probing into financial cold cases april 14, 2010

62
Probing into Probing into Financial Cold Financial Cold Cases Cases April 14, 2010 April 14, 2010

Upload: juliana-jacobs

Post on 25-Dec-2015

219 views

Category:

Documents


3 download

TRANSCRIPT

Page 1: Probing into Financial Cold Cases April 14, 2010

Probing into Financial Probing into Financial Cold CasesCold Cases

April 14, 2010April 14, 2010

Page 2: Probing into Financial Cold Cases April 14, 2010

What is a Cold Case?What is a Cold Case?

►Closed investigation – reopenedClosed investigation – reopened►Latent case – discovered laterLatent case – discovered later►Delayed prosecutionDelayed prosecution

Page 3: Probing into Financial Cold Cases April 14, 2010

Stages in a ProbeStages in a Probe

► Examine Critical AttributesExamine Critical Attributes► Develop a Theory of the CaseDevelop a Theory of the Case► Investigate Financial MotivesInvestigate Financial Motives► Examine Business Entities TiesExamine Business Entities Ties► Consider Explicit SourcesConsider Explicit Sources► Consider Tacit SourcesConsider Tacit Sources► Consider Embezzlement SchemesConsider Embezzlement Schemes

Page 4: Probing into Financial Cold Cases April 14, 2010

Stages Con’tStages Con’t

► Examine Fraud Sources Examine Fraud Sources ► Conduct Tracing of FundsConduct Tracing of Funds► Do Computer Forensics ReviewDo Computer Forensics Review

Page 5: Probing into Financial Cold Cases April 14, 2010

Critical AttributesCritical Attributes

►Subject’s occupationSubject’s occupation►AgeAge► Involvement in a criminal enterpriseInvolvement in a criminal enterprise►Banking connectionsBanking connections►Ties to businessesTies to businesses►Use of alternate financial firms and Use of alternate financial firms and

methods of paymentmethods of payment

Page 6: Probing into Financial Cold Cases April 14, 2010

Critical Attributes Con’tCritical Attributes Con’t

►Tax liens, U.C.C. filings, judgments, Tax liens, U.C.C. filings, judgments, bankruptciesbankruptcies

►Criminal historyCriminal history►Known assetsKnown assets►Use of digital devices including cellular Use of digital devices including cellular

telephonestelephones

Page 7: Probing into Financial Cold Cases April 14, 2010

Family

Associates

Cellular

As

Assets

Computer Trails

Criminal History

Tax liens, U.C.C. filings, judgments, bankruptciesTax liens, U.C.C. filings, judgments, bankruptcies

Page 8: Probing into Financial Cold Cases April 14, 2010

Theory of the CaseTheory of the Case

►What is the center of the case?What is the center of the case?► Internal evidenceInternal evidence►Proximal Proximal ►DistalDistal►Limbic (world-at-large)Limbic (world-at-large)

Page 9: Probing into Financial Cold Cases April 14, 2010

PersonEvent

Evidence

Documentary/Databases/Computer

Proximal

Business Ties/Relatives and Associates/Coworkers

Distal

Public records/News sources/Internet/Digital Storage/Assets

Limbic

Internal

Page 10: Probing into Financial Cold Cases April 14, 2010

Financial MotivesFinancial Motives

► Asset preservationAsset preservation► RevengeRevenge► Financial control of a business or an Financial control of a business or an

enterpriseenterprise► Seeking to gain an inheritance or a benefitSeeking to gain an inheritance or a benefit► Seeking to resolve personal debtsSeeking to resolve personal debts► Rescue a failing businessRescue a failing business► Removing a financial rivalRemoving a financial rival► To finance addictions such as gambling To finance addictions such as gambling

and drug abuseand drug abuse

Page 11: Probing into Financial Cold Cases April 14, 2010

Business TiesBusiness Ties► An individual may help set up a business without being An individual may help set up a business without being

an officer or director. His or her name, however, may an officer or director. His or her name, however, may appear on incorporation papers, loan applications, legal appear on incorporation papers, loan applications, legal documents, applications for utilities, and on similar documents, applications for utilities, and on similar documents. documents.

► Assisting with logistics may include operating motor Assisting with logistics may include operating motor

vehicles, signing for shipments received, making vehicles, signing for shipments received, making shipments, including the associated paperwork, shipments, including the associated paperwork, supervising contractors and vendors, and buying supervising contractors and vendors, and buying supplies and goods.supplies and goods.

► (All of these activities leave a paper or electronic trail. (All of these activities leave a paper or electronic trail. Even operating a motor vehicle leaves a trail of gas and Even operating a motor vehicle leaves a trail of gas and maintenance receipts, parking tickets, traffic tickets, and maintenance receipts, parking tickets, traffic tickets, and accident reports.) accident reports.)

Page 12: Probing into Financial Cold Cases April 14, 2010

Business TiesBusiness Ties

► Financial activity may include doing the banking, Financial activity may include doing the banking, signing checks, making credit card purchases, and signing checks, making credit card purchases, and paying bills.paying bills.

► Even in illegal operations where traditional Even in illegal operations where traditional documentation is minimal, a trail will exist. Cellular documentation is minimal, a trail will exist. Cellular telephone and pager traffic, files on digital devices, telephone and pager traffic, files on digital devices, and financial transactions through alternate and financial transactions through alternate institutions and means, as described in “Examine institutions and means, as described in “Examine Critical Attributes” above, all provide evidence of Critical Attributes” above, all provide evidence of

involvement.involvement.

Page 13: Probing into Financial Cold Cases April 14, 2010

Explicit SourcesExplicit Sources

►Web searches under subject’s nameWeb searches under subject’s name►Local newspaper and news source Local newspaper and news source

databases databases ►Re-interviewing known witnessesRe-interviewing known witnesses

Page 14: Probing into Financial Cold Cases April 14, 2010

Tacit SourcesTacit Sources

►Computers and digital devices Computers and digital devices ►Storage facilities Storage facilities ►Online repositories for information Online repositories for information

such as Google Documents®, such as Google Documents®, collaborative spaces like MySpacecollaborative spaces like MySpace®® or or Facebook Facebook ®®, and blogs managed by , and blogs managed by the subject. the subject.

Page 15: Probing into Financial Cold Cases April 14, 2010

Embezzlement SchemesEmbezzlement Schemes

►Stealing from a business or organization Stealing from a business or organization over time can be difficult to detect, over time can be difficult to detect, especially when an organization does especially when an organization does not enforce the security principles of not enforce the security principles of least privilege and separation of duties. least privilege and separation of duties.

►Look for aggregation of job dutiesLook for aggregation of job duties►Look for “threat gates”Look for “threat gates”►Constructing a timelineConstructing a timeline

Page 16: Probing into Financial Cold Cases April 14, 2010

Accounting

HR Functions

Payroll

Dangerous Overlaps

Page 17: Probing into Financial Cold Cases April 14, 2010

SuspectSuspect CenterCenter

(06/30/03(06/30/03))

EventEvent

InternalInternal ProximalProximal DistalDistal LimbicLimbic

J. JonesJ. Jones XX Digital Digital FootprintFootprint

HighHigh

CoworkeCoworkerr

SuspicioSuspicionsns

Ties to Ties to Diversified Diversified InvestmentsInvestments

CriminalCriminal

HistoryHistory

P. P. SanfordSanford

No accessNo access CoworkeCoworkerr

SuspicioSuspicionsns

NoneNone

M. M. HowardHoward XX Data Data

accessaccessNoneNone A friend of J. A friend of J.

JonesJonesPersonaPersonal Bondl Bond

Suspect Matrix – Accounts Payable Scheme

Page 18: Probing into Financial Cold Cases April 14, 2010

Fraud SourcesFraud Sources

►Online News SourcesOnline News Sources►FBI and law enforcement sitesFBI and law enforcement sites►CyberprofilingCyberprofiling

Page 19: Probing into Financial Cold Cases April 14, 2010

Tracing of FundsTracing of Funds

►Aided by documentary evidence Aided by documentary evidence uncovered in the topics of connections uncovered in the topics of connections and sources and supplemented by and sources and supplemented by computer forensics, the investigator computer forensics, the investigator can visualize the flow of money in the can visualize the flow of money in the past. past.

Page 20: Probing into Financial Cold Cases April 14, 2010

Computer Forensics ReviewComputer Forensics Review

► In a financial cold case investigation, In a financial cold case investigation, when warning flags are up that serious when warning flags are up that serious business and transactions occurred business and transactions occurred digitally, going to the expense of a digitally, going to the expense of a forensic examination of the digital forensic examination of the digital devices is warranted. devices is warranted.

Page 21: Probing into Financial Cold Cases April 14, 2010

Investigative Stage Rationale Other Considerations

Examine Critical Attributes

Enumerate the known connections of the subject to money and finance

Start with the known connections to develop new ones, previously unknown

Develop a Theory of the Case

Establish a starting framework

Always subject to revision as new facts develop

Investigate Financial Motives

Seek to understand why transactions and activity occurred

New motives may emerge as the investigation progresses

Examine Business Entities Ties

Understand who all the players were

An ongoing activity during the investigation

Consider Explicit Sources

Research all available published and public sources. Re-interview witnesses.

May provide only partial answers, but can serve as useful starting points for leads, re-interviewing witnesses can produce new leads.

Page 22: Probing into Financial Cold Cases April 14, 2010

Consider Tacit Sources Consider and locate previously unconsidered witnesses and documentary evidence, including computer-based evidence

If you think someone could have useful financial information, talk to him or her. If you find an “old” digital device related to the subject, have it examined.

Embezzlement Scheme Considered

Determine if this was a factor in the case

Embezzlement schemes explain a lot of behavior in a case. Much criminal activity occurs in connection with embezzlements.

Fraud Sources Examined

Look for online and conventional scams involving the subject

Footprinting via the Internet can be productive.

Tracing of Funds Understand where the money went

This investigative activity may require the integration of all the subjects and entities discovered in a case.

Computer Forensics Review

Locate and examine digital devices and computers possibly affecting the case

This stage may come into play earlier in the case depending upon the role of digital evidence in the events associated with the crime.

Page 23: Probing into Financial Cold Cases April 14, 2010

TOPICS AND MAIN AVENUES OF TOPICS AND MAIN AVENUES OF INVESTIGATIONINVESTIGATION

Page 24: Probing into Financial Cold Cases April 14, 2010

ConnectionsConnections

► Interrelationships that existed Interrelationships that existed between people and entities, such as between people and entities, such as businesses and organizations. businesses and organizations.

►Developing connections creates a Developing connections creates a framework for understanding the role framework for understanding the role of money or finance in the case. of money or finance in the case.

Page 25: Probing into Financial Cold Cases April 14, 2010

Background InvestigationBackground Investigation

► Do a background investigation on the subject to Do a background investigation on the subject to uncover critical attributes from available evidence uncover critical attributes from available evidence such as alternate financing cards, birth certificates, such as alternate financing cards, birth certificates, credit cards, credit histories, criminal history records.credit cards, credit histories, criminal history records.

► Including criminal intelligence sources, death Including criminal intelligence sources, death certificates, debit cards, driver’s license information, certificates, debit cards, driver’s license information, marriage licenses, divorce records.marriage licenses, divorce records.

► In addition, run registration and ownership In addition, run registration and ownership information on any known assets such as real estate, information on any known assets such as real estate, motor vehicles, boats, recreational vehicles, or motor vehicles, boats, recreational vehicles, or aircraft.aircraft.

Page 26: Probing into Financial Cold Cases April 14, 2010

More BackgroundMore Background

► Check tax liens, U.C.C. filings, judgments, Check tax liens, U.C.C. filings, judgments, bankruptcies for the subject and for any bankruptcies for the subject and for any discovered businesses.discovered businesses.

► Research any incorporation or business licenses Research any incorporation or business licenses for discovered businesses with the Secretary of for discovered businesses with the Secretary of State (SOS) or corporation authority in the State (SOS) or corporation authority in the relevant jurisdiction.relevant jurisdiction.

► Also, most important, run an officer/director Also, most important, run an officer/director search for the subject and any known associates search for the subject and any known associates on the database with the SOS.on the database with the SOS.

Page 27: Probing into Financial Cold Cases April 14, 2010

Backgrounding Con’tBackgrounding Con’t

► Obtain cellular and pager records on the Obtain cellular and pager records on the subject. Locate and seize legally any subject. Locate and seize legally any digital devices belonging to the subject. digital devices belonging to the subject. Arrange for computer forensics Arrange for computer forensics examination when appropriate to the case.examination when appropriate to the case.

► Research public records and filings related Research public records and filings related to any discovered businesses for evidence to any discovered businesses for evidence of the subject’s involvement in the of the subject’s involvement in the business.business.

Page 28: Probing into Financial Cold Cases April 14, 2010

Backgrounding - AnalysisBackgrounding - Analysis

► Obtain by legal search or subpoena any Obtain by legal search or subpoena any business records of related companies that business records of related companies that speak to the subject’s financial involvement. speak to the subject’s financial involvement. These records include payroll information, These records include payroll information, invoices, purchase orders, and shipping invoices, purchase orders, and shipping receipts.receipts.

► Organize the collected information using Organize the collected information using timelines, chronologies, link diagrams, and timelines, chronologies, link diagrams, and analytical software such as i2’s Analyst’s analytical software such as i2’s Analyst’s Notebook to gain a wide picture of the Notebook to gain a wide picture of the subject’s business involvement at the time of subject’s business involvement at the time of the events that made the basis of the cold the events that made the basis of the cold case.case.

Page 29: Probing into Financial Cold Cases April 14, 2010

Timeline

2/18/03Vehicle purchased

2/10/03 Meeting at café

02/01/03Conference with banker

01/23/03 Life Insurance purchased

Page 30: Probing into Financial Cold Cases April 14, 2010

Analytical Chart Example

Ft. Worth Business

Houston Business

Pay telephonenear residence

Cellular calls from subject’svehicle

Subject’s residence

Number of telephone calls in a month

40

38

10

15

Page 31: Probing into Financial Cold Cases April 14, 2010

http://www.i2inc.com/products/analysts_notebook/

Page 32: Probing into Financial Cold Cases April 14, 2010

MotivesMotives

► If the crime was one that presented If the crime was one that presented opportunity for embezzlement, analyze the opportunity for embezzlement, analyze the vulnerabilities or “threat gates” in the vulnerabilities or “threat gates” in the business’ operations that permitted the crime.business’ operations that permitted the crime.

► Research which employees had the Research which employees had the opportunities to exploit those vulnerabilities. opportunities to exploit those vulnerabilities. Investigate past work assignments, schedules, Investigate past work assignments, schedules, access to funds, and skill-sets that facilitated access to funds, and skill-sets that facilitated the crime.the crime.

Page 33: Probing into Financial Cold Cases April 14, 2010

“A” is a threat gate. Could a check issue without supporting documents?

Page 34: Probing into Financial Cold Cases April 14, 2010

Motives Con’tMotives Con’t

► Identify persons within the company that had Identify persons within the company that had a motive to commit the crime: financial a motive to commit the crime: financial distress, addiction problems, serious distress, addiction problems, serious dissatisfaction with company, and family dissatisfaction with company, and family problems.problems.

► Overlay the information developed about Overlay the information developed about motives with the connections data. Analyze motives with the connections data. Analyze the relationships and money flows from the relationships and money flows from information developed in these other avenues information developed in these other avenues of inquiry.of inquiry.

Page 35: Probing into Financial Cold Cases April 14, 2010

SourcesSources► Re-contact and re-interview known witnesses from Re-contact and re-interview known witnesses from

the initial investigation to see if they have any the initial investigation to see if they have any additional information to shed light on the financial additional information to shed light on the financial aspects of the case.aspects of the case.

► Locate any media accounts through news database Locate any media accounts through news database searches on subjects, related businesses, or searches on subjects, related businesses, or associates.associates.

► (Nexis® on News and Business Solutions at (Nexis® on News and Business Solutions at http://www.lexisnexis.com is a good source for is a good source for searching a vast number of news sources. Google searching a vast number of news sources. Google News at News at http://www.google.com is a free news is a free news research tool.)research tool.)

Page 36: Probing into Financial Cold Cases April 14, 2010

More SourcesMore Sources

► Review any documentary evidence in the case file Review any documentary evidence in the case file that may offer previously overlooked avenues for that may offer previously overlooked avenues for uncovering financial information about the case. uncovering financial information about the case.

► For example, the case file indicates that the For example, the case file indicates that the subject owned property in another county, but subject owned property in another county, but there is no record in the file of follow-up on the there is no record in the file of follow-up on the issue.issue.

► Determine if any information developed in the Determine if any information developed in the connections or motives avenues helps to identify connections or motives avenues helps to identify new witnesses that need locating and new witnesses that need locating and interviewing about relevant financial facts.interviewing about relevant financial facts.

Page 37: Probing into Financial Cold Cases April 14, 2010

Sources….Sources….

► Consult fraud sources available online at sites such Consult fraud sources available online at sites such as “Fraud Schemes” at the FBI (as “Fraud Schemes” at the FBI (http://www.fbi.gov/majcases/fraud/fraudschemes.htm) )

► And “Crimes of Persuasion” at And “Crimes of Persuasion” at http://www.crimes-of-persuasion.com/victims/investigation.htm to obtain intelligence and background information to obtain intelligence and background information about online scams. about online scams.

► Do online “footprinting” of a suspect’s activity on Do online “footprinting” of a suspect’s activity on the Web. Construct a criminal history from online the Web. Construct a criminal history from online sources if possible. sources if possible.

Page 38: Probing into Financial Cold Cases April 14, 2010

Sources…CyberprofilingSources…Cyberprofiling

MO (Modus Operandi)MO (Modus Operandi)

Personal IDPersonal ID

GeographicalGeographical

FinancialFinancial

TransactionalTransactional

Page 39: Probing into Financial Cold Cases April 14, 2010

InternalOrganizationalPublications

News Accounts

ResumesandCVs

Online Postings

Laptops and PDAs common storage

Financial Transactions

Writings and publications

The Infosphere

Computer-based information

New Media (USB, etc.)

Hobbies and interests

Page 40: Probing into Financial Cold Cases April 14, 2010

Modus OperandiModus Operandi Inmate SearchesInmate Searches Deadbeat ParentsDeadbeat Parents Criminal RecordsCriminal Records Most WantedMost Wanted Sites Selling Criminal Supplies/EquipmentSites Selling Criminal Supplies/Equipment Newspaper, TV, Radio sitesNewspaper, TV, Radio sites

Page 41: Probing into Financial Cold Cases April 14, 2010

Personal IDPersonal ID Vital RecordsVital Records Civil RecordsCivil Records GenealogicalGenealogical Trade, Professional OrganizationsTrade, Professional Organizations Newspaper, TV, Radio SitesNewspaper, TV, Radio Sites Fee Based SitesFee Based Sites Colleges, UniversitiesColleges, Universities ResumesResumes Personal WebsitesPersonal Websites Published WritingsPublished Writings Collaborative SpacesCollaborative Spaces

Page 42: Probing into Financial Cold Cases April 14, 2010

GeographicalGeographical Maps - GoogleMaps - Google Telephone Address DirectoriesTelephone Address Directories Reverse Look upsReverse Look ups Mail DropsMail Drops Locate SitesLocate Sites

Page 43: Probing into Financial Cold Cases April 14, 2010
Page 44: Probing into Financial Cold Cases April 14, 2010

Financial

► Licenses► Bankruptcy► Civil Records► Corporations (Officer/Director)► DBA► Property Sales, Tax Records► Fee-based Search Sites► Motor Vehicles, Boats, Aircraft

Page 45: Probing into Financial Cold Cases April 14, 2010

Deep Web sites of interestDeep Web sites of interest

SEC Edgar – ownership in public companiesSEC Edgar – ownership in public companies eBay – online auctioningeBay – online auctioning Federal Express – shippingFederal Express – shipping UPS – shippingUPS – shipping Lexis-Nexis – public records, news accountsLexis-Nexis – public records, news accounts Genealogy –ancestry.com – relativesGenealogy –ancestry.com – relatives Dun & Bradstreet – business reportsDun & Bradstreet – business reports Westlaw – court casesWestlaw – court cases Secretary of state offices – corporate Secretary of state offices – corporate

recordsrecords

Page 46: Probing into Financial Cold Cases April 14, 2010

Transactional

Domain Name Owner E-mail Directories Web Site Postings Collaborative Spaces (MySpace) Search Engines Online Auctions News Groups SIGs

Page 47: Probing into Financial Cold Cases April 14, 2010

Specific Techniques:Computer Forensics

Tracing of Funds

Page 48: Probing into Financial Cold Cases April 14, 2010

Computer ForensicsComputer Forensics

► Data that ties the subject or person of interest to Data that ties the subject or person of interest to the device or media is crucial. Without the device or media is crucial. Without establishing a connection between the digital establishing a connection between the digital evidence and the subject, anything discovered has evidence and the subject, anything discovered has limited probative value.limited probative value.

► This associative evidence includes information This associative evidence includes information only known by the subject: account numbers, only known by the subject: account numbers, usernames, passwords, financial details, e-mail usernames, passwords, financial details, e-mail addresses, personal details and facts, and the like. addresses, personal details and facts, and the like.

► Creation, access, and modification dates and Creation, access, and modification dates and times in files can tie the subject to data on the times in files can tie the subject to data on the machine or device.machine or device.

Page 49: Probing into Financial Cold Cases April 14, 2010

Computer Forensics - Computer Forensics - KeywordsKeywords

► Locating keywords reflecting illicit Locating keywords reflecting illicit trade or business tells a great deal. trade or business tells a great deal.

► Or, keywords particular to the caseOr, keywords particular to the case

Page 50: Probing into Financial Cold Cases April 14, 2010

Keywords Keywords in Identity Theft Investigationin Identity Theft Investigation

► Drivers’ licensesDrivers’ licenses► Birth certificatesBirth certificates► Dumpster divingDumpster diving► Address changeAddress change► Stealing identificationStealing identification► PretextingPretexting► Bank or finance fraudBank or finance fraud► Government documents Government documents

fraudfraud► Renting propertyRenting property► Getting a jobGetting a job► Avoiding correct Avoiding correct

identification when identification when arrestedarrested

► Phone or utilities fraudPhone or utilities fraud

► Business identity theftBusiness identity theft► Personal identity theftPersonal identity theft► Credit card fraudCredit card fraud► SSNSSN► DOBDOB► Credit card skimmingCredit card skimming► NameName► AddressAddress► Trojans in identity theftTrojans in identity theft► PhishingPhishing► Shoulder surfingShoulder surfing► Cross-site scriptingCross-site scripting► Fraudulent Web sitesFraudulent Web sites

Page 51: Probing into Financial Cold Cases April 14, 2010

Forensics… TransactionsForensics… Transactions

► Data that details financial transactions in Data that details financial transactions in spreadsheets, financial statements, spreadsheets, financial statements, financial documents, loan papers, and financial documents, loan papers, and similar documents.similar documents.

► E-mails, text messages, Internet messaging, E-mails, text messages, Internet messaging, chat room discussions, Web site postings, chat room discussions, Web site postings, and other electronic correspondence that and other electronic correspondence that documents financial connections. documents financial connections.

► Evidence of online banking and financial Evidence of online banking and financial transfers.transfers.

Page 52: Probing into Financial Cold Cases April 14, 2010

Digital ThievesDigital Thieves

► Financial forms including blank negotiable Financial forms including blank negotiable instruments like checks and money orders. instruments like checks and money orders. This could be evidence of a forgery or a This could be evidence of a forgery or a counterfeiting operation.counterfeiting operation.

► Software used to generate credit card Software used to generate credit card numbers, to skim credit card numbers, or numbers, to skim credit card numbers, or to capture credit transactions from say to capture credit transactions from say retail point-of-sale wireless networks. retail point-of-sale wireless networks. Evidence of credit card fraud through Evidence of credit card fraud through stolen account numbers.stolen account numbers.

Page 53: Probing into Financial Cold Cases April 14, 2010

Electronic TheftElectronic Theft► Caches of credit card numbers and customer Caches of credit card numbers and customer

information, social security numbers, and other information, social security numbers, and other personal identifiers. Evidence of identity and credit personal identifiers. Evidence of identity and credit theft.theft.

► Desktop software to generate fraudulent invoices, Desktop software to generate fraudulent invoices, financial statements, and correspondence. Often, financial statements, and correspondence. Often, legitimate companies’ documents and logos will be in legitimate companies’ documents and logos will be in a file to facilitate creating forgeries.a file to facilitate creating forgeries.

► Accounting software to create a bookkeeping system Accounting software to create a bookkeeping system for a business. Presence of a general ledger and for a business. Presence of a general ledger and journal entries for a business, which can be legal or journal entries for a business, which can be legal or illicit. The same software could generate fraudulent illicit. The same software could generate fraudulent financial statements.financial statements.

Page 54: Probing into Financial Cold Cases April 14, 2010

Tracing of FundsTracing of Funds

► How was the business or enterprise How was the business or enterprise financed?financed?

► What commodities, goods, or services What commodities, goods, or services served as the basis for the enterprise?served as the basis for the enterprise?

► Which financial institutions were involved?Which financial institutions were involved?► Were alternative financial tools involved?Were alternative financial tools involved?► Was money laundering involved in the Was money laundering involved in the

enterprise?enterprise?► Who were the principal players in the Who were the principal players in the

enterprise? enterprise?

Page 55: Probing into Financial Cold Cases April 14, 2010

Tracing…Tracing…

► What were the personal financing What were the personal financing arrangements?arrangements?

► Were there collateral investigations Were there collateral investigations of the enterprise by the IRS, SEC, or of the enterprise by the IRS, SEC, or state taxing authorities?state taxing authorities?

► Where did the subject’s funds go?Where did the subject’s funds go?► Were there attempts to hide assets? Were there attempts to hide assets?

How did the hiding take place?How did the hiding take place?

Page 56: Probing into Financial Cold Cases April 14, 2010

Indicators of Suspicious Indicators of Suspicious Financial ActivityFinancial Activity

► Multiple transfers to foreign bank accounts,Multiple transfers to foreign bank accounts,► Constantly clearing third party checks to Constantly clearing third party checks to

foreign accounts, and attempts to deposit foreign accounts, and attempts to deposit cash in multiple bank accounts with each cash in multiple bank accounts with each deposit below the $10,000 reporting deposit below the $10,000 reporting requirement of the Bank Secrecy Act. requirement of the Bank Secrecy Act.

► Other warning signs include interlocking Other warning signs include interlocking corporate entities with common officers and corporate entities with common officers and directors, used to shuttle funds between the directors, used to shuttle funds between the entitiesentities

Page 57: Probing into Financial Cold Cases April 14, 2010

More Suspicious ActivityMore Suspicious Activity

► Regular deposits to charities in foreign countries. Regular deposits to charities in foreign countries. Terrorists operate behind front organizations and Terrorists operate behind front organizations and businesses to move money around to finance businesses to move money around to finance terrorist operations.terrorist operations.

► Layers of dummy corporations and diverse bank Layers of dummy corporations and diverse bank accounts enable them to launder and to transfer accounts enable them to launder and to transfer funds under the guise of legitimate business or funds under the guise of legitimate business or charitable operations. It creates a labyrinth of paper charitable operations. It creates a labyrinth of paper and electronic trails to follow, making it difficult for and electronic trails to follow, making it difficult for financial investigators.financial investigators.

► Using nontraditional banking channelsUsing nontraditional banking channels

Page 58: Probing into Financial Cold Cases April 14, 2010

Topic Impact Investigative Avenues

Connections:Business Entities TiesCritical AttributesTheory of the Case

Understanding the nature of the subject’s business dealings; Uncovering connections to people, business, money; Developing a working framework for understanding the relationship of money to the case.

Doing research of public records and databases, reviewing business documents, and interviewing persons knowing about past business dealings;Building a background history on the subject;Using Chronologies, Link Diagrams, Analytical Software.

Motives:Embezzlement SchemeFinancial Motives

Detecting a crime of opportunity: What opportunities did the suspect have?What role did money or financial activities play in the crime?

Investigating past work assignments, schedules, access to funds, and skill-sets.Analyzing the relationships and money flows from information developed in other avenues.

Page 59: Probing into Financial Cold Cases April 14, 2010

Sources:Explicit SourcesFraud SourcesTacit Sources

Published media, Known witnesses, Documentary evidence in the caseSubject’s involvement in illegal financial activitiesPreviously unknown witnesses, Hidden information on computers or digital devices

Doing research in print media and on the Internet;Conducting Internet footprinting of a subject’s transactions; Doing criminal histories;Locating new witnesses, doing computer forensics.

Specific Techniques:Computer ForensicsTracing of Funds

Uncovering hidden financial dealings and relationshipsWhere did the money go? Who was involved?

Locating and examining computer and digital devices;Conducting forensic accounting, hidden asset investigations.

Page 60: Probing into Financial Cold Cases April 14, 2010

More InformationMore Information

►Probing into Cold Cases – Charles C. Probing into Cold Cases – Charles C. Thomas Publisher –Thomas Publisher –www.ccthomas.com and Amazon.comand Amazon.com

►On Google search for “Ronald Mendell On Google search for “Ronald Mendell knol”knol”

►My “knol” will stay updated about the My “knol” will stay updated about the book and cold case investigationsbook and cold case investigations

Page 61: Probing into Financial Cold Cases April 14, 2010
Page 62: Probing into Financial Cold Cases April 14, 2010

MoreMore

►How To Do Financial Asset How To Do Financial Asset Investigations 3Investigations 3rdrd edition (Working on edition (Working on the 4the 4thth edition) edition)

►Charles C. Thomas Web siteCharles C. Thomas Web site►Amazon.comAmazon.com