A Guide for Investigating Fire and Arson

This handbook is intended as a guide to recommended practices for the collection and preservation of evidence at fire/arson scenes. [1]

Fires are destructive, spreading as they grow and consuming the evidence of their initiation. Putting out fires and finding out how they started involves public officials and private groups — such as fire departments, emergency medical services and law enforcement. Law enforcement and fire service departments must always determine the cause of the fire, whether arson or accidental, in order to identify hazards and dangerous practices and prevent future fires. Many fires can be prevented through public education — for instance, educating people on safe practices for using room heaters or other gas and electric devices.

Not every portion of this document may be applicable to all fires. It is at the discretion of responding personnel (depending on their responsibilities, as well as the purpose and scope of their duties) to apply the procedures recommended in this Guide to a particular incident. Some of the procedures described in this Guide may not be performed in the sequence described or may be performed simultaneously.

Steps in this guide include:

• Arriving at the scene.
• Evaluating the scene.
• Documenting the scene.
• Processing evidence at the scene.
• Completing the investigation.

Arriving at the Fire and/or Arson Scene

First responders to a fire scene must assess and secure the scene and ensure that victims receive medical attention.

• Observe the fire and scene conditions.
• Exercise scene safety.
• Preserve the fire scene.
• Establish security and control.
• Coordinate interagency activities.

Observe the fire and scene conditions. First responders at a fire scene must observe conditions and activities and provide investigators with an accurate and complete description.

While approaching a fire scene, first responders should observe and mentally note the following conditions and activities and initiate permanent documentation of the information (e.g., written notes, voice recordings and videotapes):

• The presence, location and condition of victims and witnesses.
• Vehicles leaving the scene, bystanders or unusual activities near the scene.
• Flame and smoke conditions (e.g., the volume of flames and smoke; the color, height and location of the flames; the direction in which the flames and smoke are moving).
• The first public safety personnel to arrive on the scene, whether they are law enforcement professionals, firefighters, or emergency medical services (EMS) personnel.
• The type of occupancy and use of the structure (e.g., a residential occupancy being used as a business).
• Conditions of the structure (e.g., lights turned on; fire through the roof; walls standing; open, closed, or broken windows and doors).
• Conditions surrounding the scene (e.g., blocked driveways, debris, damage to other structures).
• Weather conditions.
• Unusual characteristics of the scene (e.g., the presence of containers, exterior burning or charring on the building, the absence of normal contents, unusual odors, fire trailers [physical trails of fuel and the burn patterns caused by those trails]).
• The fire suppression techniques used.
• The status of fire alarms, security alarms and sprinklers.

Exercise scene safety. Safety overrides all other concerns. First responders must make sure that victims, bystanders, and public safety personnel are safe. This involves mitigating safety hazards that may further threaten victims, bystanders, and public safety personnel. They must exercise due caution to avoid injuries to themselves and others.

First responders should:

• Evaluate the scene for safety hazards (e.g., structural collapse of the building; smoke; electrical, chemical or biological hazards; other health risks).
• Establish safety/hazard zones.
• Communicate hazards to other personnel arriving at the scene.
• Use tools and personal protective equipment appropriate to the task during all operations.

DANGER:Beware of incendiary or explosive devices! The scene may contain devices specifically designed to kill or maim public safety responders. Do not touch any suspected incendiary or explosive device. Evacuate the area, and request the services of personnel trained in the removal of such items.

Preserve the fire scene. First responders must understand how rescue, medical, fire suppression, overhaul, and salvage efforts can adversely affect evidence and take steps to preserve it. They should secure the fire scene and identify potential evidence, take preliminary steps to preserve it, and notify appropriate authorities about its existence.

First responders should:

• Observe and mentally note evidence at the scene, such as:
  • Fire patterns (including multiple fire locations).
  • Burn injuries to victims and fire patterns on clothing.
  • Trailers, ignitable liquids or other unusual fuel distribution (e.g., piles of newspapers and/or furniture pushed together).
  • Incendiary/ignition/explosive devices (e.g., lighters, matches and timing devices).
  • Shoe prints and tire impressions.
  • Broken windows and doors.
  • Distribution of broken glass and debris.
  • Indications of forced entry (tools and tool marks).
  • Containers.
  • Discarded clothing.
  • Trace evidence (e.g., hairs, fibers, fingerprints, blood and other body fluids).
  • Evidence of crimes in addition to the possible arson (e.g., weapons, bodies, drugs and/or clandestine drug laboratory equipment).
  • Witnesses, bystanders and victims.
  • Any other unusual items or the absence of normal contents or structural components.
• Recognize threats to evidence (i.e., its movement, removal, contamination or destruction) from any of the following sources:
  • Fire-suppression activities that may wash away or dilute potential evidence.
  • Overhaul activities that destroy fire patterns.
  • Salvage activities that involve moving or removing physical evidence.
  • Tool use that may destroy evidence.
  • Moving knobs, switches and controls on appliances and utilities.
  • Weather conditions that affect transient evidence (i.e., wind, precipitation or temperature changes).
  • Personnel walking through the scene.
  • Witnesses and victims leaving the scene.
  • Medical intervention and treatment of victims (e.g., by damaging evidence at the scene or destroying victims' clothing).
  • Premature removal or movement of bodies.
  • Vehicles at the scene (e.g., that introduce fluid to the scene through vehicle leaks or destroy other evidence, including shoe prints and tire impressions).
  • Contamination from external sources, such as fuel-powered tools or equipment.
• Protect evidence by:
  • Limiting excessive fire suppression, overhaul and salvage.
  • Avoiding needless destruction of property.
  • Leaving bodies undisturbed.
  • Flagging items of evidence with cones or markers.
  • Recording observations through written notes or voice recordings.
  • Covering items or areas containing evidence with objects that will not contaminate the evidence (e.g., clean boxes or tarpaulins).
  • Isolating items or areas containing evidence with rope, barrier tape, barricades or sentries.
  • Retaining and securing clothing items removed from victims and suspects.
  • Obtaining information about victims and witnesses (i.e., their names, addresses and telephone numbers).
  • Preserving transient evidence (e.g., trace evidence, shoe prints and tire impressions).
  • Removing evidence if it might be destroyed by the fire or the collapse of a damaged building.
  • Telling arriving investigators about what evidence has been discovered.

Establish security and control. First responders should immediately establish control of the scene and initiate documentation of the scene.

To establish security and control, first responders should:

• Set up a security perimeter (e.g., using barrier tape).
• Control access into the scene through the security perimeter.
• Initiate documentation of the scene.

Coordinate interagency activities. First responders must coordinate emergency operations between many different agencies and organizations.

To coordinate activities at the scene, first responders should:

• Establish a command post and implement an incident command system (i.e., a point of contact and line of communication and authority for public safety personnel).
• Establish staging areas to ensure that emergency and support vehicles have access into the area.
• Request additional personnel resources, such as firefighters, EMS personnel, law enforcement officers, investigators, and representatives of utility companies.
• Inform authorities about the status of the incident, hazards, injuries, witnesses, the location of evidence, and other pertinent facts.

Evaluating the Scene

Once a lead investigator arrives at the scene to relieve the first responders, he or she should evaluate the scene, identify witnesses and survey what must be done. The lead investigator must:

• Contact first responders and establish presence.
• Define the scene's boundaries.
• Identify and interview witnesses at the scene.
• Assess scene security at the time of the fire.
• Identify the resources required to process the scene.

Contact first responders and establish presence. The investigator should meet with the incident commander and first responders to assess previous events and the current status of the fire scene, make introductions, identify essential personnel, and determine scene safety and integrity issues.

The investigator should:

• Identify and contact the current incident commander and present identification.
• Conduct a briefing with the incident commander to determine who has jurisdiction and authorization (legal right of entry) and to identify other personnel at the scene (e.g., law enforcement, firefighting, emergency medical services, hazardous materials personnel and utility services personnel).
• Determine the level of assistance required and whether additional personnel are needed.
• Determine initial scene safety prior to entry through observations and discussions with first responders. Consider environmental as well as personnel safety concerns. Assess changes in safety conditions resulting from suppression efforts.

Define the scene's boundaries. The investigator should perform a preliminary scene assessment, determine the area in which the site examination will be conducted and establish the scene perimeter.

The investigator should:

• Make a preliminary scene assessment (an overall tour of the fire scene to determine the extent of the damage, proceeding from areas of least damage to areas of greater damage) to identify areas that warrant further examination, being careful not to disturb evidence.
• Inspect and protect adjacent areas that may include nonfire evidence (e.g., bodies, bloodstains, latent prints or tool marks) or additional fire-related evidence (e.g., unsuccessful ignition sources, fuel containers and ignitable liquids).
• Mark or reevaluate the perimeter and establish the procedures for controlling access to the scene.

Identify and interview witness(es) at the scene. The investigator should determine the identities of witnesses and conduct interviews.

The investigator should:

• Contact the incident commander, identify first responders and first-in firefighters, and arrange to document their observations either in writing or through recorded interviews.
• Determine who reported the fire. Secure a tape or transcript of the report if available.
• Identify the owner of the building/scene, any occupants, and the person responsible for property management.
• Identify who was last to leave the building/scene and what occurred immediately before they left.
• Identify and interview other witnesses (e.g., neighbors and bystanders) and record their statements.

Assess scene security at the time of the fire. The investigator should determine whether the building or vehicle was intact and secure and if intrusion alarms or fire detection and suppression systems were operational at the time of the fire.

The investigator should:

• Ask first responders where an entry was made, what steps were taken to gain entry to the building or vehicle, and whether any systems had been activated when they arrived at the scene.
• Observe and document the condition of doors, windows, other openings, and fire separations (e.g., fire doors). Attempt to determine whether they were open, closed or compromised at the time of the fire.
• Observe and document the position of timers, switches, valves, and control units for utilities, detection systems, and suppression systems, as well as any alterations to those positions by first responders.
• Contact security and suppression system monitoring agencies to obtain information and available documentation about the design and function of the systems.

Identify the resources required to process the scene. The investigator should determine what personnel may be required to process the scene according to National Fire Protection Association (NFPA) 921 and other recognized national guidelines.

The investigator should:

• Identify a distinct origin (location where the fire started) and an obvious fire cause (ignition source, first fuel ignited, and circumstances of the event that brought the two together).
• If neither the origin nor the cause is immediately obvious, or if there is clear evidence of an incendiary cause, the investigator should
  • Conduct a scene examination in accordance with NFPA 921 and other guidelines.
  • Seek someone with the expertise required.
• Know when to request the assistance of specialized personnel and to obtain specialized equipment as required to assist with the investigation. Standard equipment should include the following:
  • Barrier tape.
  • Clean, unused evidence containers (e.g., cans, glass jars, nylon or polyester bags).
  • Compass.
  • Decontamination equipment (e.g., buckets, pans and detergent).
  • Evidence tags, labels and tape.
  • Gloves (disposable gloves and work gloves).
  • Handtools (e.g., hammers, screwdrivers, knives and crowbars).
  • Lights (e.g., flashlights, spotlights).
  • Marker cones or flags.
  • Personal protective equipment.
  • Photographic equipment.
  • Rakes, brooms, spades, etc.
  • Tape measures.
  • Writing equipment (e.g., notebooks, pens, pencils and permanent markers).

Note: If the scene involves arson or other crimes, the investigator must address legal requirements for scene access, search and evidence seizure.

• Recognize the interests of parties that may be affected by the outcome of the investigation and avoid jeopardizing those interests by taking steps to protect evidence. These issues include spoliation[3], subrogation[4] and third-party claims.

Documenting the Scene

After the lead investigator has evaluated the scene, he or she must document the scene. He or she should follow these steps:

• Photograph or videotape the scene.
• Describe and document the scene.

Photograph or videotape the scene. The investigator should create and preserve an accurate visual record of the scene and the evidence prior to disturbing the scene.

The investigator should:

• Photograph and/or videotape the assembled crowd and the fire in progress.
• Remove all nonessential personnel from the background when photographing the scene and evidence.
• Photograph the exterior and interior of the fire scene (consider walls, doors, windows, ceilings, floors) in a systematic and consistent manner. (Videotaping may serve as an additional record but not as a replacement for still photography.)
• Photograph any points or areas of origin, ignition sources and first material ignited.
• Photograph any physical reconstruction of the scene.
• Maintain photo and video logs. Record the date, the name of the photographer and the subject.
• Determine whether additional photographic resources are necessary (e.g., aerial photography, infrared photography or stereo photography).

Describe and document the scene. The investigator should create a permanent, documented record of observations to refresh recollections, support the investigator's opinions and conclusions, and support photographic documentation.

The investigator should:

• Prepare a narrative, written descriptions and observations, including possible fire causes.
• Sketch an accurate representation of the scene and its dimensions, including significant features such as the ceiling height, fuel packages (e.g., combustible contents of the room), doors, windows and any areas of origin.
• Prepare a detailed diagram using the scene sketch(es), preexisting diagrams, drawings, floor plans or architectural or engineering drawings of the scene. This may be done at a later date.
• Determine whether additional documentation resources are necessary.

Processing Evidence at the Scene

After documenting the scene, the investigator or other evidence collectors must collect, preserve and store evidence from the scene. He or she should follow these steps:

• Identify, collect and preserve evidence.
• Prevent evidence contamination.
• Package and transport evidence.
• Establish and maintain the chain of custody.

Identify, collect and preserve evidence. The investigator should ensure that evidence collectors identify, document, collect and preserve evidence for laboratory analyses, further investigations and court proceedings.

Evidence collectors should:

• Take precautions to prevent contamination.
• Document the location of evidence using written notes, sketches, photographs, photo and video logs, the evidence recovery log, evidence tags and container labels.
• Collect evidence in any areas where the fire originated (such as the first fuel ignited and ignition source) in cases where the fire is not accidental.
• Place evidence in labeled containers for transportation and preservation. Liquid evidence collected for laboratory identification must be immediately placed in clean, unused, vaportight containers (e.g., clean, unused paint cans; glass jars; laboratory-approved nylon or polyester bags) and then sealed.
• Label each container so that it is uniquely identified. Labeling may include the name of the investigator, date and time of collection, case number, sample number, description and location of recovery.
• Collect and preserve suitable comparison samples but recognize that such samples may be unavailable.
• Package evidence in accordance with their laboratories' policies and procedures.
• Recognize the presence of other physical evidence, such as bloodstains, shoe prints, latent prints and trace evidence, and use proper preservation and collection methods or seek qualified assistance.

Prevent evidence contamination. The investigator should control access to the fire scene after fire suppression and see that evidence is collected, stored and transported so that it will not be contaminated.

Evidence collectors should:

• Establish and maintain strict control of access to the scene.
• Recognize that fuel-powered tools and equipment present potential contamination sources and should be avoided. When collectors must use these tools and equipment, the investigator should document their use.
• Wear clean, protective outergarments, including footwear.
• Use clean disposable gloves for collecting items of evidence. (To avoid cross-contamination, gloves should be changed between collecting unrelated items of evidence or when visibly soiled.)
• Use clean or disposable tools for collecting items of evidence from different locations within a scene.
• Place evidence in clean, unused containers and seal immediately.
• Store and ship fire debris evidence containers of evidence collected from different scenes in separate packages.
• Package liquid samples to prevent leakage and ship them separately from other evidence.
• Store and ship fire debris evidence separately from other evidence.
• Follow specific laboratory requests (e.g., to submit an unused sample container).

Note: In cases of accidental fire, evidence should not be needlessly disturbed, but the property owner or insurer should be notified to avoid issues of spoliation.

Package and transport evidence. The investigator should ensure that packaging, transportation and storage procedures are followed to prevent any destructive changes in the condition of samples.

The personnel responsible for packaging and transport should:

• Take precautions to prevent contamination.
• Package fragile items carefully.
• Freeze or immediately transport items containing soil to the laboratory.
• Transport all volatile samples to the laboratory in a timely manner.
• Comply with shipping regulations.

Establish and maintain the chain of custody. The investigator should ensure that the chain of custody is maintained.

Personnel responsible for the chain of custody should:

• Maintain written records documenting the sample number, description of the evidence, date and location where it was found, collector's name and miscellaneous comments.
• Document all transfers of custody, including the name of the recipient and the date and manner of transfer.
• Document the final disposition of the evidence.

Completing the Investigation

Once evidence has been collected and processed, the investigator must complete the investigation and release the scene. He or she should follow these steps:

• Release the scene.
• Submit reports to the appropriate databases.

Release the scene. The investigator should release the scene after reasonable efforts have been made to identify, collect and remove all evidence from the scene for examination and that all physical characteristics of the scene have been documented. In addition, prior to releasing the scene, associated legal, health and safety issues must be articulated to the party taking over the investigation and reported to public safety agencies if necessary.

The investigator should ensure that the following tasks are completed before releasing the scene:

• Perform a final critical review:
  • Ensure that all evidence is inventoried and in custody.
  • Discuss preliminary scene findings with team members.
  • Discuss postscene issues including forensic testing, insurance inquiries, interview results and criminal histories.
  • Assign postscene responsibilities to law enforcement personnel and other investigators.
  • Address legal considerations.
• Verify that all scene documentation has been completed.
• Address structural, environmental, health and safety issues.
• Remove all investigative equipment and materials.
  • Recover and inventory equipment.
  • Decontaminate equipment and personnel.
• Document the following information:
  • Time and date of release.
  • Receiving party.
  • Authority releasing the scene.
  • Condition of the scene at the time of release (e.g., structural, environmental, health and safety issues). Consider photographing and/or videotaping the final condition of the scene.
  • Cautions given to the receiving party upon release (e.g., safety concerns, conditions, evidence, legal issues).

Submit reports to the appropriate databases. The responsible agencies must file incident reports with the appropriate databases. Detailed fire information is collected, integrated and disseminated through national and State databases. These data help authorities identify fire trends and develop innovative procedures and equipment.

The investigator should collect sufficient information and report it to the following databases:

• Arson and Explosives National Repository (Bureau of Alcohol, Tobacco and Firearms).
• Bomb Data Center (Federal Bureau of Investigation).
• National Fire Incident Reporting System (U.S. Fire Administration).
• National Incident-Based Reporting System (Federal Bureau of Investigation).
• State and local fire incident reporting systems.