For nonlaw enforcement responders, evidence collection might seem easy. However, collecting evidence correctly is quite a daunting task. One confusing issue concerns sampling for risk assessment vs. the collection of evidence. The risk-assessment process is very different from collecting evidence, and using an improper risk-assessment process can destroy all of the evidence. Fire investigators are used to collecting evidence at fire scenes and generally are well trained and equipped to handle that task. The collection of evidence in a weapons of mass destruction (WMD) event can be very different; following the same procedures as in an arson investigation could result in complications.
This article is an overview of, not a complete guide to, the WMD evidence-collection process. The Federal Bureau of Investigation (FBI) has jurisdiction in any WMD or terrorism investigation and is the lead agency in the collection of evidence related to these types of cases. To proceed in a terrorism investigation and collect evidence without consulting with your local field office often results in an investigation that is headed for courtroom disaster. In any case, when there is a credible terrorism event, the FBI should be the agency collecting or at least directing the collection of evidence. Recent history with the Oklahoma City bombing and the events of 9/11 in New York; Washington, D.C.; and Shanksville, Pa., has shown that law enforcement directed firefighters and other emergency responders to collect a significant amount of evidence. During the thousands of white powder events in the United States, a considerable number of samples were collected. Although responders followed some rules of evidence collection and often followed law enforcement’s lead, evidence was not properly collected in many cases. If we are forced to collect evidence at future events, we must follow standard methods that will allow for the successful prosecution of the bad guy.
null
Many responders wish to obtain more training in evidence collection. This can prove to be a problem; there are several reasons that support firefighters’ not collecting evidence:
- The FBI is the statutory agency responsible for this task and has considerable resources dedicated to the collection of evidence.
- Evidence collection requires substantial hands-on training and specialized equipment, which includes very specific policies and procedures.
- Collecting evidence in a terrorism case has many facets, and the FBI uses specialists for many of these areas.
Among other areas of concern are trace evidence, fingerprints, hair and fibers, blood spatter, and DNA. Most responders think of evidence only as some potential chemical or biological material they can collect and send off to the laboratory. Evidence collection has many parts (see “The Millennium Border Bomb Case”). One small piece of evidence in that case proved to be the crucial link in that crime. Conversely, there are those who consider evidence collection awareness training important for responders so they’ll be aware of the procedures if they need to collect evidence during an incident. Such was the case with the white powder events that overwhelmed federal resources. In my mind, I have settled on this evidence-awareness training theme that would teach responders to collect evidence in extreme cases or to assist federal agencies in certain situations. Even with significant resources, the FBI sometimes relies on local responders, such as local haz-mat team members, to assist in the WMD evidence-collection process.
 (2) Part of the haz-mat process is decontaminating responders. When collecting evidence, consideration must be given to handling the evidence coming from the hazard area. |
null
null
EVIDENCE-COLLECTION CONCEPTS
Several important concepts should be reviewed to understand the evidence-collection process. The most important concept is to take a hazardous crime scene and make it an ordinary crime scene by removing the hazards. If there is chemically contaminated evidence within a room or building, one of the overall strategic goals should be to eliminate the chemical hazard. Evidence within a hazardous environment requires special equipment, protective clothing, training, and other resources in addition to standard evidence-collection tools. Collecting evidence in a nonhazardous environment requires only standard evidence-collection training and equipment.
Remember that the prosecuting attorneys will use the collected evidence to prove guilt and convict the accused, and the defense attorneys will be looking for any tactic available to clear their client of charges. Having any evidence tossed out of the court proceeding can help their clients. They’ll use any chance they have to discredit evidence or investigators in an effort to help their clients. In the case of a jury trial, the defense needs only to create an impression that the evidence is tainted, was collected improperly, or was planted at the crime scene to clear the clients of charges.
 (4) All evidence should be screened for fire, corrosive, toxic, and radiation hazards so hazards are not moved from the crime scene to the laboratory. |
null
 (5) The evidence-collection process is a group effort, and many agencies may need to be involved. An incident management system and a collaborative evidence-collection plan are good starting points. |
null
Chain of custody is also an important concept. Every piece of evidence must be tracked, as must every operation performed at the crime scene. A sample’s accompanying paperwork identifies who collected it, where it was collected, the time, the date, and case-identifying information. As investigators pass evidence to other departments, the transfer must be documented, with each person signing off on the transfer. At no point should the evidence be left unattended or unsecured. If the defense attorney can find reasons to support allegations that the evidence has been tampered with or that the collection process is suspect, there may be an opportunity to convince the jury that his client is being framed.
There is a difference between collecting a sample and collecting evidence. When collecting something as evidence, it must be a clean catch and not handled by anyone or have a chance of becoming contaminated. It is collected using clean techniques and is placed into a clean container. At no point during the collection process should there be any question of cross-contamination.
A sample, on the other hand, can be handled, tested, and examined. The results of this sampling are not considered evidence but are used to provide assistance for responder safety and to protect the public. Officials use these samples to determine if the material presents a fire, corrosive, toxic, or radiation hazard. The issue of what is evidence and what is not comes under intense scrutiny in the courtroom. Everything you do, everything you write, and all of your records become discoverable. Discovery is the legal process where both sides present the evidence they’ll use in the case and collected evidence they don’t intend to use. Both sides have an opportunity to obtain additional information or evidence related to the case. The sampling results record is usually not entered into evidence, but the defense attorney can request these records during the discovery process.
Mistakes should be minimized when collecting evidence. If you make a mistake, document it fully, and have a logical explanation for the mistake. If you try to cover up a mistake or think that no one will pick up on it, you would be very surprised when you are on the witness stand and the defense attorney uses the information to attack your credibility. As soon as a mistake is discovered, make sure it is documented and that the person responsible for the evidence is aware of the mistake.
One of the more difficult aspects of evidence collection is the need for specialized equipment. The equipment used to collect evidence in a federal prosecution is much different from that used in an arson investigation. For a terrorism investigation, the equipment must meet certain criteria and must be maintained with safeguards to ensure its integrity. Equipment used to collect the WMD evidence must be certified as being clean. Containers used to collect potential biological materials must also be sterile. Grabbing a sample with any jar from the haz-mat unit is not adequate for a federal prosecution. The jar must come from a sealed package of jars and from a batch of certified clean containers. Certified clean containers come with a letter of certification, which must stay with the evidence as it moves from location to location. If only a single jar from a whole case of jars is used, the remaining containers may be used for training. In some jurisdictions, the certification letter can be photocopied and placed inside the box. The box should be sealed with tamper-resistant tape, allowing the remaining containers to be used at another event. Any device used to pick up, collect, or move the evidence must also be certified as clean. Items such as spoons, spatulas, scoops, and syringes all come in individually wrapped packages and in some cases are bar coded for easy tracking.
EVIDENCE-COLLECTION PROCESS
Collecting evidence in a hazardous environment complicates the incident management process. Typically, the evidence-collection responsibility is an add-on to the haz-mat portion of the command structure. Managing a crime scene is similar to managing a haz-mat incident in structure and process. In the law enforcement community, persons who collect evidence are sometimes part of an evidence recovery team (ERT), crime lab technicians, or crime scene investigators. Within the group of persons who need to collect evidence, there are several functional areas that fit in the command structure. The first is the team leader, also called the “evidence team leader” to minimize confusion. There are also a number of people assigned to document the crime scene, including the photographer, the photographic log recorder, and an individual to sketch preparers’ positions.
Evidence custodian is one of the more complex positions. This person prepares all of the containers, labels, and tracking mechanisms for the entry team to collect the evidence; prepares an evidence recovery plan with the evidence team; and ensures that everything is documented and tracked. Depending on the event’s size and scope, additional persons may be assigned to assist with these positions. Also included in the evidence-recovery process are the evidence recovery team members and other specialists who may be able to assist at unique or difficult crime scenes.
null
The tasks that need to be accomplished at a crime scene are the following:
- On-scene preparation,
- Approach the scene,
- Initiate a preliminary survey,
- Evaluate physical evidence possibilities,
- Prepare a narrative description,
- Photograph the scene,
- Sketch the scene,
- Conduct a detailed search,
- Record and collect physical evidence,
- Conduct a physical survey, and
- Release the scene.
If the evidence is within a hazardous environment, standard haz-mat processes apply, and the above functions become part of the haz-mat portion of incident management. Collecting evidence is not a quick operation and can take considerable time, effort, and personnel to accomplish. Time is generally on the side of the investigators, and emphasis should be placed on safely collecting the evidence and collecting it properly.
“CLEAN PERSON/DIRTY PERSON”
The specific concept or process to physically pick up evidence is known as the “clean person/dirty person concept.” Any time evidence is collected in a potential terrorism incident, more than one person should be involved in the process. One person, the “dirty person,” physically handles the evidence. The “clean person” does not touch or handle evidence until after it has been packaged into a clean container or package. The clean person handles only the clean materials and keeps track of the evidence processing. The clean person should never come in contact with the evidence or other items in the area. Depending on the situation, more than two people should perform the physical collection. Keep in mind, though, that having too many people sometimes complicates the situation.
Ensuring there is no cross-contamination when collecting evidence is a challenge. Collecting a new piece of evidence requires a new set of tools, and the dirty person requires a new pair of overgloves.
Another part of the clean person/dirty person concept is handling the equipment. The clean person should establish a clean work area, which is usually some type of clean mat. On the mat would be the various tools and containers needed to collect the evidence. The containers should be marked with a case-identifying number and the date. When the material is in the container, the collecting person’s initials and time should be added to the container. With both team members wearing a clean set of gloves, the clean person would hand the dirty person a tool to collect the evidence and an open container. The dirty person will then collect the material and place it in the container. The clean person will hand over the lid to the container without coming in contact with the dirty person or the material. The dirty person will cap the container and will usually seal it to prevent the cap from coming loose. The clean person will hold some type of overpack container, and the dirty person will place the evidence into this overpack material. The clean person seals the overpack container. If this is the only piece of evidence being collected, then a tamper-resistant seal can be placed around the lid. When collecting a larger amount of evidence, the evidence can be placed into a larger container that can be sealed by the evidence custodian. The rules and procedures for this action vary from jurisdiction to jurisdiction. The requirements to be clean and for the equipment to be certified are cumbersome but necessary.
FIELD SCREENING
All chemical or biological evidence needs to be screened before it is sent to the laboratory. The basic field-screening process is to screen the material for fire, corrosive, toxic, and radiation hazards. Field screening is essential to ensuring that the transfer and processing of the evidence are safe for all involved. The laboratory doesn’t like surprises any more than we do on the crime scene, not to mention the hazards of transporting dangerous materials. To perform field screening, the integrity of the evidence must remain intact. Do not perform physical testing of the material collected for evidence. You can perform most field screening without coming in contact with the material by using air monitors. The testing does not need to be extensive. It would include using a lower explosive limit (LEL) sensor to determine if the material is flammable, using a photoionization detector (PID) to look for toxic vapors coming from the material, and using a radiation monitor to determine if the material has any radiological aspects. The corrosive test involves contact with the material. You can hold a piece of pH paper over the material to check for corrosive vapors without allowing the paper to touch the material. You can perform the corrosive test in two ways: You can separate some of the material from the original pile and test it from the pile or, preferably, you can place the material in another container and test it there. All field-screening tests can be done with this container. This material is not sent off for laboratory analysis as it is not evidence, but it is discoverable and needs to be kept.
Field screening is vitally important and essential to ensure the safety of everyone involved in the investigation. Whenever evidence is sent off to a laboratory, it should be field screened. A notation on the package that the evidence has been field screened is important, as it makes those involved aware of any potential hazards. If you find that the evidence presents a fire, corrosive, toxic, or radiation hazard, then alerting all those involved will simplify the evidence transfer.
DOCUMENTATION
The following documents are commonly used to process a crime scene:
- Evidence and custody log: The evidence log is written documentation as to when, where, and who collected the evidence. Accompanying this log or part of the log will be the chain of custody forms, which track the movement of the evidence. The evidence logs as well as all of the corresponding forms should all relate to each other, and the identifying numbers should match.
- Administrative log: The administrative log provides a narrative description of the evidence-collection process. It documents all aspects of the process and details the operation.
- Photo log: The photo log keeps track of all of the photographs. Every photograph needs to be documented on this form; therefore, when photographing evidence, it is important to track the number of the photograph, evidence number, photographer, time, date, and the location.
- Site management (entry) log: The site management form (or entry form) provides a detailed listing of who went into the crime scene and the time they went in and the time they came out. The form could also include other site-management items such as additional responder information, command setup, and other management-type issues.
- Plan of action: This includes the who, where, when, and what of the evidence-collection process.
- Site safety plan: When dealing with hazardous situations, such as collecting hazardous evidence, a site safety plan that is the same as a haz-mat site safety plan is required.
Some responders do not include extensive detail in their incident reports, which could lead to trouble when in court. Some of these cases may take several years to come to trial. Without documentation, it is likely that those aspects of the case may never see the courtroom.
PHOTOGRAPHS
All photographs must be noted and logged in a photographic log. Sometimes the photographer makes the notes or someone assists with this task. It is up to your local court system, but digital photographs are not admissible in court in many cases. Some courts allow their use as long as there is a system in place to prevent tampering. It is important to remember not to photograph the investigators and to make sure you do not photograph the sampling or collection process. Extreme documentation of the crime scene is important, but keep as many people out of the pictures as possible. If for some reason you did photograph an investigator during the evidence-collection process, the defense attorney may have an opportunity to question the evidence- collection process.
Many firefighters like to take personal photographs at incident sites. Since they are of the crime scene and evidence-collection process and were taken during the performance of your official duties, they are discoverable by the defense attorney. The defense has a right to view these photographs and, if they have evidentiary value, they can be used against you in court. Always be careful with what photographs firefighters take. If the incident is a crime scene, responders should refrain from taking any photographs unless they want them to show up in court.
The evidence-collection process is complicated and has a broad margin for error. If your department responds to an event requiring evidence collection, it is of the utmost importance that you contact your local FBI WMD coordinator, who can provide advice, assistance, and technical support. He should be an important partner in any incident where evidence needs to be collected.
This article only scratches the surface of the evidence collection process and focuses on the areas in which the fire service may need to assist a law enforcement agency. The time to discuss evidence collection in a hazardous environment is before an incident occurs. One method of handling hazardous-evidence issues is to provide basic training to the personnel who normally handle evidence. The haz-mat team or fire service can assist with risk assessment and personal safety oversight. Having all agencies on the same page and working together is crucial to the end point, which is a successful prosecution of the bad guy.
CHRISTOPHER HAWLEY, a 22-year of the fire service and a haz-mat responder for 15 years, is a project manager for Computer Science Corporation and is responsible for international WMD and haz-mat training provided for the DoD-DTRA International Counterproliferation Program. He is a retired fire specialist with the Baltimore County (MD) Fire Department, where he was the special operations coordinator. He is the author of a number of texts including Hazardous Materials Incidents and Air Monitoring & Detection Devices (Delmar Publishers, 2004). He is the co-author, with Greg Noll and Mike Hildebrand, of Special Operations: Response to Terrorism and HazMat Crimes (Delmar Publishers, 2001). Hawley is the owner of FBN Training & Consulting, a company that provides emergency response training worldwide.
THE MILLENNIUM BORDER BOMB CASE
The importance of properly collecting evidence is highlighted by this important al-Qaeda case. Ahmed Ressam, from Algeria, was arrested in December 1999 just before the Millennium. He was crossing into the United States from Canada at Port Angeles, Washington, about an hour north of Seattle. His car was stopped at the border, and he took off running when customs officers began to search his vehicle. He was caught several hours later. During the search of his vehicle, they found the makings of a serious explosive device. He had more than 1,000 pounds of urea, a fertilizer that can be used to make explosives. He also had timers and other chemicals in the trunk of his car. Also in the vehicle were maps of Seattle and California. Officials suspect his target was the Seattle Space Needle, LAX airport, or Disneyland. They also thought that he would wait until New Year’s Eve to detonate up to four bombs.
Although he was caught with considerable evidence that would link him to some sort of future crime, Ressam maintained his innocence, claimed he was only the driver of the car and that he did not know anything about the bomb components. He continued with this claim until one crucial bit of evidence was introduced that could be associated only with Ressam. He was successfully convicted and started cooperating with federal agents on many other cases.
The major lesson here is that investigators found a very small amount of trace evidence among the many items in his trunk, some of which would usually be considered trash. This valuable evidence could have been discarded by someone not trained in trace-evidence collection. Ressam claimed he had nothing to do with the bomb components. Without this evidence, he might have walked. But, with the evidence found, we know he was actively involved with the making of the bomb. In many cases, firefighters would not think twice about many of the items that could contain trace evidence if they were assisting with the collection of the other hazardous chemical evidence located in the car trunk. Even if identified as possibly holding trace evidence, it could be thought of as waste material or as material that was not handled appropriately.
Luckily for the United States, the hazardous-materials-trained evidence collection team handled it appropriately, and the trace evidence was recovered and was the smoking gun in the conviction. Ressam gave federal authorities key information about the al-Qaeda network, other plots, and other terrorists. Although convicted and in jail, he continues to provide vital information. One small piece of evidence that could have been easily lost was the crucial link to preventing one terrorism event and possibly several other events.
