QUESTIONED DOCUMENT EXAMINATION

"The handwriting on the wall may be a forgery" (Ralph Hodgson)

A "questioned" document is any signature, handwriting, typewriting, or

other mark whose source or authenticity is in dispute or doubtful. Letters,
checks, driver licenses, contracts, wills, voter registrations, passports,
petitions, threatening letters, suicide notes, and lottery tickets are the most
common questioned documents, although marks on doors, walls, windows,
or boards would also be included by definition.

QDE, or Questioned Document SOME FAMOUS FORGERS &

Examination, has been a profession at
least since 1870, and frequently is found
in cases of forgery, counterfeiting, mail
fraud, kidnapping, con games,
embezzlement, gambling, organized
crime, white collar crime, art crime,
theft, robbery, arson, burglary,
homicide, serial murder, psychological
profiling, and deviant sex crime. A
number of famous cases over the years,
some involving wrongful conviction --
the Dreyfus affair; Bruno Hauptmann
and the Lindbergh Kidnapping;
the Hitler Diary profiling controversy;
and Clifford Irving's forgery of Howard
Hughes signature and Mormon
documents -- were showcases for the
talents of various experts at QDE. It's
strength, drawn from civil law, is that
expert opinion can overturn (alleged)
eyewitness opinion.
FORGERIES
Major George Byron (Lord Byron
forgeries)
Thomas Chatterton (Literary forgeries)
John Payne Collier (Printed forgeries)
Dorman David (Texas Dec. of
Independence)
Mark Hofmann (Mormon, Freemason
forgeries)
William Henry Ireland (Shakespeare
forgeries)
Clifford Irving (Howard Hughes forgery)
Konrad Kujau (Hitler Diaries)
James Macpherson (Ossian manuscript)
George Psalmanasar (Literary forgery)
Alexander Howland Smith (historical
documents)
Thomas James Wise (Printed forgeries)
Unknown (Documentary Photos Billy-the-
Kid)
Numerous (Biblical forgeries)

Historically, QDE has been somewhat of an inclusive profession, even to

the point where so-called pseudo-experts (in palmistry and fortune-telling)
were sometimes welcome, and even today, it suffers from a bit of identity
crisis in that at least eight (8) different, or related, areas can be identified:

• Questioned Document Examiners -- A document examiner analyzes

any questioned document and is capable of more than just questions
of authorship limited only by their access to laboratory equipment
• Historical Dating -- These is work involving the verification of age
and worth of a document or object, sometimes done by a document
examiner, and can get as complicated as Carbon-14 dating
 • Fraud Investigators -- This is work that often overlaps with that of
the document examiner and focuses on the money trail and criminal
intent
• Paper & Ink Specialists -- These are public or private experts who
date, type, source, and/or catalogue various types of paper,
watermarks, ink, printing/copy/fax machines, computer cartridges,
etc., using chemical methods
• Forgery Specialists -- These are public or private experts who
analyze altered, obliterated, changed, or doctored documents and
photos using infrared lighting, expensive spectrography equipment,
or digital enhancement techniques
• Handwriting Analysts -- These are usually psychology experts who
assess personality traits from handwriting samples, also called
graphologists or graphoanalysts; Forensic stylistics refers to the
same purpose but by looking at semantics, spelling, word choice,
syntax, and phraseology.
• Typewriting Analysts -- These are experts on the origin, make, and
model used in typewritten material
• Computer Crime Investigators -- This is an emerging group that
relates to QDE through some common investigative and testimonial
procedures

It's probably a futile effort to rigidly demarcate and delimit the various
areas of QDE as there will always be overlap, evolution, and, perhaps,
controversy.

INVESTIGATIVE FOUNDATIONS

One of the things important to understand is what the QDE expert is

looking for. This deals with the issue of class
characteristics versus individual characteristics.

In a nutshell, CLASS characteristics, which are commonly found at

crime scenes, describe evidence which can only be associated with a group
(like those with certain personality traits) and not a single source. Such
evidence can only be used for corroboration or circumstantial purposes,
and the evidentiary problem lies in the fact that little or no mathematical
models exist to assess probability values with the comparison of class
evidence. The expert must say things like "relatively certain" instead of
things like "95% of the time" or "an odds-ratio of 300:1". INDIVIDUAL
characteristics describe evidence that is associated with a common source
and an extremely high level of probability. It's not so much that the
evidence points directly at anything or anyone; it's that it draws an
inevitable conclusion based on mathematical calculations or probabilities
so high as to defy human comprehension while at the same time
substantiated by the opinion of a scientific expert.

THEORETICAL UNDERPINNINGS

Among QDE experts, the use is made of many different scientific

principles from a variety of disciplines, and one of the first attempts at
basic principles appeared in Albert Osborn's Questioned Documents in
1910, grounded in handwriting comparison as evidence of individual
characteristics (paraphrased below):

1. The most identifying characteristics are those which are most divergent
from the regular system or national average
2. Repeated characteristics which are inconspicuous should be sought first
and given the most weight
3. Regular or national system similarities are not alone sufficient to base
judgments.
4. It is the combination of particulars, common and uncommon, that
identifies
5. It is impossible to discover how all strange and peculiar characteristics
came to be developed
6. People do wholly unaccountable things in their speech, gestures, and
writing
7. An individual characteristic may be the survival of an error overlooked
by a teacher
8. Many characteristics are outgrowths or copies of an at one time admired
design

The psychological theory of handwriting comparison is developmental.

Children learn to write by copying whatever style of writing is fashionable
at the time and taught to them by teachers from textbooks. This style is
known as the regular or national system, and for most of the twentieth
century, it was either the Palmer system or the Zaner-Blosser system for
cursive. Today, there are many systems, or no system. As the child grows,
the act of writing becomes a subconscious effort and begins to pick up
habitual shapes and patterns that distinguish it from all others. This is
most evident with capital letters and numerals. Handwriting has
individual characteristics due to it being largely unconscious behavior. The
unconscious handwriting of two different individuals is never identical.
Mechanical and physical factors, as well as the mental ones, make it highly
unlikely that the exact same handwriting occurs in two different people.
It's therefore important that samples, exemplars, or specimens (all
synonymous terms for documents of known origin) be obtained under
conditions as similar as possible to the conditions present at the time the
disputed, doubtful, or original (all synonymous terms for questioned
documents) was created. These conditions are an essential part of what
are called standards of comparison:

• Care must be taken to avoid samples which are deliberately written

in a crude, unnatural way, or so well thought out as to disguise the
writer's natural style
• A sufficient number of samples must be taken, several pages if
necessary, over and over again, to establish multiple (more than one)
comparisons of single characteristics or combinations of common
and uncommon characteristics
• Samples should be taken within two or three years of the disputed
writing in order to rule out changes in style that may have occurred
over time or with age
• The sample should include some dictated text, words, or phrases
contained in the original document (but under no circumstances
should the writer be shown the questioned document)
• Pen and paper, as well as writing position, should consist of the same
conditions that existed at the time the questioned document was
written (if these facts are known)

TECHNICO-LEGAL CONSIDERATIONS

Legally, the conditions in place that produced the specimen serve to

authenticate it as a standard. Authentication, or positively establishing the
origin of known documents, is required for any piece of documentary
evidence. This can be accomplished by the testimony of witnesses who saw
the original writing produced, by the testimony of persons familiar with
the writing, or (in some states) by a post litem motam courtroom
demonstration where the writer gives a sample which is checked within an
hour to a day or more by a QDE expert. Technically, even the police could
extract authenticated samples since neither Fourth nor Fifth Amendment
rights apply to handwriting samples. In addition, some samples are self-
authenticating -- as in any writing on legal forms, business
correspondence, responses to communication from others, and some
"ancient" documents (over 30 years old). Irregularities in the
authentication (or discovery) process of a handwriting case are NOT
grounds for reversible error. The accused may get a new trial, but they are
not exculpated or found innocent by most courtroom errors. Refusal by
the accused to give a handwriting sample is presumptive evidence of guilt.
There's no right to remain silent when it comes to handwriting.

A potential problem exists with signatures. People usually have three (3)
different signatures: (1) a formal one, used on important documents; (2) a
routine one, used on regular correspondence; and (3) an informal one,
used for jotting quick notes. Also, other circumstances affect writing such
as age, arthritis, emotional distress, medication, intoxication, and
corrective vision. It's difficult to tell handedness, gender, and age from
unknown samples. QDE experts must consider all these things, and make
an informed judgement (usually in consultation with an investigator or
attorney) based on their familiarity with handwriting dynamics (e.g.,
appearance, laborious movements, rhythm). With an impairment like
arthritis, for example, the writing function may become more of a
conscious than subconscious effort, making for a more complex case.
However, a paraphrasing of Larry Miller's (1987) indicia drawn from a
review of the forgery literature might provide useful guidelines when
dealing with impaired or deliberately deceptive writing:

Line Quality Irregular, laborious, shaky, lack of rhythm

Size/Proportion Larger, wider, higher, inconsistent, different spacing after
caps
Pen lifts Frequent lifts off paper
Angle/Slant Greater than 5 degree change, other-hand slanting
Pen Pressure Heavier than usual
Circle formation More teardrop or egg-shaped, frequent counterclockwise
formations
Retouching formal signature used, often retracing strokes, foreign marks
present
Loop formation Wider spacing between, more squared, shorter, or broken loops
Stroke Wider M's and W's, more squared or wedge-shaped stokes
formation
Alignment Change in baseline habits, more downward slants from baseline
Diacritics Heavier t-crossings and i-dots, position placement changes
Begin/end Heavier pressure, blobbed, vertical position change or slanting
strokes
 Problems get stickier when trying to draw personality inferences from
handwriting samples. Remember this is the realm of graphology, but it
might be interesting to look at a few traits of interest to criminal justice
and criminology. With that in mind, here's a small, academic fair use
sample of the Trait Dictionary from Bart Bagget's MyHandwriting.com.
Be advised that these are not definitive interpretations by any means
because there are over 30 different "systems" of graphology in existence.

Graphology systems tend to be one of three (3) types: (1) those based on
individual letter formations; (2) those based on stroke analysis; and (3)
those based on an holistic/gestalt method. Over 3000 private business
companies use it routinely (to screen employees), and it enjoys a growing
sense of scientific respectability. The courts appear to be waiting to see
college psychology courses on it. It probably has the most validity with the
following domains: (1) intelligence; (2) attitude toward work; and (3)
interpersonal skills. Recent developments have focused on "profiling" of
uncaptured criminals and sex offenders (where handwriting analysts say
they can spot a "perversion", not exactly the best word for it).
 There's some precedent in art therapy and projective psychological
testing for graphology. Many convictions of child sex offenders have
occurred because of what the child victim portrayed in a drawing, and
with psychological testing, there's the famous "Draw a Pig" assignment,
which apparently contains everything you need to make a subjective
personality assessment from: where placed on paper; the size of the pig;
the pressure applied; the direction the pig is facing; attention to details;
line quality; angular or curved strokes; and emphasis on head of pig.

TESTIFYING IN COURT

There's quite a bit of divergent terminology found

in court testimony. The most common "conclusions"
are really qualified opinions. Although the science of
QDE has its origins in Bertillon's points of comparison
method, there's no set standard, such as 11 or 12
"matches" as with fingerprinting. Instead, it's up to
each expert to say what constitutes a sufficient number.
The most commonly used phrases are "significant
similarities", "most probably", or "very probably". An
expert opinion need not be based on absolute certainty.
A QDE expert can expect to be on the stand a long time,
as direct, cross, redirect, and recross trial procedures
play out. The background and integrity of the expert as
well as the quality of the evidence determines both
admissibility and impact.

Court-recognized expertise as a QDE expert is not something that can

be achieved through self-study alone. An old common law rule that isn't
recognized much anymore says that one can become an expert by study
without practice or by practice without study. With QDE, the courts (State
v. Evans 1991) have decided that a person needs both: study and practice
-- that is, a period of training (internship or apprenticeship is better than a
self-study course) and a period of experience (twenty some previous cases
worked on is a good average). In addition, there's a rather large literature
base to become familiar with, and a good number of journals, periodicals
and newsletters.

COMPUTER CRIME DEVELOPMENTS

Computer forensics is used in many areas. In civil law for

discrimination and harassment cases, by insurance companies for
workman's compensation cases, by corporations for trade secret
misappropriations, and in criminal law mostly for drug and embezzlement
record-keeping and child pornography. As mentioned previously, this is a
loosely related, developing specialty area. It is most closely related to
typewriting comparison. The FBI has, for many years, maintained
typewriter databases, ink databases, copy toner databases, paper
databases, and watermarks (which sometimes change every year). Private
examiners do not have the advantage of large databases available to
government examiners. Computers and computer printouts also leave a
trail that can be followed, whether it's from something simple like how full
or dry a printer ink cartridge is, to the various alignments and
misalignments of dot matrix and laser printers, to fiber analysis of the
paper used, computer crime specialists utilize some of the same age-old
techniques that typewriting analysts used as well as other investigative
methods.

A computer forensics expert will have experience on a wide variety of

hardware and software. Unlike paper evidence, computer evidence exists
in many forms, with earlier, alternate, and backup versions of each and
every file somewhere on the hard drive and frequently unknown to the
user. The process of examining a suspect computer system is as follows:

• Secure/protect the system from further use, damage, or corruption

• Discover all files, including hidden and encrypted ones
• Recover all (or as many as possible) deleted files
• Reveal all hidden, temporary, and swap files
• Access all protected or encrypted files
• Analyze all unallocated or "slack" spaces on a disk
• Print out an overall analysis of the system, listing all files
• Formulate an opinion of the system layout, file structure, and any
attempts to hide, delete, protect, or encrypt information