cbrne forensics vpress - tyndall national institute forensics.pdf · 2 cbrn forensics contents...

CBRNForensics

Issue 1

Forensics in a contaminated environment

Supported by GIFT Forensics

CBRNe Forensics vPress:CBRNe Forensics vPress 30/01/2017 09:33

MOBILE | MODULAR | LABORATORY COMPONENTS 1-386-265-4300 www.GERMFREE.com

The World’s Only Manufacturer of BSL-3 Mobile Laboratories

Foreword

1CBRN Forensics

The Merriam-Webster dictionary defines forensic as‘relating to the use of scientific knowledge or methods insolving crimes’. The well-developed field of forensicsbecomes considerably more challenging when additionalhazards, such as chemical, biological, radiological or nuclearare present at the scene of an investigation. Protecting firstresponders from these hazards is a priority, as ispreservation of the evidence. Awareness, training and toolsare key elements for safe, successful outcomes.

Awareness that additional hazards may be present beyondwhat can be seen is the first step. This new journal will aidin raising the awareness of the additional risks of workingin a CBRN environment. Training in a variety of scenarioswill increase the capabilities and confidence of the firstresponders and forensic investigators in responding safely.Finally, tools, in the form of hardware - technology such assensors, protective equipment, etc. - and procedures areneeded to ensure the preservation of evidence whileprotecting the investigators.

The procedures and processes used in handling CBRNcontaminated evidence need to be carefully thought outand implemented. Decontaminating an item may lead toloss of the forensic evidence necessary for theinvestigation. Additionally, information from the CBRNagent may, itself, be a key part of the investigation. Thisaspect of CBRN forensics has been, and is beingresearched to different degrees. Using the ChemicalAbstracts Service’s SciFinder tool, searching for nuclearforensics returns 426 articles, while microbial forensics orbiological forensics returns a total of 143 and chemicalforensics returns only 11. Clearly, RN forensics is far aheadof CB forensics.

In 2015, the International Atomic Energy Agency, issuedrevision 1 of the implementation guide Nuclear Forensics inSupport of Investigation. The authors state: “Nuclearforensic examinations have been successfully applied to anumber of reported cases involving the illicit trafficking ofhigh enriched uranium and plutonium, as well as eventsinvolving nuclear and other radioactive material out ofregulatory control.”

Microbial forensics has come a long way in the past twodecades. In the 2001 anthrax attacks in the US (theAmerithrax case), DNA fingerprinting proved fairly early

that it was the Ames strain. Complete genome sequencingover the next few years enabled the FBI in 2008 toconclude that the anthrax used in 2001 all originated froma single flask of material.

In 2014, the National Academies Press published ScienceNeeds for Microbial Forensics: Developing InitialInternational Research Priorities. This documented noted:“…that, at the time of the anthrax letters mailings, the toolsand technologies that were readily available were notadequate and the science of microbial forensics was in itsinfancy and limited to a few pioneering laboratories.” Thedocument also highlights the need for this to be aninternational collaboration with both reference collectionsand accessible databases.

Where does this leave chemical forensics? A limited amountof research has been carried out and plans are underway formore research. A fourth symposium on chemical forensicswill be held at the Spring 2017 American Chemical SocietyNational Meeting. While there exists no internationalresearch effort on chemical forensics at this time, chemicalproduction techniques have been used to attempt todetermine attribution.

The third report of the OPCW - UN Joint InvestigativeMechanism (24 August 2016) includes the following text:“Multiple sources suggested that the sulphur mustard inquestion was undistilled and had been generated throughthe Levinstein process. According to them, the bad smell(rotten eggs) and colour of the substance (dark green/blue)were consistent with sulphur mustard used by ISIL in otherincidents … Some sources provided information thatindicated that ISIL had the capacity to produce sulphurmustard through the Levinstein chemical reaction process.[The OPCW] confirmed that the sulphur mustard from theSyrian Arab Republic did not contain impurities such aspolysulphides, meaning that a different process was used bythe government. The OPCW also reported that the sulphurmustard used by ISIL in northern Iraq on several occasionsin 2015 and 2016 was produced through the Levinsteinprocess. … There is not sufficient information available todraw conclusions on the origin of the sulphur mustard usedduring this incident.”

I look forward to more research on chemical forensics, andwish the new journal success!

ForewordHugh Gregg, head of the Organization for the Prohibition of ChemicalWeapons (OPCW) laboratory

CBRNe Forensics vPress:CBRNe Forensics vPress 30/01/2017 09:33 Page 1

Legal Niceties: Reproduction in whole, or

part, of any content of CBRN Forensics,

without prior permission, is strictly

prohibited. Any correspondence should be

addressed to The Editor, CBRN Forensics.

We acknowledge the assistance and hard

work of many individuals, associations

and organisations who have contributed

to this magazine. The information

published in this magazine has been

published in good faith and the opinions

contained in the article are those of the

author and not Falcon Communication

Ltd. Photos are credited individually,

non attributed articles are from the

CBRNe World archive.

©Falcon Communication Ltd 2016.

Front cover image ©AWE/MoD

CBRN Forensics is entirely funded via

the European Commission project GIFT:

Generic Integrated Forensics Toolbox.

Falcon Communications has not profited

from this magazine in any way.

Web: www.giftforensics.eu

2 CBRN Forensics

Contents

ContentCBRNe Forensics vPress:CBRNe Forensics vPress 30/01/2017 09:34 Page 2

3CBRN Forensics

Contents

ntents1 Foreword

4 Welcome to GIFT

5 – 7 Meet the Team

8 – 9 Future dreaming Ed van Zalen and Peter de Bruyn, from the NetherlandsForensic Institute on what the future holds

10 – 11 Gift wrappedEd van Zalen talks to Claudine Weeks on the

GIFT legacy

12 – 13 A good sniffEric Moore, from Tyndall University, on some of the

GIFT chemical detectors

14 – 17 Common approach pathDr Jason Bannan, from the FBI Laboratory, on the

genesis of CBRN forensics

18 Out of the darknessJohan Sand, from STUK, on stand off alpha detection

19 – 20 The SearchersDaan Noort, from TNO, on their work to improve

forensic chemical detection

21 – 24 Theatre nightAdrien Sivignon, from CONSTOX, on pre-Bataclan

developments in French forensics

25 – 26 Risky BusinessPeter Den Outer, RIVM,, and Govert Verstappen, NFI,

on the need for a CBRN forensics risk assessment tool

27 – 29 CSI UK!Karl Harrison, from Cranfield University, on the

UK’s response to CBRNE incidents

30 – 31 Analyse This! Michael Madden, from Analyse IQ, on chemometrics

in forensic analysis

32 – 35 Habsburg HazmatGunter Povoden talks to Claudine Weeks about

Austrian military forensics

36 – 37 Team effortLt. Col Martel and Katleen de Meulenaere on

Belgian military forensics

38 – 41 CSI2Dr Randall Murch on the blueprint for a CBRN

forensics capability

42 – 43 Mind the GapThe gaps in European CBRN forensics

44 – 46 Dangerous CluesSteve Johnson on forensics, SIBCRA and WIT

47 Light fantasticSilvia Lopez on the GIFT differential mobility

analyser

48 Send for the fun police!Iris Huis in 't Veld at Eticas Research & Consulting

on ethics in CBRN forensics

Published by Falcon Communications Limited

CBRNe World

Suite 26, Basepoint,

1 Winnall Valley Road,

Winchester, Hampshire

SO23 0LD, UK

Web: www.cbrneworld.com

Twitter: @cbrneworld

LinkedIn: cbrneworld

Contact Details:For Sales: +1 443 605 [email protected]

+44 (0)1962 832 534

[email protected]

For Editorial:

+44 (0)1962 832 532

[email protected]

Editor Gwyn Winfield

BusinessDevelopmentDirectorDavid Levitt

Art Director Tony Denton

BusinessDevelopmentManagerJames Ross

BusinessDevelopmentExecutivesAnna Dziaczkowska

Marcoms ManagerClaudine Weeks

Sub EditorJenny Walton

CorrespondentsJeffrey BigongiariBrian O’Shea

CBRNe Forensics vCorrections:CBRNe Forensics vCorrections 30/01/2017 16:55 Page 3

4 CBRN Forensics

The successful interrogation of evidence, either at a crime scenecontaminated with chemical, biological, radiological or nuclear(CBRN) agents, or of the agents themselves back at the lab, is anabsolutely vital part of CBRN defence.

At present forensic investigation is hampered by a lack of protocolsand training in carrying out forensic analysis on CBRNcontaminated materials.

The generic integrated forensic toolbox for CBRN incidents, or GIFTCBRN, consortium, funded under the European commission’sseventh framework programme, is designed to close up the manygaps inherent in this complex area and provide an integrated lawenforcement CBRN capability that is world class.

The GIFT consortium is developing the most advanced forensictoolbox for CBRN incidents in the world. Through the cooperationof Europe-wide research agencies, first responders, industrialistsand subject matter experts, the toolbox will provide enhancedcapability in three key areas of CBRN forensics: • Procedures, sampling methods and detection of CBRN agents atthe crime scene.• Traditional forensic laboratory methods for dealing withcontaminated evidence.• Laboratory methods for profiling CBRN agents released at anincident.

The GIFT consortium will address the issue of conducting forensicanalysis in a contaminated environment by developing novelmethodologies and technologies which will enable forensicinvestigators to perform enhanced analysis at the CBRN crimescene. Some of the key innovations being explored are:• Novel sensors for chemical and biological agents.• Detection of alpha-emitting particles using UV.• Development of decontamination methods that won’t impacton forensic traces.• Micro-analytics on-chip to detect agents of interest.• Attribution signatures for chemical, biological and radiologicalagents. • An education and training curriculum.

In order to facilitate this work, the project has been broken downinto specific work package areas, each led by a partner agency,with cross package working and cooperation as a key fundamentalfor success. The nine work packages are:

WP1: The management work package. Keeping the entireconsortium on track and liaising with the commission, among otherthings.WP2: Composed of threat assessments, gap analysis and toolboxdesign. It aims to define the forensics community’s needs, to allowidentification of what must happen to allow responders to performtheir tasks safely, quickly and properly. WP3: Two central themes, one being the development of protocolsfor use in the crime scene; the other is the development ofinvestigative methods for when the evidence is contaminated withchemical, biological or radiological agents. WP4: Development of procedures and methodologies to enabletraditional forensic science (DNA, fingerprint and electronicdevices) to be performed on CBRN contaminated exhibits. WP5: Looking at the CBRN agent itself, whether we can furtherdevelop analytical procedures on the agent and also whether wecan identify signatures in the agent that could lead to methods ofproduction and where key elements originated from. WP6: Integration of the forensic toolbox, ensuring all thetechnologies can work together. WP7: Validation and testing of the procedures and methodsdeveloped in WP3, 4 and 5. WP8: Assessing the legal, ethical and societal aspects of theproject in order to provide stakeholders with the appropriateguidance to avoid any negative impact during the project,execution or in an eventual future deployment based in thisresearch. WP9: Dissemination - this will create a CBRN forensics communitythat will be able to help guide and validate the whole project.

The ConsortiumThe consortium consists of 21 partners, from nine differentEuropean countries.

The NFI – The Netherlands Tyndall University – IrelandTNO – The Netherlands RIVM – The NetherlandsM

2L – UK Falcon Communications – UK

FERA – UK AWE – UKSTUK – Finland FOI – SwedenNFC – Sweden Analyze IQ – IrelandNICC – Belgium RMA – BelgiumSpace Applications – Belgium JRC-ITU – SpainCEA – France Eticas – Spain RAMEM – Spain LQC – Spain Nanobiz - Turkey

Welcome

to GIFT

Welcome to GIFT

CBRNe Forensics vCorrections:CBRNe Forensics vCorrections 30/01/2017 16:59 Page 4

The National Forensics Institute – The NetherlandsThe Netherlands Forensic Institute (NFI) is one of the world’sleading forensic laboratories. It invests heavily in research anddevelopment to lay the foundations for innovative forensicmethods and technologies that will play an important role in thecoming decades. The NFI also maintains close relationships withindustry, knowledge institutes and universities.

Tyndall National Institute, University College Cork – IrelandThe Tyndall National Institute is one of Europe's leading centresfor information, communications and technology (ICT) research. Itis the largest facility of its kind in Ireland with 450 staff, studentsand academic and industrial visiting researchers. Tyndall'sresearch is guided by, and applied to, finding solutions that canbe commercialised to meet the needs of society incommunications, energy, environment and health through thedevelopment of new technology in the fields of photonics,micro/nano-electronics and microsystems.

TNO – The NetherlandsThe Netherlands Organisation for applied scientific research (TNO)was founded in 1932 to enable business and government to applyknowledge. TNO is an independent research organisation focusingon five social themes:• Industry - from economic stagnation to growth in high-technology industry.• Healthy living - from illness and treatment to health andbehaviour.• Defence, safety and security - from a wide range of threats tocontrollable risks.• Urbanisation - from urbanisation bottlenecks to urban vitality.• Energy - from conventional sources to sustainable energysystems.

RIVM – The NetherlandsThe Dutch National Institute for Public Health and theEnvironment (RIVM) carries out independent research and providespolicy advice to help government authorities keep people and theenvironment healthy. RIVM works to prevent and control outbreaksof infectious diseases by promoting public health and consumersafety, and helps to protect the quality of the environment.

M2L – UK

A photonics technology company which designs andmanufactures award winning lasers and photonics systems, andcollaborates with research institutions and industries around theworld to help develop new light-based applications that can makea positive difference.

Falcon Communications – UKFalcon Communications publishes CBRNe World magazine servingthe information needs of professionals around the world chargedwith planning for or responding to chemical, biological,radiological, nuclear or explosives (CBRNe) threats or incidents.Falcon also produces the world-leading CBRNE Convergenceevents globally as well as a leading CBRNE product directory.

FERA – UKA leading supplier of scientific solutions, evidence and adviceacross the agri-food supply chain. FERA’s role is aboutunderstanding problems and enabling sustainable solutionsthrough innovative thinking and the gathering and analysis ofrobust scientific evidence. FERA is the national referencelaboratory for nine different areas, employing over 350 scientistsand technical specialists.

AWE – UKThis company has been at the forefront of the UK nucleardeterrence programme for more than 60 years. AWE’s outstandingnuclear skills and expertise means that it is able to provideintelligence and support to the UK government by developinginnovative solutions to combat nuclear threats, terrorism andnuclear proliferation. AWE is recognised as a centre of scientific,engineering and technological excellence, equipped with some ofthe most advanced research, design and production facilities inthe world.

STUK - FinlandFinland’s Radiation and Nuclear Safety Authority (STUK) operatesunder the country’s Ministry of Social Affairs and Health with thepurpose of preventing and limiting the adverse effects of radiation,controlling the safety of the use of radiation and nuclear energy,and engaging in associated research, education andcommunications. It employs around 320 people, of whom just over80% hold MSc or MA degrees.

FOI – SwedenFOI is one of Europe’s leading research institutes in defence andsecurity. It has 930 employees with various backgrounds – fromphysicists, chemists, engineers, social scientists, mathematiciansand philosophers to lawyers, economists and IT technicians. FOIhas expertise in many fields of application, such as securitypolicy studies and analyses of defence and security, assessmentsof various types of threats, systems for crisis leadership andmanagement, protection against and management of hazardous substances, IT security and the opportunities providedby new sensors.

Meet theteam

The consortium consists of 21 partners, from nine different European countries

5CBRN Forensics

Meet the team


Meet the team

6 CBRN Forensics

NFC – SwedenThe Swedish National Forensic Centre (NFC) is one of Europe´sleading forensic laboratories with cutting-edge expertise. It wasestablished as an independent expert organisation within thepolice authority with an overall responsibility for forensics and has1,100 employees. The NFC performs forensic research anddevelopment, education and training, and analyses for incidentsinvolving CBRNE materials.

Analyze IQ – IrelandAnalyze IQ Limited develops and sells an innovative, patentprotected software suite for analysis of the composition ofmixtures, based on molecular spectroscopy data. Analyze IQ uses anew model-driven paradigm for spectral data analysis, withproprietary new machine learning techniques specifically designedfor spectral analysis, that is both quicker and more accurate thantraditional analysis, and can be used by non-chemometricians inthe field. The products have applications in fields as diverse asmanufacturing inspection, law enforcement, emergency services,and the pharmaceutical industry.

NICC – BelgiumThe National Institute of Criminalistics and Criminology (NICC)was founded in 1992 as part of the Ministry of Justice. Witharound 142 staff including 34 reporting forensic experts, its fieldsof expertise include: drugs and toxicology; analytical chemistry;paint, glass and safety ink; fire and volatiles; fibres and textiles;gunpowder; ballistics and digital information; mechanical ballisticsand national database of ballistics; biology and genetics.

RMA – Belgium The Royal Military Academy is a military higher educationinstitution in charge of the academic, military and physicaltraining of the officers of the Belgian armed forces.

Space Applications – BelgiumSpace Applications Services is an independent Belgian companywhich aims to research and develop innovative systems, solutionsand products, and provide services to the aerospace and securitymarkets, and related industries. The company has a strong focuson research and development with partners across Europe, the USand the Russian Federation.


7CBRN Forensics

JRC-ITU – SpainAs the European Commission's science and knowledge service, theJoint Research Centre's mission is to support EU policies withindependent evidence throughout the whole policy cycle. Its workhas a direct impact on the lives of citizens by contributing with itsresearch outcomes to a healthy and safe environment, secure energysupplies, sustainable mobility and consumer health and safety.

CEA – FranceThe French Alternative Energies and Atomic Energy Commission(CEA) is a key player in research, development and innovation infour main areas: defence and security; nuclear energy (fission andfusion); technological research for industry; and fundamentalresearch in the physical sciences and life sciences.

Eticas – Spain Ethics Research & Consulting works on the social, ethical andlegal impact of security policies, innovation and technologicaldevelopment, as well as the interaction between changingsocial values, the possibilities of engineering systems andfundamental rights.

RAMEM – SpainRAMEM focuses on the design and manufacture of mechanicaland electromechanical equipment. RAMEM is backed byexperience and technology acquired over 55 years of activity, andhas over 40 engineers, doctors, graduates and technicians.

LQC – Spain LQC sl manufactures radiation monitor and alarm equipment formilitary, police, airports, state borders and other sectors.

Nanobiz - TurkeyNANObiz Ltd is a technology company that emerged from theMiddle East Technical University (METU) in Ankara. NANObiz’steam currently comprises 30 qualified researchers, academicians,engineers and administrative staff. The company has products andR&D operations in CBRN and homeland security; nano-biotechnology; biotechnology and other areas.

Meet the team


8 CBRN Forensics

Dr Futurity

Picture the futuristic CBRN crime scene...People in sharp suits gather round a largescreen looking at the 3D scan of the crimescene broadcast live to their control centre.To the left of the screen is a completeanalysis of all the sensor data which has beencollected by the artificial intelligence roboticsystem and was despatched immediately. The collected data was sent through to an

automatic analysis system and the results arenow being presented straight back into thecommand centre. The command team has a 360 visual view

of the entire crime scene, along with clearidentification of the location and the types ofagents within the scene, without goinganywhere near it. Forensic teams now use the data and the

images, following questions from theinvestigative authority, to assess where thebest evidence might be, and where to look for

fingerprints, DNA or other trace material totry to catch the perpetrators but also toidentify used CBRN agenst that might havebeen released during the incidentThey then send in a robot optimised to lift

latent fingerprints from the contaminatedmaterial, and to collect DNA, withoutsuffering any contamination issues, andwithout having to move any materials fromthe scene. DNA test results are immediately

generated through a lab-on-a chip expertsystem, based on the DNA-profile theperpetrators are identified from a crimedatabase and their details are passed to theinvestigative authority and local police. The perpetrators are arrested and all the

evidence is securely and electronicallyprocessed and stored so there is no potentialfor discrepancy once the court case is ready.The security of the evidence is not in doubt,

and experts are happy that it is safe from anybreach, including a cyber attack.

Too good to be true? Only time will tell – but that’s the ambitiousvision for CBRNE forensics in the very longterm future. Currently, members of thegeneric integrated forensic toolbox (GIFT)consortium are exploring some of these newtechnologies, (sadly no robots just yet), totake that key first step towards enablingmore work to be done at the crime scene,rather than having to transport everything tothe laboratory. Work Package 2, for example, was tasked

with assessing the needs of CBRNE forensicsfor the near future – many of which will havesolutions thanks to the work of theconsortium – and to predict what may beneeded to counteract as yet unknown threatsfor the longer term.

Dr Futurity


9CBRN Forensics

throughout the EU member states, and alsothe development of more advancedcapabilities within a few member states. Countries with advanced capabilities

should be able to deliver operational supportto those member states with less advancedcore capabilities. Developments should be aimed at

developing both a basic forensic response forthe contaminated crime scene throughoutEurope and on international collaborations.The latter need to be supported by thenecessary arrangements and conditions tomake that support feasible. Contributing CBRN forensic experts should

be prepared to work under different judicialsystems (eg with respect to chain of custodyor giving testimony). A high capabilityresponse will be more professionallydeveloped (eg validated, supported bysophisticated technology and systems, etc)and the basic response will be broadened andbetter substantiated.

What about ensuring chain of custody? Forensic activities in the hot zone, stillrather ad hoc or improvised for the nearfuture, will be further developed intoprofessional, integrated and harmonisedprocesses with validated guidelines and procedures.It is always crucial to make arrangements

for a guaranteed chain of custody forforensic evidence and data gathered fromsensors and detection equipment at the crimescene. Due to safety constraints it isimportant to select and prioritise forensicactivities in the hot-zone; establishing whichexhibits and forensic traces are beinginvestigated onsite and which are beingcollected or sampled for laboratoryinvestigation. Priorities in the forensic investigation

will therefore focus on the identity and roleof related individuals (eg perpetrators,makers and other potential actors); thisincludes, for example, the investigation offingerprints, DNA, digital data and theprovenance of CBRN materials used in an attack. These investigations are important not

only for finding the responsible individualsand for preventing other attacks, but also forproviding the prosecutors and judges withforensic evidence in court. Technology and technological

applications in general, and in the IT area inparticular, can be expected to developdramatically. This will definitely influencefuture forensic investigation capabilities.

And the key differences, longer term? While most of the information might still beavailable as separate (electronic) documentsin five years’ time, in 15 years theinformation should be accessible throughexpert systems and actions taken with theaid of decision support systems. This will mean that the decisions made

during the investigation process will besubstantiated, validated and traceable,improving the quality of the case in court. Detection and identification techniques

will shift from the laboratory to the field, egthrough miniaturisation and lab-on-a-chiptechnology. Individually applicable detectioncapabilities, from the near future, will bedeveloped over time into more holisticremote/robotic sensors in the far future. Some forensic characterisation and

individualisation methods will still be toocomplex and sophisticated for fieldapplication and will need to be done in alaboratory, albeit with new tools andtechniques.Trends are emerging in the application of

forensic investigation to CBRN crimes. Atfirst the focus will be on developing forensiccapabilities at existing CBRN labs and ondecontamination of exhibits for investigationat traditional forensic laboratories. In thelong term the emphasis will be more andmore on performing forensic investigationsand analyses at the crime scene/hot zone.Advantages and developments should be

taken from innovations in other scientificareas eg medical science, where experimentswith remote surgery are already ongoing.This has the potential to lead to remoteoperation of unmanned (robotic) systems ata CBRN crime scene by forensic experts froma safe command centre. The main advantages of these

developments will be a faster, better andsafer delivery of results for the criminalinvestigation under the required conditions(eg chain of custody, quality assurance).Profiling methods for CBRN agents - for

provenance and comparison - and thedevelopment of supporting forensic referencedatabases will also be developed.Furthermore individualisation methods shouldbe adapted to contaminated materials.Finally, a European network for CBRN

forensics should be developed over the years.This should evolve from an informal networkin the near future into a well organised andstructured official CBRN forensics network,under the responsibility of the EuropeanCommission and supported by the EuropeanNetwork of Forensic Science Institutes.

Peter de Bruyn and Ed Van Zalen, from the Netherlands Forensic Institute,on the future of CBRN forensics

Dr Futurity

Some of these results include interestingpredictions, with a strong potential for futurerobots, which would eliminate the need toplace a human within the inherent danger ofa CBRNE contaminated scene. Closer to handis greater automation of detection andcollection equipment, putting far moreemphasis on the crime scene itself, ratherthan the laboratory. Robots and automationoffer an enormous reduction incontamination risk from CBRNE crime scenes,and through haptic feedback and dualmanipulators offer the promise of evidencecollection on a par with human interaction.

So what is the consortium predicting forthe near future? The aims for the near future across Europe,are certainly focussed on aligning capabilityacross the countries. Currently, the focus ison developing a basic response for use


10 CBRN Forensics

The GIFT that goes on giving

The GIFTthat goes on

givingEVZ: Forensic investigators are alwayslooking for ways to improve and developtheir work and techniques but often when Imeet traditional forensics colleagues theyare all following the same path.

That’s what excited me about theopportunities with the generic integratedforensic toolbox (GIFT) consortium – we areworking with small and medium sizedenterprises (SMEs) and researchers outsidethe forensics field to see where new andinnovative technologies can be applied tothe niche world of CBRN forensics.

There are lots of ways we can improve andlearn and by looking beyond our sector wecan make sure we are keeping up to dateand moving forward. In the GIFT consortiumwe are now working together withcolleagues from a whole variety ofindustries to help take CBRN forensics tothe next level.

CW: So what does that next level look like? EVZ: We need to be able to do far more atthe crime scene – more measuring andrecording safely at the crime scene so thatthe laboratory is left with the high end work to do.

This is one of the most exciting parts ofGIFT. We are working to create newequipment and protocols to bring more ofthe laboratory work safely out in the field.

GIFT researchers are developing on-scenetechnologies, methods and instruments sowe don’t have to take so many materialsback to the labs, as well as looking at waysto carry out traditional forensics on thecontaminated materials.

We want to develop new and innovativetechnologies such as robotics and moreautomated techniques which can be usedwithin contaminated crime scenes, allowingus to do more on the scene with less risk toour staff.

CW: So why is there a need for this now? EVZ: At the Netherlands Forensics Institute(NFI) we have been running CBRN forensicsas a specialism since 2003, largely as areaction post 9/11. We started out justlooking at how we could react to threatsthat might occur, but from 2008 we movedto consider other kinds of incidents whereCBRN agents might also be released and howwe can identify and characterise them.

So while the institute has been running aCBRN forensics programme since 2008, itwasn’t until 2012 that we could clearly seethe need to extend this across Europe; togrow the learning, share what we havebeen working on with other countries andextend our knowledge further. That is whatled to GIFT.

CW: You talk about moving thelaboratory work, was this to becomemore high end focussed? EVZ: Yes, I started my career in thelaboratory, analysing surface waters for theDutch water board, for environmental issues.Back then it was all carried out manually.Today’s laboratories are far more automatedand lab technicians have to be machineoperators. Much of the technology I used todream about having in my lab when I startedout is now completely obsolete.

Technology moves fast and that’s why we inCBRN forensics need to work with academia,industry and SMEs to look at other ideas andinnovations and how we can transfer theseideas and innovations into the forensicdomain. That’s the beauty of GIFT.

CW: So what will GIFT ultimately deliverfor European CBRN forensics? EVZ: GIFT is just one step, after this project iscompleted, the work will continue and wewill be seeking for funding for furtherresearch and development.

The challenge for Europe is that not everycountry has the same CBRN forensiccapabilities available. My aim for GIFT is that

we use it to set a gold standard acrossEurope and raise the bar so that everycountry is able to develop a minimum corecapability for CBRN forensics.

I would like to see a network whereby alladvanced capability countries partner with

Ed Van Zalen, GIFT programmemanager, talks to

Claudine Weeks aboutthe need for GIFT

and the difference itwill make to

CBRN forensics


11CBRN Forensics

the other countries and work together acrossthe continent on training and education.

CW: What would this network look like? EVZ: My dream would be to see the creationof a joint European centre of excellence inCBRN forensics, set up with some of the GIFTconsortium partners.

This centre would be the main point fortraining, research and innovation in thefield, across the whole of Europe. We wouldbring together all the techniques forworking at the crime scene, which are beinglooked at as part of GIFT, and train and offerthem to all countries in Europe through thiscentre of excellence.

The centre could then provide very highspecification laboratory work to supportcountries without the capabilitiesthemselves. It would deal with high end casework and support innovation, training andeducation, and research and development inCBRN forensics for all EU countries.

CW: Why is education and training soimportant? EVZ: GIFT explores new procedures,technologies and techniques which willenable us to carry out traditional forensics invery difficult circumstances, either throughdecontamination or through containmentprocesses. Clearly it will be very importantfor anyone involved to be trained in how tocarry out these processes.

That’s why as part of GIFT, we will berunning exercises and using these to developa curriculum, an education and trainingprogramme to help support the roll out ofthe toolbox across the EU. The toolbox willprovide the procedures, protocols andequipment all in one place, for the first timeever, setting a world-class standard, so weneed to train people to use them.

I would also like to see cross training for firstresponders and forensic specialists in theCBRN field so we can understand eachother’s roles better and work more effectively

together at a crime scene. Generally, the twostreams are separate at an incident. Thepriority for the safety stream, who are thefirst responders, is to rescue people andmake the place safe again, while the securitystream, who are the investigators, want toprosecute the perpetrators.

I want to bring the safety and securitystreams together, to work in partnership andunderstand each other’s roles. If weunderstand each other and we traintogether, then responders could use some ofour equipment in the early stages to helpshape their initial response and we can usethe information they gather to help shapeour investigations.

Within GIFT the aim of the toolbox is that itwill connect with existing and futuretechnologies so future developments in theprogramme could include sensors andtechnology for first responders, which thenlink through to the forensics team, but this isa very long term cooperation goal.

The GIFT that goes on giving

Teamwork is the key: in terms of specialists, agencies and nations ©CBRNe World


12 CBRN Forensics

The software story

The software story


13CBRN Forensics

By Dr Eric Moore, Director Taught Postgraduate CoursesAnalytical Chemistry, Chemistry Department, University College Cork and Scientific Lead for GIFT

The software story

Tyndall National Institute, University CollegeCork in Ireland has several roles within theGIFT consortium. As the scientific lead for theconsortium, one of my main roles in the GIFTproject is to ensure that the science andtechnology being developed is on track andaligned to the objectives of the project.Obviously this is vitally important generally,but in terms of the GIFT project it is essentialthat we can demonstrate proof of principle,as our final forensic toolbox will successfullyprovide the teams who are making decisionson the ground at a CBRN forensic scene, withall the information they need.

The aim of the GIFT consortium is to developa gold standard for CBRN forensics, throughtechnology, protocols and procedures andmake the processes at the scene quicker andmore efficient.

Tyndall leads work package 6 (WP6), thetoolbox part, to make sure all the technologyis integrated and ultimately works together.

The institute is creating new knowledge thatwill contribute to the overall forensic toolboxwith a particular focus on the integration ofsensors and detectors to provide real timeinformation on chemical analysis. Thesetechnologies will also contribute to newmethods to ensure the safety, security andchain of custody for that data throughout theprocess. We are also working with partnerson an information hub. This will facilitatebest practice in terms of operatingprocedures and protocols, so that everyoneacross Europe can tackle a CBRN forensicscene in the same way.

GIFT will be creating the toolbox with all the elements for detection, analysis andinformation, which will enable anyone at thescene to make informed decisions about keyactions to take or how to approach the scene.It’s about having the right information at theright time.

We are developing specialised sensors anddetectors for CBRN forensics and the idea isthat the software element of the toolbox willbe able to connect with both existingtechnology and the new technologies beingdeveloped within the GIFT project.

It is expected that existing and future CBRNforensic teams will see the GIFT toolbox as a

fundamental part of their kit. It augmentswhat they have already, provides an easierway of doing risk assessment, suggestsfuture capability roadmaps and also acts as astarting basis for newcomers that mightwant to understand how to sampleefficiently. It also needs to be flexible enoughto connect with future technologies.

We are mixing past, current and futuregeneration capabilities to create a flexibleand adaptable CBRN forensics toolbox. It isnot meant to be a static delivery; it willevolve over time as current databases areaugmented with new information. We aregoing to prove the value of a truly integratedsystem. This is not about reinventing thewheel but truly doing something importantfor forensic scientists.

Our project team at Tyndall is helping toincrease the efficiency of response, to makethe process quicker. The information providedby analysis of the sensors and detectors willmean that people understand what they aredealing with faster and can take appropriateaction quicker. The protocols and guidancefrom the information hub will inform peoplehow and when to deal with the situation, forexample, what personal protectiveequipment (PPE) to wear and how to treatthose exposed.

For all data going into the toolbox, everyelement will be logged, date-stamped andonly accessible by those who require it,supporting the chain of custody for allpotential court case evidence.

The Tyndall National Institute also has keycompetences that specialise in creatingminiaturised systems for a wide variety ofend users. I am the Principal Investigatorof the Sensing and Separation group, wefocus on miniaturised integrated sensingfor the end user. We are using thattechnology and sensors expertise in WP3to explore ways of improve CBRN forensicsat the crime scene.

We will be developing a new chemicalsensor for detecting nerve agents in liquidform. The instruments currently used foronsite chemical speciation do not havesufficient sensitivity or resolving power, orboth, and therefore have a very high falsealarm rate or are too selective and only

detect a certain family of compounds. Suchinstruments include ion mobilityspectrometers, Fourier transform infraredspectroscopy, photo-ionisation detectionand flame photometric detection.

There is a need for complementarytechnologies that can be used for onsitedetection of chemicals that enablepreliminary testing to be done at thecrime scene:• Micro total analysis system (μTAS) devicesthat will enable flow through miniaturisedcapillary electrophoresis (CE).• Chemical sensors that can be used toprovide a chemical profile in thedevelopment of a robust and extendibleportable sensing platform.• Molecular sensors for the disclosure ofchemical agents on surfaces.• Associated software for all the sensingtechnologies.

We have been developing a custom-madecapability by integrating a commerciallyavailable contactless conductivity detector(C4D), a printed circuit board (PCB), coppersensing electrodes and a hybridpolydimethylsiloxane/glass microchip. Themicrochip sits on the PCB and four platinumelectrodes are located into four wells. Thismicrochip system is being developed to helpwith the detection of chemical agents and sofar we have been testing it on organo-phosphate nerve agents. We have alreadyhad promising results testing the prototypeand will be validating it at the GIFT exercisein March 2017.

At present we are focused on nerve agents asour proof of concept targets with otherproject teams in GIFT doing likewise, butthere is no reason why this couldn’t beexpanded out to other chemicals of interestin the future.

The big advantage of our system is that itcan all be contained within a wheeledsuitcase. It’s battery operated so it can beeasily used out in the field. This is the firsttime a portable capillary electrophoresis(CE) system has been available to dochemical analysis in the field and it enablesscientists to bring their lab to the crimescene – this is a key focus for the GIFTconsortium and for the forensic toolbox in general.


14 CBRN Forensics

Common approach path

Commonapproach path

There is a suggestion that CBRN events areabout as common as unicorn poop. Manyindividuals think that a CBRN incident hasto cause fatalities in several orders ofmagnitude, but this only focuses on one endof the scale. At the opposite end are manyincidents ranging from attempts to createCBR devices, to people making substancesbut unable to use them, through toindividuals selling or using viablesubstances. To focus on the upper end of thescale is to miss all the work that forensictechnicians are doing on CBR crime scenesevery month.Admittedly much of this is not at the

super toxic chemical warfare (CW) orcategory A biological warfare (BW) stage,but it provides a considerable amount ofcasework and a growing understanding andprofessionalism in CBRN forensics. It has tobe remembered that CBRN forensics isarguably the most recent of all the forensicfields. Only born in the aftermath of theAmerithrax letters in October 2001 (andboth David Willman’s Mirageman and DrMajidi’s Spore on the Grassy Knoll are worthreading), it had a lot of work to do in ashort time. An analogy might be trying tofind John Wilkes Booth (or John Bellinghamfor those with more of a UK focus) purely ongun/proof marks.In retrospect, it is hard to find a better

case for CBR forensics to have begun with. Ahigh profile series of attacks/murders donewith an esoteric weapon, a mistaken/framedindividual, an investigation lasting years andfinally a suspect that committed suicide –it’s a murder mystery dream. If, as with thecurrent crop of CBR attacks (cf EverettDutchske) the person behind it had been achancer or lunatic, there would never havebeen enough oxygen to have created thescience. Simpler investigative analysis orgood police work would have closed thecase. Had it been a more mundane weapon,an arsenical or cyanide for instance, itwould never have caught the imagination.

Dr Bruce Ivins’ motive was always claimedto be his desire to see more research intoanthrax and CBR agents, and ironically hisvery desire might have been his prosecution. Dr Jason Bannan, senior scientist in the

Forensic Response Section at the FBILaboratory in Quantico, stated that it didn’tfeel like a great opportunity to the peopleon the ground at the time, but thecomplexities of the case started the ballrolling. “It was a complicated case. Thecrime scene extended from Connecticut toFlorida and over the years we needed towork out how to exploit a lot of evidentiarymaterial in support of the investigation.Much of that turned out to be trying toexploit conventional evidence, but early inthe case it was decided that some of themost valuable evidence needed to bedecontaminated, or rendered safe, withradiation. That reduced our ability to bringto bear some of the other disciplines likeDNA analysis and prints as the materialchanges when exposed to that level ofradiation. Through its successes andmistakes that case helped shape where weare today.”The good news for the forensics team

was that while some of the technologyneeded work, some of the tactics,techniques and procedures already existed.Although it was never designed to bechallenged in court, the military had beenpractising sampling identification ofbiological, chemical and radiological agents(SIBCRA) for years. This ensured that therewere procedures for the successful collectionof agents, meaning that a viable samplecould be taken to a laboratory at no risk tothe individuals around it. Dr Bannan suggested that it was not just

at the start of the Amerithrax case that themilitary had played a vital role, butthroughout the development of CBRNforensics, and on into the future too. “Wehave worked closely with militarycomponents here and abroad. We have

liaised with the SIBCRA programme in theUK as well as the US Army’s 20th CBRNEcommand and exchanged information overthe years through AUSCANUKUS [thequadripartite agreement involving Australia,Canada, the UK and US. Ed]. We also workedwith other organizations such as ASTM todevelop standards for collection. “We exercise every two years with all four

countries on a CBR scenario where we canobserve each other, including a science daywhere we share scientific advances, or toolsthat we employ or have developed. Much ofthe technology, the suits, powered air-purifying respirators (PAPRs) and otheradvances have been in partnership with ourdefence colleagues here in the US throughthe combatting terrorism technical supportoffice (CTTSO). It does a lot of work for themilitary and plenty of the testing andevaluation that supports

Dr Jason Bannan, senior scientist at the FBI Laboratory tells Gwyn Winfieldabout developing CBRN forensic science

©CBRNe World


the FBI. The great thing about theinternational CBRN community is itswillingness to share and that has benefittedus a lot.”It is just as well that the FBI had the start

it did plus assistance from partners, as thecase load built rapidly. The FBI hasresponsibility for all forms of CBRNterrorism, ranging from threats through to‘white powder’ letters and finally to viabledevices. As such, it had to manage theenormous case load that followedAmerithrax when the world and its wifethought that it would send suspiciouspowder to its former spouse/bankmanager/high school PEteacher/gynaecologist… Among all the talc, soap powder, plaster,

starch and powdered potato there wasoccasionally something more lethal, and thiskept the capability on its toes. Dr Bannanexplained: “In the years before Amerithraxthe science involved was mostly firstresponder based. The FBI was geared up todeal with environmental crimes likedumping hazardous waste, so we had torespond and provide assistance to otherfederal agencies. Once Amerithrax openedup we realised we needed traditionalforensic investigative support to put behindthose kinds of cases and it was eye opening.At the time we were working the anthraxinvestigation, however, we were also gettingricin cases like the Fallen Angel letters. Sowhile we built the new programmes we hadno shortage of cases to follow up.Thankfully, the science has expanded in thelast decade in our law enforcementcapability to exploit evidence in dealingwith CBRN crimes.”

The science has had to expand inat least two directions. The first is theability to forensically interrogatesamples. Current identificationtechniques will quite likely tell you

what the agent is, but they might not beable to indicate the strain, or theconcentration of the various elements.Forensic interrogation needs to go furtherthan this. It will want to know what mediumthe agent has been grown in or exactly whatthe precursors were. All of this providesinformation based on the methods andingredients used to create the payload, andgives the investigator useful evidence on thesuspect’s level of skill and the possiblesources of the necessary elements and equipment. The second direction is the ability to

extract information from conventional trace(DNA, soil, cosmetics, paint etc) evidenceeither in a CBRN environment or from asubstance that is in itself contaminated. Anexample of this might be a fingermark takenfrom an irradiated phone screen, or a sampleof paint that has absorbed chemical agents.Both items are of interest but pose collectionchallenges or latent threats. As Dr Bannanlooks at these two fields which does he thinkthe most challenging and rewarding? “When we talk about attribution of

chemical weapons (CW) material we canlook at the R&D that is going on in boththose areas. In Amerithrax we looked atthe components within the sporepowders to try to work out how it wasgrown, and which region of thecountry it came from, based on anychemical signatures. Those werechallenges in that case and theyremain challenges. We don’thave great libraries of allbiological and chemicalprecursors , so thesignatures we wouldlike are not alwaysavailable forcomparison.” “These types

of challenges

mean we have to rely heavily on ourinvestigators as you can’t replace good oldinvestigative methods, putting the shoe tothe pavement, asking questions and utilisingtraditional forensic evidence that cansupport them and provide leads. The viewover years of CBRN investigations was:’Howmuch can we exploit the agent itself?’ Nowwe have learned that you can’t discountgood investigative strategy and scientificsupport to provide leads in the investigation.That has been a lot of our focus.”Another element of focus has been the

development of analytical capabilities withinthe American laboratory response network.Except in the rarest cases the FBI isunlikely to be first at the scene.Instead, local first responders arelikely to have discovered thesituation and, should theirown teams not have the


15CBRN Forensics


16 CBRN Forensics


requisite skills, the CBRN evidence will berecovered by local teams mainly composedof the civil support team, local FBI WMDcoordinator and local hazmat (for moreinformation see CBRNe World April 2015).These would then take a sample, bag itaccording to chain of custody and move itup the chain to the appropriate lab. Dr Bannan explained the procedure: “If it

has been decontaminated before we getthere as someone has taken the initiative todecon it, then the FBI lab can receive it aslong as it has been tested and shown to benon-hazardous. In a real incident, however,we prefer that samples are notdecontaminated. Biological samples go tothe national bioforensic analysis centre,chemical samples go to our partner lab atEdgewood chemical biological centre (ECBC)and if it is radiological we have ourradiological evidence examination facility atSavannah river national lab in SouthCarolina. We have full forensic capability atall three locations.”Yet it is not just the facilities that have

been upgraded, but also the people workingin them. The FBI has invested in building upboth its hazardous evidence analysis team(Heat) and its hazardous evidence responseteam unit (Hertu [pronounced hurt you! Ed.])

and it is also developing further teams thatcan assist. Dr Bannan explained how the teams

mesh together: “In terms of the crime sceneresponse the forensic response sectioncontains our traditional evidence responseteam, which trains and equips all theevidence response teams at our 56 fieldoffices. We have a cadre of agents calledHertu who do a job similar to that of thehazardous evidence response team unit,including training and equipping of ourhazardous evidence response technicians atour field offices to respond to hazardouscrime scenes. We also have the scienceresponse unit (SRU) comprising subjectmatter experts in CBRN, real scientists whoare deployed to the crime scene to providescientific support. Then we have ourtechnical hazard response unit (THRU), whocome from the first response communityand are very experienced firefighters,technical experts and paramedics that cansupport our work at a hazardous crimescene and provide medical support andsafety officer support. “Finally we have our WMD coordinators

and our agents in the field office where thecrime scene is. In an incident our deployableassets from the FBI Laboratory at Quantico,

supervisory special agents from Hertu whocan deploy to the crime scene along withscientists from SRU and technical specialistsfrom THRU, form a team who will give us atechnical intelligence base and informativecapability. Unlike other agencies we don’timmediately suit up in Level A and do arecce and come out. Typically, there is a lotof up front work gathering information thatguides our risk based response plan. In the20 years that the programmes have existedwe have only required a level A response attwo crime scenes.”In addition to the hazardous crime scene

response capabilities, the FBI Laboratory hasdeveloped the Hazardous Evidence ResponseTeam (HEAT). HEAT is composed of forensicscientists from the traditional forensicdisciplines within the FBI Laboratory. TheHeat members receive additional trainingin various safety elements of CBRN. Forexample Heat members will be sent to theFBI Radiological Evidence ExaminationFacility (REEF), at Savannah River NationalLaboratory, for the radworker II course thatemployees need before they are allowed towork in a Department of Energy (DOE)facility and similar courses for bio and chemare also done other at partner laboratories.They are then given mock evidence to work

Sample interrogation is fine, but it needs to be complemented by traditional investigative techniques ©CBRNe World


17CBRN Forensics

on in the labs to enable them to linktogether their subject expertise withevidential and safety awareness (this is inaddition to the case work that they willalready be getting). They get to mitigate thechallenges of applying their forensicdiscipline to the examination of evidencepotentially contaminated with CBRmaterials. It is not a small undertakingeither, there are approximately 60 forensictechnicians trained up and Dr Bannan statedthat there were experts queuing up join. “It is a voluntary collateral duty to be on

the Heat but they are eager to do it. Wehave more people asking to join the Heatthan asking to leave. It is exciting, it getsthem into these other labs where they getsome additional biological, chemical andradiological training and then they feel goodwhen they can support a challenging case.”So what does the future hold for the FBI

and CBRN forensics? In terms of manpowerand doctrine it is a shift closer to the crimescene. Due to deployment times, and thepotentially volatile nature of the threat, theFBI previously worked in a support role, butDr Bannan suggested that this might evolveto include triage of evidence. As with any other triage, this facilitates

the selection of what needs to be dealt withfirst. It calls for an impressive understandingof both forensics and CBRN: which evidenceis the most important, now, in 10 minutes,or an hour from now? The blood and hairunder the victim’s fingernails or attemptingto take a viable sample of sarin? “Forwardfield forensics is a concept that we are nowexploring, which allows more triage andforensic science at the CBRN scene. It helpsus to better determine what evidence maybe contaminated and require transport to aspecialty lab and if we are actually facing areal hazard that requires that specialty lab.” What equipment, then, is going to make

the difference in the lab or the field? Is itbetter to have forensic technicians with fielddeployable mass spectrometry, or is it morevaluable to have better libraries for thedevices they have? Does stand offdetection/identification hold more attractionfor CBRN forensic techs? What about theability to interrogate a hazardous crimescene safely and not disturb vital evidence?Dr Bannan suggested that it was hard, butthe future was not lots of bespoke CBRNforensic equipment. “Every year it changesand becomes a little different. There is aplethora of kits out there in the commercialsector and we don’t use a lot of bespokeitems. Every once in a while we request abespoke item, such as a telescopingcollection tool where we can retrieve a veryhot rad source while maintaining safedistance, but it is rare, it is mainlycommercial off the shelf (COTS).”Regarding the future of CBRN forensics,

Dr Bannan stated that it was likely tocontinue in a similar vein to where it started,

with healthy cooperation across a range ofinternational partners. As an example hepointed to the work the FBI has done withRCMP and their decontamination work andthe ongoing relationship with AUSCANUKUS.“We are never complacent, we are alwayslooking to hone skills further and do a betterjob. That is why the participation with theinternational community is important as weare always learning. “Crime scene response is constantly

evolving, not just for CBRN but also normalcrime scenes, with new tools and technologycoming out every year. We need to keep

abreast of them, which is a challenge.Exploiting CBRN material remains anotherchallenge: ‘what can we learn from it thatwill support the investigation?’ Our goal isto provide as much information to ourinvestigators as possible and that is one ofthe things that we will struggle with, notjust in the FBI but throughout the lawenforcement community. How can weexploit these materials not just fortraditional forensic evidence but also theCBRN material? It is one of the areas in lawenforcement and defence which needs themost sharing.”


The FBI is trying to bring more forensics specialities to the contaminated crime scene ©CBRNe World


STUK on the spectrum

STUK on the spectrumJohan Sand, of Finnish research institute STUK, published a GIFT funded paper on the standoff mapping of alpha emitters under full light. This is an edited version.

Crime scenes involving radioactive materialhave always presented a major risk and ahigh level of skill and expertise is required inhandling them. This is due, in part, tolimitations in current methods of radiationdetection, in specific for α-radiation, andthe equipment available.

Crime scene investigators in full personalprotective equipment (PPE) wouldtraditionally enter the scene and scanmanually, using a hand held detector. Theywould have to scan, within a fewcentimetres, every section of the crimescene, to ensure there was either no alpharadiation, or if there was, to identify theexact source location.

This is very laborious and time-consuming,not to mention laden with risk; it also bringswith it the added complication of PPE withall its time/physical limitations. To makematters worse, most regular cameras usedfor alpha detection, need to work in adarkened room.

As part of the GIFT consortium, researchersat the Finnish Nuclear and Radiation SafetyAuthority (STUK), have achieved abreakthrough in developing a new approachfor remote detection of alphacontamination and have

published a paper on their project success:Stand-off Radioluminescence Mapping ofAlpha Emitters under Bright Lighting.

The detection is based on the opticalmeasurement of radioluminescence light thatis produced by the absorption of alphaparticles in air. The faint light emission isobserved in UV wavelengths and this ismanaged in daylight, rather than the darknessrequired in other alpha imaging experiments.

While scientific grade cameras have beensuccessfully applied in previous experiments,due to their low noise characteristics andgood sensitivity to UV light, this project useda scanning photomultiplier tube (PMT)system redeveloped as an imaging system.The STUK team used an optical system, basedon the Galilean telescope, and constructed itusing commercial components giving it ahigh efficiency while keeping the costs down.The performance of the alpha particledetection was studied using wellcharacterised alpha emitters at the Institutefor Transuranium Elements in Germany.

The researchers reported that one of the keybenefits of the new approach was that the

spectral response characteristics of a PMTare not as prone to visible light as siliconbased camera sensors. This created their keybreakthrough – measurements inenvironments which don’t have to be dark, afar more common approach!

The STUK researchers said: “This is a keybreakthrough for operative use since thetime consuming total light shielding is notrequired. The observed photon count ratesverify that a careful combination of detectorresponse and optical filtering can enableoptical alpha particle measurements undernormal lighting.”

According to the team, the idea of usingradioluminesence light for the detection ofalpha particles, has been around for morethan a century but using it for remotepurposes has only recently been explored byseveral research groups around the world.

The GIFT research has concluded thatradioluminesence mapping with a scanningPMT system is very affordable compared witha specialist UV camera. It is also morestraightforward to use as it doesn’t requirelight shielding, and can be operated withvery little training as it only requires a laptop

to work.

18 CBRN Forensics

Bright light! Bright light! STUKs new approach to alpha contamination mapping will reduce the time spent in PPE ©CBRNe World


Dr Daan Noort, fromTNO, on their work toimprove identificationof CBRN agents andtheir manufacture

19CBRN Forensics

Search andIdentify

Methods to speed up the identification oftoxic chemicals used in a CBRN attack onsociety are absolutely key to dealing withthe crime scene and also for treatinganyone who may have been contaminated.Even more crucial for the forensics aspectis the ability to identify the potentialsource of the CBRN agent to help incatching the perpetrator.

The Netherlands Organisation for appliedscientific research (TNO) is currently workingon Work Package 5 within the GIFTconsortium – looking at chemical threatanalysis – assessing if people have beenexposed to chemical agents. Alongside this,it is working on chemical profiles, looking todevelop tools to identify chemicalattribution profiles.

Attribution profiles consist of data on thepresence of chemical attribution signatures(CAS) which are byproducts from synthesisand impurities in starting materials.

CAS are known for limited sets of chemicalsand new knowledge of profiling methods ona set of chemical threat agents wouldrepresent major progress. The GIFT project islooking at the development of analyticaltools to determine a broad range ofhazardous chemical agents in environmentaland human samples.

TNO is working alongside FERA (UK), DLD(Belgium), FOI (Sweden), DSTL (UK) and NFI(The Netherlands), to develop methods forthe analysis of biomedical samples andenvironmental samples, focussing on threemodel compounds: • Phorate – a substitute for nerve agents.• Acrylonitrile – an industrial agent.• Fentanyl – a potent opioid – non-traditional agent.

The decision to use phorate was made inthe very early phase of the project.Although some of the partners have vastexperience in working with live chemicalwarfare agents, they considered it easierfor various reasons to work with phorateas model compound for a cholinesteraseinhibitor.Eventually the organisation wantsto end up with a recommended operatingprocedure for biomedical analysis from acasualty who has been exposed.

Search and Identify

CBRNe Forensics vCorrections v2:CBRNe Forensics vCorrections v2 03/03/2017 17:59 Page 19

20 CBRN Forensics

TNO has also been looking at the impuritiesappearing in fentanyl so it can seeindications of how the opioid has beenproduced, with the idea that we might thenbe able to say that isotopes from a specificbatch of compounds are traceable from theend product.

For example, if the batch at the crimescene, compared with a batch from an illicit factory, had the same isotopes, itwould enable the forensics team to prove a correlation. The results, so far, have been successful.

TNO is now developing generic protocols togo into the toolbox. So if there is aparticular compound, for example, theprotocol can still be used in the same wayas with another compound, so it is quiteinteresting and new and will definitely helpthe entire chain of a CBRN event. This willalso enable some work to be carried outfaster on other chemicals in the future. Thespectrum of reference compounds for thetoolbox will help to speed up therecognition of certain chemicals involved inthe first response to an incident.

In Work Package 3, the organisation alsoworked on detecting agents at a crimescene – visualising the presence ofchemical agents on the spot. TNO has beenexploring three options for visualidentification of some kind of contamination –with considerable success:• Colour reagents.• Metal organic frameworks (MOFs).• Miniature mass spectrometry for on-site analysis.

It has already seen several successful resultsfrom the project including successfullydemonstrating that colour reagents reactwell with organophosphates and fluorescevery easily so they can then be detectedunder UV lamps. So far the researchers havehad good results testing on pesticides, whichis a very helpful indication for nerve agentsas well. Future developments could see thiswork developed into an enzymatic assay.

In terms of the fluorescent labelling of MOFs,this was found to be indicative for thepresence of nerve agents as they detect thefluoride ions which are found in nerve agents.While it would be easy to do this on site the

research has shown that unfortunatelyexternal interference can be a problem.

As regards miniature mass spectrometry, TNOhas been experimenting with the first DetectMMS1000, a field rugged version of aninstrument which is routinely used in labs.This proved successful and the organisationis confident that all of these technologiescould fit well in the toolbox.

All three techniques have the potential tohelp improve chemical detection at thescene. A CBRN forensic investigator wouldtake the devices with them to apply thesetechniques on site. For example, theywould see the colour change andfluorescence results and input that datainto the toolbox, the data would then beanalysed and the relevant informationwould be sent back. This would generate awarning that personal protectiveequipment is required, or it may show upparticular areas of the crime scene whichshould be avoided due to the strength ofthe contamination, or where respondersmight need more complex scanners to dealwith the situation.

Search and Identify

The work done on miniaturised MS could have value in the field ©CBRNe World

CBRNe Forensics vCorrections v2:CBRNe Forensics vCorrections v2 03/03/2017 17:59 Page 20

Before the theatre

21

Adrien Sivignon,crime scene officerwithin the PoliceTechnique etScientifique andCONSTOX, talks toGwyn Winfield aboutbolstering France’scapability to identifyCBRN terrorists

[This interview was done three days beforethe dreadful events of 13 November inParis. Our thoughts and condolences arewith the victims’ families all around theworld, and we salute the bravery of all armsof the French response system that had todeal with the circumstances of thatcowardly attack. We are sure that theFrench first responder system, describedbelow, will learn and evolve from thisoutrage to become stronger and morecapable than ever. Gwyn Winfield]

There is always a dichotomy at the heart ofany civilian CBRN response. Unless theterrorists have done the emergency servicesthe favour of announcing their attack, it isunlikely to become apparent that it is aterrorist chemical attack in the first fewminutes. The initial calls into emergencyresponse will most likely resemble those for amundane gas leak. While police mightrespond to help with public order, thedetection, identification and monitoring task,which will probably give some of the earlyclues as to the nature of the event, is likelyto be a fire brigade (FB) task. This presents a challenge to fire and

rescue services of understanding whatconstitutes evidence and forensic traces, andtrying to ensure that they don’t destroy orcompromise what might be vital clues. Somenations endeavour to manage this bycreating multi-role first entry teams,training fire fighters in forensics orbolstering police CBRN detection capability.There is no right answer, but what therecan’t be is an element of ‘we’ll sort it out onthe day’. Forensic technicians can’t beexpected to don personal protectionequipment (PPE) the first time they enter acontaminated crime scene, neither can FBofficers be expected to know whatconstitutes evidence by some weird form ofosmosis (or watching CSI New York).

CBRN Forensics

Before the

theatre

The French CBRN forensic service works closely with the French fire brigades ©CBRNe World


Before the theatre

22 CBRN Forensics

France opts for fire brigade control ofCBRN incidents, they will enter the scene,help extract casualties and perform theirdetection, identification and monitoring(DIM) duties. Police will keep the cordon andonce a CBRN terrorist incident has beenacknowledged they will inform the PrimeMinister who will then activate hisDétachement Central Interministériel (DCI), asenior level advisory board with scientificand operational assets. CONSTOX is one ofthese assets and is a collection of forensicspecialists and investigators trained to gointo the hotzone and recover the evidence. Itis headquartered in the town of Ecully, justoutside Lyon, but has operatives located in avariety of major cities and regions.

Adrien Sivignon, a CONSTOX managementteam member, explained. “Ecully is theFrench police forensic HQ and our heavyequipment is also there. In addition we have70 people spread over the country working inlocal judicial police services. They are mainlyin Paris with the counter terrorist command,and with the judicial police of Paris. Inaddition there are people in Lille, Bordeaux,Marseille and elsewhere in France, so if thereis a CBRN incident then the local people willgo and make a first assessment, according towhat their FB says and what the CBRN agentis. They will make a call to the HQ, ask themto come to the scene and deploy with all theequipment from Ecully. We have trucks thatcan drive the equipment 24/7 but we can

use helicopters or planes if needed.”CONSTOX, an acronym for investigation in

a toxic environment, has been around for awhile. The idea was born in 2007, firsttraining happened in 2009 and the teamreached initial operational capability in 2011.The CONSTOX team only deals withconventional traces (the forensic three Ds -DNA, data and dactyloscopic traces) in aCBRN environment. The samples of the CBRNagent will be taken by either the local firebrigade (if they are capable) or by military orscientific assets of the DCI (the SapeurPompier de Paris, 2nd Dragon regiment orthe Commissariat à l’Energie Atomique, theCEA) and this is assumed to have happenedby the time the CONSTOX assets arrive.

Constox is based in the town of Ecully, but has operatives spread throughout France ©Constox


23CBRN Forensics

M. Sivignon explained: “Local people willpick up initial information and, once agreedby the operations chief, they make a firstassessment and give us information. We arenot first responders, we won’t deal withsampling, the FB has the capability to dothat, and we work with them and DCI. Theinvestigative part is CONSTOX, for decon itwould be the Dragon regiment or local FB,for any rad or nuke expertise it is the CEA,and if we need any information we just gothrough them.”Law enforcement in France is not

straightforward. If it happens in a majorconurbation investigation is the role of thepolice, if it happens in a smaller city or thecountry it belongs to the gendarmerie [for

US readers: think county vs city, ie LAPD vsLA county sheriff]. The investigation routesare also different, in that the police will usethe FB to provide CBRN scene assessmentand characterisation, whereas thegendarmerie has its own assets and willgenerally keep fire outside. CONSTOX candeal with terrorist, criminal and majortechnological incidents, but city and rurallaw enforcement have to use them forterrorist incidents. That isn’t to say that theywill stop work on other cases where thingslooked terrorist at the start might turn out tobe something more benign, once they arerequested by the judicial authority for aterrorist CBRN case they are committed. M. Sivignon gave an example: “We had a

case in 2013, it was in an apartment in thesouth of France where a guy had died. Thefirst responders through the door were thelocal fire brigade, they detected somethingas they started developing headaches andhad to go to hospital. They sent in a firehazmat team that detected chemicals, whichwere identified as acids. We were called outas this guy was known to be part of aterrorist organisation, or at least he had a‘past’. We found a lot of writings in differentlanguages, and we were quite suspicious, butwhen we conducted a search we found outthat he was a poor guy and was refillingbatteries with acids. At the end of the day itwas nothing special, but we have not had acounter terrorist case in France, not even acriminal one, since 2011, and hopefully it willremain only training. We participate in a lotof local training organised by the prefecturesin France, so even though we are a nationalunit we do 15 training exercises a year andthen real training with CEA, LaboratoireCentral de la Prefecture de Police (LCPP) etc.”Most of what CONSTOX brings is lots

of experience of doing delicate forensicswork in level A suits and other PPE. Much ofits equipment is traditional forensics kit, andits PPE has not been modified in anyway, ifneeded they can grab extra hazmat suitsfrom the local fire brigade. That said, the skillset of the team is high, they are allexperienced crime scene investigators, ratherthan laboratory personnel, and expert inbeing able to defend a trace or activity in acrime scene to lawyer in a court of law. “Half of the team is composed of highly

qualified investigators, working counterterrorism in France and the second half areforensic specialists. These people are used toworking together on conventional scenes, onnon-CBRN things. Investigators take picturesof evidence and all the usual judicial aspectsof procedures are taken into account and alldone in a CBRN environment. While thegendarmerie has the capability todecontaminate to take samples of evidencethey don’t have any investigators in theirteam.” said Adrien Sivignon.

“Our team is unique in that we buildCBRN scenarios and train for them in Ecully.We have done live agent training in Cazaux,near Bordeaux, to make sure that what wewrote in our protocols was correct for a liveenvironment. Two colleagues have also donesampling and identification of biological,chemical and radiological agents (SIBCRA)training and from all of that we built ourown training for our people. When theycome here they are trained on CBRN riskand how to wear PPE, protocols such asclean man, dirty man etc. We alsoparticipate in international training andcooperation, so I am an International AtomicEnergy Agency (IAEA) trainer for radiationcrime scene investigation.”The fact that CONSTOX comes in and only

does the crime scene investigation helps itavoid some of the differences in capabilitybetween different areas. Once the DCI hasbeen activated it might well send decon orDIM support to the affected region/area, butsince CONSTOX is focused on only one task itmight be working seamlessly with 20agencies or only one, it makes littledifference to the day to day. One question and answer that

immediately became superseded by events is‘what is next for CONSTOX?’ It is hard to seethat the aftermath of the Bataclan won’thave an impact on the future business of theteam, but it is worth including the originalresponse as the revised answer is not likelyto be known for quite some time. Adrien Sivignon’s original response was

that the team has no desire to build its ownfleet of mobile labs. They prefer to work withfixed facilities and are evaluatingimprovements to them. “We have a lab forchemicals and are currently working onimproving our nuclear forensics. We havetaken the decision to recover evidence andnot work on scene and as such the best jobwill be done by working in a fixed lab ratherthan a mobile one. The idea is to build asimilar lab to the UK’s Atomic WeaponsEstablishment, with glove boxes etc. Wedon’t think that the work on scene willaccomplish the job, you might have quickerresults but they won’t be the best.”Despite the fact that the recent attack

was not a CBRN one it will be interestingto see what lessons are learned fromworking such a variety of large intensivescenes. There is little doubt, in my mind atleast, that future attacks are likely to havea non-conventional overlay as well, tofurther complicate matters and slowresponders. I suggest that so many of thelessons learned from Bataclan et al canhave a dotted line drawn from them, inmuch the same way that Mumbai and 7/7can. We hope, in time, to talk to CONSTOXagain and see whether we can learn whatthose might be.

Before the theatre


The Most Flexible GC/MS Now with Real-time Vapor Threat Detection

FLIRGRIFFING465 GC/MS

®

www.flir.com/G465

25CBRN Forensics

RiskyBusiness

A lot of the work in the GIFT consortium willenable responders to measure levels ofcontamination safely at a scene using the newtechnologies being developed. The idea of therisk assessment tool is to then take thatinformation and assess the risk to forensicinvestigators before they enter thecontaminated crime scene. Operatives will needto know the threats they are facing; these canbe from the CBRN agent itself, other hazardson the scene and any general safety risks.

With CBRN, there is also a risk that while in aprotective suit, the investigator could damageevidence as suits make them quite clumsyand cumbersome. Picking up small bottles forsampling can be very tricky when wearing biggloves, for example, as they could be droppedand broken. Using personal protectiveequipment (PPE) to protect from a CBRNagent, brings its own risks, particularly interms of the personal safety of the wearers,as they have a limited time in the suits.

All these elements need to be considered aspart of a CBRN crime scene risk assessment,before a forensic investigator can considerentering the area.

Why CBRN particularly? What makes a CBRN crime scene differentfrom a normal crime scene is that there isthe addition of a whole new level of risk tobe considered: • The risk of exposure to the CBRN agentfrom the scene.• The risk of exposure to the CBRN agentfrom the evidence.• Dealing with and handling contaminatedevidence.• Sampling of the CBRN agents themselvesfor processing.• Working within PPE restrictions.• Removing contaminated evidence from thecrime scene safely.• Decontamination.

So how will it work? The risk assessment tool will be an electronicsystem of questions, accessed via thegraphic user interface of the GIFT toolbox.Once initial information has been gatheredby first responders at the scene, the officerin charge of the forensics team, will accessthe risk assessment tool and input theinformation available, to assess the risk ofharm to the team.

The tool will run on a series of yes/noquestions and will return suggested actionsas a result. If, for example, you input the typeof agent detected, it would advise on thecorrect type of PPE required to enter thescene, any necessary respiratory protection orskin protection, or a particular type of glove.

The CBRN risk assessment tool would bequite versatile and could be used either afteran incident to check on the live issue andgive advice, or it can be used if there is aperceived risk of something happening.

Why do we need this tool?The biggest risk at any scene is the unknown,particularly with a CBRN scene. The idea isthat this tool will be very quick to use becauseit is specific to CBRN risks. A regular riskassessment at a crime scene can take at least20 minutes. We envisage that this tool willreturn a CBRN risk assessment within 10-15minutes so it will speed up the whole process.

The tool is not a monitoring device forassisting at the scene. Any change in theenvironment, such as an active new releaseof CBRN agents would be a reason to leavethe scene as it would create a newuncontrolled situation.

In that case the forensics teams would haveto come away from the scene and do a newrisk assessment starting all over again. Thesechecks and controls are important in the

Peter Den Outerfrom the NationalInstitute for Public

Health and theEnvironment

(RIVM), and GovertVerstappen, fromthe NetherlandsForensic Institute

(NFI) talk toClaudine Weeks

about the need fora specific CBRNforensics risk

assessment tool

Risky Business


26 CBRN Forensics

prevention of contamination of personneland also to stop them from bringingcontaminants out of the crime scene.

What about future developments?The idea of the current tool is to help theofficers in charge to make a decision aboutsending their forensics teams into a crimescene. The tool doesn’t alert you to anychanges in risk level once you are in there.But with all the portable sensors beinginvestigated as part of the GIFT programme,it could be developed further into a riskmonitoring tool.

Equally there could be an ongoingresearch project to look at linking up therisk assessment tool with the live sensorsto provide ongoing alerts andassessments on scene, but that’s for afuture work plan.

Currently, the planned prototyped isfocused on forensics investigators andthe idea is to use it in addition to thenormal risk assessments that wouldhave already been carried out at thescene, as it is only focused on theCBRN aspects.

Forensics teams would use informationalready gathered from the scene by the firstresponders and equipment at the scene, andthen input data into the tool and work outthe best course of action from there.

It is hoped that by using the toolconsistently at CBRN-related crimescenes, it will help to educateinvestigators about the unique risks theyface and will help to make things moreuniform across all European countries,providing a gold standard for all CBRNrisk assessments.

Risky Business

Accurate risk assessment at a CBRN incident is possibly more vital than at any other crime scene ©CBRNe World


The challenges posed by the post-eventforensic examination of a CBRNE incidentare many and varied. The response of sceneexaminers may be limited due to operationalconstraints or interventions required toensure safety. To complicate matters further,forensic response capabilities face anotherset of challenges that have little to do withthe hazardous nature of the scenesencountered in CBRNE incidents and a lot todo with the politics that surround forensicprovision in England and Wales. Someconsideration of these problems might proveto be a useful exercise in forewarning theresponder. Of even more benefit might besome consideration of what value forensicintelligence might have in advance of aCBRNE-related act of criminality. Exploringcurrent structures to find solutions inadvance of catastrophic events can surelyonly be a good thing.

In terms of the challenges, we live ininteresting times in UK forensic serviceprovision. Whilst the Forensic Science Service(FSS) had nominally been part of a landscapeof commercial providers, it’s ‘govcorp’ statusallowed it to endure swingeing financiallosses month-on-month for years, evenwhilst servicing something like 65% of thedomestic forensic market. To put thisbusiness model failure into a wider context,the next two largest (and private held)forensic service providers, LGC Forensics andCellmark, are both viewed by the market asbeing buoyant and energetic. The former isdeveloping its current status through LGC’sacquisition of Forensic Alliance, whilst thelatter was recently subject to a pricy buy-outby US-firm Labcorp.So just as more mainstream CBRNE

concerns grow more accustomed to theinterface between commercial and

governmental interests, so the same dramaplays out in the world of UK policing, whichshould not necessarily be regarded as a badthing, despite how nervous it might makesome. Show me a state-run forensiclaboratory and I’ll show you a four-monthbacklog for chemical development offingerprints. Formally estimated analyticalprocesses with agreed turnaround timessupported by a framework of tenderedcontracts seems to have sharpened theminds and submission practices of scientistsand police forces alike.From the perspective of forensic support

for CBRNE incidents in the UK, the muchpublicised encroachment of sharp-suitedprivateers may well prove to be something ofa paper tiger, having a relatively limitedeffect on the practicalities of submittingexhibits for analysis after the fact. It may yetmask other, more pernicious risk such as the

Hey! I’m trying to eat here!

Karl Harrison from the Department of Engineering and Applied Science at Cranfield University, on the UK’s challenges in forensic response to CBRNE incidents

27CBRN Forensics



28 CBRN Forensics

cultural and political disconnects with longpedigrees in UK policing that might detractfrom our ability to offer a comprehensiveand co-ordinated response to such incidents.

Plus ça change: Police versus Scenes ofCrime OfficersNotwithstanding changes to laboratorystructures, the management of forensicinvestigation within English and Welshpolice forces has enjoyed and enduredmassive and unprecedented cultural andscientific change over the past decade. Ibegan my career as a civilian Scenes ofCrime Officer (SoCO) in 2001. In some morestable sectors of public service, this wouldnot be seen as a great span of time. Indeed,had I been recruited as a police officer thenand reached my twelfth year of service, Imight just about qualify for the term ‘mid-career’. But not so in the world of crimescene investigation. Here I feel old enoughto be played on screen by Peter Ustinov,hobbling around an ivy-choked LincolnMemorial. In 2001, scenes of crimes were atrade shared pretty much in even numbersbetween civilians and detectives. Someforces, such as West Midlands Police, havebeen early adopters of the civilianisation ofSoCOs and featured a relatively smallnumber of warranted officers still in therole. Other forces, notably Gloucestershireand Essex, resisted the appointment ofcivilians to SoCO roles well beyond 2001.This may seem about as relevant to

CBRNE response as a Latin lesson, but bearwith me: this is the beginning of a fault linethat is still playing out today.Civilian SoCO respond to reported crimes,

examine scenes and interact with thepublic, more often than not these dayswhilst wearing a uniform not dissimilarfrom that of a warranted police officer,driving a marked-up vehicle and carrying achirruping airwave radio handset. They donot take statements, make arrests orrespond under blue lights, but in any othersense of the term, they are very much‘front-line’. Despite this exposure, SoCOslack any routine form of police protection:no stab vests, no CS gas, no baton and noprotection training. The reason for this isbecause the SoCO occupies a strange littletwilight zone of police policy: to equip aSoCO to deal with hazards is to admit thatthey face them. Give them no mitigatingequipment or training and you can continueto treat them as if the level of risk theyface is the same as any other police-employed civilian.It is into this twilight zone that CBRNE

scene forensics falls, along with aninteresting, mixed bag of anomalous crimescenes including hazardous materialshandling, scenes at heights, scenes inconfined spaces, scenes in water and, to agreat extent, mass fatality scenes wheredisaster victim identification (DVI) protocols

are required. It is culturally easier andpolitically more expedient to equipwarranted police officers, frequently drawnfrom search serial units, to respond to thesespecialist scenes, despite the fact that overthe past decade, many such officers havehad very limited exposure to developmentsin forensic science or current thinking onthe creation and implementation of astrategy of forensic scene examination. Thepolice CBRNE responders are well trainedand equipped to stand alongside other suchspecialists but they are not the best peoplein their services to manage the complexforensic investigations required. That islikely to be a civilian crime scene manageror co-ordinator who may not even havebeen considered for such a role.

Knowing my place: scenes of crimeofficers versus forensic scientistsIn addition to a cultural divide betweenwarranted police and SoCOs, a similar oneexists between SoCOs and forensicscientists. Whilst SoCOs are trained anddeveloped as general practitioners of crimescene examination and exhibit recovery,their ability to interpet complex scientificevidence on the crime scene is limited. Fireand explosive damage, blood spatterpatterning and the excavation of buriedhuman remains from individual or massgraves are all examples of the sometimesvital evidence types that are impossible toseize and export from the crime scene.Should they play a role in the examinationof a CBRNE crime, in the interpretation ofpost-blast fire damage or the recovery ofhuman remains buried following achemical weapon attack, we currently lacka comprehensive system of response. Thislack stems from a disconnect betweenprofessions rather than anyinsurmountable obstacles.

The brains trust: Research versus practiceIf the practice of forensic examination andscientific interpretation on the CBRNE crimescene raises a number of issues of specialistresource, the research required to improvethis situation is much the same. It wassuggested in some sections of the press thatthe demise of the FSS would herald the endof forensic science research in the UK.Whilst I don’t believe this to be the case, itis certainly true that the remainingproviders are in the process of adapting toengage with forensic science academics in aconstructive manner. Worse still,government-directed science, as fundedthrough the Research Councils UK, has sofar allowed forensics to plummet socomprehensively between its various stoolsthat academics have been forced to directtheir creative energy into devising newerand more agile ways to avoid use of the ‘f’word in research grant bids.Where the forensic service providers do

engage in concerted research efforts, theyrarely target scene-based disciplines asthese are generally peripheral to their corebusiness model of bench-based forensicanalysis and are hard to cost and resourcein a sector dominated by high-volume,quick-turnover and fixed-price services.

Watching the detectives: intelligenceversus evidenceWhilst the domestic security servicesroutinely conduct forensic examination ofscenes on the basis of intelligence received,and military intelligence gathering hasdeveloped to accommodate field-basedanalytical techniques, neither has yet fullygrasped the potential offered by forensicintelligence exploitation. The stakeholdersthat might be best placed to assist arehampered by a range of issues and civilianSoCOs are largely excluded from any suchintelligence-based activity. Experienced theymay be, but their deployment is almostwholly reactive and investigative ratherthan intelligence-led. The forensic serviceproviders are largely focussed on benchanalysis and their close involvement inforensic intelligence exploitation might behampered by the high-throughput nature oftheir business models and thecustomer/provider relationships thatdominate their work with police andsecurity services. Academic institutionsprofessing interest in forensic science are,in most instances, hampered by theirconcentration on undergraduate teaching,as well as lack of time and resources toinvest in extended research.

Is this as bad as it sounds?Categorically not, I believe. The UKpossesses all the elements required to be aworld leader in terms of both the forensicintelligence exploitation required to combatthe risks of CBRNE incidents and thespecialist forensic techniques required toexamine such scenes following their use.Despite recent cuts to police forensicbudgets nationwide, we still possess a largenumber of highly-trained SoCOs, anenergised and well-financed stable offorensic science providers and a universitysector led by a small number of the highestquality research institutions that wouldhappily facilitate this work. The challenges outlined here are largely

tribal in nature and are eminentlysurmountable. Tensions between the rolesof police CBRN responders, civilian SoCOs,forensic scientists and universityresearchers currently compromise ourability to develop a comprehensive forensicresponse to CBRNE risk, but themethodological advances of the last tenyears that represent routine best practiceon the standard major crime scene arereadily adaptable to CBRNE intelligenceand scene response.



29CBRN Forensics



30 CBRN Forensics

Analyze This!

Analyze This!


31CBRN Forensics

Michael Madden, CEO of Analyze IQ, talks to Claudine Weeks about getting more

information out of existing samples

Analyze This!

Using miniaturised sensors to detect CBRNagents at the scene is just one step in thetoolbox journey being explored by the GIFTconsortium. The aim of this project is to bringall the component parts together and AnalyzeIQ is working on the second step – providingimmediate analysis of sensor data to helpthose on scene with their decision making.

Michael Madden, CEO of the Irish companyexplains:

At Analyze IQ, we already have the world’smost advanced analytical software forspectroscopy data, including algorithms thatwork well with mixtures and complex datafor library software. Within the GIFT project,we are developing: • Data Communications protocol –structured messages sent securely over theinternet.• Information hub – to route the messagesas needed. This takes all the messages fromthe sensors and sends them through to theanalytics service. • Analytics service - performingchemometrics and/or library searches toanalyse the sensor data received into thetoolkit.

We are working with the Belgian company,Space Applications, and the Turkish company,NANObiz in Work Package 6 (WP6), to createthe information system part of the toolkit.This will take data from all the technical toolsbeing developed, and turn it into usefuldecision making information at the scene.

The added value we provide is the analyticalsoftware – pattern recognition, labelling theinformation in real time and addingfunctionality into the sensor data. For

example, the sensor will produce a graph, wewill then automate the analysis of the datawithin that graph, which will enable thecommander to make better decisions.

If, for instance, radiation is detected by asensor at the scene, that information will beanalysed and, via the toolkit, advice will beprovided on which PPE to put on or whatprocedures to take. It all fits into the dataand supplies vital information to the scene.

The advances in miniaturised chemicalsensors that are explored within GIFT, andelsewhere, open up massive opportunities inchemometrics and provide interesting optionsbeyond CBRN forensics. Chemometrics is ananalysis model which uses hundreds ofvariables to allow a non-expert to extractdata from a sample that, in our case, wouldusually only be available to an expert in thelab. The experts can build the models and theknowledge on the software system we arecreating and then the information can beused out in the field by non-experts.

We are trying to ensure we can getchemometrics information directly to thescene. For example, a Ramen detector willsend the data to the analytics hub and thenthe research will be carried out throughchemometrics and library searches, and theresults will be sent straight back to those onthe scene. Even if the chemicals are 50/50mixtures or even 10/70/60 mixtures, whichis when most library searches would fail, ourchemometrics system can come in and get aresult in a few seconds.

End users can run the chemometrics directlyon small mini processors, which is asignificant feature of this GIFT project. An

investigator could do the chemometrics ona Raspberry Pi and then stream it toanother computer so they could even havesomeone viewing it at home live, shouldthat person be on call as part of theincident management.

Any information from detectors or devicesat the scene will be stored securely andmade available to those who need it. It’sabout presenting information in a usablefashion via a good user interface.

There are some procedural questions stillto be figured out but we can enablesketches and scene photographs to becaptured by the tool box from a technicalpoint of view. We are still working on aprotocol for how this would all work andhow to store information from the firstresponders which may not be admissible asevidence. Every piece of data in will havedata stamp and time stamp on it for thechain of custody.

While working on the analysis side of thetoolbox, we are collaborating with SpaceApps who are developing the graphicinterface for the people who will be usingthe toolbox, and also with Nanobiz who arecreating the information hub which willstore all of the protocols and operatingprocedures. The three companies workingtogether, will create the software aspectsof the toolbox, ready to connect to thephysical sensors and take the data theysupply from the scene, to turn it into usefulinformation to help support decision-making. The vision, post GIFT, is to try tocommercialise the system for people to useout in the field once the principles havebeen proven from the project.


32 CBRN Forensics

Austria’s take on CBRN forensics

Austria’stake on CBRNforensics

CW: What makes Austria’s approach toCBRN forensics outstanding in Europe? GP: Over the past two years, the Austrianarmed forces have improved cooperationand interoperability between forensicsexperts and other military units, by offeringforensics training for specialised CBRN andexplosive ordnance disposal (EOD) experts sothey understand what is required. Our sampling and identification of

biological, chemical and radiological agents(SIBCRA) teams were already able to samplein very professional ways under CBRNconditions, so we have been working to linkforensics teams with our SIBCRA teams toshare knowledge.Special investigators from the military

police, EOD personnel and the weaponsintelligence teams (WIT) have all beentrained in forensics and share theirknowledge with the CBRN specialists. All theexperts understand each other and the roleseveryone plays in any incident. Our EOD personnel are also trained to

make sure they don’t destroy evidence asfar as possible when dealing with thedevices, although their priority is to renderdevices safe. The WIT teams also sharetheir knowledge with CBRN experts as theywill be dealing with post-blast scenes andneed to know what issues they may facefrom explosives. It’s all about interoperability between the

EOD teams, military police and the CBRNspecialists. We have been working together

to develop SOPs (standard operatingprocedures) across all of the branches sothat we have a procedure to follow if aCBRN expert joins a military police team foran incident, or if an EOD military expert iscalled out. The culmination of the pastcouple of years of cross-specialism trainingwill be a finalised CBRN EOD doctrine whichis due to be published very shortly.

CW: What else makes Austria stand out? GP: We are assessing some state of the artequipment for the identification ofexplosives. The same equipment is used inother countries and we are planning toharmonise the data, especially withGermany, which will enable us to detectpatterns in explosive composition, but weare at the very early stages of this project. We are also participating in the JDEAL

project – the joint deployable exploitationand analysis laboratory - located in TheNetherlands. It is a level 2 WIT in theatrelaboratory capable of screening fingerprints,exploiting electronic data and has anexplosive analysis capability. There are twolabs, one for training and one fordeployment to the scene. We will continueto participate in this next year, to look atforensics in theatre. We have also been working on a sample

control site container with a containmentsystem for bio/chem hazards that canhandle contaminated samples and securethem properly. Once we know that samples

are clean, they can go on to the normalforensics lab, or if they are contaminated aCBRN forensics expert can work safely onthe sample directly in this container. The ideal would be to attach the

container to the JDEAL and work with bothat the scene of an incident. You would usethe sample control container to assess thecontamination of the samples, and then usethe JDEAL lab to work on the evidence onsite, a highly sophisticated screening tool forunknown/CBRN samples.

CW: Can you explain the composition ofyour CBRNE forensics team? GP: We have no dedicated CBRNE forensicsteam per se but with our cross operationalskill set we can tailor make a team for anyincident. That’s why it’s so important tohave the cross force integration and skills training – it ensures everything comes together. The challenge, however, is to make sure

the teams all speak the same jargon andlanguage so they all understand each other’sroles. Special investigators from the militarypolice for example could identify which isthe best fingerprint powder to use in aCBRN environment. It’s all about learningeach other’s procedures as normal powderwould go everywhere and spreadcontamination. A forensics team with someCBRN knowledge would know to usemagnetic fingerprint powder wheneverpossible to avoid the contamination issue.

Austria’s collaborative approach to CBRN forensics is paying dividends.Guenter Povoden, head of section, chemistry and development at theAustrian armed forces’ CBRN defence school talks to Claudine Weeks about the achievements and challenges



33CBRN Forensics

Weapons Intelligence Teams, CBRN experts and forensic technicians all need to work together to create a military CBRN forensics capability ©CBRNe World


35CBRN Forensics

The forensics team also needs tounderstand the CBRN side, for example theclean/dirty man protocol on how toapproach possible contamination. Theyneed to know that within a CBRN incident,the sampling won’t be done by them butby the SIBCRA teams, but under theirsupervision. So the forensics expert canadvise on what needs sampling and why,and the SIBCRA team has the skills to do itin CBRN safe way. In case the forensicsspecialists are taking or preparing asample, the procedure will also follow theclean/dirty principle.

CW: Do counter IED operations andtraining naturally lead to CBRNforensics? Is that the best way forpeople to start? GP: We are very much involved in counter-improvised explosive devices (IED) workand we try to include CBRN related issueson a regular basis within this. We hosted aCBRN search course for the EuropeanDefence Agency last year and are workingon the implementation in the Austrianarmed forces, looking at military searchoperations carried out under a CBRNenvironment, or searching for CBRN hiddenweapons caches. We are also now writing up a concept

paper on CBRN search as we want todefine and develop this very specificcapability a lot further. It crosses over withintelligence, CBRN, EOD, laboratory andtechnical intelligence. It’s very importanthere to have a solid chain of evidence inplace for the forensics side as ultimatelythe information will be used to prosecute,so all the documentation has to be perfect. In Belgium and France they did

numerous house searches and other searchoperations after the recent incidents andthey have well established military andcivilian search protocols already. Withinmilitary search, information gathering andthe collection of forensic evidence are veryimportant. We need this capability rightacross Europe and to be able to share itwith military and civil responders. It makessense for the military to share their helpand skills with civilian authorities. There are different IEDs and different

networks now, compared to Afghanistan forexample, but the threat is still there. It won’tdie out, it’s just that the paradigm and scopechanges. We already know that terroristorganisations have used chlorine andmustard gas so we need to know how to dealwith them should they come into Europe.

CW: Are there elements of CBRNforensics that are of no interest to themilitary, or does the need for attributionand prosecution mean that there shouldbe no difference in scene processing?That military and civil CBRN forensicsshould be identical?

GP: Civilian CBRN forensics proceduresshould be similar to those of the militaryas it’s all about preserving the evidenceand safety. The only main difference on themilitary side may be time constraints.Within a military scene we may need togather evidence very quickly in case theenemy is coming onto the scene, so wewould have emergency processes for that scenario. The time constraints and pressure on a

military team would be different; theywould need to know how to prioritise whatis needed as they may have to leave a lotof evidence behind. The military need tomake the right decisions about whichsamples and evidence to grab and takewithin a very limited timeframe. The principles, however, would still be

the same in terms of documentation tolink evidence to the scene, appropriatephotos, recording everything in contextand ensuring that chain of custody isalways consistent.

CW: How do you put together a trainingprogramme for CBRN forensics? Can yougo to civilian authorities and ask themto teach you, or do you need to startfrom scratch but to a known (althoughlegally justifiable) goal? GP: The military police already get trainingfrom the civilian police in Austria. They doa couple of months of training and arealso invited to spend time with the civilianforensics teams to shadow them in real lifewhile working out in the field. They get full training with the civilians.

We need to get training and accreditationso that we can go out and support in othercountries. The first military police specialinvestigators have received basic CBRNtraining and recently they took part in alive agent training exercise with us.

CW: What experience have you had with forensics? GP: A few years ago we had severalpotential anthrax cases, which involvedour unit. That was before we had thecurrent CBRN forensics capability andlooking back, the way we handled thatcase really helped to shape how we areworking now. The incidents actually turnedout to be hoaxes, except in one case, butthe experience of handling and working onthem was invaluable for getting to wherewe are now. In Austria, forensics is mostly the

responsibility of the police – the militaryonly have a supporting role but if it is aCBRN incident then they would largely relyon us (ie CBRN specialists of the CBRNdefence school and the CBRN companies)so that’s where we would support them. Acouple of weeks ago we were called out tohelp with a suspicious container found insome woods. It was very similar to one

found in Germany which contained sarin,so there was genuine concern. We worked with the police to assess if it

was part of a crime - had it been hiddenthere by someone for use later, had it beendumped, or was it an old container leftover from the war? None of this wasapparent. But our team had to think aboutall the options and possibilities and dealwith the container accordingly. This incident was a good example of

cooperation between EOD, CBRNspecialists and civil authorities: The policecalled the CBRN specialists who checkedthe container and the environment for anycontamination, the EOD assessed itregarding explosive threat and took x-rays.We clearly could see that there was someliquid inside and after the container wassecured, the civilian police escorted it to aspecialist laboratory where the CBRNexperts took a sample with specialistdrilling equipment.So police and military worked together.

It worked well as cooperation between ourEOD people, the police explosives peopleand our CBRN expertise.

CW: What do you see as the majorchallenges for Austrian CBRN forensicsspecifically and CBRN forensicsgenerally? GP: In Austria we don’t have a labaccredited to the Organization for theProhibition of Chemical Weapons (OPCW),but our military lab is capable ofconfirming the identity of chemicalwarfare agents. We also have a very goodmilitary bio lab, it is a biosafety level 3plus lab. The challenge is gettinginformation updated. Classical chemicalagents are not the problem, the challengeis new substances coming through whichwe have never seen before andidentification of all the toxins may bechallenging. Things which affect thebody, like nano-materials may appear infuture. We always rely on databaseinformation to help us identify agents sowe need to keep it constantly updatedand share information. In general, the challenge is that most

nations are not open in sharinginformation on forensics. More informationsharing and cooperation across differentcountries is needed. Information should beshared more quickly and more openly, but national procedures often restrict thatbetween countries. The other key challenge for CBRN

forensics for the future is when evidence isreally heavily decontaminated - at themoment you sometimes have to acceptthat the evidence is gone and that’s that.Being able to decontaminate items without losing the evidence is really challenging, but is an essential focus for the future ofCBRN forensics.



36 CBRN Forensics

Collaborative Effort

CollaborativeEffortWork is now well under way on thedevelopment of three training exercises forthe Generic Integrated Forensic Toolbox(GIFT) programme, whereby the protocols,procedures and some of the technologies,will be put to use for the first time underfield conditions, to assess and provide proofof principle.

The first exercise, to be held in the UK inDecember 2016, will involve aradiological/nuclear scenario, while thesecond one in the Netherlands will focus ona salmonella poisoning to explore the bioaspects of the project. Defence Laboratories(DLD) in Belgium, is currently planning thethird and final exercise for early 2017, whichwill test the chemical aspects of the CBRNforensics toolkit, using the discovery of animprovised chemical warfare laboratory asthe setting.

Belgium was one of the first Europeancountries to develop a CBRN sampling andidentification of biological, chemical,radiological agents (SIBCRA) team, anexpertise that has since spread to its Gallicneighbour and the rest of Europe.Historically, while the US adopted CBRNE,the division between explosive ordnancedisposal (EOD) and CBRN remained strong inEurope. Belgium, however, was among thefirst countries to start knocking that doordown, and was a constant feature of NATOResponse Force (NRF) CBRN rotations withits EOD unit. Now it is increasing its effort inforensics, a logical next step after providingSIBCRA and CBRN EOD teams.

Belgium is currently looking to roll its twofull time SIBCRA units into SIBCRA/forensicunits. DLD is an active member of the GIFTconsortium (www.giftforensics.eu), which isresearching, and in some cases delivering,the next generation of CBRN forensics inEurope. Engagement with this project isallowing DLD to look at the various elementsinvolved, and see what can be utilised for itsown needs. Once you have a SIBCRAcapability you have a great deal of the CBRN

element covered, but DLD views this as achance to learn how to deal with traditionalforensic traces (DNA, data and dactyloscopicelements) in a CBRN environment.

Mrs Katleen De Meulenaere, CBRN technicalmanager at the lab, and lead for GIFT,explained: “The forensics part will be anextra task for our current SIBCRA teams.

They have already done CBRN sampling andthere is a current need for sampling oftraditional forensics as well; it’s a greatopportunity but a lot of work. Thisoperational capability gap is one of thereasons we are in the GIFT project, it is anexcellent chance to work with specialists andpeople in forensics. “It means that we canwork on a European level as well as a


37CBRN Forensics

national level, as we can collaborate closelywith other GIFT partners such as the NICC(the Belgian forensic research lab). It is awin-win situation,” she said.

Direct linkage of research to operationalarmy units is not unusual for DLD, as itviews itself as an operational unit. TheSIBCRA units in the army have DLD

scientists incorporated, while DLD itselfcomprises full time scientists and militarypersonnel with scientific backgrounds. Thesplit is about 50/50, which allows a greatdeal of understanding and knowledge tobuild up in the team, and provides agreater understanding of operationalmatters when it comes to offering CBRNadvice to commanders.

Lt Col Martel, DLD’s commander, explained themake-up of the organisation. “We have threetechnical departments. Katleen is head of theCBRN department which has five labs. There isthe protection lab focusing on personalprotective equipment (PPE), Colpro anddecontamination. The detection and samplingpreparation lab is deployable; its people cantake samples, mainly in the area ofenvironment and health and safety but theyalso do the sample preparation for Organizationfor the Prohibition of Chemical Weapons(OPCW) proficiency testing, for example.

“We have the rad and nuke lab, which provideslogistical support for all the dosimeters of themilitary staff, operational and medicalservices. They have a lot of sources and wecan test detectors, so we will test the GIFTdetectors. Then there’s the chemical analyticallab which is focused on unambiguousdetection of CWA compounds but alsoexperienced in the identification of things likeheavy metals and environmental issues.

“Finally we have the federal orientation labwhich receives suspect samples for screeningand dispatch. We do a lot of testing but alsogive a lot of advice to the military andsometimes to first responder departments.”

Katleen de Meulenaere sees the collaborationbetween national and international agenciesas a massive benefit from the GIFT projectand that these links will be maintained andeven increased in the near future. “In termsof the CBRN lab it is important to haveenough flexibility to see how we can helpbuild new capabilities since we live in achanging world with changing threats. Wehave to try and collaborate more intensivelywith civil departments; it is becomingspecialised, complicated and detailed so wewill need to actively inform each other tofoster sharing. This is also true in a Natocontext, the development of a network is veryimportant. We should go on participatingwith Nato, OPCW and in other internationalcontexts, as it is necessary to work togetherto provide answers to tomorrow’s threats.”

Collaborative Effort

Lt Col Martel and Katleen De Meulenaere, from the Ministry of National Defence in Belgium, talk to

Gwyn Winfield about developing their forensics capability


39CBRN Forensics

Dr Randall Murch,* professor at Virginia Polytechnic Instituteand State University, on considerations for success inpreparing for and initiating CBRN forensics programmes


Twenty years ago, the FBI created the world’sfirst forensics investigation programme forweapons of mass destruction (WMD)founded on the following principles, realitiesand vision:• Forensics and attribution had not yet beenrecognised as a critical component of thenational counter-WMD programme, but intime it would be. While not all threats andillicit plans and actions can be prepared for,anticipated, prevented, thwarted or mitigated,a robust investigative capability leading toattribution, including through forensicsupport, should be implemented.• Law enforcement had neither fullyrecognised nor assumed a broader role inWMD investigations and prosecutions, norassumed its rightful place as the leader andnational integrator for the desiredinvestigative, operational and forensicprogrammes, even though existing lawswould have permitted it.• Major special events, such as the 1996Olympic Games and national politicalconventions, presented WMD targetingopportunities for adversaries. The US had awoefully inadequate forensic responsecapability. While certain smaller scale nuclearand chemical threats and events could bedealt with in limited ways, larger scalethreats and events could not, and eventsinvolving biological threats would not havebeen at all.• National-level capabilities in variousagencies existed for nuclear pre and postblast analysis, chemical weapons analysis formilitary and nonproliferation purposes, andlegacy bioweapons programmes but none ofthese were organised, staged, purposed orresourced to robustly support forensicinvestigation which informed legal, policy,operational and other processes, decisions,actions and outcomes. Vertical integration(federal, state and local) was nonexistent.• The capabilities that existed then, couldnot and would not have withstood rigorousadversarial review of the science,interpretations and conclusions as would beexpected in a US court of law or on the worldstage if forensic investigation and analysissupported US allegations or actions against asuspected perpetrator.• The US required programmes for C, B, Rand N that drew on existing programmes andassets in various agencies, which wereassigned to related missions that could beleveraged quickly and well for forensic

support. Duplication of programmes andeffort would not be supported or acceptable.Relationships, shared missions andresponsibilities had not been recognised.• WMD forensic investigative programmeswould have to integrate appropriatetraditional forensic disciplines, to maximisethe gain for WMD investigations, operationsand intelligence gathering. Traditionalforensic collection and analysis involvingevidence potentially contaminated with veryhazardous materials would require speciallytrained personnel, specialised equipment andmethods, and facilities that couldaccommodate it.• There were narrow and disjointedinteragency constructs for cooperation, manybarriers existed to the creation of an effectivenational WMD forensic enterprise, certainrequired agencies were not involved, and noone was clearly in charge.• Significant gaps and shortfalls existedacross the board, from the tactical to thestrategic levels.• At the time, forensic investigation wasgenerally thought to be an after-the-factendeavour, but the vision was materialisingthat, in reality, the value of forensicinvestigation is much broader in scope acrossinvestigative process and the ‘business cycle’of perpetrators and persons of interest.• The threat of C, B, R and N terrorism andproliferation had increased, particularlythrough what was being projected as loss orredirection from unsecured WMD weaponsprogrammes and what was being learnedfrom the pursuit and use of WMD by sub-state and apocalyptic groups.

These are still instructive today, whetherprospectively or retrospectively.Since 1996, much has changed. For

example, the US has and continues to investin a fully integrated multiagency andmultidimensional programme. This continuesto evolve to address emerging threats,technical opportunities, mission areas, andexisting and new requirements, how responseand coordination will manifest and what isneeded for decision support. The USgovernment has prioritised that holdingadversaries at risk and accountable throughattribution is a critical component of nationalcounter-WMD capabilities; nationalstrategies, policies and authorities are inplace. Nuclear, chemical and weaponsforensics have been firmly established and

recognised as legitimate disciplines.Developers and practitioners are committedto incorporating forensic requirements andexpectations into research, development,validation, transition, practice,communication and quality management toensure effectiveness, robustness andconfidence for customers and stakeholders atall levels.Nuclear (radiological) and chemical

forensics are well established through long-standing nonproliferation programmes whilebiological (microbial) forensics is maturing asa discipline. It is well realised that the threeare not the same for many legitimate reasonsand have to be treated differently. Actualcase evidence has been subjected torespective analyses and legal, policy andcommand decisions have been made andactions taken as a result. There has beenmuch collaboration between the US andcertain other nations on WMD forensics inareas such as programme development andpreparedness (training), evidence collectionand analysis technologies and methods,exercises and decision support. Peer reviewed papers are published in the

open literature when possible, whichstrengthens acceptance of and confidence inthe underlying science and its applications.Other nations have realised the value and needfor such capabilities and established their ownprogrammes which are tailored for their ownpurposes, while still more are considering such.While, forensic analysis and attribution isrecognised, accepted and used to supportnuclear and chemical weapons nonproliferationinvestigations and outcomes, the discussion hasbeen elevated to the appropriate internationalfora to similarly incorporate biological weaponsforensics and attribution. Based on his own and colleagues’

experience and many ‘lessons learned’ overthe past 20 years at national andinternational levels, the author offers somethoughts for those who are just beginning toconsider or have begun instituting a CBRNforensic programme. • First, ‘ready, aim, shoot’ as modus operandiis vastly superior to ‘shoot, ready, aim’, forboth short term and sustainable success. Twogood starting points are understanding,validating and aligning requirements ofcustomers and stakeholders and conducting asystems analysis to understand: where areyou are, where you need to be by when, andhow are you going to get there?



40 CBRN Forensics

Understanding requirements shouldinclude how forensic science does or wouldcontribute to decision making in pertinentgovernment agencies and processes. CBRNforensic programmes require substantialinvestment in personnel, science andtechnology, consumables, equipment,infrastructure, transportation and logistics,training and exercises and unexpectedexpenses. Unless resources are unlimited, acarefully thought through and executedstrategy and plan with risk managementoptions is helpful. Further, it should beaccepted that there will be a substantial upfront and continuing resource investmentfor a capability that is fundamentally forrare events. • Second, forensic capabilities musteffectively inform questions that customersand stakeholders pose or need answers to,even if situational awareness changes andthe fidelity of the answer which can beoffered increases with time, otherwise thevalue is suspect or, and even if provided, willbe discounted. Forensic science cancontribute to answering most of thesequestions. However, it is unlikely that sciencealone will be sufficient in quantity, type andquality to fill all or sufficient gaps inknowledge that are required to makedecisions or take action with the confidencerequired. Competent investigative andintelligence capabilities and mature

adjudication processes are also required.Senior policy leaders and commanders

questions before, during and following anattack can include: What is or was it? Howbad are the effects, and how much worse willit get? Who did it? Is it from a programme orlabs we know about? Will there be moreattacks? What are we and the nationsinvolved doing about it? What can we know,by when, and with what confidence?Forensic science and practice can contribute

to informing most of these questions.Investigators, prosecutors and operational

commanders’ questions can include: Did acrime/event of interest occur? Whathappened? How did it occur? When did itoccur? Where did it occur? Why did it occur?Who was involved or is responsible? Whatevidence exists? What does it tell us? Howstrong are the links? How reliable andcredible is the evidence? What alternativeexplanations are there for the evidence? Canwe defend our conclusions and actions?Forensic science contributes to answering

all these questions and can provideessential, independent information thatstrengthens the quality and confidence inthe answers. For planned or newprogrammes, objective assessments shouldbe conducted to determine how wellexisting CBRN forensic capabilities can, orplanned capabilities could, address thesesorts of questions, including strengths,

weaknesses, gaps and opportunities.• Third, one should not assume that existingforensic laboratories have the infrastructure,resources and personnel with the formaltraining, knowledge and expertise to properlyand safely conduct and effectivelycommunicate CBRN forensic analyses, resultsand interpretations. Dealing with veryhazardous materials and associated evidencerequires special expertise, certifications,equipment and laboratory configurations,safety considerations, evidence logistics andpreservation and storage. Further, it should not be assumed that just

because someone understands nuclearweapons materials, design and effects, orchemical weapons decontamination, transport or analysis, or the diagnosis andeffect, or the genomics and bioinformatics ofhighly pathogenic microbes they necessarilyunderstand forensic requirements, processesand expectations. Exploiting CBRNcontaminated physical evidence for traditional forensic results of investigative orintelligence value (eg, latent fingerprints,human DNA, documents, digital media, traceevidence and materials) requiresCBRN/hazmat trained forensic personnel, andspecialised instrumentation or equipment,methods, safety programmes and facilities. • Fourth, evidence collection should seekonly that of probative value and maintainintegrity and accountability. Analyses

Exploiting CBRN contaminated physical evidence for traditional forensic results requires CBRN/hazmat trained forensic personnel ©CRBNe World


41CBRN Forensics

performed on CBRN evidence should beproperly validated, accurate, reliable,repeatable and defensible. The science andpractice being performed should match theoutcomes being sought, and stay within thebounds of what the science is capable of.Validation of methods and protocols shouldmeet forensic requirements, whichincorporate legal and other priorities. Theattributes and limitations should beunderstood by the performers andcommunicated so that consumers of forensicinformation will factor these in as part oftheir decision calculi. The expectations of customers and

stakeholders, most of whom are notscientists or otherwise experts in these fields,should be integrated with the components offorensic investigation, from sceneinvestigation through reporting. It is prudentto ensure that this in place before evidenceis collected, processed, analysed and reportedon - and not afterwards - though somesituations can be accommodated if the useof the science is limited. In the US andelsewhere, the capacity of forensic science towithstand withering external scrutiny, suchas in a court of law or a high stakes policyforum is extremely important. If theserequirements are not met, the entire systemis at risk for loss of value and impact,independence, confidence and utility. • Fifth, for best value, CBRN forensiccapabilities should be scalable and adaptableto the types, range, dynamics anduncertainties of the scenarios that theperformers and beneficiaries expect toencounter. One effective approach towards adesired end state is to use a set of realisticscenarios in tabletop and field exercises.These scenarios might bracket very smallscale and focused events and a large scale,massive impact event or one for which acombination of CBRN threats has beenpresented or the adversary has used creativetactics, techniques or procedures. Alternatively, scenarios could

accommodate situations which supportintelligence gathering on a group suspectedof CBRN development, acquisition and use,hoax situations or post event considerations.This methodology can inform programmeplanning, implementation, investmentstrategies, resource and risk management.One set of key issues that would beilluminated from this analysis is thepartitioning and positioning of field-deployable and fixed assets. Concomitantly,this would inform thinking on the need forrapid, partial answers that can be deliveredfrom the field versus deeper, moreinformative answers that require more timeand sophisticated laboratories. • Sixth, unless one agency has or canacquire everything necessary, an interagencyCBRN forensic construct for planning,

preparedness, response, resource leveragingand command, control and communicationshould be carefully considered. If one rolls upeverything that would be required or needs tobe accommodated from what the author hascommunicated thus far, for most if not allcountries, more than one agency has thenecessary expertise, resources and facilities. Thus, to maximise return on investment

and minimise duplication of effort, the bestof various agencies can be fitted togetherunder the command and control of a singleagency or interagency leadership council.Further, if any one nation cannot affordeverything it has decided it needs, bilateral ormultilateral partnerships could be considered.This might require creative and patientnegotiation on several levels but could beworth the investment of time and energy. In any case, engaging with countries that

have successful programmes and have beendown this road already, would be valuable atthe start or at specific points along the way.This will save time and manage resources,maximise performance and increase thelikelihood of a successful and sustainableoutcome as desired. For many reasons andrealities, CBRN forensic programmes are morecomplex in a number of dimensions than theyinitially appear to be. Finally, here are some considerations,

which new starters might contemplate forearly design and implementation and whichwill help define how choices and investmentsmight be made:• A competent CBRN forensics programme isa major up front and enduring investment. Itencompasses personnel (specialisedcredentials, knowledge, skills, abilities andpossibly incentivisation), specialised trainingand exercising (unit, sector and enterprise),equipment, consumables, logistics, field,laboratory and staging infrastructure andoperations, safety, and knowledgemanagement, and decision support to name afew. Need, affordability, required readinessand expectations for responsiveness will driveinvestment and implementation decisions.Programmes will have to be maintained, andlikely evolve. Appropriate resource planningand investment, as well as changemanagement, are necessary. Decision makersshould accept the fact going in that CBRNforensics is an expensive proposition.• At least initially, a CBRN forensicprogramme may not warrant a full timepresence. It is also possible that even when aprogramme is at the desired equilibrium, fulland part time elements could be needed. Parttime elements will need to stay focused ontheir principal missions while being availableand focused on demand. These situations canbe accommodated by aligning the part timeduties, responsibilities, expectations andoutcomes with forensic support as closely aspossible with full time assignments. Closely

parallel capabilities are often present incivilian forensics, public health, agriculturaland environmental agencies, specialisednational laboratories, and military medicaland CBRN programmes that can be leveragedand knitted together, then staged, preparedand maintained or called up as required.• Adversaries, the nature of threats, possiblescenarios and threat presentations, andaccess to advancing technology andtechnical knowledge changes all impartrequired evolution, adaptability and agility toCBRN forensics programmes if currency andeffectiveness is to be expected. As aframework for thinking about managingchange, one should contemplate thepotential, which is not a bridge too far, withrespect to biothreats and dual usetechnology and knowledge. Today andlooking ahead, not only will bioforensicsprogrammes have to address current threatsand challenges, but those potentially createdor influenced by the realities of rapidlyadvancing and universally available,legitimate life sciences capabilities that canbe redirected for illicit purposes. Nefarious uses could derive from powerful

genetic engineering technologies (eg CRISPR genome editing), improved bioprospectingand exploitation of natural diversity, verysmall footprint biodesign and productionsystems (eg DIY), creative denial anddeception, and synthetic biology. Biodefenseprogrammes are becoming aware that theywill have to become more agile and adaptiveto develop and make available measures toprevent, thwart, protect and recover fromnew threats. The same is true for thebioforensics component. The future presents many challenges

indeed, and may, perhaps, seemoverwhelming. Proper prior planning andthoughtful, step-wise, ‘lean-forward’implementation to the desired end is aprudent approach, however. Fullyunderstanding and modelling the problem-capability space up front is advantageous.Maximising preparation and collaboration andsystem integration should occur. Institutingregular, critical reviews and adjustments willassist with change management. Takentogether these will reduce the chances that asuboptimal programme is established, whichcannot keep pace and meet expectationswhen it matters most.

*Since leaving the FBI, Dr Murch has beeninvolved in developing new capabilities,extending the CBRN forensic mission toadditional agencies, participating in nationallevel reviews, improving capabilities at theinterfaces of science/operations/law/intelligence and policy, publishing peerreviewed scientific papers, makingpresentations (microbial forensics) andconducting international outreach.



42 CBRN Forensics

Gap analysis and assessing capability

The generic integrated forensic toolbox (GIFT)project has now completed its research anddata gathering phase, having engaged withfirst responders and forensic specialists fromacross Europe. End user workshops have beenheld in The Hague, Netherlands; Bristol, UK;Rome, Italy; and Riga, Latvia; with firstresponders attending from 12 member states.These responders provided invaluablefeedback on their current national capability,gaps in their response procedures and theGIFT consortium’s approach.

Certainly these workshops demonstrated onefundamental truth about CBRN forensicscience - in Europe at least - and that is thatvery few first responders have specialistCBRN forensic knowledge or experience.Attendees included individuals with specialistforensic knowledge and others withimpressive CBRN backgrounds but apparently

the twain never meet where front lineresponders are concerned.

The project’s research work package (WP2)is now complete. As a result the outcomesof this work package are tangible and theR&D is well under way as the next phasegets going, incorporating the feedback fromthe research. In essence WP2 focussed ontwo main objectives supported by a numberof subtasks. The first of these was to set theincident scene by capturing a number ofcredible and feasible CBRN scenarios thatcould require forensic investigation. Thesecond objective tried to identify current bestpractice in CBRN forensic science within EUmember states, and future solutions foroperational capabilities. This process ofidentification for European CBRN forensicshas now led to the development of a set ofroad maps, which can be used by both high

and low capability member states to developan adequate CBRN forensic responsecapability based on their available resourcesand threat spectrums.To meet the first objective - creating a set ofCBRN scenarios that could be used by theforensic community - the GIFT consortiumcollected existing threat scenarios rather thanreinventing the wheel. In total 15 scenariosets were amassed, primarily from within theEU with some national planning scenariosincluded. Once gathered, these scenario setswere critiqued to assess their suitability forGIFT’s purposes. Those deemed suitable forthe project delivered a substantial crosssection of the CBRN threat spectrum forEuropean member states.

The scenarios quite logically tended to focuson the actual release of CBRN material intothe environment, which would then require a

Gap analysis andassessing capability


43CBRN Forensics

forensics. Not only did this involved fillingincomplete capability or knowledge gaps butin some cases it meant writing entirely newscenarios to include preparation of CBRNagents and/or weapons, deployed weaponsand released weapons. The end result was adedicated and comprehensive template witha total of 20 scenarios, comprising six eachof chemical, biological and radiological andtwo nuclear scenarios.

These scenario sets were then used to satisfythe second main objective of this workpackage; namely the development of CBRNforensic roadmaps (as well as making themavailable to the forensic/CBRN community).In developing these roadmaps it wasimportant to identify and understand thecurrent capability gaps in various nationsacross Europe.

The GIFT consortium held a gap analysisworkshop in June 2015 at the NetherlandsForensic Institute (NFI), utilising thedeveloped CBRN scenario sets. A broadspectrum of organisations from all overEurope attended including the InternationalCommittee of the Red Cross;Czechoslovakia’s National Institute for NBCProtection; the UK’s Defence Science andTechnology Laboratory (Dstl);Bundeskriminalamt from Germany and theDutch Ministerie van Defensie.

For obvious reasons identification of gaps isessential in developing a capability, butsimply identifying the gaps doesn’tnecessarily lead to a set of roadmapsshowing the way from the current to thedesired capability levels. It was thereforeimportant to work on a number of subtasksto build these roadmaps.

To follow a map you need a starting point.So firstly GIFT had to establish the currentcapability levels of various nations acrossEurope, no easy task given the disparity inwealth, economics and public servicesacross the EU. The current state of the artfor CBRN forensics was initiallydetermined through the workshopsmentioned earlier, and throughquestionnaires that covered a broad rangeof regional differences and approaches toCBRN forensic science. This approachprovided keen insight into the memberstates’ current CBRN forensic capabilitiesand the differently implementedoperational models. The disparities incapability and operating models wereeventually subdivided into three levels,namely low, average and high capability.Once the point of departure was set, GIFTneeded a clear line of sight to the possibledestinations for both low and highcapability countries. These destinationswere established by analysing both nearand far future developments in forensicscience and technology, and theneeded/required solutions as indicated bythe European end user community.

The culmination of 12 months’ research is thegeneration of four different roadmaps thatdescribe the forensic tasks for both high andlow capability nations (medium being anextrapolation from the two extremes), andthe required actions needed to reach animproved CBRN forensic response capability.These roadmaps are primarily intended forthe EU member states and their forensiccommunities, but will also serve the GIFTCBRN project by validating the technologicaland procedural developments over thelifespan of the project.

Very few first responders across Europe have specialist CBRN

forensic knowledge or experience

Gap analysis and assessing capability

response to save lives and mitigate theconsequences. Such incidents would certainlyinvolve a forensic response, which was notfactored in when these scenarios wereoriginally developed. Other types of CBRNincidents that might require forensicinvestigation, were missing from the scenariosets however, for example the discovery of animprovised chemical or biological laboratory.In order to provide an inclusive set ofscenarios for the forensic community suchincidents were developed and incorporatedinto the scenario sets.

The GIFT consortium needed to ensure it hada comprehensive cross section of the threatspectrum, covering most if not allconceivable challenges likely to beencountered during a CBRN forensicinvestigation, so that these scenarios wouldsupport the future development of CBRN

©NFI


44 CBRN Forensics

Dangerous clues

DangerouscluesThis article explores the ways in which themilitary has been using forensic science andthe forensic capabilities of sampling andidentification of biological, chemical andradiological agents (SIBCRA) teams. There isa lesson to be learnt from analysis of theway in which silos within the military maymean that the potential for SIBCRA teamshas not been as well used as perhaps it couldhave been. For reasons of operationalsensitivity, no single country’s SIBCRAcapability will be looked at in detail butrather discussion will be generalised ordrawn from the Nato guidance. All contacts leave a trace, according to

the great forensic scientist Locard. As aresult, there is often information that can beextracted from evidence that links traces(DNA, finger marks etc), trace carriers(phones, clothing, surfaces etc) and tracesources (people, locations etc). You don’tneed to have watched CSI New York or NCISto know that this has been a source of greatinvestigative capability for modern policeforces across the globe. TV generally shows itbeing used in a basic comparative method, ina sadly true reflection of the way in whichsome forensic services have declined. This iswhere a sample is compared with anothersample to demonstrate they are of the sameprovenance. More advanced scientistsventure into the more controversial but alsohighly valuable area of investigative forensicscience, where you have no comparativesample but try to elicit information fromunknown samples and traces. The SherlockHolmes version of this would be finding atrace of soil on an explosive device andanalysing it to try and determine where itmight have originated [Dr Lorna Dawson atJames Hutton Inst rocks at this! Ed.]. Forensic science has been applied to

explosive devices since 1800 at the latest,with the French development of a weaponsintelligence capability under the supervisionof the polymath Citizen Monge. But thecapability has generally been civilian and its

military equivalents, such as weapon ortechnical intelligence teams, were morefocused on the effectiveness of capturedweapon systems. The increasing occurrenceof asymmetric tactics in the complex,congested and contested militaryenvironment forced a reconsideration of this. If you can’t get the opponent to face you

on a battlefield, then you need to pursue andfind them by other means. When they arehiding among a civilian population it is onlynatural that forensic investigative techniquescome to the fore. Usually considered to bematerial and personnel exploitation (MPE)forensic science in the military has grown toa stage where many countries havedeployable forensic labs, teams to recoverevidence and develop doctrine. An MPE orforensic capability includes an evidentialrecovery component which may beaccredited to the civilian ISO 17020standard. Analysis of the evidence isconducted in the second part of thecapability, the forensic exploitation lab. Thismay be accredited to ISO 17025. These twoISO standards are subject to a littlecontroversy as they are really test housestandards, and require interpretation andguidance to apply them to forensic science.While MPE might be unfamiliar to some

readers, SIBCRA teams should be morecomfortable territory. As SIBCRA is reviewedkeep in mind MPE. SIBCRA is a fascinatingcapability that has evolved over the yearsfrom a starting position of realising that theuse of strategic weapons needs to be verifiedin order to justify the resulting actions of theparty that has suffered the insult. If acountry decides that its response to achemical attack is to launch nuclearweapons, then it needs some pretty strongevidence both for its own purposes but alsoto validate its actions in the eyes of theworld and the UN in particular. So SIBCRAteams have often been seen as strategicassets, held back, behind the areas where thematerials might be used, and then deployed

in response to allegations of use. This canfeel inefficient, especially if they are heldback in another country, but the purpose isgenerally to prevent the teams becomingvictims or contaminated themselves. SIBCRA teams can vary from country to

country although Nato through alliedequipment publications (AEP) establishessome commonly accepted standards for keycomponents of the capability. The SIBCRAteam focuses on the recovery of samples andthe lab to process the samples. Whiletraditionally samples would be taken back to


45CBRN Forensics

a national lab, recent years have seen somecountries produce deployable labs to speedup the exploitation of the sample and toavoid the risks of taking samples longdistances and to the homeland. The strategicnature and manner of their operation meansthat they may not give any intelligence tothe local commander, and so they do notremove the requirement for CBRN recceteams, although it isn’t unheard of for someSIBCRA teams to have been cross trainedwith CBRN recce teams.Perhaps ghostly wisps of déjà vu are

teasing you as you read. Both of thesecapabilities have sampling teams, a recoveryand transportation component and ananalytical lab. They both input theirintelligence at a high level rather than thetactical level. SIBCRA teams follow apainstaking process of sampling anddocumenting their samples because of theimpact of their intelligence - or perhaps wecould say evidence. So you would probablyassume that when the MPE capability wasdeveloping and trying to address challengeslike the transportation of potentially

hazardous samples (eg explosives) one of thebest starting points might have been SIBCRAteams - not least because some werespecifically called military sampling teams ormilitary specialist couriers. The older and more cynical of you will be

less surprised that many in MPE have beenunaware of SIBCRA due to it beingstructurally outside their areas ofresponsibility. But there have beenexceptions and there has been an interestingdevelopment with the increased attention onCBRN forensics, as a component of MPE.

Dangerous clues

WIT, MPE, SIBCRA... The military approach to forensics has a completely different alphabet soup to civilian responders ©CBRNe World

Steve Johnson, Lecturer in Intelligence and ForensicExploitation at Cranfield University, tries to slip a credit

card between forensic science and SIBCRA


Dangerous clues

46 CBRN Forensics

CBRN forensics has been given a realplatform by Nato and institutions like theNetherlands Forensic Institute, DSTL, AWEand LLNL which have really provided thoughtleadership. There has been exploration ofboth the forensic analysis of the CBRmaterials themselves, which can beconsidered a classic SIBCRA function, andthe processing of evidence which may beCBR contaminated. This latter task iseffectively MPE but in contaminatedconditions. At this nexus between MPE andSIBCRA the obvious question arises, whoshould carry out this work? Potentially thereis also a question of whether there is utilityin this capability being used bothdomestically as well as for expeditionarymilitary situations.Briefly the lab processing component is

necessarily dominated by the SIBCRAsupporting labs. This is because once a pieceof evidence is contaminated with a CBRmaterial then very few labs can legally storeand handle it. For most countries there isjust a single CB facility and a single RNfacility. Many more have no real capability atall and would need to rely on allies tosupport them. So where CBRN forensics labcapability has been explored it has tended tohave a civil driving force and to be based inexisting CBRN facilities. Unfortunately, thatmeans that there is an initial separation ofMPE facilities, which tended to be based outof explosive research units – of which thereare plenty - and CBRN forensic labs, eventhough both may be administered by thesame research organisation. Strangely

economic pressures are currently tending tomake sure that the civil developed CBRNforensic capabilities would be the naturalsupport to CBRN MPE.The situation is a little more challenging

when looking at evidence recovery in a CBRNenvironment. Again, we can consider this asoccurring in the civil domain for police/courtpurposes, military MPE or military SIBCRA.Starting with the military space it is hardly arevelation to observe that in an area asunderfunded and unvalued as CBRN thereisn’t space for duplication of effort. Thiseconomic pressure doesn’t wholly removeduplication and it can also introduce politicalpressures where more reasoned logicaldecisions would be preferable. So in an effortto inform such an argument, would a SIBCRAteam be able to carry out CBRNforensics/MPE?Traditionally, processing a crime scene is a

mixture of documentation and on sceneanalysis. A SIBCRA team is already very welltrained in the documentation of scenes andoften receives training from police forces aswell. While they may not use police/evidentialpackaging or markings, their process is veryrespectful of the chain of evidence. Crosscontamination is second nature to them dueto the practice of working with hazardousmaterials. Slightly more problematic is thefact that they are generally concerned aboutprotecting themselves from contaminationand some of their protective equipment, suchas air purifying respirators, can cause a lot oftrace and DNA evidence to be introduced tothe scene. Most commonly this results from

the expulsion of sweat/spit from exhalationvalves. This is a relatively easy problem toaddress, though. A good SIBCRA team workingto Nato guidelines would extract evidence toa reasonable level of forensic integrity. Scene processing or analysis is more

challenging. SIBCRA teams are mainlyfocused on the recovery of the CBRmaterials. This is not to the exclusion ofother useful evidence, as documents and ITare often identified by SIBCRA teams asimportant intelligence to remove. They arenot necessarily as well trained in processingwithout bias through a scene. Looking fortrace evidence, body fluids, finger marks andDNA are all quite tough skill sets which canappear straightforward. It is true that anyonecan learn to lift a mark in minutes – but tofind and lift them consistently well takes alot of experience and training and then doingso in protective equipment is an even greaterchallenge. SIBCRA teams already have apretty high training burden and it’s notunreasonable to ask if this is a step too farfor them. But would the burden be anylighter for a bespoke CBRN MPE team?MPE teams have been a bit of a fluid

development. Ranging across levels, at thelowest everyone is a collector and small kitshave been designed for the conventionalcollection of evidence. This is the recovery ofa trace carrier rather than more detailedprocessing and is a ‘best of a bad situation’approach where otherwise evidence might belost. Levels above that are teams withmilitary police, intelligence and oftenexplosive specialists. Although these haveexperience, it is fair to say that at this stagethey are still some distance off the level of ahigh end police counter terrorism forensicteam. This is partly a problem of training andequipment and partly one of currency – withwithdrawal from Afghanistan there are farfewer opportunities to practice. As allmilitary staff in Nato have a basic CBRNproficiency, it is not un-thinkable to see thesimplest solution as them just doing theirwork but in CBRN equipment. Weighing the two options for CBRN

MPE/forensics instinctively a third optionarises. With the training burdens faced oneither side and the challenge of currencyand exercising it is perhaps best that neitherSIBCRA or MPE take on the role themselves.Rather taking a modular approach a CBRNforensic capability might best be deliveredby a team drawn from MPE, SIBCRA andother relevant units. The challenge thispresents is interoperability and exercisingenough to make sure such ad hocarrangements can work efficiently. That isno small effort but worthy of exploration. Itwould be an extremely interesting topic forwar gaming and defence experimentation tosee which of the methods would be mostappropriate and if a hybrid modular optioncould be made to work.

Traditional military respirators can make a DNA mess of the scene due to leakage from theexhalation valve ©CBRNe World


47CBRN Forensics

A bit of the oldUltraviolets

RAMEM has been working within GIFT ondeveloping and validating a novel detectiontechnique focussed on detecting possiblechemical contamination at a crime scene.

The RAMEM DMA (differential mobilityanalyser) technique is an ion mobilityspectrometry technique, and RAMEM has beentesting a higher resolution to try to reduce thefalse positive and negative rates, as well as anew ionisation technique. In the case of theDMA, the ion source is ultraviolet (UV) light.We have been working on methods to analysethe air at a crime scene and identify potentialchemical agents present. So far, the resultsobtained have seen better resolution andincreased sensitivity, with lower limits ofdetection and quantification.

Reproducibility has been improved byshortening the ion pathways andconsequently, minimising the probability of ion clustering. Detection of explosivesubstances using a UV ion source and DMAhas shown promising results.

It is important to underline the importance ofthese results in explosive detection using UVionisation as an ion source for explosives. It isalso important to emphasise that the lowervapour pressure explosives have beendetected as well. Just a simple laboratoryheating plate raises the temperaturesufficiently to allow detection of PETN, TNT,ammonal (ammonium nitrate/TNT ornitrometane/aluminium), ammonium nitrateand RDX.

The project has focused on some of thechallenges from the lower vapour pressureexplosives, including an appropriate sample introduction system, which isneeded due to the special characteristics of the analytes. Several chemical toxicsubstances, some of them considered aschemical weapon agent simulants have also been detected.

The DMA could be used on site, to analyseair extracted from within the crime sceneand detect potential chemical contamination.The information fed back from the toolboxwill enable decisions to be made on theusage of personal protection equipment andtreatment of casualties, as well as protocolsand procedures.

Silvia Lopez, from Ramem, on their DMA IMS solution for GIFT

A bit of the old Ultraviolets


48 CBRN Forensics

Forensics and Privacy

You mustn’t remember this…Forensics and Privacy: beyond the right to be forgotten by

Iris Huis in 't Veld, researcher at Eticas Research & Consulting

Discussions about privacy are everywhereand there are countless examples of caseswhere privacy has been unacceptablyinfringed. Edward Snowden revealed how theUS government is engaged in surveillanceprogrammes that undermine the right toprivacy. The hacking of the dating websiteAshley Madison caused the release of users'personal information including real names,home addresses, search history and creditcard transaction records, while the companyInBloom, which offered a cloud service forstudent data, was shut down because itshared data with third parties withoutparental consent.

What does this have to do with forensics?It might seem counter intuitive to discussforensics and privacy together because,while the legitimacy of identification isquestionable in some of the cases describedabove, identification is a fundamental goalof forensics. It is easy to disregard theimportance of privacy in this context, butthis would be based on a misconception of privacy.

What does privacy mean for forensics?The topics of privacy and data protection arealmost inseparably linked to data-intensivetechnology. Technology is data-intensivewhen the data is fundamental to thefunctioning of the technology or is generatedin the process. When data about people isinvolved, rights and values should beconsidered in order to prevent negativeconsequences for those individuals.

Considering that forensic investigationsinvolve dealing with personal data –including fingerprints and DNA - therequirements for data protection also appliesto forensics. Personal data can containsensitive personal details or lead toassumptions about the individuals involved.In the wrong hands, or when misinterpreted,data can have disastrous consequences.Negative consequences includestigmatisation, discrimination and wrongfulconvictions which can prevent justice from

being served. Privacy is a human right, oftenframed as the right to be forgotten, as wellas a societal value that allows people tomaintain a private space in which to bethemselves. But above all, what privacymeans is context dependent.

Nothing to hide How can privacy be understood in thecontext of forensics? A basic question toask is: do we have the right to beforgotten? The answer depends on theinterpretation of the premise. Privacy isoften downplayed by the argument that youshould not be worried about privacy whenyou have nothing to hide. The assumption isthat privacy is about hiding things – so ifyou have done nothing wrong, you do notneed to fear a privacy infringement.

This definition of privacy as secrecy does notreflect what privacy means in terms of data-intensive technology and certainly not whatit should mean within a forensic context.Privacy is not about hiding away from aninvestigation or being secretive about it. It ismore about the right to protect and beprotected from the harmful consequences ofan infringement of privacy.

Examples include function creep, where datais collected for one purpose but actually getsused for another purpose and algorithmicdiscrimination when biased software makesdecisions based on data. So in talking aboutprivacy, it’s not about hiding from forensicinvestigation and preventing identification,but the need for responsible management ofdata to prevent the potentially negativeconsequences of mishandling data.

Ethical decision makingThe lesson learned here is that values andrights should be taken into account in theprocess of forensics. Forensic investigatorswill already weigh up many factors in thecourse of their work, including collecting thecorrect samples for the investigations fromthe crime scene and doing this in such away as to maintain the chain of custody.

They also need to ensure that privacyaspects are taken into consideration duringdecision making.

Forensic personnel must pay close attentionto detail during the handling of data, withphysical evidence, and when the evidence isdigitised. Ethical considerations concerningdata protection – such as minimising thedata collection where possible - should betaken into account.

This all adds to the responsibilities of theforensic data management chain. Emotionalfactors, like uncertainty, and time pressure,especially at the crime scene, can cloudjudgement and affect decision making.Altogether, this places a heavy burden on thedecision making skills and moral judgementsof the individual agent. This can be solvedwith protocols and training, but a solutioncan also be found in the design of the datatechnology itself.

Privacy by designThe idea of embedding privacy proactivelyinto the technology itself – making it thedefault – is the core of the designphilosophy of Privacy by Design. Whenprivacy risks and vulnerability points areidentified at an early stage of development,the information can be fed back into thedevelopment process and solutions can beembedded in the design.

Within the GIFT consortium, technology andprotocols are being designed to enableCBRN forensics and support decision makingat the crime scene. There is an opportunityto foresee the data managementrequirements and make responsible designchoices at the outset.

When privacy – along with other relevantethical values - are embedded in the designof the toolbox it will help to minimise risks.The aim is to create a strong socio-technicaltoolbox to aid the CBRNE forensics teams inensuring privacy issues are maintained alongthe chain of custody.


MobiLab™

E-N-G is the U.S. leader in mobile laboratory design and production. We have delivered over 400 Mobile Laboratories worldwide since 1977 — more than any other US manufacturer.

These versatile, easy-to-operate labs allow fast, on-site identification or confirmation of CBRN hazards and threats. E-N-G mobile laboratories are also effective in quickly determining on-site the extent of contaminated areas and in monitoring the progress of remediation efforts.

The MobiLab™ line includes vans, trucks, trailers and containers. Applications range from general-purpose and chemistry to BSL3-ready and CBRNE threat detection and analysis.

Scientists are on staff to assist with workflow design, instrument specification and laboratory practices training. MobiLab systems support procedures ranging from screening to certified testing methods.

Customers include US EPA, DOL, Army, Navy, Homeland Security and other public agencies and private companies.

Mobile CBRN Labsat the Point of Need

Fully-engineered base models include electrical and environmental systems, lab support equipment

Lab-grade interior finishes for easy decontamination

Models are instrument ready and turnkey systems are available

Models are easily customized to meet specific requirements

BSL1, 2 and 3-ready models

Applications include:

CBRNE Threat Detection and Analysis

Public Health and Research

Environmental / Air Quality

Industrial Chem & Bio

Education, and more

E-N-G is your partner for state-of-the-art mobile solutions.Call us to discuss your unique requirements.

E-N-G is a PositiveID Company

PositiveID develops detection and diagnostics capabilities for Point-of-Need (PON) applications, including its M-BAND autonomous monitoring for biological weapons (licensed to Boeing) and FireflyDx handheld molecular diagnostics.

E-N-G Mobile Systems, Inc. A PositiveID Company

2245 Via De Mercados, Concord, CA 94520(925) 798-4060 / (800) 662-4522 • www.e-n-g.com

© 2016 Cobalt Light Systems Ltd.

Introducing ...Handheld Through-Barrier Chemical Identification

Seals remain intact - Evidence is preserved

Accurate ID of chemicals and mixtures in ~1 minute

www.cobaltlight.com/resolve

NEW

AVAILABLE TO DEMO

NOW!

00811 Resolve A4 AD Forensics AW.indd 1 06/10/2016 17:39

cbrne forensics vpress - tyndall national institute forensics.pdf · 2 cbrn forensics contents...

Documents