Post Blast Investigation

1
Post Blast Investigation
2
Bombing Incident

• A bombing investigation is not an entirely new
  concept to the experienced investigator
• The basics remain the same, with consideration
  being given to some features that are unique to
  bomb scenes

3
Overview

• Investigative Objectives
• Outside Investigation
• Crime scene (post blast) search
• Laboratory considerations
• Investigations Involving Unexploded or Disrupted
  Devices
• Realities of AFOSI at a post blast investigation
• Contamination Issues

4
Investigative Objectives
5
Investigative Objectives

• May end up in court
• Document, document, document
• Handle evidence as you would any other case
• Thorough investigation

6
Considerations

• Who
• What
• When

• Where
• How
• Why

7
Who

• placed the bomb?
• made the bomb?
• is the victim?
• Was this the intended victim?
• Was he an innocent bystander?
• Was he the bomb maker?

8
What

• happened?
• was the target?
• materials made up bomb?
• skills were needed to make the bomb?

9
When

• was the bomb made?
• was the bomb placed?
• was the fuse initiated?
• did it explode?

10
Where

• was the bomb made?
• was the bomb placed?
• were the components obtained?

11
How

• was the device designed?
• was the device armed and initiated?
• was the device placed?

12
Why

• was the bomb built?
• did it detonate when it did?
• did it detonate where it did?

13
Investigative Objectives

• Motive
• Opportunity
• Means

14
Motive

• Attention
• Political Extremism
• Hate
• Vandalism
• Malicious Destruction
• Vengeance
• Kicks

• Love
• Civil Rights
• Satisfaction
• Racketeering
• Monetary Gain

15
Opportunity

• Time
• Action
• Command

16
MeansBomb Manufacturing
17
OutsideInvestigation

• Investigation outside the crime scene

18
Outside InvestigationInterviews

• Describe the explosion
• What color was the flash and smoke?
• What did it smell like?
• What did it sound like?
• Were there multiple explosions?

19
Outside InvestigationsInterviews Continued

• How long were you in the area prior to the blast?
• Where were you when the explosion occurred?
• What did the victim do?
• Who went in and out of the area?
• Anything unusual prior to the blast?

20
Outside Investigation

• Record tag numbers of vehicles in the area
• Photographs of the crowd
• Obtain photographs of the victim and area as they
  were before the blast
• Obtain blueprints, utility records, etc.

21
Outside Investigation

• Accompany victim to the hospital or morgue
• Witness autopsies and observed damage to
  determine device placement
• Collect all fragments from body
• Obtain autopsy report
• Collect clothing as well as any fragments in them
• Swabbing of victim

22
Outside InvestigationVictim Related Investigation

• Identify the victim and conduct background
  investigation
• Examine victims home, auto, and place of
  business
• Avoid contamination between crime scene and
  search areas

23
Outside InvestigationSearch of Subjects
Residence/Vehicle

• Be alert for booby traps
• Obtain search warrant based on probable cause
  from the crime scene and other investigation
• Take everything legally possible
• Components, materials, tools, shoes, address
  books, computers, phone records, etc.

24
Crime Scene Search

• Some unique problems at a post blast scene
• Confusion
• Safety Concerns
• Security Issues

25
Confusion

• Accidental v. Bombing
• Treat as a crime scene until proven otherwise
• Too many people (Medical Personnel,
  Investigators, etc)
• Establish Traffic Control ASAP
• Orientation problems
• Communication problems
• Have secondary and tertiary methods
• Curious bystanders

26
Safety Concerns

• Secondary Devices
• Gas lines
• Water/Sewer
• Electric Lines
• Broken Glass
• Structural Integrity
• Secondary Fires
• Hazardous Materials
• Biohazards

27
Safety Concerns

• Shoring of columns at the Pentagon crash site

28
Security Concerns

• Establish a perimeter
• Post security to control access
• Designate a location for the news media
• Set up identification procedures for personnel
  working in the crime scene

29
Scene Security
Crime Scene
ECP
CP
ECP
30
Security Concerns Command Post

• Physically located at the perimeter
• Point of contact for both outside and crime scene
  investigation
• Control point for access into the crime scene
• Provide for liaison with news media, command
  elements, etc.
• Provide logistical support

31
Crime Scene Investigation

• Processing the area within the crime
• scene perimeter

32
Crime Scene InvestigationEquipment

• Hand tools
• Shovels rakes
• Screens
• Ladders
• Portable lighting
• Wheelbarrows

• Crime scene kit
• Measuring tapes
• Metal detectors and magnets
• Vapor proof bags or paint cans
• Swab kits

33
Forms/Documentation

• Administrative worksheets
• Narrative description
• Evidence Logs
• Latent Fingerprint Logs
• Photo Logs
• Diagram/Sketching equipment

34
Crime Scene InvestigationPersonnel Assignments

• Team leader
• Photographer and Photo Log Recorder
• Sketch Preparer
• Evidence Recorder/Custodian
• Evidence Recovery Personnel
• Specialists (as required)

35
Team Leader

• Assume control and verify the safety and security
  of the scene
• Conduct a preliminary survey
• Make team assignments
• Act as coordinator with the CP
• Ensure that the team has sufficient supplies,
  equipment, food, rest, etc.
• Continually reevaluate the efficiency of the
  search throughout the operation
• Conduct a final survey before departure

36
Photographer

• Photograph the entire scene prior to entry
• Still and video
• Photograph victims, crowd, and vehicles
• Get distant, medium, and close-up shots
• Photograph major items before moving them
• Photograph latent prints before lifting
• Prepare a photograph log

37
Photographs
38
Use of Scale in Photographs

• One with scale and one without

39
Sketch Preparer

• Diagram immediate area and orient with north
• Coordinate numbers for items on sketch with the
  photographer and collectors
• Designate and label general search areas
• Put administrative information on the sketch
  along with scale disclaimer (not to scale)

40
Sketching the SceneNikon Total Station
41
Evidence Recovery Personnel

• Have significant evidence photographed and
  sketched before it is collected
• Initial and date all evidence
• Coordinate the location of items of evidence with
  the sketch preparer
• Turn evidence over to the evidence custodian

42
Evidence Recorder/Custodian

• Receive and record all evidence
• Prepare evidence recovery log
• Coordinate evidence packaging
• Maintain chain of custody
• Coordinate transmittal of evidence to lab

43
Specialists

• Medical Examiner/Coroner
• Odontologist
• Bomb Technician
• Crime laboratory examiners
• Structural Engineers

44
Preserve the Crime Scene

• Set up crime scene barrier tape
• Generally establish flight paths of the evidence
  and protect these areas
• Search authority dependent on where blast occurred

45
Crime Scene Log

• Maintain a log of personnel entering the crime
  scene
• Name
• Department
• Number to be reached
• Date/Time of entry and departure

46
Initial Walk Through

• Initial walk through with minimum amount of
  people
• Team leader, photographer/videographer and
  swabber
• Consider contamination issues prior to entry
• Establish a cleared route for everyone going into
  the crime scene
• Use marking tape to show cleared areas
• Avoid wandering over the scene, tracking small
  particles from place to place

47
Initial Walk ThroughTime Sensitive Concerns

• Identify any evidence which may be lost if not
  handled quickly
• Wind may blow away light weight items
• Rain can destroy footprints or wash evidence down
  the drain
• Evaporation of residue
• Rescue personnel may trample evidence

48
Organizing the Search

• Grid off area
• Four exterior
• One interior, seat of explosion (crater)
• Assign personnel to specific areas
• Crater
• Rooftops, gutters, ledges, trees
• Cover large open areas in a methodical manner
• Strip/line
• Grid

49
Expanding the Crime Scene

• In an open area, the perimeter of the scene
  should be 50 farther than your most distant
  evidence from the crater
• Allowances may be made for directionality of
  blasts which are shielded from one direction
• Adjust continually as needed if more evidence is
  located beyond the original limit

50
Crime Scene Perimeter
50
Crime Scene
51
SEARCH PATTERNS

• STRIP SEARCH AND GRID SEARCH
• Great for large outdoor areas, start with the
  strip search then follow up using the grid search
• Block the area to be searched into a rectangle
• Divide the area into 1-yard wide strips and
  assign one agent to each strip
• Search the Area

52
STRIP SEARCH
53
Strip Search
54
GRID SEARCH
55
ZONE OR SECTOR SEARCH

• Can be used in both indoor and outdoor scenes
• Block the area into zones and assign agents to
  each zone
• Consider using the strip method inside the zone
  to ensure all portions of the area are searched

56
ZONE OR SECTOR SEARCH
57
Zone Search
58
Zone Search
59
Determining Items to Collect

• What are you looking for on your search
• Bomb related items
• Fuse
• Filler
• Container
• Anything foreign to the scene
• If there is the slightest doubt as to what an
  item is, collect it and let the lab review it
• Anything that could be related to the bombing
• Example packaging material from a letter bomb
• May or may not need to put the vehicle/aircraft
  back together again
• What do you do when you find significant
  evidence?
• IF YOU DONT KNOW ASK!

60
Items to Collect
61
Items to Collect
62
(No Transcript)
63
(No Transcript)
64
(No Transcript)
65
Items to collect

• Indigenous items which could be fused with bomb
  components
• Nails or screws from the target building/vehicle
• Wire and electronic components which were part of
  the target building/vehicle
• Security alarm wiring and sensors

66
Fragmentary Evidence

• Main Charge (Explosive)
• Low Explosive Requires Container to Function (ie
  Pipe)
• High Explosive Functions With or Without
  Container
• Initiator (Low Explosive) / Detonator (High
  Explosive)
• Fuzing System
• Active (Timer, Burning Fuse, Integrated Circuit)
• Passive (Pressure, Movement)
• Command Initiated (Radio Controlled)

67
Determine Items to Collect

• Adjacent objects which may have trapped explosive
  residue that we need to obtain with swabs
• Dont forget standard crime scene concerns
  (fingerprints, tool marks, footprints, tire
  tracks, trace evidence, indented writing, soil,
  body fluids)

68
Swab Kit

• 300 dry sterile cotton balls in 12 plastic
  containers (25 per container, containers labeled
  A-L) with plastic lids
• 200 small glass vials w/plastic lids empty
  (with labels)
• 200 sealable plastic bags
• 6 large glass containers w/plastic lids empty
• 100 disposable forceps sealed in a plastic bag
• Two boxes of latex gloves (100 count each box),
  non powder
• 8 Tyvek suits (1 Med, 3 Large, and 4 X-Large)
• 3 pair of safety goggles
• Two rolls of tamper resistant evidence tape
• 5 Sharpie marking pens
• 5 Quart size unlined paint cans (for soil
  sampling) with lids
• Bottles of isopropyl alcohol (16 oz)

69
Swab Kit

• Small trowels (for soil collection)
• 10 disposable pipettes (for collecting liquids)
• Disposable Scalpels/Scissors
• Leatherman
• Mini-Flashlight with extra batteries
• 100 ft tape measure
• Garbage bags (box of 25)
• 2 Rolls of Duct tape
• Heat sealer
• Large Pelican portable case with combination locks

70
Swab Kit
71
Swabbing for Residue

• Put on a pair of gloves prior to handling
  anything from the swab kit
• Then put on the tyvek suit
• Put on another pair of gloves
• Open a jar of swabs and use the isopropyl alcohol
  to moisten the swabs
• Do not saturate the swabs
• Use disposable forceps to handle the swabs

72
Swabbing for Residue

• Obtain a control swab for each container of swabs
  used and place it in a proper container
• Make the appropriate annotations (control swab
  from container X of swab kit)
• Seal the container with evidence tape and seal it
  (heat seal)
• Obtain a control swab for each tyvek and gloves
  used
• Swab the item and place the swab in a container
• Mark it with the appropriate information
  (date/time collected, collector, object swabbed)
• Seal the container with evidence tape and then
  seal it in a plastic bag (heat seal)

73
Swabbing for Residue
FSC Hard at Work
74
Explosive Residue

• Explosive residue is often deposited on street
  signs and other objects in the path of the blast
  wave
• These objects can be swabbed or packaged and
  submitted separately in sealed container

75
Trace Residue Collection

• Explosive Residues Often Remain
• Behind in the Blast Crater

76
Samples from the crater

• Take a sample from the top of the crater near the
  edge
• Take a control sample from a few feet away
• Dig down an inch or two to get the same layer of
  soil as your original sample
• Package separately
• in vapor proof
• containers
• (paint cans)

77
Sifting for Evidence
78
Metal Detector and Magnets
79
Consider Moving the Scene

• Vehicles can be lifted onto a
• flatbed truck lined with
• plastic and moved indoors
• Aircraft can be reassembled
• in hangers

80
Itemizing Evidence

• Make significant evidence a single item
• Group items within a small zone or area and label
  them as one item on your evidence log

81
Marking Evidence

• Direct marking on large items
• Indirect markings are acceptable for small items
• Initials, date, case number, item number
• In complex cases where multiple agencies respond,
  add full name and department

82
Marking Evidence
83
Containers for Collection

• Before anything is collected two things need to
  be accomplished
• Paint cans for soil samples and items containing
  residue (2-3 inches of headspace)
• Ziploc bags for items not to be examined for
  explosive residue
• Paper bags for items containing body fluids (air
  dried)
• Nylon bags/glass jars for items with explosive
  residue
• Pink anti-static bags may also be used

84
Evidence Collection - Bulk Materials

• Call the lab first!
• Solids
• USE CAUTION
• Many Shock Sensitive
• Special Containers Needed
• Collect 1 oz or Less for Lab Analysis
• Collect With WOODEN Utensil
• Provide Lab with All Information
• from Container Labels

85
Evidence Collection - Bulk Materials

• Call the lab first!
• Liquids
• Pour Out of Original Container
• Think Latent Prints
• Place Primary Container into
• Secondary Container
• Use Absorbent Material to Pad
• Provide Lab with All
• Information from Container Labels

86
Evidence Collection - Storage

• Keep ALL trace evidence away from containers of
  liquids and solids
• Keep evidence from the CRIME SCENE separated
  from other SEARCHES
• Keep evidence from different search locations
  separated
• Keep evidence collected from suspects separated
  from all the above
• DONT store evidence containing volatile
  chemicals in the same room with other evidence -
  this includes some solids
• DONT put incompatible chemicals or explosive
  materials next to
• each other

87
Final Survey

• Review all aspects of the search
• Double check your documentation
• Inventory the evidence
• Take one last look at the scene to see what you
  may have missed
• Photograph the condition of the scene it exists
  upon your departure
• Conduct a debriefing of all personnel to ensure
  that processing is complete

88
Storage and Disposal of Hazmat

• Must conform with federal, state, and local regs
• Quantities of explosives not safe for storage may
  be disposed of with prosecutor concurrence
• Wrappers and containers may be kept for evidence
• Record the destruction of the explosives and
  maintain the video/photos as evidence

89
Release of the Crime Scene

• Document the following
• Date and time of release
• To whom released
• By whom released
• If a warrant was used, provide a copy of the
  warrant and a copy of the inventory
• Once the scene is released, reentry may require
  another warrant

90
Laboratory Examinations

• Identification of particular items of evidence
• Comparison of known and questioned items of
  evidence to link the suspect to the crime

91
Laboratory Capabilities

• Type of explosive used
• Bomb components
• ID of each component
• Determine the manufacturer of the components
• Comparison with previous devices
• Determine any special skills the bomb maker
  needed to build the device

92
Laboratory Capabilities

• Tape
• Fracture end match
• Surface characteristics
• Adhesive type
• Comparison identification
• Fingerprints
• Manufacturer

93
Laboratory Capabilities

• Wire
• Gauge
• Composition
• Wire cutter tool mark comparison
• Manufacturer

94
Bombers Signature

• When one bomb maker creates several devices look
  for common elements
• Fusing system principles
• Choice of components
• Construction techniques

• Component alterations
• Placement/Delivery
• Overall technical difficulty

95
Chain of Custody

• Document the following
• Proper collection
• Proper storage
• Proper transportation
• Proper transferring

96
Investigations Involving Unexploded or Disrupted
Devices

• WORK WITH EOD!
• DANGER! Do NOT touch! DANGER!

97
Evidence vs. RSP

• Avoid unnecessary risks for the sake of evidence!
• Dont get blown up trying to collect evidence!

98
Unexploded/Disrupted Devices

• Note any modifications that were made
• Attach tags or labels to any wire or tape that
  was cut by the bomb tech
• Photograph the device once it has been rendered
  safe

99
Unexploded/Disrupted Devices

• Contact the lab and determine what kind of
  samples of the explosives they want and how to
  ship them
• Make sure all hazardous features of a device are
  rendered safe before shipping to the lab
• Advise the lab of the RSP technique used
• May require known samples of disrupter round
• If countercharge is used, advise the lab of the
  type of explosive used

100
Reality

• Host nation will take over the scene, its their
  property
• They may try to cover it up (with a bulldozer)
• They may preserve it
• They may let you in later on
• Hopefully they will allow the FBI access to the
  scene and let them run it
• Introduce your EOD folks with host nation EOD
  (IABTI)
• Make sure you know the local police beforehand

101
What you can do immediately!

• GET PICTURES
• Video and still photos of crater and blast damage
• 360 degrees
• Furthest blast damage (broken windows may be
  miles away)
• Secure critical evidence
• Large fragments that will be trampled
• Swabbing
• Dirt sample from the crater
• Notifications
• Get EOD to the scene and ask them what is
  important and their initial impression
• Document EVERYTHING that was done in order to
  properly brief the FBI

102
Pictures
103
What you can do immediately!

• Save all clothing and fragments taken from
  victims
• Set up a senior commander to run interference
• Set up an operating location for the FBI
• Evidence storage area
• Command post
• Communications
• Transportation
• Lodging
• Security
• Complete record of what has been done to that
  point in time

104
Recent case on 11 Sep 02

• Package arrives at BITS mailroom at Building
  1535, Andrews AFB
• Return address is Saudi Arabia
• Address sent to is Camp X-Ray, Washington D.C.
  obviously not real address in D.C.

105
Contamination Issues in Bombing Cases
106
Contamination

• Locards Principle
• The accidental or incidental contamination of the
  suspected person or object by material from a
  source other than the specific exchange.
• This is the exchange that the investigating
  authorities are seeking to minimize. The fiber
  from the police officer, the explosive traces
  from the explosive officer or the firearms
  residue from an authorized shot.

107
Who does it affect?

• It quite literally affects anybody who has an
  input into the investigation.
• In a post blast investigation it will include
• EMT
• Fire Department
• Police
• EOD
• Relief Workers
• Search and Rescue personnel
• List goes on and on..

108
Cross-Contamination
109
Cross-Contamination
110
Sources of Contamination

• Tools
• Work Clothing
• Equipment
• Vehicles
• Collection materials improperly stored
• Sifting Screens
• Firearms
• Handcuffs
• Turnout gear for First Responders
• Portable fuel-powered equipment

111
Where you can minimize contamination

• Prior to attendance
• At the bomb scene
• Post attendance

112
Prior to Attendance

• Make sure all kits and equipment are thoroughly
  clean and serviceable
• Personnel attending the scene have not recently
  been in a contaminated environment
• Vehicles used to transport personnel are cleaned
  before returning to use
• Only have personnel at the scene that are
  necessary
• Any person attending the scene may have to
  testify

113
Prior to Attendance Tool Care

• Cleaning of tools is mandatory between uses and
  different crime scenes
• Clean with a strong degreasing detergent and
  scrub vigorously with a brush
• Dawn liquid soap seems to work well
• Use metal head tools whenever possible
• Consider some tools as disposable (one time use
  only)

114
Prior to Attendance Vehicle

• Vehicle interior should be thoroughly cleaned
  down using alcohol and sterile paper towels then
  swabbed
• Control
• Nearside rear passenger seat, back and nearside
  interior door panel
• Offside rear passenger seat, back and offside
  interior door panel
• Front passenger seat back (rear) and rear
  nearside footwell
• Drivers seat back (rear) and rear offside
  footwell
• Interior roof area above rear seats
• Secure vehicle with seals

115
At the Bomb Scene

• Very dangerous scene-account for everyone
• Be aware of media
• People inside the scene are being photographed at
  all times
• Keep strict control of who goes in and out
• Crime scene entry control log
• Do not take unnecessary equipment into the scene,
  it will have to be sanitized
• Put different items in different nylon bags
• Use pink, antistatic bags for components
• Keep good documentation of your procedures
• Use clothing specifically set aside for bomb
  scene

116
Clothing Concerns

• Designate specific clothes to wear only at crime
  scenes
• Use Tyvek suits when clothing is not clean and
  when involved in multiple searches
• Use disposable latex gloves, preferably
  powder-free over leather work gloves

117
Post Attendance

• Ensure agents do not transit between multiple
  scenes or deal with SUBJECT/VICTIM
• Clean all equipment and clothes and package them
  up
• Sanitize vehicles before transport of SUBJECT
• Do not let improper packaging or poor handling in
  the evidence room negate all the
  anti-contamination measures you took at the scene

118
SUBJECT on Apprehension

• Designed to reduce the chances of contamination
  prior to forensic sampling
• Must consider the recent contamination of agents
  and police
• Must swab prisoners hands immediately or protect
  with nylon bags
• Do not let them use the bathroom before you swab
  their hands
• Take clothes and shoes and place in nylon bags if
  you think they contain explosive residues

119
Contamination

• Avoid packaging questioned and known items
  together for shipment to the lab

120
Summary

• Contamination at the crime scene is always a
  problem, especially with bomb and arson scenes
• Take steps before, during and after the crime
  scene to avoid unwanted transfers
• Primary means of contamination/transfer from
  solids is direct physical contact
• Use disposable gloves and Tyvek
• Eliminating contamination is everyones job and
  will keep your case from getting thrown out

121

• Questions?

Sources FBI Training Materials