Arson Investigation in the Wildlands. Case Building and Practical Analysis

Citation preview

Arson Investigation in the W1 ildlands Case Building and Practical Analysis

Arson Investigation in the Wildlands Case Building and Practica l Analysis

Ed Nordskog

Joe Konefa l

Copyright©

2020 Joseph W Konefal, Jr. and Ed Nordskog

All rights reserved. Reproduction or utilization of this work in any form, by any means now known or hereinafter invented including, but not limited to: xerography, photocopying and recording, and in any known storage and retrieval system, is forbidden without permission from the copyright holder. ISBN-13 978-0-578-77486-2 Printed on Acid Free Paper Cover image courtesy of Tom Oldag and Jeff Zimmerman

ED NORDSKOG has been an arson-bomb investigator, criminal analyst/profiler, and bomb technician for more than 21 years with the Los Angeles Sheriff's Department. He has investigated more than 2,100 arson cases and handled nearly 600 hazardous device (bomb) calls. He has arrested and interviewed more than 320 people for arson, including more than 25 serial arsonists. He has been involved in 48 serial arson investigations . He has researched more than 1,000 cases of serial arson, and has published five books on the subjects of fire death, arsonists, serial arsonists, wild land arsonists, arson profiling, and incendiary devices. Ed has provided case analysis, consulting, and profiling on more than 170 cases for other investigation units and prosecutors at the local, state, national and international levels. These cases include serial arsonists, wildland arsonists, cold cases, arson murders, and suicides. He is an internationally known instructor on the subjects of fire death scene investigation, serial arsonists, arson profiling/analysis, and incendiary devices. He routinely teaches federal agents on the subject of criminal bombers and thei r devices. Ed has testified on arson and bomb related subjects in criminal and civil courts on more than 110 occasions. He has received more than 90 medals, awards and commendations for criminal investigations, including the Arson Investigator of the Year and Outstanding Accomplishment by the IAAI, and Law Enforcement Officer of the Year for his work on major arson investigations. He has received California State POST's award for Instructor of the Year for his role in teaching Fire Death Investigation and ArsonExplosion Investigations. Ed Nordskog's other books include: Torchered Minds-Case

histories of notorious serial arsonists.

Fireraisers, Freaks, and Fiends-Obsessive

arsonists in the California foothills.

The Arsonist Profiles Incendiary Devices: Investigation and Analysis Fire Death Scene Investigation (co-author)

Ed Nordskog can be contacted at www.arsonprofiler.com

or at [email protected]

3

JOE KONEFAL is a retired Supervising Bomb Technician and Arson Investigator from the California Department of Forestry and Fire Protection, or CAL FIRE, Office of the State Fire Marshal, Arson/ Bomb Unit. He investigated fires and explosions and conducted render safe operations on improvised explosive devices at more than 875 incidents in a twenty-two-year career. He currently has forty years of experience within the arson/bomb world and is recognized internationally as an instructor on many related subjects . Joe has testified on arson and explosive cases as an expert witness on sixty-five occasions in state and federal courts. Joe is currently a consultant, case reviewer, and instructor in the fire, arson, fire death, and explosion fields. He is the Lead Instructor for California POST, Institute of Criminal Investigations, Arson and Explosives Course. Joe has obtained professional certifications: Certified Fire Investigator through the International Association of Arson Investigators; Firefighter I, Certified Fire Investigator I, and Certified Fire Investigator II through the California State Board of Fire Service; Basic, Intermediate, Advanced, and Supervisory law enforcement certificates , an Institute of Criminal Investigation Instructor and ArsonExplosives Specialty Certificates and a Master Instructor Certificate through the CA Department of Justice, Peace Officer Standards & Training (P.0.S.T.); Bomb Technician Certification through the FBI Hazardous Devices School, Redstone Arsenal; and a Certified Master Fire Investigator through the California Conference of Arson Investigators. Joe is co-author of the book Fire Death Scene Investigation Joe was an editor for the book Incendiary Devices: Investigation and Analysis

Joe Konefal can be contacted at: [email protected]

4

Acknowledgments The authors would like to acknowledge several individuals who have influenced us with their many years of investigating wildland arson cases, and those who have passed on their knowledge by teaching others. They are: Paul Steensland, Richard "Dick'' Ford, Ron Huxman, Tom Oldag, Chris Vallerga, Bryce Trask, Terry Taylor, Greg Liddicoat, Scott Fischer, Jim Engel, Ken Ness, Jeff Henricks, Richard Woods, Jim Allen, Chris Parker, Kevin Kelm, Tim Huff, and Frank Hollbrook. The following professionals added knowledge, case histories, photos, and information to the authors prior to the writing of this book: Ron Greene, Mike Cosdeigh, Mike Cofield, Joe Acevedo, Dana Duncan, John Hanson, Todd Anderson, Rich Edwards, John Ament, Derek Yoshino, Rick Velazquez, Mike Digby, Irma Gonzales, Cindy Valencia, Rob Harris, Craig Anderso n, Larry Lewis, Gary Morgan , George Elwell, Dan Briot, Darren Kaye, Joanne Baldwin, Branden Smith, D.J. "Dusty" Whiting, Vic Massenkoff, Christine Saqui, Scott Hall, Wayne Miller, Jeryl Archer, Matt Zirker, Arnold Van Lingen , Greg Smith, Jeff Campbell, Paul Fisher, Bill Smith, Carl Kent, Walt Nutting, Steve Morgan, Ross Buder, Gary White, Donna Deaton, Gary Reynolds, Fred McVay, Jeff Zimmerman, Ben Scott, Vern Canon, Terry McMahon, Tom Browning, Mark Koenig, Mike Whitney, Mac Nelson, Chris Hendrickson, John McDermott, Darren Dicharry, Robert Luckett, Dr. Joseph Cavaleri, Steve Phillips, Tiffany Shew, Kristina Fritz, John Bockrath, Sandra Enslow, Dr. Dian Williams, Michael Clough, Renee Rose, Sean Carney, historical researcher Tom Peterson, and author John Maclean .

Dedication This book is dedicated to all ranks of wildland firefighters and command staff, the fire patrol specialists, fire spotters, air attack pilots, dozer operators, water tender drive rs, tree fallers, smoke jumpers, "hot shot" crews, inmate crews, and all wildfire emergency workers who are or have been engaged in the incredibly difficult, dangerous, exhausting, yet thrilling and noble profession of Wildland Firefighting. A special acknowledgment to all who have perished while performing those intrepid duties . You have our lasting gratitude. Lastly, it is dedicated to the wildland fire and arson investigators who have been out there "making cases" for the past one hundred years. It is an exhausting, thankless job, mired by rigid bureaucracy, agency politics, meddling administrators, and an indifferent legal system. After each devastating arson fire, you must ask yourself, "If I don't bring this arsonist to justice , who will?"

5

,li\rson Investigation in the \/\/i!d!ands

Author's Note: the authors of this book, for ease of writing, use the pronouns "his and he" when describing wildland arsonists and serial arsonists. While this is not academically or politically correct, it is factually accurate in that the overwhelming number of suspects in these cases are in fact males.

A spree arsonist in the middle of setting multiple wild land fires.

6

Courtesy of Jeff Zimmerman.

This book is not designed to cover the large and highly technical topic of Wildland Fire Origin and Cause Determination, which entails conducting an Origin and Cause investigation at the fire scene. That technical information is best learned by attending a formal, lengthy, and arduous "hands on" course such as the FI-210 training provided by various entities. The authors highly recommend that the wildland criminal investigator completes a Wildland Fire Investigation FI-210 class, so they can familiarize themselves with basic wildland fire knowledge, terminology, and the numerous challenges associated with this niche field of investigation.

Wild Fire Investigation: FI-210 Origin and Cause Investigation. Courtesy of Joe Konefal.

This book instead, will focus on those wildland fires which, after a proper Origin and Cause investigation, have been deemed to be intentional incendiary acts, or arson events. The book is designed to assist wildland arson investigators in understanding the motives for the event, examining and processing the arson related evidence, using evidence, pattern analysis and behavior analysis to link a potential suspect to the event, and preparing the case for the prosecution of the arsonist.

Recently, the authors attended an international arson seminar, where a presentation was given regarding the successful investigation, arrest and prosecution of a suspect. The suspect was responsible for more than thirty wildfires. The investigators who presented the case had amassed significant physical evidence to link the suspect to multiple fires. Just prior to the end of the case, they were monitoring the suspect with surveillance assets. They had visual confirmation that the suspected arsonist had just

7

,ll. .rson Investigat ion in the \AJi!dlands

lit a small fire in the wildland on a "red flag" day. They immediately contacted the prosecutor for the case, while still monitoring the suspect. The prosecutor asked them to allow the suspect to light another, perhaps larger fire to bolster the case and enhance the future prosecution of the suspect.

Wildland .Fire Otigin and Cause Deterrn.ination FI-210

Student Workbook NFES 002817

APRlL201~

FI-210 Course: Student Workbook and Field Guide for student Origin and Cause investigators. All persons involved in wildland arson/criminal investigations should have a familiarity with the pr inciples and techniques within the FI-210 course and these documents. ImagescourtesyofTerryTaylor.

Both lead investigators recognized the high possibility of danger from the arsonist and immediately denied the prosecutor 's request, and began the process of arresting the arsonist . What they didn't realize at that point was that the arsonist had already lit another fire (yet unknown to the investigators) that exploded into a massive forest fire which surrounded dozens of potential victims. Luckily no one was injured in this event. The investigators made the correct decision in this case. This is not the first time that prosecutors or agency administrators have urged investigators to not make an arrest of an arsonist after a fairly small fire. In fact, there have been many such events like these. Recently, a news service in California conducted their own inquiries about an agency allowing a known arsonist to set an additional fire. The agency's investigators had been following a known arsonist and had watched him set a small fire in an area where he was suspected of setting several fires. They consulted a prosecutor who told them he would like to see a slightly larger fire (The prosecutor has since denied that conversation). Over the next few days, the arsonist set a fire during extreme fire conditions, which eventually burned most of a town down . The arsonist was subsequently prosecuted, but residents were highly upset when they learned that the agency's investigators had actually witnessed the arsonist setting

8

The Intent of this Book

additional fires before being arrested. The news media has made several assertions that public agencies have allowed this reckless activity to occur in the past. The authors and most of our peers are of the following opinion:

A professional arson investigator can never justify intentionally allowing an arsonist to set a fire which could possibly endanger someone's life or property! It is unethical, unprofessional, immoral, and likely illegal.

The one criminal in the world who possesses the power of a nuclear weapon at his fingertips is the wildland arsonist. In certain areas of the world, if the weather and fuel conditions are favorable, a wildland arsonist has the instant ability to burn an entire community to the ground, and kill scores of people, their pets, livestock, and the wildlife in the area. In Western North America, red flag warnings are posted during extreme fire danger periods. These red flag warnings are put in place when the weather conditions are at a critical stage based on high temperature, low relative humidity values, and strong, dry winds. These strong dry winds, or Foehn Winds, are known regionally by various names such as the Mono, Santa Ana, North, Sundowner, Diablo, Chinook, East, and Wasatch winds. It is possible that these extreme weather conditions could inspire an arsonist to strike. This act would take little to no planning, and could be accomplished in mere seconds for the entire cost of a single match, lighter or highway flare. Once the beast of fire is released, the arsonist has no ability whatsoever to control where it goes and what it burns. A wildfire set at the right place and in the right conditions, can burn hundreds of homes, and overrun persons fleeing, even in their vehicles. All wildland fires start out small. The fire growth will depend on three major influences: the type and the availability of fuel; the weather conditions such as ambient temperature, humidity, and wind; and the terrain. Wildland fires, once ignited have been known to burn for weeks, if not months, and pose a continuous danger to communities in their paths. It is an awesome destructive force that has no peer in the criminal justice world. Besides the loss of life potential, this type of event could easily cost millions to billions of dollars. Despite the horrific potential of death and destruction from this sort of event, there is very little modern training devoted to wild.land arson investigations in North America. The major wildland fire investigation agencies in the Western United States and Canada have historically allocated very few training dollars for arson investigation training. Along with those government agencies, international investigation groups have paid only lip service to the problem of wildland arson investigations. The lack of ongoing and up to date training in the wildland arson sector is a continuing issue within the industry that needs to be addressed.

9

Arson Investigation in the Wi!d!ands

Historically, the crime of arson and the persons who commit this act have achieved mythical status in the annals of criminal justice. The prevailing beliefs about this crime and its perpetrators include the following:

• •

Arson is a crime committed in the dead of night with no one to witness the act ...

•

The fire department destroys all remaining evidence ...

• • • •

Arsonists are very intelligent and clever criminals and are therefore difficult to catch ...

•

The fire burns up most or all of the evidence ...

Arsonists are loners and seldom tell anyone else about their crimes . . . Arsonists use exotic and elaborate methods to start their fires ... Arsonists are highly skilled and quite sophisticated ... Arson attacks are random and unpredictable ...

• Arson motives are difficult to identify . . . . . . and because of all of these above factors, arson cases are extremely hard to understand and solve, and arsonists are difficult to identify and arrest . While there may be a tiny degree of truth in a couple of the se beliefs, most of them are not accurate at all. As stated by Corry and Vottero in 1997, "The real problem occurs when ... investigators accept this bleak outlook as though it were fact . It has been our experience that most arson fires are not only possible to solve, in many cases, average arson fires are very easy to solve"

W e (Ed and Joe) could not agre e more . W e, as a profe ssion should be solving many more arson cases than we currently are.

10

===------

---------

~-

.

~ONTENTS ~ _ _ _

-~

_ _ _ ___~ __ . _J

Chapter 1:Wildland Fires __________________

13

Chapter 2: Wild land Arson Motives

18

Chapter 3: Investigating a Criminal Fire

26

Chapter 4: Incendiary Devices in Wild land Arson Cases

61

Chapter 5: Wildland Arson Physical Evidence

74

Chapter 6: Behavior Analysis and Profiling

114

Chapter 7: Sub-Types and Profiles

131

Chapter 8: Case Linkage

141

Chapter 9: Case Management

171

Chapter 10: Courtroom Presentation

179

Bibliography

202

11

--~

~-.

CHAPTER1:WILDtAND FIRES

j

Wildland fires occur in all types of vegetation and terrain. Various countries and agencies classify these fires by different names. In Australia and New Zealand, the term for these events is bushfires. In heavily wooded areas they are defined as forest or timber fires. Europe, Africa, Asia and large swaths of North American grasslands have prairie fires, range fires, steppe fires, or savannah fires. The jungled forests of the Congo, India, Southeast Asia, Indonesia, and the Amazon are plagued continuously in the dry seasons by rainforest fires. In the wetter areas of the world certain geographic areas frequently deal with the unique and stubborn threat of bog, peat and marshland fires. Throughout the developed world, large fires originating on agricultural lands are called cropland fires. For the purpose of this book, we will use the generic terms of wildland fire or wildfire to describe any uncontrolled fire originating and burning primarily in wild vegetation or cropland.

Arson fire in the desert region of California.From

Ed Nordskog's case files.

:Wildlan~Fire Causes In reality, the vast majority of wildland fires are not intentional acts. Most can be attributed to hu man activity in the form of equipment use, and other accidental or negligent acts. Another large number of these fires can be attributed to acts of God, which primarily means a lightnin g strike.

13

Arson Investigation in the Wildlands

Wildland fires, particularly in North America, have been occurring as long as humans have existed in these areas. There is anecdotal evidence that certain native tribes have purposely used fires to hunt game, attack enemies and to even practice a form of range management . Lewis and Clark published diaries of their travels across the Plains area of the United States in the early 1800's. Of note within those documents is the fact that the expedition members witnessed various native tribes purposely setting prairie fires. The fires had a two-pronged effect in that they drove game (buffalo, elk, deer) into a killing zone, and the effects of the fire replenished the land for the next year's crop of grasses. After North American farmers and ranchers took over large swaths of the West, they continued this use of fire as an annual land management/replenishment practice. It wasn't until the last fifty years that these purposely set fires in the West were outlawed.

Few fires other than wildland fires can be attributed to an ''Act of God" . The most common Act of God related to wildland fires is a lightnin g strike. In certain regions of the world , lightning strikes cause hundreds of wildfires annually. Lighting strikes create unique damage and patterns to both trees and to the ground. When conducting an arson investigation in an outdoor setting, the possibility of a lightning created fire must be investigated and eliminated as the cause before the investigator can conclude that arson has occurred .

Lightning is a major cause of wildfires in many areas. Any arson investigation must first eliminate lighting as potential cause. The tree in the foreground shows a recent lightning strike while other trees show burn damage. Courtesy of Tom O/dag.

14

Chapter 1: Wild land Fires

Other Acts of God that can be a causal factor for fires include high winds, earthquakes and floods. Each of these events alone do not cause fires, but they can cause equipment failures that do result in fires. An example is an earthquake or high wind that topples a powerline which then ignites any combustible materials on the ground.

Besides lightning strikes, the next most common cause for a wildfire is some form of equipment use or failure. A broad number of items and activities have been known to cause unintended outdoor fires. These include: motor vehicles, utility lines, rail operations, logging operations, mining operations, ranch activity, farming, and a long list of heavy equipment use. While most, if not all of these events are unintent ional acts, some of them rise to the level of negligence or gross negligence and may in fact constitute a "criminal fire". This classification and subsequent legal action is based on a number of facto rs to include time of year, time of day, proper maintenance, proper safety features, and scene conditions . While a significant number of wildland arson investigators do get involved in these types of cases, the subject of negligent fires is not the focus of this book.

Vehicle CausedWildfire: A mechanical failure in a semi-tractor caused a several hundred-acre fire. This fire started on a steep grade. Courtesy of Jeff Zimmerman .

O th er hum an activity not menti oned above that leads to uninten tional wild fires in cludes h un ting/ shoot in g range operations , escaped or unsu p ervised cam p fires an d barbe cues, and the careless discarding of smoking m aterials. Again, some of these actions will fall unde r the category of negligent fires, and may lead to a criminal investigation. 15

ArsonInvestigationin the V'✓ ildlands

A rare and seldom discussed topic in both North America and Australia is the issue of cultural practices leading to wildfires. These are fires that occur near populations of indigenous peoples and are related to cultural rites, customs, or even religious -style ceremonies. In 2010, the Australian government recognized that there were an inordinately higher number of arson fires near indigenous populations. These were attributed to cultural differences in the use of fire with some groups. One recommendation of the government was to provide education on the effects of wildfire to these populations, and to ensure these groups have a clear understanding of national arson laws. Local investigators need to be aware of all such issues, customs , and possibilities . In Los Angeles in 2011, a man named Kirk Billie was convicted of a series of arsons. The investigation revealed that Billie had a long history of fire setting going back twenty years. Billie was a Navajo Indian and suspected of setting fires on the Navajo Reservation as a child. As a former U.S. Marine, Billie had been convicted of two arson series while stationed in Okinawa, Japan. He was also a "person of interest" in arson cases in three states after his release from a military prison. During his sentencing for the arsons in Los Angeles, Billie's attorney claimed at one point his fire setting was related to traditional cultural rites he learned as a child . A query through investigative contacts on the White Mountain Apache, Navajo, Pueblo tribes of the northern Rio Grande, Lakota Sioux, and Hopi lands revealed that the rare "cultural" fires set during some tribal rites by designated elders are actually very small, and limited to specific ceremonies such as "cleansing and healing". Wildfire had been used in the distant past by some tribes as a weapon of war against the better armed European invaders, but there really has been no recent use of wildfire in anything resembling a cultural rite. The Native cultural advisers stated that any use of fire for a negative purpose was considered to be "witchcraft" or evil among most tribes. They rejected the notion that Kirk Billie had been practicing cultural fire setting. It is recommended that during any active arson investigation occurring near Native, First Nation, or other Indigenous persons' lands, arson investigators must engage in a face-to-face meeting with tribal authorities. Those authorities may have unique insight to local issues, disputes, relationships, or potential suspects .

16

Chapte r 1:Wi ld land Fires

Int eraction with Indigenous Authoriti es: It is highl y r eco mm ended th at arson investig ators form working relations hips w ith all entit ies in th e ar eas w her e fir es are being set. It is imp ort ant fo r investi gat ors t o ga in knowledge of loca l act ivities , cust oms, disput es, and issues. Courtesy of Dusty Whiting .

A sub-category within human activity fires is the emerging problems with homeless encampments . In the 2000's, as the homeless population exploded throughout North America, a significant number of shanty towns, encampments, and "tent cities" have come into existence. These makeshift living quarters are often located in•the volatile zone termed the urban /wildland interface. This puts these less-than-firesafe living sites squarely into the most susceptible areas for both accidental and negligent /intentional fires. The very same factors that helped create and continue to plague the homeless populations (drugs, alcohol, mental health issues), also make these sites one of the more common areas for wildfires. In Southern California, many of the recent large wildfires have originated within these homeless encampments.

17

Like arson fires set in an urban environment, wildland arson is not limited to a single motive or offender type. In fact, the wildland arsonist sets fires for many of the same reasons (motives) as urban arsonists. It should be stated clearly here, that most arsonists tend to have a bit of a blend of motives when they set their fires. An investigator should not focus on a singular motive as the arsonist can be driven by two or three different motives at the same time. Besides these similarities, there are some glaring differences when it comes to the wildland arsonist.

These two semi-related motives are more prevalent in wildland fire setting than any other, particularly among serial wildland arsonists. As stated earlier, the wildland arsonist has the ability to create massive events with very little effort, and to affect the lives and property of thousands of persons. That sort of power can be a heady intoxicant to an arsonist who leads an otherwise mundane or pathetic life. A touchy subject which is closely related to these two motives is the firefighter serial arsonist operating in the wildlands. Most informed researchers on this subject recognize that many of these unique criminals are actually dangerous thrill seekers as opposed to persons looking for recognition. A recent case from Australia describes one such arsonist. Volunteer firefighter Jourdan Ashford ignited a bushfire near Perth, Australia in 2016. He was suspected of other similar fires. After his arrest he admitted to investigators that he was "an adrenaline junkie" and wanted to "get a rush". He also admitted to calling in several false alarms. Like many firefighter arsonists, the courts granted a very lenient sentence. More will be discussed about this subject in chapter 7 .

Anger and hatred in the form of Spite/Revenge is the most common motive for all sub-types of arsonists. The subject of the anger may not be clear to investigators, but could come in the form of any petty insult, slight, injustice, or perceived wrong. Arsonists often view themselves as some sort of victim in the world, and they find that fire is a ready weapon they can use to get their revenge. A famous case in 2002 was a spite/revenge-inspired wildfire ignited by Terry Lynn Barton, who at the time worked as a seasonal firefighter for the U.S. Forest Service. Barton was a mother with two daughters, when she received a letter from her estranged husband which upset her. In a fit of anger, she burned the letter in a campfire ring, but then decided to adjust combustible materials to purposely make the small fire spread to the nearby forest. The area was experiencing a major drought and the fire erupted into the largest in Colorado's history, the Hayman Fire. It burned more than 100,000 acres and eventually destroyed 133 homes. Barton, who was not suspected of being a serial fire setter, nonetheless received a sentence of six years in prison for her act of spite.

This is a common motive for vehicle and structure arson, but a bit rarer in the wildland sector. Historically though, it has manifested itself in the wildland secto r in multipl e different forms: Insurance Fraud: Several large insurance carriers were actually created to address major losses and claims in the farming sector, hence the word "farm" in many company names. These losses could come from the destruction of crops via weather incidents, pestilence, and of course, fires. In some cases, due

Chapter' 2: Wildland Arson Motives

to either drought or low crop prices on the market, farmers have been known to "tor ch" their own crops to obtain insurance proceeds. Anecdotally, this scheme was so commonplace in the 1930's that the Los Angeles Sheriff's Department created an Arson Detail for the sole purpose of assisting an insurance investigator from the Farm Bureau of the State of California. (Source: Los Angeles Sheriff's Department Museum). The two investigators worked side by side for years. Compensation/Work: In the past there have been several notable cases where wildfires have been set by persons who obtain compensation for their role in responding to, fighting, or providing logistical support to firefighting operations. The mass-fatality Rattlesnake Fire in California in 1953 was ignited by a man named Stanford Pattan. Pattan had set two fires in the brush/forest in hopes of getting a job at a fire camp. Fifteen wildland firefighters died during the blaze. The following case history describes a series of events which led up to an organized arson conspiracy in the wildland.

"80 to 90 percent of the forest fires in Northern California in the past few years have been arson for profit" U.S. Attorney Charles Stevens, 1994

Hayfork, California is a small town which was the epicenter of a dispute between environmentalists and the timber industry. By the 1980's environmental concerns over protected species, and the ensuing regulation by state and federal agencies had slowly strangled the timber harvesting operations which were the life of Hayfork and many other small communities in that region of the state. As a result of this regulation, the timber companies and many associated businesses slowly dwindled and were at the brink of collapse. However, there was a caveat in the laws stating that while logging was mostly banned in protected areas, trees could still be harvested as "salvage" if they were damaged by fire. The natural fires in the region enabled the timber-reliant economy to exist via these salvage operations. By 1990 there was a decrease in "natural" fires and the economy teetered again on collapse. However, over the next few years a spate of suspicious wildfires ravaged the region. Investigators from both CAL FIRE and the USFS soon heard whispers of semi-organized groups of "economic arsonists" being paid to set fires. In 1992, an equipment rental company employee named Ernest Ellison was arrested for a series of fires in the area. He and his brother had made a living by renting water tenders and other heavy equipment to the Forest Service for up to $2,000 a day during major fires. Ellison soon began talking and told investigators chat a number of businessmen from the local area were involved in some manner in the larger scheme of setting fires for profit. Ellison was convicted in a plea deal. The investigation into these events caused investigating U.S. Attorney Charles Stevens to declare that "a full 80 to 90 percent of the forest fires in Northern California in the past few years have been arson for profit". In 1995, the Los Angeles Times ran a detailed story about how arson for profit schemes are impacting the nation's forests. In that article, the Times quoted a U.S. Forest Service official who bluntly stated chat in the Southeast portion of the country, "90% of forest fires on federal land are deliberately set" . The official cited the practice of an entire industry dependent on salvaging burned timber from lands as a financial motive for the fires. In more recent times, there have been international allegations of arsons on a corporate or industrial scale designed to burn down virgin rain forests. In the past decade the countr y of Indonesia has been 19

.b•.rsonInvestigation in the Wi!d!ands

highlighted in Hollywood documentaries and news articles about the ongoing number of suspicious forest fires. The media sources have openly accused the country of giving tacit approval for these fires, or simply ignoring them, so that major corporations can build plantations for sugar cane in the area. Activists term this new threat "corporate sponsored arson". The country of Brazil has come under heavy pressure in the year 2020 for allowing-if not encouraging-fa rming and ranching operations to continue to intentionally burn down the Amazon rain forest as part of a politically based profit agreement with the government. The Brazilian government deflected criticism by claiming a group of rogue firefighters had been setting the fires, in hopes of getting compensated for fighting them. Activists have termed this practice political or state sponsored arson. Firefighter Arson for Profit: The idea that firefighters would start a fire so that they could get paid to fight it is nothing new. The bulk of the force of wildland firefighters in North America are seasonal or on call firefighters. This means they only get paid if they are actually fighting wildfires. There have been dozens if not hundreds of documented cases of firefighters setting wildfires for employment throughout the world, including the United States, Canada, Australia, Greece, and Spain. The U.S. Fire Administration lists "profit" as one of the two leading reasons for firefighter arson in the wildland. One of the mo re notorious cases involved a Native American firefighter named Leonard Gregg. Gregg worked as a seasonal firefighter on a reservation in Arizona. He had hoped to be hired full time as a firefighter for the Bureau of Indian Affairs. In 2002, he set two wildfires on the same day as a means of getting employment. One of those blazes grew into the Rodeo Fire, which became the largest in Arizona's history. Gregg served nine years in p rison for the fires. The Arson for Profit motive is somewhat common in the wildland sector. Investigators need to understand all potential motives to begin their search for a suspect. With this motive, investigators need to have a good feel for local po litics, environmental issues and the current local economy.

Arsons to cover up other crimes are not a very common motive for wildland fires. In the last decade or so, gang members and other persons involved in ongoing criminal activity have begun to appreciate law enforcement's use of forensics to solve crimes. More importantly the criminals have learned that they can be linked to remote crime scenes through the use of physical evidence . Seasoned investigators have noted an uptick in fires set to cover criminal acts or to obliterate the forensic evidence at these scenes . These fires are known to investigators as anti-forensic fires. The most common crimes that are being covered up by wildland fires are stolen vehicles, the theft of resources such as timber, and the dumping of a murder victim in a remote area. Typically, these are the rare wildland arson scenes where it is common for the arsonist to have brought a flammable liquid accelerant to the scene. Any one of these fires, while it was planned only to obliterate evidence, can easily spread to a massive conflagration .

20

Chapter 2: Wi ldland Arson Mot ives

Skeletal Remains of Murder Victim Found After a Major Brush Fire: Analysis r evealed th e victim was dead long (mo nth s or years) befo re th e fir e. Courtesy of Ron Greene .

21

,L \r son I nvest igation in the Wi ldlands

Crime Concealment Arson: Upper and Lower photos-Murder victim's body (red square) dumped and set on fire as part of a cr im e concealment action. The body ignited nearby brush and caused 200-acre fire. Photos courtesy of Mike Costleigh.

;', r

~L~

·i ~ -1 C.

22

"

Chapter 2: Wild land Arson Mot ives

Crime Concealment Arson: Several thousand-acre brush fire ignit ed by "torched" st olen vehicle. This fire burned for three days. From Ed Nordskog's case files.

The practice of intentionally burning range and wildland for the purpose of replenishment or management is hundreds of years old. In recent decades it has been deemed illegal by most governments, yet some ranchers/farmers still utilize this method covertly. A famous case in the United States of range management arsons occurred in 2012 with the convictions of Dwight and Steve Hammond, father and son, respectively, who lit several "management" fires on government owned range land.

In the mid-2000's, a video was circulating throughout the arson community after a spate of wildland fires in Colorado. The video was of a man who was a retired Air Force general, speaking in front of a legislative body. He was describing all of the unexplained Western wildfires as possibly related to terrorism. The man gave a compelling story to the audience describing how groups like Al Qaeda may have been igniting fires throughout the American West via incendiary devices. While no devices had ever been found, the speaker nonetheless suggested that it doesn't mean they weren't there. The authors of this book chased this rumor for months and queried all of our reliable sources in the wildland sector . During that time, and up until the present day, there is no tangible evidence whatsoever that any international terrorist group has ever committed arson in any North American wildland setting. It did not surprise us to learn that the speaker in that video had taken a job in retirement as a lobbyist for aircraft companies , and the subject of his speech was to ask legislatures for a lot of money to update the air tanker Beet used in firefighting. While it was for a noble cause, the speaker was clearly peddling

23

Arson Investigation in the Wi!d!ands

fear and bogus information to obtain his goals. We in the arson investigation business must remain professional and avoid politics and other such hyperbole. We need to operate with truth and facts. There are very few documented cases of extremists or terrorists resorting to wildland arson as a weapon or tactic. It has occurred occasionally during wars. The last incident similar to this is the hundreds of "balloon incendiaries" launched by the Japanese military at the United States in the latter half of WWII. These highly sophisticated items were comprised of mainly cheap and natural materials . They were timed to be set aloft so that air currents would carry them to the target area over a few weeks. The majority either did not make it to North America or did not function when they landed . A few of them did function and created several fires and a few deaths. The expected massive forest fires never materialized. In more recent years, a slew of incendiary attacks using wildfire as the weapon took place in Israel. In 2010, Israel authorities announced that Arab terrorists set wildfires within the country as a plan to burn over Jewish settlements and farms. These attacks caused a couple notable fires, but mostly failed due to a switch in the wind conditions. In 2018 and 2019, anti-Israeli demonstrators launched hundreds of "incendiary kites" and balloons. These items were launched across the Gaza strip by the hundreds and came to rest among cropland and brushland. Such actions gained a large amount of media attention and have been a true headache to Israeli authorities, but have yet to cause a catastrophic fire.

Juvenile arsons have always been a common motive. There are several sub-motives within the juvenile spectrum, and there is no clear definition or profile of a juvenile fire setter. Most investigators would agree that juvenile related wildfires are not always intentionally set to create massive events. Many of them could be experimental or pranks in nature that got out of hand. Each case needs to be looked at very carefully to determine possible intent.

From Ed Nordskog's case files.

Taken at a brush fire: Was an expended "bottl e ro cket".

24

Chapter 2: Wi ld land Arson Motives

The above photo on the left was taken at a brush fire in suburban neighborhood. The item was an expended "bottle rocket" firework. It was deemed the cause of this twenty-acre fire. Investigators canvassing the neighborhood uncovered information that several teen boys from a nearby home had been setting off fireworks the previous week. Law enforcement was called to the area due to fireworks complaints twice in the days prior to the fire. Arson investigators eventually contacted a fifteen -year-old boy and his mother. The investigators obtained an admission regarding the fireworks and subsequen tly searched the home. They found a box of unexpended bottle rockets (photo on right) and numero us other illegal fireworks. The boy named multiple other teens who had been with him and all of those males were contacted and interviewed . Subsequently, four teens were placed on probatio n and the ir parents were assessed fines exceeding $100,000.

25

Criminal Investigations are completely different from other fire department functions such as suppression, evacuations and rescue. Investigations should be completely separated from other fire department functions and should not be run under the standard Incident Command System method. Law enforcement in recent years has been inundated with new equipment, computer programs, technology and innovative ideas designed to enhance our investigative abilities. These modern marvels are nice additions to our arsenal, but should never fully replace time proven, traditional methods of criminal investigation. The authors recommend utilizing a blend of modern technology along with traditional investigative techniques for the best chance of success in any wildland investigation. Along with that, it is very helpful to add a bit of fieldcraft and outdoor skill to this special area of investigation. Lastly, arson investigators must realize that they can't possibly be an expert in everything. They must utilize the unique expertise and skillsets of many other subject matter experts, with the ultimate goal of identifying, capturing, and prosecuting an arsonist.

General Investigative Steps for Criminal Wildland Fires •

Ensure the Origin and Cause Investigation is conducted properly with a qualified scene investigator in a timely manner

•

Consult a Crime Analyst; research other similar fires

•

Maintain confidentiality and information security

•

Develop an investigat ive plan-Manage

•

Ensure all physical evid ence is taken to crime lab as soon as possible

•

Conduct interviews of 911 callers, first responders, any citizens in area

•

Conduct a canvass for witnesses, evidence , security cameras, etc.

•

Utilize rewards and Tip Lines if necessary

•

Maintain list of Leads, Tips, and Clues. Vet out each one and dear them

•

Identify and collect all media and video documentation

•

Consult a Profiler or Behavior Analyst

•

If appropriate, conduct surveillance operations

the case

to include videos, photos, etc.

Identify a suspect and conduct a detailed background analysis of that person, criminal history, social media, etc .

26

•

Make an arrest, conduct an interview/interrogation

of the suspect

•

Prepare search warrants for the suspect's home, work site, and vehicle

•

Document all activities via logs and notes

•

Prepare a detailed and formal report for entire event

•

Prepare the case for filing with a prosecutor and for court

•

Provide expert testimony

Chapter 3: Investigating a Cr iminal Fire

Wildland arson events are unique from other arsons in that they can involve several jurisdictions, all responding to and investigating the same fire. In any urban/rural interface, the fire can actually cross multiple jurisdictions within a single day. It is possible for a wildland fire to start in a local area of responsibility, move to a state or provincial responsible area, and on to a federal responsible area. The arsonists might not know whose juri sdiction they are setting their fire in. In some instan ces, there might be several investi gat ors from different agencies working the same event. This can be a nightmare or a blessing, depending on the investigators' abilities to work with each other . In many cases, the investi gat ion can be handl ed by a small number of investigators, even possibly one person. However, events that emerge into massive fires with a large loss of property or lives, along with most serial arson events, will likely require a fully-staffed Arson Task Force to properly investigate .

HollywoodArsonistTaskForce2012:was comprised of 400 per sonne l and commanded by a police Homici de Commander (right) . He became the "face of the investigation " and led all press conferences . By agreement, none of the arso n invest igators ever appeared on came ra . From Ed Nordskog 's case files .

Major criminal investigations should be commanded by an experienced law enforcement-type administrator. Historically, Arson Task Force investigations have been run by entities or persons who have very little experience in criminal investigations. Typically, in many jurisdictions, an arson task force is run by a fire department administrator of some sort. Critical analysis has shown that fire department supervisory and administrative officers have virtually no training or experience in criminal events. As such, while they may be very capable managers of other fire department operations, they are usually rather poor at managing the peculiarities of criminal investigations. It should be noted strongly here, that a criminal investigation is not at all like other fire department functions which are usually run via the Incident Command System (ICS).

All major arson investigations should be run with a certain level of covertness and a high degree of confidentiality.

27

Ars on Investigat ion in the Wi idla nds

CONFIDENTIAL MEMORANDUM May 19, 2000

TO:

StationCommanders,Battalion15

FROM:

BattalionCommanders, Battalion15

SUBJECT:

GRASS FIR.ES ALONG THE 118 FREEWAY

A patternof grassfires has developedalongthe 118 Freewaybetween Rocky Peak Road and Top anga Canyon Boulevard. During a period of

a year there have been 13 suspicious firesset on bothsidesof the freeway betweenthe two streets. Two of thesefireshave developedintogreater alarms. The majorityof the fires are set betweenthe hoursof 1500 to 1700 hourswith6 of them set rightaround1630 hours. Most have been set on hot,windydays, apparentlyin an attemptto get somethinggoinggood. Investigation compromised by poor information security: During a serial wildland arson investig ati on, the above "Confid enti al Memor andum" (portions have been r edacted) was stap led to a fir e stat ion bulletin board. A few days later a loca l offi cial who had seen th e memo contac t ed a pote nti al suspect in thi s event and told him to "stop lighting fir es as the investigat ors were going to put a surv eillan ce te am on you". He th en showed the suspect the "confid ential" memo. This inform ati on leak alert ed th e suspect, st alled a signifi cant investi gati on for four month s, and caused th e suspect t o discard evidence linking him t o multipl e fir e scenes. From Ed Nordskog 's case files.

A very common issue with any task force investigating a major event is the "leaking" of confidential, case sensitive information. Leaks can be accidental or deliberate in nature, and can have disastrous consequences for the prosecution of a possible suspect. Great efforts must be put in place to safeguard critical information concerning evidence, dues, tactics, and potential suspects during every major investigation. One of the or iginal FBI/USPS studies involving wildland serial arsonists in 2003 identified a common complaint that marred many investigations . The investigators polled for the study had overwhelmingly stated that their investigations had been comprom ised at some point by information leaked to other firefighters, the media or even the general public. (Source : Serial Wildland Arson Analysis- Kevin Kelm.) One of the more famous serial arson cases in U.S . history, the DC Serial Arsonist investigation in 2003, was plagued multiple times by persons deliberately leaking sensitive case information to reporters. A "leaker" gave such specific d etails about the arsonist's incend iary device to the media that a local reporter re-created and burned the device on television . (Source : Robert Luckett.) If possible, all arson task for ce operations should be headquartered at a site away from other fire depa rtm ent an d law enfo rcemen t pe rson n el. A work in g fire station is n ever a good choice for a task force headquarters . The task force HQ shou ld be secu red, private and accessible to task force personnel only. The task force headquarters should be equipped with law enforcement type computers and communications systems. Obviously, it should also have standard creature comforts and safe work spaces. 28

Chapter 3: Investigating a Criminal Fire

A Task Force is no place for Emergency Tourism. You are either an important, working part of the task force, or you will be sent home.

Investigative Task Force Personne l Historically, task forces set up to investigate major events have brought out volunteers interested only in fame, overtime, shirking their regular duties, or thrill seekers who want to pretend they are some sort of cloak and dagger "op erator". In contrast, the "best " per sons to have on a task force are defined by their ability to think, compl ete tasks, follow orders, and by their experience and skill in the roles which they will assume. Arson task forces can be as small as thre e or four person s or can be as large as several hundred people, based on the task at hand. Below is a list of potential positions to fill on a major event task force . Task Force Administrator or Manager: This person would not normally be an investigator, but some sort of mid -level manager who can oversee the fiscal and manpower needs of the investigation. This person would be in constant conta ct with the commander of the task force. Task Force Commander: A person with significant experience in criminal investigations. This person needs to be of sufficient rank to successfully deal with other law enforcement and fire administrators. This person would be the "face of the investigat ion'', and is often the person who keeps the executive staff informed (as needed), gives media briefings, and answers questions by local political bodies. Lead Investigator: Experienced arson investigator actually overseeing the investigation and making all final decisions on tactics, methods, etc. This person has to be keenly aware of every facet of the investigation and all evidence, clues, leads, tasks, and potential suspects. Origin and Cause Investigators: If the event is an ongoing arson series, it is best to use the same expert(s) to conduct Origin and Cause examinations at every fire scene so as to maintain a uniform and systematic method of investigation and reporting. These persons must be properly trained and certified in Wildland Fire Scene Investigation. Task Force Officers: Other investigators will be assigned to general investigative duties and other specific tasks within the overall investigation. Persons selected for the task force should have sufficient experience to conduct witness interviews, conduct area "canvass" operations, fill out "clue sheets" and tip cards, and engage in general investigative duties. Prosecutor: From the onset, a prosecutor should be brought into any major investigation. The prosecutor could act as legal advisor, but should not normally make investigative or tactical decisions. Specialists: At various times, the task force will require the services of persons with a high degree of skill in a unique specialty. Some of those unique specialties are listed: Crime Analyst - Gathers data, creates geo-mapping and temporal charts of events; looks for trends, patterns, etc. Queries neighboring agencies for related events Surveillance Specialists/Undercover

Operators-Profe

ssionals brought in from law

29

Arson Investigation in the Wildlands

enforcement agencies to conduct all surveillance and undercover ops including mobile, static, aerial, trash runs, etc.

Technical Crew-Installs Digital Expert-Used searches

cameras and trackers on suspect's vehicles, etc. to conduct

social media investigations,

computer/phone

Profiler/Analyst -Highly experienced expert who can offer behavioral analysis advice , interview strategies, media strategies, pattern analysis, etc. Incendiary Device Expert-Highly experienced person who can examine devices for analysis purposes; profiling, patterns, etc. CSI Experts-Specialists to aid Origin and Cause investigators in collecting non-fire related items such as impression evidence, incendiary devices, hairs/fibers, and other physical evidence Tactical Tracker-Interprets impressions at crime scene , can link a suspect or vehicle to a crime scene

Investigative Tactics and Case Building Homicide Detectives never catch the suspect in the act of committing murder. Instead they routinely solve cases by processing crime scenes, exploiting forensic evidence, interviewing witnesses, and engaging in a systematic case building process. The authors have reviewed hundreds of case histories of serial and wildland arson investigations. Based on this, it seems that the primary investigative tactic used in past cases was to set up some sort of surveillance operation in hopes of catching the arsonist setting a fire. This method has had enough success in the past that it is still the most common tactic used today. However, in reality surveillance operations are a tremendous drain on manpower and resources, and actually have a very poor overall success rate. While we are not completely against the use of surveillance tactics, there is so much more work that should be done prior to employing costly surveillance techniques. Following the time-proven methods of successful Homicide Detectives, wildland arson investigators need to adopt a blend of traditional investigative tactics with a few more modern techniques added to the mix. This overall method is called case building.

Case Building Techniques: Below is a list of some successful strategies that will be discussed throughout this book: •

Scene work (Origin and Cause)

•

Physical Evidence Recovery/Exploitation

•

Exploitation and Analysis of Incendiary Devices

•

Bloodhounds, Interviews

•

30

Area Canvass

Scent Dogs, Tactical Trackers

Chapter 3: Investigating a Criminal Fire

•

Search for Cameras in Area

•

Crime Analysis for related cases, historical review, mapping Pattern Analysis (Temporal, GeoSpatial, other patterns)

•

Saturation Patrol Techniques

•

Clues, Tips, and Leads-Tip

•

Analysis and Profiling Techniques (Victim, Device, potential suspects, etc.)

•

Tactical Media Conferences: release sketch, vehicle description, etc.

•

Suspect development

•

Social Media Investigation

•

Cell Phone and Computer Searches

•

Surveillance, Electronic Tracking Operations

•

Search Warrants

•

Arrest/Interrogation/Interview

Lines, Wanted Posters, etc .

Post Arrest Investigations: jail operations, etc.

Historical Cases to review by the Ar son Task Force Once a suspicious fir e or seri es of fir es is r ecogn ized, local investigators will begin to confirm that they have an actual seria l arsonist on their hands. This is done thr ough case linkage techniques discussed in Chapter 8. Seasoned arson investigators understand that it is quite possible, and even probable that the arsonist has set fires prior to these events, and possibly throughout his life. The goal of any serial arson investigation is to charge the arsonist with every fire he has set, not just the current fires. Arson investigators should contact all fire officers in the area and query them about recent, unexplained fires, including those that have been listed as "accidental". Once a series of fires is recognized, investigators, through the use of a skilled crime analyst, should conduct queries into neighboring jurisdictions for any similar, suspicious fires that have occurred in the past few months or even years . In many cases, arsonists and other serial criminals are not concerned or even aware of geographical boundaries. It is common to find serial criminals of all types frequently crossing into other jurisdictions. It is also recognized that wildland arsonists tend to be seasonal in nature and their fire setting can span years and even decades. This sort of inquiry should be done quietly and with great discretion. The crime analyst will connect with other agencies and identify any fires that even remotely resemble the current series . Then , one of the arson investigators will fully review these earlier fires and confirm whether they are part of the series, not part of the series, or possibly connected to the series. Studies have shown that police/fire agencies seldom recognize that they have a serial arsonist in the area until th e arsonist has set around ten or mor e fires. There are case histories to show that arsonists have set up to hundreds of fires prior to being recognized or caugh t. It is highly likely that a historical review of suspiciou s fires will fin d addi tiona l events lin ked to a cur rent series or a potential suspect . All additional fires identified through this method will be plotted on a map and an analyst/investigator/ profiler will assess this information through various pattern analyses.

31

Arson Investigation in the Wildlands

After investigators have identified possible cases or earlier fires related to the suspect or the present series, they must obtain copies of the case files or reports from those fires. The original investigators should be contacted and interviewed about the previous incident. If there are no case files or reports, the current investigators may have to re-create that investigation by visiting the scene, taking photos (even months later), interviewing witnesses and first responders, and amassing agency information. Some of these previous fires may have been classified as something other than "arson". A case analyst will then closely read all of this information and look for any links to the current case (link analysis). If sufficient evidence is located, then the "old" case can be added to the current investigation.

Many arson cases start with a patrol officer or even a firefighter contacting eyewitnesses and getting an initial statement. Trained investigators will review all reports for the case(s) and then go out and reinterview any critical witnesses. The investigators will clear up mistakes or omissions from the original reports , and extract highly detailed information from the witnesses. At some point the investigators may show the witnesses photos to identify. Persons to contact and re-interview include the 911 caller, any persons who saw suspicious activity, the first fire units on scene, and any FD personnel who found evidence or devices at the scene. The investigators must also confirm that they have accurate names and contact information for each witness.

If a person proves to be a key witness, they need to be re-interviewed in exacting detail. It is highly recommended that you physically take the witness to the location where they observed the arson incident. Can you verify what they saw from the location? Take a photograph /video of their viewpoint of the incident. It is a good strategy to film them as they describe what they saw during the incident. It has been learned from past cases that some "witnesses" are actually the suspect inserting themselves into the invest igation. It is a good idea to get a clothing description of the "witness" for the day of the fire, in case they later turn out to be a suspect in the case.

A series of nine wildland arson fires struck a small rural town around midnight, during "red flag" fire conditions. Three fires were started on one side of town; then a few minutes later, three more fires were set on the complete opposite side of town about three miles away from the original three fires. Finally, several minutes after that, the final three fires were set in a hilly area within the town. The town had only a single main roadway that passed through it, and all fires were within ten feet of this same roadway. The arson investigators located white books of matches at the three clusters of fires. The local firefighters reported an odd fact to investigators the next morning. While driving to the scene of the first set of fires around midnight, the fire crews passed a group of people flying remote control airplanes. This seemed like fairly odd behavior in the middle of the night. A canvass of the small town by investigators helped to locate these nighttime aviators (witnesses). These witnesses reported that almost nobody was out and about at these hours. However, around midnight they spotted a blue-green Volvo station wagon "with shiny wheels" speeding by with its lights out. A few minutes later, the same car sped by in the other direction. Shortly after that the first set of fires

32

Chapter 3: Investigating a Criminal Fire

was reported. The witnesses saw the car speed by a few more times over the next half hour. A different eyewitness was identified the day after the fires and stated that a local man was drunk in the only bar in town, and left around midnight, driving a blue-green Volvo station wagon. He had sped out of the bar parking lot with his lights out. This second witness stated that the male, known as "Ricky" sped by several more times over the next half hour. Investigators identified "Ricky" and ran a records check. Ricky was a lifetime serial arsonist who had three prior convictions for arson, including one for a series of twenty-five fires. He lived in the middle of town less than fifty yards from the final three fires in the overnight arson spree. Investigators went to Ricky's house and photographed the below vehicle in his driveway. Vehicle belonging to Ricky the Arsonist.

Investigators confirmed by computer that this vehicle was in fact registered to Ricky the arsonist. Additionally, they confirmed that it was the only car like this in the small rural town. Investigators showed the photo of the vehicle to multiple witnesses and solicited their comments . In the above photo a witness wrote, "Yes: look's like it", and then signed the image. Other witnesses also confirmed that the photo was "The car I saw". While none of the witnesses could see the driver in the car, nor did they copy a license plate number, the car was of such a distinct type, model, color and year that their eyewitness accounts were deemed credible. Investigators contacted the eyewitness at the bar and confirmed that the bar actually handed out free books of matches to customers. The matches in the ba r were all in plain white matchbooks. They were linked to the evidence found at the arson scenes (next photo).

33

Arson Investigation in the \J\Jildlands

MATGH COMPARISON

SCENE "C"

CROSSROADS BAR

SCENE "H" The link analysis factors in this case are many. The fires were all started in the same small area, within a half hour of each other, with the same ignition scenario. Witnesses had spotted a distinctive vehicle acting suspiciously at the time of the fires. The only vehicle in town that matched that description belonged to a lifetime serial arsonist. The arsonist lived within fifty yards of the final three fires of the spree. The arsonist had access in the bar to the same type matchbooks recovered at the fire scenes, and was seen entering his vehicle after drinking heavily, in the same time frame of the fires.

The arsonist in this above case was confronted with the evidence and witness statements, and subsequently confessed. He was convicted and sent to prison. Case history and photos courtesy of Rick Velazquez.

In the modern world, virtually everyone has a cell phone with a high-quality camera/video capability. People are obsessed with documenting anything and everything that goes on around them. Because of this, and by being diligent and polite, investigators can often recover important evidence that had been captured by citizen bystanders. Investigators should handle this with diplomacy as some people can be reluctant to give law enforcement access to their phones.

34

Chapter 3: I nvestigating a Crimin al Fire

In the following case history, arson investigators were particularly lucky to have the eyewitness to the event be a retired fire captain and a professional photographer. His ability to capture evidence and later testify at trial resulted in a conviction of a dangerous spree wildland arsonist. The eyewitness, with another professional photographer, saw the smoke from a brush fire erupt in a dry, grassland area in California. The duo sped to the scene and saw a lone male standing directly next to a small fire. They noted that there were several other fires burning at exactly the same time in this same area. They began to photo document his activities and summoned the fire department. The male eventually ran from the photographers into a large grass and brush area. He was seen to reach down multiple times and each time a fire erupted where he had reached down to the ground. The male then ran into the flames and at one point laid down in the grass as fires burned all around him. Eventually, when the fire department arrived, the bizarrely acting male came out and "surrendered" to them. He was found raving and ranting and eventually arrested for eight arson fires. Arson investigators collected the photos from the photographers and enhanced them. The enhanced photos show the arsonist to be carrying a white plastic butane cigarette lighter in his hand. This was important because that item had not been recovered when the suspect was arrested. The suspect was eventually convicted, but then found "insane." He was sent to a psychiatric prison hospital.

Suspect standing near fires. Enhanced image shows white cigarette lighter in his right hand .

35

Arson Investigat ion in the Wildlands

Suspect, prior to starting another fire, picks up the lighter off the ground. Suspect lying down with lighter next to him.

36

Chapter 3: Investigating a Criminal Fire

,Ill Verizon LTE

5:16 PM

@ --;

i signalscv.com

1•

=-

Case Results: In vesti gator s should put th eir best case for w ard, and not be overly upset or co ncern ed about what happen s in court. Case history and photos cou r tesy of Jeff Zimm erm an and Rob Harris .

Brush fire arsonist deemed insane at time of 2016 firesetting Old fashioned police work, including a "neighborhood canvass" is a reliable and time proven method of criminal inv estigation. Typi cally, a neighborhood canvass in the urban /suburban setting is a simple, yet tedious process . Teams of investigators literally go out on the street and knock on every single door of a residence within the area of the crime, or near where some significant evidence related to the crime was discovered. The investigators will identify each person they spoke with, and ask them if they heard or saw anything related to the event, or out of the ordinary . The investigators will then note those details in a "canvass sheet", which is an informal document for the canvass operation. It is also just as important for investigators to log the identification of persons who did not observe anything, so as to eliminate them from future contacts. Each canvass sheet is then added to the main case file in a document called a "canvass log." A canvass in rural areas is conducted the same way, but with the understanding that very few people actually reside in the wildlands. The investigators will need to have a bit of knowledge about local activities and industries. For instance, if the area is known for hunting, and the fire occurred during hunting season, the investigators may need to check with game wardens and state hunting agencies who issue licenses for that particular area. Another good tactic is to stop at local convenience stores and restaurants to find out what work crews may be operating in the area such as loggers, road repair crews, utility workers , etc.

37

Arson Investigatio,~1in the Wildlands

)OE Robbery-Homicide Division

HOr{eardonly

CANVASSLOG NAflJa nswer SSIGNED: _ __

_

V v~~ rt,Vtinoccup it

HUNDREDBLOCKOF

z bJ~t(ot seehi_e ar NTHE

,, SIDEOF THE STREETBETWEEN

DATE

TIME

ADDRESS/STREET

g~'-1lf

~11..voo

·

Vt L"< l,O C i 53&- cft-s1wOJD /.kc...-c'iwo oO c+ qoo-

•

24,

19 8 9_

CONTACT:

Doug Allen, Division Law Enforcement (714) 782-4140

DISTRIBUTION:

Fire

SECURITY:

Confidential

TOPIC:

Wildland

DESCRIPTION:

Paper matchbook with the cover removed. A cigarette is placed in a vertical position and the matches are rolled around the cigarette. The device is h~ld together with · plastic coated wire (va+ious colors) either by 1/ tying a kn ot around the matches and leaving the wire ends sticking out to the sides several inches, or 2/ wrapping the wire around the matchbook and twisting the ends t ogether.

NOTE:

Several of these devices Riverside, San Bernardino

REQUEST:

Anyone locating this device above listed investigator.

,; · , -;v--. h ,~1'

March

. .,

H

Chief

and Law Enforcement

Agencies

- NOT FOR RELEASE Incendiary

Device

have been located and Orange Counties. should

contact

in the

•

-

:~ _-'~

Image from Los Angeles Sheriff's Arson-E xplosives Detail archives.

63

Arson Investigation in the Wildlands

Finding an incendiary device at the scene of a wild land arson is a major br eak in the inv estigation and should be handled by the most careful method po ssible. The device can hold criti cal for ensic informati on and can be the key item to link the offender to the fire and to other fires in a series. The d evice can also tell the investigators a significant amount of information about the offender. It can give clues as to the offender's tra ining, experience, and level of sophisticat ion . Typically, an incendiary device is found by either a memb er of the fire suppre ssion team, or later by a member of the Origin and Cause team. The very first thing to do when a device is discovered is to prot ect it! Burned incendiary devices tend to be very fragil e. They should be protected from the elements, from further suppression activity, and from th e eyes of anyone not on the investigative team. If at all possible, the device should not be m oved un til fully doc ume nted . Experts mu st be summ oned imme diately to document and recover the devi ce, and to conduct a detailed search for additional devi ces.

Device Protection: A fir e suppr ession ca ptain locat ed an incendiary device (in yellow box) at th e scene of a w ildland arson fir e. The captain w isely pr otected th e device by placing his helmet over th e ite m until invest igat ors arri ved. The helmet was moved for thi s photo.

A negati ve co nsequence of th e above acti on is th e fact th at th e fir e helmet cont ains th e hair and DNA of th e fir e captain, w hich wo uld likely creat e co nt amin ati on issues fo r th e device. A sampl e fr om th e fir e capt ain wo uld be needed to elimin at e his DNA on th e device. Courte sy of Rick Velazquez.

Through the review of hund reds of cases, the authors have noted that many investigato rs fail to properly describe a device within their investigative reports. Devices of all types are technical items and need a highly detailed and accurate description. This assists later analysis by other experts. A common description found

64

Chapter 4: Incendiary Devices in Wild land Arson Cases

in many past reports was as follows: ''A cigarette / matchbook device was found in the area of origin". This description is non-technical, vague and tells the reader/analyst almost nothing about the device. I

I

I

~

EVIDENCE/ »JlOPDft

IHl'ORMM?ION

Dt?scription

E

1 (one)match-bookdevice

This phot o is a descripti on fr om th e actu al ar son r eport. It is not det ailed enough.

A re-creation of th e device referr ed to in the report. Both ph otos court esy of Ed Nord skog.

The previous description of "one match-book device" is simply not adequate enough to describe this critical piece of evidence. A better description would be: Unburned cigarette/matchbook incendiary device, time delay, with a blue paper matchbook, «Signature Home" brand, containing 20 red tipped matches, with an unburned Marlboro Red brand filtered cigarette lying across the matchheads (layover style), and the matchbook cover closed over the cigarette, with three inches of black electrical tape as binding material for the device. The item appeared to have been hand-placed by unknown persons into dry vegetation approximately two feet from the edge of the dirt road. This device failed to function, and wasfound by firefighters responding to an adjacent fire scene.

Typically, incendi ary devices of any type are broken down int o the following categories: •

Hand Placed Remotely Delivered, Thrown, Launched, Projected

•

Time Delay

65

•

C ommand op erated (very rare)

•

V ictim op erate d (very rare)

Remotely Launched Device: An arsonist used a legal co mm er cial pr oduct, thi s rescue fl ar e pistol, t o st art mult iple bru sh fir es. Courtes y of Los Angeles Sheriff 's Ar son-E xplosives Detail .

Device Components include: •

Delay, timing mechanism, (fuse)

•

Initiator material

•

Main fuel

•

Binding materials: tape, wire, string, glue, etc.

•

Enhancements:

•

Packaging materials

explosive powders, fireworks, extra fuel, etc.

Components of devices that invo lve electronics: (It should be stressed that in cases other than extremist related arson attacks, electri c/ electronic incendiary d evices are extremely rare ) •

Power Source

•

Wiring, conductor

•

Swit ch , timer Initiator

66

•

Main fuel

•

Enhancements;

~

External containers

•

Bindin g materials

explosives, fragmentation,

etc.

Chapter 4: Incendiary Devices in Wild land Arson Cases

Incendiary Device photos and inform ation are highly sensitive and should be shared only with persons who have a need-to-know. This would include the Origin and Cause investigators , Lead Investigators, crime lab technicians/photographers, Profilers/Analysts, and Prosecutor. After a device is found at a scene, the investigators must take steps necessary to ensure that the discovery is kept confidential . Any firefighters who found, saw, or even photographed the item need to be identified, interviewed, and then admonished about disclosing any information about the device. The firefighters must turn over all photo documentation of the device, and must agree not to discuss or post/ forward photos of the device to anyone, including other firefighters. These safeguards will ensure that the sensitive information is not released to the public, and in turn will limit the chances of a copycat arsonist. Persons who do not have the need-to-know about devices or other case sensitive information include non-involved fire and police personnel, police and fire supervisors /administrators, the media, and the general public. Leaking this information to any of these people can, and usually does jeopardize the prosecution of the case. The following steps are recommended with every incendiary device: By Sce ne Inve stigator:

•

Protect in place; delayer the vegetation around the device

•

Photograph in great detail prior to moving, and during movement / collection

•

Describe the device and components in exact detail in a report

•

Draw / sketch the device and components if possible

•

Collect in the least traumatic method possible

•

Package in manner to protect the device: cotton balls, soft foam, etc., avoid metal cans

•

Begin a chain of custody documentation

•

Transport device to crime lab at earliest opportunity

•

Lead Investigator should maintain direct communication

from scene to the crime lab with crime lab experts

By Crime Lab Experts:

•

Photo device at crime lab intake, and during every step of forensic process

•

Carefully separate all device components; identify each

•

Take enhanced studio photos of each component; use microscope if necessary

•

Collect forensic material from device: fingerprints, DNA, glue, fibers, hair, etc.

•

Identify brand name materials such as cigarettes, matchbook brand, tape brand, etc.

•

Lab expert should attempt to find /purchase original device materials and construct a clone device

•

Clone device should be photographed

next to burned device: component by component,

then in total Lab expert should contact Lead Inve stigator as soon as possible, and share all preliminary lab findings, so as to further the inv estigation on the street •

All lab photos, notes, and forensic results should be returned to Lead Investigator as soon as possible

•

Original device shall be returned to investigators and maintained in evidence lockers

67

/\rson Investigation in the Wildlands

Foll ow up work on Devices:

•

Investigators should att empt to locate th e sourc e of the mat erials used in th e device

•

Investigators should make several "clones" of the devices and test them in conditions close to actual scene conditions (if safely possible)

•

All testing should be photographed,

filmed, and docum ented, including failed devic es

•

Lead Investigators should consult a device expert /analyst and show them all lab results, clear photos of the device and its components, along with test results

•

The device should be compared with all other devices found in area, or during a series

•

Neighboring jurisdictions should be queried regarding similar items (do not divulg e exact specifics of the device, just a general description)

•

Device photos and results will remain confidential until presented in court

If a suspect is identified:

• •

Home, work, and vehicle need to be searched for devices or component materials Suspect's computer should be searched for sources of information

• •

His property should be searched for indications of device testing (burn scars, marks, etc.)

•

His trash should be search for discarded packaging materials, receipts, device components, etc .

• •

His credit / debit cards should be searched for purchases of device components Attempts should be made to identify his training, education, experience regarding devices

•

A court order for the suspect's DNA and fingerprints should be obtained

His phone should be searched for photos of devices, testing, or research

Cigarette/Matchbook Delay: Heavily burn ed device as part of a w ildland arson seri es. Photo t aken befor e device r ecovery. Court esy of Joe Kon efal .

68

Chapter 4: Incendia ry Devices in Wild land Arson Cases

Describing Device Components: Cigarette, Camel filtered, partially burned, time delay; oriented across the tops of the matchheads.

Matchbook containing twenty paper matches with white match heads (unburned), Winsto n brand matchbook . Four inches of tan masking t ape used as binding material. Courtesy of John Ament.

Studio Photos at Crim e Lab: (Two above photos) Device is photographed as it arr ives at lab, and then as experts begin to separate components and collect forensic material. This device w ill be technically described as follows: Delay Incendiary Device, consisting of a white/tan paper matchbook with cover (no advertising}, and a single, Camel brand, filtered cigarette as the delay. The lit cigarette is lying horizontally across the match heads w ithin the book, the cover was closed over the cigar ette, and approximately five inches of masking tape was used to bind the item together. The cigarette was lit by persons unknown; the device was hand thr ow n into dry vegetation, but only two of the matches functioned, and the device self-ext ingui shed .

Studio Photos at Crime Lab: This third photo depicts some of the seventeen devices found in the ser ies. While all are slightly different, they share several linking traits. From Ed Nordskog 's case files.

69

Arson Investiga t ion in the Wiidlands

The previous four photos show some of the seventeen delay incendiary devices involved in a series of wildland arson fires which occurred over three weeks in the same geographic area. The devices had a mixed rate of success as several of them failed to ignite fires. The devices were all thrown from a vehicle into dry, roadside vegetation. Responding firefighters found many of the failed items. The arsonist was tossing out two or three devices at each fire. His failure rate was quite high in that he threw the devices into very sparse vegetation. Sixteen of the seventeen devices actually functioned as designed, but around half did not start a vegetation fire as they did not land close enough to the brush. Using link analysis for the above case, the fires were linked by their close time frame (three-week period), their close geographical area (all within about five miles of each other), the use of similar components, (Camel cigarettes, matchbooks, and tape as a binder). Some of the matchbooks were related to a hotel in the same area of the fires. All fires occurred between noon and 1500 hours on a weekday. Some investigators might note the differences in the brand of matchbooks and the type of tape used. Additionally, in one case the cigarette brand changed as well. However, those are minor variations in the overall M.O. At close inspection, investigators will note that the taping pattern and amount of tape used remains consistent throughout the devices, as does the area on the device where the tape is applied. It is clear that the same arsonist created all of these devices and lit all of the fires in the series.

It is vital that high quality studio photos be taken of any devices at the crime labs. These photos will show the original device, all its components, and then a compa rison of the original with an exemplar clone or mock -up device. The below photo is the original burned device, next to a photo of an unburned example of one of its components.

The original burned device, next to a photo of an ~ ~. unburned example of one of its components. Courtesy of Ed Nordskog.

70

Chapter 4: Incendiary Devices in Wild/and Arson Cases

Burned cig/matchbook device at crime lab. Matchbook is closed in left photo, open in ri ght photo. Remnants of cigarette st ill present. Courtesy Ed Nordskog .

407 -00273-3310-9 9 J653177 Lab Photos:Highly det ailed w ith measur ements, et c. From

item 006 Ed Nordskog 's case files .

So that an exp ert can provide accurate testimony regarding the viability and capabilities of an incendiary device, the expert must reconstruct and test the device multiple times in conditions as close to the true event as is safely possible. This entire process should be captured by photos, video and through a written report. Investigators need to document the weather conditions, fuel conditions, slope of land, and any time delay measurements. Device failures should be documented as well.

71

,

/';rcrin 11

VV

l

i

Tn,, ✓ 8S1..ICatinn. t' · •,n th o \ A/ ;jfi l..-. ~' V 1.. ,v, ,1111.. ••v vl/,u,uno s

.LI

Device Testing: Photo taken from video of a "bundl " t . . matches, all facing the same direction surrounding efil~ yledd~v1cebeing tested. Item is described as 11wood band as binding material. Courtesy of Ed,Nordsko a ere arlboro 100 Light cigarette, with a yellow rubber g,

. The following four Ph otos d ocument the testin of a . 1 f; hg smg e clone/ exemplar mcendiary device. This sort of documentation and testing is ne cessary or t e expert to prove their methodology , · c,u,i,,y ,fjM K,u,fal.

Cigarettewith rw,,, matohes attachedby a 1,ie.ce, of (duct) ta e 72

.Arson Investigation in the Wi!d!ands

"Wherever he steps, whatever he touches, whatever he leaves, even unconsciously, will serve as a silent witness against him. Not only his fingerprints or his footprints, but his hair, the fibers from his clothes, the glass he breaks, the tool mark he leaves, the paint he scratches, the blood or semen he deposits or collects. All of these and more , bear mute witness against him. This is evidence that does not forget. It is not confused by the excitement of the moment. It is not absent because human witnesses are. It is factual evidence. Physical evidence cannot be wrong, it cannot perjure itself , it cannot be wholly absent. Only human failure to find it, study and understand it, can diminish its value."-A detailed explanation of Locard's Exchange Principle by Dr. Paul L. Kirk, Criminalist and original author of Kirk's Fire Investigation An eyewitness is an excellent piece of evidence for any criminal case. In any wildland arson event, the investigator will be lucky to get some sort of eyewitness. However, there are numerous issues to conside r with eyewitnesses: Are they lying or exaggerating? Are they mistaken? Do they have a bias? Do they have poor eyesight or a bad memory? Are they under the influence of drugs or alcohol? Do they have a criminal record that might affect their credibility?

Eyewitness Testimony: A motorist observed a lone male suspect shoot ing a "Roman Candle firework" from his

moving vehicle, into the dry brush, late at night. A license plate was observed and the suspect was arrested two days later. From Ed Nordskog's case files.

74

Chapter 5: Wild land Arson Physical Evidence

Physical evidence, however is always better than an eyewitness. It doesn't lie, (but can be interpreted incorrectly) and it can't be biased in court. Physical evidence can bolster a weak witness, link a suspect to a crime scene, or can help exonerate an innocent person. Physical evidence helps identify the sophistication level of the suspect, can link a suspect to a vehicle, and a vehicle or a suspect to multiple crime scenes. Every effort should be made to identify and collect in a proper manner any and all physical evidence in a wildland arson case. It is recognized that physical evidence at a wildland arson scene will not be as plentiful as at other arson scenes. In many cases suspects seldom need to bring accelerants to an outdoor scene as the vegetation is typically ready to ignite. There are very few security or surveillance cameras in the wildlands, as compared to an urban setting. Cell phone mapping is greatly limited in the wildland because of vast distances between cell towers. Despite these challenges, there is still significant information and physical evidence that can be gleaned from most wildland arson scenes.

A wildland arson investigator cannot be an expert at everything. But the investigator does need to have working relationships with the many experts required to properly process a crime scene. In the case of identifying and collecting physical evidence at any major outdoor scene, qualified/ certified Crime Scene Investigators (CSI) should be brought in to assist the arson investigators. Arson investigators and CSI personnel need to work side by side during this process, as each can give the other expert advice and direction .

These two photos: Depict where a seria l arsonist ignited a fire along a rural roadway. Investigators found a "gr ound bloom flower" firework that had been hand thrown from a passing vehicle. The fire burned over 100 acres and threatened severa l ranch properties. Photos courtesy of Los Angeles Sheriff's Arson-Explosives Detail .

Once the Origin and Cause investigation has been completed and the incident ruled "incendiary," then the scene investigators need to begin a detailed search for any possible evidence. It should be done near the origin, at the closest roadway near the origin, and any natural paths, walkways, chokepoints, gates, fences, or access areas near the origin. The investigators need to look at the scene "through the eyes of the arsonist" and attempt to find where the offender parked their vehicle, exited their vehicle , arranged materials, fled the scene, etc. The scene conditions and ignition scenario will determine what evidence may be present.

75

,L\rson Investigation in the Wildlands

An outdoor arson scene offers the opportunity to utilize specially trained K-9's in multiple roles . There are at least two types of K-9's that may prove useful to the wildland arson investigator: the Accelerant Detection Canine, and the Scent Tracking (bloodhound) Canine . A strong word of caution for using any canine: All dogs and their handlers, can and do make mistakes, fail, get tired, or are not adequately trained for a specific task. The use of canines is a nice investigative tool for case building, but it should not be considered definitive proof in any case, and should never be relied on solely as the basis for an arrest. It is best used to point the investigators in the right direction. It is imperative that both the dogs and the dog handlers have the proper, documented training and certification for the task at hand .

Accelerant Detection K-9: Alerting by sitting at site of ignitable liquid residue (ILR) in a Canadian forest. Courtesy of Jeff Henricks .

78

Arson Investigation in the Wildlands

warrants of the suspect's home, phone, vehicle, etc., should be examined and then followed up on as necessary. The investigation can continue all the way through the court process as new information is learned. At some point the suspect's Defense team may provide information or new witnesses through the Discovery process. The original case investigators will then need to follow up on all of that information as well.

In certain cases, highly skilled investigators have initiated various investigations while the suspect is in custody. These include undercover operations, monitoring jail / custodial phone calls, and monitoring the communications of co-conspirators either in custody or out on the street. These jail investigations are incredibly delicate in a legal sense, and are typically only conducted by very experienced investigators, often with the advice of the prosecutor. If an arson investigator is interested in this sort of tactic, the investigator should consult the prosecutor, jail officials, and a seasoned investigator with experience in these operations.

60

Author s' note: The authors of this book were involved in writing and editing a book published in 2019 entitl ed Inc endiary Devices-Investigation and Analysis. That book took an in-depth look at all types of incendiary devices, with a specific chapter dedicated to incendiary devices found during wildland arson investig ation s. Within that book w as an entire chapter devoted to the forensic exploitation and analysis of incendiary devices in an ar son attack , along with devices involved in a seri es of ar son att acks. This book on wildland arson investi gation will not att empt to r e-writ e th e earli er book on incendiary devices. Incendiary Devices are extremely rare in any arson event. If one is found it should be treated like gold, as it is the key to the suspect and the case.

General Definition of an Incendiary Device An "incendiary device" is a general term of art within the arson /bomb commun ity given to any purposefu l improvised arrangement of materials designed to speed up the growth of fire, remotely start a fire, unnaturally spread fire through a scene, or delay the start of a fire. There are many types and styles of incendiary devices, and thei r design is only lim ited by the training, imag inat ion and skills of the arsonist or device builder. While incendiary devices are quite rare in all arson attacks, they are more common in wildland arson cases than in most othe r arson scena rios (with the exception of extremist arsons). It shou ld be noted that an additional catego ry of arson attacks where devices can be found is any arson attack involving a firefighter arsonist. So, mathematically speaking, any wildland arson event involving a firefight er arsonis t is more likely to invol ve the use of an incendia ry device. An in - depth study of this subject dete rm ine d this staggering and sad fact: If an incendiary device is used during a wildla nd arson series, then the re is more than a 40% chance that the offender is related to the fire service in some manner . Source: Incendiary D evices- Investigation and A nalysis by Ed N ordskog.

Devic e use of any type is typically "learned behavior". Mo st people are not born knowing how to build and use an in cendiary device. They must learn that information from some other source. Most devi ce-building information can be tracked back to the offender being taught by a father, or during camping, scouting activities, military training, fire department training, or through expe rimentat ion with information found in manuals or online. Device use is mostly male behavior with very few known case histories of females who have been docum ented building incendiary devices in a wildland setting.

61

Chapter 5: Wildland Arson Physical Evidence

These dogs are specifically trained to detect ignitable liquid residues (ILR's) and have been used successfully many times in past arson cases. However, if the dog alerts on a suspected ILR, samples must be taken and sent to an approved lab . If the lab does not confirm the presence of ILR's in the samples, then the investigators should not consider the positive alert by the dog as reliable evidence. ADC's are seldom used in western North American wildfire investigations as an accelerant is totally unnecessary in these dry areas to start a fire. However, the use of these dogs is more common in northern boreal forests and wetter climates where wildland arsonists are more apt to use an accelerant at outdoor scenes.

The use of scent tracking dogs has proved highly successful in past cases involving missing persons, escaped fugitives, police manhunts, and at homicide scenes. The appli cation of this type of an asset as a case building tool in arson investigations has been somewhat limited. However, there have been several documented arson cases where these dogs proved reliable and greatly assisted the investigators. The dogs have been able to lead arson investigators to potential suspects, suspect vehicles, eviden ce left at the scene, and even to the nearby homes of suspects . Again, the use of these dogs alone is not dear scientific proof, but it can be a valuable investigative tool. An excellent use of these types of dogs is to combine their work with that of a Tactical Tracking Team (man trackers), along with CSI experts. These unique assets can find the trail of a potential suspect and follow that trail for a distance. They can combine to discover tangible forensic evidence in the form of footwear impressions, hairs / fibers and other materials left along the trail, and possibly where a suspect parked a vehicle nearby. The CSI team is then brought in to collect any physical eviden ce.

Scent Detection K-9: A wildland arson investigator and a sce nt detecti on K-9 w ith handler wo rk a larg e outd oo r ar so n scene. Courtesy of Mike Cost leig h.

79

l\rson Investigationin the \/Vi!d!and s

If any fragile evidence is located, it must be documented in place in great detail before it is moved or recovered. Multiple photos from multiple angles are needed of this critical evidence. The evidence needs to be properly marked, measured, and memorialized in notes . A sketch of the fragile evidence is recommended, as well as a video of the attempted recovery process. The below two photos are of arson evidence (four wooden matches) at a wildland scene, along with the proper marking (flagging), measuring, and photo documentation of the evidence in place.

Heavier evidence, such as an incendiary device, may be hidden underneath fallen grasses after a fire. It is recognized through training that a thrown device often becomes suspended in grasses or brush prior to ignition. Once the fire starts, the device falls to the ground, and often the burning vegetation falls upon it, partially obscuring the device. The following photos show a cigarette/matchbook incendiary device as found after the fire, and then as it is very carefully "de-layered" for better photo documentation.

80

Cha pter 5: Wi ld land Ar son Physica l Evidence

In cendiary Device hidd en by fall en gr ass st ems. Photos courtesy of Joe Konefal .

Device exposed for photography by carefu l delayering. Photos courtesy of Joe Konefal .

81

Arson Investigation in the VViidiands

Incendiary Device turned over and photographed against a background for better viewing. Courtesy of Joe Konefal.

FI-210 trained Origin and Cause investigators are taught to recover highly fragile evidence via the basallift method. That technique means using a clean tool to carefully lift the soil under the device, so as not to disturb it. The entire item is then carefully packaged and transported to the crime lab. No matter how the item is recovered, great efforts must be made to preserve it in the best condition possible for later analysis by both a crime lab expert and by a special analyst or profiler. Some recommended methods include the use of small boxes padded with cotton balls or soft foam. See following photos for examples of evidence recovery.

Basal Lift Method. Courtesy 82

of Joe Konefal .

Chapter 5: Wild land Arson Physical Evidence

Two wood matches at arson scene:The following two phot os depict two methods of packagi ng thi s evidence. To prevent damage during tr ansit, it is re co mm ended to care full y pack fr agile evidence in soft cott on or foam . Courtesy of Joe Konefal .

All arson investigators have been trained to collect any evidence that may have volatile flammable liquid or vapors on it, and place that evidence in a clean, vapor proof metal can. The can is then sealed and sent to the crime lab where chemists conduct their analysis. However, some investigators have come to believe that all evidence related to an arson case should be packaged in this manner. That is not always a good practice. There are many types of evidence related to arson that do not have flammable liquid/vapors with them, and in those cases, should not be packaged in a metal can. In the next photo, an intact incendiary device has been recovered as part of an arson series. There is no reason to believe the device possesses any flammable liquids or vapors, so in this case it should be packaged in another manner. If placed in a metal can, the device must be completely surrounded by clean, soft material such as cotton balls, etc ., to prevent damage during transport or handling.

83

Arson Investigat ion in the Wildlands

Use of Metal Cans: This item mu st be wrapped in soft , clean material to prevent damage during movement. Courtesy of Kootenai County Arson Task Force.

An incendiary device is an incredibly important piece of evidence. It needs to get to the crime lab or to an analyst in the best condition possible.

Many investigators do great work to process fire scenes and locate difficult to find evidence. However, they often fail to adequately document this process, which leads to issues in court. Below are a series of four photos depicting the finding and recovery of a significant piece of eviden ce (paper match) in a wildland arson series.

84

Chap ter 5: Wi ldland Ar son Physica l Evidenc e

Match found at rural scene (red box):Flagged and placed into foam box for safe tr ansport t o crim e lab. Courtesy of Rick Velazquez.

c...

0) 0,

v:,

I

-l.

-....J -....J ;::;:

I

·m

3

O'

a.:.

---·

Match in a studio quality photofrom crime lab: Book of matches linked to suspect, and for ensically co mp ar ed to single mat ch fr om arson scene. Cour tesy of Rick Velazqu ez.

Most wildland arson investigators in the Western United States, Australia, and southern Europe would scoff at the idea of an arsonist bringing any form of ignitable liquid as an accelerant to an outdoor arson scene. The tinder -dry grass and brush in these areas is so volatile it merely needs a brief flame or spark to ignite . But, our fellow investigators in the Eastern United States, and in the boreal forests of Canada and northern Europe have reported accelerants at many outdoor arson scenes over the years. Those areas, by virtue of high hum idity, or high moi stur e content in the fuel bed sometimes require the use of an accelerant to ignite. 85

Arson Inves t igation in the Wiid iands

The below photo was taken in a forest in western Canada. It depicts the Ignitable Liquid Residue (ILR) that remained in a linear patt ern after an arson event. In this case, the arsonist walked a signifi cant distance through the forest carrying a firefighter's "drip torch". While the ILR successfully ignited, the photo shows that the surrounding vegetation was too moist to continue the flame spread and the fire self-extinguished. Despite this failure, this incident was a serious attempt at a major forest fire.

Ignit able Liquid Trailers: Used by ar sonist s t o burn slash pile and ILR pattern across log. Courtesy of Jeff Henricks.

86

Chapter 5: W ild land Arson Physical Eviden ce

Ignitable Liquid Trailers: Used by arsonists t o burn slash pile (left, red square) and ILR pattern across log (right). Courtesy of Jeff Henricks.

The main purpose in recovering physical evidence at a scene is to use it to link an offender to the crime. This can only be done if the evidence is analyzed and exploited for forensics by qualified professionals. Sadly, reviews of many past cases show critical evidence being lost, misplaced, contaminated, filed away in a locker, or even placed in a museum, instead of being shipped to a crime laboratory. The scene investigators should ensure proper evidence collection and a detailed documentation of a chain of custody that gets the items from the fire scene to the lab. At the lab, the following procedures are recommended: •

Evidence is photographed

as received and logged in

•

Evidence is examined in minute detail and any forensics material (fingerprints, DNA, hair, fibers, etc.), recovered and analyzed. Lead investigator needs to be notified of possible forensic material

•

The Lead Investigator must be made aware ASAP of lab findings and given a set of studio quality photos of the evidence

•

Crime lab personnel must generate formal reports indicating the results of all testing on the submitted evidence. These reports are peer reviewed at the lab, and then sent to the Lead investigator as soon as possible

•

In an arson series, all evidence from each scene must be analyzed and exploited separately, then must be compared to other evidence in the same series. The Lead Investigators must view photos of all evidence in a series to look for links, consistent materials, similar designs, etc.

87

.Arson Investigat ion in the Wi!d!ands

Impressions and Tracks Track Traps-Areas and materials that allow for high quality impression evidence, such as soft dirt, soil, mud, etc. Source: Dusty Whiting, TacticalTrackingInstructor

Tracks and impression marks may be the only physical evidence found at Investigators need to have a high degree of skill in identifying and collecting another expert who has those qualifications. Proper collection methods should practiced. Absent that, investigators should bring CSI experts out to all major examples of these types of evidence.

a wildland arson scene. this evidence, or retain be learned and regularly arson scenes. Below are

Photography: Photos should be taken of footwear impr essions from a 90-degree angle and an oblique angle, with artificial light added as needed. Courtesy of Joe Konefal.

88

Chapter 5: Wildland Arson Physical Evidence

Footwea r Casts: Tangible evidence , that along w it h photos and the actual footwear, can be brought to cour t. Courtesy of Dusty Whiting.

Footwear impression at crime scene: along w it h a "posit ive" match exemp lar of t he shoe fr om a Crim e Lab database. Courtesy of Dusty Whiting .

89

A1'son Investigation in the Wi ldlands

The vast majority of wildland arsonists use some sort of vehicle to access their fire scenes. They may pull to the side of the road, exit the vehicle and set the fire, leaving both tire and footwear impressions. Or, they may pull to the side of the road and toss out some sort of incendiary device, leaving only tire impressions . Investigators should recognize that an arsonist can toss a device from a moving vehicle that never leaves the pavement, which of course would leave no tire impressions. Finding tire impressions related to the arsonist can be the critical piece of evidence linking the arsonist to the scene, to a vehicle and to multiple other arson scenes. Tire impressions can identify the brand and size/type of tire, and possibly even the year and make/ model of vehicle. All wildland fire/ arson investigators need to obtain training in finding, documenting, and collecting tire and footwear impression evidence, or work with an expert who is qualified in this skill.

Identifying and Collecting Tire Impressions: Properly trained CSI experts should be used on any major case. Courtesy of Los Angeles Sheriff's crime lab.

90

Chapter 5: Wildland Arson Physical Evidence

Tire Impression Casting: Proper documentation of evidence at rural arson scene. Courtesy of Los Angeles Sheriff's crime lab

Tire and footwear impressions mixed together : Proper casting, lighting, measuring, orientation, documentation of each item of evidence is critical. From Ed Nordskog 's case files.

and

91

Arson Investigation in the Wildlands

Tir e and footwear impressions mixed together: Trained experts should be used as much as possible. From Ed Nordskog's case files.

A good "case building" tactic to use during an investigation where a potential suspect has been identified is to immediately take steps to identify all vehicles the suspect normally drives . Investigators should then use surveillance experts to surreptitiously capture photos of the tires and treads of the suspect's vehicle. During any surveillance of the suspect, investigators should be aware of "track traps." Those are areas where the suspect may drive or park his vehicle that are receptive to leaving visible impressions . Photos should be taken of the vehicle in that "trap" location, and of the tire impressions left in the trap after the suspect vehicle leaves the area. Evidence experts should immediately attempt to document and recover any impression evidence. Investigators will then have positive physical evidence along with photos/video linking that impression to the vehicle and to the suspect. This information will be documented and used at a later time to compare to impressions left at arson scenes.

This brief case synopsis and accompanying photos is courtesy of Investigators Chris Hendrickson and Darren Dicharry

A string of up to thirty suspicious roadside fires erupted in the mountains and forests of Plumas County, California, during the spring months of 2017. It was soon determined that the fires were incendiary acts, likely ignited by a "hot set" method. Investigators from both the U.S. Forest Service and Plumas County Sheriff's recognized similar tire impression evidence at seven different arson scenes. They captured the impressions, and took the evidence to a crime lab. Laboratory experts were able to determine that the impressions were made by a specific model "Toyo" brand All Terrain type tire that had been out of production for about four years. The tire model was then linked to a specific year range ofToyota SUV's/trucks.

92

Chapter 5: Wild land Arson Physical Evidence

Plumas County: "Toyo" brand tire impressions at two different arson scenes in same series. Courtesy of Chris Hendrickson.

In addition to the tire impressions, investigators noted a distinct athletic footwear impression found at four arson scenes. Again, they captured these impressions, and by using experts from the crime lab were able to match those impressions with a specific brand, size, and even color of athletic shoe. The shoe was determined to be a very specific black colored "DC" brand, likely worn by an adult male. The footwear impression evidence also helped refine the ignition scenario. Due to the lack of evidence of an incendiary device at any scene, along with the tire and footwear impressions, the M.O. of this case was determined to be: a male suspect was driving an SUV to the scenes, parking and exiting the vehicle, and setting the fires with an open flame source.

Plumas County: DC Brand black shoe; impression at arson scene and exemplar.

93

Arson Investigation in the Wildlands

By conducting basic crime scene investigation at the arson sites, investigators had identified a potential suspect as an unknown male who drove a certain year Toyota SUV, and wo re a specific size "DC" brand, black athletic shoe. The investigators began searching for vehicles that had similar tires. Shortly afte r obtaining this physical evidence, arson investigators identified a local male who drov e that type and year of vehicle. They confirmed that he had the same type of tires as the ones found at the arson scenes. The male was thirty -six years old and a former firefighter. He was currently involved in hea vy alcohol consumption. The male frequently swam and fished in waters in the local forest. In vestigato rs were able to covertly photograph the suspect 's tires and get impressions of them . H is tires were positivel y linked by forensics to multiple arson scenes.

Toyo brand tire: Covert photo t a ken of sus pec t's

ti re. Court esy of Chris

Hendri ckso n.

During surveillance of the suspect, his footwear impressions were identified in "track traps" and again, surreptitiously photographed. Those footwear impressions were positively matched to the impressions at the arson scenes. The suspect was subsequently arrested and his home was searched. In the home, investigators located a pair of black DC brand athletic shoes . Those shoes were forensically examined and linked to multiple arson scenes as well. Once he was confronted with this overwhelming forensic evidence, the suspect admitted his fire setting activity and was convicted of multiple forest fires, including the 4,000 acre Minerva Fire.

94

Chapter 5: Wild land Arson Physical Evidence

,,-.

•

,,;-

..._I' . . ... i

-

,

,1

-'-.

. ..

~J' - - .., .r ..-,,. ..

'

"

...

.

,..

' I

••

r

•

# __,

_.,_V

I_,.., _,,.~

,.,. .- r_,,., , .... ~_,. ...,,_1 /--

~

·~·~

-I/ ~

/

__... ....,,..~

, /- ,.,,. • ... ,

5:.~;·~;?}\( .~.~

•i ' _,.._ ,

.. -

• r·

..,,

t ·: .: · :

: - - .:.. :· :. .:-

_, - -

(' -

·I,..

..._,

~

Plumas County Arson Series: DC brand shoe in suspect's home forensically linked to multiple arson scenes. Mobile impr ession kit (r). Courtesy of Chris Hendrickson .

Analysis: This case history was presented at a wildland arson investigation training event attended by both authors. It was recognized as an excellent example of applying traditional, case-proven law enforcement forensic techniques with other modern arson investigation methods. It should be noted that the investigators also utilized electronic tracking devices, mobile surveillance teams, and effective interview /interrogation methods to link the suspect to other events. This is one of the better examples of "case building" that is encouraged in this book.

A slightly different method of getting tire impression information is to place trail or game cameras near a track trap on a rural road or trail. The cameras must be able to capture the suspect's vehicle from more than one angle, along with the tracks it left behind. Investigators should then recover the impression evidence as soon as possible, before it is obliterated by other vehicles. Fieldcraft and experience show that mudholes and other such track traps on dirt roads are also places where most drivers tend to slow down, which affords a better view of the vehicle, license plate, and perhaps the occupants of the vehicle.

95

.t..rson Invest igation in the VVi!d!ands

Track Trap: This mudhole on a remote dirt road is an excellent location to obtain tire impress ion evidence. Coord inate this effort w ith the use of high-quality surveillance cameras .

Coordinate th is effort with the use of highquality surveillance cameras. Photo courtesy of Dusty Whiting .

Man-tracking Evidence Authors' note-The information for this section was provided by Dusty Whiting, a retired Bureau of Indian Affairs Special Agent, wildland arson investigator and highly experienced Tactical Tracker.

96

Chapter 5: Wild land Arson Physical Evidence

From our prehistoric ancestors, through the Indian Wars, and into more modern wars, search and rescue operations, and police man-hunts, the use of man-tracking techniques has been a valuable skill for identifying and locating "bad guys", fugitives, and persons lost in the wilderness. Man-tracking in the rural environment is a somewhat rare skill in the modern world. While the wildland arson investigator does not need to be an expert tactical tracker, he/she should understand the basic principles of the art, and the value it can have in finding physical evidence, developing leads, or identifying both suspects and witnesses in a major investigation. The arson investigator should have a relationship with a skilled tactical tracker, and the ability to use that asset should the need arise. The basic principles of man-tracking include being alert for tire and footwear impressions, knowing where and how to look for them, knowing how to interpret them, and being able to document and capture them properly for later presentation in court.

Tactical Tracker: Patch (Above); Tactical Tracking team following foot impressions from crime scene. Images courtesy of Dusty Whiting.

While the CSI experts are adept at documenting and collecting impression evidence , the tactical tracker can actually assist the investigation in a different way by fo ll ow in g and int erpretin g th e impr essio n eviden ce. Among the many things a tracker can interpret from the impressions are: •

Number of suspects

•

Type of footwear

•

Possible height and weight of the suspect due to stride length , depth

•

Actions of the suspect: i.e., kneeling, running, falling, limping, walking backwards, etc.

•

Is the suspect carrying a load?

•

Direction and speed of travel

•

Was the suspect moving at night?

•

Attempts at obliterating impression evidence

•

Areas of Evidence Transfer

97

Arson Tnvestigation in the \Nildlands

Tracker: Measurin g gait and strid e of suspect. Courtesy of Dusty Whiting .

Through a combination of modern forensics, outdoor field craft, knowledge of human behavior and basic common sense, a tactical tracker can find subtle clues and evidence of the activities of persons in the wildland. The tracker conducts "sign cutting" in areas near the ori gin of the fire, looking for evidence of direction of movement, starting points, and speed of travel. The tra cker can study the gait, strides, and depth of impressions of footwear. From that, the tracker can determine if the subje ct was walking at night, carrying a load, attempting to deceive followers, climbing gates or fences, or even running. The tracker create s diagrams of both the impre ssions themselve s, and a gait pattern. These items can be compared to other evidence at the scene, to other arson scenes , or evidence at a suspect's home or work site. The tracker can assist the Origin and Cause investigation by explaining impression evidence at the scene. For instance, if an impression at the scene indicates a subject kneeled, the arson inv esti gators can look carefully in the spot to determine if perhaps an incendiary device was constru cted there. If the arsonist is captured fairly quickly, he may still bear a soil transfer on the knee of hi s pants corresponding to the arson scene. The tracker can follow footwear impressions a significant distance to an area where the arsonist parked a vehicle. Investigators can now scour that second site for other evidence. If the arsonist had bypassed a gate or fence, the team can now look for fingerprints or other transfer evidence at that location.

98

Chapter 5: Wildland Arson Physical Evidence

99

Arson InvP.stigatinn in the W ildlands

TacticalTracking Diagram: Crea ted to document th e sce ne and to link oth er sce nes.

CourtesyofDustyWhiting

..

Case Study: Use of Tactical Tracking During an Arson Investigation A small series of arson fires occurred in a rural area at the edge of a small town. Tactical trackers were utilized to assist the arson investigators with this ongoing problem. The trackers conducted sign-cutting both at the scene of the fires, and using field craft and common sense, along avenues of least resistance travel to the nearest built-up area.

100

Chapter 5: Wildland Arson Physical Evidence

Multiple footwear impressions were captured and trail cameras were installed in the likely areas of travel. The cameras captured various persons including suspected arsonists. Eventually, trackers were able to link the arson scenes to a local residence, and multiple juvenile offenders . Followingfo ur photos and case study courtesy of D usty Whiting.

Sign-cutting:from origin of fires along the path of least resistance into a built-up area. Trail Camera:This asset, used alongside tactica l tracking, produced images of potential arson suspects.

101

Arson Investigation in the \Niidlands

Tact ical Tracker: link ed arson scenes t o loca l re sidence and juvenile offenders.

102

Chapter 5: Wildland Arson Physical Evidence

The basic principle of crime scenes, forensically speaking, per Dr. Edmond Locard, is the offender almost always brings something to the scene, and almost always takes something else away from the scene. This is sometimes known as the Theory of Exchange or Transfer. There are obvious items taken away from and left at crime scenes to include impression evidence, blood, video images, tool marks, and physical items. More subtle items include physical evidence in the form of DNA, fingerprints, and trace amounts of hairs and fibers. Outdoor scenes have different items and materials compared to indoor scenes. These items could include soils, dirt/sand, vegetation, and even insects and bugs. Modern criminal investigation involves exploiting any and all of these items to forensically link a suspect to a scene.

Theory of Exchange:DNA Evidence. Bureau of Indian Affairs Agent taking a swab at mouth of drinking contai ner found in the field during arson investigation. Courtesy of Dusty Whiting

While at the origin of the fire, arson and CSI personnel are typically focused on fire setting evidence . They should expand their minds , and attempt to look for any other physical evidence that may link a suspect (or witness) to a crime scene . That could include: hairs and fibers, bloodstains, other bodily fluids, impression evidence, and tool mark evidence.

103

Arson Invest igation in th e Wild lands

Forensic Evidence:Cigar and lighter dropped at scene of wildland arson fire. DNA on cigar identified the suspect. Footprints also linked suspect to scene. From Ed Nordskog's case files.

A suspect fled the scene of a violent crime on foot. Man-tracking techniques along with search dogs were able to follow the suspect's impressions and scent into a residential neighborhood where he scaled a metal fence. In doing so, the suspect left a fragment of his clothing on a sharp section of the fence (first photo, red square). The tracking teams eventually located the suspect some distance away and recovered the shirt he was wearing. The crime lab analyzed the torn fragment found on the fence, and forensically matched it to the torn sleeve of the suspect's shirt (second photo). This case combined tracking methods, K-9's, and modern forensics to positively conclude that the male found some distance away was the same person who had fled the crime scene.

104

Chapter 5: Wi ld land Arson Physica l Evidence

-''>·•2?64? -!l

t •0:-:'

U*J0671? .rn .3

Clothing fragment caught on fence. Case history and photos courtesy of Los Angeles Sheriff's Crime Lab.

105

Arson Investiqation in the Wi ldlands

A participant in a violent crime scaled a metal fence when fleeing the event. His bloody shirt left a unique fabric pattern and impression on the fence (first photo below). After his arrest, the suspect's shirt was seized and tested for blood and DNA. Then, crime lab experts tested the pattern on the shirt against the pattern left on the fence. Multiple forensic comparisons positively linked the suspect to the crime scene.

106

Chapter 5: Wild land Arson Physical Evidence

Shi11inside-out

Case history and above two photos courtesy of LosAngeles Sheriff 's Crime Lab.

Next is a labo ratory magnified photo of a torn, bloody shirt, being forensically matched along the tear line to another piece of the same shirt.

107

Arson Investigation in the Wildlands

The following two photos show where a person cut through a lock. The second magnified photo is the laboratory analysis of the type of tool which made the indentation . When found, the crime lab can positively link the tool to the tool mark left on the lock. This type of evidence is semi -common during wildland investigations as suspects can enter restricted areas by cutting fences or locks.

108

Chapter 5: Wi ldland Arson Physical Evidence

Case history and above two photos courtesy of Los Angeles Sheriff 's Crime Lab.

An arsonist set a series of fires in a rural area of California. The arsonist used an exotic incendiary device to initiate his fires. He drove his car to within a half mile of his arson targets and then exited his vehicle and approached the scene on foot. In doing so, he carried several incendiary devices in black plastic trash bags through a wooded area. At his first target, he initiated a hypergolic incendiary mixture. The device was still in the black trash bag. After the fire, burned remnants of the black trash bag were found in the area of origin.

Case study and photos courtesy

of

Joe Konefal.

When the suspect fled the scene with multiple fires burning behind him, he dropped one of the othe r plastic trash bags in his possession. Arson investigators located this item while tracking the suspect 's passage through wet vegetation (sign cutting). 109

A1°so11 Investigation in the Wildlands

Case study and photos courte sy of Joe Konefal .

Days later a suspect was developed through a combination of techniques. A search warrant of the suspect's home and vehicle produ ced similar bla ck trash bags as had be en found at the arson scene and on the escape route used by the arsoni st.

110

Chapter 5: Wildland Arson Physical Evidence

Case study and photos courte sy of Joe Konefal .

The crime lab examined all three bags and found that they all bore consistent labeling and identical tool marks from the manufacturing process. They scientifically concluded that all three samples came from the same source, thereby positively linking the suspect to the arson event by forensics.

111

Arson Investigation in the Wildlands

-

melabaC

-

Many investigators believe that burned, dirty, or weathered evidence left at a scene for days, weeks or months is useless to them, forensically speaking. They may never collect that evidence, or if they do collect it, they may not turn it in to the crime lab, considering it a waste of time and resources. The only thing that is an absolute in that scenario is this: If you don't co ll ect o r test a potential piece of evid en ce, there is a 100% chan ce that yo u will not recover any forensics off of it . We advocate that you do everything in your power to collect potential evidence, and give the crime lab the opportunity to examine and test it. Remember, in criminal court the Defense will focus on all of the actions you did not take. Always conduct a detailed, thorough investigation.

Case Study: Burned and Weathered Paper The following bundle of badly burned papers was recovered at an arson/murder scene. It was collected, packaged, and sent to the Questioned Documents section of the crime lab. There, experts analyzed the bundle, carefully separated the pages, and then introduced infrared light to it. They were then able to read a pay stub, including a subject's name and social security number. This information greatly aided the investigators in the case.

Burned pay stub in natural light (L); Enhanced by Infrared Light, partially redacted (R). Photos courtesy of Los Angeles Sheriff's Crime Lab.

112

Chapter 5: W ildland Arson Physical Evidence

Photoscourtesyof LosAngeles Sheriff's Crime Lab.

113

Both authors of this book are strong proponents of the use of behavior analysis and profiling in its many forms. Practical profiling/analysis done correctly is a very helpful tool in any serial case. However, profiling done incorrectly, or worse, "the Hollywood way" is an absolute embarrassment, and can lead to the arrest or harassment of innocent persons. We are aware that multiple entities have attempted to use psychological behavior analysis in regards to arsonists, serial arsonists, and wildland arsonists in the past with some very mixed results. Typically, past studies have only looked at small sample sizes, or have relied on studies of incarcerated arsonists, or have relied on the very skeptical method of "self-reporting" by the arsonist. There are many obvious problems with all of these methods. Additionally, there have been serious problems in our profession with researchers lumping all persons convicted of arson into a single category. In reality there is very little correlation between a fraud related arsonist and a serial arson offender. Just as obvious is the fact that there is very little in common between a typical urban serial arsonist and a wildland serial arsonist. Investigat ors need to have an understanding of some earlier studies, as these are cited often in court by astute defense attorneys. One of the most often mentioned studies of serial arsonists was published in 1996 by highly regarded profilers/researchers from the FBI/ ATF. It is called Essential Findings from a Study of Serial Arsonists. This study was conducted entirely within the prison system and was comprised of 83 convicted serial arsonists. What is important for the purposes of this book is that the study did not differentiate between an urban serial arsonist and a wild.land serial arsonist. In the next few pages we will illustrate the dramatic differences between these two types of offenders. The FBI/ATF, along with the U.S. Forest Service attempted to initiate formal studies specifically related to wildland serial arsonists in the early 2000's. They presented their preliminary findings at the International Association of Arson Investigators (IAAI) International Training Conference in Reno, Nevada in 2003. The presenters and the study were quick to point out their limitations. Among them chiefly was the small sample size of only 49 cases. The researchers also took pains to recognize that self-reporting by many of the subjects should not be considered reliable. Lastly, they came up with several factors that were common of the "average" wildland arsonist, but were just as quick to add that "a sizeable percentage of the 49 arsonists in these 41 cases did not even come close to the "average" arsonist profile". (Source: Presentation by SIA Kevin Kelm, ATF/FBI Behavioral Analysis Unit, in Reno, Nevada, April 2003.) What all that information interprets to in layman's terms is this: there currently is not enough scientific research in the field of wildland serial arsonists. Past studies and profiling work on wildland serial arsonists have not been conducted at a large enough scale or in a controlled manner by professional researchers and investigators. The studies cited are too small and too few, and may not be accurate enough to fully rely upon. It is not prudent to come up with a psychological profile of a wildland arsonist, and then attempt to find a suspect who "fits the profile." Many a profiler and investigator has lost all credibility when attempting such a lazy and foolish investigative plan. Each case and each suspect is decidedly different and only fits within a very vague and general profile, at best. However, despite their limitations, the early studies have identified useful investigative techniques that have been successful in past serial wildland arson investigations.

114

Chapter 6: Behavior Analysis and Profi ling

Past research seemed obsessed with understanding the arsonist, and assigning them specific categories such as Organized or Dis-Organized. Additionally, those early studies were also pre-occupied with the arsonist's relationship with his parents, his attitude toward his boss, his stressors, and his level of intelligence versus his performance at work or in school. All of that is nice-to-know information for a later date in the criminal justice process, but is it truly helpful in actually catching the arsonis t ? In most cases this information is just too general to be useful in actually identifying and catching the arsonist. We want to use research and analysis for the sole purpose of apprehending and prosecuting the arsonist. For that reason, we will look at some practical uses of profiling and behavior analysis.

Arson investigators are the best resource to begin the profiling process of a subject. The investigato rs respond to the arsonist's fire scenes, study the ignition scenario, locate any evidence he left behind, and interview witnesses. If the investigators develop a potential suspect, then the profiling process gets serious. The investigators will do a full background check, interview persons who know the suspect, and begin to monitor the suspect's behavior. When the investigation fully focuses on the suspect, they will use surveillance assets to actually observe the suspect as he goes about his daily activity. Finally, if the suspect is arrested at some point, the investigators will first search the suspect's vehicle, home, and work site, and then conduct an interview of the suspect. By the end of the case the investigators should know everything there is to know about the offender . All of this information gathering is critical for later analysis by a seasoned investigator, profiler or analyst. In order to fully understand the arsonist, investigators should study his behavior at three junctures: Pre-Fire, whil e settin g the fire, and Post Fire. This information is learned through scene analys is, surveillance of the suspect, and by interviewing the suspect. This information will be very useful when conducting an interview of the suspect, and when later prosecuting the suspect. All of this information is useful during the sentencing stage of any suspect .

In numerous past serial arson cases, the investigators have discovered an odd phenomenon. They learned through research that the arsonists often set their very first few fires in the series at locations where they have a personal connection. This is usually attributed to the arsonist settling some sort of personal grievance by the arson attack. Later, as the series continues, the fires appear to be at mor e random targets. It is suggested here that investigators identify the first fire in a series and go back and focus resources on that victim. It is quite likely the owner of the property may know the arson suspec t personally.

The authors have reviewed numerous past serial arson investigations in the wildlands, and have looked at the testimony of several past "exp ert s". A portion of testimony that seems to recur in several cases is the theory that a serial arsonist in the wildland will set many smaller fires as he is building up to setting a large, devastating fire. Some expe rt s h ave opined that the arsonist is "experimenting" with his devices . Other experts have testified that it is a n atural evolution for serial arsonists to graduate to larger and more deadly fires. The authors disagree with both of these theories, primarily because there seems to be very little credible study or research in the field to back up these ideas. However, the authors have noted that 115

l\rson Investigation in the VVi!d!ands

a significant number of serial arsonists do in fact get caught after a large, devastating, or deadly fire. We analyzed the case histories to find out why. After much study on the issue, we believe it is more likely that the arsonist gets caught after a larger event because of the simple fact that more resources are employed to catch him. We are firm believers in the investigative theory that if you throw sufficient modern law enforcement resources at any serial offender, that offender will get caught very quickly. Many serial wildland arsonists will set ten or more fires before anyone even realizes there is a problem. Many of these are smaller fires, and are considered merely "nuisance fires" by many fire administrators. Some of these aren't even examined by a trained arson investigator. Eventually, as the arsonist continues setting fires, one or more may become larger or more destructive simply based on the weather conditions. At some point, these "nuisance fires" can no longer be ignored. It is at that time that the fire administrators decide to devote significant resources to the problem. It is at that time a task force is created, surveillance assets are used, and experienced investigators, profilers, and analysts are sent to the area to assist the local investigators. It is at that time that a suspect seems to be identified and then arrested in a fairly quick fashion. Below are two examp les to support this statement:

The Bobby Eason case in north central California, involved a series of eighty arson fires occurring in the same rural valley for nearly two decades. During the early years, the fires were small and did very little damage, outside of some rangeland. Typically, only one or two arson investigators worked on the case, and squeezed in the investigation between all of their other duties. Fragments of delay incendiary devices had been found on occasion, and a local firefighter was considered a person of interest. Finally, in 2005-2006, after a large, devastating fire that killed a herd of livestock, fire administrators deployed a fully staffed arson task force to specifically work on that case. Not surprisingly, Eason was arrested during the very next fire season. A similar, but much more deadly case also occurred in 2005-2006, near Palm Springs, California. The Banning Pass Series of vegetation fires eventually grew to over eighty suspicious or confirmed arson fires. Incendiary delay devices were found at more than twenty of the fire scenes and multiple potential suspects were identified. However, the investigation remained somewhat uncoordinated and sporadic as the 2006 summer season grew to an end. Many of the devices had not been tested for DNA. In late October, the final fire in the series, the Esperanza Fire, killed five firefighters. Almost overnight the area was filled with federal agents, police homicide detectives and agency heads who promised limitless resources. Experienced arson investigators were brought in from all over the state. Profilers were consulted, Tip Lines established, and large rewards were pledged for information on the arsonist. Immediately, all of the previously recovered evidence was tested at a crime lab, and DNA was recovered. Within just a few days investigators announced the arrest of Raymond Oyler, whose DNA had been found on two of the devices. This famous case is a classic example of agencies pouring massive resources into an event, and solving it almost immediately. Had this amount of resources been focused on the series of fires several months earlier, it is likely the case would have been solved then.

116

Chapter 6: Behavior Ana lysis and Profilin g

Although this heading may seem a bit far-fetched and mystical, it is actually based on a commonsense approach to profiling and analysis. After the scene investigation is complete, investigators should take a step back from their work and re-visit the scene at a later date, around the same time of day that the fire occurred. At that time, they should attempt to view the event as if they were the arsonist. They need to look at the terrain, the slope, the vegetation, study the wind, and the curve of the roadway. They should try to determine how they would have started a fire at this site if they were the arsonist. How did the arsonist arrive at this spot? Is it hidden? Are there any fences or gates he would have to bypass? Is there a structure within view? Is there a barking dog nearby? What are the escape routes? Did the arsonist exit his vehicle? Did he speed away? Is there any physical evidence that sheds light on these questions? Investigators should drive several miles in each direction to find out everything they can about the terrain, and what the arsonist would have seen on the day of the fire. They should look for obvious vantage points where an arsonist may have stopped to view the fire. They should locate the closest built up areas, convenience stores, gas stations, and restaurants in both directions from the fire scene. Later, if it is a serial case that involves an arson profiler, the lead investigators should accompany the profiler to every fire scene in the series and again, attempt to view it from the arsonist's perspective. Only by visiting a crime scene can an investigator truly get an accurate ''lay of the land", as seen by the arsonist. Additionally, by visiting these scenes, the investigators and profiler will start to see patterns or similarities that they may have missed while physically processing the scenes. It is a good idea to photograph and/ or film the scene during these visits.

What the Arsonist Saw: Investigator viewing the scene from a rural mountain turn-out; a potential observation spot for the suspect. It is helpful to visit arson scenes after the investigation to get a lay of the land and study the conditions the arsonist would have encountered. Courtesy of Dusty Whiting.

117

.ll.rson Investigation

in the VVi!d!ands

Caution: Do not exclude any potential offender based on the lack of any of these traits. Keep your mind open and assume nothing! Each case and each suspect are unique. The analysis of case histori es and the research in the field shows that wildland serial arsonists in general differ quite a bit from the urban /suburban serial arsonist. In a very general sense, the urban serial arsonist can be of either gender, usually doesn't drive a vehicle, doesn't have a job, is not involved in a relationship, operates mainly at night, does very little pre-planning, doesn't use an incendiary device, and has moderate to severe mental health and drug /alcohol issues. Their targets tend to be very close to where they live or work. The most common sub-type in the urban area resembles a rambling, raving transienttype person wandering the streets at night setting trash and rubbish on fire. In contrast to that, the wildland serial arsonist in general is typically male, is lucid enough to maintain employment, drive a vehicle, often has a spouse and possibly a family, puts some degree of planning and preparation into his attacks, travels much further distances to his targets, and sets the majority of his fires in the daylight hours. The two groups do share some psychological issues and other behavior traits, (i.e., alcohol issues, obsessive compulsive disorder, etc.) but, based on their daily activities are two completely different types of criminals.

To illustrate the various possible types of people involved in wildland serial arson, here are brief snapshots of several recent cases: •

In 2019, Brandon McGlover, a 32-year-old black male, pled guilty to setting a string of wildfires in Riverside County, California. He used WD40 and a lighter to ignite his blazes. One of his blazes was the 13,000 acre Cranston Fire.

•

In 2015, Michael Hamilton, a 70-year-old white male, pled guilty to a string of wildland fires in Fresno County, California. Several years earlier, Hamilton had been suspected of a string of similar fires in northern California. He is suspected in a total of more than eighty blazes.

•

In 2013, Steven Rutherford, a 47-year-old white male from the Banning Pass area of California, was convicted for a string of wildland fires he set using delay devices. Rutherford had multiple wildland arson arrests and convictions dating back over twenty years, totaling in excess of fifty fires.

•

In 2018, Jeffrey Lepelley, a 49-year-old white male, was indicted for eleven wildland and crop fires in Texas. He is suspected of up to fiftyeight fires in crops and hay bales over a several month period.

e

In 2018, Sam Scholfield, an 18-year-old Hispanic male from Shasta County, California was arrested and charged with over fifty counts of arson, murder, and attempted murder. He is a suspect in a series of wildland and structure fires during the summer and fall of 2018. He was suspected of lighting the fires so he could film and report them, similar to a news reporter. The suspect was arrested leaving the scene of a fire and had multiple

incendiary devices in his vehicle.

118

Chapter 6: Behavior Analysis and Profi ling

•

In 2012, Mike Malenski, a 39-year-old white male from Oklahoma, pled guilty to a series of wildfires he set while working as a game management

officer. Malenski admitted to

investigators that he lit fifty-six fires which consumed thousands of acres during a drought, due to a "fascination" with fire. Each of these six suspects used a vehicle to access their scenes, and five of the six brought incendiary materials or a device to the scene, indicating some level of preplanning. It is somewhat common for a wildland arsonist to amass a significant number of fires prior to being identified or arrested. As is clear from a review of these cases, race, income, and age are not significant factors when investigating wildfire arsonists.

Serial Wildland Arsonists While all wildland arsonists are important for us to understand, mainly on the repetitive wildland fire setters, or Serial Arsonists.

the focus of this chapter will be

While not every serial arsonist has all or even most of these traits, the ones listed below appear more often than not during wildland investigations.

•

Gender is usually male-Gender

is not a factor in most arson cases, with the exception of

the wildland serial arsonist, where the overwhelming majority are male.

•

Solitary-In

the majority of wildland cases the arsonist was alone. This is a loner crime.

Exceptions to that may be some firefighter arsonists and some juvenile arsonists.

•

Seldom brag -Most

wildland arsonists will not brag or gossip about their fires. They

typically don't have many close friends and won't often confide in others.

•

Race as a factor-Generally,

the race of an arsonist is not a factor as it typically represents

the race of the area where the fires are occurring. Historically, the majority of wildland arsonists arrested have been white males, but in recent years there has been an increase in

the arrests of Hispanic and Native/Indigenous males. As a good example, a 2010 report of Australian bushfire arsonists concluded that Indigenous people comprised one-fifth of all adult arrestees, and almost two-fifths of all juvenile arrestees.

•

Social Status/Wealth-These are generally not factors in any type of serial arsonist. Wildland serial arsonists have come from all walks of life, all wealth levels, and of every social group.

•

Age-Age

is not a factor in most serial arson cases, but it is a factor with the wildland

arsonist . The wildland serial arsonist is usually old enough to drive a vehicle. The majority of arrested offenders tend

to

be in the 18-60 year age range.

An exception to that is if there is a series of wildland fires originating within walking/biking distance of a neighborhood. At that point, the investigators must consider the possibility of a juvenile arsonist. The age range of this type of offender could be as young as eight years old, up to age seventeen .

•

Mobility and Use of a vehicl e-Contrary

to the urban offender, almost all wildland serial

arsonists use a vehicle for their attacks. The sheer amount of distance traveled by them 119

,ll,rson Investigation in the Wi!d !ands

demands that they have a vehicle. Studies by the USPS have shown that it is most common for the wildland arsonist to drive a personal truck or SUV •

Seasonal Nature of Activity-More

than any other type of arsonist, the wildland arsonist's

activities are controlled by the weather and fuel moisture issues. As such, these arsonists tend to have seasonal activities that can go on for years. Fires are set in the dry months when the fuel beds are susceptible, and then abate in the cooler, wetter months. This factor alone should explain away the myth that most serial arsonists are pyromaniacs (a word invented and used improperly for decades by persons in the psychiatric profession). The wildland arsonist in most cases does not have an uncontrollable urge to set fires, but can bide his time and wait for months for the proper conditions. Arson investigators should take the word "pyromania'' out of their vocabulary.

•

Emergency Services Monitoring Device-Past

cases of serial wildland arsonists show that the

offenders often are in possession of a scanner, police/fire radio, or similar device for monitoring local police and fire departments. In 2012, CAL FIRE arson investigators watched and photographed convicted arsonist Steven Rutherford as he routinely carried a scanner. Rutherford was not related to the fire service, but was a suspect in dozens of wildland arson events over thirty years. In 2013, he was eventually convicted for his third series of wildland arson fires. Modern technology has improved upon the scanner device as there are now cell phone apps that monitor and provide the same information to the general public. Either way, once a potential suspect is identified, investigators should attempt to find out if they have any type of device or app that gives them this capability.

Police/ Fire Scanner: in the vehicle of a wildland serial arsonist who was also posing as a fake cop and firefighter. The suspect had a vehicle that resembled a detective sedan, fire uniforms, and police equipment (note the police style flashlight). From Ed Nordskog's case files. Emergency Notifica tions: Modern Cell Phone App that notifies anyone of all emergency responses in an area. Courtesy of Jeff Zimmerman

120

Chapter 6: Behavior Analysis and Profiling

•

Live, Work, or Travel throu gh the Target Ar ea-Wildland

serial arsonists will tend to

live, work, or have some other legitimate reason or connection to the rural target area.

•

Employment-Wildland

serial arsonists tend to be employed more often than urban serial

arsonists. They often have a job related to the wildland, or within the wildland, or they pass through the wildland as part of their job. Additionally, many have a job that allows them

the freedom, mobility, or unsupervised time to set their fires. •

May report their own fires-This type of behavior is consistent with some urban arsonists who also engage in this sort of "thrill-seeking" activity. Investigators should interview all 911 callers involved in arson events. Be aware of persons who report more than one fire.

•

Keep abreast of the Investigation-More

so than urban serial arsonists. Case histories

have shown that the wildland offender may take steps toward keeping abreast of an ongoing investigation. These steps may include: arsonist attending community meetings, visiting fire stations, being overly critical of the fire department in online forums, etc., engaging in conversation with investigators or fire personnel, following the case in the media, and following/ commenting in online forums.

•

Use of an Incendiary Device -Wild land serial arsonists are more likely to use a device than any other type of serial arsonist (excluding extremist arsons).

•

Developm ent of an M.O. - The wildland serial arsonist, more than other arsonists, will tend to develop a Method of Operation (M.O.) as they gain experience and mature. This may include: scouting a target area, choosing the optimum time of day to strike, choosing optimum weather conditions, fuel bed selection, slope selection, use of an incendiary device, counter-surveillance

measures, and police monitoring

systems, etc. Investigators

should be aware that even a mature and skilled arsonist's M. 0. can have failures due to use of drugs/ alcohol, anxiety, frustration, etc. It is not uncommon

for even very skilled

arsonists to have failures in their attacks. John Orr is a good example of this as he had many

failures in his career despite being a very skilled arsonist. The Origin and Cause investigators are key to helping define the M.O . of the wildland arsonist .

•

Armed or Unarmed?-Se rial arsonists in general seldom carry firearms when setting fires. However, there have been multiple case histories of wildland serial arsonists who have been arrested with a firearm in their possession or in their vehicle . This may be nothing more than a reflection of a rural lifestyle (similar to the reason why most wildland arsonists drive a truck/SUV), where a firearm is a normal part of life. However, it is included in this section as an investigator safety factor to consider when following or attempting to detain a potential suspect.

•

Was the arsonist on foot or in a vehicle?

•

Did the arsonist use a disguise?

•

Was the arsonist using a police/FD monitoring device? 121

Arson Invest igation in the Wild lands

•

Did the arsonist leave the vehicle, or start the fire from the vehicle?

•

Was it a "hot set"?

•

How far from the edge of the roadway?

•

What is the fuel? What is the slope?

•

Time of Day?

•

Weather Conditions? Wind, Humidity , Fuel Moisture

•

Did the arsonist take steps to obliterate his tracks and footprints? (rare)

•

Did the arsonist do anything to arrange the fuels prior to ignition?

•

Did the vehicle stop, or was something tossed out while the vehicle was moving?

•

Was there a device used?

•

Is there a "double tap " at the scene? More than one device?

•

How did the device get into the fuel? Thrown/launched,

•

What type/ style of device was used? D iscarded Flame sour ce? Del ay D evice?

•

Was the device constructed on site, or p rior to th e arsonist arr iving on site?

•

Were there antiforens ics measures taken with the device? (very rare)

•

Did the arsonist "troll" the site prio r to the fire?

•

Did the arsonist practice "counter surveillance" techniques?

•

Did the arsonist park nearby to watch?

•

Did the arsonist report the fire?

•

Did the arsonist fight the fire as a citizen "hero" or firefighte r?

•

Did the arsonist return and interact with firefight ers?

•

Is this location a repeat location (been torched befo re)?

•

Was the fire started within "restricted" lands or gated property?

•

Did the arsonist set two or more fires during the same small time per iod?

•

Did the arsonist engage in crime scene staging (m ake the fire appea r as an accident, etc.)

•

Did the arsonist reach out

•

Was there anything present to indicate a "signature " or ritualistic behavior? (very rare)

to

media or investigators

to

hand placed?

brag about fire? (very rare)

Pattern Analysis

After careful examination of each fire scene for location , M .O ., the ignit ion scenario , and the use of any incendiary devices, the investigators can start comparing a single fire to other suspicious fires in the area. Specifically, investigators are looking for any form of pattern developm ent. Pattern behavior in serial cases is a critical component for the investigators to understand when later conducting lin kage analysis, or using similarities at multiple scenes to connect them to each other and to an offender.

It is well established that most serial offenders, including arsonists, form patterns of behavior, whether they realize it or not. However , it must be stre ssed again here, th ere are significant difference s between th e pattern s of activity of urb an seri al ar sonists compared to wildl and seri al ar sonists. 122

Chapter 6: Behavior Analysis and Profiling

Past documents related to this field of investigation, along with analysis and profiling techniques have spelled out specific behavioral patterns related to arsonists. These patterns have even been assigned specific names. However, this book will avoid giving names to any patterns as most of those earlier patterns were formed based on studies of arsonists in general, and not specifically wildland arsonists. Suffice to say that behavior patterns in the wildland are likely to be generated by different factors than urban serial arson pattens. The urban serial arsonist generally lives close to his targets, has unlimited targets to choose from, is generally on foot or bicycle, and operates from some sort of anchor point (home, work, school, etc.). The urban serial arsonist can easily set fires in any direction, at any time. The patterns formed by urban serial arsonists can be linear as they follow roads, alleys, paths, etc. They can also be much more sporadic, or the "shotgun" pattern if they are just aimlessly wandering the area and picking targets at total random. Much of this is based on the mental health, age, and intoxication level of the arsonist. The wildland serial arsonist tends to live much further from his "hunting zone", and for the most part is limited in his fire setting behavior to more remote areas that are along roadways. The majority of wildland serial arsonists drive a vehicle, and few stray off roads. So, it is much more common to see linear patterns developing in a wildland arson series, as the arsonist stays on roads. Additionally, most wildland serial arsonists are more mentally stable in comparison to the urban arsonists. Therefore, their target selection methods and M.O.'s tend to be better planned. Lastly, there is a much higher level of pre-planning involved in the wildland serial arsonist compared to the urban serial arsonist. There are very few cases involving the urban offender where the arsonist prebuilt an incendiary device before arriving at the target site. In the wildland sector there are numerous case histories where the offender pre-built incendiary delay devices prior to leaving his home or work site to set a fire. Tar get selection and time of the attack are other important factors to assess in a wildland serial arson investigation. The offender must consider weather factors such as wind, humidity and fuel moisture levels. In most cases, wildfires simply won't start on humid, cool days, or in the middle of a cool night. Consequently, the temporal patterns of wildland arsonists tend to be at the time of day when it is easiest to set a fire. Because the fires are most often set in remote, hidden areas, where there are few witnesses, there is no need to operate in darkness.

The firefighter related wildland arsonist may have patterns of behavior that are different from the non-firefighter wildland arsonist. This information will be further discussed in Chapter 7.

Past work by both the FBI and the USFS describes four main categories of patterns that develop during serial arson cases: Temporal/Chronological, Geographical, Target Based, and M.O. Based (Source - FI310 Module 2). We will add a fifth category, which is Incendiary Devices. While incendiary devices are certainly a component of the "M.O. Based" category, their use is so important it deserves special mention. Each of these pattern categories is highly important to analyze first individually, and then all together as the actions of the arsonist are being assessed. Analyzing patterns can help the investigators to focus resources at the appropriate time and place, and can give great insight as to the motive and sophistication level of the arsonist. Proper pattern analysis can also show if the arsonist is increasing intensity, moving target areas, changing tactics or evolving/ devolving in some manner. 123

Arson Investigation in the Wildland s

Investigators, when looking at a series of fire events, should remember this very important admonition: The actual size of the fire event has very little to do with any other aspect of the case, and is not a strong piece of data to use when conducting pattern analysis! Temporal/Chrono logical Patterns: Wildland serial arsonists have temporal patterns that are virtually opposite the urban arsonists. The vast majority of urban arson/serial arson attacks occur during times of darkness . In the wildland, for several reasons, the overwhelming majority of attacks occur during the middle of the day to late afternoon. It must be stressed here that the main reason for specific temporal patterns in any arson series is they fit the convenience of the arsonist. Arson in all cases is a crime where the arsonist chooses the time to set the fire as it suits his needs and convenience. During the interview process of the arsonist at the end of the case, the investigators should attempt to find out why the fires were set at a specific time or day of the week. There is usually a very common sense reason for it. Geo-Spat ial Patterns: Urban arsonists tend to be controlled only by their comfort zones when committing attacks. A variety of geo patterns are formed based on the arsonist alone. The wildland arsonist's movement is mainly controlled by the limited numbers of roadways that pass through the target areas. This type of pattern analysis can give information as far as direction of travel of the arsonists, clusters of activity, and any possible "anchor points" for the arsonist. Geo-Spatial pattern analysis can produce another phenomenon. Within any series of fires there may be specific areas where there are no fires at all. There may be several reasons for this, but this lack of a pattern is in fact a pattern itself. These areas devoid of arson activity are known as exclusion areas. Past studies and the FI-310 module 2 have identified several possible reasons why an arsonist may avoid setting fires in a specific area. They include: •

Lack of access to the area

•

Other activities occurring in the area

•

Police or public presence in area

•

Lack of desirable targets in the area

•

Arsonist is unfamiliar/uncomfortable

•

Arsonist fears he may get recognized in that area

with area

Target Based Patterns: While highly important during urban serial arson investigations, the analysis of the target is less critical during wildland serial arson cases. In the overwhelming majority of wildland cases, the target seldom changes and can usually be described as "combustible vegetation" on public lands. It may be important to determine if the actual target belongs to any specific individual, company, or group of people . M.O. Based Patterns: These types of patterns are the most important patterns in any serial arson investigation. Analyzed properly, the M.O. of the arson incident gives the best information as to the mobility, age, training, and experience of the arsonist. It can be the best indicator of the sophistication level of the arsonist. Most linkage analysis on a 124

Chapter 6: Behavior Analysis and Profiling

serial case is derived through a detailed study of the M.O. along with evidence recovery. Investigators should make every attempt to avoid classifying M.O .s in the general sense, and should instead focus on very specific details of the M.O.

Incendi ary D evices: The use of incendiary devices to set wildland fires is a critical component of the overall M.O. of the offender. However, because device use is so rare, and the prospect for forensic evidence is so great, incendiary devices by themselves offer significant value as far as pattern analysis. Finding a series of similar incendiary devices in an area is a sure indicator of a serial arsonist. Close analysis of the devices may give indications as to the skill level or complexity of the arsonist. The device may be "amateurish" in design, or could be fairly technical. It may be neat and tidy in appearance, or crude . It could be considered "highly reliable" , or somewhat "unreliable" in design . All of these factors may give insight into the arsonist.

Device analysis is a highly skilled field of experti se. A specialist should be consulted on cases involving incendiary devices. In cendiary devic es are cover ed in detail in Chapter 4 of this book.

Brushfires-43's area 118 Freeway #1

#2 #3 #4 #5 #6 #7 #8

#9 #10

99019796 99021105 99022687 99026971

99027996 99028292 99029719

99034589 00011808 00012063

07/26/99

08/08/99 08/25/99 10/08/99 10/18/99 10/21/99 11/04/99 12/24/99

hrs 2150 hrs 1345 hrs

1423

LA#896

LA#974

1414 hrs 1633

hrs

LA#791

1659 hrs 1729 hrs 1809 hrs

LA#712

05/12/00

1640 hrs

LA#626

05/15/00

1538 hrs

LA#680

Pattern Analysis:Early in a serial arson case, investigators created this informal Geo-Temporal analysis chart after a series of arson fires along the same freeway . All fires were in afternoons during weekdays. This chart later expanded to 32 fires over one year. Suspect was a driver on the freeway during those time periods. Courtesy of Christine Saqui and Scott Hall.

D eviations from Patterns and Outli ers: A common problem in any arson series is to find similar fires that occur that don't fit neatly into the observed patterns. Past investigato rs have made the mistake of either automatically dismissing those incidents as not related 125

Arson Invest igat ion in the Wildlands

to the series, or automatically including them as a new evolution in the series. Neither of these is a reliable method of analysis. The best method is to document the fires, and then hold them aside in a list of "possibly related" events. At the end of the case, perhaps through interviews, admissions or by some other means, the "possible" fires can be positively included or excluded from the series. Or, as happens often, the fires are never fully explained. ~BEL DATE

DAY

TIME

7/27/09

Sunday

14:34:00

2

7/18/14

Friday

13:47:00

3

8/2/14

Saturday

17:22:00

4

8/14/14

Thursday

17:50:00

5

8/25/14

Monday

20:31:00

6

8/26/14

Tuesday

0:40:00

7

9/19/14

Friday

19:13:00

8

9/20/14

Saturday

16:58:00

9

9/20/14

Saturday

17:50:00

10

6/28/15

Sunday

17:28:00

11

6/29/15

Monday

17:33:00

12

6/29/15

Monday

20:44:00

13

7/3/15

Friday

14:00:00

14

8/11/15

Tuesday

14:35:00

15

8/13/15

Thursday

20:43:00

16

8/14/15

Friday

10:37:00

17

8/22/15

Saturday

12:15:00

18

8/25/15

Tuesday

8:31:00

ADDRESS 1216 Wilbur Dalton Gardens, ID 83815 Woodland Dr./ N. 15th St. Dalton Gardens, ID 83815 E. Grandview Dr. I Sundown Dr. Coeur d'Alene , ID 83815 1536 E. Woodland Dr. Dalton Gardens, ID 83815 1735 E. Grandview Dr. Coeur d'Alene, ID 83815 7880 N. 15th St. Coeur d'Alene , ID 83814 E Woodland Dr. / N 15th St. Dalton Gardens, ID 83815 N. 15th St./ Woodland Dr. Dalton Gardens, ID 83815 1535 E. Woodland Dr. Dalton Gardens, ID 83815 1735 E. Grandview Dr. Coeur d'Alene, ID 83815 7959 N. 15th St. Dalton Gardens, ID 83815 Lookout Dr. / N. 15th St. Coeur d'Alene , ID 83815 347 E. Hanley Ave. Dalton Gardens, ID 83815 6825 N. 16th St. Dalton Gardens, ID 83815

INCIDENT

FIRE

EVIDENCE

2009-002558

Brush and Grass Fire

Wooden matches

2014-002858 2014-003115 2014-003927 2014-0035 15 Grass Fire 2014-003516 2014-003898

Brush and Grass Fire

2014-003926

Natural Vegetation Fire

2014-003927 2015-002696

Brush and Grass Fire

2015-002726

Grass Fire

2015-002730

Grass Fire

2015-002798

Grass Fire

2015-003523

Grass Fire

E. Grandview Dr. I E. Sundown Dr. Coeur D'Alene, ID 83814 2015-003557 7584 N. 4th St. Dalton Gardens, ID 83815 2015-00357 4 7584 N. 4th St. Dalton Gardens, ID 83815 2015-003719 9733 N. Chase Rd. Post Falls, ID 83854 2015-0037 46

Brush and Grass Fire

Bundle of wooden matche

Grass Fire

Single wooden match

Grass Fire Grass Fire

More detailed geo-temporal listing of eighteen wildland fires: Included within that chart are the ignition source and the type of fuel ignited. Courtesy of Kootenai County Arson Task Force .

Deviations and "outliers" occur in many serial cases and they often confound investigators, profilers, and later, prosecutors who have developed their own theories as to the patterns and the series. These deviations are often exploited by defense attorneys as either a second arsonist, a copycat arsonist, or possibly an attempt by someone to "throw the investigation off the trail" of the original arsonist. Careful case analysis, along with interviews and possibly later confessions can shed light as to why there was a deviation in the pattern of a series. It is a mistake for even the most seasoned investigators to develop and adhere to their own theories as to why a deviation has occurred. Some investigators with overactive egos have come to the belief that they can "get into the mind of the arsonist," to the point that they think they can easily explain the arsonist's actions and even pred ict future events. Some investigators believe that they are smart enough to make sense of the completely senseless actions of the arsonist. This dangerous thinking can cause an 126

Chapter 6: Behavior Analysis and Profil ing

investigator to form unsubs tan tiated theories, and to stubbornly stick to his/he r own theories despite tangible evidence to the contrary. The best technique when dealing with "outliers" or deviations from a pattern is to just collect the evidence, document the event, and keep an open mind to all the possibilities that the odd fire represents. It may be part of the series, and it may not be . Maybe, at some future date the deviation will be explained.

An arson task force was tracking a series of grass fires over a three year period. The fires were linked by their close proximity to each other, the fact that they were all roadside "sets", (likely from a vehicle), all were set during the same months of the year, and that in several cases wooden matches were found as the ignition source. After fifteen fires that all occurred within two miles of each other, a single fire occurred over a dozen miles away. This "outlier" event, was clearly outside the close geographic pattern that had been established by the arsonist (see below map).

Map and case history courtesy of the Kootenai County Arson Task Force

In the above map, the first fifteen fires are marked by colored pins in the cluster on the right. These fires all occurred within the hills of a semi-rural neighborhood. There were no footprints at the scenes and all appear to have been ignited by a suspect who threw lit kitchen matches out of the window of a vehicle. The outlier fire (red pin on left of map) was similar to the others in every aspect, except for where it occurred, which was a much more rural location several miles away. This outlier fire greatly puzzled investigators, until they took a closer look at it. The investigators in the case had developed a list of three potential suspects, and even brought in an arson profiler to assist in analyzing the case. Eventually, two suspects were eliminated and the investigation focused on a single suspect. The investigation of that remaining potential suspect found that he lived squarely within the neighborhood of the cluster of fires, and had in the past been a vocal advocate about the danger of grass fires in the area. The investigation took a decisive turn when it was learned that this same suspect had been witnessed by firefighters watching their efforts at the scene of the outlier fire, as he belonged to a rural gun club at that location . The investigators were able to positively link the suspect to both the cluster of fires and the outlier event as he had personal connections to both areas. 127

Arso n Investig ati on in the Wi ld lands

Trolling/Hunting: Reviews of the case histories of many serial predatory offenders such as serial murderers, rapists, and specifically wildland serial arsonists, show that there is a tendency for the offenders to engage in an action of trolling or hunting prior to the event. This action is idle time spent driving around searching for targets, target areas, or the possibility of law enforcement. Research has shown that a serial predatory offender will often cruise past a potential target multiple times before acting. The offender is likely confirming that his target is desirable, vulnerable, and accessib le, and that it is out of view of witnesses. It is also a time when the offender is getting the most excited or anxious as he is building up his nerve to act. Famous cases of this sort of behavior involve several serial killers of prostitutes including the Green River Killer in Seattle, who was known to cruise a red light district for hours looking for desirable, vulnerable, and accessible victims. The BTK serial killer in Wichita admitted after his arrest that he cruised and scouted potential victims virtually every day for years while seemingly engaged in his duties as a dog catcher and code compliance officer. In the arson world, the best possible example of this sort of predator is John Orr, who among his many sins was a serial wildland arsonist. In his own books Orr describes his hunting/ cruising activity . He liked to attend arson conferences a day or two early and enjoyed aimlessly cruising around the town or countryside. Of course, these are the same times that he planned or set multiple fires. Besides that activity, Orr had practically no supervision at his job and would leave the office all the time to go out and "patrol for arsonists". This absurd notion was nothing more than an excuse for him to scout, plan, and set his own fires. A final famous arson case revealed that the DC Arsonist Thomas Sweatt regularly engaged in trolling and seemingly aimless driving around as he searched for suitable and vulnerable targets. This "trolling/hunting" information may be of importance to arson investigators when surveillance units are monitoring potential offende rs. They may notice this seemingly aimless driving or cru ising, along with U-turns, somewhat erratic driving, passing the same area multiple times, or just parking by the side of the road for no apparent reason. While not illegal, these actions are consistent with the concept of "trolling/hunting". If the suspect is under surveillance at the time, followers may report or believe that the suspect has spotted them or is practicing counter-surveillance techniques . Interestingly , post-arrest interviews have shown that in most cases, the suspect is so intent on his target or planned event, he had no idea he was being watched. The erratic driving was just a mixture of his obsessions and a bit of pre-event anxiety. It is important for a surveillance team to document each of these maneuvers, even though they may not be illegal. It is good evidence to show that the suspect is not just innocently passing through the target area .

128

Chapter 6: Behavior Analysis and Profiling

During a two-year wildland serial arson investigation (38 total fires) in Southern California, the above person on a motorcycle was identified at six fire scenes by responding firefighters. He typically just sat on his bike and watched the firefighters put out the brush fires, or drove back and forth watching them . One of the firefighters captured his license plate. The fires were all along the same remote canyon road over a thirty-mile distance. The suspect usually dressed in military fatigues and boots. The suspect was identified and it was learned he lived in a town at one end of the arson pattern. A professional surveillance team began to monitor him. He had no job, and spent several days a week aimlessly driving back and forth on a paved road within the "target area''. He was seen several times to stop for no reason along the road. Other times he stopped at, and inspected previous arson scenes along the roadway. At one point he engaged in a high-speed pursuit for several miles of another person who was acting suspiciously in the same area. He then called law enforcement and reported that other person as an "arson suspect" . Multiple times he was observed smoking cigarettes while parked by the side of the remote road. Investigators and surveillance team members considered his aimless driving and odd activity suspicious and possibly consistent with a serial arsonist engaged in "trolling" a target area before lighting a fire, or returning to scenes after a fire.

129

Arson Investigation in the Wildlands

However, at no time did the male engage in criminal activity or light any fires. He was eventually interviewed in depth and was found to be a "fire buff' who was obsessed with the arson fires occurring near his home. He claimed he was looking for clues to help catch the arsonist, and had started his own ''Arson Watch" group. In the end, this person was eliminated as a possible suspect in the case.

This short case study was put in this book as a caution to investigators. Persons can act seemingly odd, bizarre, or in a manner consistent with that of an arsonist, and not be involved in anything illegal at all. Do not make an arrest of somebody who "fits the profile". Any persons of interest or potential suspects need to be carefully investigated and linked to the fires by forensic evidence and/or witnesses, or eliminated as a suspect. The above casehistory and photo is courtesyof Ed Nordskogand the LosAngelesSheriffs Major Crimes/SurveillanceTeam.

From 1976-1996, a string of over 200 intentional wildfires occurred in the dry foothills of Southern California, near the town of Ramona . A single arsonist named Charles Phillips was linked to this extended series by the finite area he operated in and the use of a delay incendiary device comprised of matches and a cigarette. Phillips was arrested and tried for arson in 1981. He was acquitted of that charge and resumed his fire setting activities. During the entire series, Phillips worked as a delivery driver, and his daily route took him through the rural wildlands where the fires were occurring. Surveillance of Phillips showed him driving around and the appearance of him cruising/trolling and huntin g for targets. CAL FIRE officials obtained a court order to install a camera in his vehicle. The camera eventually captured then forty-nine year old Phillips throwing a delay device out of his vehicle which ignited a brush fire. He was arrested and prosecuted for several fires. After arrest, the suspect's defense was that he was a Vietnam Veteran with a documented history of Post-Traumatic Stress Disorder. He admitted that he learned how to make the incendiary devices in the military as one of his duties in Vietnam was to burn vegetation to clear areas for troops and supplies. Phillips pled guilty to multiple counts of arson.

130

Firefighter Related Serial Wildland Ar sonist Highly experie nced Arson I nvest igators can often quickly determi ne if an arson series involves a Firefighter Related Arsonist- t heir fir es tend to be differe nt than oth er arson ist types . As stated earlier in this book, no other single criminal poses a greater threat to public safety than a determined and skilled wildland arsonist. We are lucky in this business that very few people in the world possess the knowledge and skills needed to consistently ignite large and devastating fires. We are additionally blessed in the fact that most of the people who do possess those unique skills to create such a catastrophe have no inclination whatsoever to do it. There lurks however, within our own profession a very small number of people who do possess significant knowledge and an enhanced skillset , along with the deviant mindset necessary to comm it such acts. They are defined in this section as the firefighter-related serial wildland arsonist. It should be noted though, that the term has the word "related" added to it as some of these folks are not actuall y firefighters, but are involved somehow in a related job, hobby or obsession. Why are we bringing up such an ugly subject in this book? When the FBI conducted its first major studies of serial arsonists in the l 990's, they found that around 3% of identified serial arsonists were related to the fire service . However, several years later when the US PS conducted studies on persons identified as "wildland serial arsonists", they discovered that 35% of the known wildland serial arsonis ts were related to the fire service. (Source: FI-310 training module, unit 2.) It is clear from these raw numbers that investigators are ten times more likely to find that a wildland serial arsonist is related to the fire service. This sub-type of offender has cropped up hundreds of times in past cases and led to some of the largest, most important arson investigations within our industry . To name but a few: •

The most famous arsonist ever identified, John Orr was a fulltime firefighter/a rson investigator . Among his many other sins, Orr was a highly prolific wildland serial arsonist.

•

Fire Marshal Bob by Eason set and sometimes reported 80+ wildland fires in an 18-year span in Northern California.

•

Fire Chief Ryan Scharber, a fire-chief-of-the-year

candidate in Babbit, Minnesota was

eventually linked to 70 wildland arsons .

•

Van Bateman, a highly regarded forest service fire officer was linked to a series of forest fires in Arizona via a very unique time delay device.

•

Nic holas Archer, a volunteer firefighter in Melbourne, Australia, set over 25 wildfires in 2016, and followed that up with arson attacks at a firehouse, rail facilities, and at a fire

depa rtment museum . The cases listed above illustrate that an arsonist with an interest and knowledge of the fire service, its activities, customs, and norms, is a very dangerous offender . Contrary to popular belief, a firefighter 131

Arson Investigation in the Wild!ands

arsonist can and does come from every level of the fire service, both professional and volunteer. For th e purposes of this book, the phrase "firefighter relat ed wildland arsonist", will include any level of firefighter, retired firefighter, auxiliary, reserve, volunteer, fire investigator, "arson watch" member, fire buff, fire chaser, a close relative of a firefighter, fire cadets, interns, Explorers, fire/ emergency photographers, videographers or "stringers", and any other person who may work for, work in a related job (fire camp worker, contractor, etc.) volunteer with, or have any other connection to the fire service, wildland fires in general, including any support role . Other persons who may also be peripherally related to this category include police officers and reserves, interns, dispatchers, any form of Explorers, ambulance drivers, EMT / Paramedics , security officers/gua rds, forest range rs, and wildlife conservation officers. Know ledge: These groups, by virtue of their connection to public safety through the fire and police services often possess a higher degree of interest, knowledge and skills related to fire response and suppression duties. Many have received some level of training related to fires and many have been exposed to firehouse education and training. Many have received outdated and antiquated training about who or what an arsonist is or does. Their fires tend to be copies of what they perceive a true arsonist would do, based on their fire training classes. Firefighter arsonists are trained to believe that real arsonists like to match wits or play cat-and-mouse games with firefighters. They are told that an arsonist would set a fire on one side of the fire district to occupy the fire crew, just so the arsonist could set a larger fire on the other side of the district. These tactics have been documented on just a few occasions, but in each case the suspect was in fact a firefighter related arsonist . Real life interviews with hundreds of arsonists have shown that most don't even think of the firefighters when they light the fires, have no idea about where a firehouse is, or even the limits of fire districts. They are only concerned about their own actions. Many of these firefighter related arsonists have developed personal relationships (both positive and negative) with fire officials, officers, and investigators, and when they light the fires, they may be expressing a very personal animosity toward a specific person or unit. Or, they may believe altruistically, that they are doing the firefighters a favor. Mindset: Unfortunately, many have been exposed to lurid "war stories" from firefighters that may have been highly exaggerated, if not totally untrue. Some of these people have demonstrated the need to be a "hero" or recognized in some manner. Some are seeking employment as a firefighter and are looking for ways to prove themselves worthy of the job. Many have been led to believe that the life of a firefighter is much more exciting, glamorous, and dangerous on a daily basis than it truly is. Many want to live that exaggerated mindset, and are greatly disappointed when they find the job actually quite mundane for most of the time. Access: These groups, also because of their job status, have access and means into areas that other persons do not have such as behind locked gates, inside of the crime scene tape, in wildland areas closed to the public, or on locked land that is owned by utilities. Many possess master keys or codes that allow them into restricted wildland areas past road gates. Training: All firefighter related arsonists have a bit more training than the average citizen. They may have some knowledge about fire behavior, FD tactics, equipment, and even fire investigation techniques . Many of them have been exposed during informal training to making incendiary devices, or to lectures about "what arsonists really do", etc. These firefighter arsonists tend to set their fires with the aid of this special knowledge.

132

Chapter 7: Sub-Types and Profile s

What the study of these cases provides investigators with is that there is some usable "profiling" or behavior analys is we can refer to when pondering the possibility that a fire or string of fires was set by a firefighte r. Past behavior analysis work has feebly attempted to assign a list of psychological traits associated with this type of offender. These traits were usually such things as "poor performer", "smar t , but underachiever", "poor history of relationships", "chameleon-like", etc. Those traits ended up being undefinable, overly vague and virtually unusable to an active arson investigation (Although they may have some good value during the court, sentencing, or treatment process) . This book will attempt to define practical indicators and traits based on the actions within a case , the M.O . of the event, the sophi sticati on of th e igniti on sce nario , pattern anal ys is, or through device analys is. This detailed analysis by Origin and Cause investigato rs and case analysts will be useful in attempting to identify a firefighter serial arsonist in the wildland . The fo ll ow in g is a li st of semi -co mm on factors associa ted w ith firefight er arson cases :

•

A series of similar fires all occurring within a single jurisdict ion

•

A series of similar fires all occurring during the same fire shift times

•

A series of fires set near fire stations

•

A firefighter reporting or calling in multiple fires he "found " or obse rved whil e off duty

•

A firefighter with a pattern of showing up to calls earlier than expected

•

A series of fires ignited with some form of delay ign ition device

•

Fires set with overly sophisticated techniques: device, fuel arrangement, etc.

•

Fires that involve some form of "ant i-fo rensics" techn iqu e (extremely rare)

•

A firefighter not assigned to investigations who finds incend iary devices in th e wildland

•

A firefighter overly interested or involved in an ongoing investigation

•

Investigators of an arson series receiving taunting messages, notes, phone calls, etc.

•

A series of fires where it appears the arsonist is playing cat-and-mouse with firefighters or investigators (extremely rare phenomenon)

•

A "red-herring" fire set by the arsonist to attempt to "throw off the investigation" (this is a rare phenomenon

•

and may not be recognized until after a suspect is arrested)

Fires set immediately following some sort of firefighte r labo r issue: cutbacks, pay cuts, union issues, lack of funding, unpopular commander, etc.

•

Fires set within restricted lands or areas where only public agency members have access

133

Arson I nvestigat ion in the Wildlands

Restri cted Lands: Locked gate prohibits most people from entering this area to set fires . Courtesy of Dusty Whiting .

Limited/ Restri cted Ar ea: Signs and barriers deny area to anyone outside this tribe. This greatly reduces the number of potential suspects in a case. Courtesy of Dusty Whiting .

134

Chapter 7: Sub-Types and Profi les

Research has shown there are actually multiple subsets within the motive group of firefighter arsonists. Some offenders do it for profit, some for recognition, some for revenge, some do it out of boredom, some do it for altruistic purposes (training, etc.), and some light fires just to "prove themselves" in front of their peers. Some of these offenders operate in groups and some of them are loners. Like many other motive groups for arson, there is no singular profile or list of traits that fits all the offenders. Each case is unique. However, once identified, past firefighter arsonists, whatever their motive, have shown some of the below general individual traits (Note, never base an arrest or suspicion just because someone has one or many of these traits): •

Immature behavior (despite their age)

•

Excessive use of alcohol

•

Highly competitive within the firehouse, "Gung ho" personality

•

A history of aggressive/unsafe driving, "racing" (on or off duty)

•

Overly risky tactics at fire/ emergency scenes

•

A desire for advancement within the FD

•

A strong need for recognition from peers within the FD

•

Fighting or confrontations within the firehouse

•

A history of theft of FD gear, personal property, etc.

• Engage in excessive hazing and pranking activity at firehouse Source of some of this material: Matt Hinds -Ald rich. In the Hot Seat: An Uncomfortable Take on the Firefighter Arson Issue. Presented at the Serial Arson Seminar. Las Vegas, 2013.

Older studies regarding the subject of firefighter arson have broken the offenders into two distinct groups; those who seek reco gnition / hero status, and those who set fires so that they can receive a financial benefit. A few modern studies show that it is more likely that the firefighter serial arsonist is motivated by thrill -see king as opposed to being a hero. Dr. Dian Williams, author of Understanding the Arsonist, and with decades of experience studying and treating arsonists, is convinced that many male firefighter serial arsonists are actually motivated by the thrill of outwitting their colleagues and getting away with a crime directly under their noses.

135

Ar son Investig at ion in t he Wi ldlands

IM MR FLARE

till ..-11 ,H.

anD fit1uipment

Demand letter from Mr. Flare: Sent by a group of fire buffs who set over 260 fires in Boston in 1982-83. This type of letter is extremely rare and is related to "thrill-seeking" as a motive. It was meant to taunt local officials. Reprinted by permission from Wayne Miller, retired ATF investigator/author,

136

Burn Boston Burn.

Chapter 7: Sub-Types and Profiles

There are multiple case studies to back up Dr. Williams' opinion. The Boston Arson Ring of 1983 was comprised of a group of cops and firefighters, all who were active fire huff s. They spent several nights a week of their own time "chasing or sparking" fires, so that they could photograph and film the activity. Their activities were clearly more related to thrill-seeking than anything else. Despite having already lit 150-200 struct ur e fires, and with a heavy po lice and federal investigative presence in th e area looking for them, the group actually stepped up activities . It began lighting even more fires in a given evening, began taunting the investigators with press releases from a mysterious "Mr. Flare" via garish notes sent to the media; began calling the fire departments to taunt and brag; they specifically addressed some phone taunts to an investigator by name (indicating personal know ledge of that investigator and the case); they were filmed cheering for the fire (as opposed to cheering for the firefighters) at a large arson scene; and even were observed yelling at, taunting, and ridiculing the Arson Squad investigators who were on the streets searching for the arsonists . The members photographed and filmed themselves at numerous of their own fires, with fire equipment, firefighters, and flames in the background. They boldly engaged fire fighters and officers in discussion at fire scenes. They stole multiple fire call boxes off of street corners. During the he ight of the investigation they set two of their more brazen fires: a burglary arson at the State Fire Academy, and an arson attack at the offices of a rival fire buff club . Th eir activit ies were so brash and outr ageous th at they came under suspicion from other fire buffs, which is how they were eventually caught .

Fire Buffs: Hobbyists or enthusiasts who devote a significant amount of time and money collecting firefighting equipment, chasing or "sparking" fires, and photographing or videoing fire scenes . This can run the gamut from an innocent, legitimate hobby to a bizarre or dangerous obsession.

D avid Berkow itz: the prolific serial arsonist and a serial killer was a rabid fire buff as well. He spent years driving around with other buffs documenting fires and fire responses in minute detail in his diaries . Later, when he was involved in a three-year spree of setting over 1,400 fires, he began reporting many of them to the fire dispatch cente r and procla iming that he had set them. He identified himself alternatively during this era as either the "Bronx Avenger" or the "Phantom of the Bronx" .

Paul Kell er: the Seattle Serial Arsonist was a long time obsessive fire buff and close friend to several firefighters. H e had an impressive collection of FD paraphernalia . H e was kn own to hang around his arson scenes and engage firefighters in conversation .

John Orr: the notorious firefighter/arson investigator turned arsonist, engaged in a more subtle form of thrill-seeking . He held meetings and convened training events with othe r investigators to talk about a mysterious serial arsonist working the Los Angeles basi n and footh ills. O rr often gave press interviews where he warned the cit izenry of serial arso nists working the area . He routinely bragged about the numbe r and type of incendia ry devices he was find ing to support his arson ist theory. Of note, he was the only one of over a hun dred arson investigators in th e area who was aware of such thin gs. He was clearly tryin g to call attention to his actions . O rr's thrill-seeking had no lim its. While runn ing a tra ining class during the weekday for ot h er investigato rs, he would go out at ni ght an d set several fires with exotic in cendi ary devices. The next day he would bring in the "evidence " to the classroom and regale the 137

Arson Investigation in the Wild lands

students with his abilities at chasing a serial arsonist. Eventually , Orr would write about these exploits in a national fire training magazine. Orr was a proponent of the cat-and-mouse theory about arsonists. He would set a fire on the edge of one fire district, and then race to the other edge and set another fire "to screw with the firefighters". Really, only another firefighter would do such a thing. While involved in setting fires, Orr sometimes wore disguises and engaged in conversations with citizens and patrol officers. He hung around his scenes to photo and video the fire department response to these events. He kept photos in his office of some of his arson targets years after he burned them. Near the end of his fire setting reign, even as investigators were closing in on him, Orr lit some of his largest fires. He even set fires while involved in surveillance operations and stakeouts with other investigators. Since his arrest over thirty years ago, Orr has maintained an obnoxious air of superiority over other investigators, including the ones who successfully prosecuted him. He is the ultimate example of the thrillseeker arsonist. These three case histories involve some of the most notorious serial arsonists ever identified, all with a distinct connection to the fire service. It is our opinion that they cannot be clearly defined by motive as they exhibit a little bit of several sub-motives to include: thrill-seeking, hero/ recognition, and financial gain. Another possible sub-motive present in a few of these cases is the altruistic motive. This motive is often cited by firefighters after their arrest for arson, where they try to explain their fire setting is due to a need for training, or to get rid of unsafe structures, or even in protest/response to cut backs on fire departments, as in the movie Backdraft.While there may be a little bit of truth in the altruistic excuse, in reality it is usually just a face-saving gesture for them as they typically don't want to admit they are "some sort of weirdo like a real arsonist."

In 1999, a string of thirty-five roadside fires were set in Southern California, all along a twenty mile stretch of the same freeway. All fires occurred during the work week in the mid-afternoon hours. There were no leads, clues or any evidence found at the scenes of these grass and brush fires. However, a local fire captain noted a strange anomaly with these fires. He recognized that the same individual had reported or called in at least seven fires, and was present extinguishing most of them when firefighters arrived. His name was "John" and the fire crews took to calling him "Johnny on the Spot". He was so bold as to ask the fire captain to write him a commendation for helping put out the fires. The alert fire captain notified the arson unit. A records check confirmed that a freeway-assist tow truck driver (employed by the state to keep freeways clear) named John had indeed reported the seven fires, and had reported two additional fires twenty miles away in a different county. Additionally, the tow truck driver had been the "victim" of no less than three suspicious fires in the past. The tow truck driver had been an applicant to be both a firefighter and police officer. He had been rejected for both jobs. A surveillance of John showed something very peculiar. He left home every morning wearing a firefighter paramedic uniform and carrying a large paramedic bag. He would later change to his true tow truck driver uniform. He drove a personal vehicle outfitted with emergency "wig-wag" lights and had been known to stop and perform paramedic/EMT duties numerous times for stranded motorists. He in fact was not a paramedic. A canvass of the neighbors who knew him for years were convinced that John 138

Chapter 7: Sub -Types and Profi les

was in fact a firefighter-which he was not. John was eventually arrested for arson. He was found to have police/fire scanners at home and in his personal vehicle, firefighter license plates, department decals on his vehicle (photo below) and entire firefighter uniforms, police badges and batons and other related paraphernalia. He had never been a firefighter or cop. John admitted to setting arson fires with a delay device. He stated he learned how to make devices from firefighter friends. John was later convicted of arson. He is a classic example of a firefighter-related serial arsonist.

Fake Firefighter: Johnny on the Spot's personal vehicle with local FD window stickers. From Ed Nordskog's case files .

Other Wildland Arsonist Sub-Types

While fairly rare (less than 10% of documented cases), it is not unheard of for a female of any age to ignite wildfires. The hallmark of female fire setting has always been fires set very near, or within the home . It is extraordinarily rare for a female to engage in device building of any sort. There are no more than a couple of cases of female wildland arsonists using any form of incendiary device. In some cases, females have been known to accompany a male serial arsonist when he set his fires. Investigators should never automatically exclude a female as a potential wildland arsonist.

The traits of juvenile related wildland arsons bear one clear distinction from many other types: the overwhelming majority of them are set very close to their own homes or built up areas. Most juveniles lack the physical ability to set fires deep into the wildland. If the investigator notes a fire or string of fires originating near a neighborhood or living area, he/she must consider the possibility of a juvenile fire setter. Other traits found with juvenile fire setters: they operate in groups ; one or more members of the group attempted to fight the fire or reported the fire; use of fireworks; fires sometimes set with crude accelerants such as hai rspray, bod y wash, etc.; graffiti , theft , or vandalism found at or nearb y the origi n of the fire. Juveniles who operate in groups while setting fires will usually have one member who is the dominant personality (male or female), while the rest are typically followers. These groups are fairly unsophisticated 139

Arson I nvestigation in the Wild lands

and easy to exploit from an investigative perspective. They leave obvious evidence at crime scenes and a significant "digital trail" on their phones and computers. More than any other type of arsonist, juveniles operating in groups will tend to confess quickly and name the other members. If juvenile arson is suspected, it is a recommended investigative technique to conduct interviews of local persons in authority such as apartment managers, teachers /principals of nearby schools, HOA leaders, and small business owners. They often have insight as to who may be a likely suspect for this type of event. A second excellent investigative strategy is to conduct an online social media investigation as teens /juv eniles are known to post their entire lives online. '~

r~ !,:

Investigators must always remain objective and open-minded in every case. Each investigation has its own quirks and peculiarities. Odd cases are sure to crop up every so often. There have been numerous documented cases of multip le, independent arsonists working in the same area at the same time, wi th no connection to each other at all. This phenomenon was recognized by California Dept. of Forestry investigators in 1995 when they helped author a document entitled 7he Investigation and Prosecution of Arson. Within a chapter describing wildland serial arsonists, the following sentence was written: "It is not uncommon for more than one fire setter to be active in the same geographic area''. Proper scene investigation and behavior analysis may tell the investigator that he has multiple, unrelated offenders. There have also been several documented cases of groups involved in serial fire setting. While this is most common with firefighters and fire buffs, it can also occur with juveniles, and any other social group.

Much has been made in the past regarding the subject of copycat arsonists. This appears to be another of the highly exaggerated myths in the arson world, with very little real documentation. Any arson event or series that receives media attention has the possibility of a copycat event. However, the only way someone can truly copycat an arson attack is to know the exact specific details of the original event. They need to know the time of event, target, exact ignition scenario, first fuel ignited, and whether or not a device or accelerant was used. If they don't have all that critical information, then a decent Origin and Cause investigator will quickly be able to determine that an event is a poor attempt at a copycat. There are only two ways a copycat arsonist can get enough of that specific information in order to replicate an attack. One is if that person is involved with or very close to the investigation or investigators. The second way is if the investigators have leaked too much case sensitive information to the media or non-involved personnel, such as area firefighters. A tightly run investigation should expose and limit the effect of any copycats.

140

There are many ways to use "linkage" during criminal investigations. A simple method is to link a suspect to a crime scene via physical evidence, witness observations, video, etc. Another use of linkage is to connect multiple crime scenes to each other, and eventually to a suspect. Another link would be to connect a suspect to a vehicle, and then the vehicle to a crime scene. Finally, and to the point of this chapter, using the theory of linkage to connect a suspect to multiple pieces of evidence, a vehicle, multiple arson scenes, and eventually to an entire arson series.

Linkage is accomplished by analyzing and exploiting the following: •

All forensic evidence at each scene

•

Uniqueness of Evidence

•

Ignition Scenario

•

Uniqueness of Method of Operation (M.O .)

•

Uniqueness oflncendiary

•

Common links between targets, target areas

•

Pattern Analysis

•

Behavior Analysis (prefire, at the scene, and post fire)

•

Signature or Ritual Behavior

•

Search of suspect's vehicle, home, and work

Device(s)

site

--~

Linkage Analysis is often done to connect serial crimes to one another, and then to an offender. It

, .·,,

is a combination investigation. The link analysis is to in a series . Then

of many aspects of the criminal best method in which to pract ice first fully investigate each event collect, analyze and exploit all forensic material at each scene. Then, conduct a detailed behavior analysis of each fire event. Finally, compare all the aspects of each fire event to the other fires in the suspected series and attempt to identify links between events . Linkage Blindness is the inability to recognize linking factors that connect fires set by the same serial arsonist.

,

, ,

Unique item: Matchbook from Connecticut found at arson series in Southern Californ ia. From Ed Nordskog's case files.

141

Arson Invest igati on in the Wildlands

One way to exploit any physical evidence found in a case is to identify any unique or semi-unique features of that evidence. Anything that is extraordinary about the evidence greatly diminishes the number of people (potential suspects) who could possess such an item. Very few criminal cases hinge on a single piece of evidence. In reality, most cases, particularly in the homicide and arson worlds, are successfully solved on a combination of numerous pieces of both direct and circumstantial evidence. The above photo of the matchbook is one such piece of circumstantial evidence. It was found at a scene that was part of a wildland arson series of more than thirty roadside fires in Southern California . When it was found, it held multiple possibilities. It could be merely roadside trash not at all associated with the case. Conversely, it could be the critical item linking the suspect to this and other scenes if it held his fingerprints or DNA. In the actual case, sadly it did not have a fingerprint or the DNA of the primary suspect, or any other persons. However, it did hold some evidentiary value . Interviews several months later would link it to both the series and the suspect . It in fact was the item that caused this particular roadside fire as the suspect admitted to leaving it at the scene after he started the fire. Additionally, the uniqueness of this particular item would also point at the primary suspect in the case. The matchbook is from a bus iness in Connecticut, while the arson series occurred in Southern California, 2,500 miles away. The investigation revealed that the primary suspect in the case was born and lived part of his life in Connecticut before moving to Southern California. He still had several family members in that state and had visited them during the two-year period these roadside arsons were taking place. In this case, that connection indicates the fairly rare nature of this seemingly common item.

The most critical part of the Origin and Cause investigation is to identify the exact method in which the fire was started. This is known as the ignition scenario, which is a portion of the arsonist's overall M. 0.

In a wild.land arson case, th e fo ll ow in g are examp les of igniti on scenarios: •

H ot Set, aka "Touch an d Go"-This

is one of the more common methods . It means to

simply touch a flame source to the combustible vegetation, and then remove the flame source. Typically, a butane lighter is used. This method leaves no forensics at the origin, but can leave both footwear and tire impressions in the vicinity.

•

D iscarded Flame Source-This

is also one of the more common methods. The arsonist

ignites an item and then discards it at the scene by either hand placing it in a suitable fuel bed, or throwing it from on foot or a vehicle. This method typically leaves the remnants of the burning material at the scene. Also, depending on the method used, there will be some additional forensic material in the form of footprints and/ or tire impressions . The burning item left at the scene can run the gamut from a match, matchbook, highway flare, burning piece of paper, flaming firework, to any other combustible item.

142

Chapter 8 : Case Linkag e

Discarded Flame Source from Wildland Series: Part of a case involving 400 fires near Kingman, Arizona. Device is non-delay, likely thrown from vehicle as it has a weight (rock) affixed to cardboard via multiple rubber bands. Courtesy of Mac Nelson.

•

Remotely Laun ched or Propelled Flame Source-Th is method is much more rare . This can come in the form of something simple or something highly exotic. Examples of this are commercial or military versions of rescue and signal flares, or burning material launched by slingshot or bow and arrow. A more exotic example would include the use of incendiary bullets or the use of a commercial explos ive target material such as Tannerite, etc.

•

Tim e D elay Incendi ary D evic e-This

method is fairly rare, but more common in the

wildland sector than in other arson classifications . This is covered in detail in Chapter 4 .

If an arsonist uses a simple flame source such as a match to ignite a wildfire, then it becomes very difficult for investigators to locate that small piece of evidence at a crime scene. If investigators are skilled or lucky enough to find a single match, then it is still difficult to pull any usable forensics off that item, such as DNA. If an arson ist uses an item such as a lighter, then carries it away with them (aka "hot set"), they are leaving practically no physical evidence behind except for perhaps foot impressions and tire tracks .

143

Arson Investigation in the Wildlands

Remotely Launched Flame Source: Arrows with a burning rag affixed. Found during wildland arson case in

western Canada (very rare).

Courtesy of Jeff Henricks ..

But, if the arsonist uses anything more than these two items to start the fire, then the arsonist begins exposing themselves to exploitation through forensics. The more unique the ignition source is, then the smaller number of potential suspects there are. The more material or components on the ignition source, then the greater chance there is for forensics to be captured and exploited. The next photo shows an ignition source found at one of 38 arson scenes along a rural mountain roadway. The ongoing series lasted over eighteen months. Most of the fires were less than one acre in size, but two of them grew to 500+ acres. Halfway through the series investigators found this item as the cause for one of the fires. At first glance it is a simple matchbook containing paper matches. However, an experienced investigator/analyst will note that there is more than meets the eye. The matchbook is in fact a military matchbook that was normally included in the Meals Ready to Eat (MRE's) packages issued to troops. Research and basic knowledge of local conditions showed that these meals were also routinely supplied to the wildland firefighters in the area. While these types of meals can be obtained by just about anyone, they are still somewhat hard to acquire. Besides the source material of the item, there was additional analytical information to be gleaned from this. Close analysis showed the arsonist was experienced in fire setting as he had torn away the matchbook cover, thus allowing more of a chance for flame to actually get in contact with the vegetation. The item had no weight to it, and was located about twenty-five feet from a roadway, which is a bit too 144

Chapter 8 : Case Linkage

far for it to have been thrown. Investigators could infer that the arsonist had to have exited his vehicle and thereby left footwear impressions at the scene (which he did). Finally, the remains of the device were suitable for both fingerprint and DNA extraction . A suspect was later identified and DNA was retrieved from him. Not surprisingly, the suspect was a seasonal firefighter in the area and had actually "discovered" and reported two of the fires in the series, and another suspicious fire in a different part of the state. The device in this case was uncommon enough for it to be a vital piece of information, and a strong due as to who the potential suspect in the case may be. Casehistoryand photo courtesyof Cindy Valencia.

Ignition source found at one of 38 arson scenes.

M.O. analysis is another very important aspect of crime scene and overall case analysis. The M.O. of any event includes all of the steps, methods, tactics, and materials used by a suspect to successfully commit a crime and safely escape the crime scene. 145

Arson Invest igatio n in t he Wildlands

M.O.'s can and do evolve as the suspect gains experience, matures, or refines his fire setting techniques. M.O.'s can get sloppy or careless if the suspect is overconfident, is heavily using alcohol or drugs, or has deteriorating mental health issues. In any arson case the Lead Investigator must be in close communication with the Origin and Cause Investigator so as to learn the exact details of the ignition scenario of the fire. The ignition scenario is a portion of the overall M.O. of the event.

Device construction, placement, and use are almost never defined as a signature, but more accurately reflect the M.O. of the offender. M.O.'s for all criminals do evolve and change as circumstances warrant and the criminal matures in his/her career. Older, experienced and more mature serial offenders of all types tend to have a fairly refined M.O. that stays somewhat consistent. Source:Incendiary Devicesby Ed Nordskog.

In the realm of criminal behavior profiling, signature is defined as something done at a crime scene by the offender, which has nothing to do with completing the criminal act, but fulfills some sort of psychological need of the offender . Signature is a phenomenon sometimes seen during the investigation of serial sexual homicides and rapes. It is an incredibly rare phenomenon in the arson investigation world . Unlike M .O . which evolves, signature, if present, seldom changes. The FI-310 training module for Wildland Arson Investigation describes that signature "feeds the offender's fantasy or emotional gratification", and is "not common" in wildland arson scenarios. Signature may be evident if the suspect takes photographs of the event, removes souvenirs from the fire scenes, leaves specific items at a scene, masturbates, defecates or urinates at the scene. The Courts of Appeal in California have weighed in on testimony regarding profiling and signature. "The pattern and characteristics ... must be so unusual and distinctive so as to be like a signature" (People vs Ewoldt, supra,7 Cal. 4th at p. 403). The Court "compared the degree of similarity and distinctiveness required to a 'calling card"'. The Court added that "The highly unusual and distinctive nature ... virtually eliminates the possibility that "anyone but the Defendant committed the crimes." Source:Incendiary Devicesby Ed Nordskog.

Rituals involved in wildland arson cases are also exceedingly rare. If present, they may consist of post-fire behavior such as returning to the scene, contacting investigators, taunting or threatening investigators or other victims, and collecting media coverage of the fires.

The following is one example of a M.O. for a serial wildland arsonist:

At 1230 hours on a weekday, the arsonist prepared three cigarette matchbook devices at his home. He placed the devices in a small plastic bag and later hid them under the seat of his vehicle. At 1415 hours, the arsonist drove an SUV with tinted windows to a turn-out on a rural foothill road. The area was about seven miles from his home and along the route to his worksite, which was another four miles away. The arsonist was wearing sungla sses and a dark baseball hat. He drove past the turn-out slowly once without stopping, drove a half mile, turned around and came back and parked at the turn-out. Within the SUV was a cellular phone which was monitoring a police/fire scanner appl ication. The arsonist did not have on any gloves. The arsonist pulled the plastic bag containing the cigarette/matchbook devices from under the 146

Chapter 8: Case Linkage

seat. He removed one of the devices from the bag, and then hid the bag under his vehicle;s seat. The arsonist exited the vehicle and looked in both directions for any other vehicles. Seeing none, the arsonist walked into the dry vegetation about ten feet from the edge of the road, at the base of a grassy slope. The arsonist then pulled several bunches of the dried grass and arranged a pile of fuel. The arsonist then lit the cigarette/ matchbook device with a small butane lighter. The arsonist was forced to puff on the cigarette filter as it would not easily ignite. The arsonist carefully placed the lit cigarette/matchbook device on top of the pre-arranged fuel bed, and oriented the burning tip into the wind. He then arranged additional dry vegetation on top of the incendiary device. The arsonist walked back to his SUV, entered and drove off back toward his home. He turned around after a mile, waited about five minutes, and then drove back to the area of the turnout. He slowed, but did not see smoke or flame. The arsonist did not return to the scene or wait for the fire as he had to be at work by 1500 hours. However, he frequently checked his cell phone app for the emergency response . Within 25 minutes there were calls to a brush fire in the area of the turn-out. The fire grew to less than two acres before being extinguished. The arsonist passed by the scene on his way home from work, but it was too dark to see anything. The next day, he stopped at the scene on his way to work to view the damage. ANALYSIS OF TH IS M.O.: The above M.O. for a wildland arson event shows factors that are typical of the majority of wildland arson attacks. The arsonist is male, drives a truck or SUV, and set the fire on a remote roadway in dry vegetation, at a site hidden from public view. The site was at the base of a slop e and was on the same road the arsonist drove daily to his worksite. The suspect wore a hat and sunglasses. All of these factors are quite common in wildland arson cases. However, the arsonist displayed additional factors that show an increased level of sophistication and a refined M .O . These factors include; preparing incendiary delay devices prior to arriving at the scene, hiding the devices in his vehicle, conducting "trolling" or a drive-by of the site prior to stopping to see if it suited his needs, the use of a police/fire monitoring device, the pre-arrangement of a fuel bed in the area of origin, and orienting the burning cigarette into the wind. All of these factors demonstrate that the arsonist has likely had some sort of training or education in the use of devices and setting fires, and has very likely set previous wildland fires. The ignition scenario within this M.O. is the use of a pre-built incendiary delay device, oriented into the wind, hand-placed into a pre-arranged bed of fuel, at the base of a slope. This portion of the M.O . is mature, reliable, and demonstrates knowledge of fire behavior. Some investigators may interpret that the use of a hat, sunglasses and tinted windows is a sem isophisticated method at concealment by the arsonist. These factors do indeed offer some form of concealment. However, common sense tells us that a large number of citizens dress the same way and have tinted windows on their vehicles. It would be unwise to put significant weight into these items that are fairly commonplace for other persons in the same area. Investigators should focus more on the extraordina ry things that the arsonist does. The final analysis shows that the arsonist , while somewhat sophisticated , lacks knowledge of forens ics as he did nothing to prevent his DNA or fingerprints from being on the devices, and left footwear and tire impressions at the crime scene. He also left two incendiary devices hidden in his vehicle which are 147

Arson Investigation in the Wildlands

things that could link him to the arsons. Lastly, he set the fire along his normal route of travel at a time when he normally drives that route . These mistakes by the arsonist would allow arson investigators a reasonable chance of identifying and apprehending the suspect in the future. The M.O . for the above scenario is refined and mature, but not overly unique. There is nothing in this above scenario which would indicate that the offender had a "ritual" or "signature". There are several usable link analysis factors present in the above scenario. If the arsonist continued setting fires like this, the factors that could be used to link him to the series of fires include: the same roadway or geographic area (which was on his way to his work site), the similar time of day (which is just prior to going to work), the use of consistent incendiary devices, any DNA or fingerprints found on the devices, and the consistent footwear and tire impressions found at the scenes. Additionally, if he is arrested, he may have similar incendiary devices or components in his possession, or the components at his home. His cell phone could be analyzed for mapping capabilities and for his use of the police/fire app on the days of the fires. A check of his past may show some fire service training, or research into fire behavior. All of these items could be used as part of any link analysis.

Blood Evidence: Found at scene of large brush fire. Suspect injured himself scaling a fence and fleeing scene. Courtesy of Irma Gonzales.

148

Chapter 8 : Case Linka ge

Physically linking a potential suspect to an arson scene

Suspect's Injuries: This arson suspect fell and injured himself at the fire scene, leaving blood evidence and skin tissue behind. When he was arrested the following day, he had corresponding injuries on his knees, linking him forens ically back to the arson scene. From Ed Nordskog 's case files .

The three photos depict an arson to a murder victim who was dumped in a rur al environment. This "crime concealment arson" or "anti-forensics gesture" led to a wildland fire. Virtually every "body dump" requires a vehicle to complete the task. The vehicle then becomes part of the crime, and is in fact a separate crime scene by itself The role of the investigator and forensics team is to exploit physical evidence in order to link crime scenes together, identify the individuals responsible, and link the suspects to all the crime scenes. In this case, the dump site was next to an area which was conducive to footwear and tire impression evidence (track trap). The first photo depicts a suspect vehicle's tracks leading up to the dumped/burned body. The second photo depicts the tire impres sions at the scene being captured by a criminalist who was specially trained in the photography of physical evidence. The criminalist also took casts of the tire impressions. The third and final photo in this sequence was taken weeks after the original crime scene work in the field. By this time, homicide and arson detectives had identified a potential suspect and his vehicle. This photo depicts an expert in tire impressions documenting the tire and wear patterns on the suspect 's vehicle. Eventually the vehicle was linked through forensics to both the suspect and to the body dump site. The suspect was eventually convicted.

149

Arson Investigation in the Wildlands

A suspect vehicle's tracks leading up to the dumped/burned Crime Lab.

150

body. Photo courtesy of Mike Cofield and Los Angeles Sheriff's

Chapter 8: Case Linkage

Tire impressionsat the scene. Photo

courtesy of Mike Cofield and Los Angeles Sheriff's Crime Lab.

151

Arson Investigation in the Wild lands

On November 24, 2007, at 0320 hours in the morning, a large, fast moving fire erupted in dry brush during "red flag" Santa Ana wind conditions (gusts exceeding 70 miles per hour) in the hills above Malibu, California. Within hours, over fifty luxury homes and ranch properties were destroyed as the fire raced to the ocean. The origin of the fire was quickly linked through fire patterns to a cave in the area known as a "party spot". This cave area had been closed due to a "State of Emergency" declared by the governor because of ongoing wildfires. Investigators descended on that scene to look for evidence . Among the hundreds of beer cans and liquor bottles in the cave, investigators found fresh evidence in the form of a bundle of firewood that is typically sold at stores, the twine from the firewood bundle, the plastic wrap of the bundle, a two-day old "Malibu Times" newspaper used to kindle the fire, and the makings for "S'mores" (marshmallows, chocolate and graham crackers). There were signs of an illegal campfire inside the cave. The wildfire was found to have ignited outside the cave, in thick brush . At the point of origin, investigators found a small piece of cut firewood (red circle, below) that had started the brush fire.

Origin of Wildfire: Small piece of commercial firewood found in high brush.

152

Chapter 8: Case Linkage

This piece of wood had been thrown or kicked from the cave by an unknown person. In the origin, next to this piece of wood was a small piece of orange-brown twine.

Small piece of twine found at origin of wildfire.

The investigation, which started at the origin of the fire followed a trail of clues eventually to the closest grocery store to the fire scene. In front of the store were racks containing the same issue of the "Malibu Times" that was found at the fire scene, along with stacks of commercial fire wood. The firewood was wrapped in plastic and bound with the same color twine found in the cave and at the origin of the fire. Investigators questioned the store manager about purchases in the hours prior to the fire. The manager located a receipt for a debit card purchase from five hours prior to the fire. The purchase was for the makings of "S'mores." Additionally, the same purchaser also bought a quantity of alcohol. A search warrant was obtained for the debit card information and cardholder identification. The store manager was also able to provide video footage of the purchase. This evidence showed a group of young adults entering the store and purchasing the "S'mores" and alcohol. At the same time as that purchase, a second set of young adults were outside the store stealing two bundles of firewood and taking several "Malibu Times" newspapers from the rack. The video showed that both groups knew each other and left the store together in two vehicles . From the debit card information and video depicting faces and license plates, investigators were able to eventually identify over one doze n persons who had been at the illegal cave party. Those persons were all interviewed and provided the names of the three suspects who lit the brush fire by kicking and throwing burning wood from a campfire into the brush. Eventually, all suspects admitted their actions and were convicted. 153

Arson Investigation in the Wildlands

Similar twine found around a bundle of commercial firewood in nearby cave.

154

Chapter 8 : Case Linkage

to7~0tt744~l 012-44: Evidence:Fresh marshmallows and the plastic wrap for a bund le of firewood found in cave.

.1942340 VC5 BurnedS'mores: Packagingfound near origin of the fire.

Grocery Bag: From "Ralph's" store found stuck in nearby tree.

Linkage: Investigators drove to closest grocery store, "Ralph 's" and found "Malibu Times" newspaper and bundles of firewood on display outside of store .

155

Arson Investigation in the Wildlands

(:c, ..· .,a

plll ,.

Cy · In

C!tf!:~forftllY d,r•i Hogf1t'mut Stt1ttaMc1

Moy,itai!if~'tem ber 9, 2010 at 12 :24 pm

157

Arson Investigation in the Wildlands

Review of this case history: There was nothing magical or extraordinary involved in solving this massive wildland fire case. It was little more than common sense mixed with the basics of criminal investigation, along with hard work. The fire scene told its own story: There was an illegal party/campfire, and from that event someone intentionally started a massive brushfire by kicking burning firewood into the dry brush. Within the origin was the burned wood and a small scrap of twine. Within the nearby cave were the remnants of the commercial wood bundle, alcohol bottles and the «S'mores.))Outside the cave was a "Ralphs))grocery bag stuck in a tree. After completing the scene investigation, investigators used common sense and drove to the nearby "Ralphs))where they were able to use "linkage analysis,,, and found all of the materials that had been present in the cave. The debit card receipt and video footage provided a connection to potential suspects. Eventually, detailed interviews of over a dozen people and the use of multiple polygraph examinations fleshed out the truth of the incident. lhis case history and attached ph otos courtesy of Irma Gonzales and Mike Costleigh.

Case Linkage involving Incendiary/Explosive Devices

In 2003 and 2004, a series of 15 incendiary/ explosive events occurred in Amador County, California. An unknown suspect created a series of small, but distinctive devices that caused both fires and explosions in the rural grasslands near Highway 88. The unusual aspect of the devices is that during the entirety of the series, the devices changed and evolved dramatically. However, arson /bomb investigators and crime lab personnel recognized that a few of the unique device components remained consistent throughout . The following group of photos shows the evolving improvised devices recovered during this investigation.

June 2, 2003- Hi ghway 88. Brush and grass fire along roadway. The fire was caused by a deliberate "hot set" ignition by an unknown suspect. June 14, 2003-H ighway 88. Brush and grass fire along roadway. The fire was caused by a deliberate "hot set" ignition. June 17, 2003- Highway 88. Brush and grass fire along roadway. The fire was caused by a suspect throwing a lit incendiary device into the dry vegetation. The device was described as a bundle of paper matches torn from a book with a cigarette attached. This bundle was affixed to a metal bolt by a length of brown twine . This gave the device weight when it was thrown, in order to achieve greater distance. The time delay device was lit, and then thrown, most likely from an automobile. All of the photos and documentation for thi s case study are courtesyfrom Joe Konefid's and Tom Oldag 's casefiles.

158

Chapter 8: Case Linkage

June 19, 2003-Highway 88, directly across from the June 17 fire. Small brush and grass fire on the side of the highway. The fire was caused by a deliberate "hot set" ignition. While fire crews were suppressing the fire, an explosion occurred next to one of the fire vehicles. The explosive was a small, improvised pipe bomb containing a low-explosive powder, Pyrodex. It initiated by a short time delay fuse/ cigarette. The device was wrapped in red cloth and a paper bag, and had blue thread and a thick brown rubber band as binding material. It also had small firecrackers bound to the outside. The device was disguised to appear like a piece of roadside trash. The device "low ordered" meaning it did not function to its full capacity. However, the explosion partially ruptured the pipe and produced metal pieces of fragmentation. The end cap of the pipe came apart and impacted a fire truck which was parked nearby. (Next photo)

June 26, 2003-New York Ranch Rd. Brush and grass fire along roadway. The fire was caused by a deliberate "hot set" ignition. June 27, 2003-New York Ranch Rd.; 100 yards from previous fire. Brush and grass fire along roadway. The fire was caused by a deliberate "hot set" ignition.

159

Arson Investigation in the Wildlands

Small, improvised pipe bomb disguised to appear like a piece of roadside trash.

The end cap of the pipe came apart and impacted a fire truck which was parked nearby.

June 28, 2003-New York Ranch Rd.; within 100 yards of previous two fires. A failed incendiary device was found along the highway. The device was a commercial firework known as a "Roman Candle", wrapped in some white gauze which was bound with a rubber band, and had a piece of blue paper towel bound to it with a piece of brown twine. There was also a 6" strand of dark human hair affixed to the device.

160

Chapter 8 : Case Linka ge

A piece of blue paper towel bound to it with a piece of brown twine. There was also a 6" strand of dark human hair affixed to the device.

July 2, 2003-New York Ranch Rd; one mile north of previous three incidents. A failed incendiary/ explosive device was found lying in dry brush next to the roadway. The device was a 20-ounce plastic soda bottle filled with gasoline. It was wrapped in soft foam, and affixed to it was a Roman Candle type firework paper tube, with an improvised fuse at the top, consisting of red fabric, and blue shirt fabric containing several paper matches. This device had a second fuse attached to the side, wrapped in blue fabric. The entire item was bound several times with various rubber bands and blue thread. It appeared both improvised fuses on the device had been lit and self-extinguished. The second photo on the next page shows the shirt material that was affixed to the side of the device. The material was burned on the edge (arrow) and appeared to be the lit fuse or initiator for this failed device. The burning material would have led to the matches and low explosive filler inside, and ignited or exploded this material. The fuse failed to function as designed. The final photo of this device is the second improvised fuse that was tied via thread to the top of a Roman Candle. This fuse also had multiple paper matches linking it to the hobby fuse of the firework. The blue fabric of this fuse shows burn marks similar to the other fuse (arrow).

July 2, 2003-New York Ranch Rd; ¼ mile north of previous incident-Fire in brush and grass. The fire was ignited by an improvised incendiary device consisting of cloth, metal scrubbing pad, multiple paper matches, firecrackers, and a metal bolt as a weight. The item was heavily damaged in the fire. The item was bound together with rubber bands and blue thread. 161

Arson Invest igation in the Wild lands

A failed incendiary/explosive device was found lying in dry brush next to the roadway. The device was a 20-ounce plastic soda bottle filled with gasoline.

162

Chap ter 8: Case Link age

Improvised incendiary device consisting of cloth, metal scrubbing pad, multiple paper matches, firecrackers, and a metal bolt as a weight.

July 3, 2003-New York Ranch Rd; same location as previous day. A fire crew returning to check on previous day's fire found an unburned improvised explosive/incendiary device. 163

Arson Investigation in the Wildlands

The device was a white towel and blue plaid shirt wrapped around a metal wheel (for weight), and filled with Pyrodex low explosive powder and paper matches. It was bound together by a rubber band, blue thread and brown twine. The blue shirt material appears to be from the same shirt as material in two previous devices.

July 13, 200 3- Highway 88 . Brush and grass fire. Fire was ignited by a doth device soaked in gasoline . Device was a blue paper towel wrapped inside of a red doth. Red doth was similar to material from two previous devices.

Clothdevice soaked in gaso line.

164

Chapter 8: Case Linkage

July 13, 2003-New

YorkRanch Rd; same location as two previous fires. A small brush

and grass fire was caused by a "hot set" ignition.

July 27, 2003-New

YorkRanch Rd; a bag of trash was found burning on the side of the

roadway.

August 27, 2003-Highway 88. A brush and grass fire on the side of the road was caused by a highway flare thrown into the vegetation.

A highway fl are thr ow n into th e veget ati on.

February 5, 2004-New

York Ranch Rd. A road crew deaning the roadside discovers

an improvised incendiary device that had not functioned. The device was comprised of two bottle rockets, with five wooden matches secured to them via rubber bands and blue thread. A filtered cigarette butt (burned) was fastened to this item as a delay mechanism .

165

Arson Investigation in the V\/ildlands

An improvised incendiary device that had not functioned.

The cigarette butt from the final device, along with three black hairs found on previous devices were submitted to the DO] lab in February of 2004. In October 2007, a DNA match was finally obtained. The DNA was from a local man who had recently been convicted of building an exotic, remotely operated rifle into the engine area of his car. The rifle had mis-fired, which in turn caused a fire to occur in the vehicle. Responding firefighters found the illegal weapon and held the driver for police. This bizarre incident occurred in 2002, several months prior to the arson series.

The DNA could only link the suspect to one of the devices. The investigators had to conduct detailed device analysis in order to develop further links between the devices and the suspect. In the end, the analysis conducted was able to establish that each incendiary or explosive device was constructed and deployed by the same individual.

The specific unique characteristics used in this link analysis included the following: •

The general location of all the fires was within a small geographic area

•

Multiple fires are "double taps" or literally on top of or next to previous fires

•

Several fires were within close time proximity to each other

•

The dominant business in the area of the fires was a casino

•

The suspect was known to frequent the casino, thus establishing an "anchor point"

•

The overall style of construction

is consistent in almost all the devices

Multip le devices included the use of the following materials: •

Twine and string

•

Blue thread as binding

•

Rubber bands as binding

166

Chapter 8: Case Linkage

• •

The same blue plaid shirt material

•

White cloth and gauze

• • •

Roman Candles and firecrackers Acceleran ts

•

Explosive powders

• •

Paper matches

The same red cloth

Time delay system

Weighted materials

qd~J~~f;.~ It was learned by investigators that after his arrest for the illegal gun and car fire, the suspect held a serious grudge against local firefighters . The suspect was out of jail pending trial when he began the arson series which targeted local firefighters. Additionally, it was learned that the suspect lived forty miles away from the area of the fires, but was linked to the area by the fact that he frequented a casino within the zone of the fires. These facts helped establish a motive and opportunity for this bizarre string of incidents . The suspect eventually went to prison.

In 2012, an unknown person set 52 fires in a four-night period in the Hollywood area of Los Angeles. The arsonist used a specific incendiary arrangement of materials, and followed a consistent method of starting most of his fires. The M.O. and device was as follows: the arsonist, dressed all in black clothing, drove a dark van to within a block of his targets. H e exited the van and approached his targets on foot. In his hands he carried an incendiary arrangement of materials consisting of a small "fire starter log", on top of which was placed a chemical booster tablet. This item was placed under the front of a vehicle, near its fan shroud. The arsonist slightly changed the device 3-4 times during the series as supplies ran out, but his placement of the device never wavered. After placing the device, the arsonist lit the item on fire with a small, disposable torch purchased at a liquor store. The fire from the device eventually ignited the plastic materials under the car, which usually involved the entire front -end of the vehicle, and any surrounding structures. The next photo is a re-creation of the device by investigators and a photo of it being tested for analysis/ court purposes.

A re-c reati on of th e device by investig ators and a photo of it being t ested for analysis/co urt purp oses.

167

Arson Investigat ion in the Wild!ands

Four days into the serial arson investigation, the suspect was stopped and arrested by police officers leaving the scene of his fifty-second arson attack. Next to him in his vehicle was a cloth bag containing the components of thirteen additional incendiary devices. He was wearing the dark clothing and his hands were smeared with residue from the fire starter logs. The following photo depicts the items seized from the suspect upon his arrest (aka Pocket Litter).

Components of thirteen additiona l incendiary devices.

Immediately after the arrest of the suspect, police detectives on the Task Force executed a search warrant at his Hollywood apartment. They found a set of car keys that had a "Ralph's" grocery store "rewards" card affixed to them. The investigators located a "Ralph's" grocery store directly across the street from the arsonist's home (following two photos, next page). Using common sense, the investigators simply walked across the street to see if "Ralph's" sold any of the components of the incendiary devices found in the possession of the arsonist. The following photo depicts the related items found by investigators. The "Ralph's" grocery store closest to where the suspect lived sold every single component of the incendiary devices used in all fifty-two fires, and the additional devices found in the suspect's vehicle. Continuing the investigation at the "Ralph's" store, Task Force investigators generated an additional court order to scan the suspect's "Ralph's rewards" card for any purchases made from it. Additionally, they sought "Ralph's" records for all device components sold to persons over the previous month. Eventually, the court order produced evidence that the arsonist had purchased more than seventy items in the previous two weeks that had been used at the various fire scenes. The below image is a portion of the police report documenting the evidence seized at the "Ralph's" linking the suspect to the store, and to the device components. 168

Chapter 8: Case Linkage

Suspect had a Ralph'sClub card.

The "Ralph's" grocery store closest to where the suspect lived sold every single component of the incend iary devices used in all fifty-two fires, and the additiona l devices found in the suspect 's vehicle.

169

Arson Investigation in the Wildlands

n Janu ry 2 2012, Oetectiv J. G H micide Di i ion. R bbery pe int d L FD A on e •ti n v ith ed

..

9 and f, We ~·ct

rimina

fl · targetingthe H

On fanuary2. 20 l . the bel w listed itt:m wer • purch s e iden c. t be u d during the ar on in esti ation.

i •

7257 W.. uns• 8h,d. a

II l was purch sed by De uerra on January · Arro o on J nuary . 20 . -, t IO 5 n

Item. #2 through# I O w r purch e I mark d and pho ogr ph d. D

64 J 7. Priorto the bcx>king of these it. m. tAFD Foren photo · d it m Pl . AU i ·ms ere then boo ·