Explosives and Arson

Abstract

A synopsis of current methodologies regarding bombing and arson investigations and laboratory analysis of evidence from these types of incidents is discussed. Each section is outlined and discussed from the viewpoint of a forensic scientist with longer than 30 years of experience in these two fields. An additional section on education and the misconceptions on these types of investigations is also covered.

Explosives and arson cases, as they relate to forensic science, are can be very hard to separate. It is a rare occasion when a fire does not occur after an explosion. That is why they have been placed together for this chapter.

In the past, there has been little education regarding forensic science let alone in the fields of arson/explosion investigation and or analysis. Only in recent years has forensic science benefitted from what is commonly referred to as the “Hollywood” effect. This occurs when movies and TV glamorize something and make it very appealing to the general public. Many recent movies and the television series “CSI” have done so in the case of forensic science. However, because arson and explosion investigations and analysis are so specialized, the Hollywood effect has done us no favors in this regard.

Both arson and explosive case/evidence can be very tedious and time consuming to analyze. Because of the materials involved, if the materials are not handled in a safe manner, they can also be very dangerous to the analyst’s health. Laboratory analysis, as anyone in forensic science knows, is tied directly to how well the crime scene is processed and evidence correctly identified and collected. If the evidence is not located and collected properly, it will be of little, if any, use when it gets to the lab, let alone when it is used in court.

This chapter is organized in two parts: Investigations and Laboratory Analysis.

5.1 Investigations

Not much has changed with bombing and fire investigations in the last few years. Very few if any investigations occur as they do on TV. There is no script; it is more like a puzzle with many of the pieces missing. Many agencies still send their laboratory personnel to the actual scenes to help in the identification and collection of evidence. Not all personnel are interested in doing this, but some are. The reasons are many.

5.1.1 Hazards

For the most part, a bombing or fire scene is one of the most dangerous places a person can be. Generally the area can be very hazardous to the responders’ health for any number of reasons. The main reason is the fact that once a bomb has gone off or a fire has occurred, the scene is generally no longer structurally sound (Figs. 5.1 and 5.2).

Fig. 5.1

Buildings can and do explode

Fig. 5.2

Cars are reduced to jagged pieces of metal

These are just a few of the hazards. On top of these, add in that the bad guys may be actively trying to kill the responders who show up. On January 16, 1997, officers responding to the scene of a bombing incident, where one person was killed and another seriously injured, were targeted by the bomber. Street officers, EMS personnel, and investigators of all types quickly arrived on scene. They were all in extreme danger just by doing their jobs. The bomber left what is called a secondary device behind timed to go off approximately one hour after the first device (Fig. 5.3).

Fig. 5.3

Components of an incendiary device

Although the device detonated, no officers were seriously injured simply because a late arriving officer had parked his car directly in front of the device. Less than a month later the same situation occurred again. This time however, the responding officers modified their procedures and searched the response area prior to beginning the evidence processing. Because of this alteration of their response, the device was discovered and disarmed before it could detonate. Walking into an area that has a device intentionally left behind, designed to kill the responding officers, can be a sobering experience. While street officers may realize these dangers, most crime scene response personnel are unfamiliar with them. I personally have been on a response where I was later informed by the suspects that they had me and several other responders in the cross-hairs of a sniper rifle. The only reason they did not shoot was because they did not want to give away their position. There is story after story that parallel this instance from other responders.

5.1.2 Crime Scene Personnel

Crime scene personnel are chosen and trained for their ability in evidence recognition and collection. They have to be cognizant of and know how to deal with all types of evidence. Both bombings and arson scenes can be quite a mess. Both will have evidence present, because they deal specifically with accelerants and explosives, in two primary physical forms: residues or intact material. Most people are under the false impression that when an explosion occurs, all of the components of the explosive device as well as the explosive itself are consumed or destroyed. The same impression is thought of fires. Everyone, including many investigators themselves, think that ignitable liquids and other accelerants are consumed by a fire. Nothing is further from the truth. Both residues and unconsumed (intact) materials can be located at the scene and in debris recovered from the scene if the investigator knows what to collect. In addition to the residues and unconsumed explosive, there may also be intentional materials left behind. Over recent years, there have been various methods used to help in tracking explosives that could be used by the investigator in bombings.

5.1.3 Taggants

5.1.3.1 Micro

One method that was tried and still being considered is micro-taggants. Micro-taggants are small, virtually indestructible layer chips that are mixed with explosives to be left behind after an explosion. This method has proven unwieldy because these taggants, although magnetic and UV reactive, are almost impossible to recover in a timely manner (Fig. 5.4).

Fig. 5.4

Micro-taggant

5.1.3.2 Chemical

Another method that is currently being used is chemical taggants. Instead of actual physical inert materials, specific chemicals are mixed with the explosives as ­markers. After an explosion, these chemical markers can be recovered, showing what explosive had been used. This method is being used to tag several different forms of organic high explosives here in the United States. It is a much better methodology and is finding wide acceptance in both the manufacturing industry as well as forensic science.

5.1.4 Contamination

This brings us to an extremely important point: anyone working at a bombing or arson crime scene must be constantly aware of contamination. The techniques and equipment that are currently available to personnel who analyze evidence from bombings and arsons is much, much more sensitive that in the past. This means that what could not have been detected in the past now can be very easily. This leads to the question if something is found in trace amounts: “Is this evidence or is it just contamination from another scene?” Boots, clothing, tools, and even vehicles can contaminate a scene. Agencies have to be aware of contamination problems and have procedures in place to combat them. Most agencies have thought this through and already have procedures in place to minimize these concerns.

5.1.5 What Happened?

In addition to collecting the evidence at bombing and arson scenes, crime scene investigators are tasked with determining what actually has happened at the scene. These investigators want to be able to determine what was the size of the bomb, where was it placed, how was it initiated, of what was it composed, what type of flammable liquid was used, and how was it ignited? All of these questions run through your mind when you arrive on scene (Fig. 5.5).

Fig. 5.5

Starting to process the scene for evidence

5.1.6 Evidence Collection

Once the evidence has been identified, it must be properly collected. The evidence must be placed into secure containers for transportation to the lab for analysis. These containers may be plastic bags, metal cans, or glass jars. The container type is somewhat dependent upon what type of evidence is going to be placed into it. Organic materials are unsuitable to be placed into certain types of plastic bags because they tend to pass through the plastic barrier and evaporate. However, there are specific types of plastic bags made to contain organic materials (Figs. 5.6 and 5.7).

Fig. 5.6

In most situations, arson evidence is generally placed into specific types of bags

Fig. 5.7

Metal cans are used to collect arson samples

Evidence from bombing scenes is collected into the same types of containers. By using the proper containers to collect and transport the evidence, any contamination or loss of the evidence can be avoided. It may be months before the analyst has time to examine the evidence. If the evidence is packaged improperly, materials could be lost or could even be contaminated sitting in the evidence locker. Without good evidence, the best forensic lab in the world cannot produce valid, acceptable results.

5.2 Laboratory Analysis

Once the lab does get the evidence, various types of analyses can be performed based upon agency protocols. Most agencies provide limited if any explosive evidence analysis. Agencies, if they have a full service lab, will do fire debris analysis. This is because there has been more fire debris training offered in the US during the last ten years than there has been explosive analysis training. The National Center for Forensic Science (NCFS) has been providing this fire debris training. They are the home of the Technical Working Group for Fire & Explosions (TWGFEX). This group is made up of forensic personnel, both government and private, from agencies across the company as well as several foreign countries, who are specialists in various areas of fire debris/explosive investigations or analysis.

5.2.1 Explosive Analysis

As with any type of evidence, first thing that is done is a visual examination of the debris for possible fragments of the device or any unconsumed explosive materials. Every small bit and piece could be important. All must be separated and, if possible, identified. Timing mechanism, firing circuit, device casing, what else? By looking at the bits and pieces, their size, and what type of damage is present, an experienced forensic examiner can start to deduce many things about the device. For instance, what type/class of explosive was probably used, and whether or not the device functioned properly (Fig. 5.8).

Fig. 5.8

Think of working a detonated device the same as putting together a jigsaw puzzle

Additionally, there may be unconsumed explosives present imbedded in the pieces along with residues coating them. TWGFEX has developed suggested guidelines for the analysis of both intact explosives and residues. Each is comprised of a table that shows the analysis in four categories:

• Those that provide significant structural and/or elemental information

• Those that provide limited structural or elemental information

• Those that provide a high degree of selectivity

• Those that are useful but do not fall in either of the other categories

Table 5.1 is applicable to both intact explosives and explosive residues.

Table 5.1 Analysis Guide for Explosives

The table is used in the following manner: A technique identified with a numeral 1 is sufficient for identification, a technique identified with a numeral 2 requires one more supporting technique for identification, a technique identified with a numeral 3 requires two more supporting techniques for identification, and a technique identified with a numeral 4 requires three more supporting techniques for identification. Some caveats can come into play when using these guidelines. When identifying ions, two techniques per ion are required. Some category 3 techniques lend themselves to being counted twice. For example, chromatographic techniques may be counted as two distinct Category 3 methodologies when different stationary and/or mobile phases are employed. Polarized light microscopy (PLM) may be counted as two distinct Category 3 methodologies when two different identification tests are done, such as examination of the physical/optical properties plus a microcrystalline test.

For any analytical technique to be considered of value, the test must be considered “positive.” Although “negative” tests provide useful information for ruling out the presence of a particular family of explosives, these results have limited value toward establishing the identification of an explosive substance.

If we look at the following flowchart, we can see a basic scheme of analysis that uses a layered approach using almost all forms or types of explosive materials (Table 5.2).

Table 5.2

5.2.1.1 Preliminary Tests

The first step in analysis is a simple presumptive color test. Regardless of whether the explosive is inorganic or organic based, these color tests will start the analyst down the road to identification. The most widely used color test is the diphenylamine color test. It gives a dark blue color with both organic and inorganic nitrates as well as chlorates (Fig. 5.9).

Fig. 5.9

The diphenylamine color test gives a dark blue color with both organic and inorganic nitrates as well as chlorates

Some color tests can be used to differentiate between organic and inorganic explosives. The antazoline test reacts with inorganic nitrates while methanolic KOH (potassium hydroxide) gives good color reactions with organic explosives. Whichever color test color test is used, they are still presumptive tests (Figs. 5.10 and 5.11).

Fig. 5.10

The antazoline test reacts with inorganic nitrates

Fig. 5.11

Methanolic KOH (potassium hydroxide) gives good color reactions with organic explosives

5.2.1.2 Confirmatory Tests

Once the preliminary color tests have been done, the next step depends upon whether or not intact particles are found. If particles are present, analysis can begin immediately. If no particles are found, a series of washes are done on the debris or fragments to recover any residues present. A water wash is done for inorganic explosives, while an organic solvent is used for organic explosive residues.

Regardless of whether traditional instrumental analysis or PLM is chosen as the confirming technique, the analysis is entering the final phase.

If there are no intact particles present ion the bombing debris, any fragments or the actual soil from the crater can be rinsed to capture any residues that might be present. They are rinsed with an organic solvent first and then with water. By using both an organic solvent and then water, organic and inorganic explosive residues may both be recovered. Once residues have been recovered, there are any numbers of ways to analyze them. Explosive analysis has been performed in forensic labs for quite a while. To identify explosives, some lab personnel use PLM while others prefer an all-instrumental approach (Figs. 5.12 and 5.13).

Fig. 5.12

Polarized light microscope (PLM)

Fig. 5.13

Gas chromatograph/mass spectrometer (GC/MS)

Shown above are two examples of the different types of equipment that can be used to analyze both unconsumed explosives and explosive residues. Although both methodologies are considered conclusive, the way the data is obtained varies greatly. The PLM gives data that must be examined visually and relies on a highly trained individual to make the determination of what it means. It will conclusively identify both organic and inorganic explosives (Figs. 5.14 and 5.15).

Fig. 5.14

Organic explosives using the polarized light microscope

Fig. 5.15

Inorganic explosives using the polarized light microscope

Instrumental analysis gives a different type of data. These data types are referred to as spectral data or spectrums. This data may be in the form of infrared (heat radiation absorbance/transmittance) or data that show the actual molecular make-up of a compound such as mass spectral information. Just as with PLM, both organic and inorganic explosives can be identified (Figs. 5.16 and 5.17).

Fig. 5.16

Data in the form of infrared (heat radiation absorbance/transmittance)

Fig. 5.17

Data that show the actual molecular make-up of a compound, such as mass spectral information

5.2.2 Fire Debris Analysis

Fire debris or arson analysis has been done for years. Initially ignitable liquids were extracted from fire debris by steam distillation. As time progressed, new and more efficient methodologies were developed. Currently most labs utilize a method referred to as passive absorption/elution. This is entails placing an absorbent material sensitized to organics inside a container of fire debris. As the container temperature is raised, any ignitable liquids will volatize and be absorbed by the absorbent inside of the can. The material is then rinsed with another organic solvent that extracts any absorbed ignitable liquids out of the absorbent material. This sample can then be run by either of two methods: gas chromatography or gas chromatography/mass spectrometry. The main difference between the two techniques is the difference in the detectors that are used to identify the compounds as they elute from the gas chromatograph.

5.2.2.1 Gas Chromatography (GC)

A gas chromatograph utilizes the amount of time that a compound takes to reach the end of a column and be detected. This means that although rare, two compounds could come off of the column at the same location, and the analyst would be unable to differentiate between them. This method was the standard method of analysis back in the 1980s and is still in use in many laboratories within the United States today. Data obtained was compared with a classification system developed in the late 1970s/early 1980s by the Bureau of Alcohol, Tobacco and Firearms.

• Class 1: Light petroleum distillates. Distillates in the range of C4 (butane) to C12 (dodecane) with a major alkane peak less than C9. Examples include many cigarette lighter fluids.

• Class 2: Gasoline. All brands and grades of automotive gasoline.

• Class 3: Medium petroleum distillates. Distillates in the range C8 (octane) to C12 (dodecane). Examples include some mineral spirits and charcoal starters.

• Class 4: Kerosene. Distillates in the range of C9 (nonane) to C16 (hexadecane). Examples include home heating oils.

• Class 5: Heavy petroleum distillates. Distillates in the range of C8 (octane) to C23 (tricosane). Examples include diesel fuel.

Using GC methodology, everything was classified as a petroleum distillate. This methodology did not work well for synthetic compounds and other types of naturally occurring materials that could be used as an accelerant.

5.2.2.2 Gas Chromatography/Mass Spectroscopy (GC/MS)

If we look at the GC/MS, as it is called, the GC is being used again to separate the compounds, but the Mass Spectrometer is the detector in this case. It does more than simply look at the amount of time it takes a compound to come off the column. It causes each compound to fragment. Each compound will fragment the same basic way time after time. Because of this, we can classify the compounds by the way they fragment, making it a much more definitive type of identification (Fig. 5.18).

Fig. 5.18

Gas chromatography/mass spectrometer (GC/MS) graph

The American Society for Testing and Materials (ASTM) developed a new classification system that utilized all the information that could be obtained by GC/MS analysis. It is called ATSM 1387-95, and all ignitable liquids are separated into six classes and five subclasses as follows:

• Class 1: Light petroleum distillates. Distillates in the range of C4 (butane) to C12 (dodecane) with a major alkane peak less than C9. Examples include many cigarette lighter fluids.

• Class 2: Gasoline. All brands and grades of automotive gasoline.

• Class 3: Medium petroleum distillates. Distillates in the range C8 (octane) to C12 (dodecane). Examples include some mineral spirits and charcoal starters.

• Class 4: Kerosene. Distillates in the range of C9 (nonane) to C16 (hexadecane). Examples include home heating oils.

• Class 5: Heavy petroleum distillates. Distillates in the range of C8 (octane) to C23 (tricosane). Examples include diesel fuel.

• Class 0: Miscellaneous compounds. This class encompasses all non-distillate products except for automotive gasoline. The miscellaneous class is subdivided into five sub-classes.

  • Class 0.1: Oxygenated solvents. Single-component and blended products that contain an oxygenated component. Examples include many lacquer thinners.

  • Class 0.2: Isoparaffinic products. Products comprised solely of branched chained alkanes (isoparaffins). Examples include many odorless paint thinners and charcoal starters.

  • Class 0.3: n-Alkane products. Products comprised solely of normal alkanes. Examples include candle oils.

  • Class 0.4: Aromatic products. Products comprised of aromatic compounds. Examples include some specialty cleaning solvents and insecticide vehicles.

  • Class 0.5: Naphthenic-paraffinic products. Products comprised of cyclic and branched chained alkanes. Examples include some odorless lamp oils, charcoal starters, and specialty solvents.

This new classification system is much better and allows almost every type of ignitable liquid to be classified.

In recent times, ASTM has come up with another newer identification guideline (ASTM E 1618-01). It is as follows (Table 5.3):

Table 5.3 Newest Ignitable Liquid Classification scheme

This new classification scheme combines the original distillate scheme with the original ASTM multilevel scheme. It combines the best of each into an easily explainable format.

5.3 Reports and Court

Once the analysis is done, a report must be written no matter what type of analysis has been done or what the results. Reporting procedures vary from agency to agency. Many have a standardized form that can be used. A fire debris report may read something like the following:

• Analysis conducted on item(s) # disclosed the presence of a flammable/combustible liquid(s) from the medium petroleum distillate class (MPD) class. The following are some examples of this class: paint thinners, some types of charcoal starters, mineral spirits, and cleaning napthas.

• Analysis conducted on item(s) # disclosed the presence of a flammable/combustible liquid(s) from the miscellaneous class. This class includes isoparaffins, alcohols, terpenes/turpentine, single component solvents (benzene, pentane, xylene, etc.), and specially formulated mixtures of alkanes or aromatics.

• No flammable/combustible liquid(s) were detected in item(s) #. This does not preclude the possibility that those types of liquids were present at an earlier time.

• Analysis conducted on item(s) # was inconclusive at this time.

An explosives report may look like this:

• Results of analysis disclosed the presence of potassium nitrate on the pipe fragments.

• Potassium nitrate is a major component of gunpowder. When confined and ignited in a pipe, gunpowder will produce an explosion. This type of improvised explosive device (IED) is capable of causing serious injury and/or death.

• Results of analysis disclosed large square fragments of a galvanized 1-in. diameter pipe. Physical characteristics determined that these fragments were part of a pipe bomb filled with a low explosive/explosive compound and ignited. Some types of low explosives commonly used in IEDs are gunpowder, flashpowder, or potassium chlorate/sugar. This type of IED is capable of causing serious injury and/or death.

• Analysis on the debris did not detect the presence of an explosive/explosive residue or any fragments/components of an IED.

All of the above are merely examples how reports could read. A report must clearly state the results. It may be necessary to describe how the results were achieved, and what they actually mean. It is also very helpful to the investigator to give examples of what a class may contain, such as a MPD in arson analysis.

Once the report is generated, it may or may not have to be explained in court. Many times the report itself will be entered as evidence and the analyst who generated it will not have to testify, although this may change with the recent court rulings. In the hundreds of bombing and arson cases I have worked during the last thirty years, there have been very few times have I ever actually testified, probably in less than 25 cases. In most situations, the report is not attacked so much as is the chain of custody. However, in today’s contamination-conscious legal system, laboratory procedures are coming under more and more scrutiny.

5.4 Educational Concerns

Since the “Hollywood” effect has occurred, there have been hundreds of “forensic science” programs popping up all over the country. Most are substandard, in my opinion, and really do not offer a true forensic degree. Understand my lack of enthusiasm for these programs because very few of them have anyone involved in either developing their curriculum or even teaching the curriculum who has any real experience in forensic science. In how many other fields do those who have done, teach? Do they use interns to teach doctors? Or do they use doctors who have years of practical experience to pass their knowledge along? Those who have actually done the work should be the ones to teach the new people coming into the field. From my past experiences in education at the university level, I have found that, in most cases, those teaching the classes may be technically competent but they had no clue in solving the problems that occur when dealing with real evidentiary issues. Our educational institutions are producing technicians, not scientists any more, or at least it seems that way. A technician follows directions. A scientist searches for answers, solving problems as they occur. This has been a reoccurring discussion that many of us in forensic science have had over the last several years, which has culminated in the Forensic Science Education Programs Accreditation Commission (FEPAC).

Some of this has been brought on by the drive for standardization of crime labs and accreditation. As pointed out in the recent National Academy of Science report, this can be a good thing; however, it can also stymie efforts to produce the best possible results by creating too many roadblocks in the path of the scientist trying to do the work. Somehow, a balance must be achieved in order for forensic science to continue to flourish as it has in the past.

Appendices

Questions

• 1. An alcohol is considered:

  • (a) An oxygenated solvent

  • (b) A paraffinic product

  • (c) A distillate

  • (d) A naphthenic product

• 2. Both micro-taggants and chemical taggants have been used to help in the recovery of high explosives.

  • (a) True

  • (b) false

• 3. TWGFEX is located at

  • (a) FBI

  • (b) ATF

  • (c) NCFS

  • (d) NFSTC

• 4. The most current ignitable liquid identification/classification guideline is ASTM E 1618–01.

  • (a) True

  • (b) False

• 5. The diphenylamine color test gives a blue color as a positive reaction for:

  • (a) Sulfur

  • (b) Perchlorates

  • (c) Nitrates

  • (d) Nothing

• 6. A burn test is considered to be a Class 3 test.

  • (a) True

  • (b) False

• 7. An IR will give limited structural data.

  • (a) True

  • (b) False

• 8. How many tests must be done to identify an inorganic explosive by PLM?

  • (a) 1

  • (b) 2

  • (c) 3

  • (d) 4

• 9. Contamination can occur both at the scene as well as the lab or evidence locker.

  • (a) True

  • (b) False

• 10. More agencies offer fire debris analysis than explosive analysis.

  • (a) True

  • (b) False

About the Author

James Crippin started in 1977 and is still currently active in the field of forensic science. From August 1978 to August of 1984, Mr. Crippin served as forensic chemist with the Missouri State Highway Patrol system. In August of 1984, he was promoted to laboratory supervisor of the Saint Joseph, Missouri Troop H laboratory. During his tenure with the Missouri State Highway Patrol, Mr. Crippin was responsible for working all of the explosive incidents in the state of Missouri. Mr. Crippin resigned from the Missouri State Highway Patrol in August of 1988 and became a commissioned agent with the Colorado Bureau of Investigation.

In February of 2002, Mr. Crippin resigned from the Colorado Bureau of Investigation to form the Western Forensic Law Enforcement Training Center (WFLETC) and serve as the Director. In February of 2003, the United States Congress funded this concept as the newest crime lab in the state of Colorado. In 2007, funding ended and Mr. Crippin took WFLETC private to provide training both in this country and internationally.

Mr. Crippin is a member of or has served in office for nine different professional organizations, including the Midwestern Association of Forensic Scientists and the Southwestern Association of Forensic Scientists, and is past chairman of the Technical Working Group for Fire and Explosions. He has presented several ­briefings on terrorism and IEDs to NorthCom and NORAD and has recently been designated a National Security Asset in these areas by Northern Command. He is also part of the United States State Department Bureau of Diplomatic Security training program. Mr. Crippin has taught more than 70 classes in various areas of forensic analysis or Homeland Defense areas. Mr. Crippin has also presented 25 papers and had eight articles published in professional journals. He is currently under contract with the National Center for Forensic Science and the National Institute of Justice to help write four on-line delivery classes in Explosives Analysis, Post-Blast Investigation, and CBRNE (chemical, biological, radiological, nuclear, explosive).