Good shout from apimembership -
1) I would add that checking the LinkedIn profile of the ICO funders/team is key
Some of the LinkedIn profile are complete scam even though they look great on paper - You can spot scam profile by the numbers of connections these profiles - that's a way to do it.

2) Whitepaper is needed indeed - KodakOne is a great example, they have no white paper