The examination of contested documents for purposes of civil or criminal law. Forensic document analysis, or forensic document examination as it is often called, is one of the oldest fields of forensic science. In North America, it gained notoriety during the early 1900s largely through the efforts of Albert S. Osborn and other founding members of the American Society of Questioned Document Examiners. See also: Criminalistics
Forensic document examiners (FDEs) draw on their skill, knowledge, and experience to determine if a questioned document is legitimate or fraudulent. Proven scientific methods are used to determine if a specific pen, typewriter, computer printer, photocopier, or other instrument produced the document. A FDE might also be consulted to determine if a document was fabricated in its entirety or whether it was altered by adding or removing information. Contested documents are not necessarily prepared on or about their purported dates. For example, it can be very important to determine when key documents related to a tax fraud investigation or a medical malpractice case were produced. The FDE can identify the presence of dating anachronisms after thoroughly examining the evidence.
Some specialists limit the scope of their analyses to one or two specific areas such as ink analysis or paper identification, while other FDEs examine a broad range of document problems, including photocopy comparisons, the identification of computer-printed and facsimile-transmitted documents, the comparison of rubber stamp impressions, the restoration of indented impressions, writing sequence determinations, charred document decipherment, and a host of other examination types. Falsified documents are often exposed by evidence uncovered by more than one of the above analyses.
The term handwriting refers to cursive writing, initials, signatures, numerals, and hand printing that can become the subject of investigation when dealing with matters that involve fraud. These entries are often written on paper using common writing instruments such as ballpoint, roller ball, fountain, gel and felt tip pens, as well as pencils and felt markers. Lipstick, chalk, or spray paint are occasionally used to write graffiti on walls, vehicles, or mirrors. On rare occasions, questioned documents may contain secret messages written with onion or lemon juice, milk diluted with water, saliva, urine, or other substances that need to be treated or developed before they can be read.
Handwriting comparisons are usually done in several stages. The first step entails an independent assessment of the questioned writing to determine if it contains features indicative of genuineness or spuriousness. The second step involves an inspection of the specimen material to identify any entries written by someone other than the known writer. The specimens are also assessed to determine if they are suitable for comparing with the questioned entries. The questioned and specimen groups of writing are then compared and all significant writing features are noted. In the final step, the document examiner carefully reviews his notes and expresses an opinion or conclusion that is supported by the evidence.
Illustrative charts are very useful for demonstrating the basis of a handwriting comparison. Figure 1 shows an illustrative chart containing several words from the questioned and specimen handwriting. The notation beneath each word indicates the document in which it is located. This chart does not show all the writing features examined but it does contain many of the features that support the opinion of identification that was expressed in this instance.
The plaintiff in another case produced a multigenerational photocopy of a contract bearing a questioned signature and stated that the original document was either misplaced or accidentally destroyed. Several documents bearing samples of the victim's signature were presented for comparison purposes. The contested signature in Fig. 2 contains many features that also appear in the adjacent specimen signatures. This evidence was sufficient to prove that the questioned document is a montage constructed by cutting and pasting the genuine signature from document K5 into position on the photocopied contract. The fraudster failed to include the underscore that appears below the K5 signature and each of the specimens.
Forensic document examiners are not the only specialists who have an interest in handwritten documents. CedarTech, a company that specializes in pattern recognition, has developed a software program that compares handwriting and verifies the authorship of documents in an efficient and objective manner. Their software allows document examiners to search large numbers of exemplars for samples that closely match a questioned handwritten document or to compare writing on two or more documents to determine if they were (or were not) written by the same person.
The degree to which two samples match (or do not match) is expressed objectively as two variables: distance (D) and log likelihood ratio (LLR). Figure 3 shows information extracted from three examples of the letter “e” that were executed by two writers. A high D value and negative LLR value suggest two letters were likely produced by different writers, while a low D value and positive LLR value suggest the pair were in all likelihood written by the same individual. Figure 4 shows the histograms and parametric probability density functions of the same and different writers for the letter “e.”
Admissibility of handwriting evidence
Document examiners have presented expert testimony with respect to handwriting identification in hundreds of thousands of judicial proceedings during the past century. An example from the early 1900s is United States v. Ortiz, where an expert witness acquired special qualifications from familiarity gained over the course of time by dealing with official records and the signatures they bear.
Forensic document examiners generally agree that handwriting identification is based on the following fundamental propositions: (1) no two people write in exactly the same manner, (2) although everyone's writing varies, the same series of recurring characteristics or habitual features appear in the handwriting of each individual, and (3) characteristics that serve to identify each person's handwriting vary to a lesser extent than the same characteristics in samples authored by other individuals.
Although these propositions are widely accepted, the admissibility of opinion evidence with respect to handwriting identification has recently been challenged in some United States courts. The challengers have raised a number of issues, but most claim that handwriting identification has not been established as a reliable expertise and that it lacks a methodology that is both objective and reliable.
The most detrimental arguments were presented in the case United States v. Starzecpyzel, where it was argued that no strong statistical evidence supported the aforementioned principles. In 1999, a district court ruled that the trial judge is responsible for determining if an expert's scientific testimony is relevant and reliable. The court further noted that Federal Rules of Evidence 702 and 703 gave the expert witness a degree of latitude not afforded to other witnesses because his opinion “will have a reliable basis in the knowledge and experience of his discipline.”
Despite these and other favorable rulings, forensic document examiners have taken steps to ensure their profession, especially as it relates to the identification of handwriting, is viewed as a credible, scientific endeavor. In one study, Professor Moshe Kam of Drexel University compared the performance of professional forensic document examiners with nonprofessionals in their ability to match examples of signatures. The results clearly demonstrated that laypersons made far more errors than professional examiners. A later test done by Dr. Kam yielded similar results with respect to hand- and nonhand-printed material.
The date when certain handwritten entries were made on a suspect document can be very significant in civil and criminal litigation. For example, the document examiner may be asked to determine if the evidence proves that a contract was signed after its alleged date or whether entries on a page from a diary or appointment book were all produced in one sitting or whether information was added some time later.
Two approaches can be used to answer these questions, one static and the other dynamic. In the static approach, a sample of ink extracted from the questioned entry is analyzed to determine its chemical composition. A database of writing inks can then be searched to identify the manufacturer and when the ink first appeared on the market. Some ink formulations are not unique to one particular manufacturer and can be produced by several companies. This and the near-impossible task of collecting samples of each ink manufactured limit the ink chemist's ability to draw definitive conclusions regarding the source of a particular writing ink.
Some companies have adopted the practice of adding trace amounts of unique chemicals to their writing inks. The composition of these tags is usually changed on an annual basis. Tags detected in a suspect entry can indicate if the ink was available when the document was written or whether it was written later than its date suggests. Figure 5 shows three inks analyzed by thin layer chromatography. Ink 1 contains a fluorescent tag added to black ballpoint pen inks manufactured in 1981 and 1991 while no dating tags were detected in inks 2 and 3.
The dynamic approach to ink dating relies on the principle that certain ballpoint pen inks age or change with time as they dry on a document. The resin components of many ballpoint pen inks also undergo a transformation as they harden and volatile solvents, such as benzyl alcohol or phenoxyethanol, evaporate or are absorbed by the paper as the ink dries. The rate of evaporation is much faster during the initial stages of aging. A quantitative analysis of an extracted ballpoint ink sample by gas chromatography–mass spectrometry (GC–MS) will discriminate fresh ink from dry ink and indicate when the ink was applied to the paper. See also: Chromatography; Forensic chemistry; Gas chromatography; Ink; Mass spectrometry
Printers and copiers
Document examiners are frequently asked to determine what equipment was used to produce a document or whether a document was printed on a specific printer or photocopier. Few areas have experienced as much growth and development as the office products industry. New photocopiers, fax machines, and printers tend to operate faster, cost less, and produce better quality output than their predecessors.
Color printers and photocopiers operate by applying multicolor and black toner or ink to paper or another supporting medium. Many color machines generate a repeated sequence of inconspicuous yellow dots, each less than a millimeter in diameter, over the entire surface of the document. Barely visible to the naked eye, these dots are easier to see in nonprinted areas when the document is illuminated with ultraviolet light (Fig. 6). The location and relationship of each dot to its neighbors indicate the serial number of the machine as well as the time and date when the copy was produced. Industry representatives claim that these codes represent a significant deterrent to counterfeiting. See also: Inkjet printing; Paper; Photocopying processes; Printing
Most qualified document examiners receive their training from federal, state, municipal, or other government forensic laboratories. These training programs are highly structured and typically take 2–3 years of full-time study to complete. Not only do they cover the theoretical aspects of document examination, they also place great emphasis on applying learned principles to practical case problems. Qualified instructors administer these programs and monitor the progress of trainees on a frequent basis.
No degree of personal supervision and no amount of sophisticated forensic equipment will compensate for a poorly trained expert. That is, document examiner trainees must receive their groundwork from effective training programs that provide the necessary knowledge, skills, and perceptive reasoning they need to perform their job.
Training acquired by some experts is not as rigorous. Many individuals received their instruction in a relatively short time through either online courses or correspondence courses. Self-directed distance learning is no substitute for more rigorous long-term training programs. A lack of day-to-day student-instructor interaction has also been found to limit performance and compromise training objectives. The more traditional pedagogical approach adopted by most government forensic laboratories clearly has its advantages.
In 1977, the American Board of Forensic Document Examiners (ABFDE) was formed to identify document examiners who meet or exceed its stringent certification requirements. In addition to this service, the ABFDE provides professional development opportunities to qualified examiners through workshops and seminars.
Candidates seeking certification must be engaged in the full-time pursuit of forensic document examination and pass a series of written, practical, and oral examinations. Certified examiners must subject their credentials to a thorough review every 5 years to maintain their certification.
In February 2007, the ABFDE's certification program was approved by the Forensic Specialties Accreditation Board, an independent agency supported and funded by the American Academy of Forensic Sciences, the National Forensic Science Technology Center, and the National Institute of Justice.