The IAAI and CFITrainer.Net present these podcasts with a focus on issues relating to fire investigation. With expertise from around the world, the International Association of Arson Investigators produces these podcasts to bring more information and electronic media to fire investigators looking for training, education and general information about fire investigation. Topics include recent technologies, issues in the news, training opportunities, changes in laws and standards and any other topic that might be of interest to a fire investigator or industry professional affected by fire. Information is presented using a combination of original stories and interviews with scientists, leaders in fire investigation from the fire service and the law enforcement community.
Rod Ammon: Welcome to the CFITrainer.Net podcast. We open this episode with a quick update on the Australian bushfire season. As of the date this podcast was recorded, even though there have been recent heavy rains and cooler weather, more than 100 fires are still burning in Australia, principally in coastal New South Wales and Victoria. In addition, the area is now enduring massive dust storms, flash flooding, and golf ball sized hail. The forecast calls for fire danger to escalate in the coming weeks as drier weather moves in and temperatures rise. As of January 20, 2020 it is estimated that during the bushfire season, at least 28 people have been killed, 25.7 million acres have been burned, and 2,600 homes have been destroyed. IAAI continues to support the Australian Fire Service and asks you to join them by donating to the Australian Red Cross relief effort. You will find a link on this podcast page.
As we mentioned last month, our podcasts in 2020 will have a technology theme, and our first feature is a wild one. At this year's IAAI International Training Conference, which runs April 26 through May 1 in Las Vegas, there will be a seminar on how spoofing and masking technologies were used to frame an innocent mother and perpetrate an arson fraud. The course is presented by Shane Otto and Zach McCune. Mr. McCune, a partner in Rolfe’s Henry's Cincinnati office, and one of only a few attorneys to hold the IAAI-CFI certification, is with us today to preview this course and talk a little bit about the role of technology in the case. Zach, welcome to the podcast.
Zach McCune: Thanks for having me.
Rod Ammon: First, why don't you tell us a little bit about yourself and the expertise you've developed in the role of technology in fire investigation?
Zach McCune: Sure. So I am a partner in Rolfe’s Henry's Cincinnati office, and I've been with them for about 12 years now, and the one area of focus that I've had throughout the course of my practice, in addition to doing insurance fraud investigations with a heavy emphasis on fire and arson cases, is developing an expertise in cell phone and other technology-related matters.
So in terms of our firm, we assist insurance companies on fraud investigations all throughout the country. Then we also do a lot of fire science litigation all throughout the country. And one of the things that has developed in that area is from cell phone and computer technology, things that range from the Sellbrite technologies to cell phone tower data analysis, computer forensics, and kind of the interplay and the way that has been increasingly used in fraud over about the past 15 years. So I, within our firm, am kind of the go-to person in terms of that technology and the way that it might interact with a given case, and then utilizing different experts to help identify the different types of arsons or other fire science cases where something like that could come up.
Rod Ammon: I'm sure that your firm, as well as your clients, are thrilled that you carry this knowledge. So how did you become involved in this case?
Zach McCune: So this was a case that we assisted all state insurance with. So Shane Otto, who will be co-presenting with me, will be able to speak to more of the insurance side of how this works, but very early on, in certain arson cases, when an insurance company is involved, oftentimes our firm is the first call. So this was a fire where we got a call at some point during the first week after the fire, and the initial role that we were going to be playing, which drastically expanded, was just in terms of getting cell phone tower data records. So with a lot of arsons, one of the first steps from the insurance company's perspective is to get in motion a process where they can get different individuals' cell phone tower data records to attempt to look at locations, communications with witnesses near the time of the actual fire, but a lot of times at other relevant times in their investigation too. So on this claim, it actually started from that kind of discrete function and then drastically grew based upon some of the information that came up early in the investigation.
Rod Ammon: Set the scene for us. What are the basic facts of the case?
Zach McCune: Okay. So you have an arson fire that happens at a house in a rural community outside of Cincinnati, Ohio. The insured represents to the insurance company that he is staying at a hotel multiple hours away from the loss location, and almost immediately, one of the things that's very interesting about this fire is that surveillance on a residential fire has survived the fire. That's somewhat unique. Typically on a residential fire, it will burn up, and you won't have anything left in terms of a significant chunk of surveillance to look at. But here, for a very specific reason, it survived the fire, and the insured immediately started blaming the mother of one of his children as having committed the fire, and then pointing out all of these distinct characteristics of the person who was on the surveillance and basically representing that was the mother of one of his kids, and, "She's responsible for this. Lock her up for a long time. My insurance claim is legitimate."
So that set off the stage of, he has represented he has an alibi hours away, so cell phone tower data is relevant for that purpose. The mother obviously was located at a particular location the night of the fire, so we wanted to look at her cell phone tower data, and then it kind of took off from there. And one of the things that we hope will be helpful with this presentation is in addition to discussions of all of the technology that was involved in the spoofing and framing this particular woman was the communications via what are called immunity requests with law enforcement, that helped the investigation develop. We had a very good working relationship with law enforcement, and responding to their immunity requests, and the investigation grew and grew once information became available throughout that process. But again, it started with fire, rural area, insured is hours away, blames the ex, and then it took off from there.
Rod Ammon: Yeah. I was going to ask you to not give away too much and sort of tease what's going on, because we don't want to take away the seminar's thunder, but you seem to have set that up very well. Any other technologies that were used to frame someone else for the arson that you might want to talk about yet, or no?
Zach McCune: Without giving away too much and without giving away the order in which they were discovered, we will end up touching upon programs like TelTech and SpoofCard that can be used to fake cell phone communications. We will have heavy emphasis on fake social media accounts, including fake Facebook accounts, fake Google accounts, VPN communications, and the way that they can be used to fake communications, more traditional methods of faking or concealing what you're doing, fake debit cards. We had wigs, masks that were created based upon facial recognition technology, fake clothing.
And then in addition to identifying those, and kind of the order in which they came into play in this given case, we'll also talk about the difficulties or challenges that are sometimes faced in a civil investigation versus a criminal investigation, in terms of how you approach these technology groups to attempt to get information from them. So we'll go through what it's like to subpoena Google and Facebook and some of the bigger quote-unquote "big tech" companies in the civil context, when you're investigating insurance fraud, but there's obviously a potential criminal component to that if there is an arson that's the underlying event that triggered that.
And then some of the other companies, like the companies that make these masks, that can create wigs. I think we probably subpoenaed, I don't know, six or seven of the largest cell phone companies in the world, so what it's like to repeatedly come to them for their information, so we'll kind of go through the plethora of that. So those are main topic areas, without giving away too much of what actually happened in this given case,
Rod Ammon: You must have done this just right, because my head's burning. There's so much I want to hear from you. You talked a lot about all different kinds of technologies that were used, services that were used, the social media. What about, are you going to talk a little bit about technologies that were used as investigative tools?
Zach McCune: Yeah. We will jump into, in this case, and one of the things that I hope is also interesting for the audience is, what I would, say the panel of experts who were used in this case. So we had forensic accountants, we had computer experts, we had cell phone experts, we had cell phone tower data experts, which is different from the physical phone, the analysis of how phones are communicating with towers. We had fire origin and cause investigators. We had origin cause investigators who were doing fire debris sift analysis. So you had a whole wide range of them, and all of the expertise that they bring, and then their interaction with some of this technology, we use Sellbrite downloads on some of the phones, Oxygen downloads on some of the phones, and then there was the more traditional gathering of social media evidence, and how you investigate fake social media accounts, fake communications that one way or another would go through a cell phone. So the presentation will hit on all of that. The investigation involved all of that.
Rod Ammon: You know, you're on the same page as us, and you and I haven't met before and I'm sitting here going through some of my questions, and you went right into developing a team of expertise, so thank you for that, because that has often been an issue, whether it's a small or a large department or agency that's working into something. "How do you develop that team?"
So I guess one of the things that I do want to still get out of you is, as you're looking at a case like this, and as you did with this case or some other, what's the light bulb? What's the switch that makes you say, "Why do I need help?" How did you know you needed to reach out? And where can people reach out to get something like this started?
Zach McCune: Sure. Well, it obviously doesn't just happen, in this one case. Over years and years and years, our firm has developed relationships with different experts who are kind of go-to people in given areas. And then you look at whether you want someone close geographically to you, and we have a network of experts that we would use there, or whether you go somewhere national and pull someone in, and then it's a very fact-specific case by case basis of once a new item of evidence comes up, who the best person is to analyze that, get you back results quickly, work well with the other experts, and compliment what they do.
Just an example, a very odd pairing of experts that actually turned out to be incredibly interesting in this case, on some level pairing an analysis from a fire debris sift expert in comparison to a forensic accountant to essentially arrive at the same results, was just one of the ways that we paired that. So it's very fact specific, and as each individual item of evidence comes up, there's a very quick call that goes out to someone, and they're on to assist you throughout the rest of the case.
Rod Ammon: You bring up a couple of good points there, obviously. You know the one that we've talked about with so many different experts who do this well is building these relationships early. Not exchanging the business card, as they say, for the first time at the scene. And that's nice to hear. There's a lot going on here. How long is this class? What's the session like?
Zach McCune: This presentation, I believe we're slotted for four hours, which seems long, but with the facts of this case, I think people will kind of be on their toes. That's actually a somewhat brief period of time to hit on all of the topics that came up in this case. So I think it will be very, very interesting. People will be engaged throughout, and the way that the presentation is set up, because it's in many ways the exact same way that the investigation developed, so again, we got that initial call just about doing cell phone tower data analysis, and then ended up in a case that lasted two and a half to three years, unbelievably long court filings that related to the events underlying the case.
So it kind of builds on itself, on some level, a little bit like a mystery that's being solved, especially when that way that the investigation developed, and it's the same way that the presentation is given. And it helps to explain identifying these issues with technology, how you go about investigating them, how you use your panel of experts, how you tie it in to the greater case or investigation that's going on, and then how you reach your end conclusion. So I think it fits well in that four-hour gap. It gives people enough time to sink their teeth into what was going on, to help identify some of this themselves. Some of the technology are things that the audience will kind of get a chance to watch themselves first and attempt to spot issues themselves, and then we'll come back to how it played into the overall investigation on how everything kind of tied together.
Rod Ammon: You know, it's interesting. Usually when people tell me how long a class is, I go like, "Wow, that's a lot. That's a lot of time." And in this case, when you said four hours, I was thinking a day or two. It sounds like a jam packed four hours to me.
Zach McCune: It absolutely is. It's tough to pare it down to a timeframe that's shorter than that. You could absolutely go longer delving into a lot of these individual topics, some of them, and more details of the case, but four hours is a pretty nice chunk of time, especially in one of these seminars, for hitting on all of these technology issues, telling the story of this case, and it'll make for a nice presentation segment.
Rod Ammon: And that's one of the beauties of being at ITC. Those people, after they get done with this, they're going to chase you to either the bar or the restaurant and try to get more. What have I missed?
Zach McCune: Not much, because I wouldn't want to, in a preliminary podcast segment, give away too much of what occurred here. I think when we've been able to hit on basic facts of the case, people maybe have a little sense of where it's going, and then the different types of technology that we'll be talking about throughout the case. So we basically got it.
Rod Ammon: Well, I feel the same way about being teased, because I'm looking forward to seeing it, and I think people have a lot to unpack from just what we've heard you tell us today. I appreciate you joining us, and all of you out there, you could check out this seminar and more than two dozen other ITC courses at iaaiitc.com. The early bird registration discount ends on February 1. Zach, thanks a lot for your time. I really appreciate it.
Zach McCune: Thank you so much.
Rod Ammon: We'll see you out there.
Zach McCune: Okay, thanks. Bye.
Rod Ammon: Here's a quick news item out of New Jersey that further illustrates the importance of technology and electronic evidence in fire investigation. On January 12, a fire destroyed several buildings in downtown Bound Brook, New Jersey. Initially the investigation was expected to last months, due to the devastation of the fire. However, only two days after the fire, law enforcement had a suspect in custody. Among the evidence investigators quickly uncovered were social media posts threatening to start a fire, allegedly made by the arsonist, and footage from multiple surveillance cameras that allowed them to track the suspect, who was wearing a distinctive shirt design, as he moved through the downtown area an hour or so before the fire began. He was seen on video entering and exiting a liquor store, then walking toward an apartment complex with something in his hand, and returning by the same path, moments later, just two minutes before the massive fire began. The suspect has been charged with arson and hindering an investigation. Dozens of people were displaced by the fire, which caused $52 million in damage.
We also have a new training opportunity to share with you. This month, CFITrainer.Net debuted a new online learning module, Introduction to Appliances. This module is a basic introduction to how many major appliances operate, covering components, explaining operation and heat generation, and describing common safety and thermal protection devices. It's a good foundation for further study in appliances as potential fire causes. The module includes applied examples and 3D animation. Check it out and earn your certificate of completion today.
This podcast and CFITrainer.Net are made possible by funding from a fire prevention and safety grant from the Assistance to Firefighters Grant Program administered by FEMA and the US Department of Homeland Security. There's also support from the Bureau of Alcohol, Tobacco, Firearms, and Explosives, and voluntary online donations from CFITrainer.Net users and podcast listeners.
Thanks for joining us today on the podcast. Stay safe out there. We'll see you next time. For the International Association of Arson Investigators and CFITrainer.Net, I'm Rod Ammon.
McGuirk, Rod. Dust storms, hail and flash floods batter Australian cities amid raging wildfires. 20 Jan 2020.
Donate to the Australian Red Cross' bushfire relief effort
2020 IAAI ITC. April 26 – May 1, 2020. Las Vegas, NV.
Kausch, Katie. Bound Brook man charged with arson in massive downtown fire. NJ.com. 14 Jan 2020.
Introduction to Appliances. CFITrainer.Net
This program provides a primer on accreditation, certification, and certificates for fire investigation training.
A fire occurred on the night of Feb. 20, 2003, in The Station nightclub at 211 Cowesett Avenue, West Warwick, Rhode Island.
Arc Mapping, or Arc Fault Circuit Analysis, uses the electrical system to help reconstruct a scene, providing investigators with a means of determining the area of a fire’s origin.
This module introduces basic electrical concepts, including: terminology, atomic theory and electricity, Ohm’s Law, Joule’s Law, AC and DC power.
A fire occurred on the evening of June 18, 2007, in the Sofa Super Store in Charleston, SC that resulted in the deaths of nine fire fighters.
This module looks at the many ways fire investigators enter and grow in the profession through academia, the fire service, law enforcement, insurance, and engineering.
This module will present a description of the IAAI organization.
This module takes a closer look at four of the most commonly-reported accidental fire causes according to "NFPA Fact Sheet.
This program brings three highly experienced fire investigators and an attorney with experience as a prosecutor and civil litigator together for a round table discussion.
One of the legal proceedings that may require the fire investigator to testify is a deposition. Depositions are often related to civil proceedings, but more and more jurisdictions are using them in criminal cases.
Deposing attorneys employ a variety of tactics to learn about the expert witness giving testimony, to try to unsettle that witness to see how he/she handles such pressure, and to probe for weaknesses to exploit.
The program discusses the basics of digital photography for fire investigators as well as software and editing procedures for digital images intended as evidence.
This self-paced program is an introduction to discovery in civil proceedings such as fire loss claims and product defect lawsuits.
This self-paced program is an introduction to discovery in criminal proceedings.
This module covers the foundation of DNA evidence: defining, recognizing, collecting, and testing.
This program provides a practical overview of how to perform the baseline documentation tasks that occur at every scene.
This module will discuss the techniques and strategies for conducting a proper science-based fire scene investigation and effectively presenting an investigator’s findings in court as an expert witness.
This program explains the basic principles of how electric and hybrid vehicles are designed and work, including major systems and typical components.
This module presents critical electrical safety practices that every fire investigator should implement at every scene, every time.
In this program, we will look at emerging technologies that fire investigators are integrating into their daily investigative work with great success.
This self-paced program examines the fire investigator's ethical duties beyond the fire scene.
As social media has emerged as a powerful force in interpersonal communications, fire investigators are being confronted with new questions...
Should you work for a private lab as a consultant if you are on an Arson Task Force? How about accepting discounts from the local hardware store as a “thanks” for a job well done on a fire they had last year?
This module takes investigators into the forensic laboratory and shows them what happens to the different types of fire scene evidence that are typically submitted for testing.
This module teaches the foundational knowledge of explosion dynamics, which is a necessary precursor to investigating an explosion scene.
This module addresses the foundations of fire chemistry and places it within the context of fire scene investigations.
The program is designed to introduce a new Palm/Pocket PC application called CFI Calculator to users and provide examples of how it can be used by fire investigators in the field.
This module examines these concepts to help all professionals tasked with determining fire origin and cause better understand fire flow dynamics so they can apply that knowledge to both to fire investigation and to fire attack.
This module provides a road map for fire officers to integrate and navigate their fire investigation duty with all their other responsibilities and describes where to obtain specific training in fire investigation.
The evaluation of hazards and the assessment of the relative risks associated with the investigation of fires and explosions are critical factors in the management of any investigation.
This module will describe the most commonly encountered fire protection systems.
This module presents best practices in preparing for and conducting the informational interview with witnesses in the fire investigation case.
This module provides instruction on the fundamentals of residential building construction with an eye toward how building construction affects fire development.
This module provides introductory information on the Hazardous Waste Operations and Emergency Response (HAZWOPER) standard – 29 CFR 1910.120.
This module teaches first responders, including fire, police and EMS, how to make critical observations.
The program examines the importance of assessing the impact of ventilation on a fire.
This program discusses how to access insurance information, understand insurance documents, ask key questions of witnesses, and apply the information learned.
This module offers a basic introduction about how some selected major appliances operate.
This program introduces the fire investigator to the issues related to the collection, handling and use of evidence related to a fire investigation.
This program takes you inside the National Institute of Standards and Technology (NIST) archives of some of the most interesting and instructive test burns and fire model simulations they have ever conducted.
The program provides foundational background on the scope of the youth-set fire problem, the importance of rigorous fire investigation in addressing this problem, and the role of key agencies in the response to a youth-set fire.
This module provides a thorough understanding of the ways an investigation changes when a fire-related death occurs.
This self-paced program will help you understand what to expect at a fire where an LODD has occurred, what your role is, how to interact with others, and how to handle special circumstances at the scene.
This program will introduce the fire investigator to the basic methodologies use to investigate vehicle fires.
This module presents the role natural gas can play in fire ignition, fuel load, and spread; the elements of investigating a fire in a residence where natural gas is present; and the potential role the gas utility or the municipality can play an investigation.
This self-paced program covers fundamental legal aspects of investigating youth-set fires, including the juvenile justice system, legalities of interviews and interrogations, arson statutes, search and seizure, and confidentiality.
This program discusses the latest developments in expert testimony under the Daubert standard, including the MagneTek case recently decided in the United States Circuit Court of Appeals.
This module focuses on how to manage investigations that have “complicating” factors.
This module uses the Motive, Means, and Opportunity case study to demonstrate how responsibility is determined in an arson case.
This program covers the general anatomy of a motor vehicle and a description of typical components of the engine, electrical, ignition, and fuel systems.
This self-paced program is the second part of a two-part basic introduction to motor vehicle systems. This program describes the function and major components of the transmission, exhaust, brake, and accessory systems.
This module educates the investigator about NFPA 1033’s importance, its requirements, and how those requirements impact the fire investigator’s professional development.
This module reviews the major changes included in the documents including the use of color photos in NFPA 921 and additional material that supports the expanded required knowledge list in NFPA 1033 Section 1.3.7.
The program illustrates for the fire investigator, how non-traditional fire scene evidence can be helpful during an investigation.
This module introduces the postflashover topic, describes ventilation-controlled fire flow, illustrates how the damage left by a postflashover can be significantly different than if that fire was extinguished preflashover.
This module demonstrates the investigative potential of information stored on electronic devices.
This module explains the relationship between NFPA 1033 and NFPA 921
This module lays the groundwork for understanding marine fires by covering four basic concepts that the investigator must understand before investigating a marine fire.
In this module, you will learn more about how cancer develops, what occupational exposure risks to carcinogens exist at fire scenes, and how to better protect yourself against those exposures.
The use of the process of elimination in the determination of a fire cause is a topic that has generated significant discussion and controversy in the fire investigation profession.
This module teaches the basics of the electrical power generation, distribution, and transmission system.
This module presents the basics of natural gas and its uses and system components in a residence.
The basics of the scientific method are deceptively simple: observe, hypothesize, test, and conclude.
This module explains the principles of search and seizure under the Fourth Amendment, as contained in the amendment and according to subsequent case law, and applies them to typical fire scene scenarios.
This module addresses the foundations of thermometry, including the definition of temperature, the scales used to measure temperature and much more.
This program presents the results of flame experiments conducted with a candle.
This self-paced program explains to non-investigators the role of the fire investigator, what the fire investigator does, how the fire investigator is trained, what qualifications the fire investigator must meet.
This module will untangle the meanings of "undetermined," straighten out how to use the term correctly, talk about how not to use it, and describe how to properly report fires where "undetermined" is the cause or classification.
This module will advise fire investigators on how to approach the fact-finding procedures necessary and validate a hypothesis.
This module provides an overview on how structures can become vacant and eventually abandoned.
This self-paced program provides a basic framework for structuring the management of fire cases and fire investigators.
This module illustrates how wildland fires spread, explains how to interpret burn patterns unique to these types of fires.
This module presents the key elements of the initial origin and cause report and methods of clearly presenting findings in a professional manner.