• A data warehouse module that includes data on more than 5million arrest records for Chicago and more than 130 subur-ban law enforcement agencies. These agencies share real-time information on 950 arrestees daily, adding more than315,000 arrest records a year to the system. In a two-yearperiod, there were nearly 5 million investigative queries madeby both internal and external users of the system.

• An evidence and recovered property module that tracks allinventories of property seized or collected.

• A mug shot system containing 3.6 million arrest photo-graphs in which officers can query and develop line-upsbased on common features.

• A Contact Card System that adds information on 10,000police interactions per week. Its purpose is to provide anelectronically searchable written record of an investigatorystop that does not result in an arrest, and which may laterserve a useful investigative purpose. By the end of 2004, itis expected that 100 external agencies will be using thissystem to track their investigatory stops.

CLEARThe information that follows was provided by the Chicago Police Department.

35 More information on CLEAR is available on the City ofChicago’s website http://egov.cityofchicago.org and a publication on how information technology is applied on the streets (Pastore 2004).

80828_i-200.R7 10/8/04 12:07 AM Page 72


Several case management and information sharing systemseither exist or are under refinement. For example, the RegionalInformation Sharing System (RISS)36 has been in existencesince 1972, and should not be overlooked as a potentialresource to address multijurisdictional crimes and multijuris-dictional information sharing within a secure communicationenvironment. RISS implemented an automated communica-tion network in the mid-1990s that allows investigators andcrime analysts to submit, share and retrieve informationusing (RISS.net) in a secure but unclassified environment.RISS’s security protocol can either reside with the user, allow-ing that person to log into the secure RISS.net anywhere thereis Internet service, or it can reside in the investigator’s officecomputer. The databases maintained by the RISS centers, andupdated by RISS member agencies, allow entry and audittrail/tracking of who submitted/queried on the item, person oractivity in question. RISS is designed to place people previ-ously unknown to each other in touch with their counterparts,when, either through submission or query, two or more partiesexpress an interest in the same specific element.

There are other information-sharing options that have beenrecently developed that use RISS.net’s communication back-bone for connectivity. (The FBI’s Law Enforcement Online(LEO) has established interconnectivity with RISS.net thatallows member agencies to share law enforcement informa-tion.) One such option within RISS.net allows for such entitiesas community service, public safety (Fire, EMS), publichealth, emergency management and utility personnel, inaddition to the traditional law enforcement community, toshare information among themselves in a secure forumthrough the anti-terrorism information exchange (ATIX) pro-gram. Thus, homeland security officials, mayors, county exec-utives, school superintendents, public health and hospitaldirectors, transportation, hazmat agency executives, and oth-ers can communicate and share information quickly andeffectively in a secure fashion. The National CriminalIntelligence Sharing Plan recommends that the RISS and LEOsystems serve as the initial sensitive but unclassified securecommunications backbone for implementation of a nation-wide criminal intelligence sharing capability. It containsmodel policies and standards for leveraging existing infra-structures for sharing criminal intelligence across all levels ofgovernment. The Plan provides

• processes and mechanisms to promote intelligence-ledpolicing,

• models for law enforcement intelligence systems, • policies for protecting privacy and civil rights, • a secure technology architecture for sharing intelligence,• a national model for intelligence training,• an outreach plan for promoting timely and credible

intelligence sharing, and • a plan for leveraging existing intelligence systems and

networks.37

Another tool that was recently added as a resource on RISS.netis the Factual Analysis Criminal Threat Solution (FACTS), whichwas created as part of the Multistate Anti-TerrorismInformation Exchange (MATRIX) project. This tool facilitatesthe integration and exchange of information within the partic-ipating states, including criminal history, driver’s license dataand digitized driver’s license photographs, vehicle registrationrecords and incarceration/corrections records, with significantamounts of public data record entries. FACTS allows lawenforcement to process large volumes of information in min-utes that would take hours if done manually.

Other examples of tools that greatly aid law enforcement insolving major cases include CriMNet, which is an enterprisearchitecture that puts in place a statewide framework of peo-ple, processes, data, standards and technology focused onproviding accurate and comprehensive data to the criminaljustice community in the State of Minnesota. Pennsylvania’sJustice Network (JNET) is another example of a collaborativeeffort among municipal, county, state, bordering states andfederal justice agencies to build a secure integrated system toallow for justice information sharing by authorized users.These and other systems of this type that exist throughout thecountry should be evaluated for their possible application tolarge-scale incidents like the sniper case.38

Examples of National Criminal DatabasesThe information that follows was provided by the U.S. Justice Department Office of Justice Programs,

Bureau of Justice Assistance.

36 Additional information regarding the Regional InformationSharing System (RISS) is available at http://www.iir.com/riss/.

37 More information regarding the National CriminalIntelligence Sharing Plan is available at http://www.it.ojp.gov.

38 More information on CriMNet is available athttp://www.crimnet.state.mn.us/. Additional informationon the Pennsylvania Justice Network is available athttp://www.pajnet.state.pa.us.

80828_i-200.R7 10/8/04 12:07 AM Page 73

C O N C L U S I O NIntegrating multiple information managementsystems into one coherent system was a challengethat was never fully realized in the sniper case.Though the public expects successful resolutionthrough rapid law enforcement analysis and inter-diction, the notion that such an information sys-tem could have been built in three weeks is folly. Acommercial off-the-shelf or custom-built systemthat could have handled the information generat-ed by the multiple jurisdictions involved in thesniper case does not exist today. The challenge forlaw enforcement is to develop and employ casemanagement systems so that crime analysts andlaw enforcement officers have a collection of inter-connected resources at their disposal during rou-tine and high-profile investigations involving mul-tiple jurisdictions. By supporting national policiesthat identify effective management informationsystems and protect privacy rights, law enforce-ment executives can minimize social disruptionduring significant crime incidents. Ultimately,cases will be solved by determined and skillfulinvestigators. To be effective, they must have thetools and support they need.

L E S S O N S L E A R N E DEnsuring Telephone and Radio Communications

• Command centers must use private branchexchange (PBX) phone systems, which pro-vide significant efficiencies in handling phonecalls coming into, as well as within, the callcenter.

• Radio systems should be interoperable andencrypted whenever possible.

Setting Up Tip Lines and Call CenterManagement

• Develop, and when possible, implement aninvestigative and technological infrastructureto support tip lines prior to an incident.

• Before an event, identify a location that willbe used for the telephone tip center that isclose to the command centers.

• Telephone tip call centers require a largenumber of toll-free telephone lines, calleridentification service and the ability to tapeall incoming calls.

• Law enforcement agencies at all levels need todevelop coherent plans for staffing telephonetip lines and training all call-takers.

• Agencies should consider using retired lawenforcement officers to take calls. Agenciesshould screen and train these retired officersas they would all call-takers.

• Law enforcement agencies should also consid-er using private telephone communicationscompanies to establish and staff call centers ifthey lack the necessary personnel.

Using Case Management Systems• Law enforcement needs an automated

information management system to manageleads and information during a significantinvestigation.

• In a task force arrangement, personnel mustbe accountable to a single command-and-control structure.

• Individuals must be familiar with the systemsthey will use during the investigation, andideally should employ the same system as theyuse every day.

• Effective case management systems should

° serve as the electronic repository for alltips, leads and other information;

° be compatible with systems in otheragencies;

° be web-based and accessible to authorizedagencies;

° feed multiple information systems basedon one-time data entry;

° perform sophisticated data analysis, suchas crosschecking and soundexing; and

° provide action tasks for investigators toconsider.

• Agencies must supervise case managementstaff closely and schedule briefings duringshift changes.

• Agencies must continually work to improvequality control and eliminate redundancy oftasks and lapses in analysis.


80828_i-200.R7 10/8/04 12:07 AM Page 74

Enhancing Information Management andIntelligence Analysis

• Locate the intelligence component with theinvestigative and operational command com-ponents of a large task force.

• The case management system can best beused when individuals completely familiarwith the software system are standing by tooffer continual training to investigative staff.

• System support personnel need to be on handso that interruptions in network access areminimal.

• When using several databases, their dailyupdates and the information from tips andother investigative efforts will require a serverof sufficient size, speed and capacity.

• The Case Explorer software is free andavailable to local law enforcement agenciesthrough partnerships with HIDTAs.

• American law enforcement should study pro-grams such as HOLMES 2 and determine theextent to which it can be applied or adaptedfor use in the United States.

• VICAP has the potential to provide lawenforcement agencies with a comprehensivenational database on violent crimes andoffenders, provided that local and state agen-cies enter their violent crime information intothe system in a timely fashion.

Accessing Criminal Information Databases• Law enforcement needs a secure network for

sharing criminal information and intelligence.It must be a national system of databases oncrimes and suspects that would enable investi-gators to identify linkages between violentcrimes in different jurisdictions.


80828_i-200.R7 10/8/04 12:07 AM Page 75

76

80828_i-200.R7 10/8/04 12:07 AM Page 76

C H A P T E R S I X ■ Local Law Enforcement Operations ■ 77


High-profile investigations draw on morethan just investigative resources; theyseemingly tax all available law enforce-

ment agency resources. From the outset of thesniper case, agencies drew upon every reserve toprevent another incident and apprehend theshooters. With so much of the law enforcementresponse focused on investigative tactics to identi-fy and apprehend the offenders, agencies can over-look the need to bolster other essential assets.

This chapter focuses on the many law enforcementunits and functions in local and state agencies thatprovided the “other” law enforcement servicesessential to an effective investigation. This is notan exhaustive discussion of all contributing agencyfunctions; rather, it is a more focused examinationof those functions that played significant roles inthe sniper case, and would likely be employed byagencies facing similar circumstances. These sig-nificant agency functions include the following:

• Patrol• Traffic• Evidence and forensics• Tactical response • Aviation• Administration

In the sniper case these law enforcement functionsfilled critical and visible roles during emergencyresponses to the shootings, crime-scene investiga-tions and roadblocks. As the case consumed weeks

and extended into multiple jurisdictions, officialsencountered such challenging questions as the fol-lowing about how to most effectively use theseresources:

• What should administrators do to make fulluse of patrol resources and expertise?

• How can administrators keep patrol officersinformed of developments when so littleinformation exists?

• How can an agency strike a balance betweendevoting resources to a high-profile investiga-tion while still meeting the community’sother law enforcement needs?

• If uniformed officers are conspicuous snipertargets, how can agencies minimize theirvulnerability?

• Do organizations need to temporarilyreorganize?

• Do work schedules need to be modified?• What tactics can agencies employ to

apprehend the shooters before or right after a shooting?

P AT R O LBecause the patrol force is each agency’s most vis-ible representative, it will often develop thestrongest connections to the community. During ahigh-profile case, those connections can be used todevelop solid leads by working with residents.With the right information, and using the correcttactics, patrol officers can affect the behavior of aperpetrator. Keeping patrol officers informed ofcase developments and intelligence is the key tokeeping them engaged in the investigation. Law

C H A P T E R S I X

Local Law Enforcement Operations

80828_i-200.R7 10/8/04 12:07 AM Page 77

enforcement agencies involved in the sniper casefaced five specific challenges in managing thepatrol function:

• Keeping patrol officers informed of casedevelopments

• Keeping patrol officers involved in the investi-gation

• Using patrol units to suppress or redirectsniper activities

• Providing routine police services to the com-munity

• Ensuring officer safety

Keeping Patrol Officers Informed of CaseDevelopmentTo help patrol officers stay informed about theinvestigation, agencies tried to brief them on casedevelopments and provide them with intelligenceabout suspects. One way this was accomplishedwas through regular briefings of patrol officers.The Prince William County Police Departmentinstituted daily briefings for all patrol shifts thatincluded the latest case developments, “be-on-the-lookouts” (BOLOs), and possible suspect informa-tion (see Appendix G for written briefings used bylocal agencies). The Montgomery County PoliceDepartment used its web board, rather than policeradios, to update officers on developments.Arlington County Police Department supervisorswrote case developments on a white board nearthe roll-call room, and augmented that by keepingstationhouse televisions tuned to the all-news net-work.

“Don’t lose your patrol team.” Lieutenant Bill Tower, Maryland State Police

However, in many agencies, patrol supervisors andofficers were troubled by what they saw as a lack ofmeaningful briefings during shift changes. Manyofficers felt communication between commandstaff and patrol was insufficient. Part of this prob-lem might have been a function of the general lackof information that existed in this case, but itmight also be due to the briefing procedures as

well. An agency has to determine whether to passalong incomplete or uncertain information or waitfor more substantive information. Some managerssaid that even imperfect information is better thanno information, if for no other reason than that ithelps to keep patrol officers involved in the inves-tigation. Other managers were adamant thatincomplete, inaccurate or uncertain informationshould never be disseminated.

Agencies also have to consider who is briefing offi-cers, and what they say. Officers interviewed forthis project alluded to the importance of “trustingthe messenger.” Although officers appreciatedwhen their regular supervisors provided briefings,they felt more connected to the investigation whena commander or someone from the JOC took thetime to provide them with meaningful informa-tion, and not just say “no comment,” which offi-cers reported happened in a few agencies.

Keeping Patrol Officers Involved in theInvestigationPatrol officers can make a valuable contribution tothe investigation by collecting street-level infor-mation and developing intelligence. When gather-ing information from residents through door-to-door inquiries, for example, patrol officers can bemore effective if provided specific interview ques-tions tailored to different communities (e.g., auniversity or business district). Often, suspects inhigh-profile cases appear to be ordinary, blend inand remain unnoticed by most people. However,specially tailored interview questions, developedwith the assistance of law enforcement behavioralscientists, can prompt residents to rememberimportant details.

Similarly, agencies need to ensure that proceduresexist, such as a field interview card system, to col-lect information that patrol officers glean frominterviews. Perhaps most important, agencies needto provide feedback to patrol officers about infor-mation they submit. Officers in several agenciescomplained that they never knew what happenedto information after it was submitted. Further,some officers said that after submitting a solidlead, they were denied feedback on the lead

78 ■ Local Law Enforcement Operations ■ C H A P T E R S I X

80828_i-200.R7 10/8/04 12:07 AM Page 78

because the agency wanted to guard against medialeaks (see Chapter Seven for a discussion of mediaissues).

Using Patrol Units to Suppress Sniper Activities A patrol force can play a crucial role in influencingsuspect activity and dealing with public panic andfear (see Chapter Eight for a discussion of com-munity outreach efforts). Agencies used some ofthe following strategies to disrupt the sniper sus-pects and to demonstrate a presence that wouldease community fear:

• High Visibility. In Washington, D.C., theMPD stationed cars with activated emergencylights on major thoroughfares at the District-Montgomery County border. The FairfaxCounty Police Department placed markedunits on the highway bridges that connectMontgomery and Fairfax Counties.

• High-Risk Locations. A number of agenciesidentified potential target hot spots and useddirected patrol strategies in those areas.Agencies assigned extra patrols in wide-opencommercial retail areas similar to those wherethe shooters most frequently struck. Manyagencies stationed officers in front ofschools—the Maryland State Police per-formed this function in several Marylandcounties.

• Exit Routes. Police agencies in northernVirginia relied on mapping technology toidentify potential escape routes from wide-open commercial areas and placed markedand unmarked cars in these areas.

Providing Routine Police Services to theCommunityA significant challenge for law enforcement execu-tives and managers is that during high-profileinvestigations, communities continue to rely ontheir agencies for routine law enforcement servic-es. Indeed, requests for service or assistance mayincrease due to citizens’ increased vigilanceregarding suspicious persons, and their increasedapprehension. Routine police activity, togetherwith dramatic increases in workload related to theinvestigation, can create a significant burden on

agencies’ ability to meet the public safety needs oftheir communities. Nonetheless, the communityneeds to be reassured and see that law enforcementis handling daily police business.

“The community expects the same serv-ices to be provided, crisis or no crisis.”

Captain T.S. McInteer, Prince William County Police Department

During the sniper case, perhaps the biggest chal-lenge for the patrol force was to balance its routineresponsibilities with the new demands of theinvestigation. The day-to-day calls for service tasksand other duties did not dissipate, although theydid fluctuate. In some agencies, the perception wasthat calls for service went down, while officials inother agencies reported that they went up. Onesupervisor said that nuisance calls went down, butcalls related to the sniper shootings went up. Chart6-1, on the next page, shows the considerablefluctuations in calls for service in three of theaffected jurisdictions—Montgomery, Fairfax andSpotsylvania Counties—for October 2002. Thevertical lines represent the 10 dates on which atleast one shooting occurred. Chart 6-2 illustrates acomparison of calls for service from these countiesin 2000, 2001 and 2002.

In the pressured environment of the high-profileinvestigation, agency leaders can be distractedfrom appreciating the contribution of patrol offi-cers in handling the routine workload. If officersfeel neglected, their performance can suffer signif-icantly. Chiefs and sheriffs need to make time topersonally confer with patrol officers and recog-nize their contributions.

E N S U R I N G O F F I C E R S A F E T YExecutives, commanders and officers were highlycognizant of officer safety issues during this inves-tigation. The suspects threatened police officers inwritten communications and had amply demon-strated their predilection for shooting unsuspect-ing victims from significant distances withoutdetection. Many law enforcement officials believed


80828_i-200.R7 10/8/04 12:07 AM Page 79


CHART 6-2CALLS FOR SERVICE COMPARISON (OCTOBER 2000-2002)

CHART 6-1CALLS FOR SERVICE DURING INCIDENT

80828_i-200.R7 10/8/04 12:07 AM Page 80

it was only a matter of time before the snipers shota uniformed officer.

Fixed-post assignments, in particular, generatedanxiety about officer safety. Officers were told to behighly visible but were also reminded of the need tobe careful. These contradictory messages mademany officers uneasy and seemed to haunt theadministrators and supervisors who gave the orders.

Many agencies assigned patrol officers to fixedposts at schools and shopping centers. InMontgomery County, patrol officers providedperimeter security for police headquarters. Sevenpolice officers filled these posts during the daylightshift, and court security sheriff ’s deputies workedthe posts at night. Montgomery County managersimpressed upon officers the importance of theperimeter security duty, especially since some offi-cers expressed discomfort with the assignmentbecause of a lack of experience performing it. InArlington County, supervisors made frequent vis-its to fixed post assignments, and frequently rotat-ed officers to reduce boredom and maintain alert-ness. In many agencies, supervisors stressed theimportance of fending off inattentiveness andboredom, especially for those officers unfamiliarwith this type of assignment.

“From an officer safety perspective, the dumbest strategy was assigning officers to high visibility posts, such

as in front of the schools. But we had no choice, and the officers gallantly

accepted these assignments.” Chief Charles Moose,


In Prince William County, police commandersrepeatedly emphasized that officers needed to expe-ditiously handle calls in high-risk areas, and mini-mize their visibility as potential targets. With nerveson edge and with law enforcement officers seeming-ly everywhere (often in plain clothes), many agen-cies stressed that officers needed to be vigilant toprevent “friendly fire” incidents. The Prince William

County Police Department made a point of remind-ing officers of the signal used at that time to identifythemselves as police officers when at an incident.The Montgomery County Police Department usedseveral methods. Personnel from other agenciesinvolved in surveillance operations were required toappear at patrol roll calls. This increased the possi-bility that officers would recognize one anothershould their paths cross while on patrol or respond-ing to a call. Plainclothes detectives and undercoverofficers used passwords when on the street: Officerscalled out a name and undercover officers repliedwith a set response. Identifying information was alsoplaced on license plates of undercover cars from out-side agencies. Tactical officers wore black uniforms.

This case was fraught with instances where officersafety could have easily been imperiled. But no onelost sight of how dangerous this situation was, andadministrators, managers and officers made everyattempt to ensure the safety of their fellow officers,whether they were handling calls for service, con-ducting surveillance or setting up traffic roadblocks.

T R A F F I CApproximately 10 days into the investigation, thetask force developed a multijurisdictional roadblockplan that would be used after any shooting thatcould be sniper-related. This plan was to facilitatethe suspects’ capture or to force them to engage infurtive or suspicious behavior that would attract theattention of law enforcement officers and/or mem-bers of the public. The initial plans were developedat a regional meeting of law enforcement leaders andcontinued to evolve during the investigation. Theplans eventually included law enforcement agenciesacross the entire D.C. and central Virginia regions,and were coordinated through state and countyhighway agencies. Multijurisdictional roadblockswere used after the following shootings:

Wednesday, October 9, 2002,approximately 8:18 P.M.Manassas, VirginiaVirginia State Police immediately shut downadjacent Interstate 66. Troopers began stoppingand searching white vans that fit a witness’sdescription. The shooting of Dean Meyers at a


80828_i-200.R7 10/8/04 12:07 AM Page 81

Manassas gas station marked the first of severaluses of an interstate dragnet by law enforcement.

Friday, October 11, 2002,approximately 9:30 A.M.Fredericksburg, VirginiaThis was the first time the task force’s coordinatedmultijurisdictional plan went into effect. VirginiaState Police and many local agencies shut downRoute 1 and every on-ramp onto I-95. Again, offi-cers stopped and searched all white vans fittingwitness descriptions.

Monday, October 14, 2002,approximately 9:15 P.M.Falls Church, VirginiaAnother massive dragnet ensued, this time clos-ing down major surface roads in the immediatevicinity of the shooting as well as the most trav-eled stretch of highway in the D.C. metro area,Interstate 495, known to the region’s residents as“The Beltway.”

Saturday, October 19, 2002,approximately 7:59 P.M.Ashland, VirginiaFederal, state and local law enforcement agenciesdeploy another I-95 dragnet, and still no suspectis apprehended.

Tuesday, October 22, 2002,approximately 5:56 A.M.Silver Spring, Maryland For the fifth time, major surface roads and high-ways were closed. The plan for the multijurisdic-tional roadblock was the most sophisticated oneyet, based on a series of concentric circles andtime intervals for blockading key intersections.Yet, without knowing what vehicle to look for, thedragnet yielded no suspect. Just a few days afterthe arrests of Malvo and Muhammad, a UPSdriver called the MCPD to report that he satbehind the suspects’ car during the October 22roadblocks. He was certain about his recollection,because the suspects’ tag number included the let-ters NDA, which is used as a disposition code byUPS drivers.

Agencies need to carefully consider the purpose ofroadblocks, the information needed for them to beeffective, how to stop traffic and how to get it mov-ing. Roadblocks have the potential to be effectivewhen coordinated across regions and states, andwhen coordinated with public highway and trans-portation agencies. A software package(RoadBLOCK39) was used to help determinewhich roads to close and where to establish check-points. For instance, checkpoints were establishedat 3, 5, 7 or 10 miles from the incident dependingon the time elapsed from the initial call and theexpected travel times.

“The roadblocks had a notion of valuebut the execution could have been moreeffective with more specific information

about the suspects’ vehicle.” Chief Terrance Gainer, U.S. Capitol Police

While roadblocks do serve the purpose of showingthe public that law enforcement is “doing some-thing,” they should be designed primarily as aneffective law enforcement tool. Regional roadblocksso significantly disrupt traffic that they have to beused judiciously and should be accompanied by apublic education initiative. Although residents weregenerally supportive of the roadblocks, their accept-ance may have waned if the roadblocks had contin-ued without any success for much longer.

The roadblocks were so effective in disruptingtraffic patterns that traffic reports on radio andtelevision stations mentioned them. “Avoid theWilson Bridge right now; the police roadblock hasbrought traffic to a standstill.” After phone callersalerted the stations that this information could betipping off the snipers, details about the road-blocks were omitted from traffic reports. This is anexample of how the sniper case affected the region,but also points to the need for agencies in futurehigh-profile investigations to alert the media


39 At this writing, RoadBLOCK has been replaced by emaps andinformation on the system can be obtained by calling (410)295-3333 or at www.digitalcorp.com/emaps.htm.

80828_i-200.R7 10/8/04 12:07 AM Page 82

about appropriate coverage of police operations(see Chapter Seven for an extensive discussion onlaw enforcement and media relations).

“I wasn’t sure what the roadblockswould accomplish. They were never really successful, but we couldn’t

afford not to use them.” Sheriff Stuart Cook, Hanover County Sheriff’s Office

Roadblocks can be an effective tool for freezingaction immediately after an incident. But once theaction is frozen, agencies have to have a plan forwhat they intend to accomplish. If the intent is touse roadblocks to gather license and vehicle infor-mation, then the necessary systems must be in placeto collect and analyze the data. In central Virginia,officers collected so much vehicle and tag informa-tion at roadblocks that it could not all be enteredinto Rapid Start. Most of this information sat inboxes, never entered into the database.40 After thecase broke, the information was scanned and placedon CD-roms and provided valuable evidence.

“The roadblock plan was implementedwith the best of intentions. In hindsight,

however, it wasn’t successful because wedidn’t know what we were looking for.”

Chief Frederic Pleasants, Jr., Ashland Police Department

The idea of establishing roadblocks to contain andinspect traffic appears to be a relatively simpleconcept. But, as demonstrated in this investiga-tion, establishing roadblocks for investigative pur-poses can be complex for any one agency to carryout. When multiple agencies attempt to developcoordinated roadblock plans, the task becomesincredibly complex, and requires extensive fore-sight and planning.

E V I D E N C E A N D F O R E N S I C SIn a complex, multi-scene case, collecting and ana-lyzing evidence is critically important to identify-

ing and eventually prosecuting suspects (ChapterFour includes a discussion about managing crimescenes). In the sniper case, a variety of law enforce-ment personnel processed the crime scenes,although local agencies had primary responsibilityfor much of the collection and identification (bag-ging and tagging). As mentioned in Chapter Four,this evidence then was transferred to the appropri-ate federal agency based on their expertise:

• ATF processed and analyzed ballistics andfirearms.

• The FBI processed and analyzed DNA; hairsand fibers; trace evidence; fingerprints; audioand video enhancements; as well as conductedcomputer forensics examinations and finan-cial forensic analysis.

• The Secret Service processed and analyzedhandwriting, paper and ink.

Federal agencies may use different approaches tomanaging crime scenes and collecting evidence,and they have very different capabilities in theirlaboratories. All agencies involved in crime-sceneand forensic functions should know and appreci-ate these differences and incorporate them intopolicies for crime-scene management. Many statepolice agencies have very sophisticated laborato-ries as well, and can provide significant assistanceduring a high-profile investigation.

External forensic expertise (whether federal, stateor local) should be brought into an investigationas soon as possible. The lack of a forensic expert atthe beginning of an investigation could causeimportant evidence to be overlooked or not col-lected, or analyzed, shared or stored inappropri-ately. DNA evidence, for instance, can be compro-mised by other forensic processes.

Local, state and federal agencies need to developevidence response and collection protocols formulti-agency operations. The protocols should


40 In the United Kingdom, agencies are using the AutomaticNumber Recognition System that captures and identifies taginformation from in-car video cameras, freeing officers fromhaving to write down tag numbers.

80828_i-200.R7 10/8/04 12:07 AM Page 83

specify who might enter crime scenes, who cancollect evidence, the types of evidence they cancollect, procedures for analysis and more.Protocols should also address specialized evidencesearch techniques, such as which type of canine(e.g., one trained in explosives/ballistics or search-ing for human scents) should search a scene first,based on the type of evidence sought and rules forscene preservation.

The protocols should include steps that enhanceconsistency in collecting and analyzing evidenceand maintaining the chain of custody. As withmany of the recommendations for coordinatedoperations, evidence and forensic protocolsshould be developed before a multi-agency inves-tigation. Once developed, the protocols must bedistributed to every agency that might be involvedin handling a crime scene.

T A C T I C A L R E S P O N S E Tactical officers in all agencies performed criticalservices during the sniper investigation, including

• providing surveillance at potential shootingsites identified through mapping analysis;

• conducting traffic roadblocks;• providing protective services at press confer-

ences and other high-profile scenes;• placing response teams at heliports for expe-

ditious response to a shooting scene; and• identifying potential sniper sites and then

providing guidance on how to deal with thosesites, including establishing counter-sniperoperations.

In Montgomery County, a combined tactical opera-tion was established very early on Day 2. Relying onexisting relationships among commanders in theMontgomery County Police Department, theMaryland State Police and the FBI’s Hostage RescueTeam, MCPD established a tactical command postat its training academy. The mission of the tacticaloperation in Montgomery County was to protectresidents and first responders, and stop the shootersby apprehension or intervention. This was a careful-ly coordinated operation that relied on a separatecommand post, chain of command, briefing sched-

ule and radio communications. To some extent theyoperated independently of other law enforcementoperations, and while this worked well because ofindividual tactical commanders and their familiari-ty with each other, this arrangement could haveunintended consequences in other investigations.

During Day 2, tactical operations in MontgomeryCounty focused on assessing the overall threatlevel and likely targets. A significant part of thiseffort entailed determining what had happened atthe different shooting scenes. To that end, twotrained law enforcement snipers responded to thescenes and assessed each shooting, gauging factorssuch as the shooter’s possible location, the projec-tile trajectory and distance traveled, and the vic-tim’s wounds. Aerial photographs were taken ofeach scene, and tactical commanders visited thescenes as well.

“The goal of the tactical teams was to be over-prepared.”

Captain Drew Tracy, Montgomery County Police Department

From this assessment, law enforcement operationstried to counter the threat by assigning patrol andundercover officers to likely shooting locations,such as gas stations and shopping centers adjacentto major roadways. Tactical officers engaged inproactive patrols at these locations, identifyingand questioning individuals behaving suspicious-ly. Tactical teams also responded to loud noise callsfor service and provided back up to patrol unitsresponding to high-risk calls for service.

To provide adequate coverage throughoutMontgomery County, the tactical operation reliedon the combined resources of the MontgomeryCounty Police Department, Maryland State Policeand FBI to form three-officer cars. The three-offi-cer teams, which always included oneMontgomery County officer, remained intact forthe entire investigation. Also throughout theinvestigation, the tactical command was able toassign between 12 and 18 three-officer cars per


80828_i-200.R7 10/8/04 12:07 AM Page 84

shift, achieving its goal of having a tactical actionteam able to respond to the scene of any addition-al shootings within three minutes.

In Prince William County, the police departmentdrew upon federal and local law enforcementexpertise to develop tactical plans. The shooting inthis county on Day 8 was the latest in a developingpattern of sniper targets near interstate intersec-tions. In response, law enforcement officials devel-oped a tactical response plan to counter the threat.Police and FBI snipers assessed each Interstate (I-95 and I-66) intersection to identify likely sniperstaging areas. Those areas were placed under sur-veillance. ATF agents from around the countryalso augmented resources. Police tactical officersand U.S. Marshals were paired together and oper-ated as response teams in these high-risk areas inthe event of a shooting or suspicious person.

Tactical officers in all jurisdictions were thrown intoa number of unfamiliar situations but handled mostof them successfully. Because tactical officers wereperforming functions different from routine tacticaloperations, supervisors had to emphasize these dif-ferences and coordinate the activities of personnel.Tactical teams also operated with officers from dif-ferent agencies. Some tactical officers operated inunfamiliar communities. As much as possible, localagencies tried to assign tactical officers from outsideagencies with officers from the home agency. Whilethis helped to increase the effectiveness of these tac-tical teams, it also required establishing shared goalsand coordinating tactics and rules of engagementconsistent with the mission.

Tactical units did not have the luxury of pre-inci-dent planning for this investigation. They did, how-ever, engage in extensive planning throughout thethree-week event, and even practiced scenarios con-sistent with different contingencies. For example, atthe Myersville rest area on Day 23, tactical officersfrom the MCPD, Maryland State Police and FBIrehearsed together before extracting and arrestingthe suspects. Whenever possible, they engaged inextensive planning, practiced particular operationsand overcompensated for the time, resources andpersonnel needed for a successful tactical operation.

AviationAs the investigation progressed, law enforcementpersonnel increased their use of helicopters, andso did the media. Media helicopters were used toobserve and photograph or tape roadblocks, crimescenes and police actions. Local, state and federallaw enforcement helicopters were used to trans-port officials, tactical teams and evidence, providea platform for surveillance and allow officials toobserve crime scenes.

In some jurisdictions, especially MontgomeryCounty, helicopters flew “low and loud” overschools and shopping centers in an attempt toreduce fear among residents. Although those whosuggested this strategy believe it was helpful, oth-ers involved in the investigation believe the aggres-sive use of military-style helicopters induced morefear than they alleviated. Yet, at the time of thesniper shootings, this was also a strategy designedto suppress sniper activity.

As the number of helicopters increased, it becamenecessary to establish protocols for air space. Forsome of the crime scenes, local law enforcementworked with their federal counterparts to convincethe Federal Aviation Administration to restrict air-space over the scene. This was easier for somescenes than others. The rest stop where the sniperswere arrested, for example, was in such close prox-imity to the presidential retreat, Camp David, thatone phone call from the Secret Service SACrestricted airspace and kept media helicoptersfrom hovering over the scene.

Local agencies also had to coordinate aviationactivity with ground tactics. On several occasions,helicopters engaged in activities that those on theground, especially at crime scenes, perceived asintrusive, annoying and threatening to the safetyof law enforcement officers. At one crime scene,helicopter spotlights illuminated a wooded areawhere tactical officers were searching for suspects.This had the dual effect of destroying their depthperception as they scanned the woods, and back-lighting them as possible targets. Coordinationbetween aviation units and those on the groundrequires the commitment of all law enforcement


80828_i-200.R7 10/8/04 12:07 AM Page 85

agencies at all levels of government. In fact, sever-al officials suggested that aviation units should notbe allowed over incident scenes unless air-to-ground communications exist. Despite some ofthese problems, law enforcement aviation unitsmade a significant contribution to the investiga-tion, and will fill a vital role in any similar investi-gations in the future.

A D M I N I S T R AT I O NAs mentioned previously, high-profile investigationscan tax all available agency resources, including avariety of administrative and human resource func-tions. Just as investigative and patrol resources per-formed admirably, so too did the individuals thatstaffed these often unseen functions.

The effect of a high-profile investigation can turneven the most routine administrative functioninto a critical responsibility. Budget, procurementand property managers allowed the MontgomeryCounty task force to function effectively by ensur-ing the procurement of the “life lines” such asfood, ballistic vests and cell phones. Budget man-agers had to create line item codes to track allexpenses related to the event. Purchasing man-agers had to expedite emergency orders for foodand equipment. These individuals are easily over-looked, yet without them an operation can grindto a stop.

“A number of unsung heroes madeimportant contributions to the success

of this investigation.” Chief Charles Moose,


Human ResourcesThe dedication of participating law enforcementofficers was evident throughout the sniper case. Inevery agency, officers showed their commitment byworking long, strenuous hours. The challenge formanagement was allowing officers to meet thisneed to contribute while balancing labor contractsand personnel rules, as well as officers’ well-being(see Appendix H for an example of a staffing plan).

In several agencies, officers wanted to work extrahours but also wanted compensation in strictcompliance with a labor contract, which createdproblems for managers trying to keep overtimeexpenditures under control. Managers had to con-sider all these factors when making decisions onthe following staffing issues:

• Some participating agencies went to 12-hourshifts, but others decided to stay with theirexisting schedules.

• Most agencies cancelled or restricted all train-ing and leave.

• Many agencies assigned administrative offi-cers to marked and unmarked cars.

• Some agencies modified court schedules forofficers, including Montgomery County,which assigned one person to work with thecourts to coordinate rescheduling.

• Several agencies received authorization fromgovernment decision makers for unlimitedovertime.

• The Prince William County PoliceDepartment suspended its take-home car pro-gram to ensure an ample reserve of markedcars for those who were working the case.

• A handful of agencies modified their uniformrequirements to improve easy identification ofpersonnel.

The sniper case placed enormous strains on lawenforcement personnel and the administrativepolicies, rules and regulations that guide much oftheir behavior. In a number of instances thoserules and regulations had to be modified to meetan agency’s operational needs. In some circum-stances, those rules were overlooked, such as whenadministrators allowed officers who were workingextended shifts to use department-issued cellphones for personal calls to their families.

Emotional Well-BeingObviously, a high-profile investigation can affectthe emotional and physical health of law enforce-ment personnel, from civilian dispatchers to patrolofficers to police chiefs and sheriffs. Extendedshifts, overtime, irregular eating habits, infrequentexercise and lack of rest are just some of the stres-


80828_i-200.R7 10/8/04 12:07 AM Page 86

sors for which agencies have to prepare (see thediscussion in Chapter Four about the need toschedule breaks and give days off). One of theother stressors in this case was being away fromhome for extended periods. Many of the federalofficers, as well as local officers from out-of-state,were forced to leave their families behind and liveout of hotels for several weeks. This arrangementcreates tension exacerbated by people’s tendencyto work excessive hours when away from home.

“We had to guard against low spirits inthose who were away from home.”


The families of many law enforcement officers weredeeply affected by the events of the sniper case, per-haps even more so than community residents.Family members had to cope with the fear every res-ident felt, as well as the anxiety associated with rela-tives being law enforcement officers. The consider-able amount of required overtime kept officers andagents from their homes over an extended period,and the lack of contact and communication exacer-bated family members’ concerns about both officers’physical and emotional well-being.

Agencies need to consider the effects high-profileor complex cases have on the law enforcementofficers who are working on them. Anxiety amongfamily members can generate even greater anxietyfor officers, who then must work while worryingabout their families’ safety and welfare. Peer sup-port networks for spouses and family memberscan be especially beneficial during critical inci-dents and high-profile investigations. Agenciesshould provide an assistance program or counsel-ing services for officers and their spouses and chil-dren. This can be done through a law enforcementcritical-incident support unit or a contract with anemployee assistance program.

Once the event is over, agencies must not forget torecognize and reward employees for their dedica-tion and accomplishments. Several agencies spokeabout how this should be done in a timely manner

so that the awards are meaningful to those whoworked so hard and with such commitment.

C O N C L U S I O NAgencies will face enormous challenges in findingthe right balance for using personnel withoutoverworking or underutilizing them. The biggestchallenge may lie in keeping patrol forces engagedin the investigation. Certainly, every law enforce-ment administrator knows the tremendousimportance of patrol officers in a case like this, andthey should make a point of frequently remindingpatrol officers of their value. The best tool may beto communicate regularly and provide them withmeaningful information about the investigationand the role of patrol. Other functions, including,but certainly not limited to tactical response, traf-fic, aviation, evidence/forensics, procurement andadministrative positions cannot be overlookedeither. They all provide essential services through-out an investigation.

L E S S O N S L E A R N E DAgencies need a mechanism for providing a dailybriefing to staff. In the absence of official informa-tion, rumors can circulate unchecked. Agenciesmay want to consider assigning an individual toact as an Internal Information Officer.

Patrol• Agencies should routinely keep patrol officers

informed of all pertinent and current infor-mation about the investigation, and may needto rely upon several methods of communica-tion to achieve this.

• Patrol officers should be provided a list of tai-lored questions to ask when talking to resi-dents or conducting field interviews.

• Agencies should strive to provide feedback toofficers on information that they provide toinvestigators, while also monitoring officers’expectations to ensure they know that lack offollow-up is not indicative of the informationreaching a dead end.

• Agencies should consider using uniformedofficers in high-visibility assignments toreduce public fear and panic.


80828_i-200.R7 10/8/04 12:07 AM Page 87

• Patrol officers must continue to provide rou-tine police services in their communitieswhile also addressing the new demands of theinvestigation.

• Supervisors should remain cognizant of offi-cer vulnerability and make frequent visits tofixed post assignments.

• Officers should be rotated frequently toreduce boredom and maintain alertness.

• Officers from different agencies must appearat patrol roll calls to increase the chances ofbeing recognized on a scene and develop offi-cer-recognition codes or signals.

• Officers must be vigilant about the presence ofnumerous law enforcement officers when con-ducting tactical operations in high-risk areas.

Traffic• Roadblocks should be used to achieve a spe-

cific law enforcement purpose (beyond visi-bility), and should be carefully planned andcoordinated across jurisdictional, regional andstate boundaries.

Evidence and Forensics• Evidence response and collection protocols

should be developed that specify who canenter crime scenes, who can collect evidence,the types of evidence that can be collectedand the procedures for analysis.

• Protocols should address specialized evidencesearch techniques.

• Protocols should include steps that enhanceconsistency in collecting and analyzing evi-dence and maintaining chain of custody.

• Local agencies should be aware of the differ-ent expertise that federal and state agencieshave in evidence collection and analysis.

Tactical Response• Tactical teams comprised of officers from dif-

ferent agencies must establish and coordinategoals, strategies and procedures.

• Tactical operations should be closely coordi-nated with patrol and investigative resources.

• Supervisors must coordinate tactical person-nel as they may be performing new or unfa-miliar functions.

Aviation• Agencies should contact the FAA to discuss

plans for restricting airspace in the event ofan incident.

• Aviation responses should be coordinatedwith on-the-ground responses and tactics.

• Agencies with air units should also be in con-tact with news stations before an event todevelop response and air-traffic plans.

Administration• Law enforcement personnel, in conjunction

with external authorizing agencies, shouldcreate budget line-item codes and emergencypurchase orders before an event so they willbe readily available and accessible.

• Agency administrators may need to modifypolicies, procedures, rules and regulationsduring high-profile cases.

• Agency administrators should pre-plan theanticipated costs associated with 12-hour andother alternative shifts.

• Agencies should ensure that counseling serv-ices are available to officers and their familiesduring and after a high-profile investigationto minimize stress and guard against burnout.


80828_i-200.R7 10/8/04 12:07 AM Page 88

C H A P T E R S E V E N ■ Media Relations ■ 89


Law enforcement and media experts alikesay the press coverage of the sniper casewent far beyond that of any other serial

crime. To say merely that the journalists’ attentionwas unprecedented does not reflect the scope orintensity. The media did more than report thisstory. They were intimately involved in the unfold-ing events, influencing the investigation, occasion-ally even creating news.

This chapter outlines law enforcement agencies’public information function in the sniper investi-gation, and identifies lessons learned to guideother agencies that may one day face handling ahigh-profile national media event of this type. Thediscussion in this chapter focuses on what an indi-vidual agency needs to do to prepare for its mediafunction. The advice contained here reflects thecollective experience of the public informationand media specialists whose agencies participatedin the sniper investigation, as gathered throughinterviews and the project’s focus group. Theinformation is provided to assist individual agen-cies, though it can be tailored to the needs of agen-cies in a task force operation. Specifically, thechapter focuses on the following:

• Managing the public information function• Holding press conferences• Releasing public information from a task

force• Addressing media leaks• Planning and preparing for high-profile cases

“From a public information perspective,this was the most difficult case

I’ve ever seen.” Public Information Officer Joe Gentile,

Washington Metropolitan Police Department

This chapter attempts to answer some of the ques-tions that executives and public informationpersonnel faced while interacting with the mediaduring the three-week investigation, including thefollowing:

• Who should be the spokesperson for an indi-vidual agency?

• When and how often do agencies hold a pressconference?

• Who should be the spokesperson for a taskforce?

• How can agencies achieve a balance betweenbeing responsive to the media without beingoverwhelmed by their demands?

• Other than press conferences, how and whendo officials communicate with the media?

• Under what circumstances should agenciesuse the media to communicate with suspects?

• How do officials control and respond tomedia leaks?

The fact that these shootings occurred in and aroundWashington, D.C., contributed to the extensivemedia coverage. As the nation’s capital, the area has asignificant national media presence as well as asophisticated local media that often covers national

C H A P T E R S E V E N

Media Relations

80828_i-200.R7 10/8/04 12:07 AM Page 89

stories as local news. The recent growth in 24-hourcable news programs and talk shows increased thenumber of on-scene reporters and led to a non-stopparade of self-proclaimed experts, “talking heads”and other studio guests willing to discuss the case.These around-the-clock shows blur the traditionaltime frames associated with the news cycle, and fos-ter an atmosphere of intense competition for “break-ing news.” The competition among networks andnewspapers caused many reporters to pursue storiesas they unfolded, relying on technology and leaks togain an edge. This competition can even cause somereporters to embellish or fabricate stories.41

One example of the media frenzy described bypolice agency media specialists during this caseoccurred after the suspects’ arrests in the earlymorning hours on October 24 in rural Maryland.Relying extensively on police scanners, reportersmade their way to the Frederick barracks of theMaryland State Police, which had received the 911call about the suspect vehicle parked at an interstaterest area. When Major Greg Shipley, the MarylandState Police public information officer (PIO),arrived at the barracks, he was astounded by the seaof reporters, cameras and satellite trucks that hadbeat him there. His subsequent announcement ofthe arrest was not a planned press conference, but aforced response to the spontaneous media gather-ing. Indeed, Shipley felt uncomfortable making theannouncement because he believed it should havecome from Montgomery County. However, thethrong’s presence left him little choice, and he wascompelled to phone MCPD PIO Nancy Demme at4:00 A.M. to consult with her about what to do. Itwas not until well after his announcement thatShipley learned how reporters drove through theD.C. area around the clock, monitoring police scan-ners in hopes of being the first on the scene of thelatest breaking news.

B A C K G R O U N DThe press conferences held by the MontgomeryCounty Police Department were the most visibleaccounting of the sniper case. But they were justone product of the public information functionsperformed during the investigation.

“We issued 1,343 press/media passesduring the investigation.”

PIO Captain Nancy Demme, Montgomery County Police Department 42

At the beginning of the investigation, the publicinformation function operated reactively. The ini-tial flurry of shootings and the events of the firstfew days created a frenetic pace that made it diffi-cult for public information staff to anticipate andplan for what would happen next, let alone keepabreast of current developments. To exacerbatematters, MCPD PIO Captain Nancy Demme hadbeen in her position for just three weeks, and hadnot yet had the opportunity to attend any type oftraining or education program related to herresponsibilities and duties.

Nevertheless, the first press conference was held onThursday, October 3 (Day 2) at the Mobil gas stationin Aspen Hill, where the MCPD mobile commandpost was located. Shortly thereafter, the press confer-ences were moved to the front entrance ofMontgomery County Police headquarters, with themedia staged in the parking lot and the four-lane

90 ■ Media Relations ■ C H A P T E R S E V E N

41 Controversial former New York Times reporter JaysonBlair, in an effort to break open a new angle on the sniperinvestigation, wrote in a December 22, 2002 story that theDNA of Lee Malvo had been recovered from a grape stemnear the scene of the Conrad Johnson slaying in Aspen Hill,Maryland. He went on to suggest that, “All of the evidence[investigators] have points to Mr. Malvo as the triggerman.Little if anything indicates Mr. Muhammad fired a shot.”This revelation was met with skepticism on the part ofinvestigators, prosecutors and the media alike, consideringthat Muhammad is a former Army infantryman withmarksmanship training. Blair also threw in four other itemsof evidence (attributed to unnamed “investigators”) impli-cating Malvo as the lone shooter, including surveillancevideotape at a shooting site, Malvo’s admissions to FairfaxCounty detectives, hair found in the trunk of the ChevyCaprice used by the suspects, and fingerprints on a piece ofpaper near one of the shootings. Shortly after the story ran,the lead prosecutor in the Malvo trial, Fairfax CountyCommonwealth Attorney Robert Horan called Blair’s report“dead wrong,” specifically saying that three of the five piecesof evidence cited by Blair were false. Eventually Mr. Blairadmitted he made up this information and was wrong tohave done so.

42 See Appendix I for a photocopy of a press pass.

80828_i-200.R7 10/8/04 12:07 AM Page 90

road that passes in front of the building. Eventually,that road was partially closed to accommodate theever-increasing number of media and to enhancethe perimeter security of headquarters.

Throughout the event, the MCPD continued tooperate its public information office with its full-time civilian and sworn staff, who were augment-ed by public information personnel detailed fromsurrounding agencies. In addition, MCPD, withassistance from public information officers fromthe FBI, ATF, Maryland State Police, the HowardCounty Police Department and others establisheda Joint Information Center (JIC) in its headquar-ters building (a different building than the onewhere the JOC was located) that functioned as theprimary information center for the task force.

M A N A G I N G T H E P U B L I CI N F O R M AT I O N F U N C T I O NSeveral of the executives, as well as every PIOinterviewed, stressed the importance of the publicinformation function (referred to by some agen-cies as media relations) during high-profile inves-tigations. They emphasized that a successful PIOfunction requires as much expertise as, for exam-ple, the ballistics, forensics or information tech-nology functions. Agencies found it helpful to callon specialists to craft and manage media relations.Those specialists were trained sworn personnel orcivilian staff with experience in other public infor-mation settings or as reporters.

“The police don’t like us because theythink we work for the media, and the

media don’t like us because they thinkwe work for the police.”

PIO Major Greg Shipley, Maryland State Police

The PIO function is especially important duringhigh-profile cases because of the crucial role it canplay in balancing executives’ workloads. The PIOaddresses media inquiries and prepares pressreleases, allowing the chief to concentrate on allaspects of the investigation/incident while avoid-ing being consumed by the media requirements.

Executives who try to assume responsibility forworking with the media can find it an all-encom-passing endeavor that prevents them from engag-ing in effective leadership for the rest of theagency. It is easy for pressure from the media toinfluence decision making as well. Prior to a high-profile event, the chief and PIO must develop aplan for managing the media and, to the extentpossible, stick to it throughout the event. This planshould include a delineation of duties and respon-sibilities throughout the investigation and allocateorganizational resources necessary to make theplan a success. The plan must describe how theorganization will address media concerns—whether through press conferences or availabilityat crime scenes, and general guidelines for howmuch information to release without compromis-ing the investigation.

Reporters need information, and departmentshave to recognize they can provide some detailsthat address the public’s right to know, while fram-ing the issues in a constructive way that will notinterfere with an ongoing investigation. Reporters,in all likelihood, will place strong demands on lawenforcement personnel, who may inadvertentlygive them information without the proper vetting.Departments have a responsibility to provideaccurate and timely information. Every attemptmust be made to release correct information at theappropriate time and through the proper publicinformation staff. Releasing erroneous or prema-ture information will damage an agency’s credibil-ity with the media and create additional problemsfor the department as it engages in damage con-trol. The one cardinal rule that all executives andPIOs know is, “never lie to the press”—credibilityand trust are the cornerstones for a successful rela-tionship between the media and the police.

A number of local PIOs, chiefs and sheriffsemphasized that the differences between thenational and local media needs to be addressed.The biggest difference is that when the investiga-tion is over, the national media will leave, but thelocal media will remain. (That difference is proba-bly blurred more in the D.C. area than most othermedia markets.) Because of that distinction, they


80828_i-200.R7 10/8/04 12:07 AM Page 91

cover stories differently, and have different rela-tionships with the law enforcement agencies andcommunity. In central Virginia, the executivesmade less of an effort to grant interviews tonational and D.C. reporters. Rather, in an attemptto reach the Richmond-area communities, theyconcentrated on giving interviews to localreporters. Several law enforcement officials statedthat the national correspondents’ lack of local tiessometimes prompted them to compromise theinvestigation to get a story. Recognizing their sym-biotic relationship, some agencies made a concert-ed effort to take care of the local media by givingthem the first opportunity to ask questions atpress conferences or to interview key officials oncethe investigation was concluded.

During high-profile cases the media will go togreat lengths to gather information, take photo-graphs or shoot video. This may include, as it didduring the sniper investigation, listening throughwalls and ceilings, using cameras to look throughcommand post windows on a third floor, and pay-ing citizens for access to private property for bet-ter camera angles into crime scenes. Law enforce-ment officials must recognize this and try to planfor how they will respond to such occurrences.Law enforcement must ultimately find a way towork with the media to give them information andphoto opportunities that will not interfere withthe investigation. An example of this occurred inAshland, Virginia at the Ponderosa restaurantscene. The executives there established the mediastaging area at the perimeter of the crime scene—close enough to allow the photographers to viewthe parking lot of the restaurant, but still a safe dis-tance from the scene. The media got what it want-ed and the crime scene was not disturbed.

“We found the media hiding in bathrooms and extending boom

microphones across drop ceilings.” SAC Michael Bouchard, ATF

Law enforcement officials may find themselvesaddressing a media trial, such as a “Richard Jewell

scenario” in which an innocent person is identifiedas a suspect and is essentially tried in the media.43 Asituation like the Jewell episode arose in the snipercase when several out-of-state newspapers ran afront-page story, complete with photographs, abouta possible suspect. Even though MontgomeryCounty officials never confirmed the individual as asuspect, the media ran the story. Within two daysthe individual had been cleared of any involvement,but his reputation was damaged nonetheless.

In granting access to the media, PIOs need to decidewith their executive how they will handle one-on-one interviews with him or her, or other key staff.Those interviewed for this project were split on thisissue. Some officials believe that exclusive interviewsdampen the media feeding frenzy. Others strenu-ously object to granting exclusive interviewsbecause, far from reducing the frantic media atten-tion, they believe they stoke the competitive natureand ill will of those reporters who do not receive theexclusive. In either case, it is best to make these deci-sions before a high-profile event occurs.

H O L D I N G P R E S S C O N F E R E N C E SPress conferences will be the most visible represen-tation of the investigation for the public, and canhave an extraordinary influence on public opinionand pundits’ critiques of the investigation’s progress.How they are managed can make or break careers ofchiefs and PIOs. Agencies need to consider, at mini-mum, five aspects of press conferences:

• Purpose• Location• Frequency• Spokesperson• Preparation


43 Richard Jewell was working as a private security guard inthe Centennial Olympic Park in Atlanta when a pipe bombexploded before dawn on July 27, 1996—killing one personand injuring more than 100. Jewell was originally hailed asa hero after the bombing for moving people away from theunidentified package that turned out to be a bomb. But thatwas before news reports identified him as a suspect in thecase, exposing him to an onslaught of media scrutiny. TheFBI eventually cleared him as a suspect, and Jewell receivedfinancial awards from several media outlets for the damageto his reputation.

80828_i-200.R7 10/8/04 12:07 AM Page 92

PurposePress briefings or conferences can serve multiplepurposes beyond the obvious one of disseminat-ing information to the media. Some of these otherpurposes include calming the community, educat-ing the public, asking residents for tips, communi-cating with suspects, and even communicatingwith officers. Officials must give careful thought towhen and how these other purposes will be served,and whether they might conflict.

Agencies will benefit from a consistent strategy onwhen and how to work with the media to achievepurposes other than informing the public. Officialsshould determine the desired outcome and how toachieve it prior to each press conference. For exam-ple, one press conference in the sniper case was usedto discredit a witness who had given false informa-tion to police and reporters about the Home Depotshooting in Fairfax County. Officials wanted to noti-fy the public of the deception, but also wanted tosend a message to the suspects that other witnessescould still have credible information. The PIOs care-fully wordsmithed the prepared statement to reflectthis distinction and to meet both purposes of theannouncement.

Friday, October 4, 2002 (Day 3)Montgomery County Police HeadquartersRockville, MarylandAt a morning press conference, investigatorsreveal they are looking for either a hunting orassault rifle that fires .223 ammunition, the sametype of bullet that killed five victims inMontgomery County. Actual rifles and ammuni-tion are on display, and photographs of the differ-ent firearms that police suspect the shooter maybe using are disseminated to the media. The pressconference receives significant “air time” andhelps law enforcement inform the community ofwhat type of rifle may have been used.

If law enforcement plans to instead use the mediaas a vehicle for communicating with suspects,police leaders must ensure the crafting of a carefulstrategy. Officials need to know what they can say,and what they cannot say. Chief executives shouldbe careful about assuming the role of a negotiator

with suspects. Regardless of who is the target audi-ence, PIOs should be involved in any strategicdecisions involving the media to ensure that theagency preserves its credibility.

“As strange as it sounds, we have todevelop trust and communicate with

the suspects, which we can do through the media.”


LocationBecause these investigations, by their nature, areunplanned, it may be difficult to arrange a locationfor press briefings immediately. Often, the initialbriefings will be at the crime scene, and if no fol-low-up briefings are planned, the crime scene maybe completely appropriate.

If indications suggest a protracted investigation, theagency should identify one permanent site for pressconferences, briefings and distributing materials. Tothe extent possible, a site should be identified thatallows the agency to maintain some control overaccess and for which it can easily establish a securi-ty perimeter. In Montgomery County, press confer-ences were located in front of the police headquar-ters because the command post was located theretoo. MCPD’s Special Weapons and Tactics (SWAT)team was staged as a quick response unit duringpress conferences in the event the snipers attempt-ed a shooting. Also, the MCPD parked the satellitetrucks in such a way as to block potential snipersight lines and to afford greater protection for pressconference participants.

Agencies can consider using an indoor site. Thiswill offer shelter from the weather and the oppor-tunity to set up tables and chairs. However, theagency will have to assume property managementresponsibilities for any indoor facility.

Whether indoors or out, the media should be sep-arated from investigators and other operationallaw enforcement personnel. The site should be


80828_i-200.R7 10/8/04 12:07 AM Page 93

convenient for those who provide the briefings,but should be far enough away from investigatorsand other law enforcement personnel so reporterscannot interfere with their work. In Ashland,Virginia, the media site was on a well-manicuredgrassy hill—separated from the Ponderosa restau-rant by a 4-lane road, yet close enough to allow fora clear camera shot of the scene. In Prince WilliamCounty, the press site was located a half-mile fromthe scene, with sight lines and access to the crimescene obstructed by an interstate highway. In bothjurisdictions, law enforcement felt this was the bestarrangement for that particular scene, and neitheragency received complaints from the media aboutthe location.

FrequencyThe MCPD held 59 press conferences during theinvestigation. Determining the frequency of pressconferences is a challenge that every law enforce-ment agency will face. Determining when and howoften to hold briefings is one of the crucial deci-sions to be made during the investigation, andregardless of the schedule, someone will likely beunhappy with it. Every case is different, and themedia coverage will vary too. The case may not bestatic, but could change daily or even hourly,which may dictate a change in scheduling confer-ences. There simply is no easy answer to “Howoften?”

“A press conference every two hourswas probably too frequent. Many times

there was nothing to say.” PIO Captain Nancy Demme,


Some PIOs talked about “being there for themedia,” which encompasses more than press con-ferences, but is nonetheless a sound guiding senti-ment for informing the media about develop-ments. However, PIOs and executives believe thatpress conferences ideally should be driven by lawenforcement and public safety concerns. Agenciesshould hold press conferences only when theyhave news to deliver, and should not schedule a

conference or summon the media if there is noinformation to provide. If press conferences arenot addressing breaking events, agencies shouldtry to schedule them to coincide with the cycle oftelevision newscasts.

“I will give the media only the informa-tion that will help me solve the case and

keep the public informed.” Sheriff Stuart Cook, Hanover County Sheriff’s Office

Agencies should try to develop a schedule for pressconferences and share it with the media. If officialscan tell the media “no more press conferencestoday,” reporters will be grateful. Agencies shouldalso be careful about canceling a scheduled pressconference or keeping the press waiting for pro-longed periods. Reporters often will assume thecancellation or delay is an indication that some-thing unusual is happening, which may create astory in itself.

The SpokespersonWho addresses the media, and under what cir-cumstances, is another critical matter to consider.In many large agencies, the general rule is that thePIO handles routine events and daily briefings,while the executive selectively appears at pressconferences under exceptional circumstances. Thedefinition of “exceptional” will vary among execu-tives and across agencies, depending on somecombination of their leadership style and a pre-arranged working arrangement with the PIO. Insome cases, lead investigators or other personnelare also authorized to speak for the agency. Everyagency should determine who will brief the mediaunder what circumstance, and make that decisionbefore a major investigation. In MontgomeryCounty, prior to the sniper case, Chief Moose toldCaptain Demme that she should expect to handle90 percent of the routine media briefings. On themorning of Day 2, Captain Demme said, “Chief, Ithink your 10 percent is about to start.”


80828_i-200.R7 10/8/04 12:07 AM Page 94

“When finished interacting with themedia over a several-day period,

as when we responded to the attack onthe Pentagon, I am emotionally spent.

The continuous preparation and performance is draining.”

Chief Edward Flynn, Arlington County Police Department 44

Though some leaders will use their PIO different-ly, he or she can provide a level of insulationbetween the decision makers and the media. Chiefexecutives, as the ultimate agency authorities, mayfind themselves in a no-win situation if they can-not or will not answer a media question. The PIOhas the greater latitude in not answering aninquiry either because he or she may legitimatelynot have the answer, or can afford to say, “I don’tknow” or “I don’t have the authority to answer thatquestion,” without it reflecting badly on his or herleadership skills or creating repercussions. Thechief may not want to provide an answer becauseof public safety concerns, such as in hostage nego-tiations, or because it could affect the integrity ofthe investigation. But when the chief chooses notto answer a question, he or she may only heightencommunity anxiety about the investigation’sprogress or the chief ’s leadership abilities.

“Why should I put the sniper case on my PIO? Ultimately, I will be held

accountable for the agency’s performance, and should accept

responsibility for media relations.” Chief Charles Moose,


When the chief is briefing the media, the PIOshould always remain close by so the chief candefer to him or her for follow-up, to facilitate aclean end to the conference and so the PIO cananswer the many questions that will be asked oncethe conference has ended.

From time to time, elected government leaders fromthe local, state and national level will participate inpress conferences, particularly if the public is look-ing for reassurance about the overall conditions inthe jurisdiction or region. Elected leaders can serve avital function in calming residents and alerting themto the availability of such government services as cri-sis counseling or victim assistance. Law enforcementofficials need to work with politicians early on todetermine how they can effectively contribute to theoverall media strategy.

If political leaders are involved in law enforcementpress conferences, their comments should be coor-dinated with all other speakers to ensure a consis-tent message that meets law enforcement goals.This will also preempt redundancy or damage tothe investigation. Speakers should refrain fromdiscussing who is safe and who is not, and shouldnot challenge the suspects. Government leaderscan help calm public fears and facilitate access toneeded services, but should always refrain fromdiscussing the specifics of the investigation.

Tuesday, October 8, 2002 (Day 7)Montgomery County Police HeadquartersRockville, MarylandAt an emotional afternoon press conference held theday after a 13-year-old student was shot in front ofhis middle school, one public official stated, “We’retalking about a person here who is basically a cow-ard. This is not an individual here who is out theredoing something strong or manly or anything of thistype. This is a person shooting elderly men, shootingwomen, and now shooting little children.”

While the general law enforcement strategy shouldbe to coordinate the involvement of elected andappointed government leaders in press confer-ences, agencies must also monitor the news to seewhat local and national political leaders are sayingoutside of law enforcement briefings, and thenadjust their media strategy accordingly.


44 Chief Edward Flynn has since left the Arlington CountyPolice Department and at the time of this writing is theSecretary of Public Safety for the Commonwealth ofMassachusetts.

80828_i-200.R7 10/8/04 12:07 AM Page 95

Monday, October 14, 2002 (Day 13)On the afternoon of the 14th, President Bush spokeabout the killings just miles from the White House:“I’m just sickened, sick to my stomach, to think thatthere is a cold-blooded killer at home taking inno-cent life. The idea of moms taking their kids toschool and sheltering them from a potential sniperattack is not the America I know.”

Preparation

“Don’t challenge the snipers, don’tembolden the snipers. When briefing the

media, we tried to strike a balancebetween these two principles.”

SAC Gary Bald, FBI

Press conferences can go forward impromptu, orthey can require hours of preparation by severalpersonnel. The amount and type of preparationmay well depend on the purpose of the confer-ence. In Montgomery County, media relationsstaff engaged in the following activities:

• Every day the PIOs read the morning newspa-per editorials to assess media and publicsentiments about the investigation and usedthe editorials to help craft the media strategyfor that day.

• Once a routine schedule of press conferenceswas established, the PIOs conferred with themedia before each conference to identify issues,questions and rumors so that the preparedcomments could address those concerns.

• FBI profilers and hostage negotiators helpedprepare the statements, especially when usingthe press conference to communicate tosuspects or when crafting language that consid-ered the suspects’ possible reaction. ATF profil-ers and negotiators provided guidance as well.

• At the beginning of many press conferences,the media relations staff distributed handoutswith talking points that would be emphasizedat the conference.

To help monitor how media efforts might influ-ence the case, public information personnel candocument media actions during the investigation.One type of documentation could consist of awritten log (or audio or videotapes) of press con-ferences and even of subsequent media reports. Asecond log would focus on significant pendingmedia questions or problems.

R E L E A S I N G P U B L I C I N F O R M AT I O NF R O M A T A S K F O R C E

How Many Spokespersons?When multiple agencies come together to form atask force, it is imperative that they speak with onevoice when communicating with the media.Achieving this one voice could entail using just onespokesperson, or coordinating messages amongmultiple spokespersons in different jurisdictions. Ofcourse the difficulty in delivering one messageincreases with the number of speakers. To the extentpossible, a task force should identify one spokesper-son or one point of contact for the media. Thatspokesperson may very well be someone in the pri-mary agency, and all participating agencies mayneed to make this decision just as they did for deter-mining the leader of the Sniper Task Force.

Circumstances may arise, however, that requiremore than one chief or spokesperson to brief themedia. Individual chiefs should make anyannouncements about critical events or majordevelopments that occur in their own jurisdiction,and only after these announcements are madeshould the chief defer to the task force publicinformation personnel (see Chapter Two for moreinformation about coordinating operationsbetween individual agencies and a task force). Forexample, in both Prince William and FairfaxCounties, Chiefs Deane and Manger, respectively,announced that sniper-related homicides hadoccurred in their jurisdictions and that they wouldinvestigate the murders locally, but participate inand coordinate with the Montgomery County taskforce. Similarly, if chiefs are present at the taskforce command post at the time the crimes arecommitted in their jurisdiction, they should deliv-er any statements about those developments.


80828_i-200.R7 10/8/04 12:07 AM Page 96

Joint Information CenterThe Montgomery County Task Force established aJoint Information Center (JIC) that included pub-lic information office personnel from the FBI, ATFand those neighboring agencies that did not have ashooting in their jurisdiction. The PIOs of the prin-cipal agencies participated in conference calls withthose professionals in the JIC. The collective opin-ion of the PIOs interviewed is that effective com-munication among the media relations personnel isjust as important as communication among execu-tives or among primary investigators. One mecha-nism for achieving this is to establish a PIO table inthe JOC, staffed by rotating public information stafffrom the principle agencies that keep all PIOsapprised of developments. If on-site representationis not possible, the PIOs should establish their ownregularly scheduled conference calls to facilitateinformation sharing and planning.

Agencies must consider and address the problemsinvolved in choosing physical locations for keyoperations—the JOC, the JIC and the media stag-ing area. As mentioned earlier, the media shouldbe staged away from the JOC to minimize interfer-ence with investigators and inappropriate access tofacilities. This may create a problem for PIOs whoprefer to be close to, or in, the JOC as a way to fos-ter communication with investigators, but have toremain physically close to the media staging area.In Montgomery County, the JIC was established inpolice headquarters and not in the JOC. This easedpreparations for press briefings that occurred infront of police headquarters, but it created prob-lems when the PIOs wanted to be in the JOC. Inthe sniper case, PIOs from several agencies saidreporters, and not investigators, informed them ofcase developments. In sum, the conflict for PIOs isthat staying close to the JOC enables them toobtain the timely investigative information neededto effectively brief and interact with the media, butstaying close to the media is more efficient andaccessible, and maintains a needed buffer betweenthe press and investigators.

“I’ve never seen an investigation wherethe media was such a driving force,

and where they had so much investigative information.”

Sheriff Stuart Cook, Hanover County Sheriff’s Office

PIOs from federal agencies such as the FBI or ATFwho serve on task forces can bring a wealth of expe-rience to managing public information duringlarge-scale, national incidents. However, their per-spective on multi-agency investigations will proba-bly be different than that of local officials. For exam-ple, federal agencies prefer to brief the media less fre-quently than state or local agencies. Also, they maynot be as familiar as local PIOs with the communityfears and demands that are an integral part of man-aging these investigations on the local level. Yet theyprovide valuable perspectives and opinions thatlocal agencies might not otherwise consider.

A D D R E S S I N G M E D I A L E A K SLeaks can be frustrating—even dangerous for lawenforcement personnel for several reasons. Someinformation, if leaked, can jeopardize an ongoinginvestigation and the eventual prosecution. It canenrage suspects who then react violently or altertheir behavior, and frustrate planned policeactions. Innocent people can be falsely accused,inviting irreparable damage to their reputationsand spurring citizen fears. Leaked information anderroneous information reported by the media mayrequire law enforcement agencies to issue correc-tions that tip their hand or otherwise underminetheir efforts. Task force leaders and PIOs will findit a challenge to maintain a balance between cor-recting information and standing by as conflictingor erroneous information appears in mediareports. Finally, leaks can hamper much-neededinformation sharing among law enforcement asdevelopments are closely guarded.

A leak can come from anyone—chiefs, sheriffs,special agents, investigators and patrol officers.Leaks occur because officials want to demonstratetheir knowledge about the investigation or itsprogress, learn from reporters what they know


80828_i-200.R7 10/8/04 12:07 AM Page 97

about the case, or inadvertently disclose informa-tion by telling someone they do not know is areporter or shares developments with others whothen inform reporters. There are many other pos-sible sources, such as conversations overheard ordocuments intercepted, as well as intentional leaksfor payment or other consideration.

In high-profile investigations, there may be little dif-ference with regard to information released internal-ly and information revealed publicly. Some officialsin this investigation wanted to implement organiza-tional controls (e.g., policies, signed contracts orpolygraph examinations) to limit leaks or identifythose who had released information improperly.Other officials interviewed disagreed with this strat-egy. Leaks can hamper the investigation and under-cut the exchange of information, but officials shouldnot allow leaks to divert their focus from the investi-gation. The consensus of investigators and executiveswith experience in high-profile investigations is toassume that leaks will occur and not to be surprisedby the leaking of any piece of information.Determine which information, if leaked, wouldrequire a response and what that response should be.

Monday, October 8, 2002 (Day 7)Montgomery County Police HeadquartersRockville, MarylandOn October 8, local news WUSA-Channel 9reported that a tarot card was found the previousday at the Tasker Middle School shooting scene,which contained the message: “For you Mr.Police…Code: ‘Call me God.’ Do not release tothe press.” The Washington Post reported thesame information the following day. Chief Mooselambasted the media for reporting the existenceof the card and endangering the case. Both mediaoutlets had relied on information “leaked” by lawenforcement officials, or somehow obtained pos-session of one of the hundreds of photocopies ofthe card that had been made.

When unauthorized disclosures occur, it is impor-tant for executives to resist the temptation to criticizethe reporters for running a story that contains leaks.They are, after all, doing their job, and are relying oninformation provided by law enforcement officials.

Agencies’ written policies should clearly statewhich personnel can interact with the media andunder what circumstances. During these investiga-tions, executives should remind personnel of thoseexisting written policies and reiterate to officersthe importance of not leaking information.

Closely related to leaks are “off the record conversa-tions” officials have with reporters. These conversa-tions are often an attempt to gain or keep good will,to spin the story, or to present their agency in a goodlight. Because they may not discuss case specifics,they might assume that these talks are relativelyharmless. But a number of PIOs spoke about howthese conversations always result in unintended con-sequences for them and their executives. Every con-versation a reporter has with someone who knowsjust a piece of the story contributes to a snowballeffect whereby reporters try to leverage what theyknow in order to gain additional information untilthey get enough for the story. At some point, thosereporters inevitably call the primary PIO or chiefand ask for information to fill gaps or to correct anymisperceptions—a position they would not have tobe in if officials refused to divulge seemingly incon-sequential elements of the case.

P L A N N I N G A N D P R E P A R AT I O NAs with many aspects of multi-agency investiga-tions, pre-incident planning for how media rela-tions will be conducted can make a significant dif-ference when a crisis arises. Executives shouldensure that all relevant personnel develop andreview agency-wide policies and standard operat-ing procedures for the public information office.

Executives and PIOs should establish relationshipswith local media during non-stress times. PIOscan work with local television, radio and printreporters on how they can meet one another’sneeds and address concerns. At another level, thechief/sheriff and PIO, perhaps in conjunction withseveral law enforcement agencies, could meet withmedia executives, such as television and radio sta-tion managers and news directors, as well as news-paper editors, to explain agency policies and plansin an attempt to reach a mutually agreeable strate-gy for covering major stories. These personal rela-


80828_i-200.R7 10/8/04 12:07 AM Page 98

tionships cannot be stressed enough. The height ofa crisis is not a good time to establish ground rulesor ask for favors from the press.

“The media does some of the samethings that law enforcement does interms of searching for information.Sometimes, reporters may uncoverinformation that law enforcement is not aware of that can actually help

solve a case. These relationships can be mutually beneficial.”

Detective James Trainum, Washington Metropolitan Police Department

Many sworn PIOs in agencies across the countrynever receive formal media relations training, butthose interviewed as part of this project empha-sized its value. If training is not immediately avail-able, agencies should provide for an overlap tran-sition between the incoming and outgoing PIO.This on-the-job training will allow the incomingPIO to learn at least how the chief, reporters andmedia managers operate. This training may alsohelp them prepare for conducting a press confer-ence, including fundamental rules about suchmatters as when the press conference should end.

PIOs should get to know their counterparts in sur-rounding agencies, and may even want to schedulea regular meeting to discuss mutual concerns orexperiences. PIOs should discuss, and when possi-ble, coordinate with nearby agencies their policiesfor granting interviews, working with well-knownreporters and responding to requests from local,national and international media. When agencieshave conflicting policies, or one agency applies itsmedia policy inconsistently, reporters may be ableto play agencies against each other in trying togain information or interviews.

A F I N A L T H O U G H T: B A L A N C I N G D E M A N D SAn important but often overlooked considerationin high-profile cases is balancing three conflictingforces: 1) the public’s right to know, 2) law

enforcement’s desire to manage information to maintain case integrity and public safety, and 3) the media’s need to run stories and compete intheir market. During an investigation of thisnature, especially one involving ongoing commu-nications with suspects, law enforcement maylearn of information that is critical to solving thecase. This same information, however, may havesignificant consequences for public safety, causinglaw enforcement officials to weigh the effects ofwithholding information for investigative purpos-es and how that might influence residents’ safetyand security.

For example, the “Ponderosa letter” left by thesnipers contained language that threatened thesafety of children, while also stating that this infor-mation should not be released by law enforcementto the media. It was, however, passed on to some,but not all, school administrators who decided onSunday, October 19 to close schools based on thisnotation. The next day, a national broadcast outletran a story about the warning in the letter, butdramatically overstated the threat, which furtherinflamed public fears. Law enforcement then feltcompelled to address public fear and put it inperspective. Law enforcement leaders released the warning in the letter, despite the potential forchallenging the suspects and undermining theinvestigation.

Ultimately, law enforcement must considerwhether information should be released to thepublic to inform them of safety concerns or to askfor assistance. Accordingly, the question is notwhether to work with the media—more reason-ably, it is a matter of when and how much. Lawenforcement must recognize that giving too littletoo late can spur the media into conducting theirown investigations, and undercut an agency’s abil-ity to control the message. Simply put: Lawenforcement and the media need each other, solaw enforcement executives need to do their bestto work with them to find common ground. Theneed to secure this common ground cannot beoverstated. Without it, conflicts will continue toaffect public safety.


80828_i-200.R7 10/8/04 12:07 AM Page 99

C O N C L U S I O NManaging the media function was one of thegreatest challenges in this high-profile investiga-tion. The media coverage was greater than anyonehad ever experienced, and individual reporterscreated significant problems for investigators andexecutives. Some law enforcement officials addedto the problems by leaking information toreporters. The role of the media went beyond justcovering the story as their actions influenced theinvestigation, citizens and suspects. They alsoplayed an important role by allowing law enforce-ment to communicate with residents to reducefear and solicit help in identifying the suspects.The media helped law enforcement take the pulseof citizen concerns, fears and expectations as well.And, of critical assistance, they helped communi-cate with the suspects.

The new relationship between law enforcement andthe media is complex, and in high-profile cases it canprove especially challenging. Police chiefs and sher-iffs should understand that the relationship deservesan investment—in building trust, ground rules andexpertise to make the most of a positive arrange-ment with the media. The role of journalists in lawenforcement operations will continue to be signifi-cant, and the next high-profile investigation maygenerate even more media attention than the snipercase. The adept police executive who gets the callthat there has been a serial shooting or other high-profile crime will already be prepared for the secondcall—the one from the media.


Managing the Public Information Function• The chief and the PIO must develop a plan

(preferably before an incident) for managingthe media, and to the extent possible, stick toit throughout the event.

• The public information plan should include,at minimum,

° a delineation of duties and responsibilitiesrelated to the media throughout the investi-gation;

° organizational resources necessary to makethe plan a success;

° a description of how the organization willmanage critical aspects of the investigation,such as press conferences and crime scenes;and

° direction on how much information it willprovide the media.

• Agencies should identify one point of contactfor the media and the means for that lawenforcement official to communicate quicklywith them.

• Agencies should recognize that by providingreporters with information, they can mini-mize the likelihood that reporters will see theneed to conduct their own independent inves-tigations.

• Law enforcement should provide accurate andtimely information through the proper publicinformation staff.

• Agencies should recognize and plan for thefact that in a high-profile incident, reporterswill go to great lengths to get their stories.

• Officials should keep suspects’ names out ofthe media to the extent possible, but recog-nize that leaks may require a strategy for deal-ing with the public disclosure of those names.

Holding Press Conferences• Agencies should hold press conferences only

when they have news to deliver.• Agencies should develop a careful strategy on

when and how to use the press conference toachieve purposes other than informing thepublic, such as communicating with suspects.

• Officials should determine the reasons for apress conference, the anticipated outcome anda strategy to achieve it.

• Chief executives should rely on the expertiseof PIOs (and behavioral scientists) to craft astrategy and message for press conferences.

• If applicable, agencies should identify onepermanent site for holding press conferencesand briefings, as well as distributing materials.

• Agencies should identify a site where they canmaintain some control over access and readilyestablish a security perimeter.

• The location of press conferences should beconvenient for those who are providing thebriefings, but far enough away from investiga-


80828_i-200.R7 10/8/04 12:07 AM Page 100

tors and other law enforcement personnel soreporters cannot easily interfere with theirwork.

• Departments should be wary of canceling ordelaying press conferences, as reporters maytake this as an indication that somethingunusual is happening.

• A PIO can be a buffer between the media andthe chief without making leadership or fulldisclosure the issue any time a question can-not be fully addressed.

• Determine what role, if any, local politicianswill play in communicating with the publicand work with those leaders to coordinatemessages that will meet the needs of commu-nities while maintaining the integrity of theinvestigation.

Releasing Public Information from a Task Force• When multiple agencies come together to

form a task force, it is imperative that theyspeak with one voice when communicatingwith the media.

• If chiefs are present at the command post,they should make statements about any devel-opments in their respective jurisdictions.

• The task force should make accommodationsto establish a Joint Information Center (JIC).

• If on-site representation in the JOC is notpossible, the PIOs should establish their ownregularly scheduled conference calls to shareinformation and develop strategies.

Addressing Media Leaks• Officials should not be surprised by the leak-

ing of any piece of information.• Law enforcement leaders should not let leaks

overwhelm the investigative effort by becom-ing preoccupied by them.

• Agency executives and PIOs should determinewhich information, if leaked, will require aresponse and what that response should be.

• When leaks do occur, it is important forexecutives to resist the temptation to criticizereporters.

• Agencies should develop written policies thatclearly state which personnel can interact withthe media and under what circumstances.

Planning and Preparation• Executives should provide new PIOs with

training, or at minimum, create overlap in theposition so the outgoing PIO can provideguidance to whomever takes his or her place.

• Executives and PIOs should develop relation-ships with local television, radio and printreporters prior to a major incident in theirjurisdiction.

• Law enforcement executives and their PIOsshould meet with media executives and deci-sion makers to explain their policies and pro-cedures and attempt to reach a mutuallyagreeable strategy for covering major storiesor high-profile incidents.

• Executives should develop and enact agency-wide public information policies and standardoperating procedures for the public informa-tion office.

• PIOs should get to know their counterparts insurrounding agencies through regular meet-ings and discussions.

• PIOs from neighboring agencies should con-sider coordinating their policies for grantinginterviews and responding to media requestsduring high-profile investigations.


80828_i-200.R7 10/8/04 12:07 AM Page 101

102

80828_i-200.R7 10/8/04 12:07 AM Page 102

C H A P T E R E I G H T ■ Community Issues ■ 103


The safety of residents must be the para-mount concern for any law enforcementagency, especially during an event that

creates panic and confusion. The effect of thesniper shootings on community fear has been welldocumented;45 and the lesson for law enforcementis that prolonged indiscriminate violence can shat-ter people’s sense of security and well-being. Thesnipers’ random violence caused many citizens tofeel an intense personal vulnerability, especially onthe heels of the September 11, 2001, terroristattack on the nearby Pentagon and the anthrax-tainted letters mailed to the area. These latterevents contributed to the initial theories that theshootings were the work of terrorists.

“The terror is here and that is terrorism.” Sheriff Ronald Knight,

Spotsylvania County Sheriff’s Office

This chapter describes how law enforcementagencies worked with community residents andorganizations during the sniper investigation.Specifically, the chapter focuses on

• Maintaining community outreach• Accessing victim assistance• Addressing school safety

Every local law enforcement agency that investi-gated a homicide or shooting during this three-

week episode realized the importance of listeningto, and working with, community members. Manyarea residents looked to law enforcement officialsfor leadership. Fortunately, community leadersand organizations helped make significant contri-butions to calming public fears and even ensuringthe safety of residents. This chapter attempts toanswer some of the questions that law enforce-ment officials—from executives to 911 call-tak-ers—faced when interacting with residents andvisitors during the three-week investigation, suchas the following:

• What can law enforcement do to reassure resi-dents about their safety and security?

• How will community members react in theface of such fear, and what can communityleaders do about it?

• What are the needs of victims and their fami-ly members, and how can law enforcementmeet them?

• How can schools, administrators and lawenforcement leaders coordinate proceduresand the messages they provide to parents andstudents?

C H A P T E R E I G H T

Community Issues

45 Numerous media outlets documented the extent of commu-nity anxiety and fear during the 23-day investigation,including a poll conducted by The Washington Post justdays before the suspects’ arrest that showed a larger propor-tion of Washington-area residents—more than 4 in 10—said the sniper shootings made them feel more personallythreatened than did either the September 11 attacks or theanthrax-tainted letters.

80828_i-200.R7 10/8/04 12:07 AM Page 103

M A I N T A I N I N G C O M M U N I T YO U T R E A C HThe sniper case was particularly frustrating formany law enforcement officers because it was thefirst time in their careers that they could not tellthe community how to be safe. Agencies foundthey had to strike a balance between telling citizensto be careful and limit some activities and, at thesame time, to live their lives as normally as possi-ble—not to be hostages in their own homes.Consistent with community policing, agenciesfound they were most successful when providingresidents with a highly visible law enforcementpresence and a sense of security. For many agen-cies, this three-week episode improved bonds oftrust and understanding between the police andcommunity that will be felt for years to come.

“From one perspective, the sniper casewas more challenging than responding

to the Pentagon on September 11. With the Pentagon, community fear subsided greatly within a few days. In the sniper case, community fearseemed to grow exponentially every

day, and created enormous challengesfor police to reassure the public.”

Chief Edward Flynn, Arlington County Police Department

Providing Information to the CommunityThis investigation provided an opportunity for lawenforcement to engage the community as its eyesand ears—explaining what to look for and how tobehave in certain areas or situations—and as part-ners in protecting themselves and loved ones frombecoming victims. The agencies involved neededto be careful, however, that in their desire todemonstrate that law enforcement was in controlof the situation, they did not release critical orincorrect information.

Once the appropriate message has been crafted, lawenforcement agencies can disseminate it to the com-munity directly through a variety of communica-tion efforts (e.g., leaflets or web postings) or existing

community networks (e.g., Neighborhood Watch orcommunity associations). Agencies can also partnerwith the media to broadcast information, mindfulthat every communication through the press mayreach the perpetrators, whose potential reactionmust be carefully considered. In addition to pressconferences, some of the ways local agencies com-municated with citizens during the sniper caseincluded the following:

• Nearly every local agency used communitymeetings to inform the public of develop-ments and reduce their apprehension by pro-viding guidance and support.

• MCPD developed a “How To Be A GoodWitness” guideline for citizens (see AppendixJ for a copy).

• The Prince William County Police Department,during its pre-incident planning efforts, deter-mined that it would use a website to provideresidents with helpful information in the eventof a shooting. When the shooting occurred, thewebsite was established immediately.

• The Prince William County CommunityServices Board, using information previouslydeveloped for Critical Incident StressManagement debriefings as well as its experi-ence in responding to the Pentagon attack,developed a tri-fold brochure entitled“Dealing with the Sniper Attacks” (seeAppendix K for a copy).46

• The Baton Rouge Serial Murder Task Forcedeveloped a website to educate thecommunity. The site included victimbiographies and photographs, descriptions ofmissing property and a profile of the killer.

• In the United Kingdom, when different con-stabularies are involved in a multi-agency inves-tigation, they each develop a website to informthe public and to also identify the individualswho might be visiting all of their websites.

While agency officials never formally evaluated theeffectiveness of these efforts, they felt these initia-tives helped inform and calm the community, andwould use them again in a similar situation.

104 ■ Community Issues ■ C H A P T E R E I G H T

46 For additional source material on coping with the shootings,see SAMHSA 2004.

80828_i-200.R7 10/8/04 12:07 AM Page 104

“To Protect, Serve and Reassure. Thiswas our motto during the sniper case.”

Chief Gerald Wilson, Prince George’s County Police Department

Sometimes, agencies may miss opportunities toeducate and inform residents about necessary lawenforcement functions, which can contribute tocommunity frustration. At one shooting scene, sev-eral retail customers were detained and questionedfor an extended time and even had their vehiclesconfiscated for evidentiary purposes. Many wereupset by the lack of explanation and follow-upassistance from the law enforcement agency, andmade their displeasure known. Despite an occa-sional misstep like this, agencies used traditionaland innovative ways to keep community residentsinformed about developments and, by most indica-tions, succeeded in their efforts.

Community Mental Health ServicesThe fear among residents became so pervasive thatlaw enforcement agencies did not always have theresources or expertise to ease residents’ anxiety. Inseveral communities, county mental health agen-cies provided awareness and counseling services toresidents. Notable examples of this includeMontgomery County and Prince William County.

The Prince William County Critical IncidentResponse Team, part of the Prince William CountyCommunity Services Board (CSB), has a 15-yearrelationship with public safety agencies. ThisCritical Response Team includes 20 people trainedto provide support to public safety personnel aftera critical incident. One measure of their successhas been the increasing frequency with whichpolice officers have been informing victims of thecrisis intervention services.

“Our unofficial motto is to say yes to the police department, no matter

the request.” Vickie Taylor, Prince William County

Community Services BoardYouth, Adult and Family Services Division Manager

The benefits of the police-mental health partner-ships were evident in such cases as when countyexecutives met several hours after the 8:15 P.M.shooting of Dean Meyers in Manassas and policeand government leaders expressed concerns aboutthe community’s emotional welfare. In an effort todemonstrate a commitment to the county’s messageabout the importance of residents’ physical andemotional well-being, the CSB was asked to partici-pate in the initial news conference. Their representa-tive stood on the podium behind police officials atthe press conference to show support and answerquestions.

CSB leaders knew the importance of getting infor-mation out to the community, so they publicizedtheir services in several ways: Officials announcedthe hotline number at the press conference and onlocal television news broadcasts. The DMH pro-duced a flyer for residents discussing likely reactionsand tips for managing stress, and made them avail-able at county buildings.

The CSB’s initial step was to establish a communi-ty hotline. Although the DMH did not have a priorplan for a hotline, it improvised and developedone with existing resources. Without enough timeto obtain a dedicated phone number, DMHstaffers used the two numbers already used formental health services, and drafted two front-deskemployees to answer the phones. The hotline call-takers routed the calls to one of five individualsqualified to provide assistance. If the caller neededadditional counseling, an appointment was set upat a mental health center.

The 24-hour hotline went into operation onOctober 10 (Day 9) and stayed up and running forabout a week after the suspects’ arrest. Call-takersanswered hundreds of calls. Unexpectedly, manyof the callers did not need counseling services butwanted the number for the FBI tip line. Of thosewho called for counseling services, most wanted toknow what to do for their children. The close con-nection between law enforcement and mentalhealth resources were invaluable to this investiga-tion, and will fill the same function in any similarinvestigation.


80828_i-200.R7 10/8/04 12:07 AM Page 105

A C C E S S I N G V I C T I M A S S I S T A N C EOutreach for victims and their families is crucialduring a high-profile investigation. Victim servicesfrom police and prosecutors’ offices can assist thelaw enforcement department in communicatingwith the victims and their families. For example, theMCPD convened the victims’ families on the nightof October 3 (Day 2) when four MontgomeryCounty residents were killed, and once again imme-diately after the suspects were arrested. In addition,these family members were brought together onseveral other occasions after the arrests. At thesemeetings, police, victim advocates and psycholo-gists were available to answer relatives’ questionsand provide support.

“The victims and their families are always your first concerns,

and cannot be forgotten.” Chief Charles Moose,


Agencies may want to consider a coordinatedapproach to providing services to victims andtheir families. Crucial participants might includevictim service professionals and representativesfrom law enforcement, prosecution and courts.This multidisciplinary team would ensure thetimely and sensitive completion of necessary tasks,such as notifying and briefing victim family mem-bers, releasing property, working with prosecutorsand court officials, and coordinating mediarequests for interviews with victims and families.During the investigation of a “normal” crime, theprimary investigator may perform many of theseduties. In high-profile cases the primary investiga-tor should be assisted with these duties, includingmaintaining contact and sharing information withvictim service providers.

Law enforcement agencies and victim serviceproviders have to remain sensitive to culturalnorms when providing victim services, such asemotional support, counseling, insurance, emer-gency funds and more. In this case, the MCPDlearned that some cultures do not allow the

acceptance of donations during times of grief. Thedepartment also had to help make arrangementsfor family members to come to the United Statesto attend a funeral, which was complicated by thefact that some family members in the area turnedout to be in violation of immigration laws.

Those involved in the sniper case cautioned that, asin many tragic cases, some victims or their familieswill express frustration or anger toward lawenforcement, and may even use media opportuni-ties to criticize or accuse law enforcement of negli-gence. When this occurs, it can be upsetting foragency personnel, and can also create distractionsand additional work. There is probably little thatlaw enforcement can do to prevent this, but officialshave to be prepared nonetheless, and understandthat it is a natural aspect of the dynamics of such anemotional experience for those who are victimized.

Victim service professionals may also assist indeveloping plans for providing post-traumaticstress counseling for victims’ families, communitymembers, law enforcement employees and theirfamilies. City, county or state mental healthservices and the agency’s internal employee assis-tance programs (peer support teams and offices of stress management) can fill a crucial role indelivering these services.

“The Washington-area sniper shootingshad a profound impact on our

community—not only for the families who lost loved ones, but for each of us who lived with fear during those three weeks in October. Throughout that horrifying time, I supported our

law enforcement officers in every waypossible and tried my level best to

reassure a community that was constantly on edge. There isn’t a daythat goes by that I don’t think about the victims of these terrible crimes and the families they left behind.”

Douglas M. Duncan, County Executive, Montgomery County


80828_i-200.R7 10/8/04 12:07 AM Page 106

A D D R E S S I N G S C H O O L S A F E T YSchool systems, in part because of their centralrole as caretakers in the community, can tremen-dously influence and even create public opinionsabout local events and issues. Certainly, the snipercase was one of those events. In MontgomeryCounty, school officials fielded an enormousnumber of calls from parents asking about thesafety of their children. So did law enforcementofficials, especially district commanders. Studentsand parents will make frequent inquiries and, attimes, unusual demands on school and lawenforcement officials during times of crisis.

“Everyone everywhere was a potentialvictim. No one was excluded.” Supervisory Special Agent Mark Hilts, FBI

School officials had many concerns about manag-ing the safety and security of the students, teachersand staff in their classes and on their grounds. Thesafety of students weighed heavily on schooladministrators. A brief overview of some of thekey developments affecting schools in the snipercase follows.

Thursday, October 3, 2002 (Day 2)By 10:30 A.M., the Montgomery County SchoolDistrict, comprised of some 191 public schools, isput on Code Blue, as are dozens of private schools.Students are no longer permitted outdoors until theschool day has come to an end. Code Blue wouldremain in effect for the next four weeks.

Monday, October 7, 2002 (Day 6)In Montgomery and Prince George’s Counties,Maryland State Troopers are assigned to schools atthe beginning and end of each school day,patrolling local shopping malls in between.Uniformed troopers, in an attempt to promote vis-ibility and security, get out of their cars and talkwith teachers, principals and students. Plainclothesofficers concentrate on surveillance and detection.(This was the day 13-year-old Iran Brown was shotin front of his school at 8:08 A.M.)

Friday, October 11, 2002 (Day 10)Outdoor activities in Maryland and Virginiaschools, including field trips and athletic events,are cancelled. Youth sports leagues suspend allpractices and games.

Sunday, October 20, 2002 (Day 19)Richmond-area school officials announce thatschools will be closed on Monday. School officialsin northern Virginia and Maryland announcethat schools will remain open.

Tuesday, October 22, 2002 (Day 21)With schools shut down in the Richmond area forthe second day, Chief Moose releases to the pressthe sniper’s postscript from the letter left inAshland: “Your children are not safe anywhere atanytime.”

School System Security PoliciesOn the morning of October 3 (Day 2),Montgomery County School Superintendent JerryWeast convened the Montgomery County CrisisManagement Committee. For the next three-and-a-half weeks, the committee, consisting of 18internal upper-level managers, met two to threetimes each day to assess the schools’ conditionsand ensure the activation of the system’sEmergency Response Plan. Tasks that requiredmanagerial oversight and decision making werestaffed “three deep.” For every critical position, areplacement and one other trained staff membersupported the primary decision maker.

From the first meeting, Superintendent Weastrequired a clerical staff member to keep meetingminutes and collect pertinent documents as a per-manent record of the committee’s and school sys-tem’s actions. The final product is a daily recordcollection, organized into four large binders, thatrecords the decision-making process.

The Emergency Response Plan includes contin-gencies based on the level of perceived threat, forexample Code Blue and Code Red. Code Blue, thesecond highest level of security, was in effect fromOctober 3 until October 28.


80828_i-200.R7 10/8/04 12:07 AM Page 107

Code Blue47

This is a term used to alert staff that an emergency/crisisexists at or near a [Montgomery County Public Schools]facility. It requires all students to be accounted for andunder supervision. Administrators may activate the on-siteemergency team and set up a command post when appro-priate. Administrators or their designees will notify staffand students via the public address (P.A.) system when aCode Blue is in effect. It is recommended that an “age-appropriate” announcement of a Code Blue include a briefdescription of the nature and location of the incident.

• When the administrator announces a Code Blue, allstudents should be accounted for in an instructional areaand be told to wait for further instructions. Classroominstruction may continue.

• Staff must document attendance and report anydiscrepancies to an administrator/designee when it issafe to do so.

• During a Code Blue, classroom lockdown is not required.• An administrator may activate the on-site emergency

team during a Code Blue via a P.A. announcement.• Depending on the Code Blue situation (the nature of the

emergency or potential threat), it may not be safe tochange classes. In these situations, class bells should beturned off and students/staff should remain in theirclassrooms until directed otherwise by the administra-tor/designee.

• Depending on the Code Blue situation, staff supervisingstudents outside may be requested to move students to apre-determined location inside.

In the sniper case, the decision to invoke CodeBlue was made while officers were en route to thesecond shooting. Dr. Weast attributed this decisionto explicit protocols for exchanging informationwith the police department, internal school staffdiscussions and knowledge of community behav-iors. Dr. Weast noted that school administratorsrelied on a network of relationships to make aninformed decision about going to Code Blue.

In the aftermath of the Columbine school shoot-ings, as well as after September 11 and the anthraxletters, schools officials reviewed and modifiedtheir security plans. That work produced the plansthat were put into effect during the sniper investi-

gation. In addition, the school system engaged in aseries of realistic training exercises to implementthe various security procedures, and conductedformal debriefings after all such events to learnfrom their experiences. This planning and prepa-ration, coordination with law enforcement, andleadership by school officials led to a response thatcan be instructive for other school systems.

According to Superintendent Weast, the snipercase pointed to a possible vulnerability inMontgomery County school preparations.Specifically, most school safety programs focusprimarily on violence by individuals who have alegitimate reason to be on campus, such as stu-dents or staff, but do not consider adequately peo-ple who do not have a reason to be on campus.School security plans should be examined in lightof this possibility.

School superintendents in both the D.C. andRichmond regions organized conference calls tocoordinate school security efforts in their respectiveregions. Many superintendents communicateddirectly with students and parents (see Appendix Mfor Arlington County Superintendent Smith’s letterto parents). The Richmond-area schools’ superin-tendents had a practice of meeting monthly to dis-cuss issues of mutual concern. The trust and com-munication patterns established in those meetingshelped them when they had to develop a unifiedresponse to the shootings and the resultant fear.

The concern in the Richmond-area schoolsincreased greatly on Day 6 when a 13-year-old stu-dent was shot in front of his Prince George’sCounty school. School superintendents relied on apre-incident “lock down” plan to limit access toschool buildings and minimize students’ exposure.Communication among school staff was accom-plished through cell phones, pagers, e-mail andfaxes. Dr. Stewart Roberson, Superintendent of theHanover County Public Schools in Virginia, visit-


47 This section is excerpted from the Montgomery CountyPublic Schools, Department of School Safety and Security’sEmergency/Crisis Plan Procedures. Additional materials canbe found in Appendix L.

80828_i-200.R7 10/8/04 12:07 AM Page 108

ed schools when they were in session, took hischild to the bus stop and answered calls at a hotline for concerned parents.

The Richmond-area schools received numerousmedia requests for interviews and stories. As muchas possible, the superintendents tried to follow anagreed upon plan of allowing local reporters pri-ority access. Close coordination among the super-intendents helped in working with the media, andwas the hallmark of all school security efforts.

Private SchoolsCoordination of security protocols among publicand private schools, including colleges and univer-sities, is important but varies by jurisdiction. Forexample, the Montgomery County School Systemcommunicated constantly with private schools inthe county through a variety of methods—tele-phone calls, Internet website updates, publishedmaterials and more. Montgomery County schoolstaffs included private schools in preparation andtraining for crisis response procedures. Similarly,when developing security plans, public school offi-cials should develop relationships with privateschool officials and principals, and create a list ofall schools and contacts in the area.

In contrast, the Richmond-area school systems didnot have a formal communication network withthe private school association before the shoot-ings. Consequently, the public and private schoolslacked strong coordination during the first fewdays, but diligently worked to improve it as theinvestigation wore on.

Administrators of private schools, just like theirpublic school colleagues, felt the pressure of ensur-ing the safety of their students. Many of theseadministrators expected the same police presenceas was provided to the public schools, and con-veyed their concerns to law enforcement adminis-trators. In some jurisdictions, law enforcementagencies were able to meet some of this demand,but in virtually every jurisdiction, the number ofprivate schools and day care centers exceeded theresources of law enforcement agencies. Some pri-vate school administrators were critical, therefore,

of law enforcement officials. Some even employedprivate security guards or off-duty officers to pro-vide a uniformed presence on school grounds.

Police-School CooperationThe Montgomery County School System hadgood relationships with the Montgomery CountyPolice Department prior to the sniper case, due inpart to the school superintendent’s effort. Thedirector of school safety and security, Ed Clarke,who held a position in the MCPD prior to joiningthe school system, also facilitated this partnership.Because of these relationships, the superintendentand his staff felt they were “inside” on every policedepartment action or briefing. This confidenceflowed down to the teachers and parents whobelieved the schools were getting accurate infor-mation. As a result, the school system and policedepartment initiated a series of coordinated pro-grams during the sniper investigation to increasesecurity, reduce fear and reassure the students.

“It’s all about relationships, and if you do not see the need for these

relationships you are bound to fail.” School Superintendent Jerry Weast, Montgomery County Public Schools

Law enforcement agencies and school systemsworked together in every jurisdiction to providesecurity and support to students, teachers andstaff. Listed below are some of their collaborativeefforts:

• The Montgomery County School System wasinvolved in the initial decisions to put cruisersin front of the schools closest to the shootingscenes. The superintendent, in interviews withPERF project staff, believed the decision-mak-ing process was appropriate for the circum-stances, and would not have changed how theprocess worked or which schools received ahigher level of attention.

• Officials from Washington, D.C.-area schoolsparticipated in some of the daily law enforce-ment conference calls, and Richmond-area


80828_i-200.R7 10/8/04 12:07 AM Page 109

school and law enforcement officials commu-nicated regularly about developments.

• The primary function for law enforcementagencies at the schools was to reduce fear andassist students and staff. Some officers wererelieved of other responsibilities so they couldwork solely with schools. MontgomeryCounty Deputy Chief William O’Toole madea point of standing with patrol officers for anhour each day in front of schools beforereporting to police headquarters for a 12- or16-hour shift.

• In most jurisdictions, law enforcement pro-vided a visible presence at arrival and depar-ture times. Officers engaged in dynamicpatrols in which they went from the highschools to middle schools to elementaryschools. Helicopters flew over the schools lowand loud. Officers and adult volunteersrelieved children from school crossing guardduties.

• In many jurisdictions, in an effort to promotevisibility and calm fears, police officers, sher-iff ’s deputies and state troopers went toschools at lunchtime and ate in the cafeteriaswith students.

• The Arlington County Police Department setup a command center consisting of police, fireand school representatives on those dayswhen school was in session.

Closing SchoolsSchool systems in the Richmond area closed onOctober 21 and 22 in response to the sniper shoot-ings. The decision to close schools was based onthreats against school children in the shooters’ let-ter left at the Ponderosa restaurant. TheRichmond-area superintendents received thatinformation on Sunday, October 20, while super-intendents in the Washington, D.C. area did notreceive the information until at least a day later.

Many individuals, including law enforcement andschool officials, were upset that information wasnot shared equally with all the superintendents.Others questioned whether this informationshould have had any bearing on the decision toclose schools, as the snipers had already shot a stu-

dent almost two weeks earlier. Still, others ques-tioned the decision to close schools primarilybecause they did not know what would have tochange before the schools could be reopened.

Complicating the matter even further is that whenthe schools were closed, unsupervised studentswere going to shopping centers, malls and otherpublic places. They were in just as much danger, ifnot more, than if they had been attending school.

In hindsight, law enforcement and school officialscautioned that any decisions about closing schoolsmust include a discussion of the reasons for clos-ing them, as well as what would have to changebefore they could be reopened.

C O N C L U S I O NDuring any event that threatens public safety andinduces fear so dramatically, it is crucial that locallaw enforcement agencies engage communitymembers. This is one role that local law enforce-ment officials are uniquely qualified to fill.Similarly, local agencies must ensure that crime vic-tims and their families are not forgotten. It is alsoimportant not to overlook the trauma to childrenfrom a high-profile crime, particularly in the snipercase when a student was shot arriving for the startof school. Schools instituted protocols to increasesecurity, cancel student activities and minimize thethreat to students. Parents looked to schools foradvice on what to tell their children, how to reassurethem, and for leadership. Pre-existing relationships,careful planning and preparation were the hall-marks of effective actions among school systems,just as they were in law enforcement agencies.Communicating information to those who mustmake informed decisions, and carefully weighingthe ramifications of decisions before making them,will help school and law enforcement collabora-tions achieve success in similar situations.

L E S S O N S L E A R N E DMaintaining Community Outreach

• Consistent with community policing, agenciesshould provide high visibility and a sense ofsecurity.


80828_i-200.R7 10/8/04 12:07 AM Page 110

• Media outlets can be asked to disseminateinformation about resident safety, includingprecautionary measures and what to look forin the event of an incident.

• Agencies should use community meetings toinform the public and reduce theirapprehension.

• Manuals for citizens on how to be good wit-nesses can empower those in close proximityto an incident.

• Crisis hotlines and websites should educateand inform communities.

• Agencies should educate the public on lawenforcement’s functions and procedures wheninvestigating a crime, which will help easecommunity frustration.

• When developing de-escalation plans to returnan agency to normal staffing levels, agenciesshould consider the effect on the community.

• Jurisdictions should develop a flexible planfor mental health services in the event of acommunity crisis.

• It is important for hotline call-takers tohandle calls as quickly as possible, with nowaiting times as the goal, while still beingresponsive to callers’ needs.

• All involved should be aware that when ahotline number is advertised people will call itfor all sorts of unrelated reasons. Hotline call-takers need to know how to transfer callsintended for law enforcement, or law enforce-ment may want to have someone availableonsite to handle those calls.

Accessing Victim Assistance• Agencies should develop a victim assistance

task force for coordinating services duringhigh-profile investigations.

• Law enforcement agencies and victim serviceproviders should remain sensitive to culturalnorms when providing such assistance asemotional support, counseling, insurance andemergency fund distribution.

• Victim service professionals should also devel-op plans for providing post-traumatic stresscounseling for victims’ families and commu-nity members as well as law enforcementemployees and their families.

Addressing School Safety• School administrators should be prepared to

deal with concerned parents and pay carefulattention to their overt messages as well asconsider what unintended signals they may bedelivering to parents, students and thecommunity.

• School security measures should be re-exam-ined in light of the sniper case—that is, howto deal with threats by individuals who do nothave a legitimate reason to be on schoolgrounds.

• School security plans should account forcommunication with key decision makers,integration of critical resources, standardiza-tion of policies and operations, cooperationwith other service providers and redundantsystems.

• Law enforcement can provide valuableassistance if included in the development ofschool security plans before a crisis occurs.

• During actual crises, law enforcement andschool officials must remain in close contact,and when necessary, make joint decisionsabout safety and security.

• During an incident, law enforcement andschool security staff must coordinate theiractions and responses to incidents.

• Public school officials should developrelationships with private school officialsprior to an incident.

• Before closing schools, carefully discuss thereasons for closing them, as well as what itwill take to reopen them.


80828_i-200.R7 10/8/04 12:07 AM Page 111

112

80828_i-200.R7 10/8/04 12:07 AM Page 112

C H A P T E R N I N E ■ Final Thoughts ■ 113

“It is amazing what you can accomplishif you do not care who gets the credit.”

Harry S. Truman

Twenty-three days, 14 shootings, 10 deaths:Thousands of law enforcement officers andfederal agents engaged in one of the largest

multijurisdictional investigations ever. Local, state,federal and even defense agency personnel partici-pated in an investigation that overnight captured theattention of communities from the Washingtonmetropolitan area to Europe and beyond. If mosthomicide investigations are handled methodicallylike a jigsaw puzzle, this case had the feel of a fast-paced hockey game with life or death consequences,sweeping into town with the intensity of a tornadoand leaving a community both traumatized andrelieved 23 days later.

In this report, those closest to the investigationprovided their candid assessment of the lessonslearned from this celebrated case. Their feedbackrevealed a number of themes that warrant furtherconsideration.

A S E N S E O F O R D E RInvestigations as complicated and visible as thesniper case require strong management and vision-ary leadership to bring order to the chaos. In mostlaw enforcement organizations, standard operatingprocedures govern criminal investigations. Mostpolice personnel are generally familiar with the basicprinciples of a homicide investigation. But in the

sniper case, these principles were ill-suited to addressthe cross-jurisdictional nature and complexity of thecrimes. Assistant Chief Bill O’Toole in MontgomeryCounty likened their response to starting a new cor-poration with no notice, little infrastructure and newpartners arriving each day. There was simply no wayto have planned for the rapid escalation of the crimesinto an expanding geographic area and the concomi-tant rapid infusion of federal resources. Overnight,one police agency had to improvise as its personneldetermined how best to accommodate cooperatingpolice departments from nearby jurisdictions as wellas additional federal law enforcement resources—allunder the watch of a determined media driven by 24-hour interest in a fast-paced story.

High-profile investigations, especially a multi-jurisdictional investigation under the direction ofa task force, can strain familiar roles and responsi-bilities. The professionals involved in this case,however, effectively addressed that strain throughdedicated efforts built on trust and respect. Whilethere was a central task force in MontgomeryCounty, satellite task forces also operated inSpotsylvania County, Prince William County,Fairfax County and central Virginia.Consequently, it was possible, as many jurisdic-tions found, to participate in a central task forceand simultaneously focus on the homicide(s)within the local area. The same held true for devel-oping media and patrol plans, as well as addressinglocal community concerns. Each jurisdiction’sexecutive recognized the importance of being partof both a large multijurisdictional task force whilealso overseeing the management of the homicide

C H A P T E R N I N E

Final Thoughts

80828_i-200.R7 10/8/04 12:07 AM Page 113

case within his or her own jurisdiction. When thehomicide occurred at the Home Depot in FairfaxCounty, it was important for the local chief, TomManger, to announce the information on the inci-dent and for both the Fairfax County as well asMontgomery County task forces to provide fol-low-up information. Balancing the importance oflocal responsibility and visibility with a unifiedregional response proved highly effective.

Throughout the investigation, leadership was criticalto success. In the sniper case a triumvirate of leaders(Moose, Bald, Bouchard) developed within the cen-tral task force in Montgomery County, whichproved both functionally and symbolically impor-tant in a case with both local and regional concerns.Equally important, however, were the other taskforces in Fairfax, Spotsylvania and Prince WilliamCounties and central Virginia. They played a vitalrole in coordinating resources in their own jurisdic-tions while contributing resources to the centralMontgomery County task force.

As Chapter Two revealed, there is no “correct”answer to the question of who should lead aninvestigation that spreads across different jurisdic-tions. In the sniper case, the top leaders represent-ed local and federal resources. The local executivein Montgomery County had the first and the mostshootings. But in other cases the leadership may bedriven by other considerations. In the early stagesof a developing multijurisdictional case, relevantstakeholders need to support the task force leaderand keep one another well informed by using goodcommunication strategies (conference calls, meet-ings and e-mail) as was done in the sniper case. Aswe indicated earlier, chief constables in the UnitedKingdom discuss among themselves and designatewhich of them is best prepared to lead the investi-gation. Clearly, the leader of this kind of compli-cated investigation should be someone who is wellrespected for his or her leadership and problem-solving abilities, and who puts the interest of thecase and public safety above all other issues.

C O M M U N I C AT I O NAs Chapter Two also details, communication was acentral theme in the investigation. The major chal-

lenges included finding mechanisms to dissemi-nate information from the tip lines, to share inves-tigative leads throughout the region and to collectand redistribute other information such as licenseplate data from roadblocks and routine trafficstops. These challenges will be faced in any large-scale investigation and can be more effectivelymanaged by both a unified information manage-ment system and strong leadership at the chiefexecutive level. VICAP and other national systemshave the potential to serve as an early warning tocommunities in cases like this.

Some felt that the task force could have done a bet-ter job in disseminating information about thecase. However, as pointed out by a number of offi-cials, this case just did not have that much infor-mation to disseminate. Compounding the lack ofinformation was the concern of key decision mak-ers about the frequent leaks of vital information tothe media. In some cases, evidence that wasreported by the media, such as the tarot card dis-covered at the crime scene in Prince George’sCounty, proved a major complicating factor inestablishing communication with the suspects.Managing information and communicationsproved central to this case and will be a significantcomponent of any major investigation of this type.

When we asked task force leaders and investigatorshow they balanced the need to keep everyoneinformed with trying to guard against the prema-ture release of information, they indicated thatthis was a constant challenge. There was not onecentral communication mechanism for all aspectsof the investigation nor should there be. But welearned that chiefs felt the need to sometimes talkamong themselves to discuss management issuesand develop appropriate protocols. FBI and ATFagents also wanted to talk with their counterpartsabout how best to assist in the investigation. Localinvestigators also saw the importance of sharinginformation with their colleagues. Each group hasslightly different needs, and types of informationthat they need to discuss in order to developappropriate strategies. While some might viewthis as fragmented, it was necessary in the snipercase. So, for example, the FBI SAC in Baltimore

114 ■ Final Thoughts ■ C H A P T E R N I N E

80828_i-200.R7 10/8/04 12:07 AM Page 114

needed to communicate with the FBI SAC inRichmond to share important information on twotask forces that were 150 miles apart. Similarly, thepolice chiefs in D.C. and Fairfax, Prince Williamand Montgomery Counties also needed to be inregular communication with each other. Still, all ofthe major stakeholders communicated through aregularly scheduled conference call that hadalready been put in place by the FBI WashingtonField Office with the Metropolitan PoliceDepartment as a result of the September 11 attackon the Pentagon. The local chiefs facilitated thecalls both before and after the sniper shootings.After the investigation began, the frequency of thecalls increased from weekly to daily, and some-times two or three times a day. Also, the FBI tooka more active role in the calls, similar to its role justafter September 11. What is important to recog-nize is that there are limitations to what can besaid during a conference call and that each of thesubgroups will be more effective in sharing moredetailed information about specific leads andstrategies in smaller working groups.

One strategy that some have suggested could provebeneficial in a large-scale investigation of this typeis a COMPSTAT-style meeting on a weekly basis.COMPSTAT, shorthand for Computer Statistics, isa highly effective management information systemfamiliar to most law enforcement agencies andused to share crime information and to developand track crime strategies. In the case at hand, onecould imagine selecting an amphitheater facilityand inviting to the meeting representatives of all ofthe jurisdictions where a homicide had occurredas well as from surrounding jurisdictions. Policechiefs, supervisors, investigators and federalauthorities would all be present. Importantly, themeeting would be moderated by someone withoutany agency affiliation and who would be effectiveat drawing out each important aspect of the case.Ground rules should be established so the meetingwould be productive and informative. Lead inves-tigators might review the status of the investiga-tion. Discussion of regional patrol strategies couldbe presented. Media ground rules could be dis-cussed. Questions could be fielded and candid dis-cussion could follow. The overall objective would

be to share information on the possible leads,develop operating strategies and policies wherenecessary, and use this occasion to solicit newideas and suggestions.

An important part of a meeting like this, beyondsimply sharing information, is to encourage alter-native theories for the investigation and to re-ana-lyze information to see if any leads were overlookedor improperly ruled out. A meeting that brings var-ious elements of the case together helps all playersshare information and encourages creative think-ing—which could be a valuable unifying element ina complicated multijurisdictional case.

B A L A N C I N G D E M A N D SA complex investigation like the sniper caseinvolves much more than managing law enforce-ment information. The public, media and govern-ment officials all play key roles in exchanging anddisseminating information related to a case.Trying to manage those multiple and sometimescompeting demands was a challenge during thesniper case.

Efficient information management is critical tothe investigative leaders. Most officials interviewedfor this project emphasized the need to maintainperspective on the actual investigation compo-nent, as well as other events associated with thecase. It was also important to not lose focus onunrelated crimes that threaten the public’s safety.Information, when shared among executives, canhelp everyone see the big picture. The advice to“avoid tunnel vision” was repeated by many offi-cials. Their clear recommendation is to solicit asmany opinions as possible rather than listening tojust one or two confidants.

Investigators and managers need to keep an openmind about alternative strategies and the unrelia-bility of witness identifications. In the sniper case,based on key information received from witnesses,investigators were given a particular vehicle andsuspect description. As one chief later observed,“We were looking for a white box truck with awhite male, but later on we discovered we hadinformation about the suspects being two black


80828_i-200.R7 10/8/04 12:07 AM Page 115

males in a blue Chevy Caprice.” Suspect identifica-tion is only as effective as witnesses’ observations,and we know that eyewitness accounts are notalways accurate.

But the investigative focus on the white box truckwas about more than just what witnesses thoughtthey saw. It also was about the public’s need forinformation, media competition for exclusive newsand the commitment of law enforcement officialsto solve the case. In future cases, executives may wellfind that these three forces can converge to createtremendous interest in and scrutiny of the smallestbits of information gathered from even a single wit-ness. The pressure on law enforcement officials tosolve the sniper case was intense, as it will be for anyofficials who must one day face the challenges ofother multijurisdictional investigations.

I N T A N G I B L E SWe heard repeatedly about the importance of per-sonal relationships in establishing trust andstrengthening communications. For example, ATFSAC Michael Bouchard reported having excellentrelationships with local law enforcement, bol-stered by regular meetings with area agencies. Inaddition, Washington-area chief executives werequick to point out that they had established anexcellent working relationship with the FBIWashington Field Office and that they had cometo trust and respect the SAC, Van Harp. (Van Harpindicated that he felt the same way about thechiefs.) So when the sniper case first broke, VanHarp immediately offered to oversee staffing ofthe tip line and to expand access to the existingarea-wide conference call used by law enforcementexecutives. In central Virginia, Sheriff Cook, thearea chief executives and their FBI SAC had estab-lished regular meetings prior to this incident.When the sniper case reached Richmond, thisgroup literally worked in one room together.Similarly, federal agents and investigators fromlocal police departments who had collaborated onother high-profile cases (the Starbucks murders orthe CIA murders) also drew on their previousworking relationships. In Baltimore, however, FBISAC Gary Bald had only been in his assignment inthe field office for three days before the first shoot-

ings occurred. He had not yet met ATF SACMichael Bouchard. Bald and Chief Moose also hadto get to know one another under the most tryingof circumstances. Months after the investigationboth men looked back on this period as havingbeen successfully “joined at the hip.” So while it isadvisable to establish working relationships dur-ing non-stressful times, the JOC commanders’relationship demonstrates that professionals whofocus on problem solving and case managementcan overcome lack of familiarity.

As Chapter Seven demonstrates, the importance ofpersonal relationships with the media cannot beoverstated. There were a number of occasionswhen releasing certain information to the publiccomplicated investigators’ strategy, so balancingthe public’s right to know, the media’s need tocompete and the mandate to run an effectiveinvestigation was important. In many cities, policechiefs and federal agents make a point of establish-ing relationships with reporters and editors duringnon-crisis times so they are better able to commu-nicate the background on the case or ask for themedia’s cooperation when an investigation reach-es a sensitive point. When the case is alreadyunderway is not the time to ask for understanding.

P R E P A R AT I O NIt would be difficult to know how any agencywould respond to a multijurisdictional homicidecase like the sniper case. Montgomery County,Maryland, a community of approximately onemillion people, experiences about 20 homicides inan average year. On October 3, it saw five homi-cides in 90 minutes. Chief Moose noted in his firstpress conference that the homicide rate for thecounty had just increased by 25 percent.

How well any community responds to a case likethis will inevitably have to do with its ability toprepare for the unexpected. Agency executiveshave to continually ask themselves, “What if? If wehad a sniper case, what would we do?” Some of themajor questions to consider include the following:

• How would we determine who should takethe lead?


80828_i-200.R7 10/8/04 12:07 AM Page 116

• Where would the task force be headquartered?• What is our relationship with federal

agencies?• What is our media plan?• What would we do to keep our own patrol

forces well briefed?• How would we communicate with the public,

victims and suspects?• Do we have memoranda of understanding

(MOUs) with other agencies?• What kind of information management

systems do we have and what systems doother agencies use?

• What are everyone’s roles and responsibilities?• How do we effectively communicate within

our own agency, with other agencies and withthe public?

• How do we evaluate our effectiveness?

We would strongly encourage chiefs from adjoin-ing communities to meet periodically to addresstogether these and the other questions that pepperthis report, perhaps even to develop a plan theywould agree to follow in the event of a crisis suchas the sniper shootings.

R O L E D E F I N I T I O NEvery case will be different, but what we have comeaway with in talking to the key players in the snipercase is that everyone has an important role to playand that the coordination of these roles is centralto success. Problems occurred when the roles wereunclear. For example, investigators are accustomedto working on their own with little direct supervi-sion. In a high-profile case such as this, lawenforcement agency senior administrators werepressured to be more involved in the actual man-agement of the investigation. This has the unin-tended consequence of creating new operatingprinciples that can run contrary to usual investiga-tive protocols. As Chapter Two reveals, some inves-tigators felt that senior-level managers lacked trustin their work, while some senior-level managersfelt some investigators acted too independently.This is not surprising, nor should it cause anyalarm. It is the natural result of a case with suchhigh visibility. Chiefs understood this dynamicand reiterated the importance of letting “investiga-

tors investigate” and “chiefs manage.” In fact, ChiefMoose and Chief Ramsey reiterated this point byemphasizing to their command staff the need toget out of the way and let investigators work. Manychiefs recognized the most important role they canplay is to support investigators in their work.There clearly is also an important support role foragency chief executives in making sure that infor-mation management and communications sys-tems (telephone and radio communication, tiplines, case management systems, data managementand criminal information databases) are effectivewithin their own agency and that there are mech-anisms for sharing information with surroundingagencies.

* * * * *

In all the interviews we conducted with chief exec-utives involved in the sniper case, there seemed tobe an acute awareness of just how important thiscase was because of the many jurisdictionsinvolved under the glare of an internationalmedia. There was a realization that what everyonedid was vital to the success of the investigation.From the local investigators to the patrol officersto the ballistic examiners to the federal agents tothe special weapons officers—everyone played animportant role. In a profound way, this case testedthe limits of the law enforcement community—and had the effect of increasing the pride that offi-cers take in their work. Indeed, both off-duty andretired officers wanted to help, as did law enforce-ment professionals from around the nation whocalled to offer their services.

Was this investigation without challenges, withoutconflicts, without missteps? Absolutely not. Butgiven the huge number of officers involved and thedeluge of information flowing into the task forces,we were struck by the professionalism personneldemonstrated. The agencies involved put in placea new company in less than three weeks, estab-lished new operating rules, and undertook a hugeinvestigation spanning more than 2,500 squaremiles, in what amounted to finding a needle in a


80828_i-200.R7 10/8/04 12:07 AM Page 117

haystack. Two suspects with a rifle were identified,arrested and convicted of one of the most trauma-tizing crimes in the history of the country. The les-sons from this case will serve as an importantblueprint for those law enforcement executiveswho will be challenged by similar cases in thefuture.


80828_i-200.R7 10/8/04 12:07 AM Page 118

R E F E R E N C E S ■ 119

Bureau of Alcohol, Tobacco, and Firearms.October 1999. Critical Incident ManagementHandbook. Washington, D.C.

Cannon, Angie and U.S. News and World ReportStaff. 2003. 23 Days of Terror: The Compelling TrueStory of the Hunt and Capture of the BeltwaySnipers. New York: Pocket Books.

Horwitz, Sari and Michael E. Ruane. 2003. Sniper:Inside the Hunt for the Killers Who Terrorized theNation. New York: Random House.

Moose, Charles. 2003. Three Weeks in October: TheManhunt for the Serial Sniper. New York: PenguinUSA.

Pastore, Richard. February 15, 2004. “Taking IT tothe Streets.” CIO. Framingham, MA.

Shores, Lisa. Forthcoming. Planning an IncidentCommand Center: The Value of Cross-AgencyComparisons, An Example from the Charlotte-Mecklenburg (NC) Police Department. Washington,D.C.: Police Executive Research Forum, Preparedfor the Department of Homeland Security, Office ofDomestic Preparedness.

Substance Abuse Mental Health ServicesAdministration (SAMHSA). February 2004. LessonsLearned from the Metropolitan Washington PublicPsychological Response to the 2002 Sniper Attacks.Final Report of the October 30, 2003 Mental HealthResponders’ Workgroup. Sponsored by the Districtof Columbia Department of Mental Health.Washington, D.C.

R E F E R E N C E S

80828_i-200.R7 10/8/04 12:07 AM Page 119

120

80828_i-200.R7 10/8/04 12:07 AM Page 120

A P P E N D I X A ■ 121

The following individuals generously gavetheir time and expertise to make this doc-ument a better product. Their ranks and

agency affiliations are listed as of the time of thesniper incident. With so many interviews beingconducted, no doubt someone will have beeninadvertently left off the list. We value everyone’sinvolvement, even those who emerged from thisprocess anonymously.

Alcohol, Tobacco, Firearms and ExplosivesSpecial Agent in Charge Michael Bouchard,

Baltimore Field Office

Special Agent April Carroll,Prosecution Task Force

Special Agent Victor Castro,Prosecution Task Force

Special Agent Scott Riordan,Prosecution Task Force

Arlington County Police DepartmentChief Edward Flynn

Captain Mary Gavin, Operations DivisionDeputy Chief Rebecca Hackney,

Operations DivisionDeputy Chief Steve Holl, Office of

Emergency ManagementCaptain Tonya Woodson, Acting Deputy Chief,

Operations Division

Ashland Police DepartmentChief Frederic Pleasants, Jr.

Lieutenant George Hansen, Patrol Investigator Nelson Douglas Jenks Officer Patrick Meacham, Patrol

Chesterfield County Police DepartmentChief Carl Baker

Major James P. Bourque, Investigations BureauDeputy Chief, Lieutenant Colonel Dennis

McDonald

DC Metropolitan Police DepartmentChief Charles Ramsey

Captain Michael Anzallo, Violent Crimes UnitLieutenant David Jackson, Violent Crimes UnitDetective Tony Patterson, Violent Crimes Unit

Fairfax County Police DepartmentChief J. Thomas Manger

Officer Eduardo Azcarate, Patrol BureauDetective June Boyle, Prosecution Task ForceLieutenant Colonel Sue Devlin, Deputy Chief for

AdministrationDetective Chris Flanagan, Prosecution Task ForceSecond Lieutenant Bruce Guth, Supervisor,

Prosecution Task Force Second Lieutenant Kevin Holmes, Patrol BureauMajor Frank Kitzerow, Commander, Criminal

Investigations BureauOfficer Drew McDonald, Patrol Bureau

A P P E N D I X A

Individuals Interviewed During the Project by PERF Staff

80828_i-200.R7 10/8/04 12:07 AM Page 121

Lieutenant Colonel Charles K. Peters, DeputyChief of Police for Patrol

Lieutenant Colonel David Rohrer, Deputy Chiefof Investigations/Operations Support

Captain Tom Ryan, Patrol BureauMajor Frank A. Wernlein, Commander,

Patrol Bureau

Federal Bureau of InvestigationSpecial Agent in Charge Gary M. Bald, Baltimore

Field Office

Supervisory Special Agent Lawrence J. Barry,Chief Division–Counsel, Richmond Field Office

Supervisory Special Agent Stephen E. Etter, UnitChief, Behavioral Analysis

Assistant Special Agent in Charge RobertGwaltney, Richmond Field Office

Assistant Director in Charge Van Harp,Washington Field Office

Supervisory Special Agent Mark Hilts, BehavioralAnalysis

Unit Chief Ronald T. Hosko, Critical IncidentResponse Group, Crisis Management Unit

Supervisory Special Agent Steven D. Irons,Richmond Field Office

Douglas V. Jones, Administrative Officer,Richmond Field Office

Special Agent Michael A. McCoy, ProsecutionTask Force

Supervisory Special Agent David T. Resch,Crisis Management Unit

Supervisory Special Agent Lloyd Sigler,Crisis Management Unit

Special Agent Lawrence B. Smith, RichmondField Office

Special Agent in Charge Donald W. Thompson, Jr.,Richmond Field Office

Special Agent in Charge Steven Wiley, CriticalIncident Response Group

Hanover County Public SchoolsSuperintendent Stewart Roberson

Hanover County Sheriff’s OfficeSheriff V. Stuart Cook

Captain Allen R. Davidson, Commander,Patrol Operations

Lieutenant Kenny B. Epling, InvestigativeOperations Division

Major David R. Hines, Field Operations DivisionInvestigator Glenn R. Schneider, Investigative

Operations Division

Maryland State PoliceSuperintendent David B. Mitchell

Major Charles T. Bowers, Commander,Criminal Enforcement Command

Detective Sergeant Daniel D. Cornwell,Criminal Intelligence Division

First Sergeant Bryan K. Davy, AssistantCommander, Rockville Barracks

Lieutenant Lawrence W. Grasso, AssistantCommander, Firearms Enforcement Division

Captain Andrew J. McAndrew, CriminalIntelligence Division

Lieutenant David C. Reichenbaugh, OperationsCommander, Criminal Intelligence Division

Tom Steel, Chief of Information Technology Bureau

Lieutenant Thurl W. Tower, Commander,Rockville Barracks

Montgomery County GovernmentCounty Executive Douglas M. Duncan,

Montgomery County

Chief Administrative Officer, Bruce F. Romer,Montgomery County

Montgomery County Police DepartmentChief Charles Moose

Ellen Alexander, Director, Victim ServicesLieutenant John Damskey, Field Services BureauCaptain Nancy Demme, Public

Information Officer Captain Barney Forsythe, Director,

Major Crimes Division

122 ■ A P P E N D I X A

80828_i-200.R7 10/8/04 12:07 AM Page 122

Lieutenant Rodney Hill, Legal Advisor Lieutenant Mike Mancuso, Deputy Director,

Criminal Investigations DivisionCaptain Brian McManus, Investigative

Services BureauAssistant Chief William O’Toole Lieutenant Philip Raum, Deputy Director, Major

Crimes DivisionStephen Souder, Director, Emergency

Communications DivisionSergeant Roger Thomson, Major Crimes DivisionCaptain Drew Tracy, Commander, Third

District StationAssistant Chief Deirdre Walker, Investigative

Services Bureau

Montgomery County Public SchoolsSuperintendent Jerry Weast

Edward Clarke, Director of School SafetyBrian Porter, Director of Communications

Prince George’s County Police DepartmentChief Gerald Wilson

Captain Eric Bowman, Criminal Intelligence Division

Prince William Community Services BoardVickie Taylor, Prince William County

Community Services Board, Youth, Adult andFamily Services Division Manager

Prince William County Police DepartmentChief Charlie T. Deane

Sergeant Richard A. Cantarella, CriminalInvestigations Division

Captain Raymond T. Colgan, Uniform DivisionDetective Sandra M. Conlon,

Major Property Crimes Captain Ted S. McInteer,

Western District CommanderAssistant Chief Ron Sullins, Criminal

Investigations DivisionMajor Daniel E. Taber, Assistant Chief,

Operations Division

Richmond School SystemSuperintendent Deborah Jewel

Spotsylvania Sheriff’s OfficeSheriff Ronald Knight

U.S. Attorney’s OfficePaul McNulty, U.S. Attorney

Eastern District of Virginia

U.S. Capitol PoliceChief Terrance Gainer

U.S. Marshal’s ServiceSupervisory Inspector Leonard DePaul, New York

City Regional Dangerous and Violent FelonyFugitives Group

Chief Deputy Donald S. DonovanRon Libbey, Technical ServicesChief Inspector Brian Maxwell, Investigative

Services Division

U.S. Secret ServiceSpecial Agent in Charge Michael Stenger,

Washington Field Office

Virginia State PoliceSuperintendent W. Gerald Massengill

Lieutenant George W. Austin, Jr., Bureau ofCriminal Investigations

Trooper David Randolph GrayLieutenant Rick A. Jenkins, Bureau of

Criminal InvestigationsLieutenant J. Thomas Martin, Bureau of Field

Operations, Division XII Headquarters Special Agent C. Wayne Sumner, Bureau of

Criminal Investigation

Washington/Baltimore HIDTAThomas H. Carr, Director

Glenn Fueston, Program Manager,Computer Training

Lieutenant Terri Wilkin, Maryland State Police,Supervisor, Strategic Analysis, HIDTA

A P P E N D I X A ■ 123

80828_i-200.R7 10/8/04 12:07 AM Page 123

124

80828_i-200.R7 10/8/04 12:07 AM Page 124

A P P E N D I X B ■ 125

Investigator Focus GroupMark de Almeida, Program Manager, Rapid

Deployment Logistics Unit, FBI, Quantico Joe Anarumo, Group Supervisor, ATF,

Hyattsville Field Office Detective June Boyle, Fairfax County

Police Department Supervisory Special Agent Kevin Crawford,

VICAP, FBI, Quantico Captain Nancy Demme, Public Information

Officer, Montgomery County Police Department

Joni Durham, Case Information ManagementSpecialist, Rapid Deployment Logistics Unit,FBI, Quantico

Chief Pat Englade, Baton Rouge Police Department

Special Agent Brad Garrett, FBI,Washington Field Office

Detective Jeff Gomes, Bellevue PoliceDepartment, Washington State

Captain Joseph Herbert, New York Police Department

Supervisory Special Agent Linda Hooper, FBI,Baltimore Field Office

Wayne Koka, Major Case Specialist, FBI, CriticalIncident Response Group

Captain Paul Maranto, East Baton Rouge ParishSheriff ’s Office

Supervisory Special Agent Mary Ellen O’Toole,Behavioral Science Unit, FBI, Quantico

Captain Wendell Raborn, Lafayette ParrishSheriff ’s Office

Lieutenant Phil Raum, Montgomery CountyPolice Department, Major Crimes Division

Chief Terrence Sheridan, Baltimore County Police Department

Sergeant Roger Thomson, Montgomery CountyPolice Department, Major Crimes Division

Detective James Trainum, DC Metropolitan Police Department

Sergeant Ike Vavaseur, Baton Rouge Police Department

Detective Superintendent Mark Warwick,Thames Valley Police, England

Media Focus GroupSergeant Kim Chin, Supervisor, Public

Information Office, Prince William CountyPolice Department

Captain Nancy Demme, Public InformationOfficer, Montgomery County Police Department

Sergeant Joe Gentile, Director, PublicInformation Office, D.C. Metropolitan Police Department

Mary Ann Jennings, Director, Public InformationOffice, Fairfax County Police Department

Lieutenant Amy Lubas, Fairfax County Police Department

Major Greg Shipley, Commander, Office of MediaCommunication, Maryland State Police

Bill Toohey, Director, Public Information,Baltimore County Police Department

A P P E N D I X B

List of Focus Group Participants

80828_i-200.R7 10/8/04 12:07 AM Page 125

126

80828_i-200.R7 10/8/04 12:07 AM Page 126

A P P E N D I X C ■ 127

A P P E N D I X C

SNIPEMUR Task ForceRecommendations for State and

Local Law Enforcement Agencies

October 16, 2002

Charles A. Moose, Ph.D.

Montgomery County (MD) Police Department

Reprinted with permission from the Montgomery County Police Department.

80828_i-200.R7 10/8/04 12:07 AM Page 127

Regional Tactical Response Plan

Objective: To capture the sniper immediately following a shooting event by responding quickly and uni-formly throughout the metropolitan area.

The primary focus must be to slow down traffic at strategic points until tactical/air/supportunits are in place. Once these additional resources are in place, traffic will be released slow-ly so that officers may safely apprehend a fleeing suspect.

Resources: Uniformed patrol officers Covert surveillance teams Tactical unitsAir support units (helicopters, airplanes) Canine unitsRemote traffic management centersEmergency Broadcast System

Principal Strategies:• Using a map and an overlay with concentric rings indicating 3, 5, 7 and 10 mile points from the center

of the overlay, identify significant traffic points along main arteries• Rapid dispatch and response by patrol officers to main arteries and at the appropriate choke points

(dependent on time elapsed from event) along with simultaneous dispatch of other resources (air,covert, tactical, K9 etc.)

• Patrol officers must stop all traffic at their assigned posts until other resources are in place• Once support resources are in place and ready, patrol officers open up their traffic points allowing traf-

fic to move in a “slow release”; patrol officers monitor flow until replaced by covert resources• A sighting of the suspect vehicle would be followed by air and ground surveillance until a tactical stop

can safely be made. This tactic enables better control of a confrontation with a potential suspect whencompared with a traditional roadblock.

Subordinate Strategies:• Immediate broadcast of the suspect vehicle description via the Emergency Alert System• Immediate display of suspect vehicle description on interstate message boards• Using remote signal controls (if available), slow traffic by activating red lights on major arterials lead-

ing away from the incident

Pre-Planning:• Each agency should develop a plan to implement this strategy.

128 ■ A P P E N D I X C

80828_i-200.R7 10/8/04 12:07 AM Page 128

Investigative Response Plan

First Responders

• Tactical Plan: Implement your local tactical plan.• Perimeter: Establish an inner perimeter.• Outer Perimeter: Establish an outer perimeter 300-500 yards.• Witnesses: Gather, isolate, and interview witnesses for statements.

- Witnesses should be taken to a secure location to avoid potential as a secondary target.• Notification: The jurisdiction Emergency Communication Center should make an immediate phone

call to the Task Force Tactical phone (XXX) XXX-XXXX (this line is dedicated for emergency notification only).

- Lookout from originating jurisdiction ECC to Task Force Tactical Center.- Leave an open line between the jurisdiction ECC and the Tactical Center.- The Tactical Center will contact our air assets (the communication needs to be maintained

between the originating jurisdiction and the Tactical Center.)• Cruiser Cameras: If patrol cruisers are equipped with cameras, turn the cameras on as soon as there is

a report of a shooting.• Secure Crime Scene: ATF would like to have primary jurisdiction for evidence collection and

processing.• Videotapes: Identify and seize surveillance videotapes from stores, banks, gas stations, etc.

Investigators

• Incident Summaries: Provide a summary of all incidents to be included in search warrant applications.• Evidence List: Provide a list of items to be seized in the service of search warrants.• Coordination: Coordinate with Task Force investigators in joint investigation of incidents.

Task Force Resources (if requested)

• ATF Mobile Evidence Laboratory: Includes a ballistics expert and chemist on-site.• Canine Assets: Bomb dog, gunshot residue.• Investigators: Canvass, witness interviews, crime scene searches and search and seizure warrants.• Air assets: Aerial photography, pursuit assistance and surveillance.• Videotaping: Spectators and crime scene.• Local Liaison on Task Force: To provide coordination of all investigative efforts.• Will provide lookout to Maryland State Police Headquarters in Pikesville who will send a NAWAS

(National Attack Warning Alert System) message, which will provide the lookout to all 911 centers inMaryland, DC, and Virginia.

A P P E N D I X C ■ 129

80828_i-200.R7 10/8/04 12:07 AM Page 129

Information Control

Objectives: All leads pertaining to the SNIPEMUR investigation should be documented on anInformation Control form. Leads include information received from citizens and police offi-cers’ observations to include, but not limited to, traffic stops that may relate to this investiga-tion. The following directions are offered for the completion and submission of the form.See a copy of the attached Information Control form.

• The only fields that are required to be completed on the Information Control form are thefollowing listed fields:- Source- Source’s full name (may be officer’s name)- Affiliation- Source’s address or officer’s department name- Phone #- Contact number- Information Received Date- Time- Prepared by- Officer’s name and department- Event Narrative:

° If applicable, list suspect’s full name and all available identifiers° If applicable, list vehicle registration number and full vehicle description° If applicable, list location of incident° List all other applicable information

• Information Control forms should be faxed directly to the Joint Operations Center at(XXX) XXX-XXXX

• Dispatch Protocols- Emergency communication centers in the metro area have been floodedwith calls for suspicious vehicles. We recommend that the following dispatch and call-takingprotocols be implemented to ensure that street-level assets are not totally overwhelmed:- Call takers should ask whether vehicle in question demonstrates specific lookout

characteristics (i.e., make, model, roof-rack, etc.)- Call takers should inquire whether a license plate number was observed or noted by the

complainant

If the vehicle/operator is engaged in suspicious activity, then dispatch is recommended, per your depart-ment’s protocol. If the information is vague or otherwise inconsistent with recent lookouts, then no furtheraction is recommended. If the information provided by the caller is consistent with recent lookouts, thenthe call-taker or responding officer should attempt to obtain a license plate number. This informationshould then be documented on an information control log sheet and forwarded for entry into Rapid Start.Traffic stops may be initiated upon articulable suspicion, given the specific lookout, the time of the offenseand the proximity of the vehicle to the location of the shooting.

130 ■ A P P E N D I X C

80828_i-200.R7 10/8/04 12:07 AM Page 130

Media Response Plan

The SNIPEMUR incidents have generated some of the most intense media scrutiny in recent memory andcontrol of the information you provide may be critical to both the effectiveness and the integrity of theinvestigation. We have found that a consistent media strategy among partner agencies across jurisdictionalboundaries provides for a more effective and unified response to media inquiries.

Members of the media will hear the incident on your radio channels and rapidly respond to the scene.They will also immediately begin calling into your media section for confirmation that the shooting isrelated. Prior to providing any confirmation that the incident in your jurisdiction is similar to the demon-strated pattern, we recommend the following standard response to inquiries: “This incident appears to besimilar in nature to the other shootings in the area and our officers (from jurisdiction where it occurred) andofficers from the task force are responding to investigate.”

We highly recommend that you send at least two (2) PIOs directly to the scene and set up a media stagingarea after conferring with the investigators. It is critical that you not allow the media to compromise theinvestigation or infringe in any way on a potential crime scene. Given the nature of this incident and therecommended parameters of the crime scene area, you should consider a media staging area outside ofthose parameters, or at least three to five hundred yards from the victim.

In the event the shooting is later confirmed as being linked to others in the area, the following confirmationstatement should be offered: “Evidence has been recovered by investigators that links this case to others in thearea.” Please do not indicate the specific type of evidence that provides the link (i.e.: ballistics). This gener-al confirmation is designed to leave the shooter(s) wondering if other evidence besides ballistics was recov-ered (i.e.: hair).

If at all possible, prevent media from talking to witnesses on the scene, and especially before investigatorshave had an opportunity to debrief them. Inform all law enforcement officers and investigators on the casethat they should not answer any media questions. Defer all media inquiries and requests to the designatedmedia spokesperson. There is a PIO attached to the task force that can be made available to provide furtherguidance if needed. We highly recommend that your PIO contact PIOs attached to the task force for fur-ther guidance relevant to this case.

Remember that any information that is divulged intentionally or otherwise becomes information about thiscase that is known by the perpetrator(s).

A P P E N D I X C ■ 131

80828_i-200.R7 10/8/04 12:07 AM Page 131

132

80828_i-200.R7 10/8/04 12:07 AM Page 132

A P P E N D I X D ■ 133

Sec. 540B. Investigation of serial killings(a) In General.—The Attorney General and the

Director of the Federal Bureau of Investigationmay investigate serial killings in violation of thelaws of a State or political subdivision, if suchinvestigation is requested by the head of a lawenforcement agency with investigative or prosecu-torial jurisdiction over the offense.

(b) Definitions.—In this section:(1) Killing.—The term ``killing’’ means conductthat would constitute an offense under section1111 of title 18, United States Code, if Federaljurisdiction existed.

(2) Serial killings.—The term ``serial killings’’means a series of three or more killings, not lessthan one of which was committed within theUnited States, having common characteristicssuch as to suggest the reasonable possibility thatthe crimes were committed by the same actor oractors.(3) State.—The term ``State’’ means a State ofthe United States, the District of Columbia, andany commonwealth, territory or possession ofthe United States.

(Pub. L. 105-314, title VII, Sec. 701(a), Oct. 30,1998, 112 Stat. 2986.)

A P P E N D I X D

Serial Sniper Law28 USC 540B

TITLE 28—JUDICIARY AND JUDICIAL PROCEDUREPART II—DEPARTMENT OF JUSTICE

CHAPTER 33—FEDERAL BUREAU OF INVESTIGATION

80828_i-200.R7 10/8/04 12:07 AM Page 133

134

80828_i-200.R7 10/8/04 12:07 AM Page 134

A P P E N D I X E ■ 135

A P P E N D I X E

Chief Charles A. Moose’s LetterRequesting Federal Assistance


80828_i-200.R7 10/8/04 12:07 AM Page 135

136 ■ A P P E N D I X E

80828_i-200.R7 10/8/04 12:07 AM Page 136

A P P E N D I X F ■ 137

A P P E N D I X F

Joint Operations Center Floor Plan Template

Reprinted with permission from the Bureau of Alcohol, Tobacco, and Firearms’ Critical Incident Management Handbook, October 1999.

80828_i-200.R7 10/8/04 12:07 AM Page 137

138 ■ A P P E N D I X F

80828_i-200.R7 10/8/04 12:07 AM Page 138

A P P E N D I X G ■ 139

A P P E N D I X G

Fairfax County (VA) PoliceDepartment and Prince WilliamCounty (VA) Police Department Briefings Provided to Officers

• Need To Know, Volume 1, Special Edition, Published by the Criminal IntelligenceUnit, October 10, 2002, Fairfax County Police Department

• Sniper Murders Daily Briefing, October 21, 2002, 0900 hours, Prince WilliamCounty Police Department

• Need To Know, Volume 1, Special Edition, Published by the Criminal IntelligenceUnit, October 24, 2002, Fairfax County Police Department, Wanted Bulletin

Reprinted with permission from the Fairfax County Police Department and the Prince William County Police Department.

80828_i-200.R7 10/8/04 12:07 AM Page 139

Although unclassified, this newsletter should be handled LAW ENFORCEMENT SENSITIVEand for official use only. This newsletter and it’s information should not be furnished to the mediaor any other agencies outside of Law Enforcement without prior approval from the CriminalInvestigations Bureau.

This edition of Need To Know is devoted solely to providing Fairfax Countyofficers with as much information on the Sniper Shootings as possible. TheCriminal Intelligence Unit has been in contact with the Montgomery andPrince Georges County Police Departments as well as the DC MetropolitanPolice in an effort provide you with this information. This information is pro-vided to the officers to not only enhance their ability to search for thesuspect(s) but to also provide some measure of officer safety. While most of theinformation in this newsletter comes from open sources, some does not.It is very important for all readers to remember our own policy on releasingpolice information as well as Chief Moose’s statements that releasing informa-tion on a case such as this can greatly jeopardize the successful apprehension ofthe suspect(s) and also the prosecution of the case.

The Latest Information

The latest information on the sniper shootings is that the subject has been targetingstrip malls, shopping centers, gas stations, schools and individuals walking alongthe street. The victims range in age from early teens to middle aged adults. Theyare both male and female. They are of different ethnic backgrounds. All the vic-tims were shot with a weapon that is know to be in the .221 to .223 caliber range. Itis believed that some of the shootings have taken place from inside a vehicle whileothers have not. The shooting are believed to have occurred from some range, possi-bly 100 to 200 yards away. There is still a belief that a white delivery style truckmight be involved in the shootings. The truck has been described as a WhiteDelivery Truck either Isuzu or Mitsubishi. The truck has 6 wheels (2 front,4rear). It has dark color lettering on the sides, possibly purple. The truck mayhave a damaged rear bumper or tail lift (see attached pictures). It is believed thatthere could quite possibly be more than one subject involved in these shootings.There are strong indications that the subject(s) are previewing the sites prior to theincidents.

140 ■ A P P E N D I X G

Need To KnowVolume 1, Special Edition Published by the Criminal Intelligence Unit October 10, 2002

80828_i-200.R7 10/8/04 12:07 AM Page 140


Officer Recommendations

During the course of their shifts All Sworn Police Personnel are requested to spendas much time in the areas of shopping centers, schools and gas stations. All offi-cers should pay particular attention to anyone spending time in these areas thatappear not to be conducting normal activities. Remember that there are no suspectsat this time. Don’t assume that what you see or respond to is not important. Anyoneseen loitering or appearing suspicious should be stopped and interviewed. All con-tacts of this nature should be reported on a police report and forwarded to the CIUfor further investigation.

Response to a sniper attack

Officers responding to a sniper attack should remember the following.

• First officers on the scene should immediately secure the crime scene and attend-ed to the victim. Remember whom you are dealing with, you could become asecondary target.

• Obtain and provide PSCC with any possible lookout.• Notify your supervisor and the CIU as soon as possible.• Secondary response officers should immediately start securing a perimeter around

the shooting scene. Keep in mind that this suspect is possibly shooting victimsfrom 100 to 200 yards away. Make sure that the perimeter is at least that large an area.

• Be on the alert for any vehicles leaving the scene.• Stop and interview any witnesses to the event.• If there are multiple witnesses, keep them separated.• If a suspect is stopped, remember that he/she may have an accomplice.• If multiple suspects are detained DO NOT place them in the same car or in close

proximity to each other.

Weapons and Vehicle Information

The pictures below are samples of assault and hunting rifles that are of thecaliber used in the shootings in Montgomery County Maryland. Below is only asample and are not the only type that could have been used.

A P P E N D I X G ■ 141

80828_i-200.R7 10/8/04 12:07 AM Page 141

142 ■ A P P E N D I X G


80828_i-200.R7 10/8/04 12:07 AM Page 142

A P P E N D I X G ■ 143


80828_i-200.R7 10/8/04 12:07 AM Page 143

144 ■ A P P E N D I X G

***The information contained within is Law Enforcement Sensitive and is not intended forPublic Release***


SNIPER MURDERS DAILY BRIEFING: 10/21/2002 0900 hours

INVESTIGATIVE UPDATE:On Oct. 19, at approximately 7:45pm, a 37 year-old W/M was shot one time in the abdomen after exiting aPonderosa Restaurant in Ashland, Virginia. This area is approximately 90 miles south of Washington, D.C.

• The victim is in critical condition with one shot to the abdomen and no exit wound. The bullet wasrecovered from inside the victim during a second surgery and will be analyzed.

• A note was discovered at the scene which contained a phone number. Police are urging the writer tocall the number left on the note.

• The Ponderosa Restaurant is located near access to I-95, Route 1 and Route 54. • It appears at this time that this incident is connected to the 12 other attacks. • Hanover County is currently using the Sniper Hot Line, 1-888-324-9800, to track leads. • Spotsylvania County has broken down the CID Command Post.

KNOWN FACTS:A summary of the attacks are as follows:

1-2) Oct. 2, 5:20pm-window shot at Michael’s craft store at 13850 Georgia Avenue in Aspen Hill. Noinjuries.

• 6:04pm-James D. Martin, 55, shot in the parking lot of Shoppers Food Warehouse grocery storeat 2201 Randolph Road in Wheaton.

3-7) Oct. 3, 7:41am-James L. Buchanan Jr., 39, shot while pushing a lawnmower in the 11000 block ofRockville Pike in White Flint.

• 8:12am-cabdriver Premkumar A. Walekar, 54, shot at a Mobil gas station, Aspen Hill Road andConnecticut Avenue in Aspen Hill.

• 8:37am-Sarah Ramos, 34, shot while sitting on a bench in front of a post office near LeisureWorld, 3701 Rossmoor Blvd. in Silver Spring.

• 9:58am-Lori Lewis Rivera, 25, shot while vacuuming her minivan at a Shell gas station atKnowles Road and Connecticut Avenue in Kensington.

• 9:20pm-Pascal Charlot, 72, shot below the neck while crossing the street at the corner ofGeorgia Avenue and Kalmia road NW.

8) Oct. 4, 2:30pm-a 43 year-old Caucasian female was shot in the back while loading packages intoher car in the parking lot of Michaels craft store in Spotsylvania County. She is in stable condition. Thevictim was 1,390 feet from access ramp to Interstate 95. 9) Oct. 7, 8:09am-a 13 year-old boy was shot after exiting a relative’s car at Benjamin Tasker MiddleSchool. A tarot card was found saying, “Mr. Policeman, I am God.” The victim was 880 feet fromaccess ramp to Route 50. 10) Oct. 9, 8:18pm-Dean Harold Meyers, 53, shot in the head and killed at the Sunoco gas station at7203 Sudley Road, Prince William County. The victim was found 940 feet from access ramp toInterstate 66.11) Oct. 11, 9:30am-Kenneth Bridges, 53, shot at an Exxon gas station, Route 1 and Market Street,Spotsylvania County. The victim was found 1, 410 feet from access ramp to Interstate 95. 12) Oct. 14, 9:15pm-Linda Franklin, 47, shot and killed while loading packages into her car in theparking garage of the Home Depot in Seven Corners Shopping Center, Fairfax County. There arenumerous side streets with access to Route 50.

***The information contained within is Law Enforcement Sensitive and is notintended for Public Release***

80828_i-200.R7 10/8/04 12:07 AM Page 144

A P P E N D I X G ■ 145


13) Oct. 19, 7:45pm-a 37 year-old male was shot and wounded in the abdomen while walking to hisvehicle in the Ponderosa Steakhouse parking lot, Ashland, VA.

Ballistic Evidence:

In other cases, it is believed the shots are being fired from 50 – 75 yards away.

The following is a listing of guns that are capable of firing the type of the caliber used in theshootings. *Note this list is only a sample of the types of guns and may not be the actual firearmbeing used.

Cartridge Manufacturer Model FA Type223 Remington Daewoo AR110C RI223 Remington Daewoo K1A1 RI223 Remington Daewoo K2 RI223 Remington Diemaco C7 RA223 Remington East Germany Wieger RA223 Remington Fabrique Nationale FNC RI223 Remington Galil (Imi) AR RA223 Remington Sterling Arm Ltd. Armalite AR-180 RI223 Remington Valmet M-72S RI5.45X18MM Russian PSM PI5.56x45MM NATO Heckler & Koch G36K RA222 Rem Mag Remington Arms 700 600 40-XB RI222 Rem Mag Remington Arms 722 725 760 R222 Rem Mag Remington Arms 722 725 760 RB222 Remington Remington Arms M700 M600 40-XB RB222 Remington Constabler 8432 8432DS RB222 Remington Remington Arms 700 RB222 Remington Remington Arms 722 RB & RI222 Remington Remington Arms 722 725 760 RI & R222 Remington Remington Arms 788 RB222 Remington Remington Arms M700 RB222 Remington Remington Arms M788 RB222 Remington Remington Arms Mohawk 600 RB222 Remington Savage 340 RB22-250 Remington FN/Browning BBR RB22-250 Remington Remington Arms 788 M788 RB223 Remington Armalite AR-180 RI223 Remington Colt AR-15 AR-15A2 RI223 Remington Colt M-16A1 RA223 Remington Colt M203 RI


80828_i-200.R7 10/8/04 12:07 AM Page 145

CREDIBLE VEHICLE LOOKOUTS:

• This vehicle was based on a witness composite from the Montgomery County shootings.• White box truck with back roll-up door.• Damage to the rear bumper, as if the vehicle had backed into something. The damage depicted on the right

rear bumper is in the right area, but is approximate....it may not be exact.• The oxidized paint has no gleam or sheen indicating it is was an older truck. The witness also reported

that the motor of the truck is loud, which is also consistent with an older vehicle.• The large lettering on the side of the truck was either dark purple or black and faded, giving it a type of

hue as seen in the photograph above. The witness recognized that there was text but does not recall whatthe text said. The writing on the truck does not say “UNKNOWN WORDS/UNKNOWN WORDS” asdepicted in the photograph seen above.

• The witness is not sure whether or not there was text on the back of the door.• The witness was unable to provide the license plate number. This one on this composite was intentionally

obscured.

• This vehicle was based on a composite completed by witnesses to the Spotsylvania shootings. • Ford Econovan with a ladder rack & a Chevy Astro van with a ladder rack.

DISPELLED INFORMATION: (lookouts no longer valid)

The shell casing found in the white box rental truck is not of the same caliber as those usedby the sniper. A cleaning crew working for a truck rental agency near Dulles InternationalAirport found the shell casing inside a white box truck after its return. The company noti-fied police Friday afternoon, and authorities confiscated the casing and the truck.

Cream colored Chevy Astro van with a ladder rack and a malfunctioning taillight is not

credible information. This information was received by an unreliable witness to the 12th

shooting incident at the Home Depot, Fairfax County. All lookouts should be canceled forthis vehicle. There is no credible information as to the distance of the sniper to the victim, ortype of gun used. The description given by the witness of the sniper kneeing down, takingaim and shooting the victim is also not credible.

There is no partial tag information.

146 ■ A P P E N D I X G



80828_i-200.R7 10/8/04 12:07 AM Page 146

IMPORTANT PHONE NUMBERS:

Sniper Murder Tip Hot Line 1-888-324-9800

EMAIL a TIP to: [email protected].

People can also send their tips to:

P.O. Box 7875Gaithersburg, MD 20898-7875

Prince William County Command Post [XXX-XXX-XXXX] (FOR POLICE USE ONLYNOT TO BE RELEASED TO THE MEDIA).

Prepared by Gwen M. Udell


A P P E N D I X G ■ 147



80828_i-200.R7 10/8/04 12:07 AM Page 147

Wanted

John Allen Williams AKA John MuhammedB/M 12/31/60Height 6’1Weight 180?

Williams is wanted on Federal Firearms Violations….He should be considered Armed and ExtremelyDangerous.

148 ■ A P P E N D I X G

Need To KnowVolume 1, Special Edition Published by the Criminal Intelligence Unit October 24, 2002


80828_i-200.R7 10/8/04 12:07 AM Page 148

Lee MalvoB/M 2/18/85Height 5’8?Weight 160?

Malvo is also wanted on Federal Firearms Violations.He also should be considered Armed and ExtremelyDangerous.

Both subjects are being sought in connection with the SniperShootings in the DC/Maryland/Virginia area. They may be seentogether or may have separated. Information has been obtained thatthe two subjects may be related (Father and Stepson) or may just actas Father and Son. There are two new vehicle lookouts that relate tothese subjects. Please keep in mind that the other lookouts for thevehicles seen near the shootings HAVE NOT been rescinded and arestill valid.

A P P E N D I X G ■ 149


80828_i-200.R7 10/8/04 12:07 AM Page 149

Vehicle Lookouts

A 1990 Chevrolet Caprice Blue orBurgundy in color with [state given]license plates

[license plate number given]

A White Chevrolet Celebrity with [stategiven] license plates

[license plate number given]

150 ■ A P P E N D I X G

* All bracketed information deleted at time of publication by PERF.


80828_i-200.R7 10/8/04 12:07 AM Page 150

A P P E N D I X H ■ 151

A P P E N D I X H

Arlington County (VA) Police Department Special Order

Reprinted with permission from the Arlington County Police Department.

80828_i-200.R7 10/8/04 12:07 AM Page 151

152 ■ A P P E N D I X H

ARLINGTON COUNTY POLICE DEPARTMENT

SPECIAL ORDER

SPECIAL ORDER: SO02-03EFFECTIVE DATE: October 15, 2002REVISED DATE:FILE WITH MANUAL SECTION:

TO: All Sworn Police Officers

FROM: Edward A. Flynn, Chief of Police

SUBJECT: Enhanced Tactical Response to Sniper Incidents

I. PURPOSE AND DURATION

This temporary Special Order establishes tactical response protocols during the sniper-relatedemergency currently affecting the greater Washington metropolitan region. It shall remain ineffect until rescinded or modified by a subsequent Special Order or canceling memorandum.

The protocols established by this Special Order have dual purposes, those being to deter orprevent a sniping incident within Arlington County, and failing that, to facilitate rapid captureof the sniping suspect.

II. PROCEDURES

A. Staffing

Effective 10/16/02 the standard tour of duty in the Operations Division shall be twelve (12)hours in duration. The following schedules shall apply:

1. Officers on the day shift shall work from 0530 to 1730

2. Officers on the midnight shift shall work from 1730 to 0530

3. Officers on the evening shift shall be assigned to one or the other of the aforemen-tioned two shifts. Captain [NAME] (or … designee) will coordinate these assignmentsand any subsequent adjustments thereto

80828_i-200.R7 10/8/04 12:07 AM Page 152

4. School Resource Officers shall work 0600 to 1800

5. SWAT officers shall work from 0500 to 2400 in two shifts, and shall be removed fromtheir regular assignments for the duration of this Special Order

6. CID personnel shall supplement Operations Division staffing and/or perform special-ized assignments when so instructed

7. SOS personnel shall work modified schedules at the discretion of the Deputy Chief forOperations (or her designee)

8. Regular days off (RDO) shall be maintained

9. Leave will be closed for all Police Department personnel. Leave that was approvedprior to the issuance of this Special Order shall be honored

10. Previously scheduled training classes shall be examined on a case-by-case basis, withcancellations imposed where appropriate

11. Each of the 12-hour shifts shall be staffed with two Watch Commanders instead of thecustomary one (for a total of four such commanders deployed each day). Worksheetsshall reflect the dual Watch Commander assignments

12. Officers with enhanced skills (K-9, AR-15, etc.) shall be evenly deployed throughoutboth shifts

13. Officers engaged in off-duty employment shall report to the roll call room prior toreporting to the off-duty employment site, and shall report back to the roll call room atthe conclusion of their off-duty work.

14. Officers engaged in off-duty employment may be strategically positioned at their jobsites by the Watch Commander. These positions may be located indoors or outdoors,may require the use of a marked cruiser, and may deviate from the customary practicesagreed upon by the officer and the off-duty employer.

15. All currently scheduled special events shall be reviewed with due consideration givento staffing effects and safety. Decisions to cancel such events, however, shall rest withthe organizer of the event rather than the Arlington County Police Department.

B. Court

1. All traffic cases in which officers working 1730-0530 are witnesses shall be continued

2. All other cases shall be tried as scheduled. However, officers shall remain on patroluntil notified to report to court by ECC

3. The Court Liaison shall provide Worksheets and sick-call information to theCommonwealth Attorney’s Office and the Clerk of the Court each day

A P P E N D I X H ■ 153

80828_i-200.R7 10/8/04 12:07 AM Page 153

C. Overtime

All requests for overtime and/or comp-time compensation shall be marked with the code“PSNI.”

D. Communications Procedures

1. To facilitate easy radio communications with other jurisdictions, plain English shall bespoken during mutual aid transmissions

2. Officers shall wear assigned pagers at all times, and shall check their voice-mail atleast twice daily

3. Where practical, ECC shall direct sniper-related telephone calls to the regional tip lineat 888-324-9800

4. ECC shall also direct non-emergency report calls to the Telephone Reporting Officeand/or the Department’s web site

E. Tactical Deployment

1. Officers shall maintain a patrol presence within their assigned area when not activelyhandling a call for service

2. Various locations shall be targeted for enhanced patrol coverage, based upon risk fac-tors and other tactical considerations

3. Counter surveillance shall be conducted at likely target locations by specificallyassigned personnel. An initial listing of these locations (subject to future revision)accompanies this Special Order as an attachment

4. The deployment locations of officers, including officers working off-duty employment,shall be plotted on a tactical map located in the TOC (Tactical Operations Center). TheTOC shall be staffed from 0600 to 2300 each day

F. Response to Sniper Incidents

1. ECC Responsibilities

a) Upon receipt of a shooting report, ECC personnel shall attempt to obtain as muchinformation from the caller as possible, in accordance with existing ECC proce-dures. Every effort shall be made to determine as quickly as possible whether theincident may be sniper-related

b) The call shall be dispatched without delay

154 ■ A P P E N D I X H

80828_i-200.R7 10/8/04 12:07 AM Page 154

c) If an apparent sniping incident is confirmed, ECC shall establish an ExecutiveCommand Center in the ECC Conference Room, and shall make appropriate notifi-cations as instructed by the Watch Commander and/or field units (see below)

2. Responding Officer’s Responsibilities

Officers responding to a possible sniper incident shall:

a) Attempt to determine whether the incident is sniper-related. Confirmation shall becommunicated to ECC via channel 1A

b) Locate and obtain information from all witnesses

c) Secure the area within a 300-yard radius of the shooting victim, taking care to pro-tect the crime scene in accordance with standard procedures

3. Corporals’ Responsibilities

Corporals responding to a possible sniper incident shall:

a) Conduct an appropriate search in an effort to determine the location from which theshot was fired

b) Maintain crime scene integrity pending notification and arrival of ATF, who willoversee the actual collection of evidence

c) Contact the treating medical facility (or in the case of a death, the medical examin-er) as soon as possible to arrange for recovery of ballistic evidence

4. Watch Commanders’ Responsibilities

Following confirmation of a possible sniper-related incident, a Watch Commandershall:

a) Instruct ECC to send a “flash” telex message and appropriate PMARS transmis-sions to nearby jurisdictions

b) Instruct ECC to notify the Chief of Police and each of the Deputy Chiefs, and alsosend a “snap” page to all other police personnel

c) Instruct ECC to request appropriate support from other jurisdictions, including heli-copter support

d) Initiate a SWAT activation, if appropriate (2300 to 0600 hours, when SWAT is notalready working)

A P P E N D I X H ■ 155

80828_i-200.R7 10/8/04 12:07 AM Page 155

5. Public Information Responsibilities

Prior to any media announcements, the Chairman of the County Board, the CountyManager, the Chief of Police, and the Department’s Public Information Officer shallconfer

[Counter-Surveillance Locations (Yellow) and Traffic Post Locations (Blue) were listed byintersection.]

156 ■ A P P E N D I X H

80828_i-200.R7 10/8/04 12:07 AM Page 156

A P P E N D I X I ■ 157

A P P E N D I X I

Montgomery County (MD) Police Department Press Pass #1341


80828_i-200.R7 10/8/04 12:07 AM Page 157

158 ■ A P P E N D I X I

80828_i-200.R7 10/8/04 12:07 AM Page 158

A P P E N D I X J ■ 159

A P P E N D I X J

Montgomery County (MD) Police Department,

Office of Media Services, October 16, 2002

“How To Be A Good Witness”


80828_i-200.R7 10/8/04 12:07 AM Page 159

160 ■ A P P E N D I X J

80828_i-200.R7 10/8/04 12:07 AM Page 160

A P P E N D I X K ■ 161

A P P E N D I X K

Prince William County (VA)Community Services Board

“Dealing with the Sniper Attacks”

This tri-fold brochure is reprinted with permission from the Prince William County Community Services Board.

80828_i-200.R7 10/8/04 12:07 AM Page 161

162 ■ A P P E N D I X K

80828_i-200.R7 10/8/04 12:07 AM Page 162

A P P E N D I X K ■ 163

80828_i-200.R7 10/8/04 12:07 AM Page 163

164

80828_i-200.R7 10/8/04 12:07 AM Page 164

A P P E N D I X L ■ 165

A P P E N D I X L

Montgomery County (MD) Public Schools

Emergency Response Plan

This material is taken from the Montgomery County Public Schools, Rockville, Maryland, Emergency Response Plan: School Safety and

Security Under the Incident Command System

Developed by the Montgomery County Public Schools, based on incident command models from the Federal Emergency ManagementAgency and the Montgomery County Emergency Management Group © 2003, Montgomery County Public Schools, Revised September 4,2003.

Reprinted with permission.

80828_i-200.R7 10/8/04 12:07 AM Page 165

166 ■ A P P E N D I X L

80828_i-200.R7 10/8/04 12:07 AM Page 166

A P P E N D I X L ■ 167

80828_i-200.R7 10/8/04 12:07 AM Page 167

168 ■ A P P E N D I X L

80828_i-200.R7 10/8/04 12:07 AM Page 168

A P P E N D I X L ■ 169

80828_i-200.R7 10/8/04 12:07 AM Page 169

170 ■ A P P E N D I X L

80828_i-200.R7 10/8/04 12:07 AM Page 170

A P P E N D I X L ■ 171

80828_i-200.R7 10/8/04 12:07 AM Page 171

172 ■ A P P E N D I X L

80828_i-200.R7 10/8/04 12:07 AM Page 172

A P P E N D I X L ■ 173

80828_i-200.R7 10/8/04 12:08 AM Page 173

174 ■ A P P E N D I X L

80828_i-200.R7 10/8/04 12:08 AM Page 174

A P P E N D I X L ■ 175

80828_i-200.R7 10/8/04 12:08 AM Page 175

176 ■ A P P E N D I X L

80828_i-200.R7 10/8/04 12:08 AM Page 176

A P P E N D I X L ■ 177

80828_i-200.R7 10/8/04 12:08 AM Page 177

178 ■ A P P E N D I X L

80828_i-200.R7 10/8/04 12:08 AM Page 178

A P P E N D I X L ■ 179

80828_i-200.R7 10/8/04 12:08 AM Page 179

180 ■ A P P E N D I X L

80828_i-200.R7 10/8/04 12:08 AM Page 180

A P P E N D I X L ■ 181

80828_i-200.R7 10/8/04 12:08 AM Page 181

182 ■ A P P E N D I X L

80828_i-200.R7 10/8/04 12:08 AM Page 182

A P P E N D I X L ■ 183

80828_i-200.R7 10/8/04 12:08 AM Page 183

184 ■ A P P E N D I X L

80828_i-200.R7 10/8/04 12:08 AM Page 184

A P P E N D I X L ■ 185

80828_i-200.R7 10/8/04 12:08 AM Page 185

186 ■ A P P E N D I X L

80828_i-200.R7 10/8/04 12:08 AM Page 186

A P P E N D I X L ■ 187

80828_i-200.R7 10/8/04 12:08 AM Page 187

188 ■ A P P E N D I X L

80828_i-200.R7 10/8/04 12:08 AM Page 188

A P P E N D I X L ■ 189

80828_i-200.R7 10/8/04 12:08 AM Page 189

190 ■ A P P E N D I X L

80828_i-200.R7 10/8/04 12:08 AM Page 190

A P P E N D I X L ■ 191

80828_i-200.R7 10/8/04 12:08 AM Page 191

192

80828_i-200.R7 10/8/04 12:08 AM Page 192

A P P E N D I X M ■ 193

A P P E N D I X M

Arlington County Public SchoolSuperintendent Robert G. Smith

Letter to ParentsOctober 9, 2002

Reprinted with permission from Arlington County Public Schools.

80828_i-200.R7 10/8/04 12:08 AM Page 193

194 ■ A P P E N D I X M

80828_i-200.R7 10/8/04 12:08 AM Page 194

A B O U T T H E A U T H O R S ■ 195

Gerard R. Murphy, Former Deputy Director of ResearchPolice Executive Research ForumAt the time of this project, Murphy was a senior research and policy analyst with the Police Executive ResearchForum (PERF). He then became the Director of the Homeland Security and Technology Division in theNational Governors Association Center for Best Practices. Murphy was the project director for this effort. Hedirected a number of other national projects at PERF, including those focusing on terrorism, police perform-ance measures, recruitment and hiring practices.

Before joining PERF in September 2001, Murphy spent 12 years with the Baltimore County (MD) PoliceDepartment. He was the Director of Planning and Research, responsible for developing and implementing thedepartment’s strategic plan, researching and developing department policies, managing federal and stategrants, and serving as the agency’s accreditation manager. Prior to that position, he was the Assistant to thePolice Chief for eight years spanning the tenure of three chiefs for whom he provided policy advice and guid-ance. Murphy also conducted a variety of special projects to improve organizational efficiency. He also servedas Executive Director of the Baltimore County Police Foundation. His previous experience also includes beingan Assistant Professor of Public Affairs at Indiana University, Fort Wayne and a previous stint at PERF as aresearch associate. Murphy holds a master’s degree in public policy and has completed extensive work towardshis doctorate in public policy. He is also a graduate of the Federal Executive Institute.

Chuck Wexler, Ph.D., Executive Director Police Executive Research ForumChuck Wexler, appointed as the Executive Director of PERF in 1993, leads a staff engaged in police and crim-inal justice research, management studies and consulting, publication of research findings, technical assis-tance, demonstration projects, and executive development and selection. PERF is a membership organizationof law enforcement chiefs from the larger police agencies in the country. It was founded more than a quartercentury ago by a number of chiefs who saw a need for an organization dedicated to progressive thinking aboutdifficult issues in policing that face bigger-city law enforcement agencies.

During his tenure at PERF, Wexler has been directly involved in numerous technical assistance, research andconsulting projects to improve the delivery of police services. Examples of major projects include his workcoordinating the development and implementation of a comprehensive anti-crime strategy in Minneapolisthat is now a model for public-private cooperation. He has spearheaded an effort to candidly confront anddiscuss police-minority conflict and the controversy concerning racial profiling. Wexler has also beeninvolved in major projects in Chicago, Kansas City, Nashville, Kingston, Jamaica and the Middle East. In eachof these projects his purpose has been to more efficiently deliver policing services to the community.

A B O U T T H E A U T H O R S

80828_i-200.R7 10/8/04 12:08 AM Page 195

196 ■ A B O U T T H E A U T H O R S

Prior to joining PERF, he worked as an assistant to the nation’s first Director of the Office of National DrugControl Policy where he identified exemplary local initiatives and helped craft national policy. He also head-ed the Professional Development Division of the International Association of Chiefs of Police where hedesigned a national program for the selection of police chiefs and revamped and broadened executive devel-opment programs for police executives.

A native of Boston, Wexler held a number of key positions in the Boston Police Department. As OperationsAssistant to the Police Commissioner, he played a central role in the agency’s management of racial violencein the wake of court-ordered desegregation of the Boston School System. He was also instrumental in thedevelopment and management of the Community Disorders Unit, which earned a national reputation forsuccessfully prosecuting and preventing racially motivated crime.

Wexler serves as an evaluator for the Ford Foundation’s Innovations in Government Project. Wexler graduatedfrom Boston University with a liberal arts degree. He earned a masters degree in criminology from Florida StateUniversity and a Ph.D. in urban studies and planning from the Massachusetts Institute of Technology (MIT). Hehas been an instructor at Bowdoin College and MIT.

C O N T R I B U T I N G A U T H O R S

Heather J. Davies, Ph.D., Research AssociatePolice Executive Research ForumDavies is responsible for managing national-level research and policy development projects. She was also theproject coordinator and contributing author on this publication. Davies is the project director of a COPS-fund-ed project and white paper series, Protecting Your Community from Terrorism: Strategies for Local LawEnforcement, to address local law enforcement’s concerns in preventing and preparing for terrorist acts. Thisproject consists of a series of five executive sessions and a subsequent white paper series. Davies is the co-authorof three volumes: Working with Diverse Communities (published March 2004), Preparing for and Responding toBioterrorism (published September 2004), and Law Enforcement Partnerships with the Department of HomelandSecurity (forthcoming 2004).

Prior to joining PERF, Davies was a senior research associate with the American Bar Association’s Center onChildren and the Law, and the Criminal Justice Section. She was the principal investigator on a project evaluat-ing parental involvement practices of juvenile courts, and one on improving legal and judicial responses toparental kidnapping. Davies assisted in the analysis of legal services provided by the District of Columbia’s Officeof Corporation Counsel to the Child and Family Services Agency. In addition, she served as the project associ-ate on such studies as the implementation of the Michigan Lawyer-Guardian Ad Litem Statute, a national assess-ment of law enforcement and community partnerships for helping children exposed to domestic violence, andan evaluation of domestic violence no-drop policies. Davies is the co-author of a National Center for Missingand Exploited Children monograph, Child Pornography: The Criminal Justice Response. Davies holds a bachelor’sdegree in sociology from Virginia Tech, and a master’s degree and a Ph.D. in justice, law and society fromAmerican University. Her dissertation addressed Understanding Variations in Murder Clearance Rates: TheInfluence of the Political Environment.

80828_i-200.R7 10/8/04 12:08 AM Page 196

Martha Plotkin, J.D., Director of Communications and Legislative AffairsPolice Executive Research ForumPlotkin has been with PERF for nearly 20 years. She currently directs PERF’s publications, media and legisla-tive programs. She has had extensive experience researching and writing on law enforcement matters, as wellas defining and implementing a national policy and legislative agenda for police professionals. She regularlyhas provided information to congressional leaders and the national media on matters of public safety. Plotkinhas edited more than 50 publications in her tenure and has written myriad op-ed articles, briefings and tes-timonies on issues ranging from gun safety to funding police services. She is the co-author of several volumesin the series Protecting Your Community From Terrorism: Strategies for Local Law Enforcement, including Local-Federal Partnerships and Law Enforcement Partnerships with the Department of Homeland Security (forthcom-ing 2004). Her other work includes being the author of A Time for Dignity and other articles and trainingmaterials on the police response to elder abuse. She is also the co-author of Police and the Homeless: A StatusReport and the editor of Under Fire: Gun Buy-Backs, Exchanges and Amnesty Programs.

An attorney, she also works on amicus briefs and other legal issues affecting police agencies. Plotkin has man-aged and continues to contribute to research projects on homeland-security issues and the police response tospecial populations and victims. She completed the legal studies program at Brandeis University where shereceived her bachelor’s degree in psychology. She earned her law degree from The George WashingtonUniversity Law School.

A B O U T T H E A U T H O R S ■ 197

80828_i-200.R7 10/8/04 12:08 AM Page 197

The Office of Justice Programs, which is part of the U.S. Department of Justice, provides federal lead-ership in developing the nation’s capacity to prevent and control crime, administer justice, and assistcrime victims. OJP is the premier resource for the justice community and is committed to provid-

ing and coordinating information, research and development, statistics, training, and support to help the jus-tice community build the capacity it needs to meet its public safety goals.

OJP was established by the Justice Assistance Act of 1984 and reauthorized in 1994. It is headed by anAssistant Attorney General and comprises five component bureaus and two offices: the Bureau of JusticeAssistance, the Bureau of Justice Statistics, the National Institute of Justice, the Office of Juvenile Justice andDelinquency Prevention, the Office for Victims of Crime, the Office of the Police Corps and Law EnforcementEducation, and the Community Capacity Development Office, which incorporates the Weed and Seed pro-gram and the American Indian and Alaska Native Affairs Desk.

OJP’s bureaus are:

• The Bureau of Justice Assistance (BJA) provides leadership and assistance in support of local criminaljustice strategies to achieve safe communities. BJA administers formula grant programs such as theEdward Byrne Memorial State and Local Law Enforcement Assistance Program and the Local LawEnforcement Block Grant Program, and discretionary grant programs aimed at reducing and preventingcrime, violence, and drug abuse and to improve the functioning of the criminal justice system.

• The Bureau of Justice Statistics (BJS) is the official statistical agency of the U.S. Department of Justice.BJS collects, analyzes, publishes, and disseminates information on crime, criminal offenders, victims ofcrime, and the operation of justice systems at all levels of government.

• The National Institute of Justice (NIJ) is the research and development agency of the U.S. Departmentof Justice and is dedicated to researching crime control and justice issues. NIJ’s mission is to advancescientific research, development and evaluation to enhance the administration of justice and publicsafety.

• The Office of Juvenile Justice and Delinquency Prevention (OJJDP) provides national leadership, coor-dination and resources to prevent and respond to juvenile delinquency and victimization.

• The Office for Victims of Crime (OVC) is committed to enhancing the nation’s capacity to assist crimevictims and to providing leadership in changing attitudes, policies, and practices to promote justice andhealing for all crime victims.

A B O U T T H E O F F I C E O F J U S T I C E P R O G R A M S

198 ■ A B O U T T H E O F F I C E O F J U S T I C E P R O G R A M S

80828_i-200.R7 10/8/04 12:08 AM Page 198

OJP’s Offices are:

• The Office of the Police Corps and Law Enforcement Education (OPCLEE) administers the PoliceCorps, a program that addresses violent crime by helping state and local law enforcement agenciesincrease the number of officers with advanced education and training assigned to community patrol.

• The newly established Community Capacity Development Office (CCDO), which creates a singleorganization infrastructure to provide a nexus for a vast array of community-based efforts, offeringrobust training and technical assistance opportunities to help communities to better help themselves.This new office incorporates the well-known Weed and Seed program and is focused on OJP’s commu-nity capacity development program and program sustainability efforts.

For more information visit the OJP Web site at www.ojp.usdoj.gov

A B O U T T H E O F F I C E O F J U S T I C E P R O G R A M S ■ 199

80828_i-200.R7 10/8/04 12:08 AM Page 199

The Police Executive Research Forum (PERF) is a national professional association of chief executivesof large city, county and state law enforcement agencies. PERF’s objective is to improve the deliveryof police services and the effectiveness of crime control through several means:

• the exercise of strong national leadership,

• the public debate of police and criminal justice issues,

• the development of research and policy, and

• the provision of vital management and leadership services to law enforcement agencies.

PERF members are selected on the basis of their commitment to the organization’s objectives and principles.PERF operates under the following tenets:

• Research, experimentation and the exchange of ideas through public discussion and debate are paths forthe development of a comprehensive body of knowledge about policing.

• Substantial and purposeful academic study is a prerequisite for acquiring, understanding and adding tothat body of knowledge.

• Maintenance of the highest standards of ethics and integrity is imperative in the improvement ofpolicing.

• The police must, within the limits of the law, be responsible and accountable to the public as the ultimatesource of law enforcement authority.

• The principles embodied in the Constitution are the foundation of policing.

Categories of membership also allow the organization to benefit from the diverse views of criminal justiceresearchers, law enforcement of all ranks, and other professionals committed to advancing law enforcementservices to all communities.

A B O U T T H E

P O L I C E E X E C U T I V E R E S E A R C H F O R U M

200 ■ A B O U T T H E P O L I C E E X E C U T I V E R E S E A R C H F O R U M

80828_i-200.R7 10/8/04 12:08 AM Page 200

GERARD R. MURPHYCHUCK WEXLER

WITH

HEATHER J . DAVIES

MARTHA PLOTKIN

1120 Connecticut Avenue, NW Suite 930Washington DC, 20036Phone: 202-466-7820 Fax: 202-466-7826www.policeforum.org

Managing A

Multijurisdictional C

ase80828_Cover R5 10/7/04 11:40 PM Page 1

manageing a multijurisdictional case · 2014-01-06 · and perf fellow mike adams of the...

Documents