Beltway Sniper Case Study

Analytic Question

Question: Who is the DC Sniper?

Discussion of the Analytic Question: The analytic question meets the criteria of:

  • At least one plausible explanation exists with some geospatial aspect, e.g., the sniper is a serial criminal and conforms to that typical geospatial pattern.
  • Counter-explanations are possible, e.g., the sniper is a domestic terrorist and conforms to that geospatial pattern.
  • The hypotheses can be defined sufficiently to allow us to gather evidence, e.g., we have research supporting the establishment of specific patterns.

There were attempts to geographically profile the killers, that is, predict where they will kill next based on the killer's spatial pattern or signature. Geographic profiling brings the science of geography, criminology, mathematical modeling, statistical analysis, and environmental and forensic psychology into the realm of criminal investigation. Below is a news report about Dr. Kim Rossmo's geographic profiling:

Computer profiler aids in sniper hunt

By Jeordan Legon (CNN), October 8, 2002

Police Foundation Director Kim Rossmo says geographic profiling "provides an optimal search strategy."

(CNN) -- Software is leading the way for investigators trying to pinpoint a Washington-area sniper. Geographic profiling, developed by former Vancouver, British Columbia, police detective Kim Rossmo, tries to zero in on the suspect by using computers to track the mass of data flooding investigators' desks -- location, dates and times of crimes. The program then matches the information with what criminologists know about human nature. Rossmo told reporters his software can help police determine where a suspect lives within half a mile. "In effect, it provides an optimal search strategy," Rossmo said. Rossmo, director of the Washington-based Police Foundation, started assisting investigators in the sniper case last week. Calculating the path, his software, which was developed by a commercial vendor and named Rigel, carries out millions of mathematical equations to give investigators a better sense of a killer's "hunting area" and where he is likely to live. Rossmo said he relies on what psychologists term the "least-effort" theory. Crimes typically happen "fairly close to an offender's home but not too close," he said. "At some point, for a given offender, their desire for anonymity balances their desire to operate in their comfort zone," he said. Rossmo's system has been used by Scotland Yard, the FBI, the Royal Canadian Mounted Police, and dozens of police agencies worldwide. Rossmo developed it while walking the beat in Canada and reading widely -- including a book on the hunting patterns of African lions. The geo-profiling technology was his doctoral thesis. Methods help solve serial murders. Geo-profilers claim their methods have helped detectives solve about half of the 450 cases they've studied -- everything from serial rapes to serial murders. "It's the high-tech version of the pin map," said Richard Bennett, a professor of justice at American University. "The concept is simple. But you can put a lot more information in. ... It's what you do with the information that is key." Bennett said nothing takes the place of good, old-fashioned detective work but computerized geo-mapping techniques help. "The advantage is you're using computer science and computer analytic abilities to solve a crime," he said. " You don't have a big city police chief out there who isn't using some form of this mapping."

For geographic profiling to produce accurate profiles the serial offenders must follow a predictable spatial model (or pattern). There is good reason to believe serial offenders do. Research has repeatedly shown that the majority of serial criminals travel relatively short distances from home to commit their crimes. Research has also demonstrated that the home location of many serial offender's crimes literally surround their home; referred to as a marauding pattern. These are the primary reasons for the effectiveness of geographic profiling when applied to "typical" criminals. When serial offenders behave in ways that contradict these behaviors, such as terrorist activity, geographic profiling will typically be ineffective (Bennell, 2007). For more general information see, Forecasting the Future of Predictive Crime Mapping; specifically look at the section on "The Role of Theory in Predictive Mapping."


The geospatial aspects of the DC Snipers actions can still help to answer our question as part of a bottom-up processes (from data to theory) or top-down (from theory to data). The bottom-up process converts raw information into knowledge of our killers. The top-down process provides evidence to support or disconfirm the assumed spatial signature of the killers. The question we have asked is, who is the DC Sniper (based on the total evidence we have including their spatial profile)?

Referring to the case study, the DC Beltway sniper attacks took place during three weeks in October 2002, in Washington, D.C., Maryland, and Virginia. Ten people were killed and three others critically injured in various locations throughout the Washington Metropolitan Area and along Interstate 95 in Virginia.

There are several important definitions we will use. These are:

  • A serial killer is a person who murders three or more people over a period of more than thirty days, with a "cooling off" period between each murder, and whose motivation for killing is largely based on psychological gratification.
  • Domestic terrorism is violence committed by a group, or groups, of two or more individuals to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives.
  • Foreign terrorism is violence committed by a group, or groups, of two or more individuals originating outside the US to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives.

Maps of the shootings and ballistics information can be found at the Washington Post Area Sniper web site.

Figure 3

Map of DC Sniper Shootings. Source:

Click for accessible description

This map pinpoints the locations of the DC area sniper shootings and includes parts of Maryland, Washington DC, and Virginia. The points are numbered 1-14. Most of the points on the map (#s 2, 3, 4, 5, 6, 7, and 15) are clustered in a similar area just outside of Washington D.C., in Maryland. Points numbered 1 and 10 are further east in Maryland, points 11 and 13 are further south in Virginia, point 8 is within the D.C. city limits, and points 9, 12, and 14 are much further south in Virginia.

As we discussed, there were attempts to spatially "model" the Sniper's behavior. Here is another article about the geographic profiling:

With no solid leads in their hunt for a sniper who has gunned down eight people in the Washington, D.C., area, investigators have turned to a relatively new technological tool: geographic profiling

(Source: CNN LAW, October 9, 2002)

(Court TV) -- Barring a lucky break, the technology currently seems like the police's best chance to find the shooter, who has killed six, left millions on edge, and single-handedly lowered the attendance rate in Maryland suburban schools. The technique, first used in 1990, operates on the assumption that a serial murderer (or rapist) balances his desire to kill far from home to avoid being recognized with his desire to be in familiar territory. The tension between these two desires usually means that serial killers kill close to home, but not too close, leaving a "comfort zone" around their home that can be detected mathematically, according to Dr. Kim Rossmo, the technique's pioneer.

Investigators into the Maryland shootings have good cause to be hopeful about geographical profiling's potential. A software program that Rossmo developed called Rigel -- the only professional geographic profiling software currently available -- has in past cases pinpointed a criminal's home within a few blocks. On average, according to Rossmo, the program narrows the police's target area by 95 percent. But while geographic profiling could help the investigation, it can't point directly to the perpetrator. Even Rossmo warns against seeing geographic profiling as a solve-all investigative device. He has described it as an information management tool that gives police a way to better allocate their time and money. Rossmo has explained that geographic profiling can never solve a case alone. It can only help focus the investigator's search by pointing them in a direction most likely to produce tangible evidence or leads to the criminal.

Rigel works best when used by an experienced geographic profiler on a serial criminal who fits a specific profile. According to Ian Laverty, an engineer who helped develop Rigel and president of Environmental Criminal Research Incorporated, the firm that produces it, the software specializes in "hunters" -- criminals who leave their home base already planning to find a victim. "A hunter works from a home site and travels out with a purpose of finding a victim and a location to commit the crime," said Laverty. "So [to best use Rigel] we must look at the nature of the crime and see if it is a hunter pattern. "But not all serial killers are hunters. In his textbook on geographic profiling, Rossmo, now research director of the Police Foundation in Washington D.C., defines four other types: trappers who lure their victims to them; stalkers who follow their victims; poachers who travel away from home to hunt; and trollers who perpetrate crimes opportunistically while in the midst of other activities.

While not enough is publicly known about the Maryland shooter to determine his methodology, Rossmo believes that all criminals commit their first crimes close to home, only leaving the areas that they know as they gain confidence. By this logic, even if the shooter at large now modifies his behavior and expands his target zone, his first six shootings, all of which occurred within a five-mile area in Maryland, probably point toward his home. Of course, by the time the profile emerges, the killer could have moved. But if geographic profiling leads to the location of his former base of operations, even that would be a huge boost to the Maryland investigation.

In the summer of 1998, Rossmo assisted an investigation of a Lafayette, LA., serial rapist who had attacked as many as 15 women in the area over a period of 11 years. After reading an article on geographic profiling, Maj. Jim Craft of the Lafayette police, who led the task force devoted to the criminal, invited Rossmo to help out. His geoprofile, which he sent to Craft after one or two months, allowed police to narrow the areas they patrolled. "It was helpful to prevent further attacks," Craft said. "Previously there was a pretty large area that we had to focus on to make sure we didn't have any further attacks. As a result of that profile we were able to narrow down our geographic area and focus our resources from an area of 60,000 people to a location with about 30,000 people in it." Although the geoprofile accurately predicted the killer's home area, the information did not end up helping them capture him. The case was solved when the police received an anonymous tip with the rapist's name. At the time of his arrest, the rapist had moved outside the area Rigel predicted. Still, Craft and the Lafayette Police Department were impressed with geographic profiling. "It's not going to specifically identify a perpetrator but it will help you focus your investigative efforts and narrow down or eliminate information from other areas," Craft said.

Whether Rigel will help in finding the Maryland shooter remains to be seen, but some proponents think it can be useful for more than serial murders. Says Laverty, "The technique itself is applicable to all types of serial crimes like robbery, burglary, and arson."

Dr. Maurice Godwin suggests that Rossmo's geographical model (See Rossmo's description) was wrong and offered another spatial model for the Sniper's behavior. Research findings also indicated that there is a strong relationship among the locations of the terrorist incident, terrorists’ preparatory behaviors, and where these terrorists reside. Research in terrorist geospatial patterns and behavior is found in Geospatial Analysis of Terrorist Activities: The Identification of Spatial and Temporal Patterns of Preparatory Behavior of International and Environmental Terrorists. Based on this information and other profiling efforts, here are some of the inferences and speculations offered about the DC sniper prior to the arrest of the two suspects (Source: http://

  • FBI/Inductive profilers
    • White male
    • 25 to 40 years old
    • Not a sniper and not likely military because of weapon choice (inaccurate round)
    • Lives in or near the community
    • No children
    • Firefighter or construction worker
    • Possible terrorist links
    • Not a true spree killer because a true spree killer would have kept going south.
  • Deductive profiling
    • No evidence of race
    • No evidence of one or two offenders
    • Anger motivation
    • Cumulative rage from successive failures in personal life
    • Straw that broke the camels back would be an event in personal life such as divorce, custody battles, and/or loss of job.
    • Would want to talk about offenses
    • Case would most likely be solved by a tip from alert citizens
    • No sniper training (not a very good shot)
    • Possible second or third party involved
    • Limited evidence of terrorist connection

Quality of Information Check

Weighing the validity of sources is the critical thinking that the confidence of any analytic judgments ultimately rest upon. Analysts should review the quality of their information and refresh their understanding of the strengths and weaknesses. This is part of becoming grounded in the problem. Without understanding the context and conditions under which critical information has been provided, it will be difficult for analysts to assess the information’s validity and establish a confidence level in an intelligence assessment.

Using the DC Sniper scenario, perform a brief quality of information check as part of your grounding. Specifically:

  • Identify geospatial information sources that might be critical but were not provided.
  • Check for corroboration of the locations (coordinates) with the text.
  • Validity of the geospatial behavioral models used.
  • Indicate a level of confidence you have in the sources which are likely to be used in future analytic assessments.

ExampleQuality of Information CheckResults:

The following geospatial evidence could have been useful given more time and resources:

  • High resolution land characterization to determine if shooting locations had sufficient vegetation or other cover within rifle range.
  • Geospatial behavioral models for criminal activities associated with sniper events.
  • Street camera recordings to identify the people and vehicles present at crime scene locations.

Corroboration of the locations with the text were as stated:

  • Using Google Earth, the site descriptions and addresses matched the coordinates.

Level of confidence you have in the sources, which are likely to figure in future analytic assessments.

  • We are confident in the general locations with respect to the address but not the specific locations with respect to the site and events.

Deliverable: Expand upon (add or delete information) the example Quality of Information Check. Post your analysis to the Lesson 4 Discussion Forum. To participate in the discussion, please go to the Lesson 4 Discussion Forum in Canvas. (That forum can be accessed at any time in Canvas by clicking on the Modules tab. The General Discussion forum is listed under the Orientation Section.)

D.C. sniper attacks of 2002, shooting spree in the Washington, D.C., area that killed 10 people and injured 3 over a three-week period in October 2002. The shooters, John Muhammad and Lee Boyd Malvo, chose targets seemingly at random and brought daily life in the area to a virtual standstill.

The attacks began on October 2, 2002, when a bullet shattered the window of a craft store in Aspen Hill, Maryland, narrowly missing a cashier. Less than an hour after that incident, a 55-year-old man was shot and killed while walking across a parking lot in Wheaton, Maryland. Although the shootings were not initially recognized as being connected, law-enforcement authorities soon realized that those two acts of violence were just the first of what would be more than a dozen linked shootings over the next 23 days.

By the end of the day on October 3, five more victims had been shot and killed in the Washington metropolitan area. Investigators determined that bullets from several of the first seven shootings were fired from the same weapon—a high-powered .223-calibre rifle. On the morning of October 7, a 13-year-old boy was shot and injured in front of his middle school in Bowie, Maryland. Muhammad and Malvo left a tarot card with a note to law enforcement written on it, but it contained no specific demands. More than 30 different law-enforcement agencies at the local, state, and federal levels would ultimately work together to track, identify, and capture the parties responsible for the attacks.

Other than conflicting reports of a white van, a white box truck, and a dark Chevrolet Caprice near the scenes of the incidents, police had no clear leads. Criminal profilers predicted that the sniper was most likely a white male, but that assumption was based largely on the characteristics of past serial killers and not the sniper case itself. From October 9 to October 14, two men and a woman were killed in separate incidents in northern Virginia. On October 19 a 13th shooting occurred at a restaurant in Ashland, Virginia. Law-enforcement officials found a second note at the crime scene, demanding money and instructing the police to call at a certain time and place. The phone number provided in the note was not valid, but technicians at the U.S. Secret Service crime lab were able to match the handwriting to the tarot card left at the scene of an earlier shooting.

Police received additional information in the form of phone calls to local police stations and a Federal Bureau of Investigation hotline. The most important tip, however, came from the shooters themselves, in a call to a Roman Catholic priest in Ashland, Virginia. For reasons unknown to investigators, the shooters detailed their crimes to the priest and asked him to advise the police to look into a September 2002 robbery-homicide at a liquor store in Montgomery, Alabama. Evidence recovered from the Montgomery crime scene was linked to Lee Boyd Malvo, a 17-year-old from Jamaica who had been fingerprinted in December 2001 by the U.S. Immigration and Naturalization Service. Further investigation found that Malvo had been seen traveling with a man named John Muhammad, a Persian Gulf War veteran who had qualified as an expert marksman. Additionally, Muhammad and Malvo had been observed target shooting at a residence in Tacoma, Washington, further linking them to the sniper case. The predictions of criminal profilers were shown to be wildly incorrect, as the suspected snipers were an African American man and a Caribbean teenager.

A warrant was issued for Muhammad on a federal firearms violation, and the police identified the make, model, and license plate number of the Chevrolet Caprice he was driving. The police released the description of the car to the media on October 23, and later that evening a motorist reported that the vehicle was at a rest stop off Interstate 70 near Frederick, Maryland. Within hours, law-enforcement personnel descended upon the car, found Muhammad and Malvo sleeping inside, and took them into custody. A search of the car uncovered a Bushmaster XM-15 assault rifle—a semiautomatic version of the M4 carbine used by the U.S. Army—as well as a concealed firing port cut into the car’s trunk. Modifications had been made to the car’s back seat so that a shooter could lie prone and fire, undetected, from inside the car.

Although their crimes spanned numerous jurisdictions—investigators eventually tied the pair to nearly a dozen additional shootings prior to the D.C. spree—Muhammad and Malvo were prosecuted in Virginia, a state where Malvo would have been eligible for the death penalty. In November 2003 Muhammad was convicted on murder and weapons charges, and he ultimately received a death sentence for his role in the sniper killings. After all of his appeals had been exhausted, he was executed by lethal injection in November 2009. Malvo was found guilty of murder, terrorism, and firearms charges in December 2003, and he was sentenced to life in prison without parole. As part of a deal with prosecutors, Malvo later pled guilty in additional cases but was spared the possibility of a death sentence by a 2005 U.S. Supreme Court ruling that declared capital punishment for juvenile offenders to be unconstitutional.

The sniper attacks were atypical in a number of respects. Typically, serial killers target one type of person so that the victims share a common characteristic. Muhammad and Malvo, however, shot both men and women, with no clear regard for the race or the age of the victims. The unpredictable nature of the shootings instilled high levels of fear into the citizens of the Washington, D.C., area. Perhaps even more unusual was the successful civil action pursued in the wake of the attacks. With the assistance of the Brady Center to Prevent Gun Violence, two survivors of the shootings and the families of six slain victims brought suits against Bushmaster Firearms, the manufacturer of the rifle used in the attacks, and the Tacoma, Washington, gun store from which the rifle had been stolen. While not admitting fault, Bushmaster and the gun store reached a $2.5 million settlement with the plaintiffs. The National Rifle Association was among those who subsequently lobbied successfully for the passage of the Protection of Lawful Commerce in Arms Act, a 2005 law that largely indemnified gun manufacturers and dealers from future liability suits.


Leave a Reply

Your email address will not be published. Required fields are marked *