Description
- In the Taxonomy of Cybercriminals, what is the motivation of cyber terrorists?
- What are three of the top computer threats for 2016?
- What is alligatoring in arson investigation?
- What is an IED and what is it used for?
Cybercrime
CHAPTER 17
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
Learning Objectives, 1
Distinguish between computer-assisted crimes and
cybercrimes
Identify the two prerequisites for the emergence of
cybercrime
State six advantages cybercriminals have over
traditional criminals
Define malware
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
2
Learning Objectives, 2
Differentiate between black hatters, gray hatters,
and white hatters
Describe the operation of botnets
Describe the typical methodologies associated with
attacks by outsiders
State the purpose of DoS or D DoS attacks
Explain the threat posed by the Chinese P L A in A P
T1
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
3
Learning Objectives, 3
Describe the use of scareware
Contrast polymorphic and metamorphic viruses
Explain the use of ransomware and a rogue
program called CryptoLocker
Describe how keylogger attacks are accomplished
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
4
Learning Objectives, 4
Summarize the general rules for consent searches in
the computer crime context
Identify the major main points for securing and
evaluating a computer crime scene
Describe the Silk Road, the deep web, and the Tor
Network
Briefly describe the process of digital forensics
relating to a seized storage device
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
5
Cybercrime: An Overview, 1
Prerequisites for the emergence of cybercrime
Computers had to be commonplace
Computers had to be linked in a network
Satisfaction of the prerequisites sets the stage for a
new breed of criminals who:
Did not have to leave the comfort of their homes to
commit crimes
Were invisible or anonymous, avoiding the dangers of
personal contact with their victims
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
6
Cybercrime: An Overview, 2
Could strike anywhere in the world
Were enabled to approach thousands of potential
victims simultaneously
Executed crimes that victims might never detect or be
too embarrassed to report
Committed crimes that might be discovered only much
later, hampering investigations
Stood to reap profits far beyond those associated with
conventional crimes
Did not have to worry about fencing tangible stolen
property
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
7
Figure 17.1: Comparison of Traditional and
Cybercrime Techniques
Source: No author, Cybercrime: Public and Private Entities Face Challenges in Addressing Cyber
Threats (Washington, DC: General Accountability Office, June 2007), p. 6
Jump to Figure 17.1: Comparison of Traditional and Cybercrime Techniques, Appendix 1
Jump to Figure 17.1: Comparison of Traditional and Cybercrime Techniques, Appendix 2
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
8
Organized Crime
Any group having some manner of a formalized
structure and whose primary objective is to obtain
money though illegal activities
Attack methods
Social engineering
Authorized use of an organizations systems
Bypassing security and control processes
Compromised accounts
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
9
Silk Road with the Deep Web or T O R
Network, 1
Silk Road
Underground website that traded in goods and services
Euphemistically referred to as the e-bay of drugs and
illegal contraband
Came to a halt on October 1, 2013
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
10
Silk Road with the Deep Web or T O R
Network, 2
Network was ingenious and operated as part of the
deep web
Deep web: Vast uncharted part of the world wide web,
not accessible through regular Internet browsing or
search engines
Most of the information in the deep web is hidden and
encrypted with a unique application called Tor
Tor net or Tor Network is a synonym for the deep web
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
11
Cyber Terrorism, 1
Politically or ideologically motivated attack against
information systems, networks, programs, and slash
or data that can result in violence against a civilian
target
Called digital terrorism
Encompasses the use of the Internet and slash or
any electronic communication technology intended
to effect traditional terrorist outcomes
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
12
Cyber Terrorism, 2
Uses technology for wide range of purposes
Recruitment
Funding
Providing training
Planning acts of terrorism
Incitement to commit and slash or the execution of acts
of terrorism
Execution of cyber-attacks
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
13
Categories of Cybercrime Tools, 1
Tools or services
Description
Malicious
software
Ready to run crimeware is often purchased on the Internet. For
example, viruses, worms, and spyware. Cost ranges from less than
10 dollars for a simple virus to over 5,000 dollars for advanced
capability programs. The Trojan horse is the most commonly sold
malicious software at approximately 750 dollars per copy. Some
sites offer free downloads of older versions of malicious software
that may be useable or that places a virus on the downloaders
computer.
Cybercrime
Services
Examples include distribution of spam and pop-up messages, and
denial of service attacks to shut down websites.
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
14
Categories of Cybercrime Tools, 2
Tools or services
Description
Stolen data
Includes bank, savings, checking, credit card, PayPal, iTunes, and
casino account numbers; user names and passwords; identity
documents, for example, data from scanned passports, are also
available to assume new identities or engage in fraud. Offenders
may use or sell data harvested.
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
15
Offenders
Black hatters: Hackers or crackers who use their
skills to illegally make money
White hatters: Hackers who use their skills for good
Gray hatters: Hackers or computer security experts
who:
May violate the law or at least violate ethical business
standards
Do not have the malicious or criminal intent of a black
hatter
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
16
Types of Cybercriminals
Novice
Old guard hackers
Cyberpunks
Professional criminals
Internals or insiders
People who commit
information or espionage
warfare
Petty crooks
Virus writers
Cyber terrorists
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
17
Computer Intrusions
Accomplished by the use of malware
Malware is intended to:
Deny use of computers
Covertly gain control over computers
Secretly access or intercept computer data
Subvert the operation of computers for personal profit
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
18
Malware Intrusions, 1
Botnet is a network of zombies or bots
Jump to Malware Intrusions, 1, Appendix
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
19
Malware Intrusions, 2
Virus: Unauthorized software program that is
surreptitiously inserted into an executable program
on a single computer
Primary purpose is to replicate as many times as possible
and to cause as much mischief or damage as possible
Types
Polymorphic virus
Metamorphic virus
Worms
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
20
Malware Intrusions, 3
Time, logic, and e-mail bombs
Time bomb: Programmed to go off at a particular time or
date
Logic bomb: Detonated when a specific event occurs
E-mail bombs: Overwhelm a persons e-mail account
Denial of service, DoS, attack: Circumstance in which the
Internet service provider suspends the use of the e-mail
account, disrupting the ability of the victim to use it
Botnet herder can use all of his or her zombies to
overwhelm even the largest servers, in a distributed denial
of service, D DoS
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
21
Malware Intrusions, 4
Ransomware
Known as cryptovirus
Holds the data on a computer or the use of the computer
hostage until a payment is made
Dead drop
Use of another computer or server to store stolen data
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
22
Malware Intrusions, 5
Trojan horses
Piggyback on the Web Accelerator download or appear
as pop-ups
Recognize three categories
Backdoor
Downloader
Infostealer
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
23
Malware Intrusions, 6
Spyware
Thought of as a surveillance tool
Keylogger, or keystroke logger
Most common form of spyware
Harvests every keystroke that is made on a computer
Rootkit
Gives attacker power over the computer
Quickly emerging as the largest threat to computers
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
24
Malware Intrusions, 7
Scareware
Attack often starts with a pop-up message
User is prompted to download software that is really
malware
©McGraw-Hill Companies, Inc./Mark Dierker, photographer
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
25
Mobile Device
Any small computer device, typically small enough
to be held in the hand
Does not have the same level of security awareness
among the public as traditional computer devices
May be the weakest link for cybercriminals to slip
through to more sophisticated systems or in which
to exploit innocent victims
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
26
Investigation of Cybercrimes: Federal
Efforts
Four-fold mission of the F B I
To stop those responsible for serious computer
intrusions
To identify and thwart online sexual predators
To counteract operations that target the intellectual
property of the United States and endanger national
security or competitiveness
To dismantle national and transnational organized
criminal enterprises engaging in Internet fraud
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
27
Investigation of Cybercrimes: United
States Secret Service
Broad jurisdiction to investigate computer crimes
Includes unauthorized access to protected computers,
identity theft, D DoS attacks involving disruption of ecommerce or extortion, and distribution of malware
Has established Electronic Crimes Task Forces, or E
C T Fs, in approximately 39 cities across the country
Mission: Prevention, detection, mitigation, and
aggressive investigation of attacks on the United States
financial institutions and critical infrastructures
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
28
Investigation of Cybercrimes: State and
Local Efforts
Computer or cyber or high-technology or electronic
crime units are commonly found in larger municipal
and county agencies
Many local agencies depend on the computer-crime
expertise of their state investigative agency, state
police, or state patrol
State agencies are often staffed with a combination of
officers trained in computer-crime investigation and
civilian information technology specialists
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
29
Legal Considerations
State statutes vary in their sophistication and
breadth
Knowledge of the federal Electronic
Communications Privacy Act, E C P A, of 1986 and
its subsequent amendments is essential
Investigators should be guided by their
departments policies and those of the local
prosecuting authority
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
30
Consent Searches
General rules
Police can rely on a
persons actual
authority to consent or
the apparent
authority of such other
parties to consent
Source: Priscilla Adams, Consent Searches (Oxford, Mississippi: National Center for Justice
and the Rule of Law, University of Mississippi Law School, 2010), p. 6 with modifications
Jump to Consent Searches, Appendix 1
Jump to Consent Searches, Appendix 2
Jump to Consent Searches, Appendix 3
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
31
Crime Scene
Computer and peripheral evidence
Tablets, computer notebooks, and laptops
Desktops
Rack systems
Main frames
External hard drives
Printers, scanners, and compact disks
Flash drives and memory card readers
Web cameras
Wireless access points and network servers
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
32
Crime Scene Processing
Secure and evaluate the scene
Conduct preliminary interviews
Document the scene
Collect and transport evidence
Conduct digital forensics
Conduct digital forensics using mobile devices
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
33
Arson and Explosives
Investigations
CHAPTER 19
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
Learning Objectives, 1
Discuss the steps in the preliminary investigation of
arson
Be familiar with various types of burn indicators
Describe ignition devices that may be used in arson
Assess several common motivations of arsonists for
setting fires
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
2
Learning Objectives, 2
Explain the scientific methods used in arson
investigation
List several groups of people whom an arson
investigator should interview
List questions that investigators should ask in
interviews and interrogations
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
3
Learning Objectives, 3
Understand how legal entry can be made into a fire
scene and how evidence may be legally obtained
Discuss the two types of major explosions, namely,
mechanical and chemical
Understand how improvised explosive devices, I E
Ds, work
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
4
Learning Objectives, 4
Outline the procedures for handling and
investigating bomb threats
Understand how to collect and preserve evidence at
the bomb scene
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
5
Preliminary Investigation, 1
Premises should not be disarranged before an
investigation
Determine the point of origin by:
Examining the bottoms of shelves, ledges, and moldings
Examining the furniture and all sides of the legs, arms,
and framework of reconstructed furniture
Using the layer-checking technique
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
6
Preliminary Investigation, 2
Investigator should clean the floor carefully at the
point of origin, examining and moving all objects to
one side
Floor or rugs should be swept as clean as possible for
examination of burn patterns
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
7
Where and How Did the Fire Start, 1
Factors needed to cause a fire
Source of heat
Material ignited
Accidental fires
Once the point of origin has been discovered, the next
step is to determine how the fire started
Even though arson may be suspected, the investigator
must first investigate and rule out all possible accidental
or natural causes
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
8
Where and How Did the Fire Start, 2
Causes of accidental or natural fires include:
Electric system
Electrical appliance and equipment
Gas
Heating units
Sunlight
Matches
Smoking
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
9
Spontaneous Heating
Produced in three major ways
Chemical action
Fermentation
Oxidation
Susceptibility to spontaneous heating is usually
determined by drying time
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
10
Spontaneous Ignition, 1
Rare in residences and small businesses
Considerably accelerated by external heat such as:
Sunshine
Steampipes
Hot air ducts
Friction from wind or vibration
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
11
Spontaneous Ignition, 2
Requires several hours to several months of
oxidation or fermentation
Characterized by internal charring of a mass of
combustibles
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
12
Burn Indicators, 1
Effects of heat or partial burning that indicate the
following fire-related factors:
Rate of development and points of origin
Temperature and duration
Time of occurrence and the presence of flammable
liquids
Determining the cause of a fire, especially arson,
requires the interpretation of burn indicators
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
13
Burn Indicators, 2
Alligatoring
Depth of char
Breaking of glass
Collapsed furniture springs
Spalling
Temperature determination
Distorted light bulbs
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
14
Burn Indicators: Depth of Char, 1
Used for evaluating the
direction of fire spread
By determining which
portions of a material were
exposed to the heat source
the longest
By locating where the
damage was most severe
damage
Used to estimate the
duration of a fire
Source: Factory Mutual Engineering Corporation, Norwood,
Massachusetts.
Jump to Burn Indicators: Depth of Char, 1, Appendix
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
15
Burn Indicators: Depth of Char, 2
The rate of charring of wood varies depending on
such variables as:
Rate and duration of heating
Ventilation effects
Surface area-to-mass ratio
Direction, orientation, and size of wood grain
Species of wood, such as pine, oak, fir, and so on
Moisture content
Nature of surface coating
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
16
Ignition Devices, 1
Matches
Only juvenile arsonists and pyromaniacs seem to favor
striking matches
Gasoline and other accelerants
Gasoline and other accelerants are very popular with
many different types of arsonists
Accelerants: Boosters that speed the progress of a fire
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
17
Ignition Devices, 2
Chemicals
Various chemical combustions have been used to set
fires
Gas
Use of a combination of gas and the pilot light on the
kitchen stoves of many residences is always a possibility
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
18
Ignition Devices, 3
Electrical systems
Any wiring system, including doorbell and telephone
circuits, can be used as a fire-setting tool
Mechanical devices
Mechanical alarm clocks were once a favored weapon of
arsonists
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
19
Ignition Devices, 4
Plants: Material placed around the ignition device
to feed the flame
Newspapers, wood shavings, rags, clothing, curtains,
blankets, and cotton
Trailers: Used to spread a fire that has already been
started
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
20
Arson for Profit, 1
Motive behind committing arson for profit is
economic gain
Enormous gain derived from inflating insurance coverage
beyond the buildings value
Limited economic gain derived from cutting ones losses
before oncoming financial disaster
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
21
Arson for Profit, 2
Factors that influence the insured persons decision
to commit arson fraud
Desire for financial relief
Greed, the desire for easily obtained financial assistance
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
22
Arson for Profit, 3
Reasons for arson
Short-term business problem
Desire to relocate or remodel
Buildup of slow-moving inventory
Outmoded technology
Satisfaction of a legal or illegal debt
Purely fraud schemes
Redevelopment
Building rehabilitation
Real estate schemes
Planned bankruptcy
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
23
Major Forms of Third-Party Arson, 1
Elimination of business competition
Motivated by someone who seeks to create a business
monopoly or at least to maintain a competitive edge
Extraction of extortion payments
May be a warning signal to a businessperson to pay up
or else, or it may be a signal to similar businesstypes to
either pay or wind up like the burned-out victim
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
24
Major Forms of Third-Party Arson, 2
Labor-management grievances
Arsons in business establishments may be the result of
an unresolved labor-management grievance for which
the perpetrator felt there was insufficient redress or
resolution
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
25
Revenge-Motivated Arson
Personal revenge: Use of fire to strike at an
individual owing to a personal grievance
Societal retaliation: Targets are random and firesetting behavior often escalates
Institutional retaliation: Often serial arsonists,
striking repeatedly at institutions
Group retaliation: Offender tends to feel anger
toward a group collectively
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
26
Detection and Recovery of FireAccelerant Residues, 1
After a fire has been extinguished, the floor should
be carefully cleaned
Baseboards and sills should be checked
Corners of the rooms should be checked
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
27
Detection and Recovery of FireAccelerant Residues, 2
Soil beneath the burned area should be checked
when gasoline or similar material is suspected to
have been thrown on porches or buildings without
basements
If recovered material is suspected of containing
flammable liquids, it should be sealed in an
uncoated metal paint can
Biodiesel fuel is one of the most common
alternative fuels used in debris analysis
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
28
Detection of Fire Accelerants, 1
Olfactory detection
Sensitivity of the human nose to gasoline vapor is about
one part per 10 million
Sometimes, dogs are brought to the arson scene to
detect accelerants on people at the scene
Chemical color test detectors
Chemical color tests may be used to detect both liquid
accelerant residues and their vapors
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
29
Detection of Fire Accelerants, 2
Catalytic combustion detectors
Portable, moderate in cost, and fairly simple to operate
Flame ionization detector
Sample gas is mixed with hydrogen, and the mixture is
burned
Gas liquid chromatograph
Sample gas is first separated into components on the
basis of the speed with which they travel through a tube
filled with packing material
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
30
Detection of Fire Accelerants, 3
Infrared spectrophotometer
Can achieve high specificity to flammable liquids and
high sensitivity
Ultraviolet fluorescence
Consists of illuminating the darkened fire scene with an
ultraviolet lamp
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
31
Interviews in an Arson Investigation, 1
Possible witnesses
Tenants, businesspeople, and customers from the burnt
building or surrounding buildings
Passersby such as bus drivers, taxi drivers, delivery
people, sanitation workers, police patrols, and people
waiting for buses and taxis
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
32
Interviews in an Arson Investigation, 2
Questions to ask witnesses
Was the fire observed?
At what time and in what part of the building was the
fire observed?
Was anyone seen leaving or entering the building before
the fire?
If yes, ask questions relating to this person
Were there any vehicles in the area of the fire?
If yes, ask if they can be described
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
33
Interviews in an Arson Investigation, 3
Can the smoke and color of the flame be described?
How quickly did the fire spread?
Was the building burning in more than one place?
Were any unusual odors detected?
Was anything else observed?
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
34
Interviews in an Arson Investigation, 4
Firefighters at the scene
Can be an invaluable source of information to arson
investigators because of their technical knowledge
and what they observe at a fire
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
35
Interviews in an Arson Investigation, 5
Questions to ask firefighters
What time was the alarm received?
At what time did the person arrive at the scene of the
fire?
Was the route to the scene blocked?
What was the extent of burning when the person
arrived?
Were doors and windows locked?
Were the entrances or passageways blocked?
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
36
Interviews in an Arson Investigation, 6
What kind of fire was it?
What was the spread speed of the fire?
In what areas did the fire start?
How near was the fire to the roof?
Was there evidence of the use of an accelerant?
Was any evidence of arson recovered?
Did the building have a sprinkler system?
Were there contents in the building?
What is the fire history of the building?
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
37
Interviews in an Arson Investigation, 7
Insurance personnel
Three people may be interviewed to determine if the
profit centers around an insurance claim
Insurance agent or broker
Insurance adjuster
Insurance investigator
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
38
Interviews in an Arson Investigation, 8
Questions to ask the agent or broker
Who is the insured, and is there more than one person
insured?
Is the insured the beneficiary?
Questions to ask the insurance claims adjuster
Was a sworn statement taken from the insured?
Did the insured submit documents regarding proof of
loss, value of contents, bills of lading, value of building,
and the like?
Copyright © 2019 McGraw-Hill Education. All rights reserved. No reproduction or distribution without the prior written consent of McGraw-Hill Education.
39
Interviews in an Arson Investigation, 9
Questions to ask the insurance investigator
Were you able to determine the cause of the fire?
Did you collect any evidence?
Property Insurance Loss Register, P I L R
Listing of everyone who has an insurab
