Joint Criminal and Epidemiological
Investigations Handbook
2015 DOMESTIC EDITION
TABLE OF CONTENTS
INTRODUCTION
SUMMARY
Purpose...................................................................................................................................................................................................................................6
The Biological Threat........................................................................................................................................................................................9
Federal Bureau of Investigation (FBI)................................................................................................................................. 10
Centers for Disease Control and Prevention (CDC)..................................................................................... 14
Key Highlights of Introduction Section.......................................................................................................................... 71
Key Highlights of Public Health Section.......................................................................................................................72
Key Highlights of Law Enforcement Section......................................................................................................... 74
Key Highlights of Joint Criminal and Epidemiological
Investigations Model Section......................................................................................................................................................... 76
PUBLIC HEALTH
Epidemiological Investigation Goals..................................................................................................................................20
Epidemiological Investigative Methods........................................................................................................................ 21
LAW ENFORCEMENT
Criminal Investigation Goals............................................................................................................................................................38
Preventing Biological Attacks........................................................................................................................................................39
Criminal Investigative Methods..................................................................................................................................................42
JOINT INVESTIGATIONS MODEL
Introduction................................................................................................................................................................................................................52
Benefits of the Joint Criminal-Epidmiological Investigations Model............................53
The Joint Criminal-Epidemiological Investigations Model: An Overview.............54
●● Building Relationships................................................................................................................................................................ 55
●● Information Sharing....................................................................................................................................................................... 55
●● Joint Threat Assessment........................................................................................................................................................ 60
●● Joint Investigations.........................................................................................................................................................................62
●● Memorandum of Understanding/Joint Protocols....................................................................... 66
●● Joint Training / Exercises........................................................................................................................................................... 67
2
APPENDICES
Sample Joint Criminal-Epidemiological Investigations Material
Appendix 1: Sample Procedure for a Joint Threat Assessment.............................................. 81
Appendix 2: Sample Procedure for Joint Interviews............................................................................... 84
Appendix 3: Sample Joint Interview Questions...............................................................................................92
Reference Material
Appendix 4: List of Select Agents and Toxins (2014)............................................................................... 94
Appendix 5: Laboratory Response Network..........................................................................................................97
Appendix 6: CSTE List of Nationally Notifiable Conditions (2013)..................................100
Appendix 7: HIPAA Privacy Rule & Permitted Disclosures........................................................... 107
Appendix 8: Overview of the FBI’s WMD Coordinators.................................................................... 111
Appendix 9: Bio-Related Laws to Prevent Bioterrorism....................................................................115
Appendix 10: Common Public Health and Law Enforcement Terminology...118
Joint Criminal and Epidemiological Investigations Handbook
3
INTRODUCTION
INTRODUCTION
Purpose
This handbook was developed to facilitate the use of resources and maximize
communication and interaction between law enforcement and public health.
This combined effort can minimize potential barriers prior to and during the
response to a biological threat.
Specifically, this handbook aims to:
●●
Provide an overview of both law enforcement and public health to
enhance the appreciation and understanding of each discipline’s
expertise
●●
Discuss criminal and epidemiological investigational procedures and
methodologies for a response to a biological threat
●●
Identify challenges to sharing information and provide potential
solutions that may be adapted to meet the needs of the various
agencies and jurisdictions
●●
Demonstrate effective law enforcement and public health collaboration
Even with these common concerns, each discipline may be hesitant to share
information because of actual or perceived limitations or barriers. Identifying
and resolving these issues in advance of a biological threat will help facilitate
more effective dialogue and information exchange, thereby increasing the
likelihood of identifying an incident and protecting public health and safety
in a more efficient manner. Simply put, working together helps both law
enforcement and public health achieve their separate but often overlapping
goals and ultimately allows for a more effective and efficient response to a
biological threat.
The 2015 edition of the Criminal and Epidemiological Investigation Handbook
has been updated to reflect current Federal policies and includes modifications
based upon experiences gained since the previous version was published.
Law enforcement and public health are encouraged to read the entire
handbook and not limit their review to just their respective sections.
It is important to take the time to understand the different goals and needs of
each other’s organization before a suspicious biological event occurs. Doing so,
will enable law enforcement and public health personnel to more effectively
respond in a coordinated manner during a biological threat.
While both disciplines have varying objectives and protocols, both public
health and law enforcement ultimately share three common concerns:
6
●●
Early identification of an outbreak
●●
Determining whether the outbreak is intentional or naturally occurring
●●
Protecting public health and public safety
Joint Criminal and Epidemiological Investigations Handbook
7
INTRODUCTION
The Biological Threat
Key Highlights of Introduction Section
●●
There has been a demonstrated interest and
willingness by terrorist groups and individuals to
acquire and employ biological agents at weapons
against the American population.
●●
The intentional release of a biological agent may
initially be difficult to discern from a natural incident,
which can result in separate law enforcement and
public health investigations.
●●
It is in public health and law enforcement’s best
interest to work together when first investigating
a suspicious biological outbreak, which includes
fostering mutual awareness and establishing joint
communication procedures.
●●
By working together, public health and law
enforcement can achieve their separate but often
overlapping objectives of identifying the biological
agent, preventing the spread of the disease, preventing
public panic, and apprehending those responsible.
There has been a demonstrated interest and willingness by terrorist groups
and individuals to acquire and employ biological agents as weapons against
the American population.
Weapons of mass destruction (WMD) terrorism is an evolving threat to U.S.
national security. In his 2010 testimony before the Senate and the House
of Representatives, the Director of National Intelligence stated that terrorist
groups have expressed an interest in obtaining WMD for use in future acts
of terrorism. Indicators of this threat include the 2001 Amerithrax letters, the
possession of WMD-related materials by Aafia Siddiqui in 2008, and multiple
attempts by terrorists at home and abroad to use explosives improvised from
basic chemical precursors.
Over the past few years, there has been an increased interest in extracting
ricin from castor beans, which are readily available to the public, to
intentionally harm others. Ricin is one of the most discussed toxins online,
which includes discussions of criminal plots. In 2011, federal authorities
disrupted a plot by a militia group in Georgia to deploy 10 pounds of ricin
against various federal employee and facility targets. Since 2013, there have
been several incidents involving individuals creating ricin and utilizing the U.S.
Postal System as a delivery system for ricin-laced letters.
Most recently, the ‘Dark Web’ — the virtual black market for drugs, guns,
explosives, and other illicit materials — has shown a growing number of
sellers and buyers of biological material. The FBI has opened investigations on
individuals who have attempted to sell or purchase illicit biological material,
such as ricin and abrin, through the Internet.
Concern that nefarious actors might use biological material as a weapon will likely
remain a persistent threat for years to come, especially as scientific advancements
in technical capability, knowledge, and accessibility continue to grow. Despite
8
Joint Criminal and Epidemiological Investigations Handbook
9
INTRODUCTION
continued efforts in bioterrorism preparedness, the intentional use of biological
agents as a weapon still poses challenges to both law enforcement and public
health due to the unique circumstances of a biological incident. Since biological
agents are often endemic or naturally occurring in the environment, an intentional
release of a pathogen may be initially difficult to discern from a natural event, and
efforts to respond to the attack and apprehend those responsible may be delayed.
In the past, it was common for public health (which conducts epidemiological
investigations to natural incidents) and law enforcement (which conducts
criminal investigations to intentional incidents) to conduct independent
investigations. Due to the challenges posed by a biological threat, an
effective response calls for a high level of cooperation between both
these two disciplines. The lack of mutual awareness and understanding,
as well as the absence of established communication procedures, could
limit the effectiveness of these disciplines’ separate, but often overlapping,
investigations.
During a suspicious biological incident, it is mutually beneficial for public health
and law enforcement to work in partnership. By working together, public health
and law enforcement can more effectively achieve their shared objectives
of identifying the biological agent, preventing the spread of the disease,
preventing public panic, and apprehending those responsible.
Federal Bureau of Investigation (FBI)
The FBI is an intelligence-driven and threat-focused national security
organization with both intelligence and law enforcement responsibilities — the
principal investigative arm of the U.S. Department of Justice and a full member
of the U.S. Intelligence Community. The FBI is vested by law and Presidential
directives as the primary agency of the U.S. Federal Government with the
authority and responsibility to investigate threats to national security, including
biological threats, within the United States and relating to U.S. citizens and
10
interests overseas. Activities of “threat to the national security” commonly
involve violations (or potential violations) of federal criminal laws, such as Title
18, U.S. Code, Section 175 (biological weapons). Hence, investigations of such
threats may exercise both of the FBI’s criminal investigation authority and of the
FBI’s authority to investigate threats to the national security.
Generally acting through the FBI, the Attorney General, in cooperation with
other federal agencies engaged in activities to protect national security,
coordinates the activities of other members of the law enforcement community
to detect, prevent, preempt, and disrupt terrorist attacks against the United
States. The FBI has multiple operational units to provide assistance in the
event of a terrorist attack, including response teams trained to collect and
handle hazardous materials and contaminated evidence. Along with the FBI
Headquarters in Washington, D.C., there are numerous FBI field offices located
in major cities throughout the United States. These field offices implement
national level policy at the local level, where they are able to tailor their
outreach to reflect the particular geographic threats and vulnerabilities unique
to their specific jurisdiction.
There is a common misconception that the FBI prosecutes cases; however, this
is incorrect. The FBI gathers facts and evidence and then presents the results to
the Department of Justice, which is responsible for deciding if an individual will
be brought to trial and if so, conducts the prosecution of the case. Therefore,
during a suspicious biological incident, the FBI would work closely with public
health to investigate whether the outbreak is criminal in nature and if so, gather
evidence to build a case for prosecution of those responsible.
FBI WMD Coordinator
The FBI is headquartered in Washington D.C. The offices and divisions at
FBI Headquarters provide direction and support to 56 field offices in big
cities, approximately 360 smaller offices known as resident agencies, several
Joint Criminal and Epidemiological Investigations Handbook
11
INTRODUCTION
specialized field installations, and more than 60 liaison offices in other countries
known as legal attachés (Figure 1). These offices allow the FBI to interact with
Figure 1. Map of FBI Field Offices and Resident Agencies
local stakeholders and obtain unique geographic knowledge of their area
of responsibility. Each field office has a designated Special Agent, called a
WMD Coordinator, who serves as a WMD subject matter expert and point
of contact for local and state emergency responders and public health.
In the event of a bioterrorism event, the WMD Coordinator would act as a
conduit for obtaining federal assistance (e.g., threat credibility evaluation
and operational response) for local law enforcement. See Appendix 8 for
additional information on WMD Coordinators.
and knowledge of various federal, state, and local law enforcement agencies
to maximize the United States’ collective ability to combat terrorism. Often
memoranda of understanding (MOUs) are developed between participating
law enforcement agencies to assist in determining in advance how law
enforcement agencies can best prevent and respond to a terrorist event. The
National Joint Terrorism Task Force is headquartered in Washington, D.C., and
there are over one hundred area-specific Joint Terrorism Task Forces nationwide
(many located at FBI field offices).
FBI International Efforts
The resources of the FBI are available to assist all law enforcement agencies
throughout the world. FBI resources can be requested through the FBI Legal
Attaché Office. The FBI has Legal Attaché personnel located in almost 70
countries throughout the world. The mission of these Legal Attaché offices is
to foster strategic partnerships with foreign law enforcement, intelligence, and
security services by sharing knowledge, experience, capabilities, and exploring
joint operational opportunities. FBI Special Agents with specific expertise in
WMD matters are located in Tbilisi, Georgia, and Singapore, Singapore. The
FBI also coordinates extensively with INTERPOL and has a Special Agent with
expertise in WMD stationed at the INTERPOL Headquarters in Lyon, France.
FBI Legal Attaché contact information may be found at:
http://www.fbi.gov/contact-us/legat
Joint Terrorism Task Force
In an effort to promote communication and collaboration across the various
law enforcement entities, the United States implements a partnership called
the Joint Terrorism Task Force. These task forces combine the resources
12
Joint Criminal and Epidemiological Investigations Handbook
13
INTRODUCTION
Centers for Disease Control and Prevention (CDC)
The Department of Health and Human Services (HHS) is the United States
government’s principal agency for protecting the health of all Americans and
a leader in promoting activities associated with the medical and public health
response to a biological incident. As an entity of HHS, CDC plays a critical
role in leading the nation’s public health efforts in strengthening capacity
to detect and respond to a biological incident. To carry out these efforts,
CDC conducts critical science and provides health
information that protects the United States against
For public health,
health threats and responds when these arise.
all response is
CDC Global Health Efforts
CDC’s global health programs, research, and training activities improve health
and save lives around the world and protect Americans from diseases and other
health threats that begin overseas. Collaborating with other federal agencies and
with international partners CDC helps other countries build capacity to prevent,
rapidly detect and effectively respond to emerging infectious diseases and
biological threats, whether they occur naturally, are intentionally produced, or are
the result of laboratory accidents.
LOCAL!
The response to a public health emergency, including
an intentional release of a pathogen, is the responsibility
of public health at the state and/or local level. Public health agencies at the
state and local level will likely be the first agencies to recognize cases of illness
associated with a biological threat. Upon recognition of an incident, public
health will initiate an investigation and respond to determine the source
and implement interventions to prevent additional illness. If the state and
local public health agencies need additional resources then they will request
federal assistance.
Since a biological incident can occur in a variety of locations and populations,
the FBI, CDC, and the Association of Public Health Laboratories (APHL)
established the Laboratory Response Network (LRN). The mission of the LRN is
to develop, maintain, and strengthen an integrated national and international
network of laboratories that can respond quickly to needs for rapid testing,
timely notification, and secure reporting of results that are associated
with acts of biological terrorism or other high-consequence public health
emergencies. All LRN member laboratories work under a single operational
plan and adhere to strict policies of safety and security.
14
Joint Criminal and Epidemiological Investigations Handbook
15
PUBLIC HEALTH
PUBLIC HEALTH
Key Highlights of Public Health Section
●●
The ultimate aim of an epidemiological investigation
is to identify the source of the disease and implement
efforts to control the outbreak and protect the public’s
health.
●●
An epidemiological investigation primarily involves
the meticulous accumulation of information from
patient interviews and surveys as well as data
collected from surveillance systems.
●●
18
Goals of an epidemiological investigation include:
»» Stopping the spread of disease (identify causative
agent, determine source, mode of transmission and
population at risk)
»» Protecting the public’s health (surveillance, medical
countermeasures, health education)
»» Protecting public health and other response
personnel (protective equipment and preventive
vaccines/medications)
●●
Important elements of an epidemiological
investigation are:
»» Detect unusual events
»» Confirm diagnosis
»» Identify and characterize additional cases
»» Determine source of exposure
»» Develop and implement interventions
●●
Laboratory analysis of clinical specimens is used to
assist the physician in making a definitive diagnosis.
While most physicians will wait for definitive
laboratory results to confirm a biological threat agent
diagnosis, physicians are likely to begin treatment
before laboratory test results are confirmed since early
treatment of disease increases the probability the
patient will recover from the illness.
●●
A laboratory that tests for biological agents should
meet applicable standards (e.g., quality control
measures, biosafety, and biosecurity) and participate
in relevant proficiency testing.
Joint Criminal and Epidemiological Investigations Handbook
19
PUBLIC HEALTH
Epidemiological Investigation Goals
Epidemiology is the fundamental
science of public health. It is used by
According to the World
epidemiologists to study diseases or
Health Organization (WHO),
events that impact human health in
“Epidemiology is the study of the
distribution and determinants of
order to reduce disease or disability in
health-related states or events
a population. Whether it is in response
(including disease), and the
to a naturally occurring outbreak
application
of this study to the
or a biological threat, public health
control of diseases and other
will conduct an epidemiological
health problems.”
investigation to gather information
that will move investigators toward
determining the source of the disease and the extent of the outbreak. When
conducting an epidemiological investigation for a naturally occurring outbreak or
biological threat, public health has the following basic goals:
20
●●
To stop the spread of disease: One of the most basic missions
of public health is the prevention of illness in the population. While
physicians focus on curing the sick and promoting health in the
individual, public health strives for health promotion and disease
prevention in the entire population. For the illness under investigation,
epidemiologists use interviews, surveys and data analysis to identify
the causative agent, mode of transmission, source of exposure, and
population at risk to limit the spread of the outbreak.
●●
To protect the public: Public health utilizes surveillance of health
trends, medical information, and a variety of analytical tools to establish
methods and implement interventions that protect the public from
health threats. Vaccine campaigns, medical countermeasure distribution
programs, disease surveillance, and health education all play a role in
preventing and responding to serious health emergencies.
●●
To protect public health and other response personnel: A
major consideration during an investigation is the protection of
responders. Since epidemiologists and other responders may come
in contact with potentially infectious individuals, provision of proper
protective equipment and preventive medications or vaccines for
investigative personnel is essential.
Epidemiological Investigative Methods
Public health uses investigative techniques to identify the causative agent and
determine the source and extent of disease outbreaks. An epidemiological
investigation primarily involves the meticulous accumulation of information
from patient interviews and surveys, as well as data collected from
surveillance systems. Since interview or disease surveillance information may
be relevant to a criminal investigation, law enforcement should become
familiar with the elements of an epidemiological investigation.
The following section provides a brief synopsis of the elements of an epidemiological investigation.
Joint Criminal and Epidemiological Investigations Handbook
21
PUBLIC HEALTH
In an epidemiological investigation, the nature of each outbreak and the
availability of personnel and resources will determine the sequence and scope
of the actions that will be performed during the investigation.
Detect
unusual
events
Develop and
nd
implement
nt
interventions
ons
Confirm
diagnosis
Epidemiological
cal
Investigationn
Determine
ne
source of
exposure
re
Identify
additional
cases
Characterize
additional
cases
Figure 2. Elements of an epidemiological investigation.
Detect Unusual Events
The first indication of an unusual event is often an unexpected increase in the
number of people with similar symptoms, referred to as cases. This increase
in cases is detected either by monitoring surveillance systems or receiving
notifiable disease reports from healthcare providers. If an unexpected increase
occurs, public health will begin to collect additional patient information, as
well as further characterize the illness to determine the nature of the incident.
22
Based on the information collected, the incident may be classified as an
infectious disease outbreak and public health would begin an epidemiological
investigation to determine the extent and source of the outbreak.
An outbreak is defined as an occurrence of cases associated with a specific
place or group of people over a given period of time. For example, public
health may determine that 15 cases of E. coli O157:H7 infection were due to
victims having recently consumed unpasteurized apple cider from a local
orchard in the last month. Since all of the cases have an association with the
orchard over a similar period, public health may consider this an outbreak. For
rare or uncommon diseases in the United States (e.g., botulism, SARS), public
health may determine that a single case of the disease constitutes an outbreak
since cases are not normally observed in their jurisdiction.
Case Reporting
All states and territories possess laws that require reporting of specific
infectious diseases by healthcare providers. It is mandatory that reportable
disease cases be reported to state and territorial jurisdictions when identified
by a health provider, hospital, or laboratory. Each state has its own laws and
regulations defining what diseases are reportable and the list varies among
states and over time. In addition, notifiable disease cases are voluntarily
reported to CDC by state and territorial jurisdictions (without direct personal
identifiers) for nationwide aggregation and monitoring of disease data. The
Council of State and Territorial Epidemiologists (CSTE) maintains a list of
diseases that are reportable to the CDC (Appendix 6). States use the CSTE list
of notifiable conditions to create their own reporting laws and may choose to
add other diseases. For additional information on reporting requirements for a
jurisdiction, contact the city, county or state health department.
Joint Criminal and Epidemiological Investigations Handbook
23
PUBLIC HEALTH
While disease case reporting is standard practice for identifying unusual events,
it is a time and resource intensive process that can be adversely impacted
by delays in symptom onset, clinical diagnosis, laboratory testing and results
reporting. Depending on the illness, it may be days or weeks before public
health is notified by a healthcare provider or laboratory of a case report. (See
Figure 3)
Lab Result
Available
Exposure
0--7
Courtesy of New Mexico Department of Health
1--3
Specimen
Received at
Public Health
Laboratory
1--3
1--5
Symptom
Onset
Sample
Collected
Report
Received
Figure 3. A depiction of the typical reporting time from initial exposure to receipt
by public health. Typically, a person is exposed to a pathogen and may experience
symptoms within a few days. After a patient is seen by a physician, specimens are
collected and sent to a clinical laboratory for initial diagnostic testing, results are
provided within a few days. If specimens are positive for a reportable disease, public
health is notified of the case and specimens may be sent
to a public health laboratory for additional testing.
24
Frequent and timely disease reports are critical for detecting outbreaks;
identifying populations or geographic areas at high risk; developing,
implementing, and evaluating prevention strategies; and improving public
health policies.
Surveillance Systems
Public health surveillance is defined as the ongoing collection, analysis, and
interpretation of health data for use in the planning, implementation, and
evaluation of public health practices. Generally, public health tends to rely on
passive methods of disease detection. This may include receiving case reports
from physicians, laboratories, or other individuals or institutions as mandated
by law. However, in the event of an outbreak or other event of public health
concern, more active surveillance techniques may be used, in which public
health will regularly contact reporting sources to obtain information. Any
surveillance system must include the capacity for collecting and analyzing data,
as well as the means to disseminate the data to individuals or groups involved
in disease prevention and control activities.
Ideally, a surveillance system will detect the occurrence of disease within a
sufficient time frame that allows public health to initiate an investigation and
implement timely prevention and control programs, thereby limiting any
impact on the public. For example, early detection of a contagious disease (e.g.,
influenza, measles, and smallpox) allows for implementation of a vaccination
program that would greatly reduce the spread of disease and the number of
people affected.
For incidents involving biological threats, public health will want to decrease
the length of time between exposure and traditional disease reporting. To assist
with this process, some cities and states may utilize a syndromic surveillance
system to track pre-clinical healthcare indicators. Syndromic surveillance is a
Joint Criminal and Epidemiological Investigations Handbook
25
PUBLIC HEALTH
system that relies on existing health data to identify clusters of disease, prior
to clinical diagnosis or laboratory testing, or to look for disease symptoms
that indicate patients are being misdiagnosed. The advantage of syndromic
surveillance is that it may provide initial indication of an outbreak; track the size,
spread, and tempo of an outbreak; monitor disease trends; or provide evidence
that an outbreak has not occurred.2,3 Some healthcare indicators found in
syndromic surveillance systems include:
●●
Number of upper respiratory disease cases seen in emergency
departments
●●
Number of ambulance runs within an allotted period of time
●●
Number of antibiotics or over-the-counter drugs sold at pharmacies
It should be noted that syndromic surveillance is not guaranteed to detect the
occurrence of an outbreak and does not replace other surveillance methods or
direct case reporting to public health. However, it is a useful tool that enhances
collaboration among public health, healthcare providers, information system
professionals, academic investigators, and industry.3 Since many biological
threat agents cause illness with symptoms similar to common ailments,
supporters of syndromic surveillance believe that monitoring and analyzing
healthcare indicator data will allow for rapid detection
of covert biological threats.
Confirm the Diagnosis
Diagnosing the potential disease agent often begins with healthcare providers
obtaining medical histories and conducting physical examinations of affected
individuals. A medical history is the record of medical information gained by
CDC. PHIN Messaging guide for syndromic surveillance: Emergency department, urgent care,
and inpatient settings. HL7 Version 2.5.1. April. 2013
3
Henning, K. Overview of Syndromic Surveillance What is Syndromic Surveillance. MMWR.
September 24, 2004 (Suppl); 5-11.
2
26
a physician during an exam and usually includes information on symptoms,
recent events, travel, or any unusual circumstances that may contribute to
an illness. Based on this information, physicians or public health may request
laboratory tests to confirm the clinical diagnosis. However, physicians are
likely to begin treatment before laboratory test results are available since early
treatment of disease increases the probability the patient will recover from the
illness, especially for biological threat agents.
Laboratory Analysis of Specimens and Samples
Diagnosing an illness by clinical signs
Field Testing:
and symptoms can be imprecise
A
field
assay
test combined with
due to the nature and progression
clinical symptoms might suggest
of the disease, especially for many
that a particular biological agent
biological threat agents, since the
is present, but the field assay test
initial symptoms are similar to common
alone cannot determine with
infectious diseases (e.g., influenza).
absolute certainty that a particular
Therefore, laboratory analysis of
biological agent is or is not
clinical specimens is used to assist
present. The lack of specificity and
the physician in making a definitive
comparably higher detection limits
of these field assay tests make the
diagnosis. Most physicians will wait
use of an approved laboratory
for definitive laboratory results prior to
test critical.
confirming the diagnosis if a biological
threat agent is suspected.
The materials that are typically collected to support a diagnosis or assist with
a public health investigation may be clinical specimens (e.g., tissues, blood,
and sputum) or environmental samples (e.g., food, water, air, dusts, powders,
surface swabs). Some environmental samples may be considered hazardous
materials and require specialized training and equipment for collection.
Joint Criminal and Epidemiological Investigations Handbook
27
PUBLIC HEALTH
Laboratories also vary in their ability to test for biological agents. For example,
forensic laboratories that process criminal evidence may not be equipped to
handle or test specimens containing a biological or chemical threat agent. Until
the public health officials obtain the results from the confirmatory diagnostic
test in an approved laboratory, such as the Laboratory Response Network, the
diagnosis is considered unconfirmed or presumptive.
Identify and Characterize Additional Cases
The process of identifying and characterizing additional cases in an
epidemiological investigation is very similar to that of a law enforcement
investigation. In both disciplines, a generous amount of time and resources is
required to obtain additional investigative information through interviews with
cases and other contacts.
Laboratory Response Network
The FBI, CDC, and the Association of
Public Health Laboratories (APHL)
Due to their expertise and
established the Laboratory Response
proficiency, only LRN facilities
should be used to test clinical
Network (LRN) in 1999. The LRN is
specimens or environmental
a network of laboratories located
samples for the presence of
across the country that possess the
biological
or chemical threat
expertise to conduct appropriate
agents.
Law
enforcement agents
analyses with approved equipment,
should contact their local FBI
qualified personnel, validated
WMD Coordinator to determine
assays, and accepted practices. LRN
the location and procedures
laboratories meet certain standards
for submitting samples to the
and continue to demonstrate their
nearest LRN facility.
readiness through proficiency tests
that validate their ability to correctly
identify biological and chemical threat agents. Sending a specimen to a
non-LRN laboratory could dramatically delay the investigation and may
destroy material required to confirm the agent’s identity and properly
diagnose the causative agent of an illness. Additional information on the
Laboratory Response Network is located in Appendix 5.
The first confirmed case of an outbreak is referred to as the index case. To
prevent further impact and to try and find the source of the disease, there is
a need to identify new, unreported or unrecognized cases and their contacts.
In the search for additional cases, public health will interview family members,
associates, co-workers, and other possible contacts of the index case. These
interviews require extensive time and personnel commitments. Interviewees
may be contacted multiple times as the investigation proceeds if there is a
need to obtain additional information. Information collected by public health
can include the following:
28
●●
Demographic data (name, address, age, race, ethnicity, gender)
●●
Clinical data (signs and symptoms, duration, onset)
●●
Exposure history (travel, meals, and significant events; all based on the
type of illness suspected)
●●
Case contacts and knowledge of other cases
Joint Criminal and Epidemiological Investigations Handbook
29
PUBLIC HEALTH
EPI CURVE: Multistate Outbreak of E. coli O157:H7 Infection
Multi-State Outreach of E. coli 0157:H7 Infection
In addition to interviewing the index case and contacts, public health will
attempt to identify additional cases by using a set of uniformed criteria, called
a case definition. Public health provides the case definition to physicians,
hospitals, and other health officials to identify any additional cases that may be
related to the outbreak, both within and outside their jurisdiction.
Number of Cases
8
Public health may also solicit assistance from the media in trying to identify
additional cases. For example, public health may work with the media to inform
the public that anyone with a certain type of symptom (e.g., skin rash, fever)
may have been exposed to a biological agent and should report to a physician
for an examination. Once additional cases have been identified, public health
will collect information on each one to determine whether their illness could be
associated with the outbreak.
Determine the Source of Exposure
Once the case/contact interview information has been collected, it is analyzed
to identify common exposures and, ultimately, to suggest the source of illness.
This process is known as descriptive epidemiology.
An example of descriptive epidemiology is the creation of a histogram (a bar
graph that estimates a probability distribution) in which the number of disease
cases are plotted by date or time of onset in order to visualize the progression
of the outbreak. This bar graph, called an epidemic curve or epi curve, provides
a visual representation of an outbreak’s magnitude over a specific time period
and can provide critical clues regarding the outbreak’s onset and duration.
(See Figure 4)
5
4
4
4
3
2
3
2
1
1
12 14 16 18 20 22 24 26 28 30 2 4
JUNE
JULY
1
6
8 10 12 14 16 18 20
Date of Onset
Figure 4. The Epi Curve. 4 This is a diagram of the number of cases of E.coli 0157:H7
infection that were associated with this outbreak and date of occurrence. This
graph, known as an epi curve, helps public health determine the source and
spread of an outbreak.
Once the descriptive epidemiology has been reviewed, public health will try to
develop a “best guess” for the source(s) of illness. This best, or informed, guess
is known as a hypothesis. For example, if multiple cases shared an exposure,
such as attending the same organized event, then public health may develop a
hypothesis that the common event is the source of disease.
During an epidemiological investigation, public health may develop several
hypotheses about the cause of the outbreak as they accumulate additional
clinical, laboratory, and investigative information. To determine whether a
Stehr-Green J. (2002) Multistate Outbreak of E.coli 0157:H7 Infection. Instructor’s Version.
Retrieved from http://www.cdc.gov/epicasestudies/downloads/ecolii.pdf
4
30
Joint Criminal and Epidemiological Investigations Handbook
31
PUBLIC HEALTH
hypothesis is correct, public health conducts a statistical analysis or study of
data obtained using a standardized survey instrument or questionnaire. This
process is known as analytical epidemiology. The statistical analysis provides
public health with mathematical evidence to confirm or reject a hypothesis.
If the analysis confirms a hypothesis then public health will develop and
implement an intervention to prevent people from becoming ill. If a hypothesis
is rejected by the analysis, then public health will develop a new hypothesis
and continue to search for more cases in order to obtain additional information.
Develop and Implement Interventions
The ultimate aim of an epidemiological investigation is to identify the source
of the disease and implement a plan to control the outbreak and protect the
public’s health. Often there is a need to develop and implement an intervention
before the disease agent has been confirmed in order to ensure a successful
intervention. Many illnesses, including those caused by biological threat agents,
can be treated successfully if antibiotics or antivirals are provided early in the
course of the illness. Also, quarantine (restricting movement of healthy people
who may have been exposed to a contagious disease) or isolation (separating ill
persons who have a contagious disease from those who are healthy) measures
may be used to control spread of a contagious disease; however, these
measures must be implemented early in an outbreak to be effective. Some
control measures may be directed at the environment to remove the source
(e.g., insects, contaminated food) of transmission.
Therefore, in the case of bioterrorism, interventions are often initiated based on
the suspicion of disease rather than waiting for confirmation. Early suspicion,
coordinated with law enforcement intelligence, can help public health
intervene as quickly as possible and save lives.
32
Joint Criminal and Epidemiological Investigations Handbook
33
LAW ENFORCEMENT
LAW ENFORCEMENT
Key Highlights of Law Enforcement Section
●●
●●
●●
36
●●
Once there is suspicion that a crime has occurred,
chain of custody procedures should be implemented
by both law enforcement and public health to ensure
accountability of evidence. Failure to properly maintain
the chain of custody may render evidence unusable
at trial.
●●
In certain situations the environment might
be contaminated; therefore, it is useful to have
specially trained law enforcement teams to handle
apprehension of the suspect and collection of
evidence in contaminated environments.
●●
The need for rapid collection and testing to save lives
outweighs normal evidence collection procedures.
Primary goals of a criminal investigation for a
biological threat are:
»»
To protect the health and safety of the public
»»
To prevent subsequent attacks
»»
To identify, apprehend, and prosecute the
perpetrators
»»
To protect law enforcement personnel
If public health and law enforcement have established
a working relationship prior to a biological threat
incident, public health may feel more comfortable
contacting law enforcement early in their
investigation.
Law enforcement should include various subject
matter experts, such as public health, to assist in
determining the credibility of a biological threat.
Joint Criminal and Epidemiological Investigations Handbook
37
LAW ENFORCEMENT
Criminal Investigation Goals
Preventing Biological Attacks
During a biological threat incident, law enforcement has the following basic
goals:
The first step in preventing a biological attack is to attempt to identify potential
terrorists or terrorist organizations that are both capable of and have intent to
execute a biological attack. This process allows FBI and other law enforcement
officials to identify potential targets and possible modes of attack. Despite all
efforts, a biological attack may not be prevented. Therefore, appropriate law
enforcement agencies must be prepared to respond to an incident either while it
is occurring or after it has perpetrated. Since soft targets are often more appealing
than solid or more stable targets, a country’s strong response capability to a
biological attack might be a deterrent for terrorists choosing a pathogen as their
method of attack.
●●
To prevent a criminal act and subsequent attacks: Through
ongoing surveillance, investigation, and intelligence-gathering
techniques, law enforcement personnel work to gather information
to identify potential terrorists, their targets, and methods of attack
before an attack takes place, or to prevent subsequent attacks from
being carried out.
●●
To identify, apprehend, and prosecute the perpetrators: Once
a biological attack occurs, law enforcement gathers evidence and
information to identify and apprehend the individual(s) responsible
for the crime. Collection of evidence includes interviewing victims
and witnesses as well as obtaining and preserving physical
evidence. A criminal investigation is not complete until there is a
successful prosecution and conviction of those responsible for the
biological attack.
●●
38
To protect law enforcement personnel: Law enforcement
personnel, including FBI agents, are likely to encounter situations
where they may be at risk for exposure to a biological agent. Since
some biological agents can be both infectious (can infect a person)
and contagious (can spread from person to person), provision of
proper personal protective equipment (PPE) and other preventive
medications or vaccines for law enforcement personnel is essential.
FBI WMD Threat Credibility Evaluation — Real or Hoax
FBI/law enforcement personnel may be confronted with a number of situations
involving the actual or threatened use of a biological agent as a weapon.
These situations may include non-credible threats (hoaxes), announcements
or indications that a release of a biological agent has occurred (overt), or
unannounced releases of a biological agent (covert).
During a covert event, the public health and medical community will likely be
first to identify an occurrence of a bioterrorism incident as patients seeking
treatment for an unexplained illness can often be a first indication of an attack.
As soon as public health suspects an intentional event or is confronted with a
case of illness caused by an agent or toxin of concern, they should notify law
enforcement to determine the likelihood of a biological attack. If public health
and law enforcement have established a working relationship prior to the
occurrence of a bioterrorism incident, public health may feel more comfortable
contacting their law enforcement counterparts early in the investigation,
allowing for a more rapid initiation of the threat evaluation process.
Joint Criminal and Epidemiological Investigations Handbook
39
All situations involving the intentional use of a biological agent require an FBIled threat credibility evaluation. In some jurisdictions, a local threat assessment
may support the FBI threat credibility evaluation. Upon notification of a
WMD threat or incident (e.g., an overt release such as a white powder letter
accompanied by a threat), state and local law enforcement or emergency
responders will contact their FBI WMD Coordinator to initiate the threat
credibility evaluation process. The WMD Coordinator will then contact FBI
Headquarters Weapons of Mass Destruction Directorate, which is responsible
for convening a conference call to support the evaluation. A threat credibility
evaluation should consist of three factors, plus an assessment of available
intelligence and/or case information to determine the credibility of a threat:
40
●●
Technical Feasibility: Does the threat require technical expertise; if so,
are those involved technically competent? (Will it work?)
●●
Operational Practicality: Does the operation that is used to carry out
the threat seem practical? (Can it be done?)
●●
Adversarial Intent: Does the person display the behavioral resolve to
carry out the operation? (Would the person do it?)
redibility Evalua
C
t
ti
rea
on
During an overt biological threat, such as a “threat letter” or another
announcement indicating the release of a biological agent, law enforcement
will likely be the first to identify the incident since the threat would be reported
to law enforcement before illness occurred. Even without the presences of a
biological agent, hoaxes, can be a very effective way for perpetrators to cause
fear since biological agents require an incubation time before symptoms
develop, essentially causing the public to fear the unknown.
Th
LAW ENFORCEMENT
Technical
Feasibility
Adversarial
Intent
Operational
Practicality
Intel
Figure 5. Threat Credibility Evaluation. When a threat is made, FBI may conduct a
threat credibility evaluation to determine how credible the threat is and what further
action should be taken to mitigate the threat.
During the course of the threat credibility evaluation, the FBI WMD Directorate
may contact various partners and subject matter experts (e.g., CDC or United
States Department of Agriculture) to assist in determining the threat credibility.
If the threat is deemed credible, the FBI WMD Coordinator, along with state
and local responders, will consult with FBI Headquarter assets to determine the
next course of action, specifically regarding how to best collect and analyze the
evidence, including environmental samples and other evidence. Additionally,
the FBI Strategic Information and Operations Center (SIOC) will notify the DHS
National Operations Center (NOC) immediately.
If the threat is deemed non-credible, FBI may initiate an investigation to
identify and prosecute those responsible for creating the perception that there
was a threat (i.e., a hoax). Under federal law (18 U.S.C. 2332a and 18 U.S.C. 175),
a threat involving a disease-causing organism is a criminal act, whether or not
the perpetrator actually possesses the biological agent.
Joint Criminal and Epidemiological Investigations Handbook
41
LAW ENFORCEMENT
Criminal Investigative Methods
FBI/law enforcement personnel conducting criminal investigations must
operate within the applicable laws governing the investigations and the
ensuing prosecution. As information is collected, it is necessary for law
enforcement to develop a thorough understanding of the investigation and
the unique circumstances of the case. This will help law enforcement to identify
any missing or weak evidence, which may impact the ability to apprehend,
prosecute, and convict the individual(s) responsible for committing the crime. A
brief summary of criminal investigative methods is provided below. While some
aspects of a criminal investigation may occur sequentially, they can also take
place simultaneously.
Gather Evidence
The process of gathering evidence during the criminal investigation of a
potential biological threat will involve collection of physical evidence (e.g.,
dissemination devices, clothing of victims and suspects), clinical specimens
(e.g., blood or other bodily secretions), documents, photographs, and witness
statements. Law enforcement must consider a variety of issues to ensure that
any evidence they gather can ultimately be used in a criminal prosecution.
The list below provides a summary of some of the key issues law enforcement
must consider when gathering evidence.
●●
Chain of Custody: Chain of custody is an issue of significant concern
during a criminal investigation. Both law enforcement and public
health personnel must provide accountability at each stage of
collection, handling, testing, storing, transporting the evidentiary
items, and reporting any test results. Failure to properly maintain
the chain of custody may render the evidence unusable at trial if law
enforcement is not able to unequivocally state where the evidence
was located and who had access during the time the evidence was in
custody. Responders should implement formalized chain of custody
procedures once there is suspicion that a crime has occurred.
●●
Delivery of Biological Samples to the LRN: Only laboratories
within the Laboratory Response Network (LRN) should be used to
test for biological agents. Submitting evidentiary biological samples
to a non-approved laboratory will not only delay proper analyses, but
may result in unintentional contamination of the samples and may be
used to create doubt about the validity of test results in court. The FBI
WMD Coordinators maintain a list of LRN laboratories within their field
office’s area of responsibility. See Appendix 5 for further information
about the LRN.
Gather
Evidence
Provide
Testimony
Criminal
Investigation
Evaluate
Evidence
Apprehend
Suspects
Figure 6. Elements of a criminal investigation.
42
Joint Criminal and Epidemiological Investigations Handbook
43
LAW ENFORCEMENT
●●
Documents: Original documents should be obtained by law
enforcement when possible. Issues of authenticity and admissibility as
evidence arise if copies are relied upon when original documents are
available given that a copy could have been modified from the original.5
Example documents that law enforcement might gather as evidence
include laboratory results or financial statements.
●●
Witness Statements: Witness descriptions of dissemination devices,
vehicles, suspects, odors, tastes, sounds, and other specific information
must be obtained as soon as possible following a potential pathogen
release. Witness information is time sensitive and the sooner the
information can be obtained, evaluated, and disseminated to other
investigators, the more value it adds to the investigation. As time passes,
a witness’s memory can fade or become influenced by the opinion of
other individuals.
During an investigation of a biological threat, law enforcement may need
to decide between collecting evidence for public safety or for criminal
prosecution. There may be an overriding need by authorities to identify the
agents or materials as soon as possible to ensure that the proper response is
implemented and steps are taken to protect the responders and the public. In
this instance, the need for rapid collection and testing to save lives outweighs
normal evidence collection procedures.
Evaluate Evidence
Similar to other criminal investigations, in the event a pathogen is intentionally
released, an investigator may be unaware of what is and is not a critical
piece of evidence that will be needed to identify, arrest, and convict those
responsible for the criminal act. As evidence is collected, an ongoing evaluation
of the evidence must be part of the investigative process. An understanding
of evidence types and the rules governing its admissibility will lead to better
evaluation as the criminal investigation progresses. While not intended to be
all-inclusive, Table 1 identifies and provides a brief explanation of some types of
evidence collected during a criminal investigation.
Table 1. Types of Evidence Collected During an Investigative Process
Type 0f
Evidence
Explanation
Example
Direct
Documents, records, physical evidence, notes,
computer data, videotapes, or other types of
information that directly relate to the case.
Vehicle rental agreements, purchase receipts,
phone records, eyewitness statements,
dissemination devices.
Circumstantial
Facts, if proven, that allow the investigator
to draw conclusions. Circumstantial evidence
often has the same probative or substantiating
value as direct evidence.
Suspect was treated for cutaneous anthrax at
or about the same time a release of anthrax
was attempted.
Very small particles of matter that can
be examined microscopically, physically,
and/or chemically.
Biological agent residue, fingerprints, DNA,
biological properties of the agent.
Statements offered to prove the truth of the
matter asserted; the person who made the
statement is unavailable for cross-examination.
A statement taken from a third party who
heard another person describe seeing the
suspect spray a substance during the time in
question.
Observation or sensation personally seen,
smelled, heard, felt, or tasted.
Witness reported smelling a particular odor,
hearing a specific sound, or seeing someone.
Trace
Hearsay
Eyewitness
Testimony
Potentially contaminated documents should be stored and examined utilizing procedures which
protect both the individuals handling the evidence and the evidence itself.
5
44
Joint Criminal and Epidemiological Investigations Handbook
45
LAW ENFORCEMENT
Generally, law enforcement should be accustomed to receiving results
quickly when the event is significant, such as a death or high profile crime.
Since evidence collected in a potentially contaminated environment must
be assumed to be contaminated, this significantly complicates the evidence
review and evaluation process. The FBI has specially trained teams to handle
the collection of evidence in contaminated WMD environments. There are 24
fully operational Hazardous Evidence Response Teams that provide coverage
of the FBI field offices, as well as specially trained FBI personnel, such as
microbiologists and other scientists, trained to collect contaminated evidence.
Following a biological attack, the FBI will have the collected evidence analyzed
in a laboratory to support and guide their investigation. As mentioned before,
only laboratories approved to handle biological evidence, such as those in the
Laboratory Response Network, may accept samples.
From the beginning of a criminal investigation for a biological threat and
until the case is submitted to a jury for a verdict, all facts collected during
the investigation must be verified and inconsistencies resolved. Documents
must be carefully reviewed to ensure they have been thoroughly analyzed
and interpreted correctly. Sometimes information contained in statements or
reports is subject to differing interpretations. Law enforcement investigators
must examine the evidence for conflicting interpretations and resolve these
issues, or be prepared to explain the contradictions to the prosecutor.
Apprehend Suspect(s)
Once the threat to public health and safety has been eliminated, the top
priority for law enforcement is the apprehension and prosecution of those
responsible for the attack. During the apprehension of a suspect or group
of suspects, law enforcement involved in the arrest must take precaution
against possible injury from the perpetrator(s). It is also possible that the
arresting officers will be confronted with either a contaminated environment
or contaminated evidence. Therefore, appropriate PPE and a decontamination
process must be utilized to prevent contamination by a biological agent. While
apprehending the suspects is a goal of the criminal investigation, the safety of
the arrest team and the general public is paramount.
Provide Testimony
Each law enforcement investigator involved in the case and potential witness
should be available to meet with the prosecutor before he or she testifies at
trial. It is important for the prosecutor to have the opportunity to evaluate each
investigator and witness and his or her statements before appearing in front of
a jury. During this time, any issues, problems, discrepancies, or gaps in evidence
or testimony can be discussed and resolved.
Once evidence has been collected and analyzed, it is important to submit all
materials (e.g., statements, laboratory reports, documents, photographs) to
the prosecutor in an organized manner to ensure all the facts are identified
before the trial. Sufficient time should be allowed to permit the prosecutor to
meet with the investigators and witnesses to review all reports, evidence, and
anticipated testimony.
46
Joint Criminal and Epidemiological Investigations Handbook
47
JOINT INVESTIGATIONS
JOINT INVESTIGATIONS
Key Highlights of Joint Criminal and
Epidemiological Investigations Model Section
●●
●●
●●
50
●●
A joint threat assessment, which utilizes the unique
expertise of both disciplines, can help determine
more quickly the nature of the incident (intentional or
natural) and lead to a more appropriate response to
the threat.
●●
A joint investigation can maximize the efficiency for
both law enforcement and public health in the event
of a biological threat through the exchange of realtime investigative information.
●●
MOU/joint protocols between law enforcement and
public health are critical in determining roles and
responsibilities prior to an event occurring and help
ensure consistent practices between the disciplines
during a response. Important information to include
in MOU/joint protocols include: information sharing
triggers, joint threat assessments, joint investigations,
joint interviews, and methods for sharing investigative
results.
●●
Joint training and exercises are important elements of
the Joint Criminal-Epidemiological Investigations Model
since they allow public health and law enforcement
to test, evaluate and refine their protocols. Amending
protocols to reflect lessons learned from an exercise is
particularly important to ensure best practices evolve
and are strengthened over time.
The Joint Criminal-Epidemiological Investigations
Model is made up of six
strategic elements.
»»
Building Relationships
»»
Information Sharing
»»
Joint Threat Assessment
»»
Joint Investigation
»»
Memorandum of Understanding/Joint Protocols
»»
Joint Training/Exercises
Benefits to conducting joint investigations:
»»
Law enforcement has access to public health
experts who understand disease epidemiology and
can provide relevant medical information.
»»
Public health has access to law enforcement case
information which could assist in identifying the
source of exposure and containing an outbreak.
The timely exchange of information in the early stages
of a response is critical. Both disciplines have access
to unique information that could help to prevent or
detect a biological threat.
Joint Criminal and Epidemiological Investigations Handbook
51
JOINT INVESTIGATIONS
Introduction
Collaboration between law
The Joint Criminal-Epidemiological
enforcement and public health
Investigations Model highlights
has not always been recognized as
several practices and procedures
beneficial. In the past, it was common
that can be used by public health
for law enforcement and public health
and law enforcement to increase
to conduct separate and independent
collaboration and partnership.
investigations during the response
to a suspicious biological incident.
However, following the 2001 anthrax mailings, a mechanism for increasing
cooperation and coordination between law enforcement and public health was
developed: Joint Criminal-Epidemiological Investigations Model. This model is
not solely limited to the investigative process; rather, it incorporates a number
of procedures and methodologies that require interaction between law
enforcement and public health prior to the detection of a biological threat
and through its resulting investigation.
The Joint Criminal-Epidemiological Investigations Model
is composed of six elements:
Building
Relationships
Information
Sharing
Joint Threat
Assessment
Joint
Investigation
Memorandum of
Understanding / Joint
Protocols
Joint Training /
Exercises
Benefits of the Joint Criminal-Epidmiological
Investigations Model
Public health and law enforcement share a set of common goals during the
response to a biological threat, including:
Protecting
the
Public
Preventing /
Stopping
the Spread
of Disease
Identifying
Those
Responsible
Preventing
Future
Attacks
Figure 8. Common goals shared between public health and law enforcement
during a response to a biological threat.
The Joint Criminal-Epidemiological Investigations Model allows law
enforcement and public health to achieve their common goals by
enabling a more efficient response to a biological threat, resulting in earlier
detection of an attack, identification of a source, and implementation of
interventions, thereby mitigating the effects of the outbreak. Additionally,
this model highlights the need to combine the investigative efforts of law
enforcement and public health, which minimizes potential discrepancies
between investigators and maximizes the opportunities to identify,
apprehend, prosecute and convict the perpetrator of the attack.
Figure 7. Elements of a Joint Criminal-Epidemiological Investigations Model.
52
Joint Criminal and Epidemiological Investigations Handbook
53
JOINT INVESTIGATIONS
Law Enforcement Benefits
When operating under the Joint Criminal-Epidemiological Investigations
Model, law enforcement personnel have:
●●
Access to experts who understand disease epidemiology (e.g.,
symptoms, diagnosis, possible causes)
●●
Access to relevant public health/medical information (e.g., results
of the epidemiological investigation that may inform the criminal
investigation)
Public Health Benefits
When operating under the Joint Criminal-Epidemiological Investigations
Model, public health officials have:
●●
Access to law enforcement case information that may help to determine
the source of the illness
●●
Assistance in containing the outbreak from law enforcement (who
can help identify information that may lead to apprehending the
perpetrator, thus preventing future releases, exposure and illness)
The Joint Criminal-Epidemiological Investigations Model:
An Overview
Generally, law enforcement and public health may exchange information
once they confirm the existence of a criminal act or an outbreak. However,
waiting until a crime or outbreak has been confirmed is too late. For an
effective response to biological threats, public health and law enforcement
need to share information prior to the confirmation that an intentional
incident has occurred. The timely exchange of information in the early stages
of a response is critical to containing the outbreak and apprehending the
perpetrators. Therefore, the Joint Criminal-Epidemiological Investigations
54
Model begins with the identification of public health and law enforcement
contacts prior to an incident.
Building Relationships
The purpose of identifying contacts prior to an incident is to initiate dialogue
between the disciplines in order to build a working relationship. Strong
personal ties between law enforcement and public health tend to foster
increased information exchange. Many of the barriers believed to prevent
collaboration between public health and law enforcement can be overcome
by developing an understanding of each other’s roles/responsibilities
and information needs and sensitivities. Over time, public health and law
enforcement contacts become more familiar with each other and trust is
gained, ensuring that information can be shared and properly protected.
Information Sharing
Both disciplines have access to unique information that may be important to
share in order to prevent or detect a biological threat. Since neither agency will
likely possess all the necessary data for a response, information sharing is an
essential part of public health and law enforcement collaboration.
Law Enforcement
Public Health
●●
Terror Groups / Organizations
●●
Case Reports / Outbreaks
●●
Threats
●●
Laboratory Tests
●●
Intelligence
●●
Epidemiological Information
●●
Victim Information
●●
Patient Information
Figure 9. Information that is unique to law enforcement and public health that, if
shared, could be beneficial to both a criminal and epidemiological investigation.
Joint Criminal and Epidemiological Investigations Handbook
55
JOINT INVESTIGATIONS
Public health and law enforcement officials are encouraged to notify and
involve each other early in a potential investigation of a biological threat, even
if it turns out to be a non-criminal event. The establishment of pre-incident
communication mechanisms is essential for the expeditious exchange of
information during an actual incident. This exchange of information requires
law enforcement and public health personnel to be familiar with one another,
and to know who should receive the information.
Information Sharing Challenges
There are challenges to sharing information between public health and law
enforcement. The challenges are both perceived and real, and should be
addressed before both disciplines can legally and safely share information and
conduct joint investigations.
Public Health Challenges
Due to the Health Insurance Portability and Accountability Act (HIPAA) and
applicable state privacy laws, a common potential challenge for public health
is concern regarding legal liability for the release of patient health information
without the patient’s consent. Challenges arise when law enforcement requires
access to “protected health information” as potential evidence of a crime from
patient health records, which are maintained by public health, healthcare
providers, health plans (health maintenance organizations, Medicare), or health
care clearinghouses. However, as covered below, there are exceptions that
allow law enforcement access to protected health information.
Another potential challenge regarding the exchange of patient information
is issues of ethics and trust. Patients often provide detailed personal
information to physicians and public health with the tacit understanding
that their information will not be disclosed. Public health may be concerned
56
that providing confidential patient information to the law enforcement
community, regardless of reason or intent, jeopardizes their future ability
to obtain data critical to identifying an outbreak source and implementing
effective control measures.
Law Enforcement Challenges
Law enforcement may also have concerns regarding the exchange of
investigative information. For any criminal investigation, the more people with
access to sensitive information, the more opportunities exist for inadvertent
disclosure. Furthermore, the inadvertent release of sensitive information
could jeopardize the safety of confidential informants or classified sources by
allowing the suspects to directly identify law enforcement’s source. As a result,
suspected perpetrators may receive the advanced warning needed to facilitate
the destruction of evidence, possibly avoid detection, and potentially affect a
successful prosecution of the perpetrator(s).
Legal Issues Related to Information Sharing
Each agency’s legal counsel is encouraged to evaluate federal, state, and local
laws and regulations to determine ways to share information. A review of the
applicable federal and state statutes should be conducted to determine the
actual limitations and the exceptions that may exist, which allow the exchange
of information between public health and law enforcement. For example,
HIPAA prevents an individual’s health information from being released without
that individual’s consent; however, there are specific exemptions in HIPAA
that allow for the release of patient medical information to public health
officials and law enforcement. One exemption relevant to a law enforcement
investigation is often identified as the “imminent threat exemption.” According
to this exemption:
Joint Criminal and Epidemiological Investigations Handbook
57
JOINT INVESTIGATIONS
“A covered entity may, consistent with applicable law and standards of ethical
conduct, use or disclose protected health information, if the covered entity, in
good faith, believes the use or disclosure is necessary to prevent or lessen a
serious and imminent threat to the health or safety of a person or the public
and the disclosure is made to a person reasonably able to prevent or lessen the
threat (See 45 CFR 164.512 (j)(1)(i)).
Additionally, HIPAA requirements may be waived in certain circumstances. For
example, in the event of 1) an emergency declared by the President and 2) a
Public Health Emergency declaration by the Secretary of the HHS, the Secretary
of HHS may waive certain HIPAA requirements under Section 1135 of the Social
Security Act (42 U.S.C. § 1320b–5). Once both declarations are issued, covered
entities may then request an 1135 waiver from the Secretary, which may allow
for the disclosure of protected health information.
The legal basis for allowing patient medical information to be shared with
law enforcement should be researched and incorporated into a MOU/
joint protocol so all entities are properly informed and can comply with the
legal requirements for sharing information. See Appendix 7 for additional
information on the HIPAA law enforcement exemption.
Information Sharing Triggers
During a biological threat, certain information or a specific event should trigger
the exchange of information between law enforcement and public health.
For example, law enforcement conducts criminal investigations every day,
and in recent years, there have been numerous hoaxes involving biological
incidents. Therefore, what should prompt the law enforcement community to
contact public health and involve them in the investigation of such an incident?
Similarly, epidemiological investigations routinely take place; most outbreaks
not caused by an intentional act. At what point during an epidemiological
investigation should public health be prompted to contact law enforcement?
Many factors could provide clues to potential biological threats. The difficulty
of trying to use definitive criteria is that almost all infections produce initial
symptoms that are non-descript and may be misdiagnosed as another disease.
Furthermore, many biological threat agents cause rare or non-endemic
diseases, often with unknown or poorly characterized etiology. As a result,
physicians may not recognize the disease until it has progressed to its more
serious and unique symptoms. In these cases, there may be a reluctance to
report this “unknown” illness until a definitive diagnosis is determined.
The following tables provide a preliminary list of factors that could trigger
public health (Table 2) or law enforcement (Table 3) to share information. These
tables are not intended to be all-inclusive. Law enforcement and public health
may want to add or remove triggers to suit their individual needs.
Table 2. Public Health Triggers
●● Any specimens (clinical) or samples (environmental) submitted to public health for analysis that test positive for a
potential biological threat-related agent
●● Large numbers of patients with similar symptoms or disease
●● Large numbers of unexplained symptoms, diseases, or deaths
●● Disease with an unusual geographic or seasonal distribution (e.g., plague in a non-endemic area)
●● Unusual disease presentation (e.g.., inhalational vs. cutaneous anthrax)
●● Endemic disease with unexplained increase in incidence (e.g., tularemia, plague)
●● Higher than expected morbidity and mortality associated with a common disease and/or failure of patients to respond
to traditional therapy
●● Unusual “typical patient” distribution (i.e., several adults with an unexplained rash)
●● Death or illness in humans preceded or accompanied by death or illness in animals that is unexplained or attributed to
a zoonotic biological agent
58
Joint Criminal and Epidemiological Investigations Handbook
59
JOINT INVESTIGATIONS
Table 3. Law Enforcement Triggers
●● Any intelligence or indication that any individual or group is unlawfully in possession of any biological agent
●● Seizure of bio-processing equipment from any individual, group, or organization
●● Seizure of potential dissemination devices from any individual, group, or organization
●● Identification or seizure of literature pertaining to the development or dissemination of biological agents
●● Any assessments that indicate a credible biological threat exists in an area
●● A HAZMAT response that involves the presence of biological agents
The identification of law enforcement and public health triggers is intended
to be a starting point to improve information sharing between agencies
or jurisdictions. The most important aspect of this process is to overcome
the hesitation or reluctance to share information before all of the facts
are known. Early notification provides an early warning and should not be
viewed negatively.
Joint Threat Assessment
To complement and support the threat credibility evaluation process coordinated
by the FBI WMD Directorate, it is recommended that local FBI field offices, local
law enforcement, and public health establish protocols for conducting a local
joint threat assessment. Determining the nature of a reported incident (i.e., natural
or intentional) and implementing appropriate response activities requires a joint
assessment by law enforcement and public health.
A joint threat assessment can be conducted in person (on the scene of an
event) or over the phone (conference call). The outcome of the joint threat
assessment is to determine the nature of the threat (i.e., credible or not
credible). A threat is deemed a “credible threat” if it is determined that potential
for a real threat does exist. In the U.S., a threat may also be deemed credible
60
if there is intent to cause terror even though no pathogen is used (e.g., an
articulated threat in a mailed letter, which contains an unknown substance).
To complement and support the information sharing process, law enforcement
and public health should establish protocols for conducting a joint threat
assessment prior to an event. Determining the nature of a reported incident
(i.e., natural or intentional) and implementing appropriate response activities
requires a joint assessment by law enforcement and public health.
A joint threat assessment can be conducted when either discipline identifies
a defined trigger. During the threat assessment, public health and law
enforcement will possess critical information that should be shared so that
the participants can make an informed decision regarding the nature of the
incident and appropriate follow-up activities. Once all available information has
been shared, law enforcement and public health should classify the incident
into one of three risk categories:
●●
No Threat: Highly likely the source of exposure occurred naturally (not
intentional)
●●
Possible Biological Threat: Information suggests possibility that
exposure may be a result of an intentional exposure
●●
Likely Biological Threat: There is a reasonable belief the exposure was
caused intentionally
Based on the risk category, public health and law enforcement perform the
next steps:
●●
No Threat: Public health will continue to manage the incident
●●
Possible Biological Threat: Separate investigations or joint
investigation
●●
Likely Biological Threat: Joint Investigation
Joint Criminal and Epidemiological Investigations Handbook
61
JOINT INVESTIGATIONS
While the incident may be initially assessed at one of the above risk levels, it
may be changed as the investigation begins and new information is collected.
Procedures for conducting joint threat assessments should be decided on
prior to a potential biological threat and included in an agreed upon protocol
or MOU between the two disciplines. For reference, a sample procedure for
conducting a joint threat assessment can be found in Appendix 1.
Joint Investigations
The objective of a joint investigation is to maximize the efficiency of both law
enforcement and public health through the exchange of real-time investigative
information. When a joint investigation is initiated, law enforcement and public
health are empowered to share information throughout the course of the joint
operations.
The goals of joint investigations are to:
62
●●
Identify the disease causing agent
●●
Identify the source and perpetrators of the attack
●●
Determine the mode(s) of spread or transmission of the biological agent
●●
Determine where and when exposure to the biological agent may have
occurred
●●
Identify who may have been exposed.
Joint Investigation Criteria
The following criteria may be used to establish a threshold for determining
whether to conduct a joint investigation of a suspect bioterrorism incident:
●●
Case-patient(s) positive for a select agent,
●●
No known natural source to explain infection,
●●
No known risk factors for disease occurrence, and/or
●●
FBI intelligence suggests that the incident is criminal/intentional
These criteria are not all-inclusive and may not cover every possible biological
threat. Once a decision has been made to work jointly, law enforcement and
public health should follow previously developed procedures for conducting a
joint investigation. These procedures should be located in a MOU/joint protocol.
Joint Investigations — Sharing of Investigative Information
During a joint investigation it may be difficult for law enforcement and public
health to know the type of information that can be freely exchanged. As a
general rule, when conducting a joint investigation, law enforcement should
share relevant criminal investigative information that will be helpful to public
health in mitigating the effects of the outbreak. Likewise, public health should
share any epidemiological investigative information that may assist law
enforcement to identify, apprehend, prosecute, and convict the perpetrator(s).
The following tables (Table 4 and Table 5) were developed to assist law
enforcement and public health in determining the type of information needed
by the other discipline.
Joint Criminal and Epidemiological Investigations Handbook
63
JOINT INVESTIGATIONS
Table 4. Public Health Information for Law Enforcement
●● Time and locations where exposures may have occurred (may be based on agent-specific characteristics or other
investigational findings)
●● Names (including date of birth) for all confirmed, probable, and exposed case-patients
●● Positive laboratory results for a biological threat agent from an approved laboratory
●● Case definition (epidemiological picture of the outbreak)
●● Risk factors that may be associated with exposure (e.g., demographics, occupation, or other activities)
●● Hypotheses generated by the epidemiological investigation
●● Notification about when public health is planning to conduct interviews with case-patients or contacts
●● National or international health alerts that may be related to the current biological threat
●● Laboratory results used to characterize the specific biological agent (e.g., strain, genetic sequencing, antimicrobial resistance)
●● Identification of any unusual cases (e.g., past case-patients, coroners’ reports)
●● Any other investigative information that may be relevant to the biological threat (e.g., requests or theft of antibiotics,
identification of a laboratory in someone’s home)
Table 5. Law Enforcement Information for Public Health
●● Law enforcement investigative information (e.g., interviews scheduled and planned search warrants) that may assist
public health with the identification of the agent and determination of the source of the outbreak
●● Information regarding any known group or sector that may be targeted (e.g., government or financial, entertainment,
religious/ethnic groups) for an attack
●● Other law enforcement cases which may have ties to the existing biological threat investigation
●● Pre-incident indicators (e.g., videotaping, sketching maps, break-ins, perimeter breaches at facilities) that may be
related to the biological threat incident
●● Information developed by law enforcement regarding the biological agent used, mechanism for delivery/
dissemination, date, time and locations of exposures
●● Information regarding any medical equipment, chemicals, toxins, biological agents or laboratory supplies stolen,
developed, or uncovered that may be related to the biological threat
Joint Interviews of Cases and Contacts
Much of the joint investigation will initially focus on interviews with patients
and potential contacts that will primarily address where and when exposures to
biological threat agents may have occurred. While many public health and law
enforcement investigators may be familiar with conducting interviews, many
have not practiced or conducted a joint interview with the other discipline
present.
Although a joint interview with law enforcement can provoke anxiety in the
patient, one interview with both agencies present may be less disruptive to the
patient than two or more separate interviews repeating similar information.
Additionally, separate questioning by law enforcement and public health
may lead to conflicting statements, which can jeopardize the outcome of the
criminal investigation. Therefore, a joint interview affords public health and law
enforcement the opportunity to examine relevant facts based on the unique
perspectives of both investigators. For reference, a sample procedure for
conducting a joint law enforcement and public health interview can be found
in Appendix 2.
For public health there are concerns that the presence of law enforcement
could compromise the collection of sensitive medical information (e.g.,
illegal drug use) by public health. However, a criminal investigation requires
interviewing all potential witnesses and victims. In order to mitigate patient
concerns, a provision should be established for confidential communications
between public health and the interviewee in order to share specific healthrelated information during a joint interview. Special consideration should be
made to protect the identifying information of the interviewees, due to privacy
as well as the integrity of a criminal investigation.
●● Intelligence information regarding the characteristics of the biological agent (e.g., strain, antimicrobial resistance, or
weaponized nature)
64
Joint Criminal and Epidemiological Investigations Handbook
65
JOINT INVESTIGATIONS
In some instances, joint interviews may not be possible (e.g., the interviewee
requests that law enforcement not be present) so each discipline should be
aware of the types of information their counterpart is seeking. For reference,
sample questions that may be asked by law enforcement and public health
can be found in Appendix 3.
Joint Investigations and the Media
It is important for FBI, law enforcement and public health to coordinate their
interaction with the media. The media will have a significant impact on the
response and the public reaction to a biological threat. With public fear and
the psychological impact of a bioterrorism incident, the media will aggressively
seek information from the investigators. Therefore, FBI, law enforcement and
public health must develop a working relationship with the media to help
ensure that timely, useful information is shared with the media to keep the
public accurately informed, but not overly alarmed.
Memorandum of Understanding/Joint Protocols
The creation of a Memorandum of Understanding (MOU) and/or joint protocols
helps to establish joint investigative guidelines between law enforcement and
public health, thus determining roles and responsibilities prior to an event
actually occurring. These guidelines help to address many of the actual or
perceived challenges and barriers to collaboration by outlining investigational
procedures for the response to a biological threat or other naturally occurring
incidents. In addition, MOU/joint protocols help establish consistent procedures
among law enforcement and public health regardless of personnel rotation
over time.
In general, the MOU/joint protocols outline some of the components discussed
above: information sharing triggers, joint threat assessments, and joint
investigations. Additional information that could be helpful to incorporate into
66
a MOU/joint protocol includes sharing of investigative results and the analysis
of information (e.g., agreement on appropriate methods for handling clinical
specimens and environmental samples and how information obtained from
these sources will be shared).
The development of a MOU/joint protocol is a difficult task, requiring the input
and agreement of many entities within law enforcement and public health. To
assist agencies and jurisdictions with the creation of an MOU/joint protocol, the
CDC and the Bureau of Justice Assistance (U.S. Department of Justice) convened
a Public Health and Law Enforcement Emergency Preparedness Workgroup
that developed a model MOU for joint public health and law enforcement
investigations.
To obtain a copy of the model MOU, send an email request to:
phlawprogram@cdc.gov.
Joint Training / Exercises
Once relationships are established and MOU/joint protocols are developed,
public health and law enforcement need to be trained in order to be proficient
in joint investigations activities. It is important to already have MOU/joint
protocols in place prior to conducting an exercise (and not use the exercise to
create the joint protocol). Creating a joint training/exercise program will enable
public health and law enforcement to test, evaluate and refine their protocols.
Amending protocols to reflect lessons learned from an exercise is particularly
important to ensure best practices evolve and are strengthened over time.
Additionally, as new individuals are trained, it allows public health and law
enforcement to continually build relationships with their counterparts and gain
familiarity and expertise with joint investigations principles and methods prior
to an actual incident.
Joint Criminal and Epidemiological Investigations Handbook
67
SUMMARY
SUMMARY
This handbook provides an overview of law enforcement and public health
roles and responsibilities and identifies the Joint Criminal-Epidemiological
Investigations Model as a best practice to more effectively prepare for and
respond to a biological threat. By implementing elements (e.g., increasing
information sharing, conducting joint threat assessments and conducting
joint investigations/joint interviews) of the Joint Criminal-Epidemiological
Investigations Model, law enforcement and public health can maximize their
resources and achieve their individual and common goals during the response
to a biological threat.
The procedures and methodologies described in the handbook are intended
to serve as a guide. Law enforcement and public health should modify this
guidance to accommodate the specific needs, statutes and authorities of their
agency, jurisdiction, or country.
70
Key Highlights of Introduction Section
●●
There has been a demonstrated interest and
willingness by terrorist groups and individuals to
acquire and employ biological agents at weapons
against the American population.
●●
The intentional release of a biological agent may
initially be difficult to discern from a natural incident,
which can result in separate law enforcement and
public health investigations.
●●
It is in public health and law enforcement’s best
interest to work together when first investigating
a suspicious biological outbreak, which includes
fostering mutual awareness and establishing joint
communication procedures.
●●
By working together, public health and law
enforcement can achieve their separate but often
overlapping objectives of identifying the biological
agent, preventing the spread of the disease,
preventing public panic, and apprehending those
responsible.
●●
Law enforcement and public health are encouraged to
read the entire handbook and not limit their review to
just their respective sections, so each community can
understand the different goals and needs of the other
organization.
Joint Criminal and Epidemiological Investigations Handbook
71
SUMMARY
Key Highlights of Public Health Section
●●
●●
●●
72
●●
The ultimate aim of an epidemiological investigation
is to identify the source of the disease and implement
efforts to control the outbreak and protect the public’s
health.
An epidemiological investigation primarily involves the
meticulous accumulation of information from patient
interviews and surveys as well as data collected from
surveillance systems.
Goals of an epidemiological investigation include:
»»
Stopping the spread of disease (identify causative
agent, determine source, mode of transmission and
population at risk)
»»
Protecting the public’s health (surveillance, medical
countermeasures, health education)
»»
Protecting public health and other response
personnel (protective equipment and preventive
vaccines/medications)
Important elements of an epidemiological
investigation are:
»»
Detect unusual events
»»
Confirm diagnosis
»»
Identify and characterize additional cases
»»
Determine source of exposure
»»
Develop and implement interventions
●●
Laboratory analysis of clinical specimens is used to
assist the physician in making a definitive diagnosis.
While most physicians will wait for definitive
laboratory results to confirm a biological threat agent
diagnosis, physicians are likely to begin treatment
before laboratory test results are confirmed since early
treatment of disease increases the probability the
patient will recover from the illness.
●●
A laboratory that tests for biological agents should
meet applicable standards (e.g., quality control
measures, biosafety, and biosecurity) and participate
in relevant proficiency testing.
Joint Criminal and Epidemiological Investigations Handbook
73
SUMMARY
Key Highlights of Law Enforcement Section
●●
●●
●●
74
●●
Once there is suspicion that a crime has occurred,
chain of custody procedures should be implemented
by both law enforcement and public health to ensure
accountability of evidence. Failure to properly maintain
the chain of custody may render evidence unusable
at trial.
●●
In certain situations the environment might
be contaminated; therefore, it is useful to have
specially trained law enforcement teams to handle
apprehension of the suspect and collection of
evidence in contaminated environments.
●●
The need for rapid collection and testing to save lives
outweighs normal evidence collection procedures.
Primary goals of a criminal investigation for a
biological threat are:
»»
To protect the health and safety of the public
»»
To prevent subsequent attacks
»»
To identify, apprehend, and prosecute the
perpetrators
»»
To protect law enforcement personnel
If public health and law enforcement have
established a working relationship prior to a
biological threat incident, public health may feel
more comfortable contacting law enforcement early
in their investigation.
Law enforcement should include various subject
matter experts, such as public health, to assist in
determining the credibility of a biological threat.
Joint Criminal and Epidemiological Investigations Handbook
75
SUMMARY
Key Highlights of Joint Criminal and
Epidemiological Investigations Model Section
●●
●●
●●
76
●●
A joint threat assessment, which utilizes the unique
expertise of both disciplines, can help determine
more quickly the nature of the incident (intentional or
natural) and lead to a more appropriate response to
the threat.
●●
A joint investigation can maximize the efficiency for
both law enforcement and public health in the event
of a biological threat through the exchange of realtime investigative information.
●●
MOU/joint protocols between law enforcement and
public health are critical in determining roles and
responsibilities prior to an event occurring and help
ensure consistent practices between the disciplines
during a response. Important information to include
in MOU/joint protocols include: information sharing
triggers, joint threat assessments, joint investigations,
joint interviews, and methods for sharing investigative
results.
●●
Joint training and exercises are important elements
of the Joint Criminal-Epidemiological Investigations
Model since they allow public health and law
enforcement to test, evaluate and refine their
protocols. Amending protocols to reflect lessons
learned from an exercise is particularly important to
ensure best practices evolve and are strengthened
over time.
The Joint Criminal-Epidemiological Investigations
Model is made up of six strategic elements.
»»
Building Relationships
»»
Information Sharing
»»
Joint Threat Assessment
»»
Joint Investigation
»»
Memorandum of Understanding/Joint Protocols
»»
Joint Training/Exercises
Benefits to conducting joint investigations:
»»
Law enforcement has access to public health
experts who understand disease epidemiology and
can provide relevant medical information.
»»
Public health has access to law enforcement case
information which could assist in identifying the
source of exposure and containing an outbreak.
The timely exchange of information in the early stages
of a response is critical. Both disciplines have access
to unique information that could help to prevent or
detect a biological threat.
Joint Criminal and Epidemiological Investigations Handbook
77
APPENDICES
APPENDICES
Appendices to Joint Criminal-Epidemiological Investigations
Handbook
Sample Joint Criminal-Epidemiological Investigations Material
Appendix 1: Sample Procedure for a Joint Threat Assessment
Appendix 2: Sample Procedure for Joint Interviews
Appendix 3: Sample Joint Interview Questions
Reference Material
Appendix 4: List of Biological Select Agent and Toxins (2014)
Appendix 5: Laboratory Response Network (LRN)
Appendix 6: CSTE List of Nationally Notifiable Conditions (2013)
Appendix 7: HIPAA Privacy Rule & Permitted Disclosures
Appendix 1: Sample Procedure for a Joint Threat Assessment
To assist in the response to a biological threat at the local level, it is
recommended that law enforcement and public health develop protocols to
conduct a joint threat assessment between agencies and jurisdictions. The
following procedure is intended to serve as a guide for conducting a joint
threat assessment; law enforcement and public health may wish to adapt the
procedures below to better suit the needs of their agencies.
Upon receiving a report indicating a potential biological threat, public health
should immediately notify the local FBI WMD Coordinator to conduct a joint
threat assessment. The purpose of the joint threat assessment is to determine
the likelihood of an intentional incident and identify response actions that
should be performed by law enforcement and public health.
It is recommended that the joint threat assessment be conducted by a
conference call and, at a minimum, include the following representatives:
Appendix 8:...
Purchase answer to see full
attachment