BOMB INVESTIGATIONSBOMB INVESTIGATIONSAlex B. Yanquiling Jr., Ph.D. FBINA 217Alex B. Yanquiling Jr., Ph.D. FBINA 217

SECTION I The Bomb Incident InvestigatorSECTION II BOMBS Weapons of the

Criminal Offender SECTION III The Bomb Incident

InvestigationSECTION IV Laboratory Examinations

The Bomb Incident The Bomb Incident InvestigatorInvestigator

“The Investigation of a bomb incident is not a new situation for the experienced investigator. The basics remains the same and only a few unique features require consideration. The purpose of this presentation is to provide an investigative outline of the tasks that should be considered at every explosion scene. To ensure that proper procedures are used to locate, identify, collect and preserve valuable evidence so that it can be examined to produce the most useful and effective information.”

Sherlock Holmes, the master of Sherlock Holmes, the master of detectives, considered it essential to detectives, considered it essential to be excruciatingly disciplined in his be excruciatingly disciplined in his approach to looking for evidence at a approach to looking for evidence at a crime scene. While it is imperative crime scene. While it is imperative that all investigators apply discipline that all investigators apply discipline in their search for evidence, in their search for evidence, it is it is apparent that few do so in the apparent that few do so in the same way.same way.

Successful bomb investigations rely more Successful bomb investigations rely more on investigative expertise than on on investigative expertise than on expertise which is concerned with the expertise which is concerned with the technical aspects of a bomb.technical aspects of a bomb.

The Police objective is the detection of the The Police objective is the detection of the violations of law, and the gathering of physical violations of law, and the gathering of physical or trace evidence to identify and successfully or trace evidence to identify and successfully prosecute the responsible individual (s). Often prosecute the responsible individual (s). Often investigators are unsuccessful in their efforts investigators are unsuccessful in their efforts because they lack experience with such because they lack experience with such cases,and are affected by the technical aspects cases,and are affected by the technical aspects of the device or magnitude of the damage done of the device or magnitude of the damage done by a bomb by a bomb

““Bomb related investigations are Bomb related investigations are undoubtedly more time consuming undoubtedly more time consuming and challenging than many other and challenging than many other investigations; however, there is no investigations; however, there is no reason to conclude that success is reason to conclude that success is impossible. The principal requisite for impossible. The principal requisite for the desired results is simply a the desired results is simply a concerted and disciplined effort” concerted and disciplined effort”

““To understand a crime involving the To understand a crime involving the use of a bomb, the investigator use of a bomb, the investigator should consider the bomb to be an should consider the bomb to be an instrument of the criminal offense or instrument of the criminal offense or simply an illegal weapon used in the simply an illegal weapon used in the commission of a crime”commission of a crime”

The bomb technician is chiefly The bomb technician is chiefly concerned with the nature and functioning concerned with the nature and functioning of the device. The investigator’s concern of the device. The investigator’s concern in this area is limited to only that amount in this area is limited to only that amount of technical information which will provide of technical information which will provide fruitful investigative leads and serve to fruitful investigative leads and serve to link or clear suspects developed. link or clear suspects developed.

INVESTIGATVE OBJECTIVESINVESTIGATVE OBJECTIVES

In order to sustain a successful prosecution, In order to sustain a successful prosecution, a prosecutor will normally require the a prosecutor will normally require the investigator to provide ample evidence that investigator to provide ample evidence that the person charged has the person charged has Motive, OpportunityMotive, Opportunity

and and MeansMeans

For Example:For Example:Shabu addict needs money to buy drugs Shabu addict needs money to buy drugs

(Motive); shabu addict identified by jeepney (Motive); shabu addict identified by jeepney holdup victims as the person who poked a gun holdup victims as the person who poked a gun in a threatening manner during the robbery and in a threatening manner during the robbery and then fled in a waiting Honda motorcycle then fled in a waiting Honda motorcycle (Opportunity). Suspects arrested on board the (Opportunity). Suspects arrested on board the said motorcycle and with a gun in his said motorcycle and with a gun in his possession during a check point (Means). possession during a check point (Means). Intelligent assessment and consideration is Intelligent assessment and consideration is frequently essential to sort out the MOTIVE, frequently essential to sort out the MOTIVE, OPPORTUNITY and MEANS necessary toOPPORTUNITY and MEANS necessary toprovide direction to the investigation.provide direction to the investigation.

MOTIVEMOTIVEThe use of a bomb device, real or hoax can be a The use of a bomb device, real or hoax can be a

result of virtually any motivational factor. Common result of virtually any motivational factor. Common motives cross the spectrum of human behavior and motives cross the spectrum of human behavior and range from experimentation to murder, suicide to range from experimentation to murder, suicide to intimidation, and vandalism to destruction of an area to intimidation, and vandalism to destruction of an area to conceal another crime.conceal another crime.

Another facet of motive which is some what Another facet of motive which is some what unique to the bomb incident is whether or not the unique to the bomb incident is whether or not the explosion was intentional. If it was accidental,it is explosion was intentional. If it was accidental,it is necessary to determine whether the explosion was a necessary to determine whether the explosion was a result of adjunct factors (industrial accident) or involved result of adjunct factors (industrial accident) or involved a bomb device.a bomb device.

It is often difficult to determine if any victims It is often difficult to determine if any victims involved were innocent bystanders or makers of the involved were innocent bystanders or makers of the device. Determining Motive is complex and needs device. Determining Motive is complex and needs appropriate consideration.appropriate consideration.

What Was the MotiveWhat Was the Motive Vengeance Monetary Gain Recognition Malicious Destruction Hate Extortion/Insurance Fraud Political Extremism Terrorism Love Etc.

OpportunityOpportunity

In the course of the normal investigation, it is customary to pursue avenues of investigation which show that the suspect was at the crime scene when the crime was committed.

Remember: In many bomb cases, however, the suspect may not be at or near the scene and this can complicate the determination of opportunity

Through a thorough processing of the Through a thorough processing of the crime scene, the investigator may be able crime scene, the investigator may be able to determine what caused the bomb to to determine what caused the bomb to “go off.” There are basically three ways to “go off.” There are basically three ways to initiate a bomb, insofar as the investigator initiate a bomb, insofar as the investigator is concerned. is concerned.

In order to develop leads which will In order to develop leads which will result in the establishment of the result in the establishment of the suspect’s opportunity to commit the suspect’s opportunity to commit the offense, the investigator needs to have an offense, the investigator needs to have an appreciation of these methods. appreciation of these methods.

THREE WAYS TO INITIATE A BOMBTHREE WAYS TO INITIATE A BOMB

Time – Device once initiated requires no further action and after a lapse of time will function.

Action – Device designed to function when a victim does something which triggers the initiation system. Such a method is often referred to as a “booby trapped” bomb.

Command – Device is initiated by the subject, usually by a remote method.

Insofar as the establishment of opportunity is Insofar as the establishment of opportunity is concerned, the method of initiation is significant. concerned, the method of initiation is significant. For example, if a “command” type device was For example, if a “command” type device was used, the subject would have had to have an used, the subject would have had to have an opportunity to place the bomb device. In some opportunity to place the bomb device. In some cases, this will involve the substitution of one cases, this will involve the substitution of one container for a similar one which contains the container for a similar one which contains the bomb.bomb.

When a time initiative method is used, the When a time initiative method is used, the opportunity covers a larger and often opportunity covers a larger and often undetermined period of time. Many of these undetermined period of time. Many of these devices are placed in public areas to which any devices are placed in public areas to which any number of persons may have access.number of persons may have access.

MEANS MEANS Criminal prosecutions of persons involved in crime in which weapon

was used should ideally provide evidence to link the suspect to that weapon. This may be done directly by showing that the suspect purchased a gun which was subsequently identified as a murder weapon or by locating a fingerprint on the suspect on the weapon left at the crime scene.

Means can be established by showing that the suspect purchased components used in the fabrication of the bomb device or that he can be linked to the theft of the device or portions of it.

Unlike other crimes, however, it may be possible to show means by locating the place where the bomb weapon was constructed.

A bomb suspect may be somewhat more careless about leaving fingerprints on a bomb, in the belief that all prints would be destroyed in the holocaust of explosion.

Suspect DevelopmentSuspect Development“Many suspects will have motive, opportunity, or

means; some may have two or three. The suspect who has all the three will be the subject of the most intensive investigation.

Analysis of the Incident Another area which requires some modified thinking is the investigator’s analysis of the incident. A proper analysis of what happened and why it happened can also help to provide the investigator with the information that will allow him to better develop and evaluate leads. Specifically, three areas should be definitively examined.

Three FactorsThree Factors

1. Design of the bomb2. Target 3. VictimNOTE: Analysis of these factors will also be helpful in

determining motive, opportunity and means, and achieving successful prosecution.

“UNLESS THE INVESTIGATOR UNDERSTAND THE BOMB INCIDENT, THE DIRECTION AND SCOPE OF HIS INVESTIGATIVE ACTIVITIES MAY SUFFER. AN ANALYSIS OF THE INCIDENT SHOULD TAKE INTO CONSIDERATION THE DESIGN AND FUNCTIONING OF THE BOMB DEVICE, AS WELL AS THE TARGET OR THE VICTIM INVOLVED

Evaluating the SceneEvaluating the Scene

NOTE: At the time the scene is determined to involve a bombing or other crime, the investigator must address legal requirements for scene access, search and evidence seizure.

DEFINING THE INVESTIGATOR ROLEPrinciple: The investigator must coordinate with the incident

commander and first responders to determine what occurred and to assess the current situation. Subsequent procedures will vary depending on the magnitude of the incident.

ProcedureProcedure Upon arriving at and prior to entering the scene, the

investigator should:A. Identify and introduce himself to the incident commander.B. Interview the incident commander and first responders to evaluate the situation,

including safety concerns, and determine the level of investigative assistance needed.

C. Conduct a briefing with essential personnel (e.g., law enforcement, fire, EMS, hazardous materials, and utility services personnel) to:1. Evaluate initial scene safety to the extent possible prior to entry.2. Ensure that search for secondary explosive devices has been conducted.3. Ensure that the scene has been secured, that a perimeter and staging areas for the investigation have been established, and that all personnel have been advised of the need to prevent contamination of the scene.4. Ensure that the chain of custody is initiated for evidence that may have been previously collected.

SummarySummary

The Investigator will conduct a briefing to The Investigator will conduct a briefing to ensure scene safety and security, while ensure scene safety and security, while addressing the issue of secondary addressing the issue of secondary devices.devices.

CAUTION:CAUTION:Only bomb disposal personnel Only bomb disposal personnel

should handle any suspected devices that should handle any suspected devices that are located. Take no further action until are located. Take no further action until the devices have been identified or the devices have been identified or rendered safe.rendered safe.

Ensure Scene SafetyEnsure Scene Safety Principle: The investigator must ensure the integrity of the scene

by establishing security perimeters and staging areas, contamination control procedures, and evidence collection and control procedures.

Procedures: Prior to evidence collection, the investigator should:1. Establish procedures to document personnel entering and exiting the

scene.2. Establish and document procedures for evidence collection, control,

and chain of custody3. Establish and document procedures to prevent scene contamination.

SUMMARY: The investigator will establish and document procedures to protect the integrity of the scene.

Conduct the Scene Conduct the Scene WalkthroughWalkthrough

Principle: The investigator must conduct a walkthrough to establish scene parameters and acquire an overview of the incident.

Procedure: During the scene walkthrough, the investigator should:

a. Evaluate scene requirements (boundaries, personnel and equipment)b. Establish an entry and exit path for personnelc. Be alert to safety concerns (structural damage, secondary devices, unconsumed

explosive materials, failed utilities, hazardous materials) and to the locations of physical evidence.

d. Ensure preservation and or collection of transient evidence e. Attempt to locate the seat (s) of the explosion (s)SUMMARY: The investigator’s initial walkthrough will be an opportunity to identify

evidence and presence of safety hazards.

EXPLOSIVES AND EXPLOSIVES AND EXPLOSIVE DEVICESEXPLOSIVE DEVICES

OVERVIEW1. Proactive manner of instruction, not a replacement for

calling a bomb squad2. You will become familiar with recognizing various types

of explosives, explosive making materials/chemicals, explosive components, and weapons of mass destruction (WMDs)

3. Reporting explosive activity to your local PNP/AFP units is critical in searching out terrorists cells and stopping their planned reign of terror before it occurs.

Reactive vs. ReactiveReactive vs. ReactiveWe must reprioritize from “reactive” We must reprioritize from “reactive” responses to “proactive” responses – responses to “proactive” responses – taking the lead.taking the lead.PROACTIVE APPROACH INCLUDES:PROACTIVE APPROACH INCLUDES:1. Knowing where large quantities of fuels and oxidizers are 1. Knowing where large quantities of fuels and oxidizers are purchased, and knowing the licensed explosive purchased, and knowing the licensed explosive manufacturers/distributors in your area.manufacturers/distributors in your area.2. Visiting these establishment and asking them to call 2. Visiting these establishment and asking them to call when large quantities are ordered/replaced.when large quantities are ordered/replaced.3. Inform all explosive and chemical dealers that any 3. Inform all explosive and chemical dealers that any suspicious activity (arriving in rental vehicles/dialects and suspicious activity (arriving in rental vehicles/dialects and conversation) should be reported.conversation) should be reported.4. Reporting any information of explosive usage/possession 4. Reporting any information of explosive usage/possession to your local PNP units.to your local PNP units.Example:Example:This is our locality where would I go to purchase 50 gallons This is our locality where would I go to purchase 50 gallons of nitro methane/diesel and 100 kilos of ammonium nitrate?of nitro methane/diesel and 100 kilos of ammonium nitrate?

An ExplosiveAn Explosive Proportions of a fuel and an oxidizer, when

manufactured to be utilized as an explosive and when provided the proper stimuli, may explode.

FUELS Generally defined as anything that will burn Most fuels are dark in color COMMON FUELS1. Red phosphorus2. Powdered aluminum3. Sulfur4. Diesel Fuel5. Sugar6. Petroleum Jelly (vaseline)7. Nito Methane

OXIDIXERSOXIDIXERS

Defined as oxygen providers Critical in any oxidation/explosion Most are solid and white to light colored Common Oxidizers1. Potassium Chlorate or per chlorate2. Sodium Chlorate3. Ammonium Nitrate4. Sodium Nitrate or Sodium Chlorate

Transporting OxidizersTransporting Oxidizers

Never, ever place fuels and oxidizers together for transportation

If a container of fuel red phosphorus is placed next to a container of the oxidizer potassium chlorate – and just the residues on the outside of each container touch – there will be a violent explosion.

AcidAcid Defined as base chemical that is most commonly

utilized in nitrating, or chemically mixing, various other chemicals to form a sensitive compound.

EXAMPLES OF COMPLEX EXPLOSIVES1. TATP – Hydrogen peroxide, sulfuric acid, acetone2. RDX – a military explosive that is mixed with a

plasticizer to form C-43. HMTD – hydrogen peroxide, hexamine citric4. Sem tex – RDX, PETN, and rubber

Explosive Safety Data SheetExplosive Safety Data Sheet Explosive Instruction Sheet1. Know how to identify an explosive instruction sheet.2. Accompanies all boxes of commercial explosives3. Often discarded or left behind by terrorist/eextremist bombers4. Finding one infers that someone:

- has stolen commercial/military explosives- is using commercial explosives

5. Large quantities (hundreds of kilos) are difficult to obtain without detection or raising suspicion, and they are costly.

6. Military explosives require an inside person7. Manufacturing high explosives is preferred due to

- Ease of material acquisition – availability and cost- often does not raise suspicion when individual components are purchased-No special skills required to mix and just add correct portions of fuel and oxidizer together.

High Explosives - DynamitesHigh Explosives - Dynamites Date, Shift Codes and Lot Numbers

Date Shift Codes (DSCs), by law, are present on all sticks of dynamites and all boxes that contain commercial explosives products.

MILITARY explosives containers utilize Lot Numbers in lieu of DSCs

-Provide a method of tracing the product, to include1. ID of the product2. Place Date and Shift of manufacture3. Where the product was shipped and sold