Reasonable Suspicion, Probable Cause,
and the Clock
Two thresholds separate a lawful encounter from a false-arrest case: reasonable suspicion for the stop, probable cause for the arrest. The practices question is never abstract. It is always what specific facts the officer could articulate at each moment, and when the encounter escalated.
Attorney and law-firm inquiries only
Two standards, one deciding question.
Reasonable suspicion is the threshold for a brief investigative detention: specific, articulable facts which, taken together with rational inferences, suggest that criminal activity may be afoot. The standard comes from Terry v. Ohio, 392 U.S. 1 (1968), and it is taught the same way in every academy: a hunch is not enough, a profile is not enough, and the officer must be able to state what was seen, heard and known, not what was felt.
Probable cause is the threshold for arrest: facts and circumstances within the officer’s knowledge sufficient for a reasonably prudent person to believe that a crime has been or is being committed, and that the person to be arrested committed it. It demands more than suspicion and less than certainty, and it is measured on the totality of the facts and circumstances known at the moment the arrest is made.
In litigation, the labels decide less than the inventory underneath them. At every moment of an encounter there is a finite list of facts the officer actually possessed: what the dispatch broadcast said, what the officer observed before the lights came on, what the records check had returned by the time the handcuffs went on. Both thresholds are measured against that inventory, and the practices analysis builds the inventory fact by fact from the record.
The analysis does not declare a stop or an arrest lawful or unlawful. It inventories the articulable facts, fixes each one to the clock, and measures the documentation against training and national standards. Legal conclusions remain counsel’s; the expert addresses police practices.
Consensual, detained, arrested: encounters move in steps.
Officers are trained to know which tier of encounter they are in. A consensual contact requires no threshold at all, and the person remains free to leave. An investigative detention requires reasonable suspicion, and must stay brief and tied to the purpose that justified it. An arrest requires probable cause. False-arrest theories usually live at the seams: the moment a consensual contact quietly became a detention, or a detention hardened into an arrest before the facts had arrived.
The record fixes those seams more precisely than any narrative can. Emergency lights, blocking positions, commands, a frisk, handcuffs, placement in a patrol car, an identification card carried back to the cruiser while a check runs: each is an escalation marker that carries a timestamp in the video or the dispatch log. The Library guide to what a Terry stop is treats the detention tier in detail.
- Lights, blocking positions and commands that end a consensual contact
- Retention of a license or identification while a warrants check runs
- A frisk, which requires its own suspicion that the person is armed and dangerous
- Handcuffing, patrol-car placement and movement away from the site of the stop
- The length of the detention, measured against the task that justified it
- The words of arrest, and the moment restraint became custodial in fact
Prolongation is its own failure mode. A detention lawful at its start can outlast the task that justified it: the citation is written, the check has come back clean, and the person is still standing on the shoulder while a canine unit drives in from the next town. The clock on each task is in the dispatch record, and the analysis reads it minute by minute.
What counts as articulation, and what does not.
Articulation is the skill both thresholds are built on, and it is trained as a skill. A usable fact is specific, observable and tied to the person stopped: conduct described in concrete terms, at a stated time and place, connected to a stated reason for suspicion. A label is not a fact. Nervous, evasive, suspicious and furtive are conclusions wearing the clothes of observation, and report-writing instruction says exactly that.
Context facts carry weight only when paired with individual conduct. An area’s reputation, the hour of night, a generalized description that would fit half the block: standing alone, none of these individualizes suspicion to the person detained. Officers are trained to stack specific observations until the stack supports the intrusion, and the analysis looks for that stack in the report written that night, not in the deposition given two years later.
The practices question is documentary. When the report was written, did the officer record the specific facts now recited, or did the articulation arrive later, shaped by what the search turned up? The difference between those two reports is often the difference between a defensible stop and a false-arrest exposure, and it is visible on the face of the paper.
How each threshold is trained to be documented.
Report writing is taught alongside the thresholds themselves. Academy curricula, field training programs and in-service instruction train one discipline: state the specific facts in the officer’s own observations, in sequence, with times, and attribute whatever came from dispatch, witnesses or other officers. The report should let a reader stand where the officer stood at the moment of the seizure and see exactly what the officer saw.
The failure patterns are as recognizable as the standard. Conclusory labels stand in for observations. Threat language repeats verbatim from report to report. The narrative compresses the timeline so the arrest appears to follow the facts, when the dispatch log shows the facts arrived afterward. Articulation surfaces for the first time in a supplement or a deposition, months after the stop, once the case has drawn scrutiny. The Library guide to how police reports fail takes up each of these patterns.
The analysis runs in both directions, and says so on the record. A report that records specific observed conduct, fixed in time and corroborated by the video, supports the officer who wrote it. When the documentation meets the standard the profession trains, the report of the analysis states that plainly.
Facts acquired after the seizure cannot justify it.
Both thresholds are measured at a moment, not over the life of a case. Reasonable suspicion is tested on what the officer knew when the detention began; probable cause is tested on what the officer knew when the arrest was made. What the search produced, what the check returned five minutes later, what a witness said an hour afterward: none of it can be carried backward to justify a seizure that had already happened.
That is why the first exhibit in a threshold case is a chronology. The method is set out in building the record chronology: dispatch audio, computer-aided dispatch entries, video timestamps and report times merged into a single timeline that shows what the officer possessed at each decision point, and what arrived only later.
Sequencing is also where the service casework concentrates. The false-arrest practice covers probable cause timing as its own case type: encounters in which the facts eventually assembled were real, but were assembled after the handcuffs.
For every fact in the report, the chronology asks two questions: when did the officer acquire it, and can the record prove the time.
What the expert adds on a threshold question.
Opinions rest on the complete record: video, reports, dispatch audio, witness statements, depositions, training files and agency policy, measured against state and federal statutes, case law, national police standards and practices, and the totality of the facts and circumstances. IACP model policies, state POST training standards, and academy and field training curricula frame what officers are trained to articulate and to write down.
Professor Gilbertson has consulted in more than 220 civil rights and criminal cases across 42 states and the District of Columbia, retained by plaintiff’s counsel, by the criminal defense bar, and by counsel defending officers and agencies. The threshold analysis is identical on either side: the inventory of facts, the clock, and the documentation, measured against training. Where the record shows the articulation was there before the seizure, the report says so.
The boundary holds throughout. Whether reasonable suspicion or probable cause existed as a matter of law is for counsel to argue and the court to decide. The expert supplies the practices foundation: which facts were articulable, when each one arrived, and whether the documentation reflects what officers are trained to record.
When the question becomes a retention.
This page is reference. When a live matter needs the analysis, these are the doors.
Adjacent reading.
Asked alongside this one.
What is the practical difference between reasonable suspicion and probable cause?
Can facts learned after an arrest supply probable cause for it?
How does an expert address these thresholds without offering legal conclusions?
Bring the matter behind the question.
Attorney inquiries are answered directly. If a case presents a conflict, you will hear it immediately.
Inquiry sent.
You will hear back directly. If the matter is urgent, call (239) 571-1840.