NCIS Says I’m a Suspect. What Should I Do?

Do not turn the first contact into the government’s first statement

If NCIS wants to interview you about suspected misconduct, you do not improve the situation by improvising an explanation before you know the evidence. Investigators may already have witness accounts, messages, device data, photographs, financial records, or other material they will use to test your answers. An interview can lock you into details before you know which details matter.

Be professional. Do not flee, threaten, destroy evidence, or lie about your identity or availability. But professionalism does not require a substantive statement. If you are ordered to report to an office, comply with lawful orders concerning where to be while preserving applicable rights concerning questioning.

What Article 31(b) means in practical terms

Article 31(b), UCMJ requires that a person subject to the UCMJ who interrogates or requests a statement from an accused or suspect first identify the nature of the accusation, advise that the person does not have to make a statement, and warn that any statement may be used as evidence at a court-martial. Military Rule of Evidence 305 adds the rules governing warnings, waiver, counsel, and admissibility. These protections are broader in important respects than the civilian shorthand people associate with Miranda.

The warning is not an invitation to prove innocence. It signals that the government views you as an accused or suspect for purposes of the questioning. A clear invocation allows counsel to evaluate whether any later communication should occur and on what terms.

Why “I can explain this” is risky

An innocent person can still misremember a time, minimize an embarrassing fact, guess at a detail, adopt an investigator’s vocabulary, or make a statement that conflicts with digital records. Those inconsistencies can become independent evidence of consciousness of guilt or a separate false-statement allegation. The safer sequence is evidence first, strategy second, statement decision third.

Interviews, phones, consent searches, and credentials are separate decisions

An interview request is one decision. A request to unlock a phone, provide a passcode, sign a consent form, surrender an account, identify a device, or permit a search is another. Do not treat them as one package merely because an agent presents them during the same meeting. Search authority can come from consent, a search authorization, or another lawful basis, and the legal analysis can be highly fact specific. Before voluntarily expanding government access to digital evidence, obtain case-specific advice.

Preserve the defense before the evidence changes

Early defense work is not limited to telling a client to remain silent. Messages disappear, apps update, cloud accounts roll over, surveillance video is overwritten, witnesses transfer, memories change, and phones are replaced. Preserve potentially relevant texts, photographs, call logs, social-media records, receipts, travel records, location information, medical records, and names of witnesses. Do not delete, edit, manufacture, coach, or conceal evidence. A defensible preservation plan protects both favorable evidence and its authenticity.

For digital evidence, screenshots may be useful for orientation but are not always the best final proof. Native files, full message threads, export data, metadata, and forensic images can become important. Serious cases often require counsel to decide early whether a defense digital-forensics expert should preserve or analyze devices before the government theory hardens.

What to do in the next 24 hours

1. Write down who contacted you, when, and exactly what was requested.
2. Do not discuss the allegation in group chats or with potential witnesses.
3. Preserve relevant devices, accounts, messages, and documents.
4. Do not delete embarrassing material because you think it looks bad.
5. Gather paperwork showing any interview date, rights form, seizure, or command instruction.
6. Consult counsel before the scheduled interview or consent decision.

When a defense presentation can make sense

Remaining silent during an interrogation does not mean the defense can never communicate. After counsel investigates, there may be strategic reasons to provide objective records, identify an alibi witness, correct a demonstrably false premise, or make a targeted presentation to investigators or prosecutors. The difference is control: the defense chooses the timing, content, and purpose after understanding the risk.

What the first consultation should accomplish

A useful investigation consultation is not a sales call built around fear. Counsel should identify the alleged offense, the investigating agency, whether the member is a witness or suspect, what rights advisement or search request has occurred, what evidence must be preserved, what deadlines or command restrictions exist, and which government actor is likely to make the next decision. The lawyer should also identify what is not yet known. That gap analysis matters because early certainty can be dangerous when the investigative file is still developing.

Before ending the consultation, the service member should understand the immediate do-not-do list, the preservation plan, who will communicate with investigators, and what event will trigger the next defense decision. That creates a disciplined process instead of reacting to every phone call or rumor from the command.

Why trial experience matters before trial exists

Gonzalez & Waddington, LLC is a civilian military defense firm representing U.S. service members worldwide. Michael Waddington is a former Army JAG prosecutor, Trial Defense Counsel, and Senior Defense Counsel with more than 25 years in military criminal defense and more than 200 contested trials. His work includes books and teaching on cross-examination, digital forensics, forensic evidence, and trial advocacy. Alexandra Gonzalez-Waddington is a founding partner with more than two decades of criminal and military defense experience and is an author or co-author of books addressing sexual-assault defense, digital forensics, DNA evidence, and courtroom advocacy.

Investigation-stage decisions should be made by asking what the evidence will look like if the matter later becomes an Article 15, administrative separation, Board of Inquiry, or court-martial. The value of experienced defense counsel is not a promise that an investigation will disappear. It is the ability to protect rights, preserve favorable evidence, identify factual and forensic weaknesses, communicate strategically when appropriate, and avoid creating evidence that did not previously exist.

How to evaluate counsel during an investigation

Related ucmjdefense.com authority guides

• NCIS Investigation Lawyer — the full NCIS investigation pillar
• Military Investigation Defense Lawyers — the investigation-cluster hub for CID, NCIS, OSI, and CGIS
• Military Investigation Rights — Article 31, searches, titling, indexing, and investigation consequences
• Under Military Investigation: Should You Talk? — a direct guide to interrogation decisions
• Pretrial Stages of a Court-Martial — how an investigation can progress toward charges and referral

Primary authorities

Verify current law in Article 31, UCMJ (10 U.S.C. § 831), the current Manual for Courts-Martial including M.R.E. 305, and agency/service policies applicable to the investigation. For the charging sequence, see the firm’s pretrial stages guide and preferral and referral guide.

Video transcript

Transcript of the video “NCIS Says I’m a Suspect — What Do I Do Now? | Military Defense Lawyer Explains,” with Michael Waddington of Gonzalez & Waddington.