English
A fire investigator searching the scene of a fire.
Arson forensics (also known as fire investigation) is the application of science to the investigation of arson. Arson forensics aims to determine the origin and cause of a fire and, if it is suspected to be arson, to gather evidence that could help identify the potential arsonists.
An adversary can usually easily determine whether a fire was accidental or arson. It is difficult to carry out an arson and make it appear accidental to an adversary who is knowledgeable in arson forensics.
Fire scene investigation is the inspection of the scene of a fire, looking for:
- The ignition source that started the fire and the fuel that source ignited. For example, in an accidental residential fire the ignition source may be a malfunctioning electrical outlet that overheats and the fuel may be a sofa positioned against the outlet. In an arson the ignition source may be a match and the fuel may be gasoline brought by the arsonist.
- Patterns left by the fire on walls, floors, ceilings, and objects. These patterns can indicate where the fire started and how it spread. For example, a fire that starts at the base of a wall may leave a distinctive V-shaped burn pattern on the wall.
- Eyewitness accounts and video surveillance footage of the scene of the fire before, during, and after the fire.
When a fire occurring inside a room reaches a high enough temperature — typically between 500°C and 600°C — it reaches the flashover point. During flashover, the room is so hot that all ignitable surfaces ignite more or less simultaneously and the fire spreads rapidly throughout the room. Once a fire has reached flashover it is usually significantly harder for the adversary to interpret the patterns it left on walls and other surfaces.
Fire debris analysis is the collection and analysis of fire debris — objects that burned in a fire. An adversary can collect samples of fire debris at the scene of the fire and analyze them in a laboratory to find traces called ignitable liquid residues (ILRs), which are left when accelerants (also known as ignitable liquids) burn. An adversary can use detection dogs to locate ILRs at the scene of the fire, facilitating the collection of samples of fire debris that are likely to contain ILRs.
An adversary can analyze a sample of fire debris to determine:
- The presence of ILRs in the sample. This can indicate that the fire was arson rather than accidental and that the fire originated where the sample was collected.
- The type of accelerant that left the ILRs in the sample: gasoline, diesel fuel, kerosene, etc.
An accelerant can have a more or less unique chemical composition depending on how it was produced, transported and stored. Let's take the example of gasoline, an accelerant made from refined crude oil. The chemical composition of gasoline sold at a gas station depends on:
- Where and how the crude oil was extracted.
- How the crude oil was refined.
- What chemicals were blended to make the gasoline.
- What additives were added to the gasoline. Additives can depend on the brand of gasoline, although a given brand can also use different additives depending on the region and the time of year.
- The chemical composition of the accelerant remaining at the bottom of the gas station's fuel tank when it was last refilled.[1]
An adversary can compare the chemical compositions of two samples of accelerant to determine the likelihood that they come from the same source. They can compare:
- An accelerant to an accelerant. This type of comparison is more precise. For example, they can compare a bottle of gasoline found unignited at the scene of a fire to gasoline found stored in a suspect's home.
- ILRs to an accelerant. This type of comparison is less precise. For example, they can compare ILRs from fire debris found at the scene of a fire to a sample of gasoline from a gas station.
If an adversary wants to know the source of a sample of accelerant — that we'll call the questioned sample — but does not have any particular leads, they have two options:
- They can collect a large number of potentially matching samples and compare them to the questioned sample. For example, they can collect gasoline samples from all gas stations in an area and compare them to a bottle of gasoline found unignited at the scene of a fire. State adversaries do not regularly do this.[2]
- If they have access to an accelerant database — a database of samples of accelerants collected regularly in a given region — they can compare the questioned sample to all the samples in the database. For example, if the questioned sample is a bottle of gasoline found unignited at the scene of a fire, they could identify the brand of gasoline (if samples are collected from refineries whenever a batch of gasoline is produced for a given brand) or the gas station where it was bought (if samples are collected from gas stations whenever their fuel tanks are refilled). It is unknown if any State adversaries have access to such databases.[3]
An incendiary device is an arrangement of items or materials that is designed to be left at the scene of a fire in order to help start, accelerate, spread, or delay the fire. Incendiary devices range from simple Molotov cocktails to complex time-delay devices with electronic timers.
Since incendiary devices are designed to be left at the scene of a fire, an adversary can recover their burned remains and analyze them to find evidence that could help identify the arsonists. It is relatively common for incendiary devices to fail — whether they fail to ignite or ignite but burn significantly less than expected — in which case an adversary can recover the devices intact or partially intact and potentially find much more evidence than if the devices had not failed.
Incendiary devices can fail because of:
- An inherent flaw in the construction or use of the device. For example, Molotov cocktails typically have a high failure rate because they often either do not break upon contact with their target, or break but fail to sufficiently ignite their target.
- Rough handling of the device during construction, transport, or installation. This rough handling can be caused by stress, darkness, or inexperience.
- Weather conditions during storage of the device (between its construction and use), particularly if it includes moisture-sensitive components.
- Weather conditions at the scene of the fire: wind, dew, fog, and rain.
When analyzing an incendiary device or its burned or partially burned remains, an adversary can analyze:
- Accelerants contained in the device, or ILRs left on the device.
- DNA traces and fingerprints left while handling the device components. The extent to which high temperatures destroy DNA traces depends on the temperature and on how the DNA traces were left.[4]
- Tool marks left when constructing the device.
- Identifiers visible on the device components such as serial numbers or barcodes.
- Glass traces, if the device includes glass components.
- Details of the device's construction, including the use of tape and glue and how components are wired, welded, or knotted together.
See “Incendiary Devices: Investigation and Analysis ?This is a link to the Surveillance Archive. Use Tor Browser to access it.”, chapter “The Analysis of Incendiary Devices” for a detailed overview of the investigation of incendiary devices.
Used in tactics: Incrimination
Mitigations
| Name | Description |
|---|---|
| Anonymous purchases | An adversary can link accelerants and incendiary device components to where they were purchased, and from there to the identity of the person who purchased them. To mitigate this, you can purchase accelerants[5] and device components anonymously. |
| Careful action planning | If you use an incendiary device in an action and the device fails, an adversary can recover the device intact or partially intact and potentially find much more evidence than if the device had not failed. To mitigate this, you can:
If you use accelerant in an action and an adversary goes through the effort of collecting accelerant samples for comparison (e.g. gasoline samples from gas stations), they could identify the source of the accelerant you used. To mitigate this, you can:
|
Used in repressive operations
| Name | Description |
|---|---|
| Case against Louna | A gas detector[6] was unsuccessfully used to detect traces of accelerant in the cab of the burned excavator.[7] Traces of accelerant were collected:
Traces of accelerant were unsuccessfully searched for on Louna's clothes, seized at the hospital while she was hospitalized. |
| Repression of the first Jane's Revenge arson | DNA traces were collected from an intact Molotov cocktail found by investigators at the action site.[8] |
| Bure criminal association case | Traces of accelerants were collected from items recovered after demonstrations and analyzed.[7] |
| Mauvaises intentions | DNA traces were collected from a cigarette used as a delay for an incendiary device — the delay failed and the device was found intact under the police tow truck.[9] |
Gas station fuel tanks are typically refilled every few days, or every few weeks at stations with fewer customers.
According to a 2023 study from the United States, this is “not common practice in forensic casework.”
A 2020 study from the Netherlands briefly mentions “a database of gasoline collected nationally.”
Research on the topic is scarce, but we found two relevant studies:
- A 2017 study examined the recovery of DNA profiles from blood after exposure to heat. The study found that complete DNA profiles could be recovered even after exposure to 1000°C for a very brief duration.
- A 2019 study examined the recovery of DNA profiles from DNA traces left on various surfaces through brief skin contact. Several volunteers left DNA traces on paper, glass, and metal surfaces by touching the surfaces with their fingers for 10 seconds. The surfaces were then heated at temperatures ranging from 50°C to 300°C. The study found that complete DNA profiles could be recovered after heating at 50°C and 90°C, partial profiles at 110°C and 150°C, but no profiles at 200°C and 300°C.
If it is too difficult to purchase accelerants anonymously in your context (e.g. because it is too suspicious to buy gasoline from a gas station without arriving in a car), you can prefer to purchase them non-anonymously, and mitigate this technique in other ways.
Private source.