Topic 2.

CONDUCT OF CRIME SCENE INVESTIGATION

Introduction
This topic focuses on the procedures to be followed/ conducted by the first responder and the
SOCO Team, their responsibilities, the checklist to be filled up by the first responder and the SOCO
Team and Procedures in the investigation of heinous and sensational crimes.

OBJECTIVE
This aims to inform the student about the procedures to be followed/ conducted by the first
responder and the SOCO Team, their responsibilities, the checklist to be filled up by the first responder
and the SOCO Team and Procedures in the investigation of heinous and sensational crimes.

LEARNING OUTCOME
At the end of this topic the student will:
1. Learn the procedures to be followed/ conducted by the first responder and the SOCO Team and
their responsibilities.
2. Learn how to fill up the checklist in the conduct of crime scene investigation.
3. Learn the procedures in the investigation of heinous and sensational crimes.

Lesson 1. RULE 22. CONDUCT OF CRIME SCENE

INVESTIGATION
The Crime Scene Investigation (CSI) starts from the
arrival of the PNP First Responders (FRs) to the arrival of the
Duty Investigator/ IOC and the SOCO Team until the lifting of
the security cordon and release of the crime scene.
22.1 Specific Functions, Responsibilities and Procedures of
the First Responder, Investigation On-Case (IOC) and
SOCO
The following are the functions and responsibilities of
the investigators during the crime scene investigation, as well
as the procedures to be observed:

a. First Responder (FR)

The four main tasks of the first officer on the scene are:
 To give first aid;
 To apprehend the suspected offender;
 To protect and if necessary collect and preserve
evidence; and
 To cordon off and protect the area.
1.1 First Officer on the Scene shall
a. Give first aid. Immediately request for assistance from medical experts.
b. Decide whether a crime has been committed.
c. Apprehend the suspected offender. Take into account possible entry points, route of escape or
hiding place of perpetrator.
d. Write down the names of all the persons at the crime scene and where they can be contacted in
the next few hours. Remove them from the scene.
e. The FR shall take the dying declaration of severely injured person/s, if any. Requisites of a “Dying
Declaration” are:
(1) That death is imminent and the declarant is conscious of that fact;
(2) That the declaration refers to the cause and surrounding circumstances of such death;
(3) That the declaration relates to facts which the victim is competent to testify to; and
(4) That the declaration is offered in a case where in the declarant’s death is the subject of the inquiry.
f. Do not let anyone enter the crime scene area. This applies to police officers too unless they
have some special reason for being there. Exception: First aid measures.
g. Inform the police officer responsible for deciding (COP/PD) on who is to carry out the
investigation and call in reinforcements to the scene.
h. If shots have been fired, secure any evidence of primer particles (gunpowder residue) on the
hands.
i. If any person has been taken to hospital, see to it that a police officer is sent to the hospital to
take the necessary measures.
` j. Cordon off a sufficiently large area around the crime scene while waiting for reinforcements.
k. Protect the crime scene from alteration.
 l. Make a note of the measures that are taken and the persons who enter the crime scene. Also
make a note of the times of important events and observations.
m. Photograph and if appropriate video record the crime scene and the adjacent area, including
people hanging around the scene.
n. The First Responder shall be responsible for the control of the crime scene until the arrival of
the designated investigator-on-case who shall thereafter assume responsibility of the crime scene.
1.2 Life-saving measures
Life-saving measures must be taken immediately if there are any signs of life on any of the
victims and/or suspects. This must be done even if a crime is suspected and the measures lead to loss of
evidence.
1.3 Apprehension of suspects/s
Apprehend the suspected perpetrator In the case of a recent incident; measures must be taken to
apprehend the perpetrator if possible. All the people at the crime scene should initially be asked for any
information that may be of help. If information is forthcoming in the form of description, escape route etc.
action should be taken accordingly and the information passed on to the local or regional operation
centers. It should always be borne in mind that persons at the crime scene who claim to be witnesses may
in fact be involved in the incident itself.

2. Crime Scene Security and Preservation Protect and collect evidence

The main duty of the first responder is, after giving first aid if necessary,
2.1 To protect the scene.
Protecting and collecting trace evidence involves a number of different measures that will vary
from one scene to another. The first responder should primarily protect the crime scene and preserve
evidence and, secondly, collect evidence that might otherwise be destroyed. One important measure when
it comes to ensuring that evidence is not lost is to avoid contamination.
2.2 Avoid contamination
When two objects come into contact there is always a
risk of contamination, i.e. exchange of materials between
them. The objects do not even have to be in contact, since
materials such as fibers and hair may be suspended in the air.
The best way of avoiding contamination at the initial stage is
to leave the crime scene untouched. The persons involved, for
example victim and suspect, must on no account be allowed to
enter the crime scene and must always be kept apart. Such
persons should be dealt with by different police officers and transported in different vehicles. If it is
necessary to recover something at the crime scene, this must always be done by an officer who has not
been in contact with the persons involved. Contamination must be avoided throughout the material
handling chain, from collection at the crime scene to the examination in the laboratory. The following
rules should be followed to avoid contamination:
 Never let suspects and victims be in the same room or be transported in the same car (not even
at different times).
 Use protective clothing (overalls, caps, gloves and disposable shoe coverings) when entering a
crime scene and collecting trace evidence (hair, fibers, blood, secretions, small particles etc.).
 Plan out the gathering of on-scene evidence such that each specific source is handled separately,
if possible. As such, one person should carry out the crime scene investigation; another should examine
the suspect‟s clothes, car etc., a third- the suspect himself, a fourth- the victim, etc.
 Cars should preferably be examined on site.
 If a car must be moved, it should be towed. Avoid using the seats. If that is unavoidable, use
protective clothing. If the car must be driven, the only person in it should be the driver, who should wear
protective clothing. A list of the clothes worn by the driver should be given to the investigating officer.
Cordons The purpose of cordons is to make sure that unauthorized persons do not enter the crime scene.
Guarded cordons are always the best. The area should be cordoned off with tape or rope and warning
signs should be put up. Make sure that the cordoned off area is sufficiently large. (It is better if the area is
sufficiently large).
 Do not allow witnesses or suspects to return to or enter the crime scene. Persons at the
scene who are to be questioned should be taken to separate premises in the vicinity and
kept apart from each other, since they may, for example, have valuable information or
evidence on their bodies that must be transmitted to other persons. Persons taken to
hospital If any involved person (suspect or victim) has been taken to hospital, a police
officer should go the hospital immediately and take the following measures:
 Seize/retrieve the persons clothes and put all pieces of clothing in a separate paper bags
properly marked as to the time/date and place of retrieval, and description of contents.
  If the clothes have been taken off, question the hospital staff on who took off the persos clothes
and what has been done with them.
 Make sure that all trace evidence on victim or suspect are collected and preserved.
 Make sure that suspects and victims are subjected for alcohol and drug test.
 If shots have been fired, request the PNP Crime Laboratory to conduct paraffin test in order to
collect primer particles/gunpowder residue from the persons hands.

3. Checklist for Initial Action of First Responders

# ACTIVITY YES NO
1 Life-saving measures (Give First Aid)
- Check for any signs of life
- Check for certain signs of death
2 Apprehend the suspected perpetrator
- In incidents that occurred very recently, apprehend the perpetrator immediately
- Conduct initial interview with all the people at the crime scene
- Ask about the escape route of the suspect/s - Pass on the information regarding
the escape route of the suspect to the local, provincial and regional police office
- Interview the witnesses or the person/s involved in the incident
3 Protect evidence
- Cordon off the crime scene with police line tape or rope - Guard the cordoned
areas
- Put up warning signs in the cordoned areas
- Ensure that the cordoned off area is sufficiently large
- Prevent unauthorized person from entering the crime scene
- Victim and suspect, must not be allowed to enter the crime scene
- Leave the crime scene untouched
- Preserve the evidence
- Victim/s and suspect/s must be kept apart
4 Collect the evidence (only if necessary as when evidence might otherwise be
destroyed)
- Avoid contamination
- Avoid any two objects/evidence from coming into contact
- Check for materials such as fibers and hair suspended in the air - Use protective
clothing (overalls, caps, gloves and disposable shoe coverings) when entering a
crime scene and collecting trace evidence
- One police officer should conduct the crime scene investigation
- Another police officer examine the suspect’s clothes, etc
- Other police officer accompany the victim
- Cars involved in the crime must be examined on site
- Cars must be towed if it should be moved to another place
- If these cars will be used, avoid using the seats or if possible use protective
clothing
- Keep a record of all activities and information
The checklists are only meant as a guide and not as a substitute for critical thinking. In some cases certain
items can probably be left out, while others must be added.

c. SOCO Team
1. Initial Phase of Investigation
The initial phase or the first 72 hours (“Golden
Hour”) of a major case such as murder or
kidnapping/abduction investigation (crimes of violence
investigation) is crucial. Since murder, homicide and
kidnapping/abduction are considered as either heinous or
sensational, the investigator-on-case shall immediately
request for technical assistance of the SOCO Team from
the local PNP Crime Laboratory Office thru the
City/Provincial Office Tactical Operation Center (TOC).
In instances where the investigator-on-case must collect the evidence himself as when it is about to be
destroyed or contaminated, he should similarly be guided by the checklist as contained in this Manual.
Only duly-trained investigators can process the crime scene.
Upon arrival at the crime scene the Investigator-on-Case makes a general assessment of the
scene, takes a cautious walk-through, jots downs notes to extensively document/record important factors
and establishes the evidence most likely to be encountered. He then defines the extent of the search area,
and determines personnel, organization and equipment needed to make specific assignments. From his
assessment, he develops a general theory of the crime scene to set his plan in motion.
The investigator needs speedy and continuous reports on the incident as well as on the results and
course of determined actions. There are a lot of initial information to be clarified and assessed in order to
survey the situation and to create bases for priorities and directions:
a. When, where and why did it happen?
b. Who is the victim?
c. Possible motive/s?
d. How did the perpetrator gain entry into the crime scene and how did he flee the scene? When?
e. Is the perpetrator to be found among a selected few?
f. Could any specific individual be suspected? Why?
g. Is there a description of the perpetrators? Accomplices?
h. Is there any information on vehicles used?
i. Is there anything missing from the crime scene or from the victim?
j. Did the perpetrator leave anything behind through which he could be traced?
k. Are there any other incidents, occurrences, circumstances or observations that could be
connected with the crime?
l. Determine if the particular area is the primary crime scene or is it just the finding place and the
crime happened in some other place? If so, secure the primary crime scene.

2. Investigator’s Checklist Section

The PNP Criminal Investigation Manual provides that the Scene of Crime Operation (SOCO)
specialists of the Crime Laboratory shall be requested in cases where the crime scene needs special
processing due to its significance or because of its sensational nature.
A crime of violence is a significant /sensational case and shall therefore require the services of the
SOCO Team. The investigator-on-case must, however, remain at all times responsible for and in-charge
of the crime scene and shall always be present during the whole SOCO operations to provide the
necessary support as well as oversee the processing. The investigator-on-case shall conduct interviews
and gather as much information as he can at the crime scene. This information could be critical in guiding
the SOCO Team on which areas to focus in the collection of forensic evidence.
It is also imperative that whenever a crime of violence or any other major or sensational crime
occurs that an On-Scene Command Post (OSCP) be immediately established adjacent to the crime scene.
Among others, the OSCP will be to provide a safe and secured area where the Evidence Custodian may
be located to receive evidence and where other operational and administrative activities may be
undertaken.
Investigation’s Checklist:
# ACTIVITY YES NO
1 Who received the report of the incident?
How was it received?
When was it received (time)?
2 Who reported the incident?
Name, address: Phone number.
Where the concerned could be reached in the near future.
3 Factual information.
What happened; Time, place?
Circumstances surrounding the incident?
Is the suspect identified?
Weapons?
4 Initial measures undertaken:
Date, time
Responsible officer
5 Initial measures undertaken:
Date, time
Responsible officer
6 Logbook?
7 Measures undertaken by the first officer arriving at the scene?
a. Murder: (body still on the scene)
- Post-mortem changes
- Algor mortis (blood circulation stops)
- Livor mortis (body cools down) - Rigor mortis (Body becomes rigid)
- Life-saving measures?
 Is it the scene, the primary crime scene or finding place?
b. Murder: (body brought to hospital)
- Officers immediately ordered to proceed to the hospital?
- Seizure of the victim‟s clothes?
- Interviews with attending hospital staff
- Who brought the body to the hospital
- How has clothing been handled
- Presence of wallet - Mobile phone - ID-card - Other items etc.
- If shots have been fired, paraffin casting of the person‟s hands for extraction
of gunpowder residue
c. Kidnapping/Abduction:
- Accurate description of the kidnapped person?
- Accurate description of all circumstances around the abduction?
- Collection of dental records, x-ray pictures?
- Collection of medical records, x-ray pictures?
- Seizure of DNA-carrying items (toothbrush, safety razor, combs)?
- Fingerprints?
- Comparison samples from relatives (preferably mother)?
- Photos?
- Flash alarm?
d. In all cases:
- Cordon off a sufficiently large area around the crime scene, taking into
account perpetrator‟s potential hide-out, ports of entry and departure?
- Ensure protection of the cordoned off crime scene and secure evidence that
could be destroyed by external factors?
- Record or take note of everyone who enters the crime scene.
- Notes of bystanders?
- Make a documentation of the crime scene (photo or sketch)?
- Make a description of the surrounding area of the scene (dwellings, shops, bus
stops, restaurants etc., security guards, pulis “OYSTERS”, etc.).
- Take note of license numbers of parked cars in the vicinity/area (potential
witnesses)?
- Check for Presence of CCTV - Mobile phone?
8 Crime scene examination:
- Outcome of proceedings (protocol)?
- Documentation (photos, videos, sketches)?
- Collected samples?
- Further forensic investigations?
- Results?
- Prudence of early decision to lift cordons?
9 Organizational set-up:
- Structure? SITG?
- Allocation of resources (reinforcements)?
- Officer-in-charge? - Priorities and directions?
- Tasking?
- Documentation?
- Daily briefings?
- Contingency plans? Media relations (monitoring and collection of articles, and
other media coverage of the incident)?
10 Alert other police stations and units in the adjacent areas?
- Routines?
11 Immediate measures to track down and apprehend the perpetrator?
- Check-points etc.?
- Employment of canine?
- Flash alarms?
12 Canvassing operation (house- to- house) around the crime scene and the route
of escape?
- Prepared templates with battery of questions?
- Comparison materials (cars, colors, etc.).
- Interviews?
13 Other initial measures:
- Secured CCTV footages?
 - Interview of people on the spot?
- Treatment of witnesses and family of the victim?
- Request of lists of mobile communications in the area during critical time
(mobile phone operators)?
- Interviews with ambulance staff or other people bringing the body from the
scene (if victim was alive did he say something?).
- If victim alive at hospital and under treatment, presence of investigator?
- Man hotline?
- Other incidents connected to the case at hand?
- Contact with prosecutor?
14 Post- mortem examination and autopsy?
- Cause of death?
Collection of evidence?
15 Identification and profiling of the victim:
- Identity established (how)?
- News of the death to relatives?
- Interviews with relatives, neighbors, friends, colleagues, employers etc.
- Any items missing?
- Indications that the victim belonged to target groups of extra-legal killings
(activists, journalists, trade unionists or farmers‟ representatives)?
- Search in database and computer files?
- Examination of incoming and outgoing phone calls from landlines and mobile
phones?
- Examination of bank accounts, credit cards and insurance status?
- Previous convictions or suspicions of crimes? Affiliations, threats, plausible
motives?
16 House search at victim‟s dwelling and other premises, cars, etc?
- Seizure and analysis of computers,
- Mobile phones,
- Pagers, diaries,
- Photos,
- Letters,
- Receipts,
- Balance sheets etc.
17 Second wave measures generated from item 1 – 16?
- Interviews with identified key persons?
- Identified prime crime scene (if finding place)?
- House searches and seizures?
- Detailed and extended search outside of the crime scene
- Analysis of phone lists?
- Search in database and computer files regarding similar cases (modus
operandi, including verbal modus)
- Vehicles
- Previous suspects of similar crimes etc.?
- Coordination?
18 Identification of suspect?
- Physical evidence?
- Eye witnesses (line-up, video, photo identification)?
- Composite sketches?
Flash alarm?
19 Witness protection?
20 Arrest of suspect?
- Tracking team (man-hunt)?
- Electronic surveillance devices?
- Plans for safe arrest (search in database, weapons, is suspect armed and
dangerous, etc.?
- Assessment (accomplices, witnesses around the suspect, alibis etc.?
- House searches (presence of SOCO)?
- Seizures and analysis?
- Body search (medical examinations)?
- If shots were fired (primers, gunshot residues)?
- Seizure of clothing?
 - Chain of custody (anti-contamination)? Media relations?
21 Interview with the suspect?
- Planning and preparation?
- Recording and documentation?
- Defense lawyer?

22 Reconstruction?
- Revisit to the crime scene with witnesses, suspect?
- Documentation? Presence of defense lawyer, prosecutor?
23 Structure of crime file/ records?
- Presentation of the findings and results
- Communication with prosecutor?
24 Re-evaluation of the investigation?
- Appraisal reports from involved officers?
- Feed-back from prosecutor?
Follow-up on pervasion through the system?
Remarks:
Recommendations:
The checklists are only meant as a guide and not as a substitute for critical thinking. In some cases certain
items can probably be left out, while others must be added.

b. Procedures to be conducted by the Investigator-on-Case (IOC)

1. Assume responsibility over the crime scene upon arrival.
2. Conduct assessment of the crime scene Organize and establish the On-Scene Command Post (OSCP) 3.
3. Conduct interviews and gather information. Jot down important facts and maintain record
4. Conduct Crime Scene Investigation.
5. Look for other witnesses Request for technical assistance in crime scene processing fm CL SOCO thru
the TOC Brief the SOCO Team Leader (TL) on the initial information gathered about the crime incident.
6. Documentation (Photography, Sketching note taking, videography)
7. Collection handling of evidence by SOCO or Forensic Investigator
8. Evaluate evidence and interrogation results at the Crime Scene Custody and Transport of pieces of
evidence by designated Evidence Custodian
9. Request laboratory examination of evidence as necessary
10. Examination of the recovered physical evidence by PNP Crime Laboratory SOCO
11. Ensure that appropriate inventory is maintained and provided.
12. Release or lifting of the cordon at the crime scene is accomplished only after completion of the final
survey and proper documentation.
13. Release of the crime scene shall be in writing with the notion that there is only one chance to perform
the job correctly and completely.

3. Procedure to be conducted by the SOCO Team of Crime Laboratory / Forensic Investigator

1. Coordinate with the Investigator-on-case (IOC)
2. Require written request for SOCO from the Investigator-on-case
3. Preparation prior to the conduct of SOCO
4. Crime Scene approach
5. Preliminary Crime Scene Survey by the SOCO Team Leader with Investigator-on-case
6. Narrative description of the Crime Scene
7. Crime scene photography/videography
8. Sketch of Crime Scene
9. Detailed Crime Scene Search
10. Physical evidence recording and collection
11. Collection and evaluation of physical evidence with the IOC
12. Brief the investigator-on-case on the result of the SOCO (for possible operational use).
13. Final Crime Scene Survey by the Investigator-on-case and SOCO Team Leader
14. Submit result of SOCO/Inventory of seized evidence to Investigator-on-case.
15. Certify conclusion of SOCO and lifting of cordon by the IOC.
22.2 Release of the Crime Scene
a. The IOC shall decide on the lifting of the security cordon and the release of the crime scene upon consultation
with the SOCO Team Leader and he shall be responsible in ensuring that all pieces of potential evidence have been
collected by the SOCO Team as any re-entry into the crime scene after its release to the owner will require a Search
Warrant issued by the Court;
b. The IOC shall accomplish the CSI Form “6” before the cordon shall be lifted c. The IOC shall ensure that the
appropriate inventory has been provided by the SOCO Team and shall only lift the security cordon and release the
crime scene only after completion of the documentation process;
d. The IOC or the COP shall turn-over the crime scene to the owner of the property or where the crime scene is a
public place, to any local person in authority using CSI Form “5”
e. The IOC shall accomplish and submit the Investigator’s Report with all the required attachments to the COP
within two (2) working days from the date of incidence; and
f. The CSI Report shall be the fi rst entry in the Case Folder for the investigation of the incident.
Lesson 2. 22.3 Special SOCO Procedures
In cases where the evidence gathered needs special processing due to signifi cant or sensational cases, the specialists
from the Crime Laboratory shall be requested.
a. In bombing cases, the EOD personnel should fi rst clear the area and declare it “secured” prior to entry of the
SOCO. The former, before entering the crime scene must submit to the latter for swabbing. All evidence collected
must be pre-cleared by the EOD prior to documentation.
b. In suspected or reported chemical, biological, radiological or nuclear (CBRN) situations, the SOCO shall directly
coordinate with the Special Rescue Team of the Bureau of Fire and Protection before the conduct of the crime scene
investigation.
c. In mass victim situation, the Regional/District SOCO who has jurisdiction over the area, in addition to their
function, shall act as the FR to the Interim Disaster Victim Identifi cation Task Group (IDVI TG) of the PNP Crime
Laboratory. The IDVI TG shall immediately assess the forensic specialists needed to be deployed at the crime scene
and relay the requirements to the PNP Crime Laboratory Headquarters.
d. The SOCO has motu proprio authority to direct all operating units involved in the police operation to submit their
respective personnel for forensic examination; their service fi rearms for ballistic tests; and other pieces of evidence
involved to expedite the investigation of the case.

Lesson 3. 22.6 Policy Guidelines on Processing of Persons Present at the Crime Scene
These policy guidelines prescribe the operational procedures in processing and handling persons present at the crime
scene; be they the suspects, victims or witnesses. The aim is to clearly defi ne police courses of actions in dealing
with persons who, for any reason and personal circumstance, are at the crime scene during the conduct of police
operation.
a. Crisis Management
As soon as the perpetrators surrender, or when they are captured or neutralized, the On-Scene Commander shall
ensure that the following are accomplished:
(1) Processing and Debriefi ng:
(a) Hostages/Victims;
(b) Perpetrators;
(c) Witnesses; and
(d) Key participants in the incident.
(2) Documentation. Sworn Statement of the following:
(a) Witnesses;
(b) Hostages;
(c) Perpetrators; and
(d) Key participants in the incidents.
(3) Venue of Processing, Debriefi ng and Documentation.
Considering the instability of the situation; the safety of the responders and persons found at the scene of the crime;
and the preservation of the place of incident, the venue of the processing, debriefi ng and investigation shall be at a
neutral and secured place.
b. Hostage Negotiation
The following procedure shall be followed during a Hostage Situation:
(1) Crisis Management Task Group shall be activated immediately;
(2) Incident scene shall be secured and isolated;
(3) Unauthorized persons shall not be allowed entry and exit to the incident scene; and
(4) Witnesses’ names, addresses, and other information shall be recorded. Witnesses shall be directed
to a safe location.

Lesson 4. RULE 23. PROCEDURES IN THE

INVESTIGATION OF HEINOUS AND
SENSATIONAL CRIMES
The SITGs (Special Investigation Task Group) shall
spearhead and coordinate the investigative and prosecutorial
efforts of the PNP to facilitate the speedy resolution and
successful prosecution of heinous/ sensational cases to include
the conviction of the perpetrators.
23.1 Policies
a. Institutionalization of Command Responsibility at all levels
of the organization shall be highly observed.
As such, the respective Commanders/Supervisors in whose
areas of jurisdiction the heinous/sensational
crimes transpired are expected to personally and effectively manage their SITGs by closely monitoring, supervising,
directing, coordinating, and controlling the overall activities of their subordinates. Hence, SITGs shall be created as
follows:

Composition and Organization of SITG:

(1) Regional Level (To investigate killings and violence committed against Senators, Congressmen,
Governors, Cabinet Secretaries, Undersecretaries, and SC and CA Justices):
SITG Supervisor - Regional Director
SITG Comdr - DRDO
Asst Comdr - DD/PD or CD, CPO
Spokesperson - Regional PIO
Members - RCIDU
- Regional Intelligence Div
- Regional Legal Offi ce
- Regional Crime Laboratory
- COP, CPS/MPS/Station Comdr
- RIDMD
- Investigator–on-Case

(2) PPO/District/CPO Level (Killings and violence committed against Vice Governors, Provincial
Board Members, Mayors, Vice Mayors, Judges, Prosecutors & IBP lawyers, militants, media practitioners, foreign
nationals)
SITG Supervisor - Deputy Regional Director for Operations (DRDO)
SITG Comdr - DD, PD/PF, PPO/CD, CPO Asst Comdr - PO/Field Offi cer, CIDT Spokesperson - PIO
(District/PPO/CPO)
Members - Provincial/City Legal Service
- Provincial/City Intelligence Section
- Provincial Crime Lab
- RIO
- PIDMB/CIDMB
- Investigator-on-Case
- Chief of Police
b. Whenever a heinous or sensational crime transpires, SITG shall be immediately organized and be headed by the
concerned District Director/Provincial Director/City Director or the Deputy Regional Director for Operations
depending on the gravity of the incident and/or upon order/discretion of the CPNP.
c. It shall be the responsibility of every established SITG to properly manage the assigned case and ensure its
resolution by applying the best investigative techniques/ practices and utilizing all its available resources.
d. CIDG shall assume the responsibility of pursuing the investigation when the case is not solved within six (6)
months and already classifi ed as a cold case.

23.2 Organizational Procedures

a. Whenever a serious crime is committed, the concerned Chief of Police (COP) or Station Commander shall
immediately assess the situation and communicate to the DD/PD/CD the attendant circumstances and its updates
which will be the basis of the DD/PD/CD for recommending to the RD whether or not there is a need to activate the
SITG.
b. Concerned COP or Station Commander shall base his/ her assessment and recommendation on the report of the fi
rst responders and his assigned investigatoron- case. The creation of a SITG is not necessary for crimes that can be
resolved at the said level. Otherwise, a District/PPO/CPO level SITG shall be organized that will take cognizance of
the investigation of heinous and sensational cases initially investigated by the City/ Municipal/District Police
Stations.
c. The Regional Director (RD) shall issue orders organizing the District/PPO/CPO SITG, indicating the ranks and
names of its personnel complement. It shall be headed by the territorial Chief/Commander/Head of Unit such as the
District Director/Provincial Director/City Director:
(1) The SITG shall be composed of Investigation Team, Case Record Team, Technical/Legal Support
Team, Admin/Logistics Teams and Evidence Team;
(2) The Case Record Team shall be headed by an Offi cer from Investigation and Detective
Management Division/Branch /Section who shall be at the same time the Case Record Offi cer and the
Evidence and Record Custodian, responsible for the preservation of evidence;
(3) The Investigator-on-Case (IOC), who is part of the Investigation Team, shall gather and prepare
relevant documents for fi ling of appropriate case(s) in Court and serve as liaison with other law enforcement
agencies/government agencies, NGOs/NGAs, and other persons or entities which could possibly help the SITG
in the resolution of the case. The IOC shall also be the Evidence Custodian, except for pieces of evidence which
need to be submitted to Crime
Laboratory, the courts, and other technical agencies for technical Examination and analysis; and
(4) In cases where the designated Commander or members of the SITG cannot effectively comply
with the operational requirements, and/or has “perceived biases” of any kind, the RD shall immediately
reorganize the said SITG and designate other offi cers who are more capable of accomplishing the job.
d. Upon the creation of a SITG, a “Case Investigation Plan” must be made to serve as operating guidelines in the
conduct of investigation of heinous and sensational cases. This will include the journal of the case which pertains to
the daily progress on what has been done and accomplished in the investigation of the case, to include the minutes of
case conferences and coordination with other offices/units. This will also be the basis of funding the SITGs
activities. (Annex “Y”- CIPLAN)
e. The CPNP may direct/task any operational support unit of the PNP to assist in the investigation. Likewise, he may
also order the reorganization of the SITG as he deems it necessary.
f. The SITG shall be deactivated upon the solution of the particular case being investigated.
g. Every SITG shall have six (6) months to resolve a case from the time it takes cognizance of the said case.

23.3 Operational Procedures

The following are the operational procedures to be undertaken by the SITG pertaining to investigations of all
heinous/sensational crimes:
a. Investigation starts from the arrival of the First Responder on the ground who shall perform
important tasks as enumerated in Rule 22.1a;
b. Aside from the usual investigative procedures, the SITG shall immediately validate and confirm
the affi liations of the victims, issue press releases on a regular basis and establish an On-Scene
Command Post (OSCP) by putting up a tent or similar structures or deploying a Mobile Investigation Van
(if available) at/or near the crime scene. The SITG Commander or his deputy who is also a member of the SITG
must be present/available in the OSCP at all times;
c. The OSCP shall be maintained for as long as necessary and shall only be deactivated or
transferred with the clearance and approval of the Regional Director;
d. The OSCP shall be utilized by the SITG to conduct on-scene or on-the-ground investigation. The tent
or van of the OSCP shall be marked appropriately as “PNP On-Scene Command Post” and shall also be posted
with the mobile Phone or contact numbers of the SITG Commander, Assistant Commander and the Investigator-
On-Case;
e. The Police Station which has jurisdiction over the area shall be utilized as alternate OSCP of the
SITG;
f. Follow-up actions and efforts must be undertaken to:
(1) Give special focus to ascertaining/establishing motive;
(2) Effectively conduct profiling of victims, suspects and witnesses;
(3) Proficiently link/matrix analysis and exploit evidence information; and
(4) Hold paramount the convenience of witnesses when extracting their Statement or affi davit.
g. The SITG Commander supported by the Investigation Team, Technical Teams, and Case Record
Offi cer shall prepare the CIPLAN and take notice, prepare, and observe the following:
(1) The Investigation Management System which consists of evidence matrix, resource spreadsheet, standard tactical
plan, and major investigation plan;
(2) The CIPLAN must be prepared and shall be in the following format (Six Point Plan); Situation,
Mission, Execution, Contingency, Administration and Logistics, Command, and Communication (SMECAC);
(3) Prepare the Crime Scene Matrix Template which is necessary in the conduct of crime analysis. It can come in
tandem with the evidence and resource matrix of the investigation plan;
(4) Surveillance must also be done to assess and make decisions on competencies needed and allocation of
resources;
(5) Strengthen the coordinative mechanism in order to:
(a) Strictly observe the chain of custody of evidence and fl ow of communications; and
(b) Develop and resolve the issues under investigation through case conference/s with DOJ and other
concerned agencies.
(6) Initiate build-up and follow-up investigation;
(7) Consolidate all the forensic results, testimonial documents and investigation reports as well as the compliances
of the members of SITG;
(8) Initiate the crime matrix analysis in coordination with all members of SITG;
(9) Initiate the preparation of the case folder with the assistance of other members of SITG;
(10) File or refer the case to the Department of Justice (DOJ);
(11) Conduct case reviews (internal/external) to be done by senior investigators or detectives. It can be seen as a
form of risk management that seeks to apply the principle of system audit to reduce recurrence of typical errors.
Case reviews shall be in the form of:
(a) Informal “Golden Hour” Review (at the early stage of the investigation);
(b) Self Inspection (Self-Completion of a short pro forma to provide prompt actions and highlight
emerging problems);
(c) 28-Day Progress Review (assure quality and assist investigators identify investigative opportunities to
advance the inquiry);
(d) Concluding Reviews (provide overview), Case Development Reviews (Cold Case Review);
(e) Detective Case Review (review of their sample solve cases and learn best practices); and
(f) Thematic Review (focus upon specific issue);
(12) All case folders including pertinent documents must be kept by the case record officers, with copies furnished
to the evidence custodian of the local police station;
(13) In case the investigator-on-case is dismissed or retired or separated from the service, all remaining members of
the investigation team shall be responsible for the court presentation of the case; and
(14) Conduct case tracking until the final disposition of the case.
h. The extension of the SITG can be considered based on the manifestation of the Regional Director to TDIDM
(Attn: C, CMD) as a result of his/her evaluation that the case could be resolved in a certain period of time, but in no
case shall this exceed a one (1) month period;
i. If the case has been solved, the SITG shall be deactivated immediately. The SITG Commander shall inform
TDIDM (Attn: C, CMD) regarding its deactivation;
j. Once the warrant of arrest has been issued, the RIDMD concern shall monitor the Unit Commander concerned to
serve the warrant. Further, the RIDMD shall monitor the Unit Commander handling the case to ensure the
attendance of prosecution witnesses when directed by the Court or Prosecutor;
k. The RIDMD shall make a monthly progress report on all SITG cases fi led in Court or Prosecutor’s office to
TDIDM (Attn: C, CMD);
l. If the SITG fails to resolve the case within six (6) months or after the extension, the case will be considered a
“cold case”. Hence, the SITG shall be deactivated under obligation to ensure that all documents, pieces of evidence
and any other related materials are accounted and secured;
m. All the records of cold cases and cleared cases including the pieces of evidence gathered shall be officially turned
over to the Regional Criminal Investigation and Detection Unit (RCIDU), CIDG in the respective PROs for the
continuation of the investigation. Likewise, chain of custody of evidence must be strictly observed;
n. CIDG must submit to TDIDM (Attn C, RAD), a modified CIPLAN or new CIPLAN in the conduct of follow-up
investigations on all cases that were turned over to them.
o. Progress report on all “cold cases” that were turned over to CIDG shall be submitted to RIDMD (copy furnished
CMD, DIDM). The latter shall monitor and periodically evaluate the case being investigated by CIDG and make
appropriate assessment for its final disposition.
p. Strengthen the coordinative mechanism in order to:
(1) Strictly observe the chain of custody of evidence and flow of communications; and
(2) Develop and resolve the issues under investigation through case conference with DOJ and other
concerned agencies.
q. Initiate case build-up and follow-up investigation;
r. All the case folders including pertinent documents must be kept by the case record officers, with copies furnished
the evidence custodian of the local police station;
s. In case the investigator in-charge is dismissed or retired or separated from the service, all remaining members of
the investigation team shall be responsible for the court presentation of the case;
t. Conduct case tracking until the final disposition of the case;
u. All concerned PNP units are enjoined to exert extra efforts in order to identify, locate or cause the identification
and arrest of the culprit(s):
(1) They shall immediately organize a dedicated TRACKER TEAM to pursue a particular target
personality/suspect;
(2) They shall enhance information gathering and intelligence build-up for the identification and
apprehension of the suspects;
(3) They shall work in close coordination with the NBI, DOJ and all other law enforcement
agencies, as necessary. The SITG must therefore closely coordinate with their respective local
prosecutors and ensure that a prosecutor is included as a member of the Technical/Legal Support team;
and
(4) They shall prepare posters of wanted personalities especially those covered with rewards. Rogue
galleries at the city and municipal levels shall also be prepared for this purpose;
(5) While the tasked units shall operate on existing logistical and financial allocations, Regional
Directors shall also provide logistical and financial support to SITG.