Laboratory Analysis of Suspect Documents
APPROVED FOR RELEASE 1994
CIA HISTORICAL REVIEW PROGRAM
18 SEPT 95
Some of the possibilities, methods, and results of submitting written materials to examination by test tube and microscope.
LABORATORY ANALYSIS OF SUSPECT DOCUMENTS
James Van Stappen
Seven or eight years ago an intelligence officer came into possession, under circumstances which aroused his professional ardor, of a small scrap of notepaper bearing only an address and a very common first name scribbled underneath it. For two years he persisted in trying to identify the writer of this note, collecting handwriting specimens from a number of likely places and submitting them for laboratory comparison. Some of them matched the original. The points of venue of these marked the writer's trail through several trouble-ridden countries, but none identified him. Finally, back in his own country, the traveler wrote to one of the prospectively useful acquaintances he had made on the trip, and this correspondent was careless enough to let the letter fall into our intelligence officer's hands. Verified as the same handwriting, it gave a complete name and home address. A search of visa records and other materials on file now yielded the true identity of the writer, his cover story, background, and even photographs of him. He is a Soviet intelligence officer, who since then, thanks to this identification, has unwittingly kept us informed by his presence of certain activities of his organization.
For twelve years, beginning during World War II, an agent in Europe had provided generous and significant reports from around and behind the iron curtain. He had apparently built up a network of informants extending deep into the denied areas. But now a sharp-eyed postal intelligence officer noticed an incorrect postal cachet on one of his envelopes, and his whole file of 300-odd reports was therefore brought to the questioned document laboratory. Analysis showed that the reports were written by eight different typewriters, which might correspond to eight different informants; but some reports from widely separated places had been produced on the same day by the same machine, and the principal agent's own correspondence turned out to have been written on one or another of the typewriters supposedly used by his secret informants behind the curtain. It was not a crude paper mill, but careless enough to get caught, finally.
At a time when one of the countries that are pulled between East and West was negotiating for a tremendous Western loan, one of its pro-U.S. representatives, a personage internationally well known, offered a letter typed on blue stationery as a sample of the Communist blandishments which he was trying to resist. An awkward signature prompted the submission of this letter to the questioned document laboratory. The signature was found to be indeed a crude attempt at handwriting disguise, executed in American-made fountain-pen ink, Waterman's Blue Black. The blue watermarked stationery could have been bought only in Australia or New Zealand, on the other side of the world from the purported Communist writer. Moreover, the Communist's letter was typed on the same machine -- a 1927 Underwood Standard rebuilt after 1940 -- that this Friend of America had some time before used to address an envelope to us. A file of miscellaneous documents our Friend had turned over to us in the past was now examined, and all were found to be forgeries. Upon interrogation he admitted his duplicity and begged not to be exposed.
These are three of the more startling questioned document cases of the 1,500-odd on file, some of them not worth to anyone the paper they were written on, some of international consequence. They include analysis of propaganda leaflets which led to the very presses that printed them. They include restorations of charred documents, erased and obliterated writings, carbon paper impressions, and writings indented on sheets of paper underneath the ones used by the writer. They include the investigation of crank letters and of forgeries using both Dulles brothers' names. They include examinations of credentials, complementing the work of the identity document analyst1; in one outstanding case a suspected hostile agent's passport was found to have 27 recordable errors in make-up, and a complete physical analysis disclosed its probable area of origin and a considerable amount of information on adversary capabilities and modus operandi in agent documentation.
Of the tell-tale manifestations by which any intelligence operation necessarily runs the risk of exposing itself, documents constitute one of the most rewarding to the investigator. Being as they are a permanent, physical item, they are devoid of the human foibles which so often bear uncertain witness -- poor observation, bad judgment, opinion and hearsay, insincerity, malice. Used to support duplicity, they often, under expert analysis, tell the truth, and in many cases much more, not only exposing the particular operation that occasioned them but supplying intelligence of far-reaching significance. By laboratory examination it may be possible to develop the complete text of indented or other imperfect writings, establish the validity of a document, detect any alterations or erasures, identify the author by analysis of the handwriting or typewriting, determine the kind, specific type, origin, and approximate age of the paper and ink used, and find the kind, specific type, and origin of the writing instruments.
Analysis of Paper
Although a document is legally defined as being of any material on which marks may be inscribed, including gravestones and in a recent case a silver goblet engraved with Josef Stalin's true signature, the material used for most documents is of course paper. The laboratory analysis of paper must take into account its color and opacity, the size of the sheet, its weight and thickness, its fiber content, the direction of the grain, the finish, and the watermark. Comparison in these respects with exhaustive files of domestic and foreign paper stock samples serves to identify most papers. If the paper is a common, low-grade type, it will yield no clues to the originator of the document except perhaps his area of operation. But if it is a rarer and more expensive one, with few dealers and retail outlets, it may be possible to trace through these the limited number of people who had access to it. A unique paper may be, and in actual cases has been, traced to a single individual. The secret markings that identify paper used by governments, banks, and other official organizations are also many of them on file along with the paper stocks, as an aid in checking the authenticity of official documents.
It can be established that a document is forged by showing that its paper is not as old as its purported date. Sometimes the age of the paper can be determined from its composition or watermark, by referring to a file of manufacturers' formulas and watermarks in use at different dates. More often it is necessary to measure the effects of age on its chemical content and color, taking into consideration the type of fiber in the paper and the climatic conditions under which it was stored. Using chemical reagents and a tintometer or similar instrument for gauging shades of color, the expert can usually determine the approximate age of the paper. If the paper has been artificially aged, a practice forgers often try, the age test will not be valid; but the false aging can often be detected and the document thus proved a forgery.
Analysis of Inks
The identification of an ink is begun by determining the type to which it belongs. The three chief types in use today are gallotannic (the most common), chromic, and aniline. Others are China ink, the colored vegetable-dye inks, a few dark ones like those made from wolfram and vanadium, and those for special application as for mimeograph and stamp pads. Chemical differences enable the laboratory to identify these types.
The age of the ink, which has the same bearing as paper age on the validity of a document, may sometimes be determined through data on file regarding changes in the manufacturers' formulas. Waterman, for example, has changed formula four times in ten years, so that a sample of Waterman's may often be associated with a particular period of manufacture. Another test is color. Permanent inks contain a temporary dye which soon fades, an iron and sulfur compound, and a weak acid. The action of the acid, oxygen, and humidity produces first a dark color and then over a period of years a slow fading to a weak stain. By using chemical reagents, the age of the ink can be approximated by comparing its color, taking into consideration the color of the paper, with standard color charts. If ink has been artificially aged the age test is impossible, but the induced aging itself is sometimes detectable.
When a stroke of ink writing is magnified fifteen or more times, the two tracks made by the point of the pen stand out much clearer than the line of ink between them. If the pen is new, the width of these tracks, compared with standard-brand widths shown in test charts, sometimes serves to identify the type of pen. When a well-worn pen has been used, the difference in width and appearance between the two tracks usually indicates whether the user is right- or left-handed. If a pen is worn badly enough, it may leave regular, easily identified scratches which provide positive identification of the very pen itself. The fact that most people fill their fountain pens with different kinds of ink at different times may also serve to identify an individual pen through the unique combination of inks in it.
The ball-point pen is more easily identified than an ordinary one. It uses a unique ink, there is a specific width of the ball point for each brand, and the surface of the ball, smooth as it may seem to the unaided eye, is really full of scratches which leave a pattern on the paper--the pen's own fingerprints. Any non-standard type of pen is the more readily identified because of its scarcity.
If a document is written in pencil or crayon, the laboratory may be able to determine the formula of the material and through file comparisons perhaps identify the manufacturer. The age of pencil or crayon writing can be determined only as to whether it was done within the last ten or fifteen days. A unique or unusual pencil or crayon may possibly be traced to the individual who used it.
Identification of Handwriting
Handwriting, like other physical acts performed by adults, is characteristic of the individual writer; there is probably no act more characteristic of an adult than his writing. It can therefore be used for positive identification of the writer through comparison of the unknown specimen with known writings. This comparison is a matter not only of letter forms but also of many other characteristics, among them movement, muscular habits, pen position, line quality, shading, retrace, proportion, connections, spacing, and embellishments. If a sufficient number of similarities are found between a known handwriting and the questioned specimen, with no dissimilarities which cannot reasonably be accounted for, it can be concluded that both were written by the same person.
A person's handwriting is developed by constant repetition over the years until it becomes second nature to him, a succession of deeply ingrained habits. The obstacles which confront a forger or a disguiser of his own writing are therefore manifold and great. It is practically impossible for a writer to divorce himself from certain inherent characteristics manifested in pressure points, pen lifts, the shading of strokes, etc., of which he is not even aware. In order to succeed in a forgery he needs not only to throw off his own characteristics but to assume the inherent characteristics manifested in another person's writing, also a virtual impossibility. Handwriting comparison, however, should not be attempted by an amateur. Its most difficult aspect is evaluating the weight to be given each of the various distinguishing characteristics.
The identification of typewriting is similarly based on a sufficient combination of peculiar characteristics. Some of the more outstanding of these characteristics are the defects in type faces, the design of the type, misalignment due to mal-adjusted type bars, and uneven printing due to twisted type faces. The make and model of a typewriter can be determined by an examination of its product, and a used typewriter can be individually identified with certainty. Since manufacturers change type design from time to time, a document may also be proved fraudulent by showing that its type was not yet manufactured at the time of its purported date.
Aside from type design and the individual peculiarities of used type, the machine may be identified as one on which worn type has been removed and replaced with a new set. This new "retread type" may be distinguishable by its sharp, angular corners, by special retread designs, or by comparison with the type faces of the numerals, which get little use and are rarely changed, and therefore will not match the retread font used for the other characters.
It is occasionally possible to identify the individual who typed a document from his habit of using particular pressure on certain keys, making unique mistakes, and in some instances using unique spacings. If a suspect is made to type a dozen copies of the questioned document on the same machine, he will follow the same psychological patterns each time, and a comparison of the test specimens under magnification with the original document will make it apparent that they were typed by the same person. A person who uses the "hunt and peck" system, for example, characteristically hits the period so hard that he punctures or almost punctures the paper. Many people put much more pressure on combinations of letters found in their own names than on the other letters they type.
The Submission of Questioned Documents
The fruits of this analysis are available, of course, only when documents have been questioned or found suspect and submitted to the laboratory. This questioning is generally the obligation of the intelligence officer who first receives a document or of some staff analyst who finds that it does not fit well into the pattern of things already known about a case. The decision to request technical aid for analysis of written materials connected with an operation has in retrospect often turned out to be the most important decision made during its course. The use of this facility for counterintelligence purposes has been a steadily growing thing, for every find encourages other intelligence officers to bring dead files back to life for comparison with the newly identified material. Different areas have on numerous occasions found, when certain documents were compared, that they were host to the same adversary agent.
Many intelligence officers, however, still overlook the very evidence which might successfully terminate a case for them. It is often thought, for example, that a handwriting expert's services are necessary only when a document is suspected of being forged, whereas the results of expert examination may be much more far-reaching in identification cases. The handwriting on an automobile ownership certificate, a piece of paper found at the scene of a meeting, an ink offset on a blotter, notations in a memorandum book, or any of a multitude of other writings may upon analysis prove to be of value to an operation. In clandestine operations where secret writing is used as a means of communications, it is often advisable to have the developed secret writing, as well as the cover letter, checked in the questioned document laboratory against the possibility that the agent has been killed, captured, or doubled and his communications taken over by the adversary. An earlier article in the Studies2 showed the value of this procedure also for the purpose of assessing the agent's stability under strain.
In order to obtain a maximum benefit from the laboratory analysis, the intelligence officer should exercise great care in collecting and preserving the documents he submits. He should make every attempt to get samples of a suspect's handwriting without his knowledge--his signature on pay vouchers, for example, or reports or letters in his natural writing. The highest quality of evidence is an uncontaminated original document. Anything less than that, such as a photocopy, is better than nothing, but still yields only qualified results. When it is known in advance that a document is to be submitted to the laboratory, it should be enclosed in a transparent plastic envelope large enough that folding is unnecessary. Thus protected, it can be read in transit on both sides and handled without soiling, wetting, or any physical alteration that might modify or destroy elements of the evidence.
This brief review should be sufficient to show that the science of questioned document analysis requires highly qualified professionals and, like surgery, should not be attempted by do-it-yourselfers. Among the cases on file that attest to the hazards of self-service in this matter is that of the 12-year-old paper mill cited above; it would have been detected at least two years sooner if the case officer involved had not imagined he could train himself in the technique. Even the experts employed in Washington are professionally impotent if separated from their standards, specimens, files, reference material, and technical facilities. Therefore this work cannot be done on a local basis in the field with any assurance of success.