by Ruth
Brayer
Reprinted from the February 1998 Issue of Security Management
Magazine
A high-level employee of a Northeast organization
almost saw her job search sabotaged in 1997 when several potential
employers received a mysterious letter containing slanderous information
about her professional abilities and personal life.
The letter scheme came to light when one of the recipients telephoned
the woman's immediate supervisor to ask whether any of the letter's
details were true. The supervisor, who was aware of the woman's job
search, assured the caller that the letter was a cruel hoax. He then
notified his organization's security department to report the incident.
An investigation revealed that several slanderous letters, each of which
was signed with a different name, had been sent to several of the
organizations with which the woman had applied for a job. Suspecting
that the letters might have been written by one of her current
coworkers, security collected writing samples of everyone in the woman's
department and hired a handwriting examiner to review the evidence.
After a week of work, the handwriting expert submitted a report
identifying one of the woman's coworkers as the probable writer of the
letters. Security confronted the worker with the information, asking him
why he had done it. He eventually confessed, saying he had tried to
sabotage the woman's career because of professional disagreements he had
had with her over the years. The man was disciplined and required to
undergo psychological treatment.
Handwriting examination can be a useful supplement to other
investigative tools in cases involving a range of incidents from fraud
to workplace violence. Just as a fingerprint can place a suspect at a
crime scene, each handwriting style has unique features that can tie a
threatening letter or forged signature to a single suspect.
Handwriting examination focuses on the fact that most people's
handwriting deviates from the model taught in grade school. Differences
in the shape, size, and spacing of letters, as well as the ratio between
upper and lowercase characters, are some of the components used to
detect patterns in handwriting styles. In addition, a handwriting
examiner will look for pauses, slants, extension of letters, and even
pen pressure as clues to identify forgeries and suspects alike.
Although most security managers do not have the background to conduct
their own handwriting examinations, they will play a vital role in
deciding when to hire a handwriting examiner and what type of evidence
to submit for examination. By understanding how the handwriting expert
does his or her job, the security manager can make that job easier.
Hiring an examiner.
There are generally two instances when a security manager should
consider hiring a handwriting examiner. The first would involve a
handwritten document-for example, an anonymous threatening letter-where
identification of the writer is critical. The second instance involves
internal or external fraud in which a signature is part of the evidence.
The handwriting examiner can be asked to determine whether the signature
has been forged and, if it is, who might be responsible for writing it.
To help with the examination, the security manager should provide the
handwriting expert with samples of each suspect's handwriting. The
samples should date from before the incident under investigation. They
can include notes and memos that the suspects have written as part of
their jobs, checks they signed for the company, or the handwriting on
their job applications.
When the suspect is a customer or client, the security manager should
check the company's existing records for any documents that the customer
has signed or written as a part of doing business with the company. For
example, a financial institution will likely have each customer's
signature and handwriting on file from when the client opened an
account.
In addition, the security manager should attempt to find writing
samples that can be easily compared to the suspect document. For
example, if the document to be examined is a threatening letter written
in script, the security manager should try to provide writing samples
that depict the suspects' handwriting in script. A handwriting examiner
will have a much more difficult time trying to identify the writer of a
letter if the document is written in script but the only samples
available are in print. For that reason, an employer may want to ask new
employees to write in script and in print a sample paragraph as a part
of the hiring process.
The more writing samples a security manager can provide, the easier
it will be for the handwriting expert to complete the examination. The
examination can take from several hours to several weeks depending on
the number of suspects whose handwriting is being analyzed, the number
of samples, and the quality of those samples.
Handwriting experts can be helpful at various stages of an
investigation, depending on the nature of the investigation. For
threatening letters, for example, the security manager should conduct a
preliminary investigation first and develop a narrow list of suspects
before hiring a handwriting expert.
Some investigators make the mistake of providing the examiner with
samples of twenty suspects, even though the security manager's
investigation may have already narrowed the list to one or two. This
approach increases the time and cost of the handwriting examination for
the company, which can expect to pay a retainer of between $550 to
$2,500 as well as an hourly fee of $150 to $350.
Cases involving forged signatures are different and can usually
benefit from hiring a handwriting expert at the start of the
investigation. For example, a bank customer might claim that his or her
traveler's checks were stolen and forged. A handwriting examiner can
sometimes determine at the beginning of the investigation whether the
signatures on the returned checks are in fact forgeries or
authentic-allowing the security manager to decide on the direction of
the investigation.
The examination.
Once hired, the handwriting examiner will conduct the examination by
comparing the suspect document with the samples provided by the security
manager. Individual letters and words will be dissected with the use of
magnifying glasses, microscopes, and various other instruments to
measure the size of letters, the distance between words, the width of
letters, and other elements of the sample handwriting.
Involuntary patterns. The first thing an examiner tries to
identify is the involuntary patterns of the handwriting - those aspects
of the handwriting that a person cannot control. Involuntary features
are so subtle and have become so automatic that an individual is not
even conscious of making them. For example, an individual may
inadvertently, but consistently, make one leg of a capital "A" darker
than the other. In addition, a person might hesitate or change
directions in the middle of writing certain letters.
Under a microscope, those hesitations turn into breaks in the flow of
the letter; those changes in direction turn into unique angles and
shapes in the letter formation. Because the person is not aware of these
actions, he or she tends to duplicate them even when trying to
voluntarily change handwriting style.
In one recent case, for example, a senior executive of a major
company received three anonymous letters in which he was personally
threatened. One of the notes had a drawing of a bomb ready to explode
and the words: "The new year is coming. Prepare for surprises!"
An internal investigation identified two possible suspects: one was a
former employee who had been laid off a month earlier and was resentful
of the executive for receiving a promotion that the former employee
believed belonged to him. The second was a current employee who had a
strained relationship with the executive. Samples of the suspects'
writing were provided to a handwriting examiner along with the
threatening letters.
The examination, which took several hours, eventually identified the
former employee as the writer. He was confronted with the evidence and
confessed. Although the former worker tried to disguise his handwriting,
several involuntary patterns gave him away. For example, the letter "p"
in "surprises" was similar to the letter "p" in several writing samples
the employee had made when he was working for the company. The lower
extension of the "p" was slightly raised above the baseline, for
example, while the shape and character of the top portion of the letter
matched. The examiner noticed similar spacing between letters as well as
similar proportions between capital and lowercase characters.
Three zones. In addition to shapes and sizes of letters, the
handwriting expert will also take note of how an individual's
handwriting fits into the "three zones" of handwriting - known as the
upper, middle, and lower zones. The upper zone includes all capital
letters as well as lowercase letters that extend upward, such as the
letters h, 1, t, and d. The middle zone is occupied by letters that
extend above the baseline but do not extend upward when written, such as
n, m, a, and e. The lower zone includes all parts of a letter that go
below the baseline. For example, the top part of the letters p and g are
in the middle zone, but the lower portions extend below the baseline and
are in the lower zone.
Most people tend to prefer, or exaggerate, one or two of the zones. Some
people prefer the upper zone and write their letters with long, sweeping
extensions. Others prefer the lower zone and write letters like y and g
with long downward extensions.
By knowing an individual's writing patterns in the three zones, the
handwriting examiner can identify certain types of forgery or identify
the writer of a letter. For example, President Bill Clinton favors the
middle zone when signing his name. The two I's at the end of Bill are
the same size or even smaller than the letter i. If a person tried to
forge Bill Clinton's name and extended the I's into the upper zone (the
way most people do), the forgery would be easily identified.
Forgeries. When analyzing a signature, the handwriting expert
will look for certain clues to determine whether it is a forgery or the
real thing. If it is a forgery, it will fall into one of three
categories: fictitious, traced, or simulated.
A fictitious signature is one in which the forger has not seen the
authentic signature and makes no attempt to duplicate it. These can be
easily identified if security has a copy of the authentic signature.
A traced forgery is one in which the forger actually traces an authentic
signature to make it look identical to the real thing. However, there
are several signs that can help detect the traced signature. Under close
examination, handwriting examiners will usually find hesitation marks in
the letters, which won't flow naturally. These marks occur because the
forger must write slowly and deliberately as he or she traces the
genuine signature. In addition, there are usually changes in pen
pressure and breaks in the letters.
A simulated signature occurs when a forger has studied the genuine
signature and attempts to write it from memory. These are more difficult
to detect, but not impossible. Although the forger has memorized the
style of the real signature, the imitator will often revert back to some
of his or her own involuntary writing patterns.
On close examination of the forgery, the handwriting expert can often
discover subtle inconsistencies from the authentic signature, such as
pen pressures, slight curvatures in letter formations, and letter
angles. In addition, people tend to write their signatures at basically
the same length. Signatures should be measured and compared to the real
thing. In many cases, forgeries turn out to be slightly shorter or
longer than the genuine signature.
Written report.
When the examination is complete, the security manager should receive a
written report that outlines the expert's conclusions, including the
level of confidence that the expert has in the drawn conclusion.
Although each examiner is different, there are generally five levels of
certainty that can be given: identification, in which the examiner
believes he or she has identified the writer of a letter or forgery
beyond any doubt; strong probability, in which the conclusion is certain
beyond a reasonable doubt; probability, in which the handwriting
examiner has a high degree of certainty; indications, in which there is
a reasonable degree of certainty that the writer has been identified;
and no conclusion. Most conclusions fall in one of the middle three
categories.
The level of certainty expressed by the handwriting expert should not
alter how the security manager completes his or her investigation.
Unless the examination reaches no conclusion, the investigator should
use the evidence to confront the suspect.
In most cases, guilty suspects will confess when told that a handwriting
expert has matched their handwriting with a suspect letter or forgery.
However, the level of certainty can come into play if the case goes to
court. The handwriting examination should, of course, be only one of the
pieces of evidence on which the company bases its conclusion. The
security manager should not ignore the possibility that a suspect who
maintains his or her innocence may indeed be innocent.
Like any science, there are limitations to handwriting examination. But
with sufficient evidence provided by the security manager, handwriting
examination can give investigators what they need to make the guilty
party see the writing on the wall - and confess.
http://www.antiforgery.com/articles.html |