FBI Law Enforcement Bulletin - Jan01leb

8/9/2019 FBI Law Enforcement Bulletin - Jan01leb

1/35

ISSN 0014-5688 USPS 383-310

Features

Departments

8 Focus on TechnologyComputer Intrusion

Investigation Guidelines

19 PerspectiveInternational Community

Policing Partnership

Implementing an AssetForfeiture Program

By Victor E. Hartman

When Casino GamblingComes to Your Hometown

By Tommy Moffett andDonald L. Peck

A Practical Guide to theAmericans with Disabilities Act

By Thomas D. Colbridge

1

12

January 2001Volume 70Number 1United States

Department of JusticeFederal Bureau of Investigation

Washington, DC 20535-0001

Louis J. FreehDirector

Contributors' opinions and statementsshould not be considered an

endorsement by the FBI for any policy,program, or service.

The Attorney General has determinedthat the publication of this periodical is

necessary in the transaction of thepublic business required by law. Use

of funds for printing this periodical hasbeen approved by the Director of t heOffice of Management and Budget.

The FBI Law Enforcement Bulletin (ISSN-0014-5688) is published

monthly by the Federal Bureau ofInvestigation, 935 Pennsylvania

Avenue, N.W., Washington, D.C.20535-0001. Periodicals postage paid

at Washington, D.C., and additionalmailing offices. Postmaster: Sendaddress changes to Editor, FBI Law Enforcement Bulletin , FBI Academy,

Madison Building, Room 209,Quantico, VA 22135.

Editor John E. Ott

Associate Editors Glen BartolomeiCynthia L. LewisBunny S. Morris

Art Director Brian K. Parnell

Assistant Art Director Denise Bennett Smith

Staff Assistant Linda W. Szumilo

This publication is produced bymembers of the Law Enforcement

Communication Unit,William T. Guyton, Chief.

Internet [email protected]

Cover Photo PhotoDisc

Send article submissions to Editor,FBI Law Enforcement Bulletin , FBIAcademy, Madison Building, Room

209, Quantico, VA 22135.

Police managers must learn to cope with various changes that affect their department and the community.

By implementing an asset forfeiture program, agencies can deprive subjects of ill-gotten gains, compensate victims,and better serve the community.

23The fourth and final article on the ADAfocuses on how the act impacts police hiring practices and day-to-day operations.

22 Snap ShotsCaptured Calf


2/35

January 2001 / 1

jail sentence often repre-sents an inadequate remedyfor a subject convicted of a

Implementing an Asset Forfeiture Program By VICTOR E. HARTMAN, J.D., C.P.A.

gains. Recidivism is encouraged be-cause the subject has learned thatcrime does pay.

Law enforcement agencies thatmake effective use of asset forfei-ture serve their communities by

punishing the subject, compensat-ing the victim, and minimizing soci-etal costs. Whether departmentscreate a new asset forfeiture pro-gram or reinvigorate an existingone, administrators can take certainsteps to enhance this process to in-clude developing a mission state-ment, implementing forfeiture poli-cies, and initiating asset forfeitureinvestigations.

DEVELOPING ANDIMPLEMENTING AN ASSETFORFEITURE PROGRAM

Administrators can begin bycreating a mission statement thatshows how an asset forfeiture pro-gram will deter crimes, compensatevictims, serve the community, and remain within legal boundaries.Within this statement, administra-tors should include goals that en-sure quality asset forfeiture trainingand specific objectives (e.g., dis-tribute policy to officers detailingthe departments asset forfeiture

program) that help establish proce-dures to determine those cases with

Acrime motivated by financial gain.Incarceration does not address theunjust wealth transfer to the sub-

ject, nor the expense of a victim, inthe case of property crimes. Thecriminal views the prospect of a jailsentence as a calculated cost of gen-erating revenue. The financial dev-astation of a victim can cause emo-tional scars, delay retirement, alter achilds education, or otherwisechange a lifestyle. This victimiza-tion continues when the subjecthires an attorney with the ill-gotten


3/35

2 / FBI Law Enforcement Bulletin

asset forfeiture potential. Also, themission statement should includemethods to provide positive feed-

back to those officers who effec-tively deploy asset forfeiture and reinforce the effectiveness of thislaw enforcement tool.

A department must remain at-tentive of the resources required tooperate a forfeiture program. Tosome extent, managers may need toadjust investigators caseloads tocompensate for the additional tasksassociated with asset forfeiture.Further, administrators should cre-ate or expand analytical positions toassist with the investigation, sei-zure, storage, and disposition of as-sets. In addition, training and ad-ministrative costs also willconsume resources. A departmentmust remain prepared to demon-strate its commitment to asset for-feiture by devoting resources to the

program.

Once a department has estab-lished the mission of the forfeiture program and has outlined its ben-efits, administrators should present

the program to investigators in amanner that encourages them to useit in their investigations. To thisend, several ways exist to advancethe use of asset forfeiture within adepartment. First, chief executivesshould involve all relevant indi-viduals in the drafting of the forfei-ture mission statement, goals, and objectives. Further, administratorsshould establish policy to reviewevery case under investigation for asset forfeiture potential, and to ac-knowledge investigators, a depart-ment could publish a newsletter about successful seizures and other asset forfeiture matters. Once moti-vated, investigators will seek training and liaison with other agen-cies in an effort to help accomplishthis mission.

MANAGING AN ASSETFORFEITURE PROGRAM

Although it might not constitute

the most rewarding aspect of assetforfeiture, indispensable legal and procedural requirements exist thatdepartments must meet. Because

forfeiture laws vary between juris-dictions and case law changes fre-quently, departments must have aknowledge of the legal require-ments and a mechanism for ensur-ing their compliance. For example,officers should realize the need for a seizure warrant early in the inves-tigation not only to avoid seriousliability issues, but to structure theinvestigation in a way that willgather the necessary facts to meetthe elements of the warrant. After a seizure, investigators must pro-vide timely legal notice to subjectsand interested third parties. If asubject contests a forfeiture, theinvestigator must work with the

prosecutor to ensure that legal dis-covery issues do not compromise aninvestigation.

Once a department seizes as-sets, they must safeguard the prop-erty until they resolve all legal is-sues. This process may begin withthe removal of the property from thesubjects custody and usually endswith the return of the property to avictim or an innocent owner or its

sale at an auction. Some of the ad-ministrative tasks may include thetowing of automobiles for safekeep-ing and appraising, storing jewelry,counting and depositing cash into a

bank account, and maintaining realestate. Prior to seizing animals, de-

partments must remember that themaintenance of livestock, racehorses, and other animals duringlitigation can prove problematic.

The only effective way to en-sure that the department remains in

compliance with the law, and itsinternal policies, is to develop and maintain a procedures manual. Adepartment can benefit greatly by

Asset forfeiture laws...allow law

enforcement to use proceeds of certain

seizures for equipment and other

needs....

Special Agent Hartman serves in the FBIs Houston, Texas, field office where he served as the Forfeiture Coordinator for several years.


4/35

January 2001 / 3

reviewing the policy manual of anagency with a successful forfeiture

program before developing or up-dating its own procedures manual.

INITIATING AN ASSETFORFEITUREINVESTIGATION

Once a department has devel-oped a mission statement and implemented forfeiture policy, in-vestigators can initiate forfeiture in-vestigations. Although forfeiturelaws vary, two legal theories haveevolved. One, commonly known asthe facilitation theory, involves asubjects use of property to facili-tate a criminal act, and the other involves the proceeds of a criminaloffensecommonly known as the

proceeds theory.Common investigative tech-

niques and legal issues involve boththeories. First, asset forfeitureshould remain one of the investiga-tive priorities of the case. Once of-ficers develop an investigativestrategy, the search for assets can

begin. This process includes sur-

veilling subjects, debriefingsources, issuing subpoenas, and searching public records.

At some point in the case, theinvestigator should brief the forfei-ture attorney on the status of thecase. Depending on the jurisdictionand the facts involved, the forfei-ture attorney may have the option of

bringing a criminal or civil forfei-ture action against the property.Pros and cons exist when using ei-ther of these methods of forfeiture.

A civil action generally allows for earlier seizure of assets, but risksflight by the subject. A criminal for-feiture action allows for both theseizure of assets and the arrest of

the subject, but risks dissipation of assets because this action generallyoccurs at the conclusion of an inves-tigation. Although the incarcerationof the wrongdoer should remain thehighest priority of the investigation,officers must give careful consider-ation to asset seizure early in theinvestigation to ensure a successfuloutcome.

Defense attorneys commonlyuse the approach that the property

belongs to an innocent owner usually a spouse. In some cases, in-vestigators can defeat this defense

by obtaining evidence that the al-leged innocent owner had knowl-edge that the property was involved in the criminal conduct. Addition-ally, the U.S. Supreme Court hasfound that the prosecution of thedefendant and the forfeiture of

property does not constitute double jeopardy. 1

Facilitation TheoryThe facilitation theory allows

the government to seize property

when it facilitates certain criminalconduct. 2 This theory provesmost applicable in drug investi-gations and allows for the forfeitureof property involved in the

manufacture, delivery, and sale of controlled substances. In practicalterms, this can include real estateused to store drugs, automobilesand boats used to transport drugs,and other facilitating property, suchas cash and firearms.

Investigations involving facili-tating property differ in at least twoways. First, the legal threshold toseize facilitating property usually iseasier to obtain. The law requiresthat probable cause exists to showthat the property to be seized facili-tated an illegal act. Investigatorscan take a few additional steps tohelp develop adequate probablecause. For example, during surveil-lances, investigators should noteand fully describe all facilitating

property and debrief sources aboutthe subjects use of the property.This can range from something aselementary as observing a subjectdrive a car to a drug transaction tohaving a reliable source witnessdrugs stored in a house.

The timing of seizures duringan investigation also remains cru-

cial. Because drug subjects often present a flight risk, investigatorsshould consider seizing property atthe time of arrest or during the ex-ecution of search warrants. If inves-tigators structure a scenario prop-erly, they can draw subjects and their property (e.g., their vehicle) toa common location. This enablesthe investigator to accomplish all of the goals in the investigation with-out risk of flight of the subject or dissipation of assets.

Proceeds TheoryThe proceeds theory allows the

government to seize property thatrepresents the proceeds of certain

...officers must give careful consideration

to asset seizure early in the investigation to ensure a successful

outcome.


5/35


...law enforcement agencies must ensure

that they use asset forfeiture only when

they can demonstrate the benefits to the

community.

specified unlawful activities. 3 Thistheory proves most applicable inwhite collar investigations and al-lows for the forfeiture of propertyrepresenting the proceeds of vari-ous economic crimes, investmentsscams, and property offenses. The

property subject to forfeiture oftenincludes bank accounts, real estate,and automobiles.

Investigators must take certainsteps, which often prove complex,to seize property based on the pro-ceeds theory. Similar to the facilita-tion theory, investigators must iden-tify property and prove ownership

before seizure can occur. However,the government also must trace theasset to the crime itself. The investi-gation becomes more complicated each time the subject converts the

proceeds from one form to another.For officers to establish that an

asset represents the proceeds of acriminal offense, they should ini-tiate two investigative steps simul-taneously. First, investigatorsshould identify the assets that initi-ated the criminal offense and trace

the proceeds forward. Second, theyshould identify all known assetscontrolled by the subject and tracethe purchase money backwards. For example, in a typical investmentscam the subject will deposit thevictims money into a bank account.Then, the subject usually spends thenewly acquired wealth on high-dol-lar assets. To further complicate is-sues, the subject may conduct sev-eral financial transactions with thefunds. By tracing the victims pro-

ceeds forward and the subjectsknown assets backwards, the inves-tigator eventually will establish thatthe subjects assets are proceeds of the crime.

In white collar investigations,subjects usually learn of lawenforcements involvement beforethe agency files criminal charges.This occurs because the investiga-tion may become lengthy and require interviews of many parties.White-collar subjects, as a general

Department of Justices (DOJ) as-set forfeiture fund in the mid-1980s,almost $2.5 billion have beenshared with state and local agen-cies. 4 Further, asset forfeiture fos-ters cooperation among federal,state, and local law enforcementagencies through the use of adop-tion and equitable sharing. 5 Whenthe federal agency agrees to processthe seizure under federal forfeiture

provisions and remits the proceeds back to the originating agency, this process constitutes equitable shar-ing. In one statutory requirement for sharing, the U.S. Attorney Generalmust assure that the sharing willencourage further cooperation be-tween the department seizing theassets and the sponsoring federallaw enforcement agency. 6

Because asset forfeiture is notappropriate in every case, adminis-trators should evaluate asset sei-zures from a policy perspective.Throughout the history of thegovernments use of asset forfei-ture, critics have attempted to pre-vent law enforcement agencies

from expanding their use of this ef-fective law enforcement tool. In aneffort to thwart those attempts, lawenforcement agencies must ensurethat they use asset forfeiture onlywhen they can demonstrate the ben-efits to the community. For ex-ample, some individuals may criti-cize law enforcement agencieswhen the value of the seized asset isdisproportionate to the offensecommitted, when the subject is asympathetic figure (e.g., a single

mother), or when a seizure creates ahardship on a third party. Becauselaw enforcement agencies use assetforfeiture as a tool to serve commu-nities, if the public perceives that

rule, remain less likely to flee the jurisdiction. However, as the inves-tigation continues, the potential for asset seizures greatly decreases asthe subject spends the proceeds,

launders the money, and hires attor-neys to defend civil and criminallawsuits. Accordingly, in white col-lar investigations, the seizure of as-sets early in an investigation re-mains the single greatest factor to asuccessful outcome.

USING ASSET FORFEITURELAWS APPROPRIATELY

Asset forfeiture laws at the fed-eral level, and in most states, allowlaw enforcement to use proceeds of

certain seizures for equipment and other needs, especially when theseized property is drug related and there are no victims to compensate.Since the inception of the U.S.


6/35

January 2001 / 5

agencies abuse this tool, both lawenforcement and the communitywill suffer.

An analysis of the depositsmade into the DOJs Assets Forfei-ture Fund (Fund) reflects how

external events impact thegovernments ability to conduct as-set forfeiture. The passage of addi-tional asset forfeiture legislation inthe mid-1980s resulted in an in-crease of deposits into the Fund. 7 In

fact, the enforcement of thatlegislation resulted in an increase inthe dollar amount of forfeitures thatlasted from the mid-1980s to theearly 1990s. 8 However, the increasein forfeitures parallelled an increase

1. Law enforcement is the principle objectiveof forfeiture. Potential revenue must not beallowed to jeopardize the effective investiga-tion and prosecution of criminal offenses,officer safety, the integrity of ongoing investi-gations, or the due process rights of citizens.2. No prosecutors or sworn law enforcementofficers employment or salary shall be madeto depend upon the level of seizures or forfei-tures they achieve.3. Whenever practicable, and in all casesinvolving real property, a judicial finding of

probable cause shall be secured when propertyis seized for forfeiture. Seizing agencies shallstrictly comply with all applicable legalrequirements governing seizure practice and

procedure. 9

4. If no judicial finding of probable cause issecured, the seizure shall be approved inwriting by a prosecuting or agency attorney or

by a supervisory-level official.5. Seizing entities shall have a manual detailingthe statutory grounds for forfeiture and allapplicable policies and procedures.

National Code of Professional Conduct for Asset Forfeiture

6. The manual shall include procedures for prompt notice to interest holders, theexpeditious release of seized propertywhere appropriate, and the prompt resolu-tion of claims of innocent ownership.7. Seizing entities retaining forfeited

property for official law enforcement useshall ensure that the property is subject tointernal controls consistent with thoseapplicable to property acquired through thenormal appropriations processes of thatentity.8. Unless otherwise provided by law,forfeiture proceeds shall be maintained in aseparate fund or account subject to appro-

priate accounting controls and annualfinancial audits of all deposits and expendi-tures.9. Seizing agencies shall strive to ensurethat seized property is protected and itsvalue preserved.10. Seizing entities shall avoid any appear-ance of impropriety in the sale or acquisi-tion of forfeited property.

Note: The National Code of Professional Conductfor Asset Forfeiture was developed by the DOJ s Asset Forfeiture and Money Laundering Section.


7/35


in public scrutiny and legalchallenges that culminated in a1994 federal appellate court deci-sion known as United States v.$405,089.23 in U.S. Currency .10That decision, which held that for-feiture constitutes double jeopardyunder certain circumstances, had asignificant chilling effect on lawenforcements efforts to pursue as-set forfeiture. Although the U.S.Supreme Court ultimately reversed that opinion in 1996, 11 Fund depos-its declined during the 2-year period when the lower federal court hold-ing was valid law. 12

COORDINATINGFORFEITURE TRAININGAND LIAISON

Asset forfeiture training pre-sents an excellent opportunity for adepartment to instruct its investiga-tors about this law enforcement tooland develop liaison with other agencies. Joint training conferenceswith local, state, and federal agen-cies and the district attorney enableall participants to forge partner-

ships in their local communities. Atraining agenda should include top-ics of mutual interest such as legalissues, investigative techniques,and the mechanics of seizing and disposing of assets.

Smaller departments have themost to gain from establishingeffective liaison with their stateand federal counterparts becausethey often do not have the re-sources or expertise to handlecomplex forfeiture investigations.

Also, small departments have theoption of working a case jointlywith other authorities or submittingthe seizure to a federal agency for adoption.

This type of training and liaisonalso enhances the relationship

between the investigator and forfei-ture attorney. Depending on the ju-risdiction, the forfeiture attorneymay be the prosecutor or a civil at-torney. Regardless of who holds theresponsibility, the investigator and forfeiture attorney working intandem remains the single most im-

portant factor in a successful forfei-ture program. Also, training allows

...asset forfeiture fosters cooperation

among federal,state, and local law

enforcement agencies....

the participants to learn their role inthe forfeiture process and toidentify experts in the field whothey can call upon to assist in forfei-ture cases. The presentation of caseexamples provides an excellent op-

portunity for all participants to dis-cuss investigative techniques used to locate assets, the legal basis toseize assets, and the legal require-ments to forfeit and dispose of as-sets. More important, training and liaison promotes teamwork among

everyone involved.CONCLUSION

Asset forfeiture remains a powerful tool for law enforcement

agencies. It remedies many of the problems that often slip through thecriminal justice system, such as ad-dressing the issue of allowing acriminal to profit from crime, and it

provides a remedy for the victim. Inshort, asset forfeiture deprives thesubject of ill-gotten gains, compen-sates the victim, and serves thecommunity.

Initiating a forfeiture programinvolves addressing a variety of

policy issues and administrative aspects. When creating an asset for-feiture program for their depart-ment, police administrators firstshould develop a comprehensivemission to include specific goalsand objectives. When developingthese management tools, a depart-ment must consider priorities, costs,and benefits associated with the

program. A department also mustestablish safeguards to ensure theyimplement asset forfeiture onlywhen appropriate.

When developing a forfeiture program, policymakers should re-main aware of various factors that

impact the success of this tool.Management must also consider other benefits and associated costsof a forfeiture program when priori-tizing their program, and in an ef-fort to prevent perceived abuses,they should include measures to en-sure that each asset seizure is appro-

priate and has a legal basis.Administrators should ensure

that their officers understand howtheir asset forfeiture program worksand that they receive proper training

on asset seizure. Additionally, theyshould encourage officers to estab-lish liaison with the prosecutorsoffice and other individuals in-volved in the forfeiture process.


8/35

Finally, investigators can applytheir newly acquired skills to seizecriminals assets. Regardless of which theory departments use, theresults are more likely to have asuccessful outcome if officers seizethe assets early in the investigation.When appropriate under the cir-cumstances, investigators should seize early and seize often.

Endnotes1 United States v. Ursery , 116 S. Ct. 2135

(1996).

2 Under federal law, the facilitation theoryfor controlled substance violations is derived from 21 U.S.C. 881.

3 Under federal law, the proceeds theory for various predicate violations is derived from 18U.S.C. 981 and 982.

4 U.S. Department of Justice (DOJ) JusticeManagement Division.

5 DOJ agencies gain their equitable sharingauthority from 21 U.S.C. 881(e)(1)(A) and (e)(3), 18 U.S.C. 981(e)(2), and 19 U.S.C. 1616a.

6 21 U.S.C. 881(e)(3)(B).7 The Comprehensive Crime Control Act of

1984 and the Anti-Drug Abuse Act of 1986 significantly strengthened and expanded the existing forfeiture provisions of prior law.

8 The DOJs Justice Management Divisionreports that deposits into the DOJ AssetsForfeiture Fund increased from $93.7 million in1986 to $644.3 million in 1991 and the number of seizures increased from 3,700 in 1985 to32,400 in 1992.

9 Generally, real property can only be seized following an adversarial preseizure hearing. SeeUnited States v. James Good Real Property ,114 S. Ct. 492 (1993).

10 33 F.3d 1210 (9th Cir. 1994).11 Supra note 1.12 The DOJs Justice Management Division

reports that deposits into the DOJ AssetsForfeiture Fund decreased from $549.9 millionin 1994 to a low of $338.1 million in 1996,representing a 39 percent decrease.

January 2001 / 7

Subscribe Now


9/35


evidence can be very complex. First, the investigator needs to understand the basics of a hack or anintrusion. The hacker, or intruder, essentially breaksinto a number of computers or computer systems toobtain either root or user level access to a computer.A hacker does this for three reasons.

Storage: the hacker finds a victim computer tostore tools and programs that can be used toexploit other computers;

Protection: the hacker typically establishes anumber of jumps, or stepping stones in route toa particular computer or computer system. This

process hides the location of the hacker, including protecting the original Internet provider (IP) of the hack; and

Exploitation: the hacker wants to exploit a computer or computer system to obtain information or vandalize the computer.The investigator can track the hacker by imple-

menting three investigative techniques: Operations: the investigator goes undercover; Sources: the investigator develops sources that

provide information about hackers and their activities; and

Investigation: the investigator uses variousmethods to legally obtain computer records(normally security and audit logs). These

records are then examined in an effort to surfaceevidence. These records give the investigator theopportunity to track, or trace, back the hacker.This should not to be confused with hacking

back, which is illegal.

INVESTIGATION BASICSAs with any investigation, investigators have

many leads to follow. In the computer intrusioninvestigation, the initial steps are the same. This is

because most computer intrusions are remarkablysimilar in nature. When hackers break into a govern-ment computer system, the Department of Defense(DOD) typically learns of it through intrusion detec-tion systems, from other law enforcement agencies, or

by obvious Web page defacement. Computer intru-sion cases are directed to the DOD's Defense CriminalInvestigative Services Computer Crimes Investiga-tion Program. Hackers make a number of jumps fromtheir computer through various other computers or computer system. For technical reasons, the number of these jumps is limited, but each of these jumps is

probably a victim.To track down these hackers, federal agents must

obtain and review various logs from each of the jumpsor victims. If these logs are obtained in a timelyfashion, the investigation will lead quickly to either the hacker or a dead end. Generally, the dead end often results when hackers jump through or from

T he process of catching the hacker may besimple, but obtaining and analyzing the

Focus on Technology

Computer Intrusion Investigation Guidelines By J. Bryan Davis

This article is a condensed version of theDepartment of Defenses Defense Criminal Investigative Service Computer Intrusion Investigation Guidelines . Some steps in theguidelines may not apply to similar FBI or otherlaw enforcement agency investigations.

John Foxx Images


10/35

January 2001 / 9

foreign countries. Sometimes, the dead end occurs because the investigator could not obtain the computer logs.

It should be noted that, due to the nature of thehacker culture, hackers commonly share their exploitswith other hackers. This means that it is very commonto find out that more than onehacker has broken into a particular computer or computer system.Although the intrusion may have

just occurred, it is typically at leasta few hours or a few days old.

Most investigations beginwhen the investigator receives acall or complaint from a DODComputer Emergency ResponseTeam (CERT); a systems adminis-trator or computer security person-nel; or a witness or confidential or registered source. The initial

phases of a computer intrusioninvestigation can be broken downinto 12 steps.

THE TWELVE STEPS

Step OneObtain the identifying data on the caller.

Step TwoObtain the identifying data on the victim computer. What is the victim IP? What agency does it belong to? Who is the system point of contact (POC)?Is the victim computer mission critical?

Step ThreeObtain the known particulars of the intrusion.

This is sometimes called the ticket information.What is the source IP? When did the incident occur?What method of intrusion was used? Was it a root or user level intrusion?

Step FourDetermine if the victim computer has beensecured (i.e., has it been taken off line and stored to

protect the evidence). Has the system administrator

removed all hacker programs, sniffers, and tools?Have the appropriate security patches been installed?

Step Five

Meet with the system administrator and determineif the victim computer should be taken off-line and taken into evidence or if the victim computer can be

left on-line and used to monitor thehackers future activity.

Step SixArrange to have the computer

seized as evidence, or have amirror image made of the victimcomputers hard drive.

Step Seven

Determine the appropriatemethod of obtaining computer records from the source (e.g., thesource computer/computer system/network). Depending on the typeof computer or computer system,investigators can use five methods

to obtain computer records. The method the investiga-tor uses is determined by the Stored Wire & Elec-tronic Communications Act. The five methods are

official request; inspector general subpoena;

grand jury subpoena; court order; or search warrant

Step EightContact the source and obtain its computer logs.

Step Nine

Make arrangements to have the victim systemexamined. The forensic analysis of a computer system is called a system autopsy.

The System AutopsyThere are essentially two types of system autop-sies: 1) an abbreviated autopsy, which identifies

...it is very commonto find out thatmore than one

hacker has brokeninto a particular

computer orcomputer system.


11/35


the basics of the intru-sion and begins toestablish probable causefor court orders and search warrants and 2) acomprehensive autopsy,or forensic analysis,which is acceptable for criminal trial. Theabbreviated autopsyshould be accomplished within a few days of theintrusion. The compre-hensive autopsy cantake weeks or evenmonths.

Available ResourcesAn expert in the field of system analysis should

perform the system autopsy. Various resourcesavailable for assistance include:

the DODs Computer Forensics Laboratory; the DOD CERT; and Other federal law enforcement agencies (includ-

ing the FBI, the MCIOs and the NASA OIG).In addition, investigators can use a number of auto-mated tools to perform the system autopsy.

The Analysis ProcessThe system autopsy is the process of finding out

what the hacker did to a given computer and what thehacker left behind. This can usually be accomplished using these 10 investigative techniques:

1) Examine the computers log files and backupsworking with a mirror image of the victim system.Keep in mind that these logs may have beenaltered by the hacker(s). Reviewing system

backups and comparing these to the victimmachines logs may help identify any alterations.Examine Wtmp files, history logs, messagelogs, the syslog fire wall logs, router logs, and

proxy server logs.2) Examine all files run by cron and at.System administrators usually automate the

logging processes. Cronis the utility used to dothis automation. Hackerssometimes use cron toautomate their processesas well.3) Examine the /etc/

password file for alterations. The /etc/

password file containsthe encrypted passwordsof all users. Look for alterations, blank entries,and empty password fields.

4) Check the system for unauthorized services,such as backdoor versions of finger, rsh,rlogin, ftp, or other services.5) Check the system for sniffer programs.6) Check the system for trojanized programs.7) Look for setuid and setgid files, whichmay provide the hacker with root access to thesystem.8) Look for + entries which signify that allincoming connections are from trusted computers.Look for nonlocal host names.9) Look for unusual and hidden files.10) Review all processes currently running onthe system.

Step Ten

Review computer system and attempt to deter-mine the next jump back.

Tracking Back In principle, tracking the hacker is simple. Once

an intrusion is reported, the investigator has a vic-tim. This is the first victim, or the final site or last

jump taken by the hacker. A review of computer

security and audit logs usually surface the first jump backtypically the second victim. After evaluatingthe known facts about this second victim, the investi-gator can determine the method best required to

Although the intrusion may have just occurred, it is typically at least a few hours or a few days old.

John Foxx Images


12/35

January 2001 / 11

obtain the victim's security and audit logs. The reviewof the second victims security and audit logs cansurface information that identifies the next jump

backusually the third victim.

Possible ConclusionsThe investigator continues this process of tracing

back the hackers jumps. This investigative processleads to one of three conclusions:

The hacker is located. At this point, traditionallaw enforcement techniques such as arrest war-rants, search warrants, trap and trace, or other techniques come into play.

The trace back leads to a foreign country. De- pending on the particulars, this case may now fallinto the area of foreign counterintelligence. It may

lead to a joint investigation with foreign lawenforcement organizations. Or, it may result in aninvestigative dead end.

The trace back leads to a dead end within theUnited States. This typically happens when one of the victim sites cannot provide useful records,when records could not be obtained in a timelymanner, or when the hacker was able to spoof,or fake, the IP address.

Step ElevenMake arrangements to have the source logs

examined.

Step TwelveConduct appropriate interviews.

CONCLUSIONAs computer intrusion crimes increase and

hackers become more efficient, the investigators roleand task will become more difficult. However, theseguidelines should help answer some basic questionsencountered at the onset of any computer intrusioninvestigation.

Special Agent Davis serves with the Defense Criminal Investigative Service, Department of Defense, in Arlington, Virginia. To obtain a copy of the DCIS Computer Intrusion Guidelines in its entirety,contact Special Agent Davis 703-607-6488 or via e-mail at

[email protected] or [email protected].

Wanted:Photographs

he Bulletin staff isalways on the lookoutT

for dynamic, law enforce-ment-related photos for

possible publication in themagazine. We are interested in photos that visually depictthe many aspects of the lawenforcement profession and illustrate the various taskslaw enforcement personnel

perform.We can use either black-

and-white glossy or color prints or slides, although we prefer prints (5x7 or 8x10).Appropriate credit will begiven to contributing photog-raphers when their work appears in the magazine. Wesuggest that you send dupli-cate, not original, prints aswe do not accept responsibil-ity for prints that may bedamaged or lost. Send your

photographs to:

Brian Parnell, ArtDirector, FBI Law

Enforcement Bulletin ,FBI Academy, MadisonBuilding 209, Quantico,VA 22135.


13/35


man, wanted on a federal fugitivewarrant, makes threatening tele-

phone calls to his former girlfriend inAWest Virginia. The calls follow an argument

they had when he shot and seriously wounded her and then fled the state in a stolen car. FBIagents from the Huntington, West Virginia,resident agency traced the call to a pay phonenear a gift shop in a casino in Biloxi, Missis-sippi. Within several minutes, FBI agents innearby Gulfport, Mississippi, drove the shortdistance to the gift shop and confronted a manfitting the description. They positively identi-fied him as the fugitive and arrested him with-out incident. 1

Photo Disc

When Casino Gambling Comes to Your Hometown

The Biloxi Experience By TOMMY MOFFETT and DONALD L. PECK, M.S.


14/35

January 2001 / 13

Special Agent Peck is an instructor in the Investigative Training Unit at the FBI Academy.

Chief Moffett heads the Biloxi,Mississippi, Police Department.

Tourists and other visitors havelong been attracted to MississippisGulf Coast area around Biloxi for the sandy beaches, warm weather,and great seafood, but the recentlegalization of casino gambling hasincreased Biloxis popularity dra-matically. Only a few of the newvisitors, like the fugitive in theopening scenario, will raise con-cerns for local authorities; however,as criminals increase, they will

place new responsibilities on thosecharged with protecting the public.

Undoubtedly, casinos have pro-duced a boom for the local economyover the last 9 years and they haveforever changed the city and theBiloxi Police Department (BPD).This industry now attracts morethan 40,000 additional visitors per day to Biloxi and generates slightlymore than $17 million a year in rev-enue for the local government, aswell as an additional $6 million tothe county and $57 million a year tothe state. 2

As Biloxi managers look ahead,they naturally focus on future

challenges. But as the police department plans for an upcomingmove to a new $10 million publicsafety building, officials can look

back and appreciate the changesthat have occurred. These dramaticchanges have produced valuablelessons in successful comm-unity planning, organizationalleadership, change management,and the role of the police executive.

THE WAVE THEORY

Domestic lotteries first sur-faced in the 1740s, primarily to fi-nance public works projects in thecolonies. They generally had be-come accepted by some of the

colonists when the crisis of theRevolutionary War forced the Con-tinental Congress to authorize a na-tional lottery to raise funds. 3 This

period in American history, some-times characterized by an accep-tance of gambling for worthycauses, is referred to as the first of three waves of legal gambling in theUnited States. 4

By the end of the Civil War,many states had legalized some

form of gamblingoften state lot-teriesto stimulate the depressed economies in the south and thewest. The lotteries soon began todisappear for a variety of reasons,and by 1878, only one remained inLouisiana. Even after a serious cor-ruption scandal involving the Loui-siana lottery in the 1890s, it stilltook federal legislation to force lo-cal officials to end the lottery. Bythe turn of the century, this second wave had ended. 5

While some historians havetraced the origins of the currentwave of legal gambling to the startof the Great Depression in the early1930s, 6 others believe that the

present day growth of legal gambling resulted from the decision by New Hampshire in 1964 to reintro-duce the state lottery. 7 That deci-sion, probably more than any other,set in motion a series of events thatexposed most Americans to someform of legal gambling. Thisindustry has grown as more peopleconsider gambling an entertainmentand not a vice, and an increasingnumber of state governments view

gambling as a source of jobs and revenue.

AMERICAN GAMBLINGIn preparing for change, the

BPD examined the history of legalgambling in this country and stud-ied past efforts to handle law en-forcement issues. Long before thearrival of casinos in Biloxi, the his-tory of legal gambling in the United States seemed to be a cycle of government prohibition against

gambling followed by some na-tional crisis. The government would then promote some form of legalgambling to solve the crisis and subsequently return to a general


15/35


prohibition. New prohibitions oftencame as the result of some scandalrelated to the administration of thegambling initiative, which ulti-mately discouraged many cities onthe whole industry. 8

Some individuals believe thatissues like legal gambling, and theaccompanying forms of 24-hour en-tertainment, have historically di-vided the different cultures and geo-graphic regions that make up theUnited States. Even in todays envi-ronment, legal gambling of anykind divides many communities be-cause some individuals often per-ceive it as socially destructive and morally wrong.

As early as 1988, casino gambling was legal in Nevada and NewJersey. Now, Utah and Hawaii arethe only states without some formof legal gambling. 9 While Missis-sippi has become one of the major centers in the growth of the casinoindustry, most Americans now liveonly a short drive away from someform of legal gambling. Early rec-ognition of the impact that casinos

can have on local services, coupled with good planning by the BPD, prevented many of the problemsother communities with casinos un-derwent. The projected revenueestimates from the proposed casi-nos made it difficult for the policeand other local officials to look be-yond such windfalls. However, thewillingness of officials to focus onthe changes that would occur ulti-mately proved the reason for Biloxis success.

MISSISSIPPI GAMBLINGCasino gambling came back to

Mississippi in 1987 when cruisesto nowhere departed Biloxi and

treated passengers to onboard gambling as soon as the ship reached international waters in the Gulf of Mexico. 10 The state of Mississippiinitially fought this gambling initia-tive in the courts, but by 1989, it had

become the first state to allow gambling in state waters on cruise shipsin transit to or from internationalwaters. 11

By the next year, the Missis-sippi legislature had passed a com-

prehensive law that legalized dockside casino gambling and cre-ated a state gaming commission.This 1990 law enabled the voters of 14 counties along the MississippiRiver and the Gulf Coast to de-cide, by referendum, if theywanted dockside casinos in their communities. 12

As local voters prepared to de-cide this issue in 1990, Biloxi found itself nearly bankrupt and 6 months

behind in repaying its debtors. 13 The police departments equipment wasdeteriorating, and the city could not

afford to replace officers who leftthe department. This countywide is-sue divided voters in HarrisonCounty and the major cities of Biloxi, Gulfport, and Long Beach.

Few options seemed to exist for thefuture of Biloxi, but the voters of Harrison County overwhelminglyrejected this initiative. A change inthe state law enabled the voters ineach city in the counties to decidethe issue for their locality, and in1991, voters in Biloxi approved thenew referendum and the first of ninedockside casinos opened in Biloxiin 1992. 14 Mississippi now has 29casinos in operation, and it has be-come the third largest gaming cen-ter in the country. 15

Legalizing gambling did notcome without a price to the citizensof Biloxi. According to BPD data,crime figures for Biloxi show anincrease in reported crimes sincethe first casino opened in 1992. 16 Tohelp ally fears about this increase incrime in those localities approvingcasino gambling, Mississippi lawmandated that 20 percent of the ca-sino revenues returning to the com-munity would supplement the local

public safety budget.

THE IMPACT ON CRIME

As senior staff members at theBPD prepared for the inevitablechanges, they had the advantage of access to past studies by academi-cians and practitioners. In a 1976report, the U.S. Commission on theReview of the National Policy To-ward Gambling had cautioned about corruption and the incompat-ibility of revenue raising and crimecontrol when jurisdictions legalizegambling. 17 Crime figures reported to the FBI in the 9 years after the

first casino opened in New Jersey in1977 showed that the incidence of all crime combined had increased 138 percent. 18 This crime problem,and the anticipated increase of

Police managers need to assure the

community that their department vigorously enforces

gambling laws....


16/35

January 2001 / 15

citizen participation in legal as wellas illegal gambling, raised a con-cern in the 1988 report of the NewJersey Governors Advisory Com-mission on Gambling. 19 These his-torical studies convinced Biloxi of-ficials that their city would suffer from an increase in crime as well.

CHANGES AT THE BILOXIPOLICE DEPARTMENT

Biloxi officials attribute thecitys success since the arrival of casinos to a good partnership be-tween the police department and thecommunity and good planning bygovernment officials at all levels.As a result of the influx of newrevenue to the city, the police de-

partment hired additional officersand increased their starting salary.At the same time, the departments

budget more than tripled. 20 Part of this new money also enabled thecity to build a new public safety

building for the police and firedepartments.

Within a very short period after the arrival of legal gambling, an ad-

ditional 11,000 jobs linked directlyto the casinos came to the areaaround Biloxi. In addition to those

positions, another 18,000 jobs asso-ciated indirectly with the casinos

became available in the community.The unemployment rate declined from about 8 percent before the ca-sinos to about 3 percent today. 21

In 1990, Biloxi, a congested peninsula, covered approximately25 square miles with a population of 46,319. Officials estimate that

Biloxis population has grown dur-ing the last decade to more than53,400. In 1999, Biloxi annexed asmall area to the north and added approximately 34 square miles and

an additional 4,000 individuals tothe city. 22 This growth, primarilydue to casino gambling, forced offi-cials to face the challenges of polic-ing the new Biloxi.

BPD managers tried to recog-nize the many positives, as well asthe negatives, of casino gamblingand began to focus on the variouschanges the department needed tomake. Besides anticipated newcrime problems, managers realized that casino gambling also would impact the departments employ-ees. Past corruption scandals asso-ciated with casino gambling evoked images in the publics mind of thearrival of organized crime figuresnear the casinos, bribery scandalsinvolving elected officials, and corrupt police officers. 23 Police

officials had to put forth a dedicated effort to negate this perception and ensure that it did not become realityin Biloxi. The first efforts involved four stages and dealt with personalconduct issues, traffic enforcement

priorities, department reorganiza-tion, and interagency partnerships.

Personal Conduct for EmployeesDuring the first stage of a re-

view of departmental policies, man-agers revisited ethics and personalconduct issues. Police managersrecognized that the employees atthe department remained just assusceptible to gambling-related

problems as anyone else in the com-munity. To address this issue, BPDmanagers restated the agencysstandards. The department had to

Comparison of Crime Rate Trends, 1989-1998


17/35


prevent or respond to any problemsthat surfaced from its employeeswho patronized the casinos. Manydepartments have established Em-

ployee Assistance Programs (EAP)to augment programs availablethrough insurance companies. Be-cause insurance benefits are oftenlimited, the establishment of anEAP received high priority.

Additionally, the departmenthad to reinforce policy guidelineson the critical relationship betweenthe role of investigators and main-taining the integrity of investiga-tions. One of the first policy amend-ments made to manage perceptions

prohibited police employees fromengaging in any off-duty employ-ment at the casinos. Policy forbid anyone who regularly patronized the casinos from conducting crimi-nal investigations at the casinos.Additional guidelines prohibited officers in uniform from takingmeal breaks in the casinos.

Traffic Enforcement Priorities Next, the department made a

priority of the enforcement of gen-eral traffic offenses and, particu-larly, driving under the influenceviolations. Biloxi could expectmore than 40,000 visitors each day,and the police department had toensure that the city remained safefor residents and visitors alike.

Hurricane evacuation plansalso came under this review.Biloxis position on the coast al-ways has made hurricane evacua-tion plans a priority for city offi-

cials. Now that Biloxi had becomemore of a vacation destination for families and large groups, contin-gency plans would have to account

for tens of thousands of additionalvisitors during this period. The lim-ited number of evacuation routesfrom the coast always has presented a challenge to traffic and emer-gency services planners. Every sea-son they must prepare new plansthat require evacuating more peopleand staging larger emergency shel-ters inland.

Department ReorganizationThe third area of review in-

volved recognizing that gamblingand gamblers attract many of thetraditional vices (e.g., prostitution,

pornography, loan-sharking, and extortion). The department reorga-nized its vice and narcotics unit intoseparate units to more effectivelyinvestigate the increased violations.The department anticipated that

pawn shops would experience moreactivity with casinos in town, and within a year, the number of pawn-shops had doubled. Within the next

4 years, the number had doubled again to more than 30. While thisdid not necessarily indicate thatmore people were pawning stolen

property, it did require that the department dedicate resources tomonitor this increased activity toavoid future problems.

Partnerships Between AgenciesThe BPD had always fostered

working relationships with other law enforcement agencies in thearea, but the introduction of casinosrequired a renewal and rededicationof these efforts. The last major issueinvolved developing a CasinoCrimes Task Force with the FBI and other federal, state, and local agen-cies. The task force would targetthose groups involved in check and credit card fraud, prostitution,money laundering violations, and

pornography occurring in and around the casinos. The task forcehelped generate successful prosecu-tions of these complex investiga-tions. The gaming commission and the police department continued toinvestigate regulatory violationsand some cheating cases at the casi-nos, but the task force remained dedicated to the investigation of or-

ganized criminal groups.In addition to crimes at the casi-nos, the police department experi-enced an increase in the investiga-tions of robberies, check and creditcard fraud, property crimes,domestic abuse, and alcohol-related violations. The dramatic increase inthe local population fueled the in-creases in reported crimes.

LESSONS LEARNEDOrganizational change proves

both healthy and inevitable, but thechanges associated with the impactof casino gambling on a communityaccelerate everything for the police

...the willingness of officials to focus on

the changes that would occur

ultimately proved the reason for Biloxis

success.


18/35

January 2000 / 17

executive. In addition to managinggrowth issues and changes withinthe department, police executivesmust deal with changes in attitudesthat, if left unchecked, can have anegative impact on the community.

Some studies have shown a link between the sometimes widely held view that illegal gambling isa victimless crime and theinfluence that it can have on

police officers. 24 Even theadvocates who oppose anylegal gambling sometimedownplay the importance ongambling-related crimeswhen the police have moreserious crimes to investigate.Officials must realize that le-gal gambling will attract anunsavory element that can

jeopardize the safety and well-being of the citys resi-dents and the many visitorswho come to gamble.

Police managers need toassure the community thattheir department vigorouslyenforces gambling laws like

they would any other laws. The citi-zens of Biloxi want casino gambling to prove successful, and therole of law enforcement remainscritical to that success.

Last, the police departmentlearned the importance of having avoice on local boards to preventsome seemingly trivial or unrelated matter from becoming a future

police problem. The police should participate in any discussions be-tween planners, developers, and

representatives from the local gov-ernment. For example, designs for new road patterns around the casi-nos in Biloxi were sometimes

hastily made. Input from the policedepartment proved critical to avoid creating nuisance traffic or critical

problems in the event of an evacua-tion. Looking at this issue in hind-sight, officials agree that this areashould have received a higher prior-ity during the early planning stages.

officers must deal with citizens whocomplain about the nighttime con-struction noise, flashing lights from

business signs, or other seeminglyminor issues that citizens consider important.

CONCLUSIONThe city of Biloxi re-

mains forever changed bythe legalization of casinogambling in Mississippi. Al-though controversy alwayswill exist over casino gam-

bling, the benefits it providesto the community are unde-niable. People who work,live in, and visit Biloxi re-ceive a much higher level of service and protection, in

part due to the revenues gen-erated by the legalization of casino gambling. The com-munity can now attract and retain more qualified policeofficers, which has given thedepartment the stability and experience that it will need in the future.

The experience that Biloximanagers gained during this period in dealing with the various issuesaffecting the police department and the community proved invaluable.While Biloxis experience centersaround the impact of legal casinogambling, reaching a balance on is-sues and dealing with change re-main paramount for any successful

police executive.

Endnotes

1 The Jackson, Mississippi, FBI field officeconducted this investigation in February 2000.

2 Gaming tax revenue figures compiled bythe Biloxi Police Department from state gamingcommission records.

With the ongoing changes at the police department, amendments tothe local zoning ordinances and

building codes and issuing con-struction permits did not initiallyseem like a police priority. How-ever, it did not take long to realizethat the placement of large signs,the location of parking lots and

parking spaces, and the design of major area roads quickly would be-come a problem for both the publicand the police.

The police can bring a needed perspective to any policy discussion by city engineers and other localgovernment leaders. After all,

Photo Disc


19/35


3 Ronald J. Rychlak, The Introduction of Casino Gambling: Public Policy and the Law,

Mississippi Law Journal 64 (1995): 300.4 Scott M. Montpas, Gambling On-line:

For A Hundred Dollars, I Bet You GovernmentRegulations Will Not Stop The Newest Form of Gambling, University of Dayton Law Review22, (1996): 165. The study of the three waves isattributed to a study by I. Nelson Rose of theWhittier College School of Law.

5 Ibid, 165.6 Supra note 4, 165.7 Supra note 4.8 Supra note 3, 291.9 Robert Goodman, Legalized Gambling

and the Real Costs (para), The WilsonQuarterly 19, no. 4 (autumn 1995): 24; and Stephanie Martz, Legalized Gambling and Public Corruption: Removing the Incentives toAct Corruptly, or, Teaching an Old Dog New

Tricks, Journal of Law and Politics 13,(Spring 1997): 458.

10 Supra note 3, 307.11 Supra note 3, 307.12 Supra note 3, 308.13 Supra note 3, 317.14 Barbara Marquand, Legalized Gambling:

What Police Have to Win and Lose Law and Order , November 1994, 86; and Edward Walsh,Two Sides of Casinos Coin: Success OpensRift In Mississippi Politics, The WashingtonPost , July 12, 1998, A1.

15 Ibid (Walsh).16 Biloxi Police Department.17 John Warren Kindt, Increased Crime and

Legalizing Gambling Operations: The Impacton the Socio-Economics of Business and Government, Criminal Law Bulletin ,

November-December 1994, 540.18 Ibid, 544.

19 Supra note 17, 544.20 Statistics compiled by the Biloxi Police

Department revealed that personnel increased from 92 to 157 officers. In 1991-1992 thestarting salary for a police officer was $15,707.By 1999-2000 it increased to $24,255. Duringthe same period, the police departments budgetgrew from slightly more than $3.4 million in1991-1991 to more than $12 million in 1999/2000.

21 Figures from local statistics compiled bythe Biloxi Police Department.

22 Information provided by the Biloxi PoliceDepartment.

23 Supra note 9 (Martz) 460.24 Supra note 9 (Martz) 461.

T he FBI Law Enforcement Bulletin staff invitesyou to communicate with us via e-mail. Our Internet address is [email protected].

We would like to know your thoughts oncontemporary law enforcement issues. We

welcome your comments, questions, and suggestions concerning the magazine.

Please include your name, title, and agency on all e-mail messages.

Also, the Bulletin is available for viewing or downloading on a number of computer services, as well as theFBIs home page. The home pageaddress is http://www.fbi.gov.

The Bulletin s Internet Address

The author thanks Dr. John Jarvis,Behavioral Science Unit, FBI Academy, for his assistance in preparing this article.


20/35

Perspective

ocated approximately 45 minutes south of Cleveland, Medina, Ohio, encompasses nearly

Chief Hanwell leads the Medina, Ohio, Police

Department.

L11 square miles and has a population of about 25,000residents. As with other small communities located near metropolitan areas, citizens of Medina face manyof the same threats to their peaceful lifestyles as thoseencountered by residents of large cities. To strengthenits commitment to safeguarding the public and servingits citizens needs, the Medina Police Departmentadopted the community policing philosophy inJanuary 1995. Since that time, the department hasreceived over $1 million in federal grants for itscommunity policing efforts and has won local, state,and national recognition for these strategies.

To share its experiences and successes, thedepartment began an international community polic-ing partnership with the Ballymena Neighborhood Policing Unit of the Royal Ulster Constabulary in

Northern Ireland. This partnership has developed intoan ongoing exchange of information and ideas thathas benefitted both agencies.

BackgroundIn April 1998, the mayor 1 of Medina took a

personal vacation to the United Kingdom. Whilevisiting Northern Ireland, he shared a few days with alocal family who took him to visit the Borough of

Ballymena in County Antrim. The borough has a population of about 57,000 and covers nearly 200square miles. About half of the boroughs population

resides in the town of Ballymena. Agriculture repre-sents the boroughs main industry, with the retailestablishments of the town providing additionalemployment. The mayor noted several similarities

between the towns retail center and the downtownshopping area of Medina.

While touring the town, the mayor met a local 19-year veteran constable. During their conversation, theconstable asked the mayor about community policingstrategies in the United States. The mayor advised theconstable that he would contact the Medina PoliceDepartment and have it forward information on itscommunity policing initiatives and operations. Thus,

a partnership began between the Medina PoliceDepartment and the Ballymena Neighborhood Polic-ing Unit.

Partnership DevelopedWhen the mayor returned from his trip, he

provided me with the constables business card and requested that I contact him to exchange community

policing ideas and strategies. For the next 2 years,Constable Bob Young and I worked together viatelephone, mail, and e-mail to share what has worked

January 2001 / 19

Digital Vision

International Community Policing Partnership By Dennis Hanwell


21/35


in our community policing efforts, steps taken toimplement these initiatives, improvements made sincethese efforts began, and future ideas we want toexplore. As we worked together, we realized that itwould benefit both agencies if I visited Ballymena to

better understand his agencys requirements and helphim implement some of our successful initiatives. Themayor concurred and supported my request to travelto Northern Ireland.

I arranged the trip for April 2000 and scheduled visits to area schools, businesses,

police agencies, communitygroups, government institutions,courts, and local religious organi-zations. At Constable Youngsinvitation, I stayed the 2 weekswith his family. This arrangementexposed me to more of the differ-ences between American and Irishcultures and gave the two of usmore time to share our thoughtsand ideas.

Northern Ireland ExploredOn the afternoon of my arrival,

Constable Young gave me a tour of his police stationwhere I met several officials. Later, I attended ameeting between the police and about 12 high schoolstudents who discussed issues of concern, areas where

they would like to see more police presence, and suggestions for improving youth activities and policeservices relating to area youth.

For the next 2 weeks, I attended meetings withRoyal Ulster Constabulary Police personnel, particu-larly the Ballymena Neighborhood Policing Unit. Wediscussed problem-solving techniques, differences inlaws and policing practices, and community policinginitiatives. I attended various in-service trainingsessions with the constables, including problemsolving, operating a motor vehicle while under theinfluence, riot control, and canine handling. I visited the basic training academy and spoke with recruits

and the academy training staff, regarding community policing principles.In addition to my law enforcement contacts, I

spent a considerable amount of time talking with

community and religious leaders, local media repre-sentatives, and business owners, both individually and in groups. Besides discussing community policingefforts, I also took part in a domestic violence forumand several local community meetings.

The preplanned media contacts occurred duringthe first week of my visit, but due to the attention myvisit drew, more requests for media interviews spilled over into the second week. Both local newspapersinterviewed me, along with both local television

channels and a radio station. Whilethe interviews focused mainly onmy visit, they also provided mewith a chance to discuss theconcept of community policingwith a wide and diverse audience.

Lessons LearnedI have found this international

community policing partnershipvery beneficial and informative.The Royal Ulster Constabulary,especially the Ballymena Neigh-

borhood Policing Unit, has madegreat strides in partnerships and

collaboration within its community. This stands as noeasy achievement with the unrest and militant activi-ties that have occurred for decades in NorthernIreland. While the political climate has calmed

recently, vast differences still exist in comparison toAmerican policing. For example, I learned thatEngland makes all of the laws, which may not havethe same relevance in Northern Ireland. England alsoappoints court judges, which limits or restricts their accountability to the citizens. Further, for security

purposes, the police must use radios with scrambled frequency and employ ear speakers to avoid unautho-rized monitoring. Many police officers cannot discusswhere they work for fear of harm to themselves or their families, and each police station must have acafeteria because police personnel cannot eat safely in

public. Since 1969, the Royal Ulster Constabulary has

had over 300 members killed and nearly 10,000members injured in the line of duty, all from a totalsworn membership of approximately 13,000. Todevelop, maintain, and improve community policing

This partnership hasdeveloped into anongoing exchange of

information andideas that has

benefitted bothagencies.


22/35

January 2001 / 21

Bicycle and Foot PatrolsOfficers patrol not only in cruisers but on

bicycle and foot as well.School Resource OfficersThree officers work in area schools as liaison

between the department and school personnel,students, and parents.

Neighborhood WatchThe department helps citizens start and main-tain Neighborhood Watch groups to reducecrime and violence.

Tip Line

The department monitors an anonymous tip linethat residents can call to report incidents or pass along information.

Bicycle Safety RodeosOfficers teach bicycle safety and riding skills tochildren, inspect their bicycles for safety, and register them for bicycle licenses.

Vacation WatchResidents fill out a simple form to have officerscheck periodically on their homes when theyare out of town.

Behind the BadgeOfficers appear on a monthly cable televisionshow that highlights various aspects of the

police department and covers a variety of lawenforcement-related topics of interest to thecommunity.

Community Police AcademyThis program provides area residents withfirsthand information about how their policedepartment works, acquaints them with lawenforcements role in the criminal justicesystem, and provides increased understandingof the tasks police officers face in their dailywork.

Medina Police Department Community Programs

WON CardsOfficers leave WON (Watching Our Neighbor-

hoods) cards at residences after patrolling the areato advise residents of their presence and notifythem of any problems.

Juvenile DiversionThis program serves as an option for juvenileoffenders who are monitored on a regular basiswhile having to abide by certain rules and guide-lines. Infractions can result in having chargesfiled.

STRIVE CampEach summer, the department conducts the

STRIVE (Students Taking Responsibility for Initiative, Responsibility, and Excellence) campfor at-risk youth.

Liaison OfficersTwo officers handle liaison with the subsidized housing apartment complexes, hold monthlymeetings with residents, issue newsletters, and help organize special events.

SeminarsOfficers conduct seminars about the dangers and downfalls of drug abuse and gang involvement,school violence, road rage, womens assaultsurvival, and fraud and scam activities.

Areas of ResponsibilityOfficers have geographical areas of the cityassigned to them and are responsible for getting toknow the residents and their problems and con-cerns.

Adopt-A-SeniorThis program encourages officers on patrol intheir assigned areas of responsibility to visitseniors who may experience difficulties living ontheir own.


23/35


efforts in such an environment illustrates the agencyscommitment to the public it serves.

Constable Young has kept me informed of continuing developments that have occurred as adirect result of my visit. For example, the Ballymena

Neighborhood Police Unit has implemented our departments bicycle patrol program by using bicyclesas a means of patrolling areas and developing closer ties with local citizens. Also, the unit has begun usingour WON (Watching Our Neighborhoods) program.This concept employs cards which officers leave atdwellings to notify residents that the police were

patrolling their neighborhoods in case no one sawthem at the time. Most encouraging, Constable Youngrecently informed me that the unit will receiveadditional constables to help with its community

policing effort.

ConclusionThe international community policing partnership

between the Medina Police Department and the RoyalUlster Constabulary constitutes one of the besttraining experiences of my 19-year law enforcement

career. I have made local and state presentations onmy visit to Northern Ireland to share my invaluableexperiences with law enforcement professionals, civicgroups, and other community organizations. Moreimportant, Constable Bob Young of the Ballymena

Neighborhood Police Unit has accepted my invitationto visit the Medina Police Department in the near future and actively participate in our community

policing efforts.If given the opportunity to partner with another

law enforcement agency, officers should welcome thechance to exchange and share policing principles and methods. Such an effort can prove a very enrichingand positive experience to observe, compare, and witness policing in other areas, as well as culturaldifferences both inside and outside the United Statesthat can influence how officers interact with thecitizens they are sworn to protect.

Endnote1 James S. Roberts official title is Mayor/Safety Director because he

oversees both the fire and police departments of Medina, along with performing his mayoral duties.

Snap Shots

Captured Calf

Kathleen Gagne

An officer in the Wisner, Nebraska,Police Department was on patrol when hereceived a call that a calf was runningthrough the main street business district.The calf had gotten loose from a local sale

barn. The officer bulldogged the calf, tied its legs, and returned it to the sale barnunharmed.

Submitted by Terry L. Soden, Wisner Police Department


24/35

January 2001 / 23

Legal Digest

he Americans with Dis-abilities Act (ADA) 1 is adifficult statute to under-

The Americans

with Disabilities Act A Practical Guide for Police Departments By THOMAS D. COLBRIDGE, J.D.

charged with enforcing the ADA,and the courts often disagree on thestatutes meaning.

This article will focus on pro-viding practical advice to police ad-ministrators regarding the ADAsimpact on departmental operations.It will discuss how the ADA im-

pacts police hiring practices and day-to-day operations when depart-

ments are faced with disabled appli-cants and employees. Specifically,it will provide guidance regardingthe questions that may be asked of applicants and employees, what

tests may be administered at thevarious stages of the employment

process, and what reasonableaccommodations should be madefor applicants and employeesdisabilities.

THE ADA PHILOSOPHY ANDPRACTICAL REALITIES

The purpose of the ADA is toensure that Americans with dis-abilities are given equal employ-ment opportunities and equal accessto all the benefits of the workplace.In short, the statute aims to ensurethat employers judge the disabled on their abilities, rather than their disabilities. To accomplish thatlaudable goal, the ADA divides theemployment process into three dis-tinct stages: the application/inter-view stage; the postconditional of-fer stage; and the working stage. Atall of these stages, the statute at-tempts to strike a balance betweenthe interest of the disabled in being

judged fairly and the interest of employers in finding the most quali-fied workers and running an effi-

cient enterprise. At the application/interview stage, the interest of thedisabled clearly wins, because em-

ployers are severely limited in their prerogatives. At the postconditionaloffer stage, employers interests are

paramount, because there are fewrestrictions imposed by the statuteon employers. During the workingstage, a delicate balance is struck

between the interests of disabled workers and the employers. Over-laying all of the employment stages

is the employers reasonable ac-commodation obligation.The ADA has practical implica-

tions in three major areas. Thefirst area is in the nature of

Tstand and implement in the work-

place. The statutory definition of adisability is confusing and subjectto infinite variations. Determiningwho is disabled, and therefore, pro-tected by the act, is difficult at best.Defining what is or is not a reason-

able accommodation for employ-ees disabilities is extremely diffi-cult. To make matters worse, theEqual Employment OpportunitiesCommission (EEOC), the agency


25/35

disability-related inquiries employers may make at the differentemployment stages. The second area is what kind of medical ex-aminations employers may con-duct at the various stages. The lastarea is the kind of reasonable ac-commodations employers are re-quired to make at all stages.

DEFINITIONSDisability-related inquiry,

medical examination, and rea-

sonable accommodation are termsof art under the ADA. Understand-ing how the ADA defines theseterms is key to understanding whatrestrictions the ADA places on po-lice managers.

Disability-related InquiryThe EEOC defines a disability-

related inquiry as a question or se-ries of questions likely to elicit in-formation about a disability. 2 Adisability is any physical or mental

impairment that substantially limitsa major life activity, having a record of such an impairment, or being re-garded as having such an impair-ment. 3 Disability-related inquiries

include not only questions likely toelicit information regarding the ex-istence of a disability, but also in-formation regarding the nature of adisability and its severity. The defi-nition includes employers ques-tions asked directly to applicantsand employees, as well as inquiriesdirected to third parties and surrep-titious searches for information. 4

Medical ExaminationsThe EEOC defines medical ex-

aminations as procedures or teststhat seek information about indi-viduals physical or mental impair-ments or health. 5 It is not alwaysclear whether an examination or testis medical for purposes of the ADA.The EEOC suggests the followingguidelines: 6

If the examination or test isadministered or interpreted byhealth care professionals, it islikely to be considered medicalin nature.

If the examination or test isnormally given in a medicalsetting or is administered usingmedical equipment, or is

invasive, it is likely a medicalexamination.

If the employer is trying todetermine the nature or extentof applicants or employeesdisabilities, or the test or examination is designed toreveal impairments or disabili-ties, it is likely a medical test.

If the examination or testmeasures individuals re-sponses to performing tasks,rather than simply their abilityto perform tasks, it is likely to

be considered medical.

Reasonable AccommodationReasonable accommodation is

a change in the workplace environ-ment or in the way of doing busi-ness that permits the disabled toenjoy equal employment opportuni-ties and benefits. 7 The disabled have a fundamental statutory rightto have their disabilities accommo-dated unless it would create an un-due hardship on the employers or they pose a direct threat. 8 Employ-ers duty to accommodate the dis-abled extends to all facets of theemployment relationship, from thehiring process to termination, and includes not only employment op-

portunities, but also access to job benefits. 9

PRACTICALCONSIDERATIONS FORPOLICE MANAGERS

The complexity of the ADAmakes it a difficult statute for the

police manager to apply to theworkplace. However, the require-ments of the ADA become lessoverwhelming when they are con-sidered in terms of the stages of the


...the statute aims to ensure that employers judge the disabled on

their abilities, rather than their

disabilities.

Special Agent Colbridge is a legal instructor at the FBI Academy.


26/35


27/35


both past and current, is a disabilityunder the ADA, 24 so direct ques-tions pertaining to addiction are

prohibited. Therefore, questionssuch as Are you addicted todrugs? and Have you ever beentreated for drug addiction? are im-

permissible. Current illegal drug 25use, however, is not a disability un-der the ADA, even if the current useresults from addiction. 26 Conse-quently, employers may ask appli-cants if they currently use illegaldrugs. Past casual illegal drug use isnot a disability, so questions regard-ing such use are permissible: Haveyou ever used illegal drugs?;When was the last time you used illegal drugs?; Have you used il-legal drugs in the last 6 months? 27It would violate the ADA, however,to ask applicants to list all medica-tions they currently take becausethe question is likely to illicit infor-mation concerning disabilities.There is one exception to this prohi-

bition against inquiring about cur-rent medication use. As noted be-low, employers are permitted to test

applicants for current illegal druguse. If the drug test is positive,employers may validate the test byasking applicants about lawful druguse or other possible explanations. 28

Like drug addiction, alcohol-ism is a disability under the ADA if it substantially limits a major lifeactivity. 29 Consequently, employersare prohibited from asking appli-cants questions that are likely toelicit information about their addic-tion to alcohol. 30 However, em-

ployers may ask if applicants drink,as long as the questions are notaimed at discovering how muchthey drink. 31

The Application/InterviewStage: Medical Examinations

Medical examinations are pro-hibited during the application/inter-view stage. 32 Tests for illegal druguse are not considered medical ex-aminations under the ADA, so em-

ployers may test applicants for cur-rent illegal drug use. 33 However,the EEOC has ruled that tests for alcohol use are medical in nature,and violate the ADA at this stage of the employment process. 34

Two other kinds of tests mayalso be given at this stage. Physicalagility tests that demonstrate theability to do actual or simulated job-related tasks, with or without rea-sonable accommodation, are per-missible if given to all applicants. 35Examples of such tests for policeapplicants are the trigger pull test,obstacle courses simulating policechases and vision tests designed todetermine if applicants can distin-

guish objects or read license plates.Employers may also require thatapplicants take physical fitness teststhat measure their ability to do

physical tasks such as running and lifting, so long as all applicantsmust do so. 36 Neither test is consid-ered a medical examination under the ADA unless applicants physi-ological or psychological responsesto the tests are measured. 37 It doesnot violate the ADA to require thatapplicants certify that they cansafely perform these tests. 38 If sucha certification is required, employ-ers should describe the tests to theapplicant, and simply have their

physician state whether or not theycan safely perform the tests. It isalso important to understand that if either physical agility or fitnesstests screen out or tend to screen outdisabled applicants, employersmust be prepared to defend the testsas both job-related and consistentwith business necessity. 39

Applicants may also be given psychological tests that are notaimed at uncovering recognized mental disorders. 40 Psychologicaltests that measure such things ashonesty, tastes, or habits are notconsidered medical examinations

under the ADA.41

Polygraph examinations of applicants at the application/interviewstage do not violate the ADA if nodisability-related questions areasked during the exam. 42 However,to ensure accurate results, examin-ers generally must ask examinees

prior to the exam if they are takingany medications that might affectthe results. Such a question could violate the ADA because the an-swer is likely to elicit informa-

tion regarding disabilities. Conse-quently, it may be wise to postponethe polygraph examination to the

post-conditional offer stage. Before

The EEOC defines medical examinations as procedures or tests that seek information

about individuals physical or mental

impairments or health.


28/35

January 2001 / 27

administering any polygraph ex-aminations, however, police admin-istrators should consult with their legal advisors regarding their legal-ity under state law and local labor contracts. 43

The Application/InterviewStage: ReasonableAccommodation

The ADAs statutory obligationto reasonably accommodate dis-abilities applies to the interview/ap-

plication stage. 44 Employers mustaccommodate all applicants knowndisabilities unless it would create anundue hardship on them. Employersmay become aware of applicantsdisabilities because it is obvious, or

because the applicants disclosed their disabilities in response to theemployers inquiry for the need toaccommodate them during the ap-

plication/interview process.Once the need for accommoda-

tion is demonstrated, the partiesshould decide what accommoda-tions are appropriate. Typical ac-commodations at this stage include

changing testing dates to accommo-date doctors appointments, chang-ing testing sites to those accessible

by the disabled, and giving appli-cants with reading disabilities moretime to complete written examina-tions. The forms of accommodationare as varied as the imaginations of employers and applicants.

As can be seen from this discus-sion, the ADA limits the applica-tion/interview stage to employer in-quiries and examinations designed

to judge all of the non-disability re-lated qualifications of applicants.But what if employers know at thisstage that applicants are disabled?

Must they ignore the disabilities en-tirely, even if they reasonably be-lieve the disabilities will impact theapplicants ability to do the job?

There are several ways employ-ers could lawfully become aware of applicants disabilities. The disabil-ity may be obvious, such as a lostlimb, or the use of a wheelchair.The applicant may have voluntarilydisclosed the disability through arequest for reasonable accommoda-tion during the application/inter-view stage, or in response to em-

ployers inquiries about their abilityto perform job functions.

The EEOC has stated that whenemployers reasonably believe thatapplicants will need reasonable ac-commodation to perform job func-tions, they may discuss with appli-cants if accommodation will beneeded, and the form that accom-modation may take. 45 After thesediscussions, employers may decidethat they cannot accommodate thedisability because the applicants

cannot perform the essential func-tions of the job, or pose a directthreat, or because the accommoda-tion needed is unduly burdensome.

If employers do not extend an offer to disabled applicants because of their disability, they must be pre-

pared to defend their decisionsagainst claims that they failed tohire the applicants because of theneed to reasonably accommodatetheir disabilities. 46

Once employers have judged applicants based upon their non-disability related qualifications dur-ing the application/interview stage,found them qualified, and made

bona fide job offers to them, theADA permits employers to face theissue of disabilities. Employers maynow inquire about disabilities, re-quire medical examinations, and condition their employment offerson the results of these medicalexaminations.

The EEOC considers job offers bona fide if they are made after employers have evaluated all of therelevant nonmedical information itreasonably could have gotten and analyzed before making the offer. 47Conditional offers do not have to belimited to current vacancies. Condi-

tional offers are still bona fide if they are made in reasonable antici- pation of future vacancies. Thenumber of offers may even exceed the number of current and antici-

pated vacancies if employers candemonstrate that a percentage of offerees will likely be disqualified or drop out of the pool. 48

The PostconditionalOffer Stage: Disability-relatedInquiries

After making a conditionaloffer of employment, employersmay ask applicants if theyhave disabilities and will need


29/35


reasonable accommodation to per-form the job. 49 There is no restric-tion on the nature of questions thatmay be asked. Consequently, em-

ployers may ask all of the questions prohibited during the application/interview stage: questions regard-ing the existence of disabilities,workers compensation histories,sick leave usage, drug and alcoholaddiction, as well as questions re-garding general physical and mentalhealth. The only conditions im-

posed on employers by the ADA arethat all offerees be asked thesequestions, and that informationgathered in response to the que

FBI Law Enforcement Bulletin - Jan01leb

Documents

Transcript of FBI Law Enforcement Bulletin - Jan01leb