LN324-91

                             CHAPTER XVII

                        SABOTAGE INVESTIGATION

INTRODUCTION:

     To understand the importance of a sabotage investigation you must always
think that the sabotage act is the intent to cause harm, intercept, or
obstruct by the desire to cause harm or destroy or intent to destroy material,
installations, or utilities with regards to the national defense.

GENERAL FACTS:

     A.    IDENTIFY THE INVESTIGATION REQUIREMENTS:

     1.    Use various reports from other agencies to identify the
requirements so that the counter intelligence elements could start an
investigation of the sabotage act. These reports could be found in the
following agencies:

     a.    Military police

     b.    Criminal Investigation Divisions

     c.    Local Civil Authorities

     d.    The superior authority/supervisor in charge of the facility where
the sabotage occurred.

     e.    Confidential sources that could testify that a particular incident
was indeed a sabotage act.

     2.    Review the Preliminary Sheet (PS), prepared to be distributed by
the Central Intelligence Office, to identify the investigative requirements:

     a.    The PS has information collected during an investigation that may:

     (1)   Require further investigation and development.







                                  152

LN324-91 FIGURE/EXAMPLE #1 PRELIMINARY SHEET _____________________________________________________________PRELIMINARY SHEET DATE INVESTIGATION STARTED _____________________________________________________________ 1. SUBJECT/THEME 2. DATE 3. CONTROL OR FILE NUMBER _____________________________________________________________4. TYPE AND REASON FOR INVESTIGATION 7. AGENCY REQUESTING 8. AGENCY PREPARING REPORT _______________________________________________________________________ OFFICE OFFICE _____________________________________________________________ ADDRESS ADDRESS _____________________________________________________________ FOR G2 ACTION FOR G2 ACTION (IM) _____________________________________________________________ AUTHORIZED SIGNATURE AUTHORIZED SIGNATURE _____________________________________________________________ NAME AND RANK NAME AND RANK _____________________________________________________________ 8. CONVINCING DOCUMENTS CONVINCING DOCUMENTS _____________________________________________________________ 153
LN324-91 4. To condemn a person for an act of sabotage during peace time, you have to prove that he had tried to cause harm described above. In war time it is sufficient to prove that the person had knowledge that his act will affect the "war effort". 5. If more than one person conspires to carry out a sabotage act and one of them is captured while carrying out the plans of the act, all could be accused and condemned for the sabotage act. C. DETERMINE THE TYPE OF SABOTAGE INVESTIGATION THAT WILL TAKE PLACE: 1. PASSIVE SABOTAGE: This type of sabotage involves the passive resistance of the population and it could be local or at national level. The passive sabotage is not so organized so that persons or groups are assigned specific missions: nevertheless, the population reaction is the result of propaganda, well organized propaganda by a subversive group that is well organized. In other words, the passive sabotage is when a population locally or nationally has been convinced by a propaganda group to carry out or to allow the acts previously described that could be classified as sabotage acts. 2. ACTIVE SABOTAGE: This type of sabotage is characterized by violent sudden actions with visible results and which commonly turn into conflicts with military forces. Within this category, we found the following physical forms of sabotage: a. Fire sabotage: Is when combustible materials are used to cause fires and destroy government properties. This is normally considered as an act of vandalism or a common criminal act. (1) This act changes from vandalism to sabotage when it is proven that it took place with the purpose of affecting the national defense, the war or the war effort. b. Explosive sabotage: (1) In this type of sabotage explosives are used to destroy or neutralize targets that are resistant to fires and to obtain the maximum quantity of destruction at the minimum time. 154
LN324-91 (2) Targets that are sensitive to explosive sabotage are: (a) Bridges (b) Tunnels (c) Railroads (d) Ships/boats (e) Heavy equipment (f) Industrial machinery c. Mechanical sabotage: (l) the mechanical sabotage is easier to maintain since it does not require instruments or special tools, and normally is directed against railroads, ships or industrial facilities. (2) The mechanical sabotage is normally classified within one of the following categories: (a) Destroy/break/tear (b) Inserting materials or abrasive substances such as, sand, soil, etc., into lubricants and vehicle's fuels. (c) Omission acts. This consist of not doing something so that a mechanical equipment stop working. Not lubricating a motor so as to damage it, not adjusting a mechanical part so that when the motor is turned on it will stop working. (d) Substituting real parts for fake parts in apparatus or vehicles. Ce) Contamination of lubricants or fuels. d. Biological, chemical and nuclear sabotage: (l) The sabotage with biological agents is know as "biological warfare", and is considered as the introduction of living organism and its toxic products in the environment with the purpose of causing death, impede, or harm people, animals or crops. (2) Sabotage using chemical agents is know as "chemical warfare: and is considered as the introduction of chemicals to the environment to cause death, impede, or harm people, animals or crops. 155
LN324-91 (3) Sabotage using nuclear weapons, could just with its destructive capacity, cause serious damage or destruction to property, materials and persons. D. PREPARE AN INVESTIGATION PLAN: (See example #2) 1. Initial plan: a. Determine the purpose of the investigation. b. Determine the place of the incident. c. Determine what official documents are required to travel to the place where the incident took place (passport, visa, etc.) d. Make arrangements to get these documents. e. Determine priorities, if any, that exist in regards to the case being investigated. f. Determine if any restrictions or special instructions are necessary. 2. Modify the investigation plan according to how you could obtain more information. F. CARRY OUT THE INVESTIGATION: 1. Go to the place where the incident took place. 2. Write down the date and time you arrived to area and the weather conditions. 3. Visually search the area to try to find wounded persons and: a. Coordinate medical attention. b. Write down identity of the wounded, so as to possibly question them later. c. Coordinate transportation of wounded persons to medical facilities. 156
LN324-91 (FIGURE/EXAMPLE #2) INVESTIGATION PLAN 1. PURPOSE OF THE INVESTIGATION: 2. TYPE OF INVESTIGATION: Limited 3. THE INVESTIGATION WILL TAKE PLACE IN THE FOLLOWING MANNER: (Discretely) 4. PRIORITY: 30 days after having received the preliminary sheet. 5. SPECIAL INSTRUCTIONS: a. b. 6. INFORMATION PROVIDED: 7. INVESTIGATION SEQUENCE: a. Carry out the review of files. b. Examine the medical and military files of suspect. c. Interview the following persons: (l) (2) (3) d. Carry out the investigation of the neighborhood. e. Carry out the review of credit bureaus. NOTE: THE PLAN DESCRIBED ABOVE MUST BE FLEXIBLE AND ITS INTENTION IS ONLY TO BE USED AS A GUIDE. EVERY CASE MUST BE TREATED INDIVIDUALLY. YOUR PLAN COULD BE SIMILAR, SHORTER OR LONGER ACCORDING TO WHAT THEIR OWN REQUIREMENTS. 157
LN324-91 4. Coordinate work with other investigation agencies that are present in the incident area, or if they should arrive later. 5. Identify and search a road for the medical personnel to use when arriving to the place where there are wounded and/or dead persons. 6. Do not allow the corps to be covered since this could destroy evidence. 7. Protect the area of the incident using persons to maintain the curious passersby away from the area and to avoid that witnesses, suspects and victims destroy evidence. 8. Protect all that could possibly be destroyed by fire, rain or any other thing, such as footprints, etc. 9. Find the possible witnesses in the area. 10. Ask and write down the identity of the witnesses. 11. Separate the possible witnesses and take them outside the incident area. 12. Carry out questioning/preliminary interviews of witnesses to determine: a. How much knowledge they have of the incident. b. Movements that the witnesses have done in the incident area. c. Any tool that the witnesses or other persons have possibly touched. 12. Write down all the pertinent facts: a. Identify the persons involved or that were involved in the area. b. Initial impressions or observations. c. Take photos of the area in all angles. d. Take photos of the persons in the vicinity of the area. 13. Search the incident area and adjacent areas to collect all evidence using the search patterns more useful in the area. a. Pay particular attention to fragile traces of evidence that could be destroyed if not collected immediately. 158
LN324-91 b. Carefully examine all objects or areas where there may be latent fingerprints and make sure that a follow up is done of this fingerprints. c. Take photos or prepare imprints that could have value as evidence. (Example: shoe prints, or boot prints on the ground could indicate the amount of persons involved in the incident). d. Treat stains or accumulation of liquids as evidence and write down its place and take photos of them. e. Treat any tool as evidence until this could be found to the contrary. 14. Collect, mark for identification and process the evidence. F. Transfer the evidence to the criminal laboratories and proper agencies to evaluate such evidence. G. Carry out the review of files. H. Carry out the interviews with "Witnesses" that are necessary: 1. To obtain more information about the incident. 2. To develop new leads and/or sources. I. Prepare Preliminary Reports, if necessary. NOTE: THE PRELIMINARY REPORTS ARE PREPARED WHEN THEY ARE REQUIRED BY THE SOP OR IF AN ORDER IS RECEIVED FROM THE HIGH COMMAND. J. Contact your confidential sources of information. K. Carry out an analysis of the information in the case to identify the suspect. Even though an investigation is basically a collection of information, the analysis of such information is a secondary function. This analysis is the review and comparison of information obtained to develop a hypothesis and come up with conclusions that could be used in identifying the suspects and determining the circumstances of the incident and future actions. NOTE: THERE IS NO FIXED PROCEDURE IN THE ANALYSIS OF INFORMATION OF A CASE TO 159
LN324-91 ARRIVE AT A SOLUTION. ONE METHOD COULD WORK AS WELL AS THE NEXT. NEVERTHELESS, ANY OF THE METHODS USED MUST HAVE THE BASIC FUNCTIONS OF: (REVIEW, COMPARE, AND MAKE A HYPOTHESIS). 1. Review all the information in the case: a. Arrange in an orderly fashion all the information. b. Examine the information in detail to identify the pertinent facts. (1) Determine the dependability of the information. (2) Determine the truth of the information 2. Compare the information known: a. Compare the available information with the legal aspects of sabotage. (l) Identify facts/evidence that support or prove the legal elements of sabotage. (2) Identify vulnerabilities in the information that could require further investigation. b. Compare the information obtained from witnesses with such obtained by other witnesses and sources. c. Identify possible suspects through the information comparison. (l) Identify such persons that have connection with the incident. (2) Identify information that supports or proves the "OPPORTUNITY" that possible suspects may have. (Ask yourself: Is it physically possible that the suspect could have committed the act of sabotage?) (3) Identify information that supports or prove "MOTIVATION" by each suspect. (4) Identify information that proves "INTENT" by part of the suspects. (5) Identify all circumstantial or association information related with each suspect. (6) Evaluate all information and evidence in regards to the test elements required to support the sabotage accusation. 160
LN324-91 3. Show one or more hypotheses. The most possible hypotheses are selected to solve a problem according to the information and available evidence. a. Apply deductive and inductive reasoning to show your hypothesis. (l) Inductive reasoning involves moving from the specific to the general. Develop a generalization of the information being evaluated that could explain the relationship between events under investigation. (2) Deductive reasoning involves moving from the general to the specific. Start with a general theory and apply it to the particular incident to determine if the truth of the incident is part of the theory. NOTE: WHEN USING DEDUCTIVE AND INDUCTIVE REASONING, THE MOVEMENT FROM ONE POINT TO ANOTHER MUST BE DONE LOGICALLY. b. During the study of information to show a hypothesis, the concept of intuition must be considered. Intuition is an internal and sudden solution towards a problem. Intuition frequently clarifies a problem when there is no progress through logic. c. Submit the hypothesis to probability tests, additional information of other witnesses, and other data already known. d. Eliminate the possibilities through the systematic comparison of the hypothesis with the following considerations: (1) Opportunity (2) Motivation (3) Observed activities (4) Corroboration of the suspects' bribes e. Select the best hypothesis based in the consistency of data compared and the high degree of probability. f. Test the hypothesis objectively. g. Modify and/or refute the hypothesis if information to the contrary is found. 4. Determine the requirement/direction of the future investigation activities. 161
LN324-91 a. Identify what could support or prove the hypothesis selected. b. Get the approval of the Control Office to initiate actions that have been identified. L. Carry out the follow up, if necessary. M. Carry out the personnel interviews if necessary. N. Carry out a CI interrogation of suspects, when there is suspicion in regards to the identity of a person. 0. Prepare and distribute the required reports. P. You may consider that the investigation was successful when: 1. All the information and material related to the case has been discovered and developed. 2. The physical evidence available was handled. 3. All the witnesses were interviewed. 4. The suspect was properly interrogated. 5. The case has been reported in a clear, exact and intelligible manner. 162