Forensics: Arson

Contents

A fire investigator searching the scene of a fire.

Arson forensics (also known as fire investigation) is the application of science to the investigation of arson. Arson forensics aims to determine the origin and cause of a fire and, if it is suspected to be arson, to gather evidence that could help identify the potential arsonists.

An adversary can usually easily determine whether a fire was accidental or arson. It is difficult to carry out an arson and make it appear accidental to an adversary who is knowledgeable in arson forensics.

Fire scene investigation

Fire scene investigation is the inspection of the scene of a fire, looking for:

When a fire occurring inside a room reaches a high enough temperature — typically between 500°C and 600°C — it reaches the flashover point. During flashover, the room is so hot that all ignitable surfaces ignite more or less simultaneously and the fire spreads rapidly throughout the room. Once a fire has reached flashover it is usually significantly harder for the adversary to interpret the patterns it left on walls and other surfaces.

Fire debris analysis

Fire debris analysis is the collection and analysis of fire debris — objects that burned in a fire. An adversary can collect samples of fire debris at the scene of the fire and analyze them in a laboratory to find traces called ignitable liquid residues (ILRs), which are left when accelerants (also known as ignitable liquids) burn. An adversary can use detection dogs to locate ILRs at the scene of the fire, facilitating the collection of samples of fire debris that are likely to contain ILRs.

An adversary can analyze a sample of fire debris to determine:

Accelerant comparison

An accelerant can have a more or less unique chemical composition depending on how it was produced, transported and stored. Let's take the example of gasoline, an accelerant made from refined crude oil. The chemical composition of gasoline sold at a gas station depends on:

An adversary can compare the chemical compositions of two samples of accelerant to determine the likelihood that they come from the same source. They can compare:

If an adversary wants to know the source of a sample of accelerant — that we'll call the questioned sample — but does not have any particular leads, they have two options:

Incendiary devices

An incendiary device is an arrangement of items or materials that is designed to be left at the scene of a fire in order to help start, accelerate, spread, or delay the fire. Incendiary devices range from simple Molotov cocktails to complex time-delay devices with electronic timers.

Since incendiary devices are designed to be left at the scene of a fire, an adversary can recover their burned remains and analyze them to find evidence that could help identify the arsonists. It is relatively common for incendiary devices to fail — whether they fail to ignite or ignite but burn significantly less than expected — in which case an adversary can recover the devices intact or partially intact and potentially find much more evidence than if the devices had not failed.

Incendiary devices can fail because of:

When analyzing an incendiary device or its burned or partially burned remains, an adversary can analyze:

See “Incendiary Devices: Investigation and Analysis ?This is a link to the Surveillance Archive. Use Tor Browser to access it.”, chapter “The Analysis of Incendiary Devices” for a detailed overview of the investigation of incendiary devices.

Used in tactics: Incrimination

Mitigations

NameDescription
Anonymous purchases

An adversary can link accelerants and incendiary device components to where they were purchased, and from there to the identity of the person who purchased them. To mitigate this, you can purchase accelerants[5] and device components anonymously.

Careful action planning

If you use an incendiary device in an action and the device fails, an adversary can recover the device intact or partially intact and potentially find much more evidence than if the device had not failed. To mitigate this, you can:

  • Make and use several test devices similar to the “real” device you will use in the action. You should conduct the tests with good security precautions because conducting such tests can be incriminating. In particular, you can:
    • Construct test devices with components of the same brand and model as the components you will use for the real device.
    • Store test devices in the same conditions (e.g. humidity) as the real device, and for the same length of time.
    • Transport test devices in the same way as the real device.
    • Install test devices in the same conditions as the real device (weather, temperature, darkness, etc.)
  • Ensure that you will be able to construct, transport, and install the device under the psychological conditions of the action (e.g. stress).

If you use accelerant in an action and an adversary goes through the effort of collecting accelerant samples for comparison (e.g. gasoline samples from gas stations), they could identify the source of the accelerant you used. To mitigate this, you can:

  • Make the identification less likely to be effective by using a mix of accelerants of the same type coming from different sources (e.g. gasoline from different gas stations).
  • Make the identification even less likely to be effective by using a mix of accelerants of the same type from sources located in different areas (so that the chemical compositions of the accelerants are more distinct) and let some time pass between when you obtain the accelerants and when you use them (so that the adversary cannot retroactively obtain the samples they would need for comparison because the fuel tanks of the gas stations where you obtained the accelerants have been refilled).

Used in repressive operations

NameDescription
Case against Louna

A gas detector[6] was unsuccessfully used to detect traces of accelerant in the cab of the burned excavator.[7]

Traces of accelerant were collected:

  • On a torch — a piece of wood tipped with a cloth soaked in flammable liquid — found near the burned excavator.
  • Inside the burned excavator.

Traces of accelerant were unsuccessfully searched for on Louna's clothes, seized at the hospital while she was hospitalized.

Repression of the first Jane's Revenge arson

DNA traces were collected from an intact Molotov cocktail found by investigators at the action site.[8]

Bure criminal association case

Traces of accelerants were collected from items recovered after demonstrations and analyzed.[7]

Mauvaises intentions

DNA traces were collected from a cigarette used as a delay for an incendiary device — the delay failed and the device was found intact under the police tow truck.[9]


1. 

Gas station fuel tanks are typically refilled every few days, or every few weeks at stations with fewer customers.

2. 

According to a 2023 study from the United States, this is “not common practice in forensic casework.”

3. 

A 2020 study from the Netherlands briefly mentions “a database of gasoline collected nationally.”

4. 

Research on the topic is scarce, but we found two relevant studies:

  • A 2017 study examined the recovery of DNA profiles from blood after exposure to heat. The study found that complete DNA profiles could be recovered even after heating at 1000°C.
  • A 2019 study examined the recovery of DNA profiles from DNA traces left on various surfaces through brief skin contact. Several volunteers left DNA traces on paper, glass, and metal surfaces by touching the surfaces with their fingers for 10 seconds. The surfaces were then heated at temperatures ranging from 50°C to 300°C. The study found that complete DNA profiles could be recovered after heating at 50°C and 90°C, partial profiles at 110°C and 150°C, but no profiles at 200°C and 300°C.
5. 

If it is too difficult to purchase accelerants anonymously in your context (e.g. because it is too suspicious to buy gasoline from a gas station without arriving in a car), you can prefer to purchase them non-anonymously, and mitigate this technique in other ways.

7. 

Private source.