You are here: Resources > FIDIS Deliverables > Forensic Implications > D6.7c: Forensic Profiling > 
Profiling and the reconstruction process  Title:
 Repetition of crimes as a fertile area for forensic profiling


The different forms of forensic profiling in the judicial process

It is crucial to distinguish the different forms forensic profiling may take according to the different aims of each of the three chapters. They are manifold, but unfortunately, they are not all intensively studied. They are often tacitly applied or result from best practices. Here, the distinction between profiling as the result of a well-grounded professional methodology and its tacit counterpart is not always very clear. Moreover, there is a gap between what mythology about police work might suggest and the actual degree of formalisation of profiling methods practically used by law enforcement agencies.  

Here is an attempt to capture only some aspects and methods that are applied at different degrees, but this survey does not intend to cover all possible forms. Even, some forms may be variably applied across organisations in terms of formalisation of the processes using databases, as a best practice or tacitly applied at the level of the individual. They will be mostly envisaged from an inferential perspective first; then, they will be considered in relation with the increased availability of electronic traces. Finally, data mining technologies for treating data will be discussed.  

We will study profiling along the three chapters paradigm, but in the reverse order than was presented, because forms are limited when presenting evidence to a court and progressively more diverse when dealing with investigation. First, we will sketch the challenge faced when delivering conclusions to a court, then envisage some forms of profiling when structuring evidence, and finally complete the problematic by considering profiling as an investigative aid.   

The interpretation process and profiling

Following the hierarchy of propositions coined by  forensic experts are essentially dealing with propositions related to the source (an object or a person) of a trace, alternative activities that may explain a set of traces and explaining how traces may provide other pieces of information aiding the final decision of the judge.

According to traces collected, the expert deals with propositions representing the prosecution and defence positions . For instance, these propositions may take the form “this electronic trace was generated by this computer versus the alternative possibility that another computer taken in a relevant population caused it”. Or at the activity level, according to traces collected: “this person was surfing on the internet during this particular session versus another person among a relevant population did a manipulation that provoked the traces”.  

In terms of profiles, one may assimilate a trace to an element of description of an object or a person. Then, interpretation necessitates comparisons between profiles built on the basis of traces collected from the scene (profile trace) with the profile of an accused person (profile accused). It often takes the concrete form of comparing traces with reference material taken from the source, for example a finger mark collected from a scene compared with a fingerprint taken from the accused. We will call the result of this comparison a match.

The relevant questions are reformulated in a probabilistic form: what is the probability that the profile-trace matches the profile-accused, if the accused person is the source of the trace. Then, from an interpretation perspective, one must consider the alternative possibility: the probability of a same match if another person were at the origin of the trace. Thus the reasoning process must continue by evaluating the proportion of profiles of other persons taken from a relevant population that could have possibly caused traces that match in a similar way.  

Population studies (profiles of populations) are of great importance to help provide an informed assessment. Even, evidence is often wrongly considered as absolute: 10-loci DNA profiles, even rare, generally represent more than one single individual on the planet. Frequencies distributions of alleles in different populations constitute necessary background knowledge for assessing evidence. For instance, specific subpopulations and familial relationship may considerably affect allele frequencies.  

In the field of electronic evidence, presenting evidence to a court according to this framework is still in its infancy: very few studies help determine on the basis of traces collected on a computer, how the profile built from this information may individualise the user. Many researches have still to be carried out in this direction.  

Another form of forensic profiling occurs at this stage because a person must be categorised in function of a criminal rule of law. The virtual person representing the guilty is compared to the profile generated from traces. This is the offence level.  

For example it is often asked if a suspect has belonged to or participated in a specific criminal organisation: according to the description of criminal organisation that may differ from one legal system to another one, how is the classification possible on the basis of the profile of the individual? Representation of criminal organisations as defined by the law, classification of a specific organisation as a criminal organisation and demonstrating the participation of a specific individual in the organisation are frequent and far from obvious questions that have to be answered by the court. 

Individual profiling  is required in this circumstance, as well as when for instance forensic psychiatry supports the assessment of a persons profile in order to evaluate his degree of responsibility that may depend on this kind of diagnosis.

The whole process is synthesised in figure 2. Using profiles in the interpretation process is promising because it rests on definitions of identities and clarifies which attributes are compared.  

Figure : Description of the interpretation process using the notion of profile


Structuring evidence and profiling

When a suspect has been arrested, forensic scientists may advise an authority on how to deal with traces and provide leads on new traces to be collected. At this stage, a lot of activity is dedicated to test the consistency of available information, under the assumption that the suspect is at the source of the traces and the activity. A test of consistency with the hypotheses is not sufficient for going to court (see above), but it may lead to refute the hypotheses if available traces show unexplained discrepancies.  

For instance a person who is supposed to have used her credit card at one place could not have used simultaneously her mobile phone at another distant place. In terms of profiles, coherence of the profile of the person under scrutiny has to be tested from various perspectives in order to detect potential contradictions or on the other hand to support hypotheses by demonstrating consistence (it has still to be confirmed how those concordances may occur by coincidence!). For instance, it may be assumed that the use of a mobile phone is part of the modus operandi of a serial offender when he is operating. Thus, data related to the localisation of mobile phones should show spatio-temporal coherence with data related to the crimes themselves. Correlation between different sources of data (traces) may be thus intensively used according to the hypothesis to be tested.


Forensic profiling in an investigative perspective

As stated by many authors , there is the realisation among forensic scientists that their role must extend to the investigation itself. They must be particularly engaged when hypotheses have still not been entirely drawn, in the coordination of the forensic information collected, as well as for proposing new collection of data. In this way, the forensic scientist turns from an evaluator to a more investigative attitude : who/what is the source of this trace, how can we explain the existence of these traces, what is the offence, what evidence may indicate some possibilities for new data collection, what support and leads to the investigation may be provided, where is the person who committed the crime, etc?  

This contribution is based on an entirely different inferential process than for interpreting evidence for the court. Rather than balancing probabilities related to given propositions, it focuses on the development of alternative hypotheses that may explain the existence of traces. Thus, rather than testing the hypothesis of culpability or innocence, we could generally describe the process as starting from the effects (the traces) and imagining possible causes on the basis of general knowledge (abduction and induction). Forms of profiling that arise during the investigative part of the process are manifolds and combine individual profiling with group profiling . We do not have the pretension of identifying all the possible forms here, only the most typical will be described.  

One of the basic operations consists of creating a first profile from the available (collected) information and then searching for all the persons or their relations to objects that correspond to this profile. Profiles are described here as categories that restrict the search within a “selected” population. A person (individual) may generally be described through traces:  


  1. They themselves reflects directly some physical aspects of the sources and have some descriptive capacity, such as fingermarks or DNA profiles extracted from biological marks, a snapshot taken from a camera; 

  2. Traces and where they are found may be used to infer some indications about physical aspects or inform about clothes or accessories: earmarks found at a certain height on a door and the size of shoemarks may indicate (qualitatively) how tall the source is; a snapshot may provide some physical description as well as information about clothes and accessories; 

  3. Traces may indicate the make and model of the printer used to print a recovered document, a bullet collected at the scene of crime may indicate the make and model of the firearm used, while paint marks coming from a car may point to a make and model of the implicated car. These are all types of acquisitions that may indirectly point to a person. Other possibilities include the use of fibre for inferring description of clothes, toolmarks or other marks for obtaining some description of the tools used. In a similar way of thinking, but about persons, DNA profiles indicate the gender (generally not more about the physical aspect through non-coding DNA sequences chosen for forensic use); 

  4. The activity and behaviour in the immediate environment may be inferred through a global analysis of the spatial (and temporal) distribution of traces, such as a sequence of shoemarks, a sequence of withdrawals with a specific bank card at different ATMs, traces of navigation with an internet browser; 

  5. Circumstances and application of different theories from different bodies of knowledge may help to interpret the situations in order to provide other traits of the person or of his behaviour. For instance, geographical profiling (mostly for serial crimes) aims at providing clues for localising a person , or different theories point out that psychological traits may also be inferred. The person may also be the object of a classification process into different categories (pre-defined classification of computer crime offenders, arson offenders, rapists, etc.).  


Each final profile may thus be more or less general. Its attributes are known or unknown, complete or not and mostly uncertain.  

One of the main (but not the only) questions of the investigation is the identification of the sources of the traces and how they may be related with the activity. Developing hypotheses about who/what is the source may be straightforward for instances through the use of DNA databases or Automatic Fingerprint Identification Systems (AFIS). Those systems start from the traces that come from a source (data subject as defined in ) , transform them into a digital form (attribute of a virtual person ), compare them with collections of reference material and suggest as output a (list of) possible candidate(s) (or list of virtual persons) that refer to possible data subjects. The result is then interpreted and integrated into the investigation process. When using AFIS databases, a list of candidates is returned by the system, while for DNA databases, usually a single profile is returned. However, with the evolving content of databases and since identical twins have same DNA, occasionally several DNA-profiles may be returned by the database. Moreover, with the extended use of partial DNA or mixtures, putative sources may be multiple.

In order to generalise this process, a useful concept has been stressed by Kind . He argues for the use of the dual concepts of frame and form. The frame contains the set of entities considered as relevant for the investigation, according to available evidence, while, roughly, the form distinguishes different region of the frame as more or less promising. A list of candidates extracted from an AFIS system constitutes the frame, while scrutinising the content provides as outcome the form. The frame is often constituted of persons or entities that share a common profile. This may also be seen as a non-distributive group profiling approach  where a category of individuals is built on the basis of a different set of data and where the decision to insert an individual (or its individual profile) into the frame may depend on features of different natures.   

There are many ways to develop a frame in the course of the investigation, depending on the case and available traces. The direct and simplest way consists in comparing the trace with the collection of reference material (like for DNA or AFIS databases). A similar process consists of comparing images taken from video surveillance systems (CCTV) with collection of photos taken from known persons. The scheme is the same and simple, but obviously the source of data used presents specificities that make the methods routinely applicable, as well as automated profiling possible or not.  

Another possibility, when recidivism is known as frequent, is to compare the assumed modus operandi of the offender with modus operandi used by known recidivists. Here again, when serial crime is considered, a profile extracted from the series of modus operandi used by the recidivist (a profile extracted from an already constituted set of information – individual profile) may be used to proceed to the comparison: the burglar usually operated during the night, entered the premises through an open window, and generally selected only credit cards. There may be very different approaches for building such a profile, for instance by expecting that a specific feature occurs in each case or only in the majority of cases, expecting the existence of a specific feature of not, etc. The relevancy of such a profile depends on the expected use of the profile (searching other databases for linking cases, organising specific surveillance, trying to intercept the perpetrators) and thus may take the status of intelligence (see below).  

Another important form of profiling is carried out through the application of models and methods used for hypothesising the place where the offender resides, or one of his centres of interest. These methods are known as geographical profiling and may be used in specific situations, for instance when a serial offender operates . With the development of new technologies, data extracted from GSM operators may play an important role in this perspective, for instance by assuming the degree of mobility of a person, where he resides or other spatial dimensions related to his behaviour.  

Finally, other possibilities are developed through new id-systems: when a profile of the offender has been developed and some of his activities may be inferred, new frames may be built. For instance if the author was suspected of having used her mobile phone when operating, details of all the calls made during the time of the offence in the region of interest may be asked from the operator, with the hope of detecting the card or the mobile phone used by the offender. If an offender is supposed to have entered a building controlled through id-systems, the list of persons who entered the building may be provided.  

All these forms may be used in combination through cross-referencing, for instance when geographical profiles lead to a list of inhabitants, the use of firearms may indicate the relevancy to search among the list of legal possessors, the profile of a car to consider the file of car owners, etc. This data may then be cross-referenced either to build a category of persons corresponding the best to the offender profile, conscious of the fact that the offender may or not appear in these databases. This may, as an outcome, provide a list of relevant identities to be further investigated. 

Jaquet-Chiffelle  stressed that this kind of investigative profiling follows two distinct goals: the first is to identify an individual within a community or infer its habits, behaviour, preferences, knowledge, etc. But the second form is not independent from the first one as it is often not obvious, once identified, to find (ultimately arrest) a person worth being the object of further investigations. Occasionally, the localisation of the person even leads to his arrest before he is identified. For instance, when a serial burglar operates, his pattern may be detected and used to devise surveillances that may in turn lead to his arrest.  

A rich example, well documented, of possibilities to apply such techniques can be found in the review of the investigation of the Yorkshire Ripper during the 70s . This investigation offers a broad series of inferences and treatment of data typical of complex investigations. Review of the case has led to original ideas about different forms of profiling . At that time, among other difficulties, the lack of computerisation and possibilities of cross referencing was identified as a severe handicap for the investigation. The ripper was finally arrested through a routine control in the street, because he was circulating with stolen plates. Despite that this arrest was made in isolation from the investigative strategy itself, it was actually also obtained through the use of a systematic control process aided by the databases of stolen plates. Lessons learned from this case have had in particular considerable impact on the development of computerisation for major case management and organisations of incident rooms. It may also be considered as a milestone in the development of analytical capabilities within law enforcement such as geographical profiling or the use of information technologies in the management of serious cases.


Categorical elimination

Once the frame has been built, further techniques or investigations may lead to categorical elimination. This can be performed for instance through DNA screening, when persons are eliminated through comparison of their DNA profile with the profile of the trace.  

This filtering process, when applied with DNA, offers some guaranties, but occasionally, the profile may not be accurate and leads to a wrongful elimination. This was the case during the Yorkshire Ripper investigation, with the letters and an audio tape received by the police. The tape contained a message of a person who pretended to be the ripper. He had a strong accent from one specific region. By assuming that the sender of the video was the actual ripper, each person who did not correspond to this profile (in particular the strong accent) was eliminated from the investigation. Actually, the person who sent the letters and tape was identified in 2005 thanks to DNA and had apparently no connection with the ripper. This example illustrates one reason why profiling in the course of criminal investigation is particularly critical and necessitates further formalisation.  



Profiling and the reconstruction process  fidis-wp6-del6.7c.Forensic_Profiling.sxw  Repetition of crimes as a fertile area for forensic profiling
8 / 27