INTRODUCTION TO PROBLEM SOLVING

Definition of Terms
1. Problem Solving Approach
Refers to a methodical process for reducing the impact of crime and disorder problems
in a community. The problem-solving approach is an integral component of the philosophy of
community policing.

SARA Approach to Problem Solving

The SARA approach to problem-solving is described as Scanning (S), Analysis (A),
Response (R), and Assessment (A). That is, once a problem is identified and its
characteristics are analyzed, a response is developed and deployed to combat the problem,
and after a determined period, the response is evaluated. The following is a brief discussion of
each aspect of the SARA process.
Scanning
Scanning is the first step to problem-solving and is the identification of a cluster
of similar, related, or recurring incidents through a preliminary review of information, and the
selection of this crime/disorder problem among competing priorities for future examination.
(One example of using crime analysis information to scan for crime problems is a comparison
of crime every month. Comparison of specific areas over time may indicate a problem area or
type of crime. Another example is examining housebreaks over six months to identify small
patterns of activity, which could represent a larger housebreak problem.)
Analysis
The analysis is the use of several sources of information to determine why a
problem is occurring, who is responsible, who is affected, where the problem is located when it
occurs, and what form the problem takes.
Response
The response is the execution of a tailored set of actions that address the most
important findings of the analysis phase. Some examples of responses that have been used
are working with city engineers to redesign a park that had a high number of assaults,
vandalism, and drug dealing incidents (Mankato, MN); convening an advisory board
composed of law enforcement, residents, business owners, and charities to address traffic and
safety concerns at day-laborer gathering points (Glendale, CA); and establishing a juvenile
diversion program whereby police bring together adolescent taggers and the owners of the
property they deface to agree on terms for restitution and community service (Santa Ana, CA)
(Sampson and Scott, 2000).
Assessment
Assessment is the measurement of the impact(s) of the responses on the
targeted crime/disorder problem using information collected from multiple sources, both before
and after the responses have been implemented. For law enforcement agencies, assessment
is probably the most challenging part of the SARA process, not only because measures of
effectiveness are often difficult to determine and capture, but also because assessment takes
time and effort to complete at a time when the problem -solving process is winding down

Crime Analysis and Problem Solving

Crime analysis and mapping play a major role in all phases of the problem-solving
process. It is important to measure the problem accurately during the scanning, analysis, and
assessment phases. Analysts can also assist in the response phase of the SARA process by
informing the effective allocation of resources by determining the times when, and areas
where the offenses are most frequently or disproportionately occurring.

B. General Data Integrity Issues

There are various data integrity issues associated with tabular and geographic law
enforcement data. This section is not meant to serve as a comprehensive description of the
data integrity issues in law enforcement but instead gives a general overview of the major
issues.

Data Entry
In a law enforcement setting, oftentimes the individuals, officers, dispatchers, and
records clerks, who are conducting data entry, do not realize that others are using the data
they produce. This lack of awareness can lead to carelessness and result in unreliable data.
Data entry errors can be improved by technology (address cleaning software), proper training,
and making individuals aware of the uses and importance of the data.

Timeliness
A primary concern in crime analysis, especially in tactical crime analysis, is that data
obtained are current and available promptly. Unfortunately, because of human error and
technological difficulties, this is not always possible. One method to remedy this problem is to
stress the need for and the value of current data for crime analysis. This need should be
communicated throughout the department to come up with solutions for improving data
timeliness.

Data Validity
Validity refers to whether data accurately reflect the concept that they are intended to
measure. Although true validity is difficult to measure, law enforcement data, like any other
data, are prone to validity issues. For example, many police departments use calls for service
information as a proxy for the crime. This is problematic because not all calls that are originally
dispatched as a crime are in fact crimes. The best example is a robbery call for service since
there is common confusion about the difference between a robbery and theft. If the dispatcher
enters what the citizen reports and the title of the call are not changed when the actual crime
is determined (a common problem), the call for service would not accurately represent the
crime that occurred.

Reliability
Refers to the data measured the same in repeated observations. An example of a
reliability issue related to law enforcement data is when there is a policy or law change (e.g.,
mandatory arrest for domestic violence offenses). Frequently, there will be a sharp increase or
decrease that indicates that the data no longer represent the same phenomenon and thus, the
numbers are not reliable. Reliability issues can significantly affect crime analysis results.

Data Transfer Process

The data transfer process can affect data quality and integrity in that data can be
inadvertently or unavoidably lost or reformatted. An issue associated with the data transfer
process is data compatibility. Police departments are notorious for having data in many
different formats and converting and combining these data is often a time-consuming and
frustrating process.

Data Confidentiality/Privacy
Crime analysts are managers of law enforcement data; therefore, crime analysts are
responsible for protecting the information and individuals represented within the data.
Normally, the data used and created in crime analysis adheres to a jurisdiction’s policies on
privacy and confidentiality. New situations of providing information have surfaced which
require additional and more detailed policies such as the invention of the Internet and the use
of mapping. Thus, police departments should include specific crime analysis concerns into
their data-protection plan. On a related issue, the crime analysis unit, itself, should have a
written data and analysis request policy that addresses common issues surrounding requests
for crime analysis information. A policy, supported by the agency’s administration, can provide
guidelines for requesting information and expectations of what will and will not be provided.

Data Management

Metadata
Metadata refers to the data that describes the analyst’s work. Metadata is the data that
describe data. Every police department has its own set of procedures that outlines how crime
analysis is conducted. Frequently, these procedures are kept only in the analysts’ memories,
and it is important to have them written down for a variety of reasons. They include consistent
data handling and cleaning procedures, guidelines for sharing work with others, keeping track
of products and files created and reducing duplication of effort. These written procedures are
also invaluable training tools for new analysts. Categories of metadata include:
Geocoding
Is the process of bringing tabular and geographic data together based on a common
geographic unit of analysis.

A geographic unit of analysis

Refers to a spatial characteristic within the data that is necessary to locate it on a map
(such as an address, zip code, beat, or grid).
Tabular data
These are contained in a table and are a list of records that, along with information
about the record, contain addresses or some other type of geographic variable. Examples of
law enforcement tabular data are calls for service, crime, accidents, citations, sex offenders,
and arrests. Along with information about the nature of the incident (e.g., type of call or crime,
date, time), these data contain the location of the incident (e.g., address, grid, and/or beat),
which will allow it to be geocoded.
Geographic data
This is data that can be displayed on a map such as streets, census tracts, parcels, and
buildings.
(Examples of geographic data specific to law enforcement are police districts, beats, or grid
boundaries).
 The purpose of geocoding is to assign tabular data to a location on the earth’s surface
to visualize the spatial characteristics of the data. It is analogous to placing a pin on a map in
the appropriate location. Unlike the paper map, when geocoding in a geographic information
system, data associated with the pin, or data point, are available. To geocode either
electronically or manually, there must be a common geographic unit of analysis. In law
enforcement, the address is primarily used as the geographic unit of analysis to which tabular
data are geocoded. However, other types of geographic units are also used such as parcels,
zip codes, census tracts, census blocks, or beats. In the case of geocoding, geographic data
used for geocoding are called "reference data" since the geographic data are used to
reference the tabular data.
The following is a discussion of the geocoding process, regardless of the geographic
information system (GIS) software used, and some common problems faced when geocoding
law enforcement data.

The geocoding process

In general, there are five basic steps in the geocoding process. They are:
1. Prepare the geographic and tabular files for geocoding.
2. Specify the geocoding parameters.
3. Geocode.
4. Review results.
5. If necessary, re-specify parameters and geocode again.

Topic: Introduction to Problem Solving

(Continuation of Topic 16)

Definition of Terms:
Single Symbol Mapping
Single symbol mapping refers to the use of individual symbols to represent a point,
line, and polygon features. The utility of single symbol maps is that they allow for a detailed
analysis of small amounts of data. Single symbol mapping is also helpful in representing
geographic data such as schools or churches in that it is known that they are discrete
addresses and the risk of two points on top of one another is low. The following is an
example of schools in a single symbol map. The user should be aware of the readability of
the map to determine what is "too much" data.
Graduated Mapping
Graduated mapping consists of aggregating data into groupings that are displayed on
the map. These groupings can be graduated by size or by color and can be classified
statistically in various ways. This next section describes the size and color graduations as
well as the classifications that are available in most GIS software packages.
1. Graduation By Size
Graduated size mapping is the process by which data are summarized so that
symbols (point or line features) are altered in size to reflect the frequencies in the data.
In other words, in this type of map, more than one incident at a given point or line is
represented with a larger symbol or a thicker line. One drawback is that oftentimes, the size
of the symbol or line is difficult to distinguish and the actual value associated with that
symbol is not displayed. In addition, similar to single symbol mapping, this type of map is
most helpful with smaller amounts of data, since too many incidents make the map unclear
and difficult to read.
2. Graduation By Color
In graduated color mapping, symbols (point, line, or polygon features) are altered in
color to reflect a particular value of the feature. Features can be graduated by any variable.
Law enforcement variables include shading by date/time, by priority, by crime type, by
several crimes at a location or in an area, or by crime rate of an area. Each category or
unique value is a different color.

Crime Analysis Product Format and Dissemination

The effectiveness of any crime analysis or mapping endeavor has as much to do with
the presentation of the results as it does the analysis. If the resulting document of analysis is
not legible and understandable to its audience, it is worthless.
*factors to consider when developing a final product;
1. Methods of dissemination
2. Components of a crime analysis product
3. Types of crime analysis products.
4. Included also the recommendations for elements of a crime analysis product and
elements of a map. These are distinguished from one another since maps include additional
elements such as a legend, North arrow, and scale.

Factors to Consider When Developing a Crime Analysis Product,

1. The purpose of the product.
Crime analysis products can serve many purposes, from informing citizens about the
recent activity to assisting the agency in planning, to apprehending a suspected criminal. For
example, monthly maps of a town that depict reported crime are useful for providing general
information to the public about changes in hotspots of reported crime; however, a detailed
map of each hotspot location may be necessary for patrol officers and investigators who
need specific information to focus their problem- solving efforts. In either case, it is important
to prepare maps that are appropriate for the purpose. In addition,
2. The audience of the product
There are also many audiences for crime analysis products. They can include police
department personnel, the general public, community groups, business groups, school
officials, or city council members. By gauging the needs, expectations, and skill level of
these individuals, products that are appropriate for each group can be developed.
*In general, when producing a crime analysis product, the needs of users of the
information need to be balanced with political, legal, and ethical concerns.

Methods of Dissemination
Methods of dissemination of a product inherently rely on the intended purpose and
audience. They also rely on the means available, such as the Internet and Intranet
capabilities, or the newspaper.

The analyst must also consider what is the most efficient and effective method of
dissemination because frequently, the easiest method is not the most effective. For example,
it may be simple to publish a crime pattern bulletin and e-mail it to the department or place
fliers on a table in the briefing room for officers to read.
The most effective way to disseminate information depends on the current specific
circumstances of the department, and the analyst should continually pay attention to what is
appropriate and effective.

Components of Crime Analysis Products

A crime analysis product can include one or more of several types of analytical output,
which can include tables, charts, graphs, maps, images, and narratives. In a law
enforcement setting, a balance of one or more of these components should be used in any
one product, and including all or just one component should be avoided.
For example, a two-page essay on the recent burglary activity in Beat will not be as
effective as a simple description of the pattern, a table of the relevant information, a chart
depicting the time of day and day of the week of the activity, and a map that indicates where
the activity is occurring.

Types of Crime Analysis Products

The following are some general types of crime analysis products.
Crime bulletins
Short one to two-page documents that describe a tactical short-term trend or
pattern.
Memos
A document in letter form that summarizes a request, explains the analysis,
highlights the interesting findings, and, in some cases, makes recommendations for a
response or further analysis. These should be included as cover letters for research and
special reports.
Weekly/monthly/quarterly reports and maps
Documents and maps that convey the same information in regular intervals to
inform about activity and allow for identifying problems. These products should be
consistently formatted to ensure recognizability by customers and allow comparison.
Annual reports
Reports that provide information aggregated by year and are published every
year. They would include breakdowns by geography, months, and types of activity (e.g.,
types of crime, types of calls, and accidents) and comparisons among years. They might
also include comparisons to other similar jurisdictions as well as to state and national figures.
Research reports
Reports that describe the data, methodology, and analysis of a research
project (i.e., problem-solving project or evaluation of a program) as well as the results of the
analysis, interpretations of the findings, and recommendations for a response or future
research.
Special reports
These are reports that are requested on an ad hoc basis and address a
particular issue such as traffic accidents around schools or efficient allocation of a new
squad of officers. The analysis that makes up these reports is less rigorous than the
research reports and subsequently takes less time.
These special reports make up much of the daily work of the crime analyst.
These general categories can include information about crime, calls for service, arrests, and
accidents.
They also can be specific to a particular area such as street segment,
neighborhood, beat, district, and the entire city. Other more specific types may include lists
of incidents, “attempt to locate” bulletins, gang information bulletins, missing person’s fliers,
and FI card summaries.

General Crime Analysis Product Elements

The following are the general elements of a crime analysis product.
Title
It includes the nature of the data and geography included as well as the time
included. For example, "Citizen Generated Calls for Service in Precinct 9: January 1, 2001,
through June 30, 2001."
File path
This is where the document is located. This is important, so that future
requests for the report, an update, or similar report can be easily filled. This assists the
analyst in finding the product versus redoing it.

Credits/date
This includes the name or divisions of the individual(s) who created the report
and the date it was created. This allows the analysts to get credit, for others to direct
questions about the product to the appropriate people, and for everyone to know when the
product was disseminated.
(For example, "Prepared by Crime Analysis Unit, December 2001" or "Prepared by Jane
Doe, 01/06/02.")
Text, tables, graphics, and/or maps
This is the substantive content of the product and what is included varies from
product to product.
Analysis of summary
This is an interpretation of the data and interesting findings and is important to
ensure appropriate interpretations of the data and results by others. This section is often
omitted from crime analysis products.
Disclaimers
This information details what the data and analysis results do not say. For
example, conclusions drawn from any report containing crime information can only be made
about crimes known to the police, not all crimes. Another example is the use of calls for
service in lieu of crime data. The difference between the two data sources should be noted
as should the limitations of using calls for service.
(e.g., time and date of the call may not be the time and date of the criminal incident).
Recommendations
This section would contain suggestions for future analysis or actions based on
the results. It is considered optional and may not always be included in a crime analysis
product. Because these elements can be included and combined in an infinite number of
ways, a specific example of a crime analysis product is not included here. See below for an
example of the map design elements.
Map Design Elements
Maps differ substantively from other components of a crime analysis product,
and they contain specific features unique to maps. The following are guidelines for map
design elements.
Title- Similar to the title of a general crime analysis product, the title of a map should
contain the nature of the data and geography included as well as the time included.
Legend - This element lists the tabular and geographic data sources displayed in the
map and indicates the symbols that are used to represent each data source. In addition, in
the case of a map that includes graduation by color or size, the classification used should
also be listed. This will allow the reader to understand the divisions of the categories and the
analysis that has been conducted

Geocoding rate - As with statistics and tables that are presented in social science,
data that are missing from the map should be noted. In the case of a map, this would be
displayed as a percentage of the data that have been successfully geocoded.

Labels - Should be used in moderation and where appropriate within the map. Labels
should orient users to the map as well as highlight analytical results.
Scale Bar - Describes the distance units used in the map.
North Directional - Indicates the geographic orientation of the map.
Credits/date - As in the general crime analysis product, this contains the name or
division of the individual who produced the map as well as the date it was created.
Remember, these elements are specific to maps and even though maps should stand on
their own, supplemental description and interpretation of the analysis should be included.

Evaluating the Utility of Crime Analysis and Mapping Products

Finally, a feedback mechanism for crime analysis products is important to determine
both their relevance and effectiveness. Customer surveys, informal discussions, and/or focus
groups can be used to learn whether a product is serving its intended purpose and is useful
to its audience. Also, the analysts themselves must review and re-evaluate current crime
analysis products. As noted in the following figure, this process is ongoing. Changes in focus
of the department, capabilities of customers, the nature of the criminal activity, and
information technology are only a few of the factors that could influence the needs and
purposes of crime analysis products.

LESSON 11
 PROCEDURE ON SPECIAL CRIME

A. HOSTAGE SITUATION/BARRICADED SITUATIONS

1. Procedure to be followed in a Hostage Situation
The following steps shall be undertaken:
a. A Critical Incident Management Committee shall be activated immediately;
b. Incident scene shall be secured and isolated;
c. Identify and secure the stronghold;
d. As much as possible, ensure the control of communication lines, and cut-off all
other lines as
well as electricity and water supply to allow for more bargaining;
e. Unauthorized persons shall not be allowed entry and exit to the incident scene;
f. Witnesses’ names, addresses, and other information shall be recorded;
g. Witnesses shall be directed to a safe location;
h. Evacuate all victims/injured persons immediately when the opportunity
permits;
i. The arrest of the perpetrator shall be the last paramount concern; and
j. Conduct debriefing immediately after the conclusion of the incident.
2. Ground Commander/On-Scene Commander
There shall be only one Ground Commander/On-Scene Commander holding at least a
senior rank and/or one (1) with experience in hostage/crisis or relative training. Until
such time that he officially designates a spokesperson, he may issue appropriate press
statements and continue to perform the role of the spokesperson.
3. Negotiators/ Negotiation Team
Negotiators shall be designated by the Ground Commander. No one shall be allowed to
talk to the hostage-taker without clearance from the negotiator or Ground Commander.
The Negotiation Team is directly under the control and supervision of the On-Scene
Commander. Negotiation team structure will be as follows:
a. Negotiation Team Leader (NTL)/coordinator;
b. Primary Negotiator;
c. Secondary Negotiator;
d. Intelligence, liaison /recorder; and
e. Board Negotiator.
[Link] Team
An assault team shall be alerted for deployment in case the negotiation fails. Members
of the assault team shall wear an authorized and easily recognizable uniform during the
conduct of the operation.
5. Support Personnel
An ambulance with the medical crew and fire truck shall be detailed at the incident area.
6. Plans
The On-Scene Commander shall, upon the assessment of the situation, prepare
necessary plans to include but not limited to:
a. Emergency Response Plan - depends on the threat posed by the hostage-
takers and the need of the Negotiation Team and On-Scene Commander.
 b. Breakout Plan - the possibility of breakout shall be considered immediately
upon drawing up a negotiation strategy. This should be considered as one of the priority
plans.
c. Delivery plan - in case the hostage-takers change plans in the middle of the
execution.
d. Surrender plan- should be drawn up in a way that the hostages’ lives will not
be jeopardized.
e. Hostage Reception/ Release - for security reasons, released hostages should
be contained and isolated.
f. Collection plan - the safety of the police personnel involved is the priority
consideration.
7 Coordination
Proper coordination with all participating elements shall be done to consolidate efforts in
solving the crisis.
8 Safety of Hostage(s)
In negotiating for the release of a hostage, the safety of the hostage shall always
be paramount.
9. Guidelines during Negotiations
a. Situation must be stabilized first and contained before the start of the negotiation;
b. All relevant tools and information that can strengthen a negotiator’s position and
create a favorable climate for a successful negotiation must be prepared e.g. facts
relevant to the situation, financial and non-financial terms, issues and concerns, etc;
c. Do not introduce outsiders (non-law enforcement officers) into the negotiation
process unless their presence is extremely necessary for the solution of the crisis. If so
introduced, they shall be properly advised on the do's and don'ts of hostage
negotiations;
d. In case the negotiator breaks down or he/she finds himself/herself in a deadlock, it is
recommended to employ the service of a mediator.
e. Police officers without proper training shall not be allowed to participate in hostage
negotiations.
f. Whatever the scale of an incident and the extent of resources deployed, it is essential
that proper liaison exists between the Tactical/Assault Team, Technical Support Team,
and the Negotiation Team.
g. All activities on the scene, even the delivery of food to the stronghold, must-have
tactical coordination with the NTL/Coordinator.
10 Negotiation through Mediator
a. The mediator will act as a referee, helping the negotiators resolve their differences.
b. The mediator must be well-versed in the issues to be able to eventually recommend
an effective solution.
c. The main objective is to reconcile the object of the negotiator with that of the other
party.

B. RULE 33. INVESTIGATION OF VIOLENCE AGAINST WOMEN AND THEIR

CHILDREN (VAWC) AND OTHER CASES OF CHILD ABUSE
1. Investigation of Complaints and Reports Involving All Forms of Violence
against Women and Their Children
 The PNP Women and Children Protection Desks (WCPD) in coordination with
the Local Social Welfare Development Office (LSWDO), shall conduct a timely,
thorough, and comprehensive investigation of all cases involving violence against
women and their children, committed within their respective area of responsibility,
consistent with domestic laws, rules and regulations, and international human rights
standards.

a. Upon the receipt of the complaint, the WCPD officer shall conduct an appropriate
investigation which includes, but is not limited to, taking the formal statement of the
victim-survivor and collecting other evidence necessary for the filing of the case under
the Act;
b. Immediately after taking the essential elements of information during an investigation,
the WCPD officer shall refer the victim-survivor to the nearest PNP Crime Laboratory
and/or hospital or any medical facilities for appropriate medico-legal examination. It
shall be the WCPD officer's duty to ensure that as far as possible, the examining
physician must be of the same gender as the victim-survivor, especially in sexual
violence cases;
c. Except in the case of a child who is a victim-survivor of the Act, by which other
existing laws require the immediate presence of the unoffending parent or guardian and
social worker, only persons expressly authorized by the victim-survivor shall be allowed
by the WCPD officer inside a room where police investigation, as well as the
medical/physical examination, are being conducted in private;
d. Ensure the confidentiality of the identity of the victim-survivor and all other parties
directly involved with the
case under investigation. For this purpose, the WCPD officer must maintain a separate
blotter on crimes
committed under the Act. Under no circumstances shall any police officer allow media
access to information concerning VAWC reported to PNP;
e. After the conduct of police investigation, the WCPD officer shall refer the victim-
survivor to the social worker of the LGU, any available DSWD shelters, NGOs, and
other service providers for psycho-social intervention and other rehabilitation programs;
f. The WCPD officer shall forward the investigation report, together with the relevant
evidence, including the formal statements of witnesses and result of the medico-legal
examination, to the prosecutor for filing of appropriate criminal action under the Act;
g. If victim-survivor is found to have manifestations of the Battered Woman Syndrome
which is validated by past police records and testimonies from witnesses in interest, the
WCPD officer shall inform the Punong Barangay, the local social worker, or the
concerned NGOs, local professional or civic groups in the area for appropriate
psychiatric and psychological evaluation which may form part of the evidence to be
presented in court;
h. Assist in the application and enforcement of the provisions of the protection order as
may be issued by
the barangay or the court;
i. Respond, with the assistance of other police personnel, barangay officials, and other
parties-in-interest, to a call for emergency assistance to ensure immediate protection of
the victim-survivor by entering the dwelling if necessary, whether or not a protection
order has been issued;
j. In the case where the perpetrator is armed or in possession of a deadly weapon in
plain view, cause the confiscation thereof with the assistance of other police personnel;
k. Effect the arrest of the perpetrator by virtue of a warrant issued by the court under
existing laws. If any crime under the Act has been committed, is being committed or
about to be committed, or that any police officer has personal knowledge of the facts
indicating the commission of such time, it shall be his or her duty to arrest the
perpetrator even without the strength of a warrant, provided the offender shall be
processed in accordance with Section 5, Rule 113 of the Rules of Court;
l. Except when the victim-survivor is deemed more secure to stay in their place of
residence, in which case the perpetrator has been removed under protection order
issued by the barangay or the court, the WCPD officer or any designated police officer
shall provide assistance to help facilitate the transfer of the victim-survivor to a safe
place of her own choice, including the removal of some of the victim-survivors personal
belongings;
m. Monitor and follow up any case in violation of the Act that has been filed in court. In
this regard, the WCPD officer must maintain a periodic assessment report of all cases
reported to the police in violation of the Act; and
n. Participate in multi-disciplinary mechanisms to help address the protection needs of
the victim-survivor of VAWC.
2. Investigation of Complaints and Reports Involving Other Forms of Child
Abuse
Police Officers, in coordination with the PNP Women and Children Protection Desks
(WCPD) and Local Social Welfare Development Office (LSWDO), shall conduct an
investigation on all cases of child abuse committed within their respective area of
responsibility, consistent with domestic laws, rules and regulations, and international
human rights
a. Police officers shall, upon receipt of a complaint or report or information that a
child has been or is being abused, maltreated, discriminated, exploited, neglected, or
abandoned, or is under imminent danger of being abused or exploited, shall take
immediate action thereon, but under no circumstance shall be beyond forty-eight (48)
hours;
b. Police officers shall immediately coordinate with the WCPD and report the
matter to the LSWDO.
c. In situations where immediate rescue operations are necessary, the police
officers and WCPD in coordination with the LSWDO and other stakeholders shall
prepare the corresponding rescue operations plan;
d. The police officers, together with the WCPD, LSWDO and other
stakeholders/authorities like the Barangay or Municipal or City Health Officer, Barangay
Officials in the place where the incident occurred or is taking place, the Barangay
Human Rights Action Officer or any officer of the Commission on Human Rights (CHR)
in or near the area of operation shall, without delay, proceed to the place where the
child-victim is located and execute the rescue operations plan;
e. Upon rescue of the child-victim, the law enforcers shall turn over the child-
victim to the LSWDO for protective custody;
 f. The police officer, together with the LSWDO, shall ensure that the child-victim
shall be immediately taken to the nearest government medical center or hospital or
clinic for physical and psychological examination, treatment, and/or confinement;
g. The police officer, in coordination with the LSWDO, shall gather the
necessary/relevant and material data and evidence to support the filing of appropriate
charges before the Prosecutor's Office and trial of the child-abuse case/s before the
court;
h. The police officer shall ensure that the child-victim shall not be subjected or
exposed to multi-victimization in the course of the investigation. Hence, the police officer
shall see to it that the interviews and statements of the victim shall be recorded and/or
videotaped; and
i. Investigation of child abuse cases shall be assigned preferably to members of
the Women and Children Protection Desk (WCPD) or in their absence, the police officer
of the same gender who has appropriate training on child rights, and investigation and
handling of child abuse cases.
3. Right to Privacy of the Child and Confidentiality of Records
The police officer shall at all times respect the right to privacy of the child and shall
observe confidentiality of information and records about child rights cases he
investigated or is investigating, from the beginning of the investigation and/or initial
custody of the child-victim and at all times thereafter, except when the release of any
information about the child's case is according to an Order issued by a competent court.
4 Procedure in the Rescue of Minors
a. Planning
All police operations regarding the rescue of minors who are victims or subject of
physical, sexual, psychological abuse, exploitation, discrimination, negligence, and
other forms of abuse, shall be properly planned, in coordination with stakeholders
concerned. The plan shall be drawn and discussed in a pre-conference with national
and/or local authorities such as the Department of Social Work and Development
(DSWD) or the LSWDO, female Police Investigator, preferably from the WCPD or one
trained in the handling of the investigation of child rights cases, the local police units,
police photographer, Public Attorneys' Office (PAO), barangay officials, City and
Municipal Licensing and Permit Division, the Department of Health or the City or
Municipal Health Office, Barangay Human Rights Action Officer or officer of the CHR,
and/or the DOLE.
b. Rescue operations
(1) All police officers participating in the rescue operations shall be in the prescribed
uniform.
(2) Upon arrival at the operation scene, the police officers shall properly introduce
themselves and
inform the people in the area where the child-victim is located as to the purpose of their
operation.
(3) Police officers shall not use force unless necessary under the circumstances. In
circumstances where reasonable force is allowed, the police officers/ rescue team shall
ensure and/or avoid collateral damage or hitting innocent civilians within the vicinity of
operations.
(4) The child-victim shall be handled preferably by a police officer of the same gender
as the victim, who has appropriate training on child rights, and in the investigation and
handling of child-abuse cases.
5 Procedure to be Observed in the Handling of Children in Conflict with the
Law (CICL)
From the moment a child is taken into custody, the law enforcement officer shall:
a. Properly identify himself as a police officer and present the proper
identification to the child;
b. Explain to the child, in simple language and in the dialect that he can
understand, the reason why he is being taken into custody and the offense he allegedly
committed;
c. Refrain from using vulgar or profane words and from sexually harassing or
abusing, or making sexual advances to the child in conflict with the law;
d. Avoid displaying or using any firearm, weapon, handcuffs, or instruments of
force or restraint unless necessary and only after all other methods of control have been
exhausted and have failed;
e. Refrain from subjecting the child in conflict with the law to greater restraint
than is necessary for his apprehension;
f. Avoid the use of unnecessary force;
g. Search on a child in conflict with the law shall only be done by a police officer
of the same gender as the child;
h. Determine the age of the child;
i. Take the child immediately to the proper medical and health officer for a
thorough physical and mental examination. The examination results shall be kept
confidential unless otherwise ordered by the Family Court. Whenever medical treatment
is required, steps shall be immediately undertaken to provide the same;
j. Turn over custody of the child to the LSWDO or other accredited NGOs
immediately but not later than eight (8) hours after apprehension and notify the child’s
parents/ guardians and the PAO of the child’s apprehension;
k. When the child is fifteen (15) years or below, he shall be immediately released
to his parents or guardian or nearest relative. However, if the child is above twelve (12)
years of age up to fifteen (15) years of age and commits serious crimes such as
parricide, murder, infanticide, kidnapping and serious illegal detention where the victim
is killed or raped, robbery with homicide or rape, destructive arson, rape, or carnapping
where the driver or occupant is killed or raped or offenses under RA 9165
(Comprehensive Dangerous Drugs Act of 2002) punishable by more than twelve (12)
years of imprisonment, shall be deemed a neglected child under PD 603, as amended,
and shall be mandatorily placed in a special facility within the youth care facility or
“Bahay Pag-asa” called the Intensive Juvenile Intervention and Support Center (IJISC).
(Sec 20-A of RA 10630)
l. A child who violated local ordinances concerning juvenile status offenses shall
be considered as a "child at risk" and not as a "child in conflict with the law". Hence, no
penalty shall be imposed on them for said violations, and they shall be instead brought
to their residence or to any barangay official at the barangay hall to be released to the
custody of their parents and an appropriate intervention program will be provided. (Sec
20-A of RA 10630)
 m. Ensure that should detention of the child in conflict with the law be necessary,
the child shall be secured in quarters separate from that of the opposite sex and adult
offenders;
n. Take the statement of the child in the presence of:
(1) The child’s counsel of choice or in the absence thereof, a lawyer from the PAO;
(2) The child’s parents, guardian, or nearest relative, and
(3) LSWDO;
o. In the absence of the child’s parents, guardian, or nearest relative, and the
LSWDO, the investigation shall be conducted in the presence of an NGO, religious
group, or member of the Barangay Council for the Protection of Children (BCPC).
p. Ensure that all statements signed by the child during investigation shall be
witnessed by the child’s parents or guardian, social worker, or legal counsel in
attendance who shall affix his signature to the said statement;
q. Record the following in the initial investigation:
(1) Whether handcuffs or other instruments of restraint were used, and if so, the reason
for such;
(2) That the parents or guardians of a child, the DSWD, and the PAO have been duly
informed of the apprehension and the details thereof; and
(3) The exhaustion of measures to determine the age of a child and the precise details
of the physical and medical examination or the failure to submit a child to such
examination.
6. Guidelines
The police officer shall at all times ensure respect for the rights of the child in conflict
with the law as provided in the Philippine Constitution, domestic laws, the Convention
on the Rights of the Child, and other related international human rights instruments.

C. BOMB, BOMB THREAT AND BOMB INCIDENT EMERGENCY RESPONSE

PROCEDURES
1. Bomb
A bomb is a container filled with explosive, incendiary material, smoke, gas, or other
destructive substance, designed to explode. It can appear obvious or concealed and
can vary in size, shape, or sophistication and may not necessarily explode such as in
the case of incendiary and dirty bombs. It may be referred to as Improvised Explosives
Device (IED) or ordnance.
2. Bomb Threat
A bomb threat is either a written or verbal threat communicated through electronic, oral,
or other means that threatens to place or use an IED at a certain time, date, or place
against any specific person or place. The First Responder (FR), the police investigator,
and the police detective must remember the following basic facts on bomb threat:
a. A threat is considered only a threat until something visible is found;
b. Determined bombers do not frequently give warnings of a possible
explosion/incendiary attack;
c. Threats are an excellent way to disrupt productivity without actually risking life,
limb, and/or property; and
d. The consequences of a conviction for "threatening" are not necessarily as
serious as those that could result from the actual placement/initiation of a bomb.
 3 First Responder’s Procedure on Bomb Threat
The following are the guidelines for FRs during a bomb threat:
a. Upon receipt of the information:
(1) Treat all threats as serious until proven otherwise;
(2) Determine the exact location of the establishment under threat;
(3) Assess or analyze the threat whether it is a long term or a short- term threat;
(4) Consider evacuation options as follows:
(a) Option 1 - Do Nothing
(b) Option 2 - Search with partial evacuation
(c) Option 3 - Search and evacuation
(d) Option 4 - Evacuate immediately
(5) Alert Explosives Ordnance Demolition Team (EODT) for bomb search
mission and emergency readiness before going to the crime scene;
(6) Proceed immediately to the scene; and
(7) Notify Higher Headquarters of any development.
b. Upon arrival at the scene:
(1) Confirm the reported bomb threat and notify EODT on the need to conduct a bomb
sweep;
(2) Conduct or cause a search for suspicious device/s together with a person familiar
with the location; and
(3) Unless a bomb is found, personnel may not order an evacuation of the affected
area, but may inform
the person-in-charge of the property of the need to evacuate. The following procedures
shall be followed during evacuation:
(a) Evacuation and assembly point routes must be searched to ensure that
personnel are not unnecessarily exposed to danger during the evacuation;
(b) Designate a "safe" assembly area, well away from the threatened structure,
out of line-of-sight of the building, and well clear of windows. A minimum distance of 150
meters is recommended;
(c) Never assemble personnel in front of or directly below glassed areas;
(d) Advise employees and visitors to take their personal belongings to eliminate
superfluous “suspicious objects” and to reduce the number of items to be “checked out”;
(e) Select safe and climatically acceptable assembly areas where evacuees may
wait for
a considerable period;
(f) Avoid car parks as assembly areas and be mindful of the car bomb potential;
(g) Install procedures to ensure that escape routes are clear. Evacuation routes
and assembly areas must be searched before evacuation;
(h) Install procedures to ensure windows and doors are left open and lights left
on; and
(i) Include a procedure for machinery shutdown. This can include plant and
equipment, electronics, computer equipment, securing files, and correspondence.
(4) If a suspected device is discovered, cause the evacuation of people in the affected
area to a distance of at least 300 meters away, and maintain security for the protection
of life and property:
(a) Any discovered device shall be isolated;
 (b) Do not touch, tamper with or disarm any suspected bomb or IED;
(c) Report discovery of suspected device;
(d) Do not permit radio transmission within the premises/building;
(e) Turn off all electricity and gas units within the premises/building;
(f) Secure the area and prevent people from approaching;
(g) Establish traffic control;
(h) Summon ambulance and fire trucks to the scene;
(i) Await the arrival of the bomb disposal team; and
(j) Notify Higher Headquarters of the situation.
4. First Responder’s Procedure in Case of Actual Bomb Explosion
The following are guidelines for FRs during cases of actual bomb explosions:
a. Upon receipt of the report:
(1) Identify the exact location of the incident;
(2) Alert EOD teams and direct them to proceed to the area;
(3) Notify the Higher Headquarters of the situation;
(4) Request assistance of medical personnel; and
(5) Proceed to the scene immediately.
b. Upon arrival at the scene:
(1) Cause immediate evacuation of the injured;
(2) Direct occupants of the establishment to evacuate;
(3) Maintain order and control crowd;
(4) Notify the Higher Headquarters of the situation;
(5) Seal off location until EOD Team determines if a secondary device exists;
(6) Conduct rescue operations at the scene when necessary;
(7) Initiate immediate investigation if investigators have not yet arrived and
determined the following:
(a) Time of detonation/explosion;
(b) Time when the call for bomb threat was received; and
(c) Type of device.
(8) Submit incident report immediately; and
(9) Avoid issuing “speculative” press releases or statements.
 LESSON 12

CONTINUATION OF THE PROCEDURE ON SPECIAL CRIME

A. PROCEDURES IN DETERMINING AND REPORTING OF TERRORISM

INCIDENTS/CASES
The Anti-Terrorism Council headed by the Executive Secretary as Chairman was
mandated by law to assume the responsibility for the proper and effective
implementation of the anti-terrorism policy of the country. The Philippine National
Police, among other law enforcement agencies, serves as a support agency for the
Council.
1. Procedures
a. The On-Scene Commander shall initially determine if there is a high degree of
probability that the incident is a terrorist attack. He also establishes the On-Scene
Command Post and initiates the convening of the Critical Incident Management Task
Group (CIMTG) and the Critical Incident Management Committee (CIMC) regardless of
the nature of the attack.
b. In the event of a suspected terrorist attack, the PROs shall ensure the
management and containment of the incident and shall coordinate with the Task Force
(TF) Sanglahi-Alpha Commander during the development of the case.
c. Bombing attacks and explosions perpetrated by the terrorist, the Inter-Agency
Protocol on Explosives and Related Incidents investigation among the PNP, AFP, NBI,
and PCG shall be strictly followed.
d. The Philippine Bomb Data Center (PBDC) will be the fusion center for the
reporting of ERIs. As such, PBDC will be furnished with all Post-Blast Investigation
(PBI) and initial reports pertaining to ERI.

B. CYBERCRIME INCIDENT RESPONSE PROCEDURE

1. Cybercrime Response
Cybercrime Response is the actual police intervention in a cybercrime incident where
the acquisition of matters of evidentiary value is traceable within the computer's
hardware, software, and network.
2 Guidelines for Cybercrime Incident First Responder
a. When responding to a cybercrime incident, or to a scene of the crime where
computers (or electronic
the device, digital media, and other similar devices) are present, it is imperative for the
First Responder (FR)
to be able to protect, seize, and search the same and to be able to recognize potential
evidence, using the following questions as guidelines to determine its role in the
commission of the crime:
(1) Is it contraband or the fruit of a crime?
(2) Is it a tool used for the commission of the crime?
(3) Is it only incidental to the crime, i.e. being used to store evidence of the
crime?
(4) Is it both instrumental to the crime and a storage device for evidence?
b. After identifying the theories as to the role of the computer in the commission of the
crime, the following
questions essential to any further police intervention should be considered by the first
responder:
(1) Is there probable cause to seize the hardware?
(2) Is there probable cause to seize the software?
(3) Is there probable cause to seize the data?
(4) Where will the search and seizure be conducted?
c. Search of computers (or electronic device, digital media, and other similar devices)
and seizure of data therefrom require a warrant issued by the court.
d. Appropriate collection techniques shall be used to preserve the data sought to be
seized.
e. The evidence seized shall be subjected to forensic examination by trained personnel.
The result of the forensic examination, as well as the testimony of the forensic expert,
shall be made available during the trial.
3 Search and Seizure of Computer
Upon determination of how the computer was utilized in the commission of the crime,
and once the legal
requirements have been complied with, the following are the guidelines for the conduct
of search and seizure:
a. Secure the Scene
(1) Officer’s safety is always paramount.
(2) Preserve the area for potential fingerprints.
(3) Immediately restrict access to the computer.
(4) Isolate from phone lines.

b. Secure the computer as evidence

(1) If the computer is “OFF”, do not turn it “ON”.
(2) If the computer is “ON”, do not turn it “OFF”, nor touch its mouse or its
keyboard.
c. For stand-alone connection or single area connection computers (non-
networked)
(1) Consult a computer specialist.
(2) If a specialist is not available:
(a) Photograph screen and disconnect all power sources and plugs including those at
the back of the computer;
(b) Place evidence tape over each drive slot;
(c) Photograph (or make a diagram) and label parts located at the back of the computer
including its connections;
(d) Label all connectors and cable end to allow reassembly as needed (Example:
“Socket” marked “A” and the “cable End” also marked “A”);
(e) If transport is required, pack the components as "fragile cargo" before transport;
(f) Keep it away from magnets, radio transmitters, and from other hostile environments;
(g) Ensure that only a computer forensic expert searches for any evidence contained
in the computer hardware; and
(h) Ensure that the computer hard disk is duplicated by the forensic expert and the
original is kept
by the evidence custodian for future court presentation. Further search and analysis
shall be undertaken using only the imaged disk.
d. For Networked Computers (or business computers)
(1) Consult a Computer Specialist for assistance.
(2) Do not immediately pull the plug to prevent
(a) Severe damage to the system;
(b) Disrupting the legitimate business; and
(c) Possible liability of the officers.
4. Guidelines in the Treatment of Other Electronic Data Storage Devices
The FR should understand that other electronic devices may contain viable evidence
associated with the crime. The FR must ensure that, unless an emergency exists, the
device should not be accessed. Should it be necessary to access the device, the FR
should ensure that all actions associated with the manipulation of the device should be
noted to document the chain of custody and ensure its admission as evidence in court.

5. Search and Seizure of Wireless Telephones

Upon determination of how the wireless telephone device was utilized in the
commission of the crime, and once the legal requirements have been complied with, the
following are the guidelines for the conduct of search and seizure:
a. If the device is “ON”, do not turn it “OFF”:
(1) Turning it "OFF" could activate the lockout feature.
(2) Write down all information on display and, if possible, secure a photograph.
(3) Power down before transport (bring all power supply cords found at the
scene).
b. If the device is “OFF”, leave it “OFF”:
(1) Turning it on could alter evidence in the device.
(2) Upon seizure, take it to an expert as soon as possible, or contact the local
service provider.
(3) Exert an effort to locate any instructions manual about the device.
6. Search and Seizure of Electronic Paging Devices
The FR should remember that search of stored data in an electronic paging device can
be made only when incidental to a lawful arrest, when consent has been given, and
when a warrant has been issued.
7. Search and Seizure of Facsimile or Fax Machines
The FR should remember that, if the fax machine is "ON", powering it down may cause
loss of the last number dialed or other stored fax numbers. The FR should also
remember that the header line should be the same as the phone line and that if
possible; all manuals should be seized along with the machine.
8. Search and Seizure of Caller ID Devices
a. The FR should be able to recognize potential evidence contained in caller ID
devices such as telephone numbers and subscriber’s information from incoming phone
calls.
b. The FR should remember that interruption of the power supply of the caller ID
device may cause loss of data if not protected by an internal battery back-up.
 c. The FR must also make sure to document all stored data before the seizure of
the device, otherwise, loss of data may occur. All seized electronic equipment shall be
turned over to the Anti-Cybercrime Group (ACG), and in the absence of ACG in the
area, to the local Regional/Provincial Crime Laboratory Office (R/PCLO).

C. RULES ON ANTI-ILLEGAL DRUGS OPERATIONS

1. General Policy and Guidelines

a. The Philippine Drug Enforcement Agency (PDEA) was mandated by law to
carry out the provisions of RA 9165 (Comprehensive Dangerous Drugs Act of 2002),
serve as the implementing arm of the Dangerous Drugs Board, and be responsible for
the efficient and effective enforcement of all the provisions on any dangerous drug
and/or controlled precursor and essential chemical as provided in the Act.
b. The PNP, however, still possesses the authority to conduct anti-illegal drug
operations,
c. The PNP is not prevented from conducting warrantless arrest under Section 5,
Rule 113, and search incident to a lawful arrest under Section 13, Rule 126 of the Rules
of Court.
2. Coordination Requirements
a. PNP units, before any anti-drug operations, shall, as far as practicable,
coordinate with the PDEA;
b. In any case, the PNP anti-drug units shall coordinate/ inform the PDEA of the
anti-drug operation within 24-hours from the time of the actual custody of the suspects
or seizure of said drugs and substances as well as paraphernalia and transport
equipment used in illegal activities involving such drugs and/or substances and shall
regularly update the PDEA on the status of the cases involving the said anti-drug
operation. (Section 86(a) IRR of RA 9165)
c. The word "as far as practicable" means that the prior coordination with the PDEA may
be done, practiced, or accomplished as may be feasible and possible to be performed.
Under the following instances, prior coordination is validly dispensed:
(1) In remote places where coordination is not possible
(2) When coordination will compromise the lives of police operatives, informant
and witnesses, involved in the anti-drug operation;
(3) When coordination will prejudice the apprehension of drug suspects and
confiscation of dangerous drugs and CPECs;
(4) When prior coordination will compromise the entire police operation. (In the
above instances, post coordination shall be made in lieu of prior coordination)
3 Handling, Custody, and Disposition of Evidence
a. In the handling, custody, and disposition of evidence, the provision of Section
21, RA 9165, and its IRR shall be strictly observed.
b. The apprehending officer/team having initial custody and control of the drugs
shall, immediately after seizure and confiscation, physically inventory and photograph
the same in the presence of the accused or the person/s from whom such items were
confiscated and/or seized, or his/her representative or counsel, a representative from
the media and the Department of Justice (DOJ),
and any elected public official who shall be required to sign the copies of the inventory
and be given a copy thereof.
c. The physical inventory and photograph shall be conducted at the place where
the search warrant is served; or at the nearest police station or at the nearest office of
the apprehending officer/team, whichever is practicable, in case of warrantless seizures;
d. Photographs of the pieces of evidence must be taken upon discovery without
moving or altering its position in the place where it was situated, kept, or hidden,
including the process of recording the inventory and the weighing of dangerous drugs,
and if possible under existing conditions, with the registered weight of the evidence on
the scale focused by the camera, in the presence of persons required, as provided
under Section 21, Art II, RA 9165.
e. The seizing officer must mark the evidence with his initials indicating therein
the date, time, and place where the evidence was found and seized.
f. Where the situation requires urgent action suspected drug evidence acquired
may be "field-tested" using a drug test kit. If the result is positive this will be the basis of
the seizure and the conduct of further drug analysis.
g. Within twenty-four (24) hours upon confiscation/seizure of dangerous drugs,
plant sources of dangerous drugs, controlled precursors and essential chemicals, as
well as instruments/paraphernalia and/or laboratory equipment, the same shall be
submitted to the PNP Crime Laboratory for laboratory examination and proper
disposition.
h. Containers, packaging, equipment, etc., suspected of containing trace
amounts of drugs including controlled precursors and essential chemicals will be
considered drug evidence and shall be submitted for analysis.
i. In every negotiation operation, a "seizing officer" shall be designated who shall
be responsible for the inventory and initial custody of all drug and non-drug evidence
during the anti-drug operations. These will later be turned over to the investigation
officer or any member of the apprehending team, as the case may be, or to the Crime
Laboratory for laboratory examination and proper disposition.
j. Cellphones, computers/laptops, or any other electronic equipment or gadgets
shall be properly preserved for evidentiary purposes and technical exploitation.
k. A certification of the forensic laboratory examination results, which shall be
done under oath by the forensic laboratory examiner, shall be issued within twenty-four
(24) hours after the receipt of the subject item/s:.

D. RULES ON ANTI-KIDNAPPING OPERATIONS

The Anti-Kidnapping Group (AKG) is the PNP's lead unit in the conduct of anti-
kidnapping operations which operates in close coordination with the local police units,
other law enforcement agencies, and the community.
1. Types of Kidnapping
a. Kidnapping by Organized Crime Group/Criminal Group (with ransom)
b. Kidnapping by Threat Groups/Terrorists
c. Kidnapping by Other Individuals
2. Concept of Operation
a. Upon receipt of the kidnapping incident report, the police officer shall make an
incident recording, deploy first responders and alert all concerned authorities/ tasked
groups like the local territorial units, Criminal Investigation and Detection Group, and the
Anti-Kidnapping Group (AKG).
b. Upon initial assessment of the type of kidnapping and upon confirmation that
the kidnapping incident is true, the case shall be referred to the AKG, other territorial
units, or to a higher authority
c. If the kidnapping was perpetrated by an Organized Crime Group/Criminal
Group (OCG/CG) and with a ransom demand, it shall be referred to the AKG for their
initial action/operational response.
d. If the kidnapping was perpetrated by Threat Groups/ Terrorists, it shall be
referred to the higher authorities for the activation of AFP-PNP Joint Task Force, Critical
Incident Management Committee (CIMC), or Critical Incident Management Task Group
(CIMTG); local Chief Executive; and other concerned agencies.
e. If kidnapping was perpetrated by other individuals, it shall be referred to the
concerned PNP territorial units for an appropriate operational response.

LESSON 13

PROCEDURES ON PNP CRITICAL INCIDENT MANAGEMENT OPERATIONAL

1. PNP CRITICAL INCIDENT MANAGEMENT OPERATIONAL

As a matter of policy, human-induced (man-made) critical incidents are the

responsibilities of the National and Local Peace and Order Council (NPOC) while
natural calamities and disasters are the responsibilities of the National and Local
Disaster Risk Reduction and Management Council (NDRRMC). Lower-level
organizations of the NPOC and NDRRMC take cognizance of the responsibilities
ascribed to their national organization. The PNP, being at the forefront of crises, must
play an active role by organizing its Incident Management Committee (IMC) in support
of the NPOC and NDRRMC.
The Secretary of the Interior and Local Government is designated as the Cabinet -
Officer Primarily Responsible (C-OPR) for threats to peace and order such as civil
disturbance, violent labor strikes, riots,
anarchy, disorderly mass demonstrations. The SILG acts also as the Vice Chairman on
Disaster Preparedness, NDRRMC.
1. Types of Incidents:
a. Man-Made Incidents - In the event of man-made incidents, the PNP shall respond to
two different
situations:
(1) To manage an incident that could be resolved by the responding policemen
without the involvement of CMC (ex: hostage-taking of a father to his son);
(2) To manage an incident that needs a CMC–directed operations that require
the implementation of special tasks by one or more of the urgent services of the
Philippine government (ex: raids or attacks by lawless elements on a community
causing significant impacts on the social, economic, security, and political situation in
the affected area).
b. Natural/Disaster Incidents - In the event of natural/ disaster incidents, the PNP shall
act as the first responder in the affected area to provide area security and support to the
conduct of search and rescue operations to be spearheaded by the area DRRRMCs.
2. 5 P’s of Crisis Management
The 5 Ps are executed in three phases – proactive (predict, prevent, prepare); reactive
(perform); and post-conflict (post action and assessment).
PROACTIVE PHASE - is designed to predict or prevent the probability of occurrence of
crises at the same time prepare to handle them when such occur.
a. Predict - attempts to remove uncertainty from the future. The Predict
component is undertaken through Strategic, Operational, and Tactical Situation
Awareness (SA) processes. Strategic SA is producing foresight and conveying strategic
warnings through Horizon Scanning or Strategic Forecasting. It scans the environment,
identifying weak signals, drivers, inhibitors, wildcards, threats, hazards, risks,
opportunities, and vulnerabilities, among others, develops foresight, and conveys
strategic warnings. Operational and Tactical SA is producing detailed reports against a
specified threat, describing the operating environment where a threat or a crisis could
emerge; the threat of the crisis itself, it's potential of becoming a crisis; and current
efforts and capabilities of agencies/departments addressing the threat or crisis.
b. Prevent - a deliberate action aimed at avoiding future harm by addressing its
causes. It is closely related to mitigation which accepts that a potentially harmful
incident cannot be prevented, but harmful consequences arising from it can be
minimized by precautionary measures. The two (2) preventive measures are: the first
involves a long-term strategy that is expected to yield effects over years; and, the other
is operational (e.g. target hardening). Prevention capability is essentially physical
security. It is the responsibility of government security forces with the support of
Barangay Peacekeeping Action Teams (BPATs). For man-made incidents, it requires
vigilance and alertness to signs and manifestations of suspicious-looking individuals;
warning and alert systems have to
be established to alert the population to minimize the effects of terrorist attacks in terms
of casualties and damages, active and passive security measures.
c. Prepare - essential for effective response. It covers six (6) essential activities:
Plan, Organize, Train, Equip, Exercise and Evaluate and Improve. Simulation and
tabletop exercises evaluate the effectiveness of preparations, bring out flaws and
weaknesses and enable corrections and remedies to be effected, to heighten levels of
readiness of systems, procedures, organization, equipment, and logistics, to better cope
with an actual crisis.
REACTIVE PHASE - is the institution of passive and active security measures, remedy
or solution to destabilizing factors or security flaws to such crisis,
or emergency, vigilance, and alertness to signs or manifestations of developing crisis, or
emergency and establishment of alert systems.
d. Perform - the actual implementation of contingency plans when a crisis
occurs, despite the pro-active measures undertaken. Once a crisis occurs, priorities
shift from building or enhancing capabilities to employing resources to save lives,
protect property and environment, and preserve the social, economic, and political
structure of the jurisdiction.
POST CONFLICT PHASE - This is the situation when the proactive and reactive
phases were all done.
e. Post-Action and Assessment - a component that begins when the crisis has
been addressed and the situation is deemed clear. It is in this phase where the
organization is returning to business as usual. Post – Action activities seek ways to
evaluate and improve prevention, preparation, and actual execution.
3 Incident Command System (ICS)
The PNP’s ICS, patterned under NCMCM’s ICS is structured on six major functional
areas: Command, Operations, Planning, Logistics, Finance/Administration, and
Intelligence/Investigation as an optional sixth functional area that is activated on a case
to case basis. Every level of the ICS has the corresponding role to play in Critical
Incident Management operations.
a. Incident Command/ Incident Commander (IC) – the person designated by
the Chairman, CMC to provide the overall supervision and management in handling
incident response operations. He manages the human and other resources necessary
to address the crisis.
b. Command Staff (CS) – Provides technical advice to the IC and they are: (1)
The Safety Officer (SO) – monitors safety conditions and develops measures for
assuring the safety of all assigned personnel.
(2) The Public Information Officer (PIO) – serves as the conduit for information to
internal and external stakeholders, including the other organizations seeking information
directly from the incident or event.
(3) Liaison Officer (LO) – serves as the primary contact for supporting agencies
assisting at the incident.
(4) Negotiation Team (NT) – serves as the lead team in communicating/negotiating
with the suspects or perpetrators of the crisis incident (Negotiation Team will be
included only when the critical incident requires like during hostage incidents).
c. General Staff (GS) – provides planning and operations direction and supervision,
resources procurement and allocation, and support services. They are primarily
composed of:
(1) Operations/Plans Staff (OPS) – tasked with directing all actions to meet the
incident objectives.
(2) Intelligence and Investigation Staff (IIS) – tasked with the collection and display of
incident information, primarily consisting of the status of all resources and the overall
status of the incident.
(3) Budget and Logistics Staff (BLS) – tasked with tracking incident related costs,
personnel records, requisitions, and administrating procurement contracts required by
Logistics.
(4) Administrative Staff (AS) – tasked with supervising all human resources and other
administrative services and support required by the incident.

4 Alert Levels During Human-Induced (Man-Made) Critical Incident

An appropriate man-made critical incident alert level shall be disseminated by DO to all
concerned offices through the PNP National Operations Center (NOC).
a. Level 1 (Low) – There is no information to suggest a specific man-made
Critical Incident may occur.
 b. Level 2 (Moderate) – Man-made Critical Incident is possible, but not likely.
c. Level 3 (High) – There is a strong possibility that a manmade Critical Incident
may occur within a short period.
d. Level 4 (Extreme) – A man-made Critical Incident has just occurred or has
just been pre-empted; or incidents are expected.

5 Stages in Disaster Management

a. Pre- Disaster Stage - Pro-active Assessment (Level
1 - Green): When there are no disasters or calamities:
(1) Conduct Risk Mapping and identification of disaster-prone areas;
(2) Identification of staging areas, evacuation routes, and evacuation centers;
(3) Conduct of disaster drills (earthquake, fire, etc.) simulation exercises and
training;
(4) Holding of regular Task Groups and Sub-Task Groups meeting together with
respective levels of the National Disaster Risk Reduction and Management Councils;
(5) Capability enhancement (Manpower, Machines, Materials, Money, and
Methods);
(6) Production and distribution of Information Education Campaign materials; and
(7) Conduct of community organizational work for various purposes such as:
(a) Sewerage clean-up;
(b) De-clogging of waterways, canals, esteros;
(c) Clearing of squatter shanties and unauthorized occupants in disaster-
prone areas; and
(d) Other community mobilization activities.
b. Disaster Response Stage - Disaster Incident Management (Level 2 - Red):
When there is an official forecast of an incoming natural disaster in the country and
when an unexpected
natural disaster suddenly occurs in the country:
(1) Activation of Disaster Incident Management Task Groups in areas expected
to be hit by the weather disturbance twenty-four (24) hours before the expected landfall
or occurrence;
(2) Employment of alarm and warning systems as stipulated under DILG MC
2009-165, such as the use of police sirens and other portable warning systems capable
of producing loud wailing sound;
(3) Activation of the PNP Disaster Incident Management Committee;
(4) Coordination with NDRRMC to support its disaster response;
(5) Activation of PNP SCDM National Disaster Operations Center (NDOC) to be
co-located at the
NHQ PNP National Operations Center;
(6) Activation of Command Post by Task Groups whose area is hit by the
disaster;
(7) Forced relocation/pre-emptive evacuation of residents in flood-prone areas in
coordination with corresponding LDRRC; and
(8) Conduct timely and rapid disaster response according to the needs in the
disaster/calamity area such as search & rescue operation, evacuation & relief operation,
emergency medical services, and security & traffic management operation in support
and coordination with NDRRMC.
c. Post-Disaster Stage - Support to Recovery and Rehabilitation Efforts (Level 3-
White):
(1) Get reports from concerned Disaster Risk Reduction and Management
Council the Damage Assessment and Needs Analysis of the affected areas;
(2) Deployment of relief personnel for relief operations;
(3) Provide security and traffic assistance to returning evacuees;
(4) Submit After Disaster Response Report to C, PNP copy furnished DRRMC;
and
(5) Deactivation of the PNP SCDM by the C, PNP through the Chairman/Task
Coordinator, PNP
SCDM when the situation is already manageable in the disaster-stricken area.
6 ORGANIZATION AND STRUCTURE OF CIMC/CIMTG/ DIMTG
In accordance with Executive Order 320, as amended, NPOC has constituted Crisis
Management Committees (CMCs) at all levels specifically to take decisive action in
emergencies.
a. The Peace and Order Council (POC) Crisis Management Committee (CMC)
The Crisis Management Committee (CMC) is primarily concerned with the formulation
of crisis management procedures, integration, and orchestration of government,
military/police, and public efforts towards the prevention and control of crisis incidents.
All actions and decisions taken by the CMC shall be within the policies laid down by the
corresponding Peace and Order Councils (PCOs).
b. The PNP NHQ Critical Incident Management Committee (PNP NHQ CIMC)
In support of the mandates of CMCs, the PNP NHQ shall organize its Critical Incident
Management Committee (PNP CIMC) with four (4) sub-committees namely: sub-
committee on criminality, sub-committee on destabilization/public disturbances, sub-
committee on terrorism, and the sub-committee on disasters.
(1) Sub-Committee on Criminality – shall take cognizance on act/s or omission/s
against public law/s which tends to prejudice the community and is punishable by the
courts of justice.
(2) Sub-Committee on Destabilization/Public Disturbances – shall take cognizance
on threats posed by destabilizers which include military uprisings, demonstrations,
rallies, sabotage of key installations, etc., or a combination thereof, undertaken
separately or jointly by anti-government forces from the left and right of the political
spectrum. These critical incidents, backed oftentimes by disgruntled uniformed
personnel and politicians with a vested interest, are undertaken primarily to undermine
the present leadership, thereby rendering it unstable and incapable of effective
governance or surviving with the end given averting the status quo to replace the
government..
(3) Sub-Committee on Terrorism – shall take cognizance on acts punishable
under any of the following provisions of the Revised Penal Code: Article 122 (Piracy in
general and Mutiny in the High Seas or the Philippine Waters); Article 134 (Rebellion or
Insurrection); Article 134a (Coup d'état) including acts committed by private persons;
Article 248 (Murder) thereby sowing and creating a condition of widespread and
extraordinary fear and panic among the populace, to coerce the government to give in
to an unlawful demand.
(4) Sub-Committee on Disaster Management (PNPSCDM) – TDPCR as the
Chairman/Task Force Commander, Dep DPCR as the Deputy, Chairman and the
following are the members: DPRM, DI, DL, DPL, DC, DIDM, DHRDD, DRD, DICTM
Other NSUs, and Community Affairs Division (CAD), DPCR as the Secretariat. The
PNP shall organize Task Groups from the National Hqs down to the City/Municipal
Police Stations following the Incident Command System ICS Structure: Critical Incident
Management Task Group (CIMTG) to address human-induced (manmade) incidents
and Disaster Incident Management Task Group (DIMTG) to address disaster incidents.
c. The Critical Incident Management Task Group (CIMTG)
To carry out the mandates of the PNP Critical Incident Management Committee (PNP
CIMC) on human-induced (man-made) incidents, Critical Incident Management Task
Groups (CIMTGs) shall be organized and replicated at the PRO/NCRPO (Regional)
level down to the PPO/CPO; CPS/MPS (City/Municipal) level following the PNP's ICS
structure.
The following are considered as human-induced critical incidents:
(1) Incidents like abduction, involving prominent personalities such as national
and local government officials, foreign nationals (diplomats, ambassadors, consuls,
attachés, foreign tourists), religious leaders from various religious congregations, and
other personalities whose involvement in incidents may result in controversies;
(2) Incidents involving national security such as attacks on vital installations,
communities, and prominent personalities.
(3) Jailbreaks;
(4) Heinous crimes like assassination, ambush involving prominent personalities;
(5) Robbery hold-up, armored van robbery, and bank robbery perpetrated by
syndicated groups;
(6) Election –Related Violent Incident (ERVi);
(7) Surrender of enemy personalities and notorious criminals wanted by law;
(8) Coup d’état; and
(9) Other similar man-made critical incidents that may result in human casualties
and/or destruction of properties.
d. Disaster Incident Management Task Group (DIMTG)
A Disaster Incident Management Task Group shall also be established and shall serve
as a special operating task group of the PNP SCDM and assist the PRO Disaster
Incident Management Task Groups as the Chairman/Task Coordinator, PNP SCDM
may direct. As a matter of rule, a Regional DIMTG shall be activated if two (2) or more
Provinces/Cities are affected by the disaster, a Provincial DIMTG shall be activated if
two (2) or more municipalities are affected and a Municipal DIMTG shall be activated if
two (2) or more barangays are affected (refer to LOI 35/10 “SAKLOLO REVISED.
The following are considered natural disaster incidents:
(1) Floods;
(2) Landslides;
(3) Volcanic Eruption;
(4) Earthquake;
(5) Tidal Wave;
 (6) Tsunami;
(7) Typhoons;
(8) Drought; and
(9) Other natural hazards that may lead to colossal loss of property and lives

B. GENERAL RULES ON MEDIA RELATIONS DURING CRISIS

a. It is the responsibility of any Unit Head/Chief or Ground Commander to
respond to queries raised by the press, as well as decide on what media lines or press
releases would be given out to the media unless he delegates this responsibility to the
unit PIO or spokesperson.
b. No information regarding the incident shall be released without clearance from
the Ground Commander.
c. Ground Commander must designate/establish a media area for pooled
coverage and ensure the safety of all media personnel covering the incident.
d. Media practitioners shall be confined to an area designated by the incident
commander and never, in the process of hostage-taking incident, be allowed to air live
coverage of unfolding event.
e. Suspect/s arrested for any violation of the law shall in no case be presented in
a 'firing line' to the media and must maintain a limit of the disclosure.
f. In cases when information must be denied/withheld to the press, the basis for
such shall be fully and courteously explained.
g. Ranking officers at crime or incident scenes may provide factual information to
the media subject to the limitation by existing policies.
h. In cases of inter-agency operations, the department/agency with primary
jurisdiction will determine the dissemination of appropriate media lines.

C. DEFINITION OF TERMS
AFIS (Automated Fingerprint Identification System) – it refers to the PNP
Crime Laboratory's computerized system captures, matches, compares identifies, and
verifies stored digitized fingerprints.
Arrest – it denotes on the taking of a person into custody so that he may be
bound to answer for the commission of an offense.
Buy Bust Operation –it refers to an entrapment technique employed by a peace
officer as an effective way of apprehending a criminal in the act of the commission of
the offense.
Chain of Custody – it denotes to the duly recorded authorized movements and
custody of seized drugs or controlled precursors and essential chemicals or plant
sources of dangerous drugs or laboratory equipment at each stage, from the time of
seizure/confiscation to receipt in the forensic laboratory to safekeeping to presentation
in court and destruction.
Child Abuse – refers to the maltreatment, whether habitual or not, of the child
which includes any of the following:
a. Psychological and physical abuse, neglect, cruelty, sexual abuse, and
emotional maltreatment;
b. Any act by deeds or words which debases, degrades, or demeans the
intrinsic worth and dignity of a child as a human being;
 c. Unreasonable deprivation of his basic needs for survival, such as food
and shelter; or
d. Failure to immediately give medical treatment to an injured child
resulting in serious impairment of his growth and development or his permanent
incapacity or death.
Child in conflict with the law – refers to a child who is alleged as, accused of,
or adjudged as, having committed an offense under Philippine laws. A "child at risk"
refers to a child who is vulnerable to and at the risk of committing criminal offenses
because of personal, family, and social circumstances, such as, but not limited to, the
following:
• being abused by any person through sexual, physical, psychological,
mental, economic or any other means and the parents or guardian refuse, are unwilling,
or, unable to protect the child;
• being exploited including sexually or economically;
• being abandoned or neglected, and after diligent search and inquiry, the
parent or guardian cannot be found;
• coming from a dysfunctional or broken family or without a parent or
guardian;
• being out of school;
• being a street child;
• being a member of a gang;
• living in a community with a high level of criminality or drug abuse;
• living in situations of armed conflict;
• being in any other similar situation.
Children – refers to persons below eighteen years of age or older but are unable
to fully take care of themselves from abuse, neglect, cruelty, exploitation, or
discrimination because of a physical or mental disability or condition.
Conjugal Visit – refers to the visit of the spouse of the detainee to fulfill the
marital obligation.
Crime Scene – is the place from which most physical evidence associated with a
crime will be obtained.
Critical Incident – is an emergency event, whether man-made or natural, that
requires the implementation of special tasks by one or more of the urgent services of
the government and will generally include the involvement, either directly or indirectly, of
the Philippine National Police. It is a crucial and rapid intervention point at the acute
phase of a crisis.
Crime Scene Investigation – is the conduct of processes more particularly the
recognition, search, collection, handling, preservation, and documentation of physical
evidence to include identification of witnesses and arrest of the suspect at the crime
scene.
Custodial Investigation – an investigation conducted by law enforcement
officers after a person has been arrested or deprived of his freedom of action. It
includes an invitation to a person who is investigated in connection with an offense.
Destabilization – are threats posed by the destabilizers which include military
uprisings, demonstrations, rallies, sabotage of key installations, etc., or a combination
thereof, undertaken separately or jointly by anti-government forces from the left and the
right of the political spectrum. These critical incidents, backed oftentimes by disgruntled
uniformed personnel and politicians with vested interests, are undertaken primarily to
undermine the present leadership, thereby rendering it unstable and incapable of
effective governance or surviving with the end given averting the status quo to replace
the government.
Detainee/Detention Prisoner – refers to a person arrested due to the
commission of a crime/offense by the arresting unit for custodial investigation. It likewise
includes persons arrested for heinous crimes, against national security, and high-profile
crimes.
Detention – a restraint of personal liberty or deprivation of freedom of action in
any significant manner.
Detention/Custodial Center – an institution secured by the PNP Units
concerned for providing short-term custody of the detention prisoner thereby affording
his safety and preventing escape while awaiting the court's disposition of the case or
transfer to an appropriate penal institution.
Detention Officer – a Police Commission Officer (PCO) or Police Non-
Commission Officer (PNCO) directly responsible for the administration and
management of the detention facility and the detainees housed therein.
Disaster Incident – refers to serious disruption of the functioning of a community
or a society involving widespread human, material, economic or environmental losses
and impacts, which exceeds the ability of the affected community or society to cope
using its resources.
Dragnet Operation – is a police operation purposely to seal-off the probable exit
points of fleeing suspects from the crime scene to prevent their escape.
Electronic Blotter – is a computerized system that is now being used in Davao City
Police Office which was accepted by the courts, prosecutors' office, and the public in
general.
First Responder – refers to a Police Officer who is the first to arrive at the crime
scene to provide initial police actions on the information or complaint received.
Freedom Park – shall mean the venue or place established or designated by
local government units within their respective jurisdictions where a public assembly
could be held without securing any permit for such purpose from the local government
unit concerned.
Hasty Checkpoint – is an immediate response to block the escape of lawless
elements from a crime scene, and is also established when nearby checkpoints are
ignored or during hot pursuit operations.
High-Risk Arrest – it denotes to the actual restraint of armed persons following
a high-risk stop.
High-Risk Stop – it denotes to the actual stopping or accosting of an armed and
dangerous person or persons, aboard a vehicle or on foot, including the power to use all
necessary and legal means to accomplish such an end.
Hot Pursuit (Cross-Jurisdictional Pursuit) – (also termed in the US as fresh
pursuit) it means an immediate, recent chase or follow-up without a material interval to
take into custody any person wanted under a warrant, or one suspected to have
committed a recent offense while fleeing from one police jurisdictional boundary to
another that will normally require prior official inter-unit coordination but which the
pursuing unit cannot, at that moment, comply due to the urgency of the situation.
Immediate Family Members – shall refer to the detainee’s spouse, fiancé or
fiancée, parent or child, brother or sister, grandparent or grandchild, uncle or aunt,
nephew or niece, and guardian or ward.
Imminent Danger – the danger is “imminent” if it is on the point of happening. It
is not required that the attack already begins, for it may be too late. (The Revised Penal
Code, Book I, JBL Reyes). The elements of imminent danger are the following:
1. Intent of the suspect to harm the policeman;
2. The capability of the suspect to harm the policeman or other persons;
and,
3. Accessibility or the proximity of the suspect in harming the policeman
and other persons.
Inquest Proceedings – it denotes to the informal and summary investigation
conducted by a public prosecutor (called the inquest prosecutor) in criminal cases
involving a person arrested, without the benefit of a warrant issued by the court, and
thereafter detained, to determine whether or not the warrantless arrest is valid, said
arrested person should remain under custody, and be correspondingly charged in court.
Investigator-On-Case (IOC) – it denotes to the police officer who determines the
cause or motive of the crime, identify and interview witnesses, and effects arrest of
suspect/s.
Man-made Critical Incident – it refers to special events, acts of terrorism,
destabilization, and criminal activities that require the prompt implementation of police
procedures or interventions to contain and mitigate the incident as well as to normalize
the situation.
Maximum Tolerance – means the highest degree of restraint that the police,
military, and other peacekeeping authorities shall observe during a public assembly or
in the dispersal of the same.
Miranda Doctrine – it denotes to a principle on the rights of a suspect from
forced self-incrimination during police interrogation as enshrined in the 1987 Philippine
Constitution’s Bill of Rights (Article III, Sec. 12).
Missing – Anyone whose whereabouts cannot be established and where the
circumstances are out of character or the context suggests the person may be subject
to criminal or at risk of harm to themselves or another.
Mug shot (or booking photograph) – it is a photograph of the suspect taken
after one is arrested. The purpose of the mug shot is to allow the law enforcement
agency to have a photographic record of the arrested individual to allow for identification
by victims and investigators.
Necessary and Legal Means – as used in the definition shall include, but not
limited to, the employment of an appropriate number of troops, armor assets, and
tactical or special units to effectively and permanently quell the threat or present danger,
or to swiftly restrain or arrest the suspect or suspects.
On-Scene Command Post – refers to a temporary area established in the
vicinity of a crime scene to coordinate all activities or actions relevant to the
investigation of the case.
 Pat-down Search – is a “frisk” or external feeling of the outer garments of an
individual for weapons only.
Police Checkpoint – a location where the search, which is duly authorized by
the PNP, is conducted to deter/prevent the commission of crimes, enforce the law, and
for other legitimate purposes.
Pre-Determined Area – is the specific or projected spot where the armed and
dangerous person or persons would pass or likely to pass and so tactically located as to
gain a calculated advantage against a said person or persons.
Property Custodian – the Property Custodian is a designated individual who
has the authority and responsibility for the immediate physical custody of all personal
property under their control and within their custodial area. He is the person designated
to receive, store, issue properties, attach identification tags or labels to the property to
the type of object and keep records of incoming and outgoing properties.
Public assembly – means any rally, demonstration, march, parade, procession,
or any other form of mass or concerted action held in a public place to present a lawful
cause; or expressing an opinion to the general public on any particular issue; or
protesting or influencing any state of affairs whether political, economic or social; or
petitioning the government for a redress of grievances.
Public Place – shall include any highway, boulevard, avenue, road, street,
bridge or other thoroughfares, park, plaza, square, and/ or any open space of public
ownership where the people are allowed access.
Reasonable Suspicion – facts that, within the totality of the circumstances, lead
an officer to reasonably suspect, or to have probable cause to believe, that criminal
activity has been, is being, or is about to be committed.
Rogues Gallery (or rogues’ gallery)/mug shot book – is a police collection of
mug shots and pictures or photographs of criminals and suspects kept for identification
purposes.
Scene of the Crime Operation (SOCO) – is a forensic procedure performed by
trained personnel of the PNP Crime Laboratory through scientific methods of
investigation to preserve the crime scene, gathering information, documentation,
collection, and examination of all physical evidence.
Search Warrant – is an order in writing issued in the name of the People of the
Philippines, signed by a judge and directed to a peace officer, commanding him to
search for personal property described therein and bring it before the court.
Security Officer – it denotes to a properly trained and cleared officer whose
appointment is covered by appropriate orders with the concurrence of the Directorate
for Intelligence.
Spot Check/Accosting – is the brief stopping of an individual, whether on foot or
in a vehicle, based on reasonable suspicion/ probable cause, to determine the
individual's identity and resolve the officer's suspicion concerning criminal activity.
Stopping Zone – is the strategic predetermined area strongly sealed off,
barricaded, and occupied by tactical forces in a lawful display of authority to maintain
law and order or in defensive response to an event of criminal nature or of such gravity
that occurred or likely to occur calling for a high-risk stop or arrest.
 Terrorism – it denotes to an act punishable under any of the following provisions
of the Revised Penal Code: Article 122 (Piracy in General and Mutiny in the High Seas
or the Philippines Waters; Article 134
(Rebellion or Insurrection); Article134a (Coup d'état); including acts committed by
private persons; Article 248 (Murder) thereby sowing and creating a condition of
widespread and extraordinary fear and panic among the populace, to coerce the
government to give in to an unlawful demand shall be guilty of the crime of terrorism
and shall suffer the penalty of forty (40) years imprisonment, without the benefit of
parole as provided for under Act No.4103, otherwise as to the Indeterminate Sentence
Law as amended. (Source RA 9372-Human Security Act of 2007)
Unlawful Aggression – refers to an attack amounting to an actual or imminent
threat to the life, limb, or right of the person claiming self-defense.

INTRODUCTORY GUIDE TO CRIME ANALYSIS AND MAPPING

Ever since maps have been available that depict the geographic features of
communities, such as streets and city boundaries, police departments have used such maps
to determine patrol areas and emergency routes as well as to assist patrol officers in finding
specific addresses. Police departments have also mapped crime, a process that, until recently,
involved the manual placement of pins on hand-drawn wall maps. This chapter discusses the
emergence of computerized crime mapping as a tool for conducting crime analysis. It begins
with an introduction to key terms and then describes basic concepts before presenting a
history of crime mapping and information on the field’s current status and career paths.
The following topic was developed from the curriculum for the "Introduction to Crime
Analysis, Mapping, and Problem Solving". This topic focuses on defined terms used in this
topic, types of crime analysis, introduction to crime mapping, types of crime mapping, and its
history.
A. DEFINITION OF TERMS
Apprehending criminals
The main function of crime analysis is to support law enforcement endeavors. One of
the primary goals of law enforcement is the apprehension of criminals; consequently, one of
the primary goals of crime analysis is to assist in the apprehension of criminals.
Crime Analysis
Is a law enforcement function that involves systematic analysis for identifying and
analyzing patterns and trends in crime and disorder. Information on patterns can help law
enforcement agencies deploy resources more effectively, and assist detectives in identifying
and apprehending suspects. Crime analysis also plays a role in devising solutions to crime
problems and formulating crime prevention strategies.
Crime
In a law enforcement agency, the central focus is a crime, both those reported to the
police and those that are not. Thus, the central type of data analyzed is a crime and the
information surrounding it, such as arrests, offenders, victims, property, and evidence.
Crime mapping
This is a term used in policing to refer to the process of conducting spatial analysis
within crime analysis. This is the process of using a geographic information system to conduct
spatial analysis of crime problems and other police-related issues.
 *Crime mapping serves three main functions within crime analysis:
1. It facilitates visual and statistical analyses of the spatial nature of crime and other
types of events.
2. It allows analysts to link unlike data sources together based on common geographic
variables (e.g., linking census information, school information, and crime data for a
common area).
3. It provides maps that help to communicate analysis results.
Evaluate organizational procedures
The fourth goal of crime analysis is assisting with the evaluation of organizational
procedures. Several examples include resource allocation, the assessment of crime
prevention programs, realigning geographic boundaries, forecasting staffing needs, and
developing performance measures for the police department.
Geographic information system (GIS)
This is a powerful software tool that allows the user to create any kind of geographic
representation, from a simple point map to a three-dimensional visualization of spatial or
temporal data.
Law enforcement information
In addition to crime, law enforcement agencies address many other issues and thus
collect many other types of data. Examples of law enforcement data that are often available
for crime analysts are calls for service (e.g., noise complaints, burglary, alarms, suspicious
activity), traffic information (e.g., accidents and citations), citizens’ perceptions (e.g., fear of
crime, crime prevention behavior, satisfaction with the police), victimization, probation records,
and parole information.
Socio-demographic
This type of information refers to the characteristics of individuals and groups such as
sex, race, income, age, and education. On an individual (micro) level, socio-demographic
information is used in law enforcement to search for and identify crime suspects. On a macro
level, socio-demographic information is used to determine the characteristics of groups and
how they relate to crime.
Spatial
The location where crimes or activities occur and the relationship of those places to one
another and other information is an important factor in the analysis of crime. It is not only
important where a crime takes place but also the characteristics of those places and the
environment in which the crime occurs. Thus, the examination of spatial data such as street
networks, parcel information, orthophotographs, school locations, business, and residential
zoning, among others, is imperative for effective crime analysis.
Prevent crime
Another primary goal of law enforcement is to prevent crime through methods other
than apprehension. This goal lends itself particularly well to assistance from crime analysis.
For example, members of the police department are conducting a crime prevention campaign
about the residential burglary and would like to target their resources in the areas that need it
the most. Crime analysis can assist in planning community education and patrol response
tailored to the problem by providing spatial analysis of residential burglary, analysis of how,
when, and where the burglaries occurred, and analysis of what items were stolen.
Reduce disorder
Many criminologists contend that social disorder can lead to crime; that is, blight and
other indicators of social decay left unchecked can attract crime and accelerate further decay.
Thus, reducing disorder is a law enforcement objective and, by extension, one for crime
analysis as well. Crime analysis can assist with these efforts by providing research and
analysis of disorder indicators such as traffic accidents, noise complaints, or trespass
warnings that can assist officers in addressing these issues before they become more serious
problems.
Study
It is a systematic way of looking at crime and law enforcement information. That is,
crime analysis is not examining information haphazardly but rather is applying formal
analytical and statistical techniques as well as a research methodology to law enforcement
information according to the rules of social science
B. Types of Crime Analysis
The following are five types of analysis that fall under the umbrella of crime
analysis. As you will see, each contains characteristics of crime analysis in general, but each
is specific in the type of data and analysis used as well as in its purpose.

Intelligence Analysis
The study of “organized” criminal activity, whether or not it is reported to law
enforcement to assist investigative personnel in linking people, events, and property. The
purpose of intelligence analysis is to assist sworn personnel in the identification of networks
and apprehension of individuals to subsequently prevent criminal activity. A related goal is to
link information together, prioritize information, identify relationships, and identify areas for
further investigation by putting the analysis in a framework that is easy to understand. Much of
the information analyzed in the field of intelligence analysis is not reported to the police by
citizens but is gathered by law enforcement. Examples of data collection methods include
surveillance, informants, and participant observation.

1. Criminal Investigative Analysis

The study of serial criminals, victims, and/or crime scenes as well as physical, socio-
demographic, psychological, and geographic characteristics to develop patterns that will assist
in linking together and solving current serial criminal activity. This type of analysis has also
been called “profiling,” which is the process of constructing a “profile” of an unknown offender
based on the nature of the crime, the facts of the case, and the characteristics of the victim. As
with intelligence analysis, this type of analysis focuses primarily on qualitative data
surrounding serious serial crimes such as murder and rape. Data are collected and analyzed
on an individual level for those persons primarily or peripherally involved with the incidents.
The spatial nature of the incidents and related locations such as the body dump sites or the
encounter sites is also considered. The primary purpose of the criminal investigative analysis
is to develop patterns of serial crimes crossing city, state, and even national boundaries by
linking behavior and evidence within and among incidents to catch the offender and/or clear
cases

2. Tactical Crime Analysis

The study of recent criminal incidents and potential criminal activity by examining
characteristics such as how, when, and where the activity has occurred to assist in problem-
solving by developing patterns and trends, identifying investigative leads/suspects, and
clearing cases. Tactical crime analysis focuses on information from recent crimes reported to
the police. "Recent" can refer to the last few months or longer periods for specific ongoing
problems.
Tactical crime analysis also focuses on specific information about each crime such as
the method of entry, point of entry, suspects actions, type of victim, type of weapon used, as
well as the date, time, location, and type of location. Field information such as suspicious
activity calls for service, criminal trespass warnings, and persons with scars, marks, or tattoos
collected by officers are also considered in the analysis.
*Three purposes of tactical crime analysis are;
1. Linking cases together and identifying the notable characteristics of the
patterns and trends.
2. Identifying potential suspects of a crime or crime pattern.
3. Clearing cases.
The focus of tactical crime analysis is examining data daily to identify patterns, trends,
and investigative leads for recent criminal and potential criminal activity. Once a crime pattern,
suspect, or investigative lead is identified, the information is compiled and disseminated to
patrol officers and detectives.

3. Strategic Crime Analysis

The study of crime and law enforcement information integrated with socio-demographic
and spatial factors to determine long term "patterns" of activity, to assist in problem-solving, as
well as to research and evaluate responses and procedures.
Strategic crime analysis consists primarily of quantitative analysis of aggregate data.
(Monthly, quarterly, and/or yearly compilations of criminal and non-criminal information such
as crime, calls for service, and traffic information are analyzed in aggregate form).
Two primary purposes of strategic crime analysis
1. To assist in the identification and analysis of long-term problems such as drug
activity or auto theft.
2. To conduct studies to investigate or evaluate relevant responses and
procedures. Both of these purposes correspond very well to problem-solving.
These types of studies include
1. Evaluation of crime prevention programs.
2. in-depth examination of a particular crime problem.
3. Implementation of a survey of citizens’ perceptions of crime and the police.

They incorporate pre- and post-measurement as well as both impact and process
evaluation methodology. Procedures examined include such activities as deployment and
staffing, redistricting of beats or precincts, data entry and integrity, and the reporting process.
In sum, strategic crime analysis uses statistical techniques and research methods to
investigate long-term problems and evaluate organizational procedures. Analysts who
primarily conduct strategic crime analysis are also called problem or research analysts.

4. Administrative Crime Analysis

The presentation of interesting findings of crime research and analysis based on legal,
political, and practical concerns to inform audiences within law enforcement administration,
city government/council, and citizens.
Administrative crime analysis is different from the previous types of analysis in that it
refers to the presentation of findings rather than to statistical analysis or research. The
decision of what and how to present information is the primary focus of administrative crime
analysis. Often, the type of information that is presented represents the “tip of the iceberg” of
all the work and analysis that has previously been done, for example, an executive summary
of a report. The purpose and the audience of the information determine “what” is presented
along with legal (e.g. privacy and confidentiality), political (e.g., union issues, election
concerns), and practical concerns (e.g., the complexity of the information presented). The
primary purpose of administrative crime analysis is to inform audiences. These audiences may
vary from one situation to the next, which is why the type and quantity of information should
vary as well. Audiences can be police executives, city council, media, citizens, and
neighborhood groups, or a combination

Introduction to Crime Analysis Mapping and History

History of Crime Mapping
Even though crime mapping plays a significant role in crime analysis today, conducting
spatial analysis and creating crime maps have only recently become common in policing and
crime analysis, thanks to advancements in technology. Unlike crime analysis, the history of
crime mapping begins not with the establishment of the first police force, but with researchers
long before computers were invented.

Beginnings of Crime Mapping

In the 1800s, European researchers who adhered to the school of thought known as
the cartographic school of criminology examined the levels of crime within different areas
(regions) and the relationship of these levels to sociological factors, such as socioeconomic
status (Groff & La Vigne, 2002). (For example, in 1829, Adriano Balbi, an ethnographer and
geographer, and André-Michel Guerry, a lawyer, created the first maps of crime using criminal
statistics for the years 1825 to 1827 and demographic data from the census. They examined
crimes against property, crimes against persons, and levels of education in France and found
that areas with high levels of crimes against the property had a low incidence of crimes
against people and that higher numbers of educated people lived in areas with more property
crime (Weisburd & McEwen, 1997). Also, during this period, the Belgian astronomer and
statistician Adolphe Quételet used maps to examine correlations between crime and
transportation routes, education levels, and ethnic and cultural variations (Weisburd &
McEwen, 1997).

United States: 1900–1970

In the United States, the use of crime mapping began a little later than it did in Europe.
Because the United States was a relatively new country in the 1800s, reliable maps were not
readily available and census data were not regularly collected, as they were in France and
England at that time. The first substantive spatial analysis of crime in the United States was
conducted in the 1920s and 1930s by urban sociologists in Chicago. Their crime research and
related crime maps linked crime and delinquency to factors such as social disorganization and
poverty. These scholars' spatial analysis of juvenile delinquency and social conditions in
Chicago is considered to be one of the foremost examples of crime mapping in the first half of
the 20th century (Groff & La Vigne, 2002).
Crime mapping was a theoretical component in the development of the concentric zone
model, which contends that in an urban setting different types of zones (areas with different
purposes) form around a central business district and that some of these zones are more
prone to crime and disorder than are others. Researchers who analyzed the locations and
distribution of gangs in Chicago based on the concentric zone concept found that gangs were
concentrated in parts of the city where social control was weak and social disorganization was
high (Weisburd
& McEwen, 1997). Most of the early crime mapping conducted in both Europe and the United
States examined aggregate levels of crime by area. However, evidence exists of a map that
was created by hand in 1929 by Chicago school researchers in which the home addresses of
more than 9,000 delinquents were clustered in particular areas of Chicago (Weisburd &
McEwen, 1997).
Through the 1950s, 1960s, and 1970s, sociologists and others who were interested in
crime and its causes continued to examine the sociological factors associated with crime. The
explanations and geographic methods of analysis used remained fairly uncomplicated during
this period, possibly owing to the researchers’ focus on sociological factors and the lack of
adequate technology (Groff & La Vigne, 2002).
In the late 1960s, scholars began conducting a spatial analysis of crime with the help of
large computer systems and unsophisticated visualization methods (Weisburd & McEwen,
1997).

1970 to Present
From the late 1960s through the early 1980s, a group of researchers in England,
Canada, and the United States shifted their focus of the study of crime away from what
traditional criminology examined—criminal offender—and toward the criminal event and its
context, including the physical and social environments that create opportunities for crime
(Brantingham & Brantingham, 1981; Clarke, 1980, 1983; Cornish & Clarke, 1986). This
movement affected crime mapping, as researchers shifted from aggregate analysis of crime
and social factors to the analysis of discrete criminal events and their locations (for a more
detailed discussion of this theoretical approach. Consequently, researchers began to
incorporate information about geography and environment into their study of crime problems
and related issues, such as rape (LeBeau, 1987) and a host of other crimes (Harries, 1980) as
well as the distribution of police personnel (Rengert & Wasilchick, 1985). In the early 1980s,
client-server technology made geographic information systems more available, and this
enabled several police departments to experiment with crime mapping in their everyday work
(Groff & La Vigne, 2002). A project funded by the National Institute of Justice partnered
researchers and practitioners in five U.S. cities to use innovative analytic techniques in
studying drug markets and tracking their movements over time (Groff & La Vigne, 2002):

In Connecticut, the city of Hartford joined Abt Associates, a private consulting firm
based in Boston, to promote crime mapping as a way of encouraging community involvement
in addressing crime problems.

In Pennsylvania, Carnegie Mellon University and the Pittsburgh Bureau of Police

developed a system in which thematic maps were created to show changes in crime by the
area over time.

In the early to mid-1990s, significant improvements in computer technology and police

data systems made electronic crime mapping a much more practical tool for police and
researchers. GIS software became available for desktop computers as these computers
became capable of processing large amounts of data quickly. In addition, police data on
crimes, arrests, accidents, and calls for service became available electronically through
computer-aided dispatch systems as well as through electronic records management systems
Geographic data such as street and census information became widely available in electronic
format and were provided free or at minimal cost by a variety of government agencies and
commercial organizations. All of these developments helped to advance the field of crime
mapping beyond manual methods and the use of large, costly mainframe mapping systems.
In 1993, the Illinois Criminal Justice Information Authority and the Sociology
Department of Loyola University of Chicago joined forces to present a computer crime
mapping workshop in Chicago. In a publication resulting from the workshop titled Crime
Analysis Through Computer Mapping (Block, Dabdoub, & Fregly, 1995), participants—many of
whom are top researchers and analysts in the field today— described spatial analytic
techniques and offered practical advice for both police professionals interested in
implementing computer mapping in their agencies and students of spatial analysis. This
workshop was one of the first efforts to bring practitioners and researchers together to discuss
crime mapping.
During the mid-1990s, the federal government, in a movement spearheaded by Vice
President Al Gore, provided increased support for crime mapping technology and methods.
Police agencies received federal funding to obtain crime mapping technology, and several
programs were developed specifically to assist police agencies with the implementation of
crime mapping. The U.S. Department of Justice’s Office of Community Oriented Policing
Services (the COPS Office) allocated a significant amount of funding for crime mapping
software and equipment through a program called MORE (Making Officer Redeployment
Effective). The primary objective of this funding was to “expand the amount of time current law
enforcement officers can spend on community policing by funding technology, equipment, and
support staff” (Office of Community Oriented Policing Services, 2004).
Since 1995, the COPS Making Officer Redeployment Effective (MORE) program has
provided funds over 1.3 billion dollars to law enforcement agencies for the purchase of time-
saving technology and civilian personnel. The time savings produced by these grants have
resulted in the redeployment of officers to the street to enhance their community policing
efforts. Some of the funds provided by MORE grants have been used to purchase crime
mapping and GIS hardware and software. The COPS Office recognizes the important role that
crime mapping plays in the in-depth analysis of community problems. This increased analytic
capability improves the capacity of law enforcement to work with the community to develop
more effective solutions to crime and social disorder problems.—Dr. Matthew Scheider, social
science analyst, COPS Office (personal communication, October 8, 2003)
C. Types of CRIME Mapping
Manual Pin Mapping
Wall maps have long been a simple and useful way to depict crime incidents or hot
spots. Many police departments still have large maps tacked to the wall of the briefing room
with the most recent crimes represented by pins. Although useful, manual wall maps, offer
limited utility because they are difficult to keep updated, keep accurate, make easy to read,
and can only display a limited amount of data. (For example, although different colored pins
could be used to represent different types of crime, date, and time of incidents, the nature of
incidents, and other information cannot be displayed easily. To update a manual wall map, for
example, the pins must be removed each month. Unless a photo or some other mechanism is
used to record the previous month's map, the information illustrated on the map is lost. Thus,
the comparison is difficult, if not impossible, from one month to the next. Finally, the maps
become unreadable when they display large amounts of data because of the numerous pins
and/or holes.

Computer Mapping
An Internet mapping program, where an address is entered and a map of the
surrounding area appears with a pin to locate the address. Even though it is possible to zoom
in and out of this type of map, the geographic features (e.g., locations, streets, parks) are
static and cosmetic only. In essence, a computer map is similar to a wall map, in that the
computer is used to place a point at a specific location just as a person would put a pin on a
wall map.

Geographic Information System (GIS)

A geographic information system (GIS) is a set of computer-based tools that allow a
person to modify, visualize, query, and analyze geographic and tabular data. A GIS is a
powerful software tool that allows the user to create anything from a simple point map to a
three-dimensional visualization of spatial or temporal data.
A GIS is different from manual pin maps and computer maps in that it allows the analyst
to view data behind the geographic features, combine various features, manipulate the data
and maps, and perform statistical functions.

Types of GIS programs include;

1. Desktop packages (e.g., ArcView®, MapInfo®, GeoMedia®, Atlas GIS®,
Maptitude®)
2. Professional software (e.g., ArcInfo® and Intergraph®).
GIS Components
The following is a description of the major components of a GIS, which include
1. Data representation
2. Data features, visualization
3. Scale
4. Querying

Data Representation
Real-world data are represented by one of four features in a GIS.
(They include point, line, polygon, and image features).
1. Point feature
A point feature is a discrete location that is usually depicted by a symbol or label.
A point feature in the geographic information system is analogous to a pin placed on a paper
wall map. Different symbols are used to depict the location of crimes, motor vehicle accidents,
traffic signs, buildings, beat stations, and cell phone towers. The following map shows a
robbery point map.
2. Line feature
A line feature is a geographic feature that can be represented by a line or set of
lines. The following map shows how different types of geographic features such as railways,
streets, and rivers can be represented by a line in a GIS. Additional examples are streams,
streets, power lines, bus routes, student pathways, and lines depicting the distance from a
stolen to a recovered vehicle.
3. Polygon feature
A polygon feature is a multisided figure represented by a closed set of lines. In
the following map, the largest blue polygon represents the city boundary, the green is census
tracks, and the black are census block groups. Other examples of polygon features used in
law enforcement would be patrol areas, beats, neighborhoods, or jurisdictions. Polygon
features can represent areas as large as continents and as small as buildings.
4. Image feature
An image feature is a vertical photo taken from a satellite or a plane that is
digitized and placed within the geographic information system coordinate system so that there
are -x and -y coordinates associated with it.

Data of geographic features

Each type of feature has "attributes" or a table of data that describes it. All the attributes
for three of the four types of features (point, line, and polygon) are stored in a GIS as a data
table (Note that a digital orthophotograph has an –x and –y coordinate but does not have an
associated data table worthy of analysis). The ability to view, query, relate, and manipulate
data behind these features is the true power of a GIS. A manual pin map and a computer map
depict points, lines, and polygons but do not have data associated with the features and are
not easily manipulated.

Connectivity
Refers to streets and other linear features that are represented by segments that
connect at intersections. However, each segment connects at an intersection, and connectivity
is the ability of the GIS to recognize that the two-line segments come together to form an
intersection.

Contiguity
Refers to adjacent areas that are represented by adjacent polygons. The following map
shows how a GIS includes adjacent polygons representing parcels and buildings. The ability of
the GIS to recognize adjacent polygons allows for querying, selection of polygons within
others, and visualization of complex land units.

Geometry
This refers to the fact that all features in the geographic information system have at
least one set of –x and –y coordinates.

Visual display/mapping Thematic approach

Scale
The scale is the relationship between the dimensions of the map and the dimensions of
the Earth. Usually, the scale depends on the purpose of the analysis or map.

Crime Analysis Mapping

“Crime mapping” is a term that has been used to refer to research analysis using GIS in
a law enforcement setting. The term crime analysis mapping is used to describe this process
because using a GIS to analyze crime is not just the act of placing incidents on a map but also
of analysis.
It is the process of using a geographic information system in combination with crime
analysis techniques to focus on the spatial context of criminal and other law enforcement
activity.