Obtaining standards

A handwriting examiner needs several standards, or writing samples, to get a feel for a person’s writing style and determine whether that person wrote the questioned document. Complicating matters, standards may have been written with a different instrument and under different circumstances. So comparing a questioned document to a known writing sample on a wall may be impossible.

If no usable nonrequested standards (samples that already exist and are known to be authentic) are available, the examiner asks the suspected writer to provide a writing sample, using a similar writing instrument on similar paper, so that the examiner can at least establish a requested standard.

Nonrequested writings provide several advantages. The most important is that nonrequested samples reveal the writer’s true writing habits and may reveal words and phrases that the writer frequently uses, which can be strong evidence for or against the writer. For example, old letters or notes may contain phrases that are identical to the ones used in a ransom note. The major disadvantage of nonrequested standards or samples is that they also must be authenticated. If they can’t be linked directly to the writer, they don’t have much value to the examiner.

Handwriting styles aren’t static throughout our lives, so examiners try to obtain writing samples from documents written by suspected authors at about the same time as the questioned document. Say that an examiner is asked to determine whether a 20-year-old, handwritten will is authentic and was indeed written by the supposed author. The examiner needs to see other documents written by the supposed author from 20 years ago because those documents reflect his style at or near the time the will was prepared better than documents written just weeks before the examination.

The major advantage of requested writing samples is that no one questions their authenticity. The examiner actually watches the person write. The examiner also can dictate exactly what the individual writes, even a passage taken directly from the questioned document, so that the examiner can compare the samples word for word. If the document contains information that the examiner wants to withhold from the suspect or that is sensitive to an ongoing investigation, the person providing the sample can be asked to write sentences that are quite different but include many words and phrases that were used in the questioned document.

Several disadvantages accompany requested writing samples. Providing a writing sample makes some people nervous or causes them to concentrate too much on the writing process, which can lead to uncharacteristic changes in the way they normally write and sign their names. As a result, minor changes can be introduced that make an accurate comparison much more difficult.

Suspects may also try to disguise their writing style on purpose, not wanting the handwriting sample to match the writing on a forged will, ransom note, or other questioned document. Unfortunately, these attempts to alter writing styles are sometimes successful, making getting a match difficult or impossible.

One way around this problem is to have the suspect write a great deal of material — not just a passage or a page, but several pages. Although altering your style may be fairly easy when writing short passages, the more you write, the more your conscious alterations give way to your natural writing style. Dictating the same material to the writer several times is another trick examiners use to ferret out those who are attempting to disguise their handwriting style. With each attempt, the suspect is likely to use different devices. A good examiner then finds the hidden style elements and the devices that the suspect used to disguise them within the requested writing before making a comparison.

Investigators don’t have to worry about a suspect refusing to offer a handwriting sample. Although you may be thinking that providing a handwriting sample violates the suspect’s Fifth Amendment right not to incriminate or testify against oneself, the United States Supreme Court decided in Gilbert v. California that handwriting is part of identifying physical characteristics that are not protected under the Fifth Amendment. Furthermore, in the case of the United States v. Mara, the high court also decided that providing a handwriting sample doesn’t violate Fourth Amendment protections against unreasonable search and seizure. So the court can order a suspect to produce handwriting standards even after a refusal.

Comparing handwriting

When beginning the comparisons between two handwritten documents, an examiner looks for points of similarity and points of difference between the known standards and the questioned document. The examiner typically assesses the following features:

• Overall form: The size, shape, slant, proportion, and beginning and ending strokes of the letters are part of the writer’s overall form.
• Line features: Writing speed, fluidity, and the amount of pen pressure used provide hints about line features, and so do the spacing between letters and words and how the letters are connected.
• Margins and format: The width of the margins, the consistency of the spacing, and the slant between lines fit into this category, which covers the overall form and layout of the writing.
• Content: Grammar, punctuation, and word choice help point the examiner toward consistent errors, repeated phrases, and other clues that hint at a writer’s ethnicity or level of education.

Astute examiners look for all of these features when comparing documents or signatures. No single feature makes an accurate comparison, but a combination of features may enable examiners to determine whether suspect and sample writings came from the same person, which ultimately is a subjective judgment. However, based on the findings, examiners may say that the documents

• Absolutely match
• Match with a high probability
• Probably match
• Do not match

Not every examination ends in an answer: The examiner may also say that a determination based on the samples is not possible. That outcome isn’t too common, though. If the writing in question is cursive (with the letters joined) or a signature, a trained examiner usually can usually determine whether a particular individual created it. If, however, the questioned document is printed, this task is much more difficult because many of the distinguishing features of cursive writing aren’t present in printed text.

Fortunately for law enforcement officials, most criminals aren’t that clever, which is something that often becomes evident in written documents, where misspellings are common. Forensic document examiners use these mistakes to their advantage. When suspected writers of forged documents or ransom notes are asked to produce requested samples for comparison, examiners usually ask them to use the same words that were misspelled in the questionable document. More often than not, if a suspect is the author of a questionable document, any misspellings are also seen in the requested writing.

As is true for fingerprints, firearm rifling patterns, and DNA, several handwriting databases exist. The FBI maintains the “National Fraudulent Check File,” the “Bank Robbery Note File,” and the “Anonymous Letter File.” Examiners can compare some questionable documents with these reference files. High-tech files, like the Forensic Information System for Handwriting (FISH), also exist. FISH contains scanned and digitized documents that officials can compare with other similar documents. Forensic document examiners visually check any matches.

Fingering forgers

Forgery typically is defined as writing or altering a document with the intent to defraud. Document examiners may be able to determine whether a document was altered or written by someone other than the stated author, but determining whether the writer’s intent was to defraud is left up to a judge or jury.

Even the most careful and gifted forgers leave behind evidence of their efforts. Examiners inspect documents not only with the naked eye but also view them under a microscope, which often reveals telltale signs of forgery.

Two of the more common methods of forgery are freehand simulation and tracing. Freehand simulation simply means attempting to copy a signature or handwriting sample, and tracing involves placing another document over an original signature and tracing its lines. Each technique leads to various defects in the writing, and an examiner can identify them as the result of forgers writing in a manner that’s unnatural. Perfectly matching someone else’s writing style is not an easy task.

Common clues that reveal forgery include

• Evidence of a previous drawing, which can include an underlying tracing of the words or signature
• Forger’s tremors, which are fine yet distinguishable markings that indicate shakiness in the writing and happen when the forger attempts to copy a signature or writing style
• Uneven writing speed and pen pressure
• Hesitations
• Unusual pen lifts, where the forger continually checks his handiwork
• Patching and retouching, fixing or adding marks
• Blunt beginnings and endings

Another special form of forgery is disguised writing, a deception in which writers attempt to camouflage their own writing. Many ransom notes and threatening letters are written this way in hopes that the author can deny ownership at a later date. Suspects sometimes attempt to disguise their writing when confronted with an incriminating letter they foolishly wrote in their natural handwriting. Check out the earlier section “Obtaining standards” for more information about how criminals try to hide their handwriting.

Wiping away writing

Text that doesn’t suit the criminal’s needs may simply be erased using a rubber eraser, a knife point or other sharp instrument, sandpaper, or even a fingernail — anything that scrapes or rubs away unwanted marks. You often can easily see erasures with the naked eye, but even when alterations aren’t readily apparent, forensic examiners have the following investigative tools at their disposal:

• A simple magnifying glass or a microscope used with oblique (angled) lighting uncovers most erasures.
• Ultraviolet or infrared light may expose tiny fragments of eraser and ink nestled into the fibers of the paper whenever someone uses a rubber eraser.
• Lycopodium powder, when dusted over the page, clings to and exposes tiny rubber particles and eraser fragments that invariably remain after erasures.

Exposing erasures is important because, even if the examiner can’t see the original words or marks, erasures reveal that someone altered the document, which in and of itself may be proof of a crime and render many legal documents null and void.

Eradicating the original

One way to destroy a document is to obliterate the paper on which it’s written. Criminals typically use fire for this purpose. After the paper burns, the writing is lost forever, right? Well, not exactly. If the paper is charred but still intact, reflecting light at various angles off the paper’s surface might expose the contrast between the ink and the charred paper background. The page then can be photographed.

Handling charred pages, however, is extremely difficult because they’re delicate and easily crumble. Spraying them with a solution of polyvinyl acetate in acetone is one way around this problem. Doing so stiffens the paper and makes handling it much easier. Examiners then float the treated pages on a solution of alcohol, chloral hydrate, and glycerin and photograph them. Alternatively, forensic workers sandwich the pages between two photographic plates and place them in a darkroom for two weeks. They then develop the plates, which may reveal the writing.

Criminals sometimes use chemicals, such as oxidizing or bleaching agents, to remove writing. These chemicals react with ink by producing a colorless compound, and the writing disappears. Well, it almost disappears. Using a microscope, an examiner may see remnants of the ink and even a discoloration in the area where the paper was treated.

Using a laser is another modern method of obliterating writing. Although the laser vaporizes the ink, it also burns nearby paper fibers, and the damage shows up under a microscope.

Adding words

Often, a simple obliteration of words or marks doesn’t completely serve the forger’s needs, so further alteration by replacing obliterated words or numbers with others is required. Common examples are changing the amount of a check or the date on a contract or will. Whenever someone obliterates writing before adding changes, an examiner can see the changes in the underlying paper and analyze the new writing by comparing it with the old for differences in technique. Sometimes, the forgery is so well done that a simple inspection doesn’t reveal any changes. Fortunately, the examiner has other tools in his bag of tricks.

Under the microscope, subtle differences between the original and altered portions of the writing may appear. Slight changes in ink color, line thickness, and pen pressure, as well as double lines, often become visible. If the forger used a ballpoint or roller ball pen, distinguishable marks from defects in either type of pen point may show up.

Overwriting is another form of forgery in which the forger doesn’t erase anything but rather adds to or overwrites a portion of a document. Maybe a 1 is changed to a 9, or a 0 is added to a check. If the forger uses the same ink that was used to prepare the original document, these types of changes can be extremely difficult to uncover. But forgers don’t often have access to the pen or ink that was used for the original writing, so they make do with a similar pen and ink color. Careful examination of the differing ink might reveal areas that have been altered.

Although two inks may seem identical under normal light, they usually appear much different when exposed to ultraviolet (UV) or infrared light. Each ink reacts differently to UV light; one may fluoresce, and the other may fade from view. Infrared photography, which basically means photographing the page under a blue-green light with infrared-sensitive film, often clearly distinguishes between two kinds of ink. If these lighting techniques don’t provide any help, the examiner may have to examine the chemical contents of the inks to show that they are indeed different (see the following section).

Distinguishing papers

Most paper is made of wood and cotton and often has chemical additives that affect its opacity, color, brightness, strength, and durability:

• Coatings improve the appearance and surface properties of the paper and make the paper better for copiers, printers, or for writing.
• Fillers add color, strength, and surface texture.
• Sizings make the surface less porous to ink, so that writing and printing appear sharp and clear.

The types and amounts of each of these additives vary among manufacturers and paper types, and chemical testing can distinguish one type and manufacturer from another.

Another distinguishing characteristic of paper is its watermark, which is a translucent design on the paper that you can see by holding the page up to a light. This design indicates the manufacturer, the date of its production, and often for whom the paper was manufactured. Attempts to forge a watermark usually are easy to spot because true watermarks have fewer fibers than the rest of the page. Forged marks, however, actually are added images and thus have an underlying fiber density equal to the rest of the page.

Identifying inks

Sometimes, the key to determining authenticity of a document lies in the ink that the writer used. Inks that appear the same, physically, may be much different, chemically. This distinction helps the examiner determine whether the same ink was used for each page or word of a document and may even help reveal whether a particular ink existed at the time the document supposedly was prepared.

One nondestructive method of ink comparison is called microspectrophotometry (see Chapter 17). This process enables the examiner to accurately determine whether the colors of the two inks match by comparing their light transmission, absorption, and reflection characteristics.

Another method for comparing ink samples is thin-layer chromatography (TLC), which includes following four steps:

1. Very small samples of the inked paper are punched from the written lines using a thin hollow needle.
2. The tiny pieces of paper are placed in a test tube, and a solvent that dissolves the ink is added.
3. A drop of the solvent solution, which now carries the ink, is placed on a paper strip along with drops of several known control inks.
4. The strip is dried and then dipped into another solvent that migrates up the paper strip, dragging the inks along with it.

The distances that all of the inks migrate along the strip are determined by the respective sizes of their molecules. This process separates the inks into bands. Whenever inks from two pages of a questioned document are tested and they yield different bands, the writing on the two pages was done with two distinctly different inks.

An extensive ink reference database is located at the Ink Library, a part of the U.S. Secret Service Forensic Services Division’s Questioned Document Branch. In addition, the U.S. Treasury Department maintains an extensive database of the TLC patterns of commercial inks. In a more recent development, many manufacturers began adding fluorescent-dye tags to their products so that they are easier to identify. And because the tags are changed annually, examiners can readily determine the year that the product was manufactured.

Hunting and pecking for clues

People frequently use typewriters to write threatening letters and ransom and extortion notes. Criminals often are under the mistaken impression that doing so makes the letter untraceable. Not true. When a typewriter is involved, the document examiner tries to

• Determine the make and model of the typewriter
• Match up the note with a suspect typewriter, if one is available

Identifying the make and model means that the examiner must have access to a database of typefaces used in various typewriter models, new and old. Most manufacturers use either pica or elite typefaces, but the size, shape, and style of the letters vary, making identification of the manufacturer and model possible. This greatly narrows the search for the exact machine that produced the document. Unfortunately, typewriters have given way to computers, which connect to printers that may use daisy-wheel, dot-matrix, ink-jet, or laser technologies. These machines vary so little that examiners often can’t distinguish one from another.

To determine whether a particular typewriter produced a questioned document, examiners search for individual characteristics that can include misaligned or damaged letters, abnormal spacing before or after certain letters, and variations in the pressure applied to the page by some letters. For example, certain letters can have telltale nicks or spurs that are imprinted on the page, or they can lean to one side or print slightly higher or lower than the others. These defects can be compared to a sample from a suspect typewriter and thus offer powerful individualizing characteristics.

To compare a typed document to a particular machine, the examiner types a comparison document using that machine. When doing so, the examiner uses a ribbon similar in type and condition to the one used to produce the original document. The reason: A worn or lightly inked ribbon reveals minor defects in the typeface, whereas a heavily inked, new ribbon may obscure them.

Typewriters that use ribbons can help the examiner link the typewriter to the document. If the typewriter has a single-pass ribbon and the same ribbon that was used to type the document still is in place, the police can simply read the message from the ribbon itself. Even if the ribbon has been used for several passes, investigators may be able to retrieve portions of the message.

What if the criminal used the original typewriter to add a line or a paragraph to a document? How does an examiner know when that has happened? Because the typeface would be identical, the examiner may not be able to tell whether an alteration occurred. However, when a page is placed into a typewriter a second time, the alignment often is off, and although it may only be slightly askew, the examiner can place a specially made glass plate with an etched grid pattern over the page. This reveals any imperfection in the alignment of the added lines or paragraphs.

Finding distinctive traits in copies

A copy machine duplicates an image from one page onto another through a complex series of events. First, a lens focuses the image of the original page onto a drum that is charged with static electricity and coated with selenium or another light-sensitive substance. The drum retains the image as it’s bathed with a toner powder that attaches to the surface of the drum in proportion to the strength of the electrostatic charge. This toner image then is transferred to the blank page, which, in turn, is exposed to a fixing agent.

Investigators can sometimes match a photocopied document to a particular copy machine because the mechanisms within the machine that pull the paper onto and remove it from the copy surface can leave marks on the page. Likewise, the cover glass, camera lens, or drum may have scratches or defects that mark every page that it produces. Occasionally, these marks appear on a photocopied page, and investigators can identify and match this marked page to the machine that produced it.