Document Detectives Help Hunt Anthrax Terrorists

One by one the letters arrived in Florida, Washington and New York. They bore New Jersey postmarks, neatly printed but nonexistent return addresses, and a powder that proved to be anthrax, a bacterium that can cause agonizing death if inhaled. One person died, and dozens were infected.
 
If police, federal agents and postal authorities succeed in tracking down the sender(s) of these guided missives, they will require another type of detective to find evidence linking them to the deadly envelopes.
 
Using techniques pioneered in the nineteenth century along with technology so new that it's still evolving, sleuths called questioned document examiners will attempt to match the handwritten words on the envelopes with known examples of the suspects' writing. They will analyze ink and paper to determine their origins and perhaps link pen and paper to any suspect. And they will peer into invisible realms to ascertain if the anthrax mailer might have written something else on top of the envelopes he or she mailed. 
 
Most document examiners work for government agencies, but others are in private practice. One of this unsung profession's landmark cases involved the so-called Mormon Will, purportedly handwritten by the mysterious, reclusive Howard R. Hughes.  Dated March 19, 1968, it was three pages long, written on yellow legal tablet with the tops ripped off, and delivered along with two envelopes and a brief note to the Clark County, Nev., courthouse by an emissary of the Church of Jesus Christ of Latter-day Saints. While the will earmarked most of the money for well- known charities, one bequest was startling: Melvin Dummar, owner of a Gabbs, Nev., gas station, was to receive one-sixteenth of Hughes' $2.5 billion estate.
 
The so-called Mormon Will was just one of 30, most hilarious or pathetic, delivered to the court after Hughes died in 1976, supposedly without leaving a will. Unlike the others, it acquired a quick veneer of authenticity when a "handwriting expert hired by a television network peered at the lined paper under a magnifying glass and pronounced it "absolutely genuine." Lawyers representing Hughes' heirs, however, hired John Harris, the legendary founding member of the American Board of Forensic Document Examiners, who soon determined that, like the others, it was a fake.  Charities that stood to reap megabucks from its bequests nevertheless went to court repeatedly to assert the will's legitimacy. Because Hughes was such a famously improbably character, the incident inspired a Hollywood move, "Melvin and Howard," and the Mormon Will remains among the most famous forgeries.
 
Disputed documents are far from rare: Virtually every day in America, someone goes to court to challenge or defend the authenticity of a will, check, credit-card receipt, ledger, contract, power of attorney, bill of sale, deed, medical record, insurance policy, lease, diary or other paper record. Questioned document examiners-the term dates to the early 19th century--are experts employed to authenticate disputed papers. Some are primarily handwriting specialists. Others are particularly adept in the use of laboratory equipment to detect forgery, including analyzing and dating of ink, paper, typewriters, computer printers, faxes and photocopiers, and in revealing erasures and alterations. A tiny cohort of the profession assesses the linguistic or literary qualities of writings as a way of determining authorship.
 
The art of authenticating a single document can involve an array of techniques, from the almost primitive (handwriting analysis) to such advanced technologies as lasers and carbon dating.
 
In North America only a couple of hundred qualified examiners are in private practice. To succeed they must have patience and encyclopedic memories. Other useful traits are a suspicious nature and an appreciation of the criminal mind: If there is a way to fake a document, someone will find it.
 
Most examiners deal with handwriting and hand printing, typewriting comparison and authentication of legal documents. Some specialize in verification of anonymous letters, disguised writing, the detection of erasures, and alterations o disturbance of paper fibers.
 
One such professional is Howard Rile of Long Beach, Calif. He learned his trade as a Colorado police examiner and mastered it under the tutelage of Jack Harris, now retired. Rile notes that while many cases involve forgeries, a great many of the documents he sees are genuine.
 
Wills are among the most commonly disputed papers. Rile recalls one scribbled scrap of paper that began with:

loaf whole wheat
pound sugar
coffee regular grind
eggs
I hereby bequeath my home and its contents to (her grandson).
My other real estate goes to [a nephew] And my stock- holdings are for [a sister]
bacon
laundry detergent
flour
pepper
 
"It was a genuine document," Rile chuckles. "Now, whether or nor the elderly woman who wrote it was of sound mind-that's not a question for a document examiner."
 
Documents are often valuable evidence in the courts. The primary reason that people turn to document examiners is to verify signatures. "That's the bulk of what I do," says Howard Rile. "Here we are in the 21st century, still trying to prove that a person actually signed a piece of paper."
 
 Part of a document examiner's job is educating clients, most of whom are attorneys. "The legal profession still doesn't have a clue about how technology is affecting evidence," Rile says.. For example, he notes the "widespread and naive assumption that a photocopy is a reliable copy of a missing original. Yet it's incredibly easy to manipulate photocopies--at least three techniques can be used and only one, cut-and-paste, sometimes leaves evidence of manipulation." Examiners sometimes prove that a document came from a certain photocopier by analyzing the pattern of tiny dots left by random bits of dirt on rollers, photosensitive drum and glass.
 
"We can discredit a signature on a photocopy, but neither I nor anyone else can say for sure that it's a true copy without the original to compare it with," he adds. "A variant of this is faxes."
He cites a recent case trying to determine the authenticity of a signature and eventually disproved its legitimacy by determining the brand of fax machine used. "The people who presented the document asserted that it came from one of three types of machines," he explains. "(In my experience) it's generally not known, but the information at the top of each page is created by the sending machine. Particular fonts may be unique to a particular brand." Accessing a research database, Rile was able to prove that the fax did not come from one of the three machines. "That tended to discredit the document," he says.
 
To compare questioned signatures with proven exemplars, Rile often works from huge photographic enlargements. On a workbench covered with costly, esoteric devices, such as an infrared-sensitive video display for identifying ball-point pen inks, is a faded wood box--a 75-year-old camera, still used to enlarge signatures. "We sometimes use color photos, but otherwise this is exactly the kind of work that was used in the Lindbergh (kidnapping) case in the '30s," he explains.
 
Most document examiners constantly update their technological expertise. One who has made the leap from the archaic world of typewriters to the latest computerized printing devices is New York's Peter Tytell, who grew up in a family of document examiners. At the 1982 tax-evasion trial of the Rev. Sun Myung Moon in New York, Tytell's mother, Pearl, testified that papers showing ownership of some $1 million weren't produced until a year past their dates. Peter's 86-year-old father, Martin, is a leading authority on typewriters, learning the intricacies of the machines in his father's repair shop. At 11, Peter worked on his first document, one of his father's cases, by counting the times a certain letter appeared on each page. At 55, he has been examining documents for more than 40 years.
 
When the New York Post ran a Page One enlargement of a letter accompanying "Unabomber" Theodore Kaczynski's manifesto in 1995, it caught Tytell's eye at the newsstand. "I took a paper and handed the dealer a dollar," he recalls. "Before he made change, I knew what the letter had been written on, and the year that this model was manufactured." The FBI later confirmed it.
 
When an attorney was accused of over-billing, Tytell examined his time sheets. He found that entries were made by the same typewriter, which had been repaired after the penultimate entry. "One character--the hyphen--had been resoldered. After that, it hit the paper a tad higher," he explains. Examining other time sheets, Tytell saw the same pattern: early entries with drooping hyphens, late ones by the repaired machine. "The problem was that most of the late entries bore dates that were months or even years before the repair," he laughs.
 
Tytell once tracked down the designer of a laser-printer type font to show that the apostrophe character appearing on a questioned lease was not yet available on the date it was signed. So the landlord had added a new clause, then used the original printer with updated fonts to make a new document that he claimed was the original.
 
"Many of the investigative principles developed for typewriters can be used for laser printers and other modern devices," says Tytell. "For example, marks made on paper edges as they feed through a printer can often be matched to individual machines."
 
Miami's Linda Hart also has met the past in the present. In reviewing Dade Registrar of Voter signatures she encountered citizens who had continued to exercise their franchise long after their obituaries were published. "Apparently dead men do vote in Miami," she sighs, pointing to several forgeries. In the 25 years since she left her position as a U.S. postal investigator to become an independent document examiner, Hart has investigated many forensic mysteries. While much of her work involves distinguishing individual handwriting characteristics to identify authorship, she also employs other techniques to verify claims.
 
"Recently I was asked to date bearer bonds offered as collateral for a million- dollar loan," she explains. Issued by three Latin American companies and bound into three books, each bore the date when the respective company was founded, a 24-year span between oldest and newest enterprise. Hart probed paper, inks and printing processes, but after days of toil, could not determine when they were printed.
 
Then she observed that one book bore diagonal striations along its unbound edges, the marks of an industrial paper cutter. "When the guillotine blade drops, any burrs or nicks create a distinctive pattern in the paper," she explains. "I stacked all three on top of each other and looked at them under focused fiber-optic light. The marks were identical. Since every blade develops tiny defects over time, it was plain that all three books had been cut by the same blade at the same time--and that made them fakes."
 
It can't be easy living with such a good spy. Not long ago Hart noticed erasure marks on her son's school attendance record. When confronted, the boy confessed that he'd changed the number of absences because he didn't want his parents to know he'd ditched a day.
 
Like other examiners, Hart draws on a host of resources. One weapon in her forensic arsenal is a device invented by Scotland Yard in the 1950s. The Electrostatic Detection Apparatus reveals faint impressions left in paper by writing on the sheet above it. In the fiction of espionage, secret agents burnish the paper with a soft pencil to create a negative of the imprint. The ESDA accomplishes this without altering the original by creating an electrostatic field on the paper. When fine particles of ink are sprinkled across it, they create a permanent record of the latent impressions.
 
Jerry Brown, who heads the Iowa Department of Criminal Investigations Laboratory, worked as a criminalist supervisor and document examiner for many years. He once used an ESDA to examine an anonymous note threatening Pope John Paul 11 during his most recent visit to the United States. In this case, the criminal mind wasn't operating on all cylinders. Impressions from the sheet above revealed a letter to the writer's mother. "At the end of the page he gave Mom his new address and phone number," chuckles Brown.
 
The constituents of paper often tell tales. Diane Tolliver, a 29-year veteran document examiner at the Indiana State Police Laboratory in Indianapolis, had a case involving a lawyer charged with embezzlement for cashing a check intended for his client. "The lawyer admitted taking the money, but offered a power of attorney granting him check-cashing authority," says Tolliver. Her microscope examination of the watermark, a faint, translucent impression embedded in the expensive bond paper's fiber during manufacture, revealed a code enabling the paper maker to prove the sheet had been manufactured months after the document was dated. "No way it's genuine," concluded Tolliver. A jury agreed.
 
The most esoteric specialty among forensic document examiners involves linguistics, the critical, qualitative and comparative analysis of language within a document. Maybe half a dozen experts practice this art in North America, one of whom is Professor Gerald McMenamin of California State University, Fresno. "A writer's choice of words, use of punctuation, spelling, grammar and sentence structure reflects his class and education," McMenamin explains. "Among the more educated, there are fewer differences," he adds, noting that these disparities often betray claims.
 
McMenamin recalls a case involving a man accused of molesting a child. Reviewing an unsigned letter to the victim an comparing it with other samples of the man's writings, he spotted an oddity: While writing in English, the man sometimes used Latin grammatical constructions such as "Your friend loyal." McMenamin attributes this to the man's education. "He grew up speaking Bengali, learned to speak English in India, then spent several years … studying Latin," explains McMenamin, whose insight was used to confirm the suspect's identity.
 
McMenamin has traced many offenders to their writing through such oddities as distinctive punctuation The text of a bomb threat, for example, contained an extra space after commas, and added two after semi- colons and periods. "When I examined one suspect's other writings, I found the same pattern," McMenamin says. Once able to focus on this suspect, police uncovered further evidence that led to a conviction. "Some who learn English as a second language may use unusual phonetic spellings," he continues. "A woman who grew up speaking Spanish was angry at her boss. She sent (anonymous) typewritten letters to several co-workers, each attributing disgusting behavior to the supervisor. In each she used the phrase, 'A beseen ya,' meaning 'I'll be seeing you.' The writer also sent a letter to herself, which is very common in this kind of case. Police never found the machine used to write the letters, but when I read her personal letters, all handwritten, several contained exactly the same phrase," McMenamin notes. Confronted with this and other similarities between her private letters and the missives to her co-workers, the woman confessed.
 
McMenamin once examined threatening letters that had been produced on an anonymous word processor. He noted that one suspect's business correspondence always contained exactly four paragraphs and used "boilerplate" topic sentences, with phrases such as "I have enclosed" and "I wanted to follow up." McMenamin found the same format and phrases in each offending letter. The findings became part of a case of circumstantial evidence that prosecutors used to obtain a conviction.
 
In one of McMenamin's more unusual cases, an Oregon man murdered his wife and disposed of her body in the Columbia River wanted police to believe that she had been abducted by a mysterious Canadian. He sent authorities a ransom note in which he effectively disguised his handwriting but still left clues. "People speaking aloud may imitate an Irish accent for a few sentences, but they can't keep it up. The same is true when they try to fake a writing style," says McMenamin. "For example, the husband spelled 'color' like a Canadian, 'c-o-l-o-u-r,' but he used American spellings everywhere else. I took that for a red herring."
 
In the page-and-a-half document, McMenamin found 60 "style markers"-deviations from standard usage. Among them: "to late" (for too late), "bossiness" and "confidentuality." "That was a very high number of markers, and it allowed me to demonstrate conclusively that the husband had written the letter." A jury agreed.
 
In addition to the anthrax-contaminated letters mailed to news organizations and lawmakers following the September 11 attack on the World Trade Center, since 1998 more than 200 abortion and family-planning clinics in the U.S. have received letters containing white powder and threatening notes. All proved to be hoaxes. The handwriting, paper and ink of these threatening notes, however, have given law enforcement document examiners a trove of valuable evidence.
 
Despite new methods of creating documents and a shift to email for much personal and office correspondence, the venerable document examiner remains in the forefront of efforts to apprehend and convict those who mail terror.
 
© 2011 Marvin J. Wolf