post forensics interview
DESCRIPTION
Technical forensics can only recover so much data about a security incident�more can be gathered through effective interviews of those with valuable information. Learn about social engineering, neuro-linguistic programming and interviewing techniques that will help you get the most information and most accurate information out of interviewees. And know when the information you're given is false.TRANSCRIPT
1
Brad Smith
Post Forensics InterviewApril 28, 9:45-12:00
RN,BS-Psychology,MCNPS,CISSP,NSA-IAMDirector, Computer Institute of the Rockies
Uses Reid, Walters, Kübler-Ross?Does Bandler, Grinder, NLP?Does Bandler, Grinder, NLP?Does Forensics, Anti or live Forensics?Who Lawyer, Law enforcement, X-spouse
Public Service Message
Post Forensics InterviewApril 28, 9:45-12:00
2
Learn in first halfPractice in secondReal IT scenariosNot just for work
Post Forensics InterviewApril 28, 9:45-12:00
Simple book to readGreat case studiesGreat case studiesNo clusters mentionedWidely taught, 1962Practical
Post Forensics InterviewApril 28, 9:45-12:00
“Essentials of the Reid Technique: Criminal Interrogation and
Confessions”Fred E. Inbau, John E. Reid, Joseph P. Buckley, Brian C. Jayne
3
Based on flight or fright mechanismFreudian4 personality types4 stages of interview5 standard responsesTailoring session for personality
Post Forensics InterviewApril 28, 9:45-12:00
“Principles of Kinesic Interview and Interrogation” Stan B. Walters
1. Orientation2. Narration3. Cross-examination4. Close (Resolution)
Post Forensics InterviewApril 28, 9:45-12:00
Principles of Kinesic Interview and Interrogation” Stan Walters
4
You talk(accusatory)
Suspect talks (nonaccusatory)
Notes after the suspectNotes after each
Direct accusationFree formFinal sessionEarly in investigationReveal informationGather information
( y)( y)
Closed environments Open environments
Notes after the suspect has admitted guilt
Notes after each question
Privacy is most importantMi i i i dMinimize consequences remindersArrange chairs across 4-4.5 feet apart
Straight back, no rollersNot between door and subject
Minimize noise
Post Forensics InterviewApril 28, 9:45-12:00
Observation room, electronic recordingLighting
5
t Topic sic Shifts in chair
i-i Direct I to I contact
/fl Breaks gaze, floor
xlg Crosses legs fc Facial cover
rptq Repeat … Seconds to question respond
AngerDepressionDenialBargainingAcceptance (acknowledgement)
Post Forensics InterviewApril 28, 9:45-12:00
Acceptance (acknowledgement)
”Principles of Kinesic Interview and Interrogation” Stan Walters
6
Denial - The initial stage.AngerAngerBargainingDepression Acceptance
Post Forensics InterviewApril 28, 9:45-12:00
“On Death and Dying” Five Stages of Grief
Posture of body: upright, slump, awaySkin color: pale, red, white, changesHead position: upright, tilted, forward/backEyes: direction openness
Post Forensics InterviewApril 28, 9:45-12:00
Eyes: direction, opennessHands/Feet: movement, position, color
7
Mouth/Lips: position, color, turn up/downPrimary Sense: visual, aural, kinetic, feelingVoice: pitch, rate, changes
Post Forensics InterviewApril 28, 9:45-12:00
Words: short, long, # syllables, dysfunctions, pauses
Initial meetingEstablish WhoPurpose Topic
Post Forensics InterviewApril 28, 9:45-12:00
Topic GoalsEstablish rapport
8
Listen for dominant sense and respond appropriatelyModel postureWatch / measure baseline stress
Post Forensics InterviewApril 28, 9:45-12:00
stressBaseline entire person for future changes
Easier for them to understandCulturally based in TranslationCulturally based in TranslationModerate skill practiceSpeed killsSlow slightly with power wordsS h l
Post Forensics InterviewApril 28, 9:45-12:00
Stretch vowel
PRACTICE: Match the speed of your neighbour
9
Birds of a feather flock…Makes you seem more like them
PITCHSPEED
Post Forensics InterviewApril 28, 9:45-12:00
SPEEDWORDS
Most subconscious, micro-motorHardest ProsHardest, Pros
Practice: Crease forehead
Great for buying cars
Post Forensics InterviewApril 28, 9:45-12:00
Great for buying cars -one questions, one watches!
10
Case: Loss / Theft of laptopSomeone has “misplaced” the company laptop. Used for presentations, it has been on loan to HR. it was not encrypted. The HR manager report the data on the laptop contained all the HR data for the company. (15,000 names, SSN & address) because several workers were working on a project
Post Forensics InterviewApril 28, 9:45-12:00
g p jwith your insurance company.
“Listening phase”Let subject talk Ask open ended questionsInformation here is used in next stage
Post Forensics InterviewApril 28, 9:45-12:00
next stage
11
Watch YOUR body languageWatch for physical changesTopic specific changesCluster of changes
Watch for verbal changes
Post Forensics InterviewApril 28, 9:45-12:00
Tense changePerson change
Regain control of interview from Narration Ask question about statements in NarrationVery specific questions about
Post Forensics InterviewApril 28, 9:45-12:00
events, items
12
Point out contradictory statements or evidenceGreatest % denial hereFocused attacks causes stress and increased deception to
Post Forensics InterviewApril 28, 9:45-12:00
maintain deception
Watch for physical changes when a ti l t i i i t d dparticular topic is introduced
Color, body position, hands-to-face, Feet, hand, eye movementVerbal tense change, shortened responses
Use personal space for extra push
Post Forensics InterviewApril 28, 9:45-12:00
p p pWATCH you body language (they are!)
13
Not everyone admits guiltN t h d it ilt i iltNot everyone who admits guilt is guiltyUsually marked by bargaining
“Would someone loose their job over this”?“What if it was an accident”?
Must accept and take ownership to action
Post Forensics InterviewApril 28, 9:45-12:00
Get it in writing / video / audio / witness
DON’T buy it backChange in stress level“I swear”Watch for relaxation of postureEyes up and closed for few
Post Forensics InterviewApril 28, 9:45-12:00
Eyes up and closed for few seconds
14
“You wouldn’t have done this if your family didn’t need the money”“It was the ________”“I know your OK, but those
Post Forensics InterviewApril 28, 9:45-12:00
people who got you into this”
You don’t really believe this, but people want something outside of them to blame
PostureSlouch, distant, disinterestedTurned torsoRetreating postureCrossing behaviorS i
Post Forensics InterviewApril 28, 9:45-12:00
Static posture
15
↑ activity = ↑ stressElbows in vs nat ralElbows in vs. naturalIllustratingAdaptive behaviorGrooming Personal gestures
“I Swear” pose ready for bargaining
Personal gesturesSupporting / protective
Cultural / Education sensitive
Facial touch targetFlight / fight dries mucus membranesBelow bridge of nose to bottom lipSignificant association with deception
Post Forensics InterviewApril 28, 9:45-12:00
deception50% greater faceCovering eye = hide leaks
16
Increased / prolonged eye contacth !Watching you!
Want’s to be believedBargaining State
Roll-upEyes up then close;
Post Forensics InterviewApril 28, 9:45-12:00
Eyes up then close; Bargaining State
lower YOUR voice pitch / softer tone / feelings
Pupillary ResponseConstrict with fear / angerWatch for verbal incongruenciesColor changeSanpaku = 3 whites – show
Post Forensics InterviewApril 28, 9:45-12:00
Sanpaku 3 whites show whites under eyes, high stress
17
“brain tachometer”Baseline 1/10 of a sec. closedIncrease with stressDecrease (near 0) Internal conversation
Post Forensics InterviewApril 28, 9:45-12:00
Approaching acceptanceUse short statements, confirm factual information
Very visible Hard to controlV shape (hardening eyes) AngerV shape (hardening eyes) AngerBoth raised high with mouth open
Surprise
One raised SkepticismSmall skin ridges b t d b
Strong emotional i / ff ibetween and above
eyes pain / suffering: Change tactic
18
Negative procedural cuesUncooperativeWon’t follow simple instructionsPersistent questioningDelaying
Post Forensics InterviewApril 28, 9:45-12:00
Where do they start the story?Robbery with weaponViolent crime
Verbal / NonverbalRepeating excuse / alibiAvoidance of main issueRecall aided by “numbering”Compression (time, event, distance)Ci l i ( i f
Post Forensics InterviewApril 28, 9:45-12:00
Circumlocution (opposite of compression)
Clusters
19
Varying levels of detail in storyAbsence of emotional statementsImplied action phrasesOmissive responsesEvasive responses
Post Forensics InterviewApril 28, 9:45-12:00
Evasive responsesDeceptive responses
Similar detail in entire storyO f Out of sequenceTell story backwardThought and emotions Usually have 3 partsI t d ti
Post Forensics InterviewApril 28, 9:45-12:00
IntroductionMain eventEpilogue (results)
20
Confusing Narration with X-examAccusatorial approachConfront at start or at 1st deceptionNo baselineNo clues to further investigation
Post Forensics InterviewApril 28, 9:45-12:00
False statementsHardens even innocents
Not watching yourselfM it b d / b lMonitor your own body / verbal
PreconceptionArsenic and old Lace
Interrupting during the narrative phase
Post Forensics InterviewApril 28, 9:45-12:00
phaseSave clarification for cross-examinationLet the subject run the narrative
21
Asking closed questions (Y/N)Open ended is less threateningShow unknown area for further investigation
Questioning in inappropriate sequenceRepeating same questionp g qTrying to get different answer, “Correct”
Working “the list”Miss points trying to finish the list
Next question from last question
Prepare yourselfPrepare area properlyEstablish personality typePrior interviewsAsk others who have interacted
Post Forensics InterviewApril 28, 9:45-12:00
Ask others who have interacted with suspect
22
Establish baselineStress levelPh i l iPhysical signs
Watch for signs of denialWatch for incongruence's between body and speech
Post Forensics InterviewApril 28, 9:45-12:00
Watch for clusters that are topic specific
Take notes on these, but pretend on othersOffer excusesOffer excusesMove in orderly progress by personality typeNot everyone will confessDon’t take offense at suspects statements
Post Forensics InterviewApril 28, 9:45-12:00
pDon’t prejudge suspectHard work, PRACTICE
23
Watch Columbo and identify each phase of interviewWatch Politian's for signs of credibilityPractice nonverbal shorthand
Post Forensics InterviewApril 28, 9:45-12:00
Practice changing dominant sense model
Short breakNext session is:
Scenarios and groups practice