W. Va. Code R. § 149-7-6

Current through Register Vol. XLI, No. 49, December 6, 2024

Section 149-7-6 - Initial Law Enforcement Officer Response

6.1. Approaching the scene.

6.1.a. The law enforcement officer should obtain all available information from the dispatcher before arriving at the scene and should notify the dispatcher upon arrival.

6.1.b. Unless the circumstances of a particular incident require different measures, the law enforcement officer should follow the approach procedures set out in the remainder of this section. The law enforcement officer should:

6.1.b.1. Approach the scene inconspicuously. The law enforcement officer should not use sirens or lights in the immediate area of the scene of the incident;

6.1.b.2. Park away from the immediate scene of the incident;

6.1.b.3. Keep a safe exit route in mind;

6.1.b.4. Be alert for the employment of weapons from doors, windows, or nearby vehicles;

6.1.b.5. Be alert for persons moving away from the immediate scene of the incident; and,

6.1.b.6. Employ other standard precautionary measures for approaching high risk incident scenes.

6.2. Initial contact.

6.2.a. The responding law enforcement officer should identify himself or herself, explain the law enforcement presence, and request entry into the residence or business. The law enforcement officer shall ask to see the person who is the subject of the call. The law enforcement officer shall not reveal the caller's name.

6.2.b. Complete a report on all incidents where a reporting party or victim alleges another person violated stalking law

6.2.c. In some exigent circumstances, forced entry is necessary and appropriate. Exigent Circumstances include but are not limited to:

6.2.c.1. The residence area shows signs of a fight or scuffle;

6.2.c.2. When a person from inside the residence calls for assistance or is yelling;

6.2.c.3. When the law enforcement officer has reason to believe that the person is wounded, injured, or is otherwise in need of assistance;

6.2.c.4. When the accused is suspected of concealing the victim;

6.2.c.5. When the call came from the residence and the victim is identified as the caller and entry is denied by others present on the scene; or

6.2.c.6. When the officer has articulable suspicion that absent immediate entry serious bodily injury or death may result.

6.3. Establishing control of scene.

6.3.a. Once at the scene of the incident, the responding law enforcement officer should establish control by:

6.3.a.1. Identifying and securing potential weapons;

6.3.a.2. Separating the victim and the accused when circumstances are appropriate;

6.3.a.3. Inquiring about injuries (including inquiry about possible internal injuries), administering first aid, and notifying emergency medical services as necessary;

6.3.a.4. Identifying all occupants and witnesses on the premises; and

6.3.a.5. Separating occupants and witnesses from the victim and accused and keeping them out of hearing range (to avoid compromising their witness status).

6.4. On-scene investigation.

6.4.a. The law enforcement officer shall conduct an investigation using the same procedures that the law enforcement officer would use in any other on-scene criminal investigation. While conducting the investigation the law enforcement officer shall attempt to establish the existence of credible corroborative evidence. The law enforcement officer shall make specific note of and document all statements made by the victim, accused and all witnesses, particularly those statements that may be admissible as evidence as exceptions to the hearsay rule such as excited utterances, present sense impression and statements made for medical treatment. The law enforcement officer shall also determine if such statements were made to the dispatcher and take appropriate measures to secure and preserve such evidence.

6.4.b. The law enforcement officer should ensure the victim's safety and privacy by interviewing the victim in an area apart from the accused, witnesses, and bystanders if possible.

6.4.c. In questioning the victim, the law enforcement officer should use supportive interview techniques. The law enforcement officer should ask the victim about previous stalking or similar incidents. Determine the frequency and severity of the stalking or similar incidents. Determine if they are domestic in nature. The law enforcement officer should not tell the victim what action the law enforcement officer intends to take until all available information has been collected.

6.4.d. The law enforcement officer should interview and record, if possible, the victim and any witnesses (including all child witnesses) as fully and as soon as circumstances allow, taking down names, addresses, and other relevant information. When interviewing the victim and any witnesses (including all child witnesses) law enforcement officer should determine whether the victim and any witnesses (including all child witnesses) allege facts that constitute all of the elements of stalking. If so, the law enforcement officer should inquire whether the victim and any witnesses are willing to sign a statement containing those facts. The law enforcement officer should also inquire about past abuse and past behavior or other crimes to aid the law enforcement officer in evaluating the dangerousness of the accused. The law enforcement officer should proceed with the investigation even in the absence of a statement from both a victim and any witnesses (including child witnesses).

6.4.e. The responding law enforcement officer should interview and record, if possible, the accused as fully as circumstances allow inquiring about the nature of the incident. The law enforcement officer should be alert to possible incriminating statements.

6.4.f. In cases where the accused or victim does not speak English, law enforcement officer should use a neutral interpreter when possible. Officers should use caution when using family and friends and especially children, to provide interpreter services.

6.4.g. In the collection of evidence and taking of statements, the law enforcement officer shall protect the constitutional rights of the accused in accordance with current laws and statutes of the state of West Virginia and of the United States.

6.4.h. Children should be interviewed in a manner appropriate to the child's age. If the law enforcement officer has reasonable cause to suspect that a child is neglected or abused or observes the child being subjected to conditions that are likely to result in abuse or neglect, the law enforcement officer shall immediately report the circumstances to Child Protective Services (CPS).

6.4.i. The law enforcement officer should solicit information as to the possible whereabouts of the accused (place of employment, relatives, friends, etc.). The law enforcement officer should make reasonable efforts to locate and interview the accused as to any statements or evidence they may wish to provide prior to arrest or obtaining a warrant.

6.4.j. The law enforcement officer shall collect and preserve all physical evidence reasonably necessary to support prosecution, including contact made through electronic devices, logs kept by the accused, witness accounts, officer observation, etc. All physical evidence shall be collected, noted in reports, and vouchered as in other criminal investigations.

6.4.j.1. Electronic Evidence Collection

6.4.j.1.A. Digital Forensics is the recovery of evidence from various electronic and magnetic media such as computer hard drives, compact disks, digital cameras, memory cards, cellular telephones and mobile devices to retrieve information of probative value stored or transmitted in digital form. Precautions must be taken in the collection, preservation, and examination of electronic evidence. Handling the evidence at the crime scene normally consists of the following steps:

6.4.j.1.A.1. Recognition and Identification

6.4.j.1.A.2. Collection and Preservation

6.4.j.1.A.3. Packaging, Transportation, Storage and Submission for Analysis

6.4.j.2. Recognition and Identification of Electronic Evidence

6.4.j.2.A. Computer systems typically consist of data storage devices, a display, keyboard, and mouse. These can be in the form of a laptop, desktop, tablet, or smart phone. Evidence is found in files that are stored on hard drives, storage devices and removable media.

6.4.j.2.B. Removable media is any device that can be connected to a computer for storage but is not part of the computer itself. This includes memory cards, flash drives, external hard drives, recording devices, and access control devices (dongles, smart cards, and biometric scanners). Memory cards can be as small as a human fingernail and flash drives can easily be disguised as other objects such as pens, pocket knives, and lighters. These devices can store the same files found on computer systems.

6.4.j.2.C. Digital cameras are recording devices for images and videos. These devices can have internal storage and contain memory cards. Electronic evidence stored within the camera can only be obtained if the camera is powered on, and therefore chargers should be collected along with these devices. Potential evidence includes images, videos, and date and time stamps. If memory cards are present, any files that can be recovered from removable media can be present.

6.4.j.2.D. Answering machines are electronic devices that store voice messages from callers. Some models use a magnetic tape while others use an electronic digital recording system. Since batteries have a limited life, data could be lost if they fail. Appropriate personnel should be informed that a device powered by batteries is in need of immediate attention. Caller identification information, deleted messages, and dates and times of recordings are all potential evidence that can be collected here.

6.4.j.2.E. Telephones can include but are not limited to: landlines, cable, VOIP, satellite, and cellular telephones. Call history can be obtained from telephones including date and timestamps and caller identification. Cellular telephones can store small amounts of data such as text messages and calls. Cellular telephones can be more advanced like smart phones and can store the same information as a computer. Data may be lost if batteries die, so finding and securing power cables is essential.

6.4.j.2.F. Mobile devices such as personal digital assistants (PDAs), portable media players or electronic organizers have the same capabilities of a computer and smart phone. These may have special cradles or cables to connect to a computer which should be collected with the device. Limited battery life in these devices can cause data loss if they fail, so finding and securing power cables is essential.

6.4.j.2.G. Other types of electronic evidence include pagers, digital watches, floppy disks, disks, business video surveillance, CD-ROMs, and GPS devices. Pagers can hold address information and contact history. Digital watches can store email information and address books. GPS (global positioning systems) can hold points of interest, travel logs, and address books.

6.4.j.3. Collection and Preservation of Electronic Evidence

6.4.j.3.A. The search for and collection of evidence at an electronic crime scene may require a search warrant or consent from the owner. Recognize that other types of evidence such as trace, biological, or latent prints may exist. Follow your agency's protocol regarding evidence collection. Destructive techniques (e.g., use of fingerprint processing chemicals) should be postponed until after electronic evidence recovery is done.

6.4.j.3.B. Items relevant to subsequent examination of electronic evidence may exist in other forms (e.g., written passwords and other handwritten notes, blank pads of paper with indented writing, hardware and software manuals, calendars, literature, text or graphical computer printouts, and photographs) and should be secured and preserved for future analysis. These items frequently are in close proximity to the computer or related hardware items.

6.4.j.3.C. Computer evidence, like all other evidence, must be handled carefully and in a manner that preserves its evidentiary value. This relates not just to the physical integrity of an item or device, but also to the electronic data it contains. Certain types of computer evidence, therefore, require special collections, packaging, and transportation. Consideration should be given to protect data that may be susceptible to damage or alteration from electromagnetic fields such as those generated by static electricity, magnets, radio transmitters, and other devices.

6.4.j.3.D. Multiple computers may indicate a computer network. Likewise, computers located at businesses are often networked. In these situations, specialized knowledge about the system is required to effectively recover evidence and reduce your potential for civil liability. When a computer network is encountered, contact the forensic computer expert in your department or outside consultant identified by your department for assistance.

6.4.j.3.E. Collection of Computer Systems

6.4.j.3.E.1. Record in notes all actions taken and any observable changes in the display, computer, printer, or other peripherals that result from actions taken.

6.4.j.3.E.2. Observe the display and determine if it is on, off, or in sleep mode. Then decide which of the following situations applies and follow the steps for that situation.

!Situation 1: Display is on and work product or desktop is visible.

!Action: Photograph screen and record information displayed.

! Proceed to Situation 3

! Situation 2: Display is on and screen is blank (sleep mode) or screen saver (picture) is visible

!Action: Move the mouse slightly (without pushing any buttons). The screen should change and show work product or request a password.

! If the mouse movement does not cause a change in the screen, DO NOT perform any other keystrokes or mouse operations.

! Photograph the screen and record the information displayed.

! Proceed to situation 3.

!Situation 3: Display is off.

! Make a note of the "off" status.

!Action: Turn the monitor on, then determine if the monitor status is as described in either situation 1 or 2 above and follow those steps.

6.4.j.3.E.3. Regardless of the power state of the computer (on, off, or sleep mode), FIRST remove the power source cable from the computer THEN remove from the wall outlet. If dealing with a laptop, in addition to removing the power cord, remove the battery pack.

6.4.j.3.E.4. Photograph and label the connections of the computer and the corresponding cables.

6.4.j.3.E.5. Record or log evidence according to your departmental procedures.

6.4.6.3.F. Collection of Other Electronic Devices

6.4.6.3.F.1. Electronic devices, such as the ones in the list below, may contain potential evidence associated with criminal activity. Unless an exigent circumstance exists, the device should not be operated. Should it be necessary to access information from the device, all actions associated with the manipulation of the device should be documented to preserve the integrity of the information. Special attention should be given to the following devices:

6.4.6.3.F.1.(a). Wireless mobile devices should be removed from the wireless networks. Ways to do this can include: removing the battery or placing the cellular telephone in a Faraday bag/container or wrap the device in three layers of aluminum foil and place the device in an empty metal paint can. Data from cellular telephones can be transferred onto computer systems so these systems should be collected. A preservation order should be sent to cell phone providers to preserve call logs, subscriber information and text messages. A subpoena must be served to obtain these records and a search warrant is necessary for any content.

6.4.6.3.F.1.(b) GPS devices should be turned off to prevent potential evidence from being overwritten.

6.4.j.4. Packaging, Transportation, Storage, and Submission

6.4.j.4.A. Actions taken should not add, modify, or destroy data stored on an electronic device, computer or other media. Computers are fragile electronic instruments that are sensitive to temperature, humidity, physical shock, static electricity, and magnetic sources. Therefore, special precautions should be taken when packaging, transporting, and storing electronic evidence.

6.4.j.4.A.1. Packaging procedure:

6.4.j.4.A.1.(a). Ensure that all collected electronic evidence is properly documented, labeled, and inventoried before and after packaging.

6.4.j.4.A.1.(b). Pay special attention to latent or trace evidence and take actions to preserve it.

6.4.j.4.A.1.(c). Pack magnetic media in antistatic packaging (paper or antistatic plastic bags). Avoid using materials that can produce static electricity, such as standard plastic bags.

6.4.j.4.A.1.(d). Avoid folding, bending, or scratching computer media such as diskettes, CD-ROMs, and tapes or other types of external storage devices.

6.4.j.4.A.2. Transportation procedure:

6.4.j.4.A.2.(a). Keep electronic evidence away from magnetic sources. Radio transmitters, speaker magnets, and heated seats are examples of items that can damage electronic evidence.

6.4.j.4.A.2.(b). Avoid storing electronic evidence in vehicles for prolonged periods of time. Conditions of excessive heat, cold, or humidity can damage electronic evidence.

6.4.j.4.A.2.(c). Ensure that computers and other components that are not packaged in containers are secured in the vehicle to avoid shock and excessive vibrations.

6.4.j.4.A.3. Storage procedure:

6.4.j.4.A.3.(a). Store evidence in a secure area away from temperature and humidity extremes. Protect it from magnetic sources, moisture, dust, and other harmful particles or contaminants.

6.4.j.4.A.3.(b). Potential evidence such as dates, times, and systems configurations may be lost as a result of prolonged storage. Since batteries have a limited life, data could be lost if they fail. Therefore, appropriate personnel should be informed that a device powered by batteries is in need of immediate attention.

6.4.j.4.A.4. Submission procedure:

6.4.j.4.A.4.(a). Complete a Forensic Laboratory Case Submission Form, WVSP-53, completely.

6.4.j.4.A.4.(b). Remove all internal hard drives from desktop computers or towers. The hard drive(s) need to be removed from the computer before submission. Complete laptops will be accepted, however, since special techniques may be required to remove the hard drive. If you should need guidance in removing hard drives from a desktop or laptop computer, contact a digital forensics analyst for more information.

6.4.j.4.A.4.(c). Mobile phones should be turned off and the battery removed. If the phone is locked, include an unlock code if possible.

6.4.j.4.A.4.(d). List, on a separate sheet of paper, a brief description of the case, evidence sought, and a list of keyword search terms relative to the case if appropriate. Names, aliases, screen names, e-mail addresses, and any other pertinent information should be included.

6.4.j.4.A.4.(e). The West Virginia State Police Digital Forensic Unit (WVSP DFU) is the entity available to all law enforcement agencies in the state for technical assistance and evidence processing:

Morgantown Laboratory

Morgantown, WV 26505

Huntington Laboratory

Huntington, West Virginia 25701

6.4.k. The law enforcement officer shall also document and report the victim's state of mind to show a level of fear for their safety or significant emotional distress. Items to document include but are not limited to whether the victim:

6.4.k.1. Moved to a new location

6.4.k.2. Obtained a new phone number

6.4.k.3. Put a tap on the phone

6.4.k.4. Told friends, coworkers, security, etc. about the stalking

6.4.k.5. Changed work schedules or route to work

6.4.k.6. Stopped visiting places previously frequented

6.4.k.7. Taken self-defense classes or purchased self-protection items, i.e. pepper spray

6.4.k.8. Installed an alarm system

6.4.l. The law enforcement officer should encourage the victim to seek medical attention for injuries that do not require emergency treatment at the scene. The law enforcement officer should inquire about injuries of the victim that are concealed by clothing or otherwise not readily apparent. The law enforcement officer should advise the victim to have photographs taken if injuries appear later.

6.4.m. The law enforcement officer may conduct surveillance on the accused.

6.5. Advising the victim.

6.5.a. The law enforcement officer should advise the victim about:

6.5.a.1. Personal safety orders or protective orders of protection

6.5.a.2. Contact information for local victim advocacy or other services

6.5.a.3. The Law Enforcement Officer's pertinent information

6.5.a.4. How to document incidents surrounding the alleged stalker including but not limited to:

6.5.a.4.A. Keeping a diary with all contact attempts, dates, times, and details of the incident and witnesses to the incident.

6.5.a.4.B. Contacting the service provider to have them document any contact.

6.5.a.4.C. Securing and preserving emails or text messages or other contact made through electronic devices.

6.5.b. The law enforcement officer should advise the victim to:

6.5.b.1. Stop all contact with the alleged stalker.

6.5.b.2. Prepare for their safety by:

6.5.b.2.A. Having emergency numbers ready.

6.5.b.2.B. Keeping a reserve of necessities ready such as: a suitcase, money, medication, clothes, and children's items.

6.5.b.3. Report EACH incident of stalking to your local law enforcement agency.

6.5.b.4. Not let third parties other than law enforcement intervene with the alleged stalker.

6.6. Enforcing any orders or bail conditions.

6.6.a. To determine the existence of a personal safety order, ask the victim whether there is a valid personal safety order in effect. If so, the law enforcement officer should ask the victim if he or she can produce a copy of the personal safety order. If the victim cannot produce a copy of the personal safety order then the officer should attempt to verify the existence of an order by accessing, if applicable, the statewide protective order database, NCIC, and identifying the issuing county and court. The law enforcement officer shall enforce all orders. Where the respondent has been served with the personal safety order or has actual notice of the personal safety order, then the law enforcement officer shall follow the arrest authorization provisions as set forth in this rule.

6.6.b. If a law enforcement officer determines that an otherwise valid personal safety order cannot be enforced because the respondent has not been notified of or served with the order, the officer shall inform the respondent of the content of the order and make a reasonable effort to serve any available copy of the order upon the respondent. The officer shall allow the respondent a reasonable opportunity to comply with the order, such as vacating the premises, surrendering firearms, etc. Once the officer has notified or served the respondent, and the respondent fails to comply with the order, the officer shall enforce the order.

6.6.c. If the officer makes verbal notification, the officer shall notify the respondent of the following minimum mandatory relief:

6.6.c.1. Order the respondent to refrain from abusing, harassing, stalking, threatening or otherwise intimidating the petitioner, or engaging in other conduct that would place the petitioner in reasonable fear of bodily injury.

6.6.c.2. Inform the respondent that the order is in full force and effect in every county of this state.

6.6.d. The law enforcement officer shall document the notification in writing to the circuit clerk's office.

6.6.e. Verbal notification does not relieve the agency or officer from serving the order.

6.6.f. If the victim is aware of pending criminal charges against the accused and bail conditions, the law enforcement officer should verify such information by contacting the local law enforcement department specified by the victim or the issuing court to verify the conditions of release on bail and initiate the proper proceedings.

6.6.g. The law enforcement officer shall enforce all personal safety or similar type orders that have been issued by a circuit judge, family court judge or magistrate of this state, and from courts of another state, territory, or tribe.

6.6.h. Whether or not an arrest is made, the responding law enforcement officer should not leave the scene of the incident until the situation is under control and the likelihood of immediate violence has been eliminated. The law enforcement officer should stand by for a reasonable period of time to ascertain safety of surroundings and while victims or other persons desiring to leave gather necessities for short-term absences from residence, such as clothing, medication, and necessary documents.

6.6.i. Notwithstanding the issue of violation of the state law, the crossing or causing the crossing of a state line or territory or tribal boundary to violate a valid personal safety order is a violation of state law and should also be referred to federal authorities.

6.7. Missing Persons Investigation; Stalking

6.7.a. A law enforcement agency, under WV Code § 48-27-601, shall initiate a missing persons investigation if the agency:

6.7.a.1. Has possession of a valid personal safety order, or has notice of the existence of a personal safety order which is in effect, or has been expired for a period of less than thirty (30) days, and receives a report that a person protected by the order has been reported missing; or,

6.7.a.2. Receives information that at the time of disappearance the missing person was subjected to stalking,

6.7.b. An agency or department shall not have a policy delaying the beginning of an investigation of a missing person, which meets the criteria outlined in this subsection.

6.7.c. The investigating officer cannot release the whereabouts of the alleged missing person, if found, without expressed consent of that person.

W. Va. Code R. § 149-7-6