NCIS Special Agent Training: The Case of the Missing Microchip
Materials Needed:
- Notebook or several sheets of paper
- Pen or pencil
- Access to the internet (for a simple cipher tool, if desired)
- A curious and analytical mind!
Lesson Plan Details
1. Learning Objectives
By the end of this lesson, Special Agent Gail will be able to:
- Analyze multiple pieces of evidence (witness statements, physical evidence) to identify patterns, connections, and contradictions.
- Apply deductive reasoning to formulate a logical hypothesis about the perpetrator of a crime.
- Synthesize information from various sources to construct a coherent timeline of events.
- Communicate a final conclusion clearly and persuasively in a written "Case Report," citing specific evidence.
2. Case Briefing: Your Mission (5 minutes)
Welcome, Special Agent Gail. We have a situation at a high-tech research firm, "Innovate Dynamics." Dr. Aris Thorne, a lead engineer, has reported the theft of a prototype microchip from his lab. The chip contains revolutionary new AI processing designs and is priceless. The theft occurred sometime overnight. The lab was locked, and only a handful of people have access. Security footage was mysteriously corrupted during a two-hour window from 11:00 PM to 1:00 AM.
Your job is to review the case file, identify the thief, and determine the motive. Remember Gibbs' Rule #1: Never let suspects stay together. Let's analyze them one by one.
3. The Investigation: Analyzing the Evidence (60 minutes)
Work through the following evidence packets. Take detailed notes in your notebook. Look for inconsistencies and connections.
Evidence Packet A: The Suspect List
Only three personnel besides Dr. Thorne have keycard access to the lab.
- MARTHA "MARTY" JENKINS (The Rival Scientist): A brilliant but notoriously competitive colleague. She and Dr. Thorne were competing for the same promotion. She claims she was working late in her own lab (on a different floor) until about midnight.
- DAVID CHEN (The Junior Assistant): Dr. Thorne's overworked and underpaid lab assistant. He has a significant amount of student loan debt. He claims he went home at 5:00 PM and spent the evening studying for an online certification exam.
- CLAIRE VANCE (The Head of Security): A former military officer in charge of facility security. She has access to all labs. She claims she was doing her final rounds and left the building at 10:30 PM, before the security feed went down.
Evidence Packet B: Crime Scene Evidence Log
Our forensics team processed the lab. Here’s what they found:
- A faint scent of strong, floral perfume near the lab safe where the chip was stored.
- A small, discarded coffee cup from "The Daily Grind," a 24-hour coffee shop located two blocks from the firm. The cup was found in the trash bin inside the lab.
- A single, smudged fingerprint on the keycard scanner. It's too smudged to run through AFIS, but it appears small.
- The lab's digital clock was unplugged. When plugged back in, it reset to 12:00. The power cord was found lying neatly coiled on the floor beneath the outlet.
Evidence Packet C: Witness Interview Transcripts
Ducky has passed along his initial interview notes. Read them carefully.
- Interview with Martha Jenkins: "Aris thinks he's a genius, but he cuts corners. I was burning the midnight oil in my own lab, trying to meet a deadline. I didn't see anyone. I wear a very distinct, expensive French perfume—it's my signature. I certainly didn't go near Aris's lab."
- Interview with David Chen: "Dr. Thorne is a great boss. I wouldn't do anything to jeopardize my position here. I was at home all night. My apartment is tiny, and I needed to focus, so I went to The Daily Grind around 9:00 PM to study. I stayed there until well after 1:00 AM. The baristas know me."
- Interview with Claire Vance: "My job is to keep this facility secure. The system going down is my responsibility, but it wasn't my fault—it looks like a targeted hack. I completed my final physical patrol at 10:30 PM, as my report states. I don't drink coffee; it gives me the jitters."
Evidence Packet D: A Coded Message from Abby
Abby recovered a deleted, encrypted text fragment from the security office computer system, sent around 11:15 PM. She says it's a simple Atbash cipher, where the first letter of the alphabet is swapped with the last, the second with the second-to-last, and so on (A=Z, B=Y, C=X, etc.).
The Coded Message: ZOOZ GSV HZXF GZPVH GILD WLIIVH
Your Task: Decipher the message. You can do this by hand or by using an online Atbash cipher decoder. What clue does it provide?
4. Building the Case: Synthesizing Your Findings (30 minutes)
Step 1: Create a Timeline
In your notebook, draw a timeline from 9:00 PM to 2:00 AM. Use your evidence notes to plot the known locations and actions of each suspect. Where are the gaps? Where are the contradictions?
Step 2: Write Your Final Case Report
This is your primary assessment. Your report must be structured like an official NCIS file. Address it to Director Vance (no relation to the suspect!).
Your report must include the following four sections:
- SUSPECT IDENTIFIED: State clearly who you believe stole the microchip.
- MOTIVE: Explain WHY this person committed the crime. What did they have to gain?
- KEY EVIDENCE: Present at least THREE pieces of evidence from the case file that directly support your conclusion. Explain HOW each piece of evidence implicates your chosen suspect and rules out the others. (This is the most important part!)
- CONCLUSION: A brief, one-paragraph summary of how the crime was committed, based on your timeline and evidence.
5. Case Debrief and Extension (15 minutes)
The "Gibbs Slap" Self-Reflection
After you've written your report, take a moment to reflect. (The solution is provided at the very bottom so you can check your work afterward).
- Which piece of evidence was the "linchpin" that cracked the case for you?
- Which piece of evidence was a "red herring" designed to mislead you?
- How did creating the timeline help clarify the sequence of events?
Director's Challenge (Optional Extension)
Think like a show writer. Write a short (2-3 paragraph) "scene" that shows the confrontation and confession of the suspect you identified. What do they say when you present them with the evidence?
Click Here for Case Solution and Analysis
Deciphered Message: ALLY THE HACK TAKES TWO DOORS. (This indicates the thief needed both keycard access AND a way to bypass security via a hack, and that they entered through two doors - the main building and the lab).
Perpetrator: Claire Vance, Head of Security.
Motive: Corporate espionage. She wasn't just a security guard; she was a plant for a rival company. Her military background was a cover. She was selling the chip for a massive payday.
Analysis of Evidence:
- The Lie: Claire claimed she left at 10:30 PM, but the hack was initiated from the security office at 11:15 PM. She was the only one with the expertise and access to do it. Her claim of an "external hack" was a lie.
- The Coffee Cup: This was a red herring to frame David, the assistant known to frequent the coffee shop. But Claire planted it. Her statement that she "doesn't drink coffee" was an over-denial. She bought the cup specifically to plant it.
- The Perfume: Another red herring, meant to frame Martha. Claire likely dabbed some perfume (easily acquired) in the room. Martha's proud admission of her "signature scent" made her an easy target.
- The Unplugged Clock: This is the key! A professional thief or a frantic scientist would smash a clock or simply ignore it. Coiling the cord neatly is the action of someone meticulous and procedural, like a former military officer and head of security. She unplugged it so Dr. Thorne wouldn't know the exact time of the theft, only the wider window of the "outage" she created. She did it out of habit and procedure—leaving things tidy.
- The Smudged Fingerprint: Claire would know better than to leave a clean print, but in her haste to manipulate the keypad and plant evidence, she left a small, smudged print—consistent with someone trying to be careful but making a minor mistake.