The use of fire/burglar alarm data has been very useful as a tool in many aspects of fire investigation. The following are uses that I have discovered and utilized on multiple fire scenes: 1. Determination of the area of the fire’s origin. 2. Determination of the time that the fire occurred. 3. Identification of actions of the occupant prior to the fire. 4. The ability to identify an intentionally started fire or confirm an accidentally caused fire.
First, we must identify how a typical smoke/fire/burglar alarm works. Most alarms are either monitored by a central station, or are for local use only. If an alarm is monitored, the central station is automatically notified (usually by telephone) if the system goes into alarm mode. The monitoring station may be located in the same city or another state. The monitoring company subsequently notifies the local police or fire dispatch center of the alarm for the appropriate response. If the system is local only, then an audible alarm only sounds on the property. Under both systems, the alarm data is stored in the “brain” of the system, which is usually found in a closet, hallway, or office. If the system is monitored, that alarm data is transmitted to the monitoring company, where it is also stored. This data allows us to recreate the incident, and study what happened and when. More importantly, it illustrates what didn’t happen.
Alarm data for burglar alarms can include which windows, doors, or motion detectors have activated during an incident. Heat, smoke, and/or carbon monoxide detectors will identify where and when the fire first initiated an alarm. In addition, if the structure has a sprinkler system, the activation of sprinklers and their location can be helpful to identify the location where the fire started. An incident timeline is very useful to show the progression of the fire within a structure. In addition to alarm data, I usually include fire department response data including dispatch time and arrival time. Witness statements that tie into the previous data can also be included in the timeline. The identification of these items will give a complete picture of the incident.
On many occasions, I have been able to retrieve the alarm brain from the burned structure. Depending on its location in the structure and the extent of damage sustained, it is possible to collect the “brain” as evidence and have a qualified technician extract the data. If this is possible, the information can be a virtual gold mine. The data retrieved is commonly known as an event log. The log lists each time the alarm was armed and/or disarmed. If the system is more sophisticated, different people may have use of their own access codes. This can be useful to identify whom armed/disarmed the alarm. Interviews with the manager/owner will also limit those with knowledge and/or access to the alarm.
It is necessary to review the event log from one to two months prior to the fire to develop a pattern of use. For example, if each night at 11:00 pm, the alarm is armed when the business closes, and is disarmed every morning at 8:00 am, this indicates a pattern. Further, if on the night of the fire, that pattern changes, and the alarm is not armed, this could be a red flag. Moreover, if the alarm was armed then disarmed at a peculiar time, further investigation may be indicated especially if a fire subsequently occurred minutes or hours later. Those with access to the alarm system may become persons of interest.
When alarm systems are initially set up, an internal time clock may be set. However, many times the technician does not utilize this function and the event log time/date is incorrect. One way to correct this situation is to “translate” the time/date from a known event, such as witness statement of alarm activation, or fire department response, etc. In addition, if the system is monitored, a signal is transmitted from the alarm to the monitoring station every 24 hours. The purpose of this is to check that the system is functioning properly. This system check is entered in the event log as well as with the monitoring company logs. The investigator can then match up the actual time/date with the incorrect one on the local alarm event log.
A typical alarm system utilizes low voltage wiring that is installed in the attic or above a drop ceiling in commercial applications. The wiring connects to motion detectors, door and window magnets, as well as to heat and/or smoke detectors. All of the wiring returns to the alarm control box, where the computer brain, power supply, and backup battery are located. How the alarms are activated and entered into the event log can be helpful in determining where the fire started, or if forcible entry occurred to the property prior to the fire. For instance, if the alarm is armed, then a point of entry activation occurs, such is in the case of a burglary, one can assume that a person entered the establishment without disarming the alarm. If however, the first event after arming the alarm is a smoke/heat detector or motion detector activation, it may be assumed that no forcible entry occurred. This information may indicate that someone with access to the alarm code set the fire. In this case, interviews with first arriving police officers or fire department personnel are important to ascertain if windows were broken or doors were open at the time of their arrival.
In a large commercial structure, activation of motion/heat/smoke detectors can offer the approximate location of where the fire started. The fire may have assaulted the low voltage wiring in that area (attic). Or the heat/smoke detector activation can give a specific room where the fire originated. Typical activation of motion detectors in a structure reset when persons move between rooms. However in the case of a fire, if the event log shows simultaneous (or close to) activation of multiple motion detectors, it could be that the fire burned through the low voltage wiring in the attic.
Often, fires occur a short time after an alarm system is activated. Anytime this occurs, the investigator must find out who armed the system and what their actions were preceding the fire. Most arsonists are unaware that data from the alarm system can be retrieved. If the investigator can show that no one came or went after the system was armed, then the person setting the alarm had a good idea about how the fire was started. Of course accidental fires can occur, however if ignitable liquids are detected or other arson red flags exist, an intentionally set fire is probable. The alarm event log data can be very damning during an interview with the owner/occupant, especially when the investigator has locked him/her into a different story. In addition to alarm data, use of cell phone records to confirm the location of the suspect at the time the fire was started can be useful. These records can also prove false an alibi that the owner was out of town at the time of the fire.
An example of how alarm data helped prove an arson fire occurred at a restaurant. During an interview, the owner admitted to closing the restaurant himself. In fact, he told his manager that she could go home early (which was out of character). The owner was adamant that he locked the front and rear doors to the restaurant when he left. The alarm event log showed that the alarm was armed at 11:07 p.m. A building surveillance camera also showed the owner exiting through the front door and walking to his car. The next event on the log occurred at 11:10 p.m., where multiple motion detectors activated (fire attacking the low voltage wiring). No point of entry sensors activated (illustrating that the doors were not opened). In addition, a police officer was the first on scene, and stated that the front windows failed as he was pulling up. Interviews with the fire crews revealed that the doors were closed and locked (firefighters had to force entry).
A timeline was created that included witness statements from employees as to when they left the restaurant (confirmed by surveillance cameras), fire alarm events, as well as fire department dispatch and on-scene times. During the scene investigation, I found evidence of gasoline (verified with the laboratory) throughout the rear area of the restaurant (office and kitchen). As a result of gathering this information, I was able to show that the owner intentionally caused this fire.
Alarm data is a significant tool to utilize, when it is available. When it is used, care must be given to continue to employ normal investigative techniques as well as the scientific method to determine the origin and cause of the fire.