How To Build a Smoking Gun
Using Data and Documents More Effectively in Investigations
Imagine that you are an investigator and have access to an insider whose credibility could not be impeached and that this insider could lay out exactly what the defendant did with the money or told his victims. You would spend days with that insider, figuring out how to ask the right questions to elicit the information you need to make your case.
Documents and data can be the equivalent of those potential insiders, and prosecutors and agents should treat them as such. With some time and the right mindset, documents and data can be turned into the equivalent of a “smoking gun,” strengthening cases and even helping make them in the first place.
I was a federal prosecutor for 11 years and was also a reporter for the Chicago Tribune. I will talk about some examples from real-life criminal cases below, but let’s start with two examples from journalism (one fictional, one real) that show how powerful this kind of work can be.
In the popular thriller The Girl with The Dragon Tattoo, the main character (an investigative journalist) is trying to discover what happened to a girl who has been missing for decades. The big break comes when the journalist discovers archived photos from a parade that the missing girl attended. Each photo, in and of itself, is meaningless. But then the journalist does something with the photos. He takes all of the photos and puts them into a chronological sequence focused on the missing girl.
The resulting sequence shows the girl enjoying a parade, and then it shows her reacting with shock and horror when she sees something on the other side of the street. Something happened at that parade that changed everything. Something that turns out to be a key part of the mystery.
Each photo, on its own, was just noise, but when aggregated, the overall sequence changed the entire course of the investigation.
In Spotlight, the 2015 Oscar-winning movie based on true events, Boston Globe reporters are investigating the sexual abuse scandal within the Catholic Church. One reporter looks up a suspect priest in the archdiocese’s annual directory and realizes that the archdiocese had used a euphemism to refer to the priest’s location. The reporters then realize that the archdiocese had been using such euphemisms to refer to other priests, and that the archdiocese had thus left a coded guide of the abuse in its own directories.
A montage sequence ensues of reporters going through directories, climaxing with, of all things, the completion of a spreadsheet.
Three of the Pulitzer Prize-winning Boston Globe reporters who actually did the work in real life — Walter Robinson, Michael Rezendes and Sacha Pfeiffer — described it as “three and a half weeks of agony” in a telephone interview. To relieve the tedium on the eyes, they sometimes did the work in pairs, with one reporter reading off from a directory and another person entering the data. But it was worth it. The resulting database was invaluable, they said. The work showed that the individual examples they had heard about were not isolated and showed that there was a larger pattern at work.
These fictional and real journalists made these breakthroughs themselves by investing time and resources into taking little bits of information and aggregating them into something that no single witness would have given to them, making them into the equivalent of smoking guns. Prosecutors and agents can achieve similar results by thinking beyond the witnesses they will interview and investing time and resources into aggregating evidence into powerful tools.
Here are three general approaches that I take to data and documents in my investigations.
I. Count Something
Whether you are dealing with bank records, emails, or boxes of documents, simply counting and categorizing key pieces of information can answer important questions and yield powerful evidence. In his book, Better: A Surgeon’s Notes on Performance, Dr. Atul Gawande suggested that one way of becoming a better doctor was to count something: “If you count something you find interesting, you will learn something interesting.” This advice can go far in criminal investigations and trials as well.
Who are people talking to, how often, and what about? These are things that can be quantified in potentially powerful ways.
Take the 2014 trial of former Connecticut Governor John Rowland. In describing the evidence that led to the jury’s guilty verdicts, a New York Times reporter described the government’s summary witness as providing “several powerful punches,” simply by categorizing emails and phone records and counting them up.
One issue at trial had been Rowland’s contract with a nursing home owned by a cooperating codefendant — was it a legitimate contract for services, or was it really a way to disguise campaign work? To help address this, the summary witness, who was a retired postal inspector, simply counted their emails and found that the vast majority related to campaign business and that only a small number related to the nursing home’s business.
Where is the money coming from, and where is the money going? In Ponzi scheme cases, analysis of the bank records typically will reveal some common traits: (1) money coming in primarily from new investors, (2) little money actually going out for the kinds of investments that the fraudster had promised, and (3) some kind of disconnect showing how the enterprise’s obligations far outstrip the enterprise’s actual assets or funds.
That is what happened with Charles Ponzi himself. Ponzi told investors in early 1920 that he could use their money to make huge profits using “international reply coupons” that could be bought at low rates in some countries and worth more in others. He promised fifty percent returns in just months.
The graph below summarizes the amount of money that Ponzi was able to collect from people in 1920 as his scheme suddenly grew. The scheme started off small, but grew rapidly before suddenly collapsing in the summer of 1920. (These numbers are based on reporting done by Mitchell Zuckoff in Ponzi’s Scheme: The True Story of a Financial Legend (2005).)
Had Ponzi been just a bad businessman rather than a fraudster, then there should have been expenses showing that he was actually implementing the business model that he had been pitching. There were not. The money that Ponzi collected went to hire more people to solicit more investors, to pay down debts, and to enjoy and show the wealth that made him look successful — suits for himself and jewels for his wife, a custom made limousine, and a seven-bedroom house. Ponzi claimed to have given some of the money to a man who went to Italy to buy the international reply coupons necessary for his model to work, but there appears to be no evidence that this man actually existed.
Counting up the money can be a big part of going after people like Ponzi. Most money will go to maintaining or expanding the scheme (the employees that Ponzi hired and branches he opened to solicit more investors) and for the fraudster’s own benefit, and little, if any, will actually be used to do what the fraudster has claimed to be doing.
Individual acts vs. a fraud scheme? Anyone can make a mistake, and a mistake is generally not a crime. But if you can show that someone was making the same mistake over and over again, it becomes a lot easier to show that a crime was committed.
The James Bond villain Goldfinger put it well: One time is happenstance and twice is coincidence, but the third time is enemy action. Similarly, one time may be an accident or mistake, two or three times may be negligence or sloppiness, but time after time is a scheme.
For example, in a campaign finance case (United States v. Whittemore), the defendant funneled money through multiple intermediaries to the ultimate recipient. The government used charts to show that each intermediary’s contribution followed the same pattern. On one day alone, the defendant transferred $145,000 to seventeen relatives and employees that were characterized as “bonuses” or “gifts” and simultaneously encouraged them to make contributions, sometimes explicitly saying that the money was intended to cover the cost of the contribution. At trial, the government introduced charts showing each step being repeated over and over again, a powerful depiction of the defendant’s conduct and intent.
One “bonus” or “gift” might have been just that, but all these bonuses and gifts, aggregated together, were strong evidence of a scheme and of criminal intent.
Similarly, health care fraud cases also can benefit significantly from simply counting something that seems odd. People committing healthcare fraud typically have gotten very good at papering their files to fool an auditor who is looking only at a few randomly selected claims in isolation. But if you step back and look at the files overall, that may reveal some kind of ridiculous pattern that will be powerful evidence of the overall fraud.
One common type of healthcare fraud involves doctors billing routine patient visits as if the visits were more complicated than they actually were. Complicated visits should typically take more time, and the American Medical Association includes typical times for each billing level. Adding up the number of visits in a day and multiplying them by the associated time can yield powerful evidence of fraud, especially when the totals become particularly ridiculous, such as the doctors who regularly bill more than twenty-four hours’ worth of visits in a single day. Theoretically possible, but extremely unlikely.
Look for something weird or untrue or inconsistent in the files and data, and you can turn it into something powerful at trial.
II. Contrast Something
Fraud cases often are about defendants making their victims (investors, clients, Medicare) believe that defendants are doing one thing when the reality is otherwise. They create a fake world that appears legitimate from the inside. Documentary evidence and summary charts can help jurors step out of the fake world and see the reality for themselves.
In Ponzi scheme cases, there probably will be a huge contrast between what the defendant says he is doing and what he actually is doing. Charles Ponzi told people that he was arbitraging postal reply coupons, but there were not enough coupons in circulation to make all the money that Ponzi was promising, and Ponzi was not actually buying large quantities of coupons as he would have had to if he really meant what he was saying. The chart below shows this comparison.
Similarly, when forensic accountant Bruce Dubinsky tried to show that Bernie Madoff was running a Ponzi scheme, there was a contrast between the stock purchases shown in Madoff’s customer ledgers and the stock purchases that actually occurred. Dubinsky found that ledgers reported purchases on particular days that were in greater volume than had occurred in the entire stock market, and he found that ledgers reported purchases at prices that were lower than all the reported prices in the entire stock market.
Dubinsky’s slides were admitted at the trial of some of Madoff’s associates via his role as an expert, but many of them probably could have been admitted under Rule 1006, which allows a summary of voluminous records. Dubinsky testified at trial that he spent days going through thousands of banker boxes of Madoff documents that were housed in a warehouse on Long Island, and his work summarized the review of those and other voluminous records.
Contrasting lies with reality can work in prosecuting other types of fraud. In the late 1990s and early 2000s, a defendant conspired with a courthouse procurement officer to rig bids and to overcharge the court (United States v. Millkiewicz). To prove the fraud, the government used multiple summary charts, including one that juxtaposed (1) what the defendant actually purchased from his vendors, based on a summary of roughly 1,300 pages of records and (2) what the defendant actually billed to the district court. Here is a visualization of one such comparison from October 2001:
Rather than making the jury compare huge amounts of records, charts like this can do the work for the jury. With the chart, the jury can more easily see that the court had paid for 100 more cartons of paper than the defendant himself could have delivered in October 2001.
In health care fraud cases, the records and data of legitimate providers can also provide strong contrasts with a defendant’s fraud. For example, in home health cases, nursing agencies and doctors often claim that patients are “confined to the home” for extended periods of time. The agencies and doctors can submit claims making the patients appear that sick, but the files and data created by patients’ other providers can show that the patients were leaving their homes during the same time periods and were in stable condition.
In a case involving cosmetic light treatments that were falsely billed as the destruction of precancerous lesions (United States v. Memar), the government learned that one patient had gotten such treatments at the same time as she was seeing another dermatologist. The government contrasted the two doctors’ records in a timeline that showed that (a) the defendant was allegedly destroying lesions nine times over a single year and (b) another doctor saw no such lesions during that same year.
III. Track Something
You can also use summaries to track particular facts and pieces of evidence and to highlight patterns via repetition.
First, tracking something can create powerful evidence that would not be obvious or compelling if presented solely via oral testimony, especially when you track something that no one thought to lie about at the time.
Human resources records can be particularly helpful, such as the directories mentioned in the Spotlight example above. Bonuses that continued and grew over the course of a fraud scheme can help show that a defendant was more involved and knew more than she might claim. Also, payroll records can help show that a defendant was the only person who could have committed a particular crime.
Second, tracking something over time can reveal key moments that can corroborate witness testimony, show the defendant’s intent, or open up new investigative areas. In my fraud cases, I often break down the data by year and often by month, looking for those key moments. Did the fraud peak sometime? If so, why? And if it never peaked, did the fraud keep going despite red flags that should have been heeded? Did the scheme change at some point? If so, why?
For example, in one health care fraud case (United States v. Kolbusz), a doctor billed cosmetic light treatments as if they were medical procedures destroying large numbers of precancerous lesions. In 2006, one large insurance company started to catch on. In 2007, a peer warned the doctor that what he was doing looked like fraud. Data and documents showed that the doctor still tried to keep the fraud going. Suddenly, the total number of lesions he claimed to destroy each time dropped from a ridiculous number (120) to less unreasonable numbers (20–40), corroborating witness testimony about instructions that they had received. In context, this actually helped show criminal intent even more clearly.
Third, tracking disparate items in a single chart can help jurors see how evidence fits together and can save you time in your closing arguments. When evidence comes in at trial through multiple sources and out of chronological order, a simple timeline can help the jurors understand the materials better while you are still presenting the case. This can help them see the points you are trying to make, rather than leaving them in confusion until closing arguments. For example, the timeline below was used in a Western District of Missouri case (United States v. Borders) involving multiple vehicles that were stolen and later recovered. Timelines like this one helped show what happened to a particular vehicle, something that may have gotten lost otherwise.
IV. Practice Pointers
Creating a good summary is like developing a good witness. It takes time and preparation, it can be tedious and sometimes painful, and it can pay off.
Here are some pointers for creating good, effective summaries for trial:
Think of questions that data and documents might be able to answer. Can the data corroborate a witness’s account of how the scheme worked? Can data from the defendant or someone else contradict the defendant’s statements or promises? Can the data tell you when a scheme peaked or collapsed, suggesting turning points that can be useful to explain at trial? Are there flaws in the data or documents that can show the larger scheme (e.g., a defendant who is automatically billing for services not actually rendered will be revealed by occasional “mistakes,” such as billing for visits performed on patients who were actually dead or out of town).
Build a database based on a targeted review of voluminous records. When reviewing documents, do not count on finding a “smoking gun.” Cases can be made with the little details that you have to look for and aggregate. If you have boxes of documents to review, find a few things to track or add up, and start recording the data. Create a template for the investigative team to use, test it out, track something, and collect the results in a table or spreadsheet.
Start counting, tracking or contrasting something with draft charts. Some useful computer programs that you can use are Microsoft Excel or Microsoft PowerPoint for charts, tables or graphs, or Lexis TimeMap or PowerPoint for timelines (and there’s always paper!). If you need help setting up formulas, meet with a financial analyst and explain the kinds of things you are trying to do (your office’s fiscal or accounting people generally should be familiar with Excel and might be able to help out as well). Your initial drafts may not work out, or may reveal data that is helpful but not clear enough to be worth using at trial. Step back and think of another way to look at the data from your database. Go back and track something else if necessary.
Make the charts clear and legible for a general audience. Trials typically are not the place for complicated graphics based on complex formulas or for logarithmic scale. Make charts that convey a lot of information while being based on simple principles that a jury will be able to follow, and make sure the charts are legible to jurors looking at them from some distance. I generally make charts first in Microsoft Excel and then copy the chart over to PowerPoint where I can have more control over how the charts will look on the screen or when printed out.
Remember what the evidentiary rules allow and do not allow. There are three federal evidentiary rules that lawyers can use to admit charts, and charts can differ in tone and use based on the particular rule being used. Charts admitted under Rule 1006 are substantive evidence and can go back to a jury for deliberations, and generally should be non-argumentative. Charts allowed under Rule 611(a) or Rule 703 generally may be less neutral in presentation because they are viewed “more akin to argument than evidence.” Such charts cannot go back to a jury during deliberations.
Here’s a table to summarize the law regarding charts:
Show your work. In a bank robbery case, simply saying that the defendant confessed is okay, but it is better to first give the details that help the jury figure that out for themselves. Similarly, it is okay to show a chart making your final point, but it is better to show your work and allow the jury get there themselves. Before I summarize claims data or other records, I typically have a witness go through some specific examples first. This can help establish the credibility of the summary and avoid confusing cross-examination.
Think about when you are going to admit your summaries at trial. Data can corroborate insiders when they describe a scheme, but consider flipping this around. If the summarized data goes in first, then the jury might actually understand the scheme better and have better context for the witnesses’ testimony. In health care fraud cases, presenting the defendant’s own files to highlight implausible patterns may be a great way to start the trial. This can leave jurors with doubts about the defendant’s practice and sets up the testimony of witnesses whose testimony might otherwise be confusing or out of context.
Consider ways to ensure that your charts get admitted at trial. Provide the underlying materials to defense counsel as part of discovery, and provide some charts to defense counsel as early as possible, even if they are in draft form. Consider providing the underlying spreadsheets with the formulas used to create the charts. This is by no means required, but can avoid issues that might endanger admission at trial. Consider offering to meet with defense counsel to explain any methodologies ahead of trial. Also, consider filing motions with draft charts ahead of trial to avoid last minute problems.
Finally, do not wait until trial to start thinking about what summaries might be useful at trial. If you wait until trial to make your summary charts, you may never get to trial because you might never even get the case charged. Taking the time to do a summary chart during the investigative phase unfolds can open new leads and new questions that can shape your case and even accelerate an investigation. Summary charts can corroborate witnesses and can help convince defendants to plead guilty. Embracing this kind of approach early on can help you simplify and transform your cases.
Good luck!
Stephen Lee was an Assistant United States Attorney in Chicago from 2008 through 2019 and served as senior counsel to the healthcare fraud unit in the U.S. Attorney’s Office for the Northern District of Illinois. He is now in private practice in Chicago as a solo practitioner focusing on health care fraud, data analytics, and white-collar criminal defense. This article is a revised version of an article that was originally published in the U.S. Attorney Bulletin in 2018 and that contains additional references and examples.
