Forensics Q&A: Chain of Custody

By Kristy Lahoda | @KristyLahoda

Disclaimer: The information provided in this post should not be used for malicious intent unless it is in the form of crime writing. The author is an explosives expert, not a crime scene expert. While every attempt was made to ensure the accuracy of this information, for security purposes, some details may have been withheld.

QUESTION: In my crime novel, there are scenes involving courtroom testimony about the evidence that was collected at the crime scene. What happens to evidence at a crime scene once it’s been collected?

ANSWER: An investigator from the agency that had jurisdiction over the crime scene will take the evidence to the proper lab. Depending on the state, it could be the state crime lab, state highway patrol lab, state fire marshal’s lab, a city or regional crime lab, or even governmental labs such as the Federal Bureau of Investigation, the Drug Enforcement Agency, or the Bureau of Alcohol, Tobacco, Firearms and Explosives. It really just depends on the jurisdiction. 

So what is chain of custody?

Chain of custody provides a record of time and possession/location of the evidence. This is documentation that later becomes important if the case goes to trial. If the evidence cannot be accounted for from cradle to grave—from detection at the crime scene, to delivery to the crime lab, to analysis, and to either destruction or its return to the submitting agency—it is impossible to prove that the evidence has not been tampered with. This is often a tactic of the defense attorney and rightfully so. The evidence needs to stay secure at all times. 

How does a crime lab keep track of chain of custody?

Once the evidence is collected and packaged, the investigator secures it with evidence tape, initial and date it, and bring the packaged evidence to the lab from the crime scene. Paperwork is submitted with the evidence that provides a description of the evidence in each container along with the type of evidentiary tests that the investigator wants run on the sample. For example, if the investigator suspects that an item of evidence was used to commit arson and this item potentially has latent prints on it (such as a gas can), then there will be an indication such as checked boxes that will let the lab analysts know to analyze the evidence for arson and latent prints.

In many crime labs, each piece of evidence is received and logged into the Laboratory Information Management System (LIMS) by the evidence-receiving technician. The investigator’s name and submitting agency will be on the evidence receiving form and once the evidence is logged into the LIMS system, it will be transferred from the investigator’s possession to the evidence storage area. Once the lab analyst wants to analyze the evidence, he or she will first transfer it into his or her possession, then cut through the evidence tape, breaking the seal. After analysis, the lab analyst will place the evidence back in the original container, add another piece of evidence tape to seal the package once again and write his or her initials and possibly the date. The initials are written half on the tape and half on the package. The evidence is then transferred back into the evidence storage area. Each transfer is logged into the LIMS indicating the time and date of transfer.

What happens if the chain of custody is broken?

If proper chain of custody is not documented and maintained, there will most likely be serious repercussions for the case in court. This could lead to the perpetrator being found not guilty even if s/he was actually at fault for the crime. 

Kristy Lahoda, Ph.D., is an explosives analyst contractor in a crime lab as well as a science content editor for a major educational publishing company.  She writes Christian forensic suspense and discusses forensics on her blog called Explosive Faith.  You can follow her on Facebook and Twitter.

If you have a forensics question for Dr. Lahoda that you'd like to see answered on the QueryTracker Blog, send your question via Carolyn Kaufman using the email link under Contact Us in the right-hand column of the main QTB page.

Forensics Q&A: Explosives Crime Scene Investigation

By Kristy Lahoda | @KristyLahoda

Disclaimer: The information provided in this post should not be used for malicious intent unless it is in the form of crime writing. The author is an explosives expert, not a crime scene expert. While every attempt was made to ensure the accuracy of this information, for security purposes, some details may have been withheld.

QUESTION: My antagonist is a juvenile delinquent who set off a pipe bomb with the intent to destroy property. What would the bomb scene investigation look like?


ANSWER: There should be three phases of the investigation: outside investigation, control and coordination, and inside investigation.

Outside Investigation

First responders have the initial responsibility. Above all else, safety and security must be ensured. After assessment, a call for backup may be warranted. If the scene is unsafe, the first responder must not only wait until the scene is made safe, but must also ensure that the scene is secure for the safety of others. The last casualty from the bombing of the Alfred P. Murrah federal building in Oklahoma City was a nurse who wanted to help the injured. She passed away because a computer monitor fell on her from one of the compromised floors above. Once the scene is safe, rescue of victims is performed.

The crime scene must be secured. This involves establishing an inner security perimeter by placing crime scene tape around the scene. Hazards should be identified and removed or mitigated. Sometimes it is not initially known if the explosion was the result of a bomb, so a call to the bomb squad might be necessary in order to check for secondary devices. A structural engineer may need to be called to check the structural integrity. Other potential hazards that must be taken into account may include fire, hazardous materials such as asbestos and carbon monoxide, utilities such as electrical, natural gas, and ruptured water pipes, debris such as metal and glass, and blood-borne pathogens. If there is fire at the bomb scene, firefighters should use only enough water to quench the fire because the evidence could be washed away. Also during this phase the first responders should ensure that evidence that might be removed from the scene is properly preserved. Witnesses should be located and interviewed and license plates checked—the perpetrator might be among the crowd. The outside investigation is not just a phase of the crime scene investigation, but remains ongoing until the case is solved.

Control and Coordination

Control and coordination takes place once the scene is secure. This phase involves compiling the information obtained from the outside investigation and making it available to the inside investigation. The people operating in this capacity direct investigative endeavors by acting as the filter for incoming and outgoing information by briefing and debriefing. They are responsible for resources acquisition and allocation. A command post is set up near the crime scene, but at a distance so as to not interfere.

Inside Investigation

The inside investigation may occur within a building or outside. The term “inside” is used to indicate that this phase of the investigation is generally confined to the crime scene itself. It is like piecing a puzzle together by collecting physical evidence. The inside phase may need to be moved to a secure area if, for example, the structure is unstable.

The crime scene investigator should meet with the first responders at the command post to learn what actions have been taken. Are there are any victims? Is there any relevant information from witnesses regarding the scene? Are there any known hazardous materials present? Is there any physical evidence already located? They should establish perimeters. The inner perimeter should encompass the blast area including where the evidence is present. The command post should be set up at this boundary and should be determined by multiplying 1.5 by the distance from the epicenter to the farthest piece of evidence located. The outer perimeter is the distance at which investigators want to keep people away not affiliated with the crime scene.

The investigator needs to conduct a walkthrough for observation purposes to identify the “nature of the explosion” and possible evidentiary items. The process of documenting the scene may commence during this stage.

After the walkthrough the team lead should come up with an investigative plan for the scene such as contamination prevention. Contamination of the scene with trace evidence is a real possibility. The investigators should wear Tyvek or laundered clothes and shoe coverings. Care should be taken to avoid stepping on potential evidence and destroying things like shoeprints, tire treads, etc.

The team lead should brief the team and assign specific tasks, ensure that team members are wearing proper protective clothing, and provide reminders not to forget the basics—to be on the lookout for fingerprints, shoeprints, tire treads, tool marks, and trace evidence such as DNA, blood, fibers, suspicious packaging and wrappers, etc. A member should be assigned to swab explosive residue.

A number of steps take place during the inside investigation including establishment of a team lead, evidence identification, documentation, collection, and preservation, and the performance of a final survey.

Establishing a Team Lead

A team lead should be chosen to serve as a liaison between the inside investigation unit and the command post, to formulate an action plan such as assigning investigators/scientists to certain tasks in order to cover all bases, arrange for the command post to obtain essential equipment, and help to maintain the morale of the unit. Two essential questions should be asked. What happened? How did it happen? This is the objective of the crime scene search.

Documentation, Identification, Collection, and Preservation

The scene is documented. This includes photographs, sketches, and notes. Photographs of the scene should be taken to include an overall perspective. Once evidence is identified, such as pieces of an explosives device: the possible container, fuzing mechanism, and filler, it may also be documented. Key evidentiary pieces should be photographed individually. The photographer should coordinate with the sketch artist. Photographs of every individual item are not required, but should be taken prior to moving the evidence if that piece is considered vital to the investigation. Evidence custodians collect, package, and label the package. Chain of custody is important during this step, thus an evidence log should be maintained.

Final Survey

A final walkthrough of the crime scene is performed to verify completion of crime scene evidence search, documentation, and processing. Recovery of all equipment used should also be completed at this time.

There are multiple investigations occurring during an explosives crime scene investigation. The outside investigation and inside investigation are linked together through the control and coordination unit. This connection is important to bring the puzzle pieces together for both phases. It is the responsibility of the inside investigative team lead to keep up the team morale due to the nature and tedium of the investigation. This is one of the most important jobs. When the crime scene investigative team grows weary or emotionally unstable, mistakes are made.

Source: Thurman, James T. Practical Bomb Scene Investigation. Boca Raton: CRC Press, Taylor & Francis Group, 2006. 

For more information on these topics, stay tuned for the installments in the upcoming months of Forensics Q&A!

Kristy Lahoda, Ph.D., is an explosives analyst contractor in a crime lab as well as a science content editor for a major educational publishing company.  She writes Christian forensic suspense and discusses forensics on her blog called Explosive Faith.  You can follow her on Facebook and Twitter.

If you have a forensics question for Dr. Lahoda that you'd like to see answered on the QueryTracker Blog, send your question via Carolyn Kaufman using the email link under Contact Us in the right-hand column of the main QTB page.

Forensics Q&A: Not All Explosives Are Created Equal

By Kristy Lahoda | @KristyLahoda

Disclaimer: The information provided in this post should not be used for malicious intent unless it is in the form of crime writing. The author is an explosives expert, not a crime scene expert. While every attempt was made to ensure the accuracy of this information, for security purposes, some details may have been withheld.

QUESTION: I am writing a thriller and my antagonist is planning to make a pipe bomb.  Does it matter what type of explosives she uses?  For example, could something like TNT be used as an explosive in the pipe?

ANSWER: It does matter as not all explosives are created equal.  TNT is not an explosive typically used in a pipe bomb—it does not need to be contained to cause mass destruction.  Explosives are generally grouped into two categories: low explosives (LEs) and high explosives (HEs).  These are differentiated based on the speed of explosion.  LEs deflagrate, HEs detonate.

High Explosives (HEs)

Detonation occurs when the reaction front propagates (i.e the reaction proceeds) through the explosive at a speed greater than the speed of sound,  Detonation occurs at velocities above 3,300 ft/sec (2,250 mph).  For detonation to occur, the assistance of a primary explosive is required.  To provide sufficient energy for the high explosive to begin its energetic decomposition (i.e. the breakdown into chemical components as a result of the energy of the reaction), only small amounts of the primary explosive are needed because they are reactive to shock, friction, or heat.  Detonation results in a rapid release of energy and an accompanying shock wave.

Types of HEs

High explosives are categorized as primary or secondary based on ease of initiation.  When comparing the two, primary explosives are more sensitive to heat, friction, and shock and have less energy, and therefore less power, than secondary explosives.  Secondary explosives are less sensitive to heat, friction, and shock and are more powerful.  Primary explosives are used in detonators and initiation systems.  They can be used to ignite secondary explosives.  Secondary explosives are used in large quantities relative to the primary explosive and are typically used as the main charge.

Primary Explosives

Two common initiating explosives include lead azide and lead styphnate.  Lead azide is very sensitive to initiation by friction, heat, or shock.  The velocity of detonation for lead azide is around 17,500 feet per second.  That’s just over 11,900 miles per hour!  Lead styphnate is sensitive to static electricity and fire, but is less sensitive than lead azide to friction and shock.  Its velocity of detonation is similar to that of lead azide.

Secondary Explosives

Trinitrotoluene (TNT) is one of the most universally known HEs.  Cyclotrimethylene trinitramine (RDX) and pentaerythritol tetranitrate (PETN) are two favorites of terrorists.  In fact, PETN was the explosive that Richard Reid, aka The Shoe Bomber, had concealed in his shoe in an attempt to blow up American Airlines Flight 63.  Another example of a high explosive is ammonium nitrate-fuel oil (ANFO, used by Timothy McVeigh and Terry Nichols in the bombing of the Alfred P. Murrah federal building in Oklahoma City in 1995.

Low Explosives (LEs)

Low explosives are propellants that burn in open air, but deflagrate (burn rapidly) when initiated in confinement.  LEs might not sound that dangerous since they burn, but they can be extremely perilous when used improperly.  In fact, they can even “act” as high explosives upon deflagration given the proper conditions when initiated, such as containment.  Simply stated, deflagration = explosion when confined.  When the LE deflagrates, the burn is faster than in open air.  However, it does not burn as rapidly as detonation occurs.  The reaction front propagates through the low explosive at a velocity less than the speed of sound.  As a result, low explosive deflagration reactions occur at a lower reaction front pressure, velocity, and temperature than HEs.  

Types of LEs

There has been a strong emphasis in counterterrorism literature on high explosives analysis, but the majority of incidents in the US have been due to LEs such as black powder, smokeless powder, improvised explosives, and fireworks. These are the types of explosives that are used in pipe bombs.

In summary, low explosives require containment to deflagrate.  High explosives require primary explosives to initiate detonation of secondary explosives, but are destructive without containment.  After an explosion, there are a number of law enforcement activities that are launched at the crime scene and crime lab including an investigation, a crime scene search, evidence collection, sample preparation, and forensic analysis on the decomposition products of the explosives—called post-blast residue analysis.  The wealth of forensic information obtained post-blast is amazing and should give pause to anyone considering bomb construction.  

For more information on these topics, stay tuned for the installments in the upcoming months of Forensics Q&A.

Kristy Lahoda, Ph.D., is an explosives analyst contractor in a crime lab as well as a science content editor for a major educational publishing company.  She writes Christian forensic suspense and discusses forensics on her blog called Explosive Faith.  You can follow her on Facebook and Twitter.

If you have a forensics question for Dr. Lahoda that you'd like to see answered on the QueryTracker Blog, send your question via Carolyn Kaufman using the email link under Contact Us in the right-hand column of the main QTB page.