Fire/Security Alarm Data in Fire Investigation

Fire/security alarm data has been very useful as a tool in many aspects of fire investigation. The following are uses that I have discovered and utilized on multiple fire scenes:

First, we must identify how a typical smoke/fire/security alarm works. Most alarms are either monitored by a central station or are for local use only. If an alarm is monitored, the central station is automatically notified (usually by telephone or cellular) if the system goes into alarm mode. The monitoring station may be located in the same city or another state. The monitoring company subsequently notifies the local police or fire dispatch center of the alarm for the appropriate response. If the system is local only, then an audible alarm only sounds on the property. Under both systems, the alarm data is stored in the “brain” of the system, which is usually found in a closet, hallway, or office. If the system is monitored, that alarm data is transmitted to the monitoring company, where it is also stored. This data allows us to recreate the incident, and study what happened and when. More importantly, it illustrates what didn’t happen.

Modern alarm systems can be accessed by the user via a phone application. The events that occur can be viewed almost instantaneously by the owner or tenant. Many systems also provide video surveillance with remote access. An important aspect of these systems is the ability to log accurate date and time information. Older alarm systems require an alarm technician to manually set the date and time in the system programming. Often, the times on the event log are either slow or fast. Alarm data for security alarms can include which windows, doors, or motion detectors activated during an incident. Heat, smoke, and/or carbon monoxide detectors can identify where and when the fire first initiated an alarm. In addition, if the structure has a sprinkler system, the activation of sprinklers and their location can be helpful to identify the location where the fire started.

An incident timeline is very useful to show the progression of the fire within a structure. In addition to alarm data, I include fire department response information including dispatch time and arrival time. These times are referred to as “hard times,” due to their objective nature. Witness statements can also be included in the timeline as “soft times” due to their subjective perspective. Cell phone photos and videos from witnesses are also helpful, as we can view the scene conditions with accurate times and dates. The identification of these items will give a complete picture of the incident.

On many occasions, I have been able to retrieve the alarm circuit board/brain from the burned structure. Depending on its location in the structure and the extent of damage sustained, it is possible to collect it as evidence and have a qualified technician extract the data. If this is possible, the information can be a virtual gold mine. The data retrieved is commonly known as an event log. The log lists each time the alarm was armed and/or disarmed. If the system is more sophisticated, different people may have use of their own access codes. This can be useful to identify who armed/disarmed the alarm. Interviews with the manager/owner will also limit those with knowledge and/or access to the alarm.

It is necessary to review the event log from one to two months prior to the fire to develop a pattern of use. For example, if each night at 11:00 pm, the alarm is armed when the business closes, and is disarmed every morning at 8:00 am, this indicates a pattern. Further, if on the night of the fire, that pattern changes, and the alarm is not armed, this could be a red flag. Moreover, if the alarm was armed then disarmed at a peculiar time, further investigation may be indicated, especially if a fire occurred minutes or hours later. Those with access to the alarm system may become persons of interest.

When alarm systems are initially set up, an internal time clock may be set. However, many times the technician does not utilize this function and the event log time/date is incorrect. One way to correct this situation is to “translate” the time/date from a known event, such as witness statement of alarm activation, or fire department response, etc. In addition, if the system is monitored, a signal is transmitted from the alarm to the monitoring station every 24 hours. The purpose of this “test” is to ensure that the system is functioning properly. This system check is entered in the event log as well as with the monitoring company logs. The investigator can then match up the actual time/date with the incorrect one on the local alarm event log.

Conventional alarm systems utilize low voltage wiring that is installed in the attic or above a drop ceiling in commercial applications. The wiring connects to motion detectors, door and window magnets, as well as to heat and/or smoke detectors. All of the wiring returns to the alarm control box, where the computer brain, power supply, and backup battery are located. Modern systems utilize wireless technology, which eliminates the need for actual wires.

The sequence of how/when various alarms activated can be helpful in determining where the fire started, or if forcible entry occurred to the property prior to the fire. For instance, if the alarm is armed, and a point of entry activation occurs, one can assume that a person entered the establishment without disarming the alarm. If however, the first event after arming the alarm is a smoke/heat detector or motion detector activation, it may be assumed that no forcible entry occurred. This information may indicate that someone with access to the alarm code set the fire. In this case, interviews with first arriving police officers or fire department personnel are important, to ascertain if windows were broken or doors were open at the time of their arrival.

In a large commercial structure, activation of motion/heat/smoke detectors can indicate the approximate location where the fire started. The fire may also have burned low voltage alarm wiring in an area (attic), causing an activation. Typical activation of motion detectors in a structure reset when persons move between rooms. For instance, if someone enters a reception area and triggers a motion detector, it will usually reset when the person leaves the room and enters another area of the building. This process repeats with sequential motion detector activations. Investigators can often track movement of someone through a building by reviewing the event log. However, in the case of a fire, if the event log shows simultaneous (or close to) activation of multiple motion detectors, it could be that the fire burned through the low voltage wiring in the attic.

Often, fires occur a short time after the alarm system is armed. When this happens, the investigator must identify who armed the system and what their actions were preceding the fire. Most arsonists are unaware that data from the alarm system can be retrieved. If the investigator can show that no one came or went after the system was armed, then the person setting the alarm may be the one who set the fire. Of course, accidental fires can occur, however if ignitable liquids are detected or other arson red flags exist, an intentionally set fire is probable.

The alarm event log can be very helpful during an interview with the owner/occupant, especially when the investigator has locked him/her into a conflicting story. In addition to alarm data, use of cell phone records to corroborate the location of the suspect at the time the fire started can be useful. These records can also verify an alibi that the owner was out of town at the time of the fire. License plate readers have also proven helpful to show a suspect vehicle near the crime scene.

An example of how alarm data helped prove an arson fire occurred at a restaurant. During an interview, the owner admitted to closing the restaurant himself. In fact, he told his manager that she could go home early (which was out of character). The owner was adamant that he locked the front and rear doors to the restaurant when he left. The event log showed that the alarm was armed at 11:07 p.m. A building surveillance camera also showed the owner exiting through the front door and walking to his car. The next event on the log occurred at 11:10 p.m., where multiple motion detectors activated (fire attacking the low voltage wiring). No point of entry sensors activated (illustrating that the doors were not opened). In addition, a police officer was the first on scene, and stated that the front windows failed as he was pulling up. Interviews with the fire crews revealed that the doors were closed and locked (firefighters had to force entry).

A timeline was created that included witness statements from employees as to when they left the restaurant (confirmed by surveillance cameras), fire alarm events, as well as fire department dispatch and on-scene times. During the scene investigation, I found evidence of gasoline (verified with the laboratory) throughout the rear area of the restaurant (office and kitchen). As a result of gathering this information, I was able to show that the owner intentionally caused this fire.

Alarm data is a significant tool to utilize when it is available. When it is used, care must be given to continue to employ normal investigative techniques as well as the scientific method to determine the origin and cause of the fire.