Questioned documents - still a vital forensic tool

How can forensic scientists tell so much about from a simple piece of paper? Jennifer Scillitoe tell us what techniques are involved in examining incriminating documents

Forensic document examination may not be the first discipline that springs to mind when one thinks of the forensic investigation of a crime. However, forensic service providers use handwriting comparisons, alongside the detailed examination of various other aspects of a document, to provide key evidence in a surprisingly wide range of case types. Whether the crime is one of fraud, harassment, professional misconduct or even murder, there is very often documentary evidence involved somewhere along the line.

Ever since society first started using paper to record legitimate transactions, the potential for theft, counterfeiting and identity fraud has been realised and used by unscrupulous individuals for profit or to avoid blame. Even with the increase in digital transactions, hard copy documents are still all around us.

A questioned document is simply any sort of document which has been brought into question during an investigation. It may be a genuine document being used fraudulently (e.g. a bank account application form opened in a false name), or a counterfeit document being used in a genuine name (e.g. a counterfeit passport). It may even be an entirely genuine document in a genuine name which helps provide information about the sequence of events in an investigation (e.g. a hotel booking in form). Even graffiti scrawled on a toilet wall falls into the category of ‘document’ under the definition: ‘any instrument capable of conveying information’.

At LGC Forensics, the forensic document examiners use various techniques to gather a great deal of information from a single document. For example, it may be suspected that a particular page within a will or other legal document has been replaced or manipulated. The forensic document examiner’s role may include determining whether any signatures on the suspect page are genuine or simulated, and if simulation is evident, to establish what methods have been used. The act of freehand simulation of a signature may be carried out via various methods. These range from a careful, practised copying directly from a model of the genuine signature, through attempts at copying from memory, to a simulation which consists of little more than ‘making up’ a signature, with little attempt to replicate the genuine author’s style. Other commonly employed methods include direct or indirect tracing, or cutting and pasting using a digital or physical technique. There are very often ‘tell-tale signs’ left behind by the forger, which allow the examiner to determine exactly what has occurred.

Aside from the examination of signatures and other handwritten entries that may be of interest, the paper and inks which comprise a document may themselves hold a large amount of information. LGC Forensics makes use of specialised lighting techniques through an instrument known as the Video Spectral Comparator (VSC), which contains various radiant energy sources (tungsten, halogen, and fluorescent lamps). The instrument is capable of viewing and recording the response of inks and paper when exposed to light of various wavelengths. A high-resolution camera within the instrument records the response, which may range from luminescence to total transmittance of incident light at a particular wavelength (thus rendering an ink ‘invisible’ at that wavelength). Due to the variety of optical brighteners and other components present in paper, many apparently similar types can be distinguished using this technique. The VSC is also useful for the comparison of security features in documents such as counterfeit passports and driving licences, the examination of altered or obliterated entries and the examination of entries which have faded or been washed out (for example due to environmental exposure).

Conversely, it may be necessary to link a large number of separate documents to a common source. For example, when a single individual is suspected of benefit fraud and is believed to have completed application forms and opened bank accounts in a whole series of different identities. It may possible to establish a conclusive link between the documents based on the handwriting upon them, although strength of evidence depends on a number of factors. Firstly, access to the original version of the document is preferred as it will in many cases yield far more detailed information than a photocopy can. The forensic document examiner will aim to determine the direction of travel of the pen across the paper, allowing them to establish how each character has been constructed, as well as how it is joined to other characters. Many such features may be lost during a faxing or photocopying process. Factors such as slope and spacing between characters and words can also be characteristic and enable the scientist to build up a full picture of the author’s unique handwriting style.

Where a suspect has been identified, reference writing should be gathered with which to compare the questioned writing. Police will often have no option but to gather specimens from the suspect under interview conditions. Whilst this type of reference material is useful to an extent, it does provide an opportunity for the suspect to introduce elements of artificiality into their handwriting. Convincing disguise, however, is difficult to maintain over a prolonged period, as handwriting habits are deeply embedded and almost impossible to over-ride with consistency. Where possible, material should be gathered from the suspect’s day-to-day life. Job application forms, diaries, shopping lists and handwritten letters all make ideal comparison material. As the examiner is aiming to become familiar with the full range of the author’s handwriting, a good quantity of material should be examined. Where comparisons are limited by poor copy quality or by poor reference material, the conclusion reached by the examiner may be lower on the scale of opinion levels.

The expert opinion provided by the forensic document examiner is expressed on a scale which allows the jury to judge the strength of evidence being given. The scientist must consider all alternative explanations for the findings and observations that they make. They must then make a judgement as to which of the alternative explanations is most likely and to what extent their findings support that explanation. In some cases, for example when asked to determine whether or not a particular laser printer has produced a printed document, it may be possible to link the document to the serial number of the machine with certainty. In other cases, the forensic document examiner must use their knowledge and experience to weigh up the significance of their findings. Unlike some other forensic disciplines, there is no set number of points of similarity which must be identified in order to reach a particular level of opinion. The significance of each similarity or difference found must be assessed on its own merit and within the framework of circumstances of the particular case.

The work of the forensic document examiners at LGC Forensics is diverse, and each case requires an individual strategy of approach before work can begin. It may be necessary for the document examiner to liaise with the police officer, scientific support units and other forensic scientists working on the case to identify the best strategy. For example, an investigation may revolve around an envelope containing an anonymous threatening letter. In this case, it is likely that the areas around the stamp and seal of the envelope will need to be tested for the presence of DNA. The envelope and letter may both need to be treated to visualise any fingerprints present, and document examination work may also be required. Chemical fingerprint treatment would interfere with the DNA testing work, and therefore the DNA swabbing must be carried out prior to fingerprint treatment. Similarly, chemical treatment would prevent the envelope and letter being tested for the presence of indented impressions by the document examiner. The most common method used for the visualisation of indented impressions is Electrostatic Detection Apparatus (ESDA). Indented impressions are formed when pressure is applied to a sheet of paper by the writing instrument during the act of writing. Any underlying sheets will pick up a latent ‘image’ of that writing which may later be detected using the ESDA. The latent image is very often destroyed by the application of liquid chemicals to the paper. With this is mind, the most logical strategy in most cases would be; DNA swabbing first, then forensic document examination and finally fingerprint treatment.

As the methods employed by the criminal evolve to take more and more advantage of the digital world, the role of the forensic document examiner must follow in its evolution. Where once the examination of typewritten documents and typewriter ribbons were commonplace in the document laboratory, they are now far less frequently seen.

The examination of suspected counterfeit packaging is one area which is moving up to take its place in the forensic document examiner’s portfolio of skills. Pharmaceuticals are now such big business that many large scale counterfeiting operations have been set up. Not only are the drugs themselves not genuine, but the packaging can be replicated with varying levels of accuracy. Using their knowledge of the precise layout, wording and fonts present in the genuine packaging, the forensic document examiner is able to make detailed comparisons in order to identify and link together counterfeits, as well as trace them back to printers or original artwork.

From the reconstruction of shredded documents, to the matching of damage features on a rubber hand stamp to its printed impression, the work of the forensic document examiner is surprisingly broad in its application and ability to make vital connections across a wide spectrum of criminal investigations.