Reasoning and Cognitive Apprenticeship
to Teach Criminal Profiling and Internet Crime Investigation
by Eoghan Casey, BS
Master of Arts Candidate in Educational Communication and Technology
New York University
Note: Eoghan Casey is a full
partner of Knowledge Solutions LLC.
He can be reached for comment or consultation by contacting:
Knowledge Solutions; 61535 S Hwy 97, #9-148; Bend, OR 97702;
Phone 541-318-8293; Email: firstname.lastname@example.org
Extensive research shows that we learn best through a combination of
theory and practice . Theory is inert until it is applied to a
realistic situation, and practice is shallow without the influence of theory. A clear
example is how modern pilots are trained. Though attending lectures and reading books is
necessary, it is not sufficient training for a pilot. There is an obvious need for
practical experience. This is why millions of dollars have been spent on flight simulators
to provide a safe, realistic environment to practice skills and learn from
inevitable mistakes. Similarly, with Criminal Profiling and Internet Crime Investigation,
students learn best by applying theory and techniques to realistic cases in an environment
where they can make mistakes without the real world consequences of failure.
The purpose of this paper is to outline a powerful approach to
teaching Criminal Profiling and Internet Crime Investigation. This approach - informed by
cognitive science - combines theory and practice by teaching through cases, supplying
relevant theory when necessary. The two pertinent instructional strategies, Case-Based
Reasoning and Cognitive Apprenticeship, are described in the beginning of this paper. The
discussion of these strategies is followed by an actual example of how both strategies
have been combined to implement a realistic learning environment. Finally, the main
benefits of using the approaches described in this paper are summarized.
Using cases to teach Criminal Profiling and Internet Crime
Investigation might seem like a straightforward procedure. After all, the theories and
techniques that are used to investigate criminal cases were born from past cases, and are
thus inextricably bound to them. However, there are some subtleties in the implementation
that deserve serious consideration. It is not enough to use a single case, or to string
cases together in an arbitrary manner and expect students to flourish. Having a carefully
structured set of cases that clearly demonstrate how experts link and compare cases is
crucial when teaching any aspect of criminal investigation. To better understand the
subtlety of choosing instructional cases, let us look at two serious mistakes that
- Inappropriate case comparison The most pronounced
instances of this mistake occur when investigators cannot comprehend a heinous crime in
terms of their past experiences and so they attribute the crime to less tangible
influences such as the devil and "pure evil". Some investigations have become
witch-hunts (or Satan worshipper hunts) as a result of this mistake, leaving the actual
perpetrator free to commit more heinous acts.
- Failure to make appropriate case comparisons
This is so common that it has earned the name "linkage blindness" . Investigators fail to notice similarities in several cases and thereby
fail to link the crimes to a single perpetrator. This failure to link cases makes it
significantly harder for investigators to apprehend the perpetrator thus allowing him to
commit additional crimes.
In light of these recurring problems, it becomes clearer that the
choice of cases in instruction is crucial. In addition to learning how to apply theory to
cases, students need to learn how to compare cases and to evaluate the validity of these
comparisons (i.e. critical thinking). A model of how people reason using cases, called
case-based reasoning (CBR), can help us choose instructional cases that address the two
problems described above.
In the late 1970s Roger Schank and Robert Abelson  initiated the research that led to the Case-Based Reasoning model. While
studying under Schank, Janet Kolodner  refined the CBR model and used
it to create a computer program that demonstrated a limited ability to reason. CBR has
been further developed and is regularly used to create successful learning environments
and expert systems.
A key assumption of the CBR model is that people understand new
experiences in terms of past ones:
"Knowing where something fits in with what we already know
is a prerequisite to reasoning about it. We find it hard to suggest a solution to a
problem until we understand the problem.
We use what we know about a situation to
find the closest match in memory, and we use that as the basis for deriving expectations
and inferences." 
Even when we are reasoning deductively we are employing knowledge
that has been distilled from past experiences to arrive at new information. The CBR model
goes on to suggest that, to make case comparison easier, we organize cases in our minds by
indexing them in two distinct ways (, ):
- Type of case and how it differs from similar cases. For
example, an investigator might index a case as a sadistic rapist who slaps breast and
uses pliers to associate it with, but differentiate it from, other cases involving
sadistic rapists. The same investigator might also index the case as a mobile offender
who has committed similar crimes elsewhere. Both indexes are valid and each one is
useful when comparing cases. For example, the investigator might try to recall other cases
that involve a sadistic rapist, and search through literature for other sadistic rape
cases. Also, the investigator might take a hint from the second index and look in
surrounding geographical areas for crimes that match some part of the first index.
- The goals of participants in a case (e.g.
acquire money) and the details surrounding those goals. For example, an investigator
might index a case as sadistic rapist intended to kill victim but was interrupted.
The surrounding details, adapted from Kolodner , might include:
- a description of motive or intents (e.g. evil intent).
- the plan or type of plan being used to achieve the goals
(e.g. search plan; cover tracks plan; attack plan)
- characteristics of the plan being used (e.g. easy but
inappropriate; strange strategy; dirty tactics)
- unusual conditions that influence the plan (e.g. outside
opposition; difficulties along the way; outside help; normal solution will not work)
- if and how the goals were achieved (e.g. apparent success;
apparent failure; goals reached using compromise solution, goals reached after opponent
quit; goals not reached because opponent successfully resisted)
We create an index for each aspect of a case
that is distinctive or violates our expectations. Therefore, a single case can have many
indexes. Also, different people will index cases very differently unless some indexing
guidelines are provided. When we encounter a new case, we compare it with cases that have
similar indexes, using the differences and similarities between cases to understand them.
If a case does not fit into our existing understanding we can reject the case, distort the
new case until it fits into our existing understanding, or create new indexes that
accommodate the case. When teaching criminal investigation, the latter method is most
To address the problem of inappropriate case comparison in
criminal investigation, we can present students with cases that they cannot understand in
terms of past experiences. After repeatedly failing to understand these cases using past
knowledge, students will appreciate the vocabulary, theory and techniques that help them
understand these unusual new cases. The purpose here is to wean students from their
personal indexing systems, help them develop a new indexing system for criminal cases, and
teach them the usefulness of relevant theory.
Once students have developed several new indexes for
criminal cases (e.g. sadistic rapist; motive of offender) additional cases can be
introduced that have some relation to previously presented cases. A careful combination of
cases can teach students to identify cases with similar behaviors, motives, MOs
(modus operandi actions necessary to commit the crime), or signatures (actions
performed by the perpetrator that were not necessary to commit the crime) .
Teaching theory and teaching how that theory can be
applied to cases is a major undertaking. The added effort and complexity of teaching
through cases could explain why many instructors retain the traditional lecture format.
Fortunately, a powerful instructional strategy called Cognitive Apprenticeship  can help us with the difficult task of case-based instruction. Cognitive
Apprenticeship is founded on the assumption that people learn best in authentic
environments  and has been used successfully to teach subjects such as
writing, mathematics, multimedia production and computer programming.
In cognitive apprenticeship the instructor first gives
students an overview of what they will be learning so that they know from the outset what
to expect and how things fit together. The instructor then demonstrates how to do certain
tasks. As the instruction progresses, the tasks become increasingly demanding, leading the
student into the culture of expert practice. Students try each task themselves
with some coaching from the instructor. The instructor gradually reduces the coaching,
ultimately leaving the students to perform the tasks on their own. Students are encouraged
share understanding and to explore, reflect upon, and articulate ideas throughout the
Ideally, the learning environment will provide students
with the resources that they require to carry out tasks and become independent learners
and practitioners. In cognitive apprenticeship these supportive resources are referred to
Collins, Brown, and Newman  provide
the following framework for an ideal cognitive apprenticeship learning environment. The
remainder of this paper will describe each characteristic of this ideal framework and how
they relate to teaching students of criminal investigation to apply theory to cases and
reason using cases.
- Domain knowledge
- Heuristic strategies
- Control strategies
- Learning strategies
- Scaffolding and fading
- Increasing complexity
- Increasing diversity
- Global before local skills
- Situated learning
- Culture of expert practice
- Intrinsic motivation
- Exploiting cooperation
- Exploiting competition
Domain knowledge is the conceptual, factual and procedural
knowledge that we normally associate with a subject. This is the knowledge that is usually
found in books and covered in traditional lectures. While working on cases, students will
have to use this domain knowledge to assist them in an investigation. It is the
responsibility of the instructor to present this knowledge in a clear and accessible
manner and sensitize students to when this knowledge is applicable.
Heuristic strategies are the rules of thumb that expert
investigators use to accomplish a task. For example, whenever possible, an investigator
will look through all of the available evidence before forming an opinion or focusing on
specifics in the case. An expert Criminal Profiler will examine crime scenes first,
victims second, and possible offenders last. A more difficult heuristic strategy to teach
is how to identify pieces of information (clues) that are likely to lead to more
information. An instructor can teach heuristic strategies by example and can make their
rationale and usefulness clear whenever the opportunity arises.
Experts use control strategies to choose applicable
approaches during an investigation. These control strategies involve self-monitoring,
self-diagnosis, and self-correction. An expert will identify the need for correction, will
determine what needs to be corrected, and will choose a method of correction. Experts use
control strategies to choose appropriate domain knowledge and heuristic strategies, as
well as to decide when to change strategies. For example, when expert investigators get
stuck on one part of a case, they will move to a different part of the case for a while.
Again, an instructor can teach students these control strategies by example, and by making
self-monitoring and evaluation an inherent part of the learning process. Having students
compare their approaches with the approaches of experts and of other students will help
them develop a refined understanding of where they are going astray and how they can
correct their mistakes.
Learning strategies are used to acquire additional domain
knowledge, heuristic strategies, and control strategies. The instructor can encourage
these learning strategies by teaching students to use additional sources. Also, the
instructor can help students evaluate the work of other investigators, by
identifying flaws and picking out useful techniques.
Modeling is one of the most important aspects of cognitive
apprenticeship and should be given a great deal of attention. This is because
observation plays a surprisingly key role  in learning. By
observing the instructor perform a specific task, the students get a better idea of what
they are supposed to do and how they are supposed to do it. It is tempting to make
checklists rather than demonstrate how to do something. However, checklists create
inflexible learners who have difficulty progressing beyond or operating without the
It takes some trial and error before students can perform
the tasks that they have seen modeled. The instructor can coach students through this
trial and error process by showing them where they went wrong and how to correct the
error. For example, after showing students how to read and interpret an autopsy report or
an email header, the instructor can ask students to interpret a new autopsy report or
email header. The instructor and other students can then examine and learn from each
other's interpretations. If necessary, the instructor can model the process again for
students who are having difficulty. Over time, this coaching should be reduced and
ultimately stopped. This reduction is called fading.
Any additional support (other than modeling and coaching)
that helps students develop necessary skills is called scaffolding. For instance, to give
students the satisfaction of making sense of a case, the instructor can carry out tasks
that are too advanced for students and can then allow the students to put the
prefabricated pieces together. Additional support can be provided by organizing case
materials in a logical way, making them easy to access and search, and by giving students
questions to ask themselves as they look through the materials.
Creating a forum where students can offer each other
support and share their understanding is another form of scaffolding. Such a forum can
also be used to help students articulate and reflect upon what they have learned. The more
students practice these high level thought processes, the better they will understand what
they are learning. Shared articulation and reflection usually magnifies the benefits of
Encouraging and facilitating exploration is key to making
students more independent. Giving students an interesting assignment with only generally
formulated goals gives students the latitude to explore and thus extend their
understanding of a subject. Exploration can also help students gain confidence in their
ability to learn on their own.
We have already considered how to sequence cases when
teaching criminal investigation. It remains to discuss how to sequence the vocabulary,
theory and techniques required to understand these cases. The three main recommendations
in cognitive apprenticeship are increasing complexity, increasing diversity and global
before local skills.
Increasing complexity involves gradually putting more
responsibility on the students, forcing them to perform more of the tasks required in an
investigation and making those tasks more challenging. For instance, after giving students
the satisfaction of putting prefabricated pieces of a case together, the instructor can
present a new case that requires the students to do some of the work that was previously
done for them.
Increasing diversity involves choosing cases that require
a wider and wider variety of strategies and skills. The main purpose of increasing
diversity is to teach students that what they are learning is applicable in a variety of
different situations. Essentially, this is an effort to help students generalize what they
are learning so that the knowledge is not permanently locked within the cases that they
learned from. Also, increasing the variety of strategies and skills required in a case can
develop students' control strategies.
A good example of presenting global skills before local
skills can be found in tailoring apprenticeship. Apprentices learn to put together a
garment using precut pieces before they learn to draw and cut out the pieces
themselves . The purpose of this is to demonstrate the ultimate
purpose of a process before presenting students with all of the details. Once the students
understand the ultimate purpose of a process they can develop the necessary skills to
achieve this purpose. In criminal investigation, the same effect can be achieved by giving
students evidence that has already been interpreted before asking them to interpret
By choosing cases to teach criminal investigation, we are
situating the learning process in an realistic context. In cognitive apprenticeship, the
subsequent learning that takes place is called situated learning. Collins, Brown, and
Newman summarize several general purposes served by situated learning. First,
students come to understand the purposes or uses of the knowledge they are learning.
Second, they learn by actively using knowledge rather than passively receiving it. Third,
they learn the different conditions under which their knowledge can be applied. 
One of the main goals of cognitive apprenticeship is to
bring students into the culture of expert practice. This is achieved through situated
learning, modeling and comparing student and expert methods. An additional step can be
taken when teaching Criminal Profiling and Internet Crime Investigation by encouraging
students to get involved in the expert discussions that occur in related mailing lists and
discussion groups on the Internet.
Intrinsic motivation is an important aspect of creating a
learning environment. If students do not see the purpose of what they are learning and do
not find it interesting, they will not be motivated to learn. When teaching criminal
investigation using cases, an effort must be made to present cases in a way that
encourages students to become involved. If a case is described in minute detail, students
might absorb some of the details, but they will not necessarily be engaged by it or even
learn from it. On the other hand, if a case is presented in a puzzle or problem solving
format where students must put the pieces together before they can understand the case,
they are more likely to be engaged and they are more likely to be motivated to learn.
On balance, collaboration will enhance learning. Unless
students are encouraged to share and compare what they are learning, learning will occur
more slowly because every student will have to make every mistake in order to learn from
it. However, collaboration has some pitfalls. For example, asking students to work as a
group on a project often hurts students by placing added load on stronger students and
sheltering weaker students. One way to avoid this pitfall is to have an open forum that
enables the instructor to identify and support weaker students. Weaker students will call
attention to themselves by making serious blunders or by remaining silent.
Cognitive apprenticeship draws attention to competition in
a learning environment but is not very helpful with its resolution. The reality is that
some students are reluctant to share their work because they fear that they will seem less
intelligent than other students. No matter how engaging and supportive a learning
environment is, it still takes some luck and inventiveness for constructive competition to
Internet Crime Investigation
An example of how these strategies can be integrated to
teach Internet Crime Investigation is given here in an effort to clarify how case-based
reasoning and cognitive apprenticeship can be used to teach criminal investigation.
The course is fully situated by teaching it over the
Internet using instructional cases. Supporting domain knowledge is given on a set of Web
pages that are referenced when applicable. A Web-based class forum is used to communicate
and share information. Email plays a lesser role, enabling the students and instructor to
communicate issues that require special attention. The course begins by giving students an
overview of crime on the Internet. Several simple cases are presented to give students a
better idea of what is involved in an investigation and how experts investigate.
The students are then presented with their first case.
They are told that a complaint has been made against an individual and they are asked to
examine some information that has already been gathered to determine if he has done
anything illegal. Students are asked to submit a report to the class forum. The students
are then informed that the subject of this case is the founder of MIRSO (Male
Intergenerational Relationship Support Organization) and are instructed to search the Web
for additional information. Students are asked to submit another report based on the new
information that they have acquired. Each report should include a few of the
students indexes of the case (as described in section 2). The purpose here is to
have the students articulate their understanding of the case so that they can look back
later to see how their understanding changes as they learn. Also, students can learn from
each others indexes, these indexes facilitate case comparisons later in the course,
and the instructor can identify any severe misunderstandings by looking at the indexes.
For three weeks, students are asked to search different
parts of the Internet for more information on the suspect. Search techniques are modeled
using simpler or more general cases (e.g. searching for obscene materials). Relevant
domain knowledge is provided on easily accessible Web pages. For every new search
assignment related to the suspect, students are asked to submit a report specifying what
they found, when and how they found it. Students are especially encouraged to describe any
difficulties that they had. Again, each report includes some of the authors indexes
for the case. Students will find that the vocabulary, tools and techniques they learn
during the course will improve their understanding of the case and will change the indexes
they use for the case.
The instructor addresses specific problems, providing
coaching when necessary. The instructor also discusses heuristic and control strategies
and asks probing questions that give students a hint about what clues to look for. As the
main case evolves, students follow the suspect into different parts of the Internet,
gradually uncovering his criminal behavior. By this time, students will be competing to
find more incriminating evidence and will be learning from each other as they read each
others reports and messages.
After three weeks, students are asked to review the case
and summarize the main things that they learned. At this time, another major case is
presented that requires all of the previously accumulated skills and tools as well as some
new ones. Again subskills are modeled and developed using simpler, more general cases. The
instructor encourages case comparisons throughout the course by having students compare
motive, MO, signature and other characteristics of each case. These comparisons will be
fairly simple to begin with, especially among the smaller cases, but comparisons will
become more involved as the major cases develop.
In this course, the Internet is used as scaffolding. The
instructor helps students explore and become comfortable with the Internet and students
learn to use its many resources to support their learning. Later in the course, students
are encouraged to become involved in the culture of expert practice by participating in
on-line discussion forums such as alt.computer.crime. Ideally, after students finish the
course they will continue to participate in and learn from the culture of expert practice.
Expert investigators have much more to offer students than
a book or lecture series. The instructional models and methods advocated in this paper can
help instructors create a rich learning environment that brings students closer to the
fields they are studying than a traditional lecture course would. Students invariably
learn more from this engaging and supportive learning experience because they have the
opportunity to create a personal understanding as they apply what they learn in authentic
ways. Any personal understanding that students create as they learn will be more
meaningful and useful than abstracted concepts and facts. Having students articulate,
share and reflect upon what they have learned encourages them to think more deeply about a
topic. Finally, by providing students with scaffolding, an instructor enables them to
become more independent and continue learning after instruction has ceased.
1. Brown, J. S., Collins, A., and
Duguid, P. (1989). Situated Cognition and the Culture of Learning. Educational Researcher
2. Collins, A., J. S. Brown, and S.
E. Newman (1989). Cognitive Apprenticeship: Teaching the Crafts of Reading Writing and
Mathematics, In L. B. Resnick (Ed.), Knowing, learning, and instruction: Essays in honor
of Robert Glaser, ed. L. Resnick (pp. 140-185). Hillsdale, NJ: Lawrence Erlbaum
3. Douglas, J. E., Burgess, A. W.,
Burgess, A. G., Ressler, R. K. (1992), Crime Classification Manual: A Standard System for
Investigating and Classifying Violent Crimes. New York, NY: Lexington Books.
4. Kolodner, J. (1994). From
Natural Language Understanding to Case-Based Reasoning and Beyond: A Perspective on the
Cognitive Model That Ties It All Together. In R. C. Schank (Ed.), Beliefs, Reasoning and
Decision Making (pp. 55-110). Hillsdale, NJ: Lawrence Erlbaum Associates.
5. Schank, R. C., Abelson, R.
(1977) Scripts, Plans, Goals and Understanding. Hillsdale, NJ: Lawrence Erlbaum
6. Schank, R. C. (1990). Tell me a
Story: Narrative and Intelligence. Evanston, IL: Northwestern University Press.
7. Egger, S. A. (1990), Serial
Murder: An Elusive Phenomenon. London: Praeger.