Felonies and Misdemeanors

Felonies and misdemeanors are titled and defined by category in different ways from jurisdiction to jurisdiction. Examples of titles are Class A Felony, or Felony 1 or Felony in the First Degree; Class A Misdemeanor or Misdemeanor 1, and so forth. The terms can be misleading because, for example, a Class B Felony in one jurisdiction may be equivalent to a Felony 3 in another jurisdiction.

Also, the crimes in one category can be defined differently than crimes in another jurisdiction. For example, a felony that is named Murder One could be named Premeditated Murder in a different jurisdiction.

But generally speaking it is understood that a felony is more serious than a misdemeanor, and for that reason is punished more harshly than a misdemeanor. Punishment for the commission of a felony is imprisonment for one year or more or more than one year. Punishment for the commission of a misdemeanor is imprisonment for less than one year.

Elements of Proof

To prove a crime, the investigator must obtain evidence of the existence of certain facts. These facts are often called elements of proof. For example, the felony crime of arson has three elements:

·        Damage by fire or explosion;
·        The intentional act or destruction by the defendant knowing that it will damage a protected structure; and
·        Lack of the owner’s consent.

In this particular crime the protected structures can be:

·        Dwelling houses,
·        Buildings, vehicles, railroad cars, watercraft or other structures designed for use as dwellings,
·        Any structure that is insured against loss or damage by fire or explosive, and
·        Any structure that is damaged with the intent to defeat, prejudice or defraud the rights of a spouse or co-owner.

Seriousness is also a factor. Again, in the case of arson, the most serious form could be called First Degree Arson. Spelled out, a First Degree Arson could relate to damage of a structure under such circumstances in which danger to human life is reasonably foreseeable.

Second Degree Arson is less serious. It would be limited to structures not designed as dwellings, and the damage was done without intent to defeat, prejudice or defraud the rights of the owner.

Arson contains a key presumption; it is presumed that any burning is the result of accidental or providential cause, rather than of criminal design. At trial, the state must overcome this presumption. Because arson is usually accomplished by stealth, circumstantial evidence generally must be used to show both the guilt of the accused and the corpus delicti. Because arson cases usually rest in large part on circumstantial evidence, the factual patterns are so varied that it is difficult to find any common denominators. Nevertheless, certain types of factual circumstances are more persuasive than others. A factual circumstance might be the presence of an accelerant in arson debris.

Aggravated Assault

There are two components to the proof of any aggravated assault. First, the defendant must commit an assault. Second, the assault must be committed either:
·        With an intent to murder, to rape, or to rob,
·        With a deadly weapon, or
·        By discharging a firearm from within a motor vehicle toward another person without legal justification.

An assault with intent to murder, rape, or rob is a specific-intent offense. Specific intent would not be present in the following scenario: A man returns home and finds his wife in bed with another man. The husband goes into an immediate rage. He shoots and kills the other man. The husband’s action was the result of a sudden, violent, and irresistible passion resulting from serious provocation.

Let’s change the above scenario. The husband suspected that his wife was having an affair with another man. He hid outside the home with a gun in his possession. He watched the other man enter. He waited awhile before going in the home. He found his wife in bed with the other man and then shot and killed the other man. In this scenario, specific intent was present.

Intent to rape, when it is an element of aggravated assault, may be shown by circumstantial evidence. For example, a man gains entry to a woman’s home by pretending to be a repairman. Once inside, he demands that the woman submit to intercourse. She refuses, they tussle, and he leaves. Facts show that:

·        He pretended to be a repairman,
·        He gained entry to the home,
·        The woman had fresh bruises, and
·        She immediately called the police.

An essential element of aggravated assault on a peace officer is that the defendant knew the victim was a peace officer. Thus, the jury must be charged that knowledge is an essential element of the crime.

A person’s motive, intent, plan, scheme, bent of mind, or course of conduct can be demonstrated in several ways:

·        Conviction for a prior aggravated assault of a similar nature
·        Conviction for a prior sexual offense similar in nature to a charge of aggravated assault with intent to rape
·        A guilty plea to a prior voluntary manslaughter
·        Evidence of prior difficulties, threats, or confrontations against the particular victim, and
·        Where the victim is the defendant’s wife, evidence regarding the defendant’s marital separations and relationship with another woman

Defense of Property and Habitation


The owner of property or a person with a legal duty to protect the owner’s property is justified in using force or threatened force to prevent trespass, tortuous conduct or criminal acts. However, the use of deadly force to protect non-habitation property (an office building, for example) is not justified unless the actor reasonably believes it is necessary in order to prevent a forcible felony. This defense is not available to a spouse attempting to recover personal property taken by his estranged spouse.


The use or threatened use of force to protect a habitation (a home, for example) is justified when and to the extent that the actor reasonably believes that it is necessary to prevent or terminate an unlawful entry into or attack upon a habitation. The use of deadly force to protect a habitation, however, is not justified unless the actor reasonably believes that an entry that is made in a violent and tumultuous manner is attempted or made for the purpose of assaulting or offering personal violence to any person dwelling or being therein and that such force is necessary to prevent the assault or offer of personal violence, or unless the actor reasonably believes that the entry is made or attempted for the purpose of committing a felony therein and that such force is necessary to prevent the commission of the felony.

Deadly Force

The major limitation on the use of force in the defense of property is the rule against using deadly force (that which is intended or likely to cause death or great bodily harm) to protect non-habitation property where there is no apparent need to use such force to prevent a forcible felony.

Deadly force can be used in more situations to protect a habitation than in the defense of other property. Usually, the deadly force is justified:

·        If the entry defended against is made “in a violent and tumultuous manner” and the actor reasonably believes that the entry is being made for the purpose of assaulting someone or
·        If the actor reasonably believes the entry to be for the purpose of committing any felony therein. The actor must be acting under a reasonable belief that the deadly force was necessary to thwart the attack or felony. For example, a homeowner is awakened in the middle of the night by a stranger forcing entry into his home. If the homeowner has a reasonable belief that a felony is in progress or that harm may be done to him or his family, the homeowner is justified in using deadly force.

Disorderly Conduct Crimes

Disorderly conduct is a petty offense against public order and decency. Whether conduct violates or does not violate a disorderly conduct statute depends on the nature of the act and the surrounding circumstances. These crimes are often misdemeanors.


The crime of riot has three elements:

·        A shared intent among two or more people
·        To do an unlawful act of violence or some other act in a violent and tumultuous manner, and
·        A concert of action in furtherance of the intent.

Inciting to Riot

Encouraging others to riot is also a crime. To incite is to advise or urge others to riot under circumstances which create a clear and present danger.


The misdemeanor of affray has three elements:

·        Two or more people intentionally fighting
·        In a public place and
·        To the disturbance of the public tranquility.

Drug-Related Crimes

Controlled Substances Act

This Act contains five schedules of controlled substances each of which are similar in their potential for abuse, medical importance and level of safety.

Schedule I drugs have a high potential for abuse, have no currently accepted medical use in treatment in the United States, and there is a lack of accepted safety for use under medical supervision. Schedule I includes certain opiates, opium derivatives, and hallucinogens, including LSD, mescaline. peyote phencyclidine, and tetrahydrocannabinol (marijuana).

Schedule II drugs have a high potential for abuse, have currently accepted medical uses in treatment in the United States, and may lead to severe psychological or physical dependence if abused. Included in Schedule II are opium and opiates (including raw and powdered opium, codeine and morphine), cocaine, coca leaves, certain opiates (including methadone), stimulants (including amphetamine) and depressants (including amobarbital, secobarbital and pentobarbital).

Schedule Ill drugs have a potential for abuse less than those in Schedules I and II, have currently accepted medical uses in the United States, and may lead to moderate or low physical dependence or high psychological dependence if abused. Included in Schedule Ill are certain stimulants, certain depressants, substances containing limited narcotic concentrations, and anabolic steroids.

Schedule IV contains drugs with a low potential for abuse relative to the drugs in Schedule Ill, with currently accepted medical uses in the United States, and may, relative to Schedule Ill drugs, lead to limited physical or psychological dependence if abused.

Schedule V includes drugs with a low potential for abuse relative to Schedule IV drugs, with currently accepted medical uses in the United States, and, relative to Schedule IV drugs, may lead to limited physical or psychological dependence if abused. Substances with very limited narcotic concentrations are included in Schedule V.


Generally, there are three major homicidal offenses: murder, voluntary manslaughter, and involuntary manslaughter.


Murder is the killing of another human being with malice aforethought or during the commission of a felony.

Voluntary Manslaughter

Voluntary manslaughter is the killing of another human being resulting from a sudden and violent passion arising from a serious provocation.

Involuntary Manslaughter

There are two types of involuntary manslaughter:

·        A killing caused by the commission of a non-felonious unlawful act and
·        A killing caused by the commission of a lawful act in an unlawful manner likely to cause death.

Corpus Delicti

The single element common to homicidal offenses is the death of a human being. In these crimes, the corpus delicti, or body of the crime, very literally includes a body.

The second element of the corpus delicti is the existence of a criminal agency as the cause of death. This element is normally easily proven by circumstantial evidence of the body’s condition at the time of discovery. The court must be convinced that the circumstances exclude an inference of non-criminal homicide by natural causes, suicide, or accident.

The other element is that of causation. Because these crimes are all defined at least partially in terms of a particular result (the death), the linkage between the defendant’s behavior and the result of death of the victim is crucially important.


The crime of rape has three elements:

·        Carnal knowledge,
·        Force, and
·        Lack of consent.

Carnal knowledge is generally defined as “any penetration of the female sex organ by the male sex organ.” Any penetration, however slight, is sufficient to constitute this element. Other than penetration, the infliction of physical injury is not an element of the offense. Also, ejaculation is not an element.

A person who aids and abets in the commission of a rape is a party to the rape and may be charged and convicted of rape even though he did not actually have sexual intercourse with the victim.

Although force and lack of consent are clearly two separate elements, force can be proven if the defendant’s words or acts were sufficient to instill in the victim a reasonable apprehension of bodily harm, violence, or other dangerous consequences to herself or others.


Robbery in effect is a compound crime because it is a combination of larceny and assault. More particularly, it is the felonious and forcible taking of the property of another from his person, or in his presence, against his will, by putting him in fear.

The offenses of robbery and armed robbery have four separate elements. In both offenses there must be:

·        The intent to commit a theft,
·        A taking of property of another, and
·        The taking must be from the person or from the immediate presence of another.
·        The taking accompanied by force, which may be either actual force, intimidation, or a sudden snatching.

In the case of armed robbery, the force must be the use of an offensive weapon. Included within the notion of force is the requirement that the taking be against the victim’s will.

The Intent to Rob

Regardless of whether a defendant intended to take another’s property and withhold it permanently, his intent to take it for his own temporary use without the owner’s authorization evinces the intent to commit a theft. It does not matter that the defendant did not have the intent to commit a theft at the time he used force against the victim. Once he takes property belonging to the victim, he has committed the offense of robbery regardless of when his intent to take the property arose.

The Taking

The violent taking of money or property from the person of another by force or intimidation, without the consent of the owner, with the intent of converting the same to the use of the taker for the payment of a demand claimed to be due him by one from whom the money or property is so taken, constitutes the offense of robbery. The taker cannot under such circumstances justify the taking and be excused of the offense of robbery because the person from whom the money or property was taken was indebted to him, and that the taking was to pay the debt.

The slightest movement of property is a taking. Consequently, the taking element would be satisfied by evidence that the defendant temporarily took control of the money just before being apprehended for the robbery. Return of the property does not negate the taking element. It should also be noted that the taking element can be proven by circumstantial evidence.

The taking in an armed robbery is complete once control over the property is transferred from the victim to the armed robber. When the armed robber uses his weapon to force the victim to give up the property, he exercises complete control over that property. That his exercise of control is brief and ultimately unsuccessful is immaterial. Thus, the armed robber need not physically touch the property to complete the taking. Also, it is not necessary to prove the exact value of the items taken, but only to show that the items had some value.

Robbery is a crime against possession, and is not affected by concepts of ownership. Thus, one may be charged with robbery even when the object of the intended theft is contraband, in which the victim could have no legitimate property rights.

Force in a Robbery

The modus operandi of robbery focuses on the force or violence displayed by the robber, rather than on any resistance or violence on the victim’s part. Force implies actual personal violence, a struggle, and a personal outrage committed upon the person of the victim which precedes the defendant’s nonconsensual taking of the property.

Although the assailant has custody of an item pursuant to the victim’s consent, possession of the item does not change to the assailant until the victim, by means of violence, has been dissuaded from seeking its return. That being so, it is the force which affects the taking.

Intimidation is a form of force. Robbery by intimidation is not a lesser included offense of robbery by force, but rather a different method of committing robbery. The intimidation must take the form of a threat, coercion, or placing the victim in fear of immediate bodily injury to himself or to another.

Sudden snatching is also a form of force. This theory of “force” is satisfied where the victim is relieved of some possession so quickly that he does not have time to react, even though he is aware of the taking.

Armed robbery is distinguished from robbery by the requirement that the force element be satisfied by use of an offensive weapon. The offensive weapon must be used prior to or contemporaneously with the taking.


A person has committed theft when he has:

·        Unlawfully taken or misappropriated or carried away
·        The property of another
·        With intent.

For a taking to be unlawful, it must be without the permission of the owner or other person in lawful possession. Because theft by taking is a crime against possession, a property owner may be guilty if he takes the property out of the lawful possession of another who has a lien or security interest in the property.

A second element is “asportation” or “carrying away.” This element is usually easily met as it has been held that a theft is completed when there is an asportation, however slight. Also, the concealing of property is sufficient asportation to satisfy this requirement.

A third element requires that the property taken be that of another. Lawful possession of property is sufficient, for the purposes of theft by taking, to make the property in question the property of the victim. Sometimes, but not always, the theft by taking offense will include an intent to permanently deprive the owner of the taken property.


The following procedural articles are free and yours to use as on-the-job aids.If used for any other purpose, you may be in violation of our copyright.

Body Language

​“Actions speak louder than words” is an expression used in many contexts and is particularly applicable in the context of interviewing and interrogating. We use the term “body language” when referring to body movements that occur in response to a fear-inducing question. A deceptive person, i.e., a person hiding the truth, will experience physiological changes resulting from fear of detection.  

 A rise in blood pressure and respiration, contraction of the bowels, and release of adrenaline are physiological changes which in turn trigger body language signals, such as sweating, lip wetting, twitching, finger and toe tapping, crossed arms, hunched shoulders and eye avoidance. Verbal signals are possible as well: “It sure is hot in here” or “I must have eaten something bad this morning.”

Strong signals are sent through speech. The content of speech can be significant but much greater significance can be attached to the manner of speech. How something is said can be more revealing than what is said.

The body language of an innocent person will reflect outrage as opposed to fear; verbal signals might include statements like “This is insane” and “I don’t have to put up with this nonsense.”

In a pure sense body language is made up of nonverbal signals. They include any reflexive or nonreflexive movement of a part of the body or all the body. Three assumptions are made:

  • A deceptive person will harbor fear of detection
  • Skillful questioning will intensify fear
  • Fear will provoke physiological changes

A deceptive person has a general fear of investigation. When the investigation calls for questioning, the fear increases. A deceptive person’s immediate anxieties are directed toward questions that present the greatest threat to exposure. In other words, a guilty person's fear of detection increases as questioning proceeds from the general to the specific.

The deceptive person will tune in on questions that indicate trouble or danger. Sensory organs will be anticipating a particular line of discussion, creating a tendency to tune out low-threat questions and tune in on questions that can lead to exposure.

An investigator unschooled in the nuances of body language will misinterpret the signals. A glance, a smile, and a raised eyebrow are signals but each can have different meanings when they appear in different contexts. A smile in one circumstance may reveal pleasure; in another it might mean cynicism or disbelief.


Body language and spoken language are nearly always intertwined. A comment made without a body signal has a lesser meaning than a comment accompanied by a gesture. In the very simplest sense, a promise to punch you in the nose is more threatening when it is accompanied by the waving of a clenched fist.

Research indicates there are no more than about 30 traditional American gestures, with even fewer body postures that carry any significance, and that each gesture or posture will occur in a limited number of situations.

Eye Signals

The eyes are rated the most revealing body part; they transmit important signals and do so in ways ranging from extreme subtlety to unmistakable clarity. While the eyeball itself reveals little, the muscles around the eyes reveal a great deal. Much can be learned from a raised eyebrow or a squint, provided we understand the context. A very important eye signal is the stare. From a suspect under interrogation it could mean, again depending on context, disbelief, anger, or defiance. From the interrogator to the suspect, a stare could be saying, “I am waiting for your answer and I’m getting impatient.”

The stare is a cultural taboo. No one likes being stared at. It is very normal to stare at a painting, a dog, or the Moon, but it is neither normal nor acceptable to stare at a fellow human being. The cultural aspect of the stare confers to it special status.

Body Signals

A body language signal is like a word in a sentence. The true meaning of the word cannot be established without knowing all the other words in the sentence. Like words, body language signals are sent in groups, and the sending is a response to a stimulus. Knowing the stimulus, reading the set of signals, and understanding the context are parts of the interpretive process.

Executive Protection

An executive protection program is a component in many venues: business, government, entertainment, sports, wealth, royalty, and crime. The protected person can be a prominent businessman, government leader, movie star, sports star, billionaire, king, or head of a Mafia family. The protected person can be someone that feels the need to be protected, even when the need does not exist.

 In this article the protected person is the chief executive officer (CEO) of an organization. The organization can be a business corporation, government department, non-profit organization, or foreign government. For that reason, and for simplicity, we will use the term CEO when referring to the protected person. If your job is to protect a movie star, think movie star when you read CEO.

We have chosen the business venue because that is where you will find a CEO, and we will use the term program when referring to the executive protection program. However, not all organizations have a security director or even a security staff. Organizations lacking a capability to provide executive protection services must go outside the organization to obtain a person capable of performing those duties. The private investigator is a good choice.

Substitute private investigator for security director when you encounter the term, and place yourself in that person’s shoes. Also think in terms of being the member of a team formed to provide protection.

Terrorist threats aimed at U.S. business leaders have created an ever-increasing demand for executive protection services—services that a private investigator is well-qualified to provide.

Program Elements

Not every organization will provide out-of-the-ordinary protection for the CEO. This is so because:

  • The organization’s Board of Directors sees no need for it
  • The CEO sees no need for it or refuses to accept it
  • The threat is believed to not exist or is perceived to be at such a low level that a program is not merited
  • The cost of a program is not affordable

 A program can be small and simple, large and complex, or somewhere in between. The nature of the threat confronting the CEO determines the nature of the protection program. As the threat level rises, so must the capability of the program.

The protection elements in a small program can consist of guards at the office building and an alarm system in the home. The program enlarges as duress alarms are installed in the executive suite, a security officer is the receptionist at the suite entrance, and secretaries are trained to look for and react to danger.

At the home, exterior lighting is added and a security patrol passes by several times during hours of darkness.

A comprehensive program can have all the previous plus a driver and an automobile for local commuting. The driver is skilled in bodyguard tactics, escape driving, use of a firearm, and administration of CPR and first aid. The vehicle is resistant to bullets and explosives and has capabilities for quick acceleration, high speed, and tight cornering. The CEO's home has a controlled gate at the entrance to the property and one or a few security officers stationed on the grounds. A communications system allows the CEO’s driver and other security personnel to communicate among themselves and with a security control center.

The organization’s security director is the person in charge of the program as it exists inside the organization. When the program is large, the security director is assisted by a person that might hold a position titled executive protection manager (EPM). This individual supervises routine protective activities at the CEO’s office and home, and accompanies the CEO when he/she is traveling in high-risk areas and appearing at or attending public events.

Protection at the Office and Home

At the office or the home, the protective shield is a combination of physical safeguards and people. The safeguards and people have three main functions: keep threats away, give warning when a potential threat is near, and summon help. Many physical safeguards serve purposes in addition to personal protection. For example, fences, lights, sensors, alarms, and CCTV at the office are there to protect everyone. Other safeguards serve the CEO only, e.g., duress alarms, bullet- and explosive-resistant walls, concealed room, and specially equipped vehicle.

People who protect the CEO at the office consist mainly of security officers and they too serve a general population. At the CEO’s home the people component is different: non-uniformed security officers and a household staff that cooperate in the administration of protection.

The Threat

U.S. citizens, both at home and overseas, are targets for kidnapping, assassination, and other acts of violence at the hands of criminals and terrorists. The criminals’ usual objective is to acquire money in exchange for their captives. When the criminals are also followers of an ideology, their objective may be to force changes to government policy or business practices or obtain release from incarceration of their fellow criminal.

Terrorists can also use kidnapping as a means for acquiring money, but their usual objectives are to shape public opinion, overthrow a government, elevate a religion or cult, or simply annihilate people.

Experience tells us that CEOs often become the targets of deranged individuals with motives as strange as the acts they commit. For example, a CEO whose decision caused an employee to be disciplined, laid off, or terminated may become the center of the employee’s frustrations. The employee may believe he/she was discriminated against, and as a result seeks revenge.

A group intending to kidnap or harm the CEO may attempt to gain entry to the residence or office through pretext. Examples are posing as a cable repairman, slipping past a guard during shift change, and pretending to be a FedEx courier.

The group’s target can be the CEO's child. If kidnapping is the objective, the method may be trickery in effecting release of the child from the custody of a babysitter, child-care center, or school. The target can be the CEO’s spouse, and the capture may be attempted when he/she is away from the home such as when shopping, jogging, or socializing.

The best guidance for the protectors and the protected is to anticipate possible scenarios, take pre-emptive steps, look for the early warning signals, and react quickly.

The organization’s security director or retained private investigator evaluates the threat, the weaknesses of the organization to resist the threat, and the range of countermeasures necessary to eliminate the weaknesses.


A program has credibility when it is managed by a professional and anchored in the authority of a clearly stated company policy. The program takes into account specific risks, one of which is kidnap.

A first step in an organization’s defense against executive kidnapping is to develop a kidnap policy and an anti-kidnap plan. Approval of the policy and plan in most cases is made at the Board of Directors level. Consideration is given to kidnap insurance, ransom payments, and a crisis management team (CMT). The policy provides overall direction and authority; the anti-kidnap plan is the mechanism for carrying out the policy.

Kidnap Insurance

If kidnap insurance is purchased, the carrier will require absolute secrecy with respect to that fact and to any premeditation concerning intent to pay ransom. The carrier may also dictate who is to do the negotiating of ransom payments, require that the organization's response be conducted in accordance with applicable laws of the United States and other nations, and that prompt and full notification be given to law enforcement. A failure by the organization to meet the carrier's requirements can render the coverage null and void or reduce the carrier's obligations to pay.

Anti-Kidnap Plan and Kidnap Survey

Anti-Kidnap Plan

Although the organization's plan for dealing with kidnapping is a highly sensitive matter, it cannot be developed with such great secrecy that it will reflect the thinking of one or a few individuals who may not have all the right answers. An initial planning group consisting of in-house and outside experts can be helpful in touching all the bases. One of the organization’s in-house experts will be the security director. A private investigator may very well be one of the outside experts.

Other members of the group can include:

  • Agents of the Federal Bureau of Investigation (FBI)
  • Counter-terrorism experts
  • People familiar with the national government of the place where the kidnapped person is held captive
  • Kidnap insurance specialist
  • Professional hostage negotiator
  • Public affairs specialist
  • Specialist in receiving, sending and recording communications
  • Human resources specialist

 Kidnap Survey

 A survey of the CEO's home can uncover weaknesses correctible with safeguards such as trimming the shrubs, adding outside lights, and installing an alarm system. In high-risk circumstances it may become necessary to add watch dogs and security officers.

Thought in the survey is given to the time needed to execute an appropriate response. When an effective or less than timely response is not always certain, protection can be supplemented by creating in the home a concealed room. A concealed room typically features a hidden door that is highly resistive to brute force attack, a panic button, and a telephone. A weapon inside the room is an option.

A survey might call for screening and equipping protective staff. Screening can go beyond routine background checking; equipping can include defensive items such as bullet-resistant vests, firearms, cell phones, and walkie-talkies.

Personal Protection File

An important step is to set up a file on the CEO. The file contains details about family members, persons and pets close to him/her, places frequently visited, unique personal characteristics, and proof-of-life information.


In the people category are the CEO's family, relatives, household help, neighborhood friends, close friends, key working associates, physicians, dentists, and others who play a part in the CEO's life.


In the places category are restaurants, lounges, homes of friends and relatives, jogging paths, workout centers, theaters, and other places frequented by the CEO.

Unique Characteristics

The unique characteristics category relates exclusively to the CEO. It includes descriptions of distinguishing characteristics such as blood type, dental records, eye glasses and contact lenses, hairpiece, prosthetic devices, scars, birth marks, tattoos, and jewelry worn. Also included are hobbies, special interests, and medications. Especially important are handwriting and hand printing samples, fingerprints, and palm prints.

Proof of Life

The proof of life category includes one or a few bits of information that would be known only to the CEO. Examples include the name of the CEO's first grade teacher, the name of the CEO’s first dog, or the family nickname of an eccentric aunt. In discussions with kidnappers, proof of life information can be used to verify that the CEO is alive.

As much as possible, the CEO's file is augmented with photographs, maps, sketches, and the like. In a kidnap situation, information of this type can be extremely helpful in determining where the taking occurred and whether or not the CEO is alive.


A private investigator is a good choice for conducting some or all training. A private investigator, more so than a security director and his/her staff, is better skilled at certain protective tasks such as spotting surveillance, conducting surveillance, avoiding road blocks, and serving as a bodyguard.

The CEO, his/her immediate family, and protective staff are at the top of the list for training. Below them are house servants and office workers with frequent access to the CEO. The training topics address the tactics of kidnappers, the early warning signals of a kidnapping attempt, how to respond, and, if abducted, how to survive.

Avoid Attracting Attention

The CEO needs to learn how to avoid attracting attention. Kidnappers are assisted when they possess details of appearance, social activities, local movement, and out-of-town travel. Care has to be taken when talking on the telephone, in restaurants, and in other places where conversations can be overheard. Written information personal to the CEO deserves protection and should be shredded when no longer needed.

Avoid Predictable Patterns

Routes to and from work and the vehicles used need to be frequently and randomly changed; the times, dates, and places of out-of-office business meetings should not follow a discernible pattern; and family and social routines should be varied.


The value of planning and preparation is immediately evident in the aftermath of abduction. Tasks performed earlier can help in receiving contact from the kidnappers and responding to their demands in a manner that will not place the CEO’s life at greater risk.


The kidnappers usually make contact by telephone. In other cases, contact is made by letter or through another party such as a newspaper or radio station. If contact is by telephone, certain protocols are in order:

  • Express a willingness to cooperate
  • Ask to speak to the CEO
  • Ask for proof-of-life information
  • Record the call

If the contact is made in writing, the document and its envelope or outside container are carefully protected in order not to adversely affect forensic analyses such as examinations for fingerprints and saliva on the envelope flap.

Contact by the kidnappers is reported to the FBI immediately. Notifications to law enforcement agencies of other countries that have jurisdiction are also made. An attempt to handle the situation without recourse to government authorities is likely to fail.

By the time the kidnappers have made contact, the crisis management team will have been activated. The CMT leader, to whom considerable decision-making authority has been delegated, is the key person in coordinating major issues with law enforcement and other parties of interest.

The CMT members perform their pre-planned tasks, e.g., notifying next of kin, dealing with the news media, setting up a command center, establishing a rumor control function, coordinating with the kidnap insurance carrier, and calling in the professional negotiator.


Kidnappers often demand an immediate and large payment but do not expect the demand to be met quickly and entirely. They realize that even if an immediate payment can be effected, it is not likely to be as large as a payment arranged with deliberate speed. Kidnappers focus on “making a big score” and want to believe that the ransom payer has not contacted law enforcement authorities. An expectation of success suppresses their fear of getting caught.

The Reso Case

On April 29, 1992, law enforcement authorities were asked to investigate the disappearance of Exxon executive Sidney J. Reso from his home in Morris Township, New Jersey. On the morning of that day, Reso’s wife discovered her husband's car at the end of the driveway, empty but with the engine running. After calling his office and finding he had not arrived, she called the police.

At first, the Morris County authorities handled it as a missing person case. The next day, however, a caller to the Exxon switchboard claimed to have information about Reso and said that a letter could be found at a nearby shopping mall. Convinced then that a kidnapping had occurred, the Morris County Prosecutor's Office (MCPO) called the FBI.

Within four hours, the Reso home became an FBI command post complete with trap, trace, and recording devices on phone lines. The neighborhood and surrounding wooded areas were thoroughly searched and 24-hour surveillance and security was set up at the Reso home and at the homes of four children in Texas, Missouri, California, and Washington, D.C.

A ransom demand letter was picked up at the mall. The kidnappers instructed that a cell phone be obtained for future calls and that the phone number be published in a classified ad in the Newark Star Ledger. The letter also contained a demand for $18.5 million in hundred dollar bills.

Exxon provided the ransom money and the FBI packaged it. A cell phone was obtained and the waiting for a call began. Specialist teams were gathered and made ready to move on an instant’s notice. As they waited, the teams practiced skills that ranged from communication intercepts to sniper firing to SWAT exercises.

The kidnappers made eight calls and sent fourteen letters before attempting to collect the ransom. The attempt occurred on May 3 but went awry when the kidnappers made a mistake in following their own instructions. More calls, letters, and advertisements followed.

On June 16 the kidnappers seemed ready once again to act. They instructed Reso’s wife, daughter, and an Exxon executive to deliver the ransom and to take the cell phone with them so they could receive instructions along the way. Two FBI agents posing as Reso’s wife and daughter accompanied the Exxon executive. The kidnappers' instructions took them on a rambling journey. Meanwhile, FBI agents in many separate locations watched out of sight. A break came when an agent observed a heavyset white man with blonde hair wearing gloves making a phone call at a shopping mall. The agent also observed this same man remove the gloves when he got into a red Cutlass Ciera, which was traced to a rental car company.

Shortly after that, one of the kidnappers’ calls was traced to a pay phone in an area where a surveillance team was in place. The team observed a woman calling from a pay phone, and the time of the call matched the time of one of the kidnappers’ Agents went to the rental car company and waited. Arthur Seale returned the Ciera. His wife Jackie arrived to pick him up. Jackie Seale turned out to be the same woman who had been seen earlier making a call from a pay phone. The Seales were arrested.

Arthur Seale had previously worked as a police officer and a security official at Exxon. He and his wife decided to kidnap and ransom Sidney Reso in order to get out of serious financial difficulty. They began by watching the Reso house and learning Mr. Reso's morning routine. When they felt prepared to act, they went to the house and moved the morning newspaper from one side of the driveway to the other. They knew that he always picked up the newspaper and took it to work with him. To pick up the newspaper where Seale had placed it, Reso would have to get out of his car and walk around the car. When Reso did exactly that, Arthur Seale approached him quickly and at gunpoint forced him into a rental van driven by Jackie Seale. The gun went off and Reso was shot in the arm. The Seales drove him to a storage facility where, after treating his gunshot wound, they blindfolded him, handcuffed him, gagged him, and placed him in a coffin-like wooden box.

One week after the Seales were arrested, Jackie began cooperating. She said that Reso had died on May 3, just five days after his kidnapping. She and Arthur Seale removed the body from the box at the storage facility and buried it at another location.

The Seales were charged with multiple federal and state offenses. He pled guilty to 7 federal counts, including extortion and the use of a weapon in the commission of a crime, and also to a state charge of murder. He was sentenced to 95 years in federal prison to be followed by 70 years' state imprisonment. She was sentenced to 20 years in federal prison for the two counts of extortion.

Event Protection

Kidnapping is but one of several threats confronting a CEO. Other threats include assassination, assault, robbery, and non-kidnap threats such as heart attack, sudden illness, or injurious accident. Of these other threats, assassination presents the greatest risk by far.

The CEO is most vulnerable when in close proximity to the public. Potential assassins understand this. They know that the protective capability is much reduced and that with little sophistication and a simple weapon the target can be brought down. We know this from experience. Nearly all assassinations of prominent leaders have occurred in public places, the assassins were able to get close enough to act, and the weapon was easily obtainable such as a knife, firearm, or homemade bomb.

CEOs are exposed when they appear at a public event. Public events vary but all of them have one thing in common: the CEO is exposed to danger to some degree or other.

Event protection is an activity separate from security provided to the CEO in the office, at home, during commuting, and routine out-of-town travel. Routine security requires a lesser number of people; event security can require numerous people, some of whom may be outside contractors such as private investigators.

Team Leader

The person in overall charge of event-related protection can have a number of titles, e.g., mission leader or person-in-charge. We will use “team leader” and for event-related protection activities we will use “mission.”

The team leader will be the organization’s security director or a private investigator/consultant hired to head up a protective mission. The big-picture functions of the team leader are preparing an operational plan and supervising the mission team. The mission team for an event has four groups: advance party, residence party, baggage party, and protective party.

Advance Party

This group travels in advance to the locale of the upcoming mission and:

  • Conducts on-site inspections to evaluate probable risks to the CEO and proactively sets up countermeasures. Inspections take place at arrival and departure terminals, offices to be visited, conference rooms, restaurants, event venues, and other places on the CEO’s travel agenda.
  • Meets with and initiates working relationships with officials of participating agencies.
  • Conducts reconnaissance of local travel routes and makes recommendations to local traffic control officials. Recommendations might include speed, composition, and order of a motorcade.
  • Coordinates local ground transportation and arranges for the security of baggage.
  • Inspects vehicles to be used for local ground transportation and briefs drivers concerning what to do if a vehicle is involved in an accident or breaks down or if the CEO is injured or becomes ill.
  • Prepares sketches, maps, photographs and written reports.

Residence Party and Baggage Party

Residence Party

This group provides around-the-clock protection at the CEO’s places of stay during travel. Duties can include keeping a log of occurrences, screening incoming telephone calls, checking packages, controlling the access and movements of visitors, and driving the CEO from place to place.

Baggage Party

The baggage party provides oversight protection to the CEO’s baggage. The function begins at the starting point and continues during travel to the visit location. Oversight is discontinued during the time the baggage is in use by the CEO. The baggage party resumes oversight at the outset of and during the return trip and concludes when the CEO reaches home base. This group does not actually handle baggage but supervises the movement and custody of it.

Protective Party

This group conducts surveillance and provides close-in protection prior to, during, and following the event. The protective party consists entirely of or is complemented by persons from the advance, residence, and baggage parties.

The nuts and bolts of the mission, which are covered in the operational plan, determine the tasks of the protective party. Details of the operational plan are known only by the team leader and members of the protective party. Details can be revealed to outsiders only when knowledge of them is necessary for plan execution. For example, if the team is to be armed, this fact is made known to local law enforcement authorities.

Operational Plan

Information acquired by the advance team is dropped into the planning pot along with information obtained from the CEO’s staff. Details can include the type and theme of the event, event agenda, names of event speakers, special guests, characteristics of the audience, travel itinerary, persons traveling with the CEO, modes of travel to and from the event city, social activities, shopping and sightseeing trips, etc. Also placed into the pot is information about potential threats, especially any threat in the form of a terrorist group. These pot ingredients are a terrorist group’s proximity to the event site, its stated intentions, capabilities, resolve, preferred targets, weapons, and tactics. The team leader stirs the pot to see what kind of stew has been cooked.

Based on what has been learned, the team leader begins to put together a plan. The plan will take into consideration:

  • The attitude of the CEO regarding the protective shield
  • Political, religious, and cultural beliefs that pervade or surround the event
  • Duration of risk exposure, i.e., the length of time that the CEO will be exposed to a potential threat
  • Coordination with other agencies, particularly law enforcement
  • Ability of the protective force to deflect an attack and react effectively
  • Laws that apply such as laws dealing with possession of weapons and the application of deadly force
  • Means of communication
  • Factors of terrain and geography
  • Modes of transportation, both routine and emergency
  • Availability of emergency medical treatment
  • Selection and training of security personnel
  • Dealing with news media

Murphy’s Law applies. Even when a plan addresses every possible glitch, the unexpected will happen. It is for this reason that planning has to include a strong flavoring of flexibility

Overseas Events

The situation changes when the event is to occur overseas. For one thing, the organization sponsoring the event may have to perform administrative tasks normally done by the advance team such as acquire maps and photographs and identify routes of travel, emergency care facilities, and private security firms. The sponsor can also introduce the advance team to local agencies involved in the event. When the CEO’s organization has an office near the event site, staff from it can help as well.

Events held overseas present out-of-the-ordinary circumstances, some of which can be problems. Problems decrease the protective capability, which in turn increases risk to the CEO. Problems are created when the assisting persons at the overseas site prove to be unreliable. Small details, such as traffic conditions and ground transportation, are certain to be different and therefore problematic. What may work nicely close to home base may not work overseas.

Event Protection Tasks

Event protection is an activity separate from security provided to the CEO in the office, at home, during commuting, and routine out-of-town travel. Routine security requires a lesser number of people; event security can require numerous people, some of whom may be outside contractors such as private investigators.

Event protection tasks include:

  • Book travel and hotel accommodations in the name of the sponsoring organization. Work through a vetted point of contact (POC). Preferably, the POC will be a senior person in a governmental police or intelligence service.
  • Maintain confidentiality of details associated with the CEO’s travel, accommodations, and attendance. Communicate with the POC and others on a confidential and need-to-know basis.
  • Evaluate arrangements made at the location site pertaining to side trips.
  • Anticipate potential disruptions, most particularly public demonstrations and actions of unfriendly news media.
  • Acquire pertinent maps, sketches, diagrams, photographs, etc. These will depict the layout of the event site, areas surrounding the event site, travel routes to and from the event site and places where the CEO will be stationary. Restrooms are included.
  • When the sponsoring organization is company owned or company managed, the POC will be an employee of the sponsoring organization. Make clear to the POC that overall security is the responsibility of the sponsoring organization, subject to approval of the team leader. (Note: bodyguard protection during the event is provided by the team.)
  • Confer with and obtain advice of local law enforcement authorities concerning potential security threats; obtain recommendations; and invite participation and use of local resources in carrying out the mission.
  • Avoid advance publicity.
  • Schedule local ground transportation as tightly as possible. Local ground travel is by a primary vehicle operated or occupied by a team member or a local person vetted, trained in CPR and first aid, and having knowledge of the roadways and emergency medical treatment facilities. The primary vehicle and backup vehicle are equipped with a telephone and cell phone. A primary and an alternate route is selected and tested in advance.
  • Confer with security professionals working at hotels to be used. Evaluate security normally provided to CEOs at hotels and, where necessary, augment to ensure an adequate level of protection.
  • Escort the CEO throughout the event and give to him/her a contact telephone number to use in case of an emergency, an unanticipated incident, or a change in schedule
  • Employ local security officers only in exceptional circumstances. Hiring is made through a reputable security company.
  • Obtain the services of an anti-eavesdropping specialist if information security will be an issue at closed meetings of a sensitive nature.

Finally, if the risk is high or local security capabilities are inadequate, advise the CEO to cancel or re-schedule the event.

In-Depth Defense

This operational concept is used in almost every mission. It consists of one or more layers of protection that an attacker has to penetrate in order to reach the target. For a high-risk mission, the number of layers may be numerous. For example, in a situation where the CEO moves through a dense crowd, a tight ring of one to four persons move in unison with him/her; a loose ring of trouble spotters operate 15-25 meters away; and spotters at an elevated location communicate with those down below. In a low-risk situation, the CEO may be accompanied by one or two persons and no spotters.

In-depth defense can be likened to an onion. As each layer of the onion is peeled back, another layer is beneath it, and each layer is increasingly difficult to peel. The whole onion is mobile. As it moves, the CEO remains at the center and moves with it. The objective of in-depth defense is delay an attacker long enough to allow the CEO to escape under escort to a safe haven.

After-Action Report

A written report is made for the record at the conclusion of a mission. It is written in narrative style, with emphasis on problems encountered and steps taken to resolve them. The report contains recommendations for improvement of performance in future missions.

Problems described in the after-action report give proof of an irrefutable fact: it is not possible to give absolute personal protection. The best that can be expected is to reduce the risks as much as possible. Persons assigned to CEO protection duties have to understand this basic premise. They also have to know and accept the legal and sociological constraints that are present in every mission.


There can no protective program without the CEO’s buy-in. A CEO may understand risk as a management concept but may not be ready to acknowledge risk in personal terms. CEOs have been known to respond with denial, not unlike alcoholics refusing to look at the evidence of addiction. A program will not work until risk is acknowledged.

Buy-in is demonstrated by a commitment to and active involvement in protective arrangements. Involvement has three dimensions: training, interest in the program, and cooperation with the program. The first of the three is problematic. CEOs are often busy and do not assign a high priority to training. The security director has to find a way to get past the reluctance. In this case, patience is a virtue; persuasion is a must. Horror stories and cajolery, while not recommended, may help.

Fortunately, the key points of training are knowledge-based, i.e., they can be learned without actually getting up from a desk. The exceptions would be firearms and self-defense training. For many companies and many CEOs, the use of firearms is not seen as helpful, and for some CEOs self-defense is not practical for reasons of age or inclination.

Training of the CEO has two learning objectives: know how to keep from being kidnapped or assassinated and how to respond if attacked or taken hostage. As to the first objective, the CEO learns to closely control information that an adversary needs to be successful, avoids predictable behavior, and stays within the shell maintained by the protective party at public events. As to response, the CEO learns the early warning signals and how to recognize them, actions to take and not take, and most importantly, how to survive if taken hostage.

Training is a serious and difficult endeavor. It is serious because death or injury can result if the CEO makes an incorrect response; it is difficult because the typical CEO has little or no familiarity with violence and without training stands little chance of surviving. Can such things be learned easily? The answer is no. Is this something that has to be learned? The answer is yes