LN324-91
CHAPTER XVII
SABOTAGE INVESTIGATION
INTRODUCTION:
To understand the importance of a sabotage investigation you must always
think that the sabotage act is the intent to cause harm, intercept, or
obstruct by the desire to cause harm or destroy or intent to destroy material,
installations, or utilities with regards to the national defense.
GENERAL FACTS:
A. IDENTIFY THE INVESTIGATION REQUIREMENTS:
1. Use various reports from other agencies to identify the
requirements so that the counter intelligence elements could start an
investigation of the sabotage act. These reports could be found in the
following agencies:
a. Military police
b. Criminal Investigation Divisions
c. Local Civil Authorities
d. The superior authority/supervisor in charge of the facility where
the sabotage occurred.
e. Confidential sources that could testify that a particular incident
was indeed a sabotage act.
2. Review the Preliminary Sheet (PS), prepared to be distributed by
the Central Intelligence Office, to identify the investigative requirements:
a. The PS has information collected during an investigation that may:
(1) Require further investigation and development.
152
LN324-91
FIGURE/EXAMPLE #1
PRELIMINARY SHEET
_____________________________________________________________PRELIMINARY
SHEET DATE INVESTIGATION STARTED
_____________________________________________________________
1. SUBJECT/THEME 2. DATE
3. CONTROL OR FILE NUMBER
_____________________________________________________________4. TYPE AND
REASON FOR INVESTIGATION
7. AGENCY REQUESTING 8. AGENCY PREPARING REPORT
_______________________________________________________________________
OFFICE OFFICE
_____________________________________________________________
ADDRESS ADDRESS
_____________________________________________________________
FOR G2 ACTION FOR G2 ACTION (IM)
_____________________________________________________________
AUTHORIZED SIGNATURE AUTHORIZED SIGNATURE
_____________________________________________________________
NAME AND RANK NAME AND RANK
_____________________________________________________________
8. CONVINCING DOCUMENTS CONVINCING DOCUMENTS
_____________________________________________________________
153
LN324-91
4. To condemn a person for an act of sabotage during peace time, you
have to prove that he had tried to cause harm described above. In war time it
is sufficient to prove that the person had knowledge that his act will affect
the "war effort".
5. If more than one person conspires to carry out a sabotage act and
one of them is captured while carrying out the plans of the act, all could be
accused and condemned for the sabotage act.
C. DETERMINE THE TYPE OF SABOTAGE INVESTIGATION THAT WILL TAKE PLACE:
1. PASSIVE SABOTAGE: This type of sabotage involves the passive
resistance of the population and it could be local or at national level. The
passive sabotage is not so organized so that persons or groups are assigned
specific missions: nevertheless, the population reaction is the result of
propaganda, well organized propaganda by a subversive group that is well
organized. In other words, the passive sabotage is when a population locally
or nationally has been convinced by a propaganda group to carry out or to
allow the acts previously described that could be classified as sabotage acts.
2. ACTIVE SABOTAGE: This type of sabotage is characterized by violent
sudden actions with visible results and which commonly turn into conflicts
with military forces. Within this category, we found the following physical
forms of sabotage:
a. Fire sabotage: Is when combustible materials are used to cause
fires and destroy government properties. This is normally considered as an act
of vandalism or a common criminal act.
(1) This act changes from vandalism to sabotage when it is
proven that it took place with the purpose of affecting the national defense,
the war or the war effort.
b. Explosive sabotage:
(1) In this type of sabotage explosives are used to destroy or
neutralize targets that are resistant to fires and to obtain the maximum
quantity of destruction at the minimum time.
154
LN324-91
(2) Targets that are sensitive to explosive sabotage are:
(a) Bridges
(b) Tunnels
(c) Railroads
(d) Ships/boats
(e) Heavy equipment
(f) Industrial machinery
c. Mechanical sabotage:
(l) the mechanical sabotage is easier to maintain since it does
not require instruments or special tools, and normally is directed against
railroads, ships or industrial facilities.
(2) The mechanical sabotage is normally classified within one of
the following categories:
(a) Destroy/break/tear
(b) Inserting materials or abrasive substances such as, sand,
soil, etc., into lubricants and vehicle's fuels.
(c) Omission acts. This consist of not doing something so that a
mechanical equipment stop working. Not lubricating a motor so as to damage it,
not adjusting a mechanical part so that when the motor is turned on it will
stop working.
(d) Substituting real parts for fake parts in apparatus or
vehicles. Ce) Contamination of lubricants or fuels.
d. Biological, chemical and nuclear sabotage:
(l) The sabotage with biological agents is know as "biological
warfare", and is considered as the introduction of living organism and its
toxic products in the environment with the purpose of causing death, impede,
or harm people, animals or crops.
(2) Sabotage using chemical agents is know as "chemical warfare:
and is considered as the introduction of chemicals to the environment to cause
death, impede, or harm people, animals or crops.
155
LN324-91
(3) Sabotage using nuclear weapons, could just with its
destructive capacity, cause serious damage or destruction to property,
materials and persons.
D. PREPARE AN INVESTIGATION PLAN: (See example #2)
1. Initial plan:
a. Determine the purpose of the investigation.
b. Determine the place of the incident.
c. Determine what official documents are required to travel to
the place where the incident took place (passport, visa, etc.)
d. Make arrangements to get these documents.
e. Determine priorities, if any, that exist in regards to the
case being investigated.
f. Determine if any restrictions or special instructions are
necessary.
2. Modify the investigation plan according to how you could obtain
more information.
F. CARRY OUT THE INVESTIGATION:
1. Go to the place where the incident took place.
2. Write down the date and time you arrived to area and the
weather conditions.
3. Visually search the area to try to find wounded persons and:
a. Coordinate medical attention.
b. Write down identity of the wounded, so as to possibly
question them later.
c. Coordinate transportation of wounded persons to medical
facilities.
156
LN324-91
(FIGURE/EXAMPLE #2)
INVESTIGATION PLAN
1. PURPOSE OF THE INVESTIGATION:
2. TYPE OF INVESTIGATION: Limited
3. THE INVESTIGATION WILL TAKE PLACE IN THE FOLLOWING MANNER:
(Discretely)
4. PRIORITY: 30 days after having received the preliminary sheet.
5. SPECIAL INSTRUCTIONS:
a.
b.
6. INFORMATION PROVIDED:
7. INVESTIGATION SEQUENCE:
a. Carry out the review of files.
b. Examine the medical and military files of suspect.
c. Interview the following persons:
(l)
(2)
(3)
d. Carry out the investigation of the neighborhood.
e. Carry out the review of credit bureaus.
NOTE: THE PLAN DESCRIBED ABOVE MUST BE FLEXIBLE AND ITS INTENTION IS ONLY TO
BE USED AS A GUIDE. EVERY CASE MUST BE TREATED INDIVIDUALLY. YOUR PLAN COULD
BE SIMILAR, SHORTER OR LONGER ACCORDING TO WHAT THEIR OWN REQUIREMENTS.
157
LN324-91
4. Coordinate work with other investigation agencies that are present
in the incident area, or if they should arrive later.
5. Identify and search a road for the medical personnel to use when
arriving to the place where there are wounded and/or dead persons.
6. Do not allow the corps to be covered since this could destroy
evidence.
7. Protect the area of the incident using persons to maintain the
curious passersby away from the area and to avoid that witnesses, suspects and
victims destroy evidence.
8. Protect all that could possibly be destroyed by fire, rain or any
other thing, such as footprints, etc.
9. Find the possible witnesses in the area.
10. Ask and write down the identity of the witnesses.
11. Separate the possible witnesses and take them outside the incident
area.
12. Carry out questioning/preliminary interviews of witnesses to
determine:
a. How much knowledge they have of the incident.
b. Movements that the witnesses have done in the incident area.
c. Any tool that the witnesses or other persons have possibly
touched.
12. Write down all the pertinent facts:
a. Identify the persons involved or that were involved in the area.
b. Initial impressions or observations.
c. Take photos of the area in all angles.
d. Take photos of the persons in the vicinity of the area.
13. Search the incident area and adjacent areas to collect all evidence
using the search patterns more useful in the area.
a. Pay particular attention to fragile traces of evidence that could
be destroyed if not collected immediately.
158
LN324-91
b. Carefully examine all objects or areas where there may be latent
fingerprints and make sure that a follow up is done of this fingerprints.
c. Take photos or prepare imprints that could have value as evidence.
(Example: shoe prints, or boot prints on the ground could indicate the amount
of persons involved in the incident).
d. Treat stains or accumulation of liquids as evidence and write down
its place and take photos of them.
e. Treat any tool as evidence until this could be found to the
contrary.
14. Collect, mark for identification and process the evidence.
F. Transfer the evidence to the criminal laboratories and proper
agencies to evaluate such evidence.
G. Carry out the review of files.
H. Carry out the interviews with "Witnesses" that are necessary:
1. To obtain more information about the incident.
2. To develop new leads and/or sources.
I. Prepare Preliminary Reports, if necessary.
NOTE: THE PRELIMINARY REPORTS ARE PREPARED WHEN THEY ARE REQUIRED BY THE SOP
OR IF AN ORDER IS RECEIVED FROM THE HIGH COMMAND.
J. Contact your confidential sources of information.
K. Carry out an analysis of the information in the case to identify
the suspect. Even though an investigation is basically a collection of
information, the analysis of such information is a secondary function. This
analysis is the review and comparison of information obtained to develop a
hypothesis and come up with conclusions that could be used in identifying the
suspects and determining the circumstances of the incident and future actions.
NOTE: THERE IS NO FIXED PROCEDURE IN THE ANALYSIS OF INFORMATION OF A CASE TO
159
LN324-91
ARRIVE AT A SOLUTION. ONE METHOD COULD WORK AS WELL AS THE NEXT. NEVERTHELESS,
ANY OF THE METHODS USED MUST HAVE THE BASIC FUNCTIONS OF: (REVIEW, COMPARE,
AND MAKE A HYPOTHESIS).
1. Review all the information in the case:
a. Arrange in an orderly fashion all the information.
b. Examine the information in detail to identify the pertinent facts.
(1) Determine the dependability of the information.
(2) Determine the truth of the information
2. Compare the information known:
a. Compare the available information with the legal aspects of
sabotage.
(l) Identify facts/evidence that support or prove the legal
elements of sabotage.
(2) Identify vulnerabilities in the information that could
require further investigation.
b. Compare the information obtained from witnesses with such obtained
by other witnesses and sources.
c. Identify possible suspects through the information comparison.
(l) Identify such persons that have connection with the incident.
(2) Identify information that supports or proves the
"OPPORTUNITY" that possible suspects may have. (Ask yourself: Is it physically
possible that the suspect could have committed the act of sabotage?)
(3) Identify information that supports or prove "MOTIVATION" by
each suspect.
(4) Identify information that proves "INTENT" by part of the
suspects.
(5) Identify all circumstantial or association information
related with each suspect.
(6) Evaluate all information and evidence in regards to the test
elements required to support the sabotage accusation.
160
LN324-91
3. Show one or more hypotheses. The most possible hypotheses are
selected to solve a problem according to the information and available
evidence.
a. Apply deductive and inductive reasoning to show your hypothesis.
(l) Inductive reasoning involves moving from the specific to the
general. Develop a generalization of the information being evaluated that
could explain the relationship between events under investigation.
(2) Deductive reasoning involves moving from the general to the
specific. Start with a general theory and apply it to the particular incident
to determine if the truth of the incident is part of the theory.
NOTE: WHEN USING DEDUCTIVE AND INDUCTIVE REASONING, THE MOVEMENT FROM ONE
POINT TO ANOTHER MUST BE DONE LOGICALLY.
b. During the study of information to show a hypothesis, the concept
of intuition must be considered. Intuition is an internal and sudden solution
towards a problem. Intuition frequently clarifies a problem when there is no
progress through logic.
c. Submit the hypothesis to probability tests, additional information
of other witnesses, and other data already known.
d. Eliminate the possibilities through the systematic comparison of
the hypothesis with the following considerations:
(1) Opportunity
(2) Motivation
(3) Observed activities
(4) Corroboration of the suspects' bribes
e. Select the best hypothesis based in the consistency of data
compared and the high degree of probability.
f. Test the hypothesis objectively.
g. Modify and/or refute the hypothesis if information to the contrary
is found.
4. Determine the requirement/direction of the future investigation
activities.
161
LN324-91
a. Identify what could support or prove the hypothesis selected.
b. Get the approval of the Control Office to initiate actions that
have been identified.
L. Carry out the follow up, if necessary.
M. Carry out the personnel interviews if necessary.
N. Carry out a CI interrogation of suspects, when there is
suspicion in regards to the identity of a person.
0. Prepare and distribute the required reports.
P. You may consider that the investigation was successful when:
1. All the information and material related to the case has been
discovered and developed.
2. The physical evidence available was handled.
3. All the witnesses were interviewed.
4. The suspect was properly interrogated.
5. The case has been reported in a clear, exact and intelligible
manner.
162