-“The more outre’ and grotesque an incident is the more carefully it deserves to be examined”- Sir Arthur Conan Doyle, The Hound of the Baskervilles, (Sherlock Holmes #5)
–“You know my methods. Apply them.”- Sir Arthur Conan Doyle, The Sign of Four, (Sherlock Holmes # 2)
Forensic science is the application of multidisciplinary scientific concepts, principles and techniques to matters of the law. From ballistics and latent fingerprints to blood spatter evidence to the very cutting edge of DNA analysis, the forensic sciences have had a critical and successful role in solving even the most sophisticated and complex crimes.
In counterterrorism operations, forensics has gained an essential role in areas such as explosive event investigations, biological and chemical agent characterization, failure analysis and computer modeling, and DNA identification of victim and perpetrator remains, eg. 9/11 fatalities and Osama bin Laden’s postmortem investigation.
Evidence is something legally and procedurally submitted to a competent tribunal as a means of ascertaining the truth in an alleged matter under investigation. Forensic science generally seeks the truth by thoughtful, meticulous, systematic and purposeful collection, preservation and analysis of direct and trace physical evidence, and interfaces with corroborative evidence, such as eyewitness testimony. Eyewitness testimony, cannot be discounted, as the witness may have observed, sensed, personally seen, smelt heard, felt, or tasted-such as a witness reporting a strange-looking vapor cloud in the vicinity of downed victims or a feeling of ocular or throat irritation or violent coughing during an event. He or she may be able to describe the perpetrators or other characteristics relevant to the event. In addition, other forms of evidence may include documentary, photographic, video and/or audio evidence seized by military operators or law enforcement authorities during a raid.
The forensic investigation of any criminal event aims for identification and individualization. Forensics seeks to establish uniqueness that can be associated with a questioned piece of evidence in relation to a crime or other matter of the law. Examples of these would include the ballistics of a bullet fired from a recovered firearm, paint chips or metal fragments from an automobile connected to a vehicular homicide, or, in the case of a CBRNE event, shrapnel and residue from an IED, bodily fluids, microbiological cultures and environmental samples in bioterrorism events, air sampling and monitoring data from a venue attacked by a suspected chemical agent, collection of environmental media, e.g. vegetation, soil and dust for radiochemical analysis/isotope characterization in an RDD or IND detonation, or even a nuclear reactor accident. More conventional forensic methods and techniques, such as latent fingerprints and DNA analysis, if not destroyed by fire or other physical forces in a terrorist event, would prove to be invaluable in the criminal investigation, subsequent prosecutorial efforts, and possible retaliatory actions against foreign aggressors.
In a CBRNE event, evidence can consist of both conventional and unconventional evidentiary materials. These may include blood and explosive residue, fingerprints on a flask of an unknown, suspect liquid, Petri dishes, incubators, microbial growth media, fermentation equipment, precursor chemicals or materials, suspect powders, dissemination devices, chemical synthesis labware, shipping papers, computers and related data storage devices, technical references, PPE or a myriad of combinations.
While there is no uniform or universal, standardized definition of terrorism, per se, it has been firmly established that terrorism is a crime associated with achieving political, social and religious goals and objectives by utilizing tactical ultraviolence to coerce or influence governments and civilian populations. Political violence and terrorism generate a law enforcement and judicial response to a criminal act, and it may well instigate an international and military response against a culpable nation-state or terrorist faction.
With reasonable objectivity, we may deduce that terrorism is a crime, and that the commission of any crime creates a crime scene containing evidence that is subject to investigative strategies and tactics. Essentially, a crime scene is any area in which a crime may have been committed, as well as anywhere the criminal was during the commission of a crime and the egress from the scene. Evidentiary materials may be left or carried away from a crime scene and its ultimate value is largely dependent upon the human factor. The scientific examination of forensic evidence is only as good as the evidence that is brought to the laboratory.
Therefore, it is necessary that evidence preservation and protocols be followed in a systematic and scrupulous manner with focus and attention on factors such as tight perimeter/access control, strict adherence to chain-of custody and documentation, and preservation of the scene.
Crime scene protocols normally involve:
- Approaching the scene
- Securing and protecting the scene
- Initiation of preliminary surveys
- Evaluation of physical evidence probabilities
- Preparation of narrative script
- Photographing the scene (using intrinsically safe equipment, if a HAZMAT/CBRNE scene)
- Preparation of a scene diagram or sketch.
- Conducting a detailed search
- Recording and collecting physical evidence
- Conducting the final search
- Release of the scene
Crime scene investigation, scene management and forensic evidence collection, preservation and analysis have become essential components of CBRNE crisis and consequence management. The CBRNE operational environment is unique, dynamic and complex, and may present with multiple hazards for both responding personnel and the affected community. Specialized methods, techniques, equipment and approaches to the crime scene management and evidence collection processes of hazardous materials and CBRNE events have evolved, however, the basic principles and techniques of crime scene investigation remain the same as in more conventional contexts. The FBI has promulgated recommendations, guidelines and standards for handling contaminated and hazardous material evidence for public safety and other response personnel. For example, contaminated clothing is evidence in a CBRNE release event, and must be removed and handled as such.
During the decontamination process, clothing and other items removed from victims are considered evidentiary materials and must be collected and preserved utilizing strict adherence to chain -of-custody procedures. All such evidence must be logged in, vouchered, secured and handed off to law enforcement personnel. In terms of wound ballistics, embedded shrapnel, injury patterns, victim positions, and fatalities, the on-scene advice of law enforcement authorities, and medicolegal investigators/medical examiners should be sought. Shrapnel, bullet and other projectile damage to clothing should be cut around, not through to preserve forensic value of ballistic patterns/evidence. Fatalities must not be moved until examined and released by medicolegal and law enforcement authorities. The minimal movement of victims that are being triaged, treated and transported should be observed as much as possible, and body position and injury patterns noted and documented.
In a HAZMAT/CBRN context, fatalities will have to also be decontaminated by specialty teams. As part of our National Disaster Medical System (NDMS) in the USA, we have deployable assets, such as Disaster Mortuary Operational Response Teams (DMORTs) that can respond to conduct mass fatality operations, including forensic identification and decontamination of contaminated fatalities.
NOTE: Life safety and incident stabilization ALWAYS take precedence over evidence collection or other forensic considerations.
The attack may involve hybrid or multimodal methods, e.g. armed assault and chemical agent, so collection and documentation of firearm evidence may have to be coupled with evidence recovery involving a chemical agent. Firearm and wound ballistics cannot be overlooked in a terrorist attack utilizing hybrid methods.
In CBRNE events, specialized and hybrid entry teams are used to conduct on-site hazard characterization and assessment, close quarters tactical sweeps, render-safe operations and mitigation, meticulous evidence recovery and preservation utilizing rigid sampling/collection techniques and maintaining documentation and chain-of-custody for all representative samples and other evidence.
A thorough on scene size-up and hazard assessment must be conducted and continued during the entire operational period. This includes atmospheric and radiological surveys and monitoring. Incident Command, decontamination assets, medical, rapid extraction and rehabilitation teams and areas must be safely established uphill and upwind of the hot zone (Exclusion Zone). In practice, air sampling devices such a chemical agent detectors, radiological survey meters and Smart tickets for biodetection will be used by the sampling/evidence collection team(s), once safe entry is established .
Scene sketches and diagrams and photographic and videographic documentation of the scene using intrinsically safe equipment is essential. Regular feedback to the Incident Command Post (ICP) while the team(s) are down-range is critical.
Appropriate care must be shared by all team members in anticipating and recognition of health and safety hazards, such as secondary devices deployed to maim and kill first responders, as well as follow-on armed assault, electrical, structural and ergonomic hazards. An effective, viable evacuation plan must be available and adhered to as part of the scene size-up/pre-entry planning process. A back up entry team and rapid intervention/extraction team must be prepped and ready to react to unforeseen emergencies and contingencies.
Personnel will be required to wear appropriate PPE with sufficient respiratory protection, usually a fully-encapsulated, vapor -proof ensemble with SCBA (Level A), especially when dealing with unknown airborne hazards. When the operational environment is more adequately assessed and characterized, it may be possible to downgrade PPE with consultation of the on-scene safety officer and in concurrence with the Incident Commander. In collecting and handing over hazardous material/CBRN evidence, the outside of containers will have to be decontaminated.
In suspected bioterrorism (BT) attack scenarios, partnerships forged between law enforcement/criminal investigation assets and public health systems are absolutely crucial. Conducting a joint epidemiological and criminal investigation, done properly, will result in seamless integration of diverse, yet, similar skill sets and resources, and yield vital information essential for optimal mission outcomes.
What is learned from an epidemiological/public health investigation will be useful from a public health response viewpoint, and will also benefit on-going criminal investigative and prosecutorial efforts. In a BT event, microbial forensics techniques such as polymerase chain reaction (PCR) assays may be used to amplify the identification of microbial threat agents. The Laboratory Response Network (LRN) which commences with local and State clinical and public health laboratories form the front end and foundation of a pyramid of national laboratory capacity and capabilities leading to up to the pinnacle of national laboratories with advanced capabilities, e.g. DoD, private and academic assets. LRN assets are applicable to biotoxic/biochemical agents, e.g. ricin and chemical warfare agents, as well.
Nuclear and radiological forensics include DOE, DoD, and academic/research assets and is also incorporated into our National Response Framework (NRF), as are all CBRNE threat response capabilities, and are able to conduct radiochemical analysis, isotope signatures, nuclear yield assessment, and atmospheric transport and deposition projections.
The application of the tools of modern forensic science have taken into account the “what ifs” of CBRN and other asymmetric threats. Data derived from evidence collected, preserved and analyzed utilizing accepted protocols and meticulous technique, will serve to facilitate the successful prosecution of perpetrators, identify foreign actors, aid homeland defense and national security policymaking and enable decisions on possible pre-emptive or retaliatory actions against international aggressors and terrorist organizations willing to commit heinous acts of asymmetric ultraviolence.