Crime scene investigation in a chemical, biological, radiological and nuclear (CBRN) context


CBRN-E crimes are closely linked to environmental crime and their number is constantly growing. Their investigation is a major challenge, and many countries urgently need to improve their systems. An important role for law enforcement agencies is to identify them and provide relevant evidence in court proceedings to ensure that the perpetrators are brought to justice. On-site investigation in the CBRN context must therefore meet high quality standards to maintain the safety of investigators and preserve the evidence. This requires skilled and educated experts.
This article describes the basic attributes of a crime scene investigation under CBRN conditions and recommends a global framework of procedures for investigators, including the use of new technologies. It represents a basis for a future Biological and Chemical Crime Scene Management Guidance Manual for Law Enforcement planned to be developed by an international team of experts under the umbrella of UNICRI.


Known assassinations or assassination attempts using novichok, such as the Skripal case in 2018, or the VX case at the Malaysia Airport against Kim Jong-Nam in 2017 or the use of Polonium 210 in the 2006 Litvinenko case, have attracted worldwide attention precisely because of the use of hazardous substances. Other cases that have attracted public attention include the attacks in Tokyo using sarin (1995); letters sent to public authorities in Slovakia containing americium 241 (2016); the yperite attack at Tbilisi airport (2018); and the dimethylmercury and abrin case in Czech Republic (2018). Several attempts of terrorist attacks have also been recorded, such as those involving the use of hydrogen sulphide in Australia (2017); ricin in several European countries like Germany (2018); a chlorine bomb (2015) and abrin terrorist plots in Indonesia (2019). All these cases pose a particular challenge for law enforcement agencies and security forces, especially in terms of evidence gathering and quality crime scene processing.
In this context, however, it is also necessary to mention other much more common cases of chemical, biological, radiological, nuclear crimes, even though the definition of CBRN crime is not yet sufficiently and uniformly established in the criminal law systems worldwide. These definitions include an increasing trend of assaults using acid; the illegal trafficking, production and possession of CBRN materials; and the illegal transport and dumping of hazardous waste, etc.
We can clearly observe from practice that there is a wide range of CBRN crimes classified under different crime categories. Their impact on the population is often invisible, as it primarily affects the environment and the impact on human health is a secondary consequence. Therefore, it is important to link CBRN crime partially to environmental crime, depending on their type. We can also make this connection on the basis of the existing Directive 2008/99 / EC of the European Parliament and of the Council.
As a good example of combating CBRN/Environmental crimes, we can mention the Slovak Republic, where the police created a special unit within the Criminal Police Bureau focused on combating environmental crime and investigating cases where hazardous materials are involved, unofficially called the Enviro-CBRN Police Unit.
Also, police agencies from the Czech Republic, Georgia and many other countries have a rich experience in dealing with such types of illegal activities. Therefore, it is important to share this knowledge worldwide among law enforcement practitioners, because different CBRN crimes can be interconnected, e.g.: CBRN material illegally dumped in a landfill site can be used for a terrorist attack or for any other offence putting the population in danger.
Based on our experience and based on existing international legislation we are preparing a research article about the definition and classification of CBRN crime, which will be published soon. This will address the question of why it is necessary to consider a new, separate and clearly defined category of CBRN crime and will explore the specific methodological, tactical and strategic approach to CBRN crime investigation.

Traditional versus CBRN crime scene investigation

The topic of CBRN crime is complex and is being increasingly discussed worldwide, especially in connection to crime scene investigation (CSI). We often encounter questions as to whether it is necessary to carry out research in this area or to look more deeply at the adequate standard operating procedures necessary to properly secure evidence at the crime scene under hazardous conditions while protecting the health and safety of crime scene investigators.
To this end, it is necessary to compare traditional CSI with CSI in a CBRN context to identify any differences and why it is necessary to specify CSI procedures in a CBRN environment.
As we know from practice, there are different approaches to classical CSI, however each has a common basis and goal. Priority is given to securing the crime scene and evidence, but also to the general protection of crime scene investigators. As stated by the National Forensic Science Technology Center, the first is to set the main crime scene dimensions and detect any potential health issue or other hazards. The crime scene must be secured and relevant cordons established. As stated in the United Nations Office on Drugs and Crime (UNODC) Guidebook, one of the main objectives of the protection of the crime scene and its evidence is to ensure appropriate anti-contamination measures in such a way as to protect the integrity of the identified evidence. This objective must be a part of the planning phase.
As stated in another UNODC document written by David James Davis and col. (4), the phases of identification, securing and recovery of evidence from crime scenes represent a challenging part of the investigation. It requires intensive work by investigators and spending the necessary amount of time in performing the duties.
So, what is the difference between traditional CSI and CSI in the CBRN context?
CBRN crime scene investigation is very complex and time consuming compared with traditional CSI. A number of factors play a role that affect the whole chain of custody process. Additionally, compared with a traditional crime scene, the CBRN crime scene contains hazard that could significantly affect the health and safety of investigators and the validity of evidence. A primary CBRN crime scene can be found anywhere: inside an inhabited house, in public buildings and spaces, in industrial enterprises, on critical infrastructure land, on agricultural land, in a forest, in and along a river, in landfills – dump sites, in means of transport, simply everywhere where hazardous materials are commonly present, or where they are transported and used by the perpetrators.
The following four factors must, therefore, be carefully considered in a CBRN context:
I. Specialised equipment and tools
Investigation teams and other cooperating agencies have to be equipped with relevant detection devices and sampling kits for hazardous material or integrated multi-detection systems able to provide reliable data. Simulation and modelling aspects at the contaminated crime scene using new technologies should also be taken into consideration.
The hazardous materials at the crime scene must be accurately detected, identified, monitored and carefully risk-assessed to determine how they should be managed (including the levels of protection required for CSIs).
The transport and deployment of such equipment significantly affects the time and personnel management of activities at the crime scene.
II. Protective requirements
Safety is also emphasized in traditional CSI and priority must be always given to protecting the health and safety of investigators. However, in a CBRN context, the investigators may have to deal with highly hazardous and dangerous materials. This involves the correct selection, dressing and use of personal protective equipment (PPE) that may differ from traditional CSI PPE. When performing on-site tasks, care must be taken to avoid cross-contamination between investigators and to prevent damage to protective clothing. Furthermore, it is important to properly decontaminate, remove and dispose of PPE after completing the work.
In a radiological crime scene, other safety aspects must be considered: time spent in the hazard control area; distance between radioactive sources and CSIs collecting evidence; radiation shielding; the potential spread of radionuclide contamination and monitoring of individual radiation exposure.
The word “contamination” has multiple meanings in CBRN CSI compared to traditional CSI; to prevent the contamination of investigators with dangerous substances; to prevent the contamination of the crime scene and evidence with dangerous substances; and to prevent contamination of other materials that can be transported into a crime scene from outside or from investigators (body fluids, etc.).
It is important to recognise that the work at the CBRN crime scene should only be carried out by police officers or civilians (forensic experts) with specialized training and education. There will always be a limited number of these experts and therefore it is necessary to pay close attention to their protection and safety, as they guarantee the quality of the work.
III. Time and staff resilience
Crime scene investigation in a CBRN context has its specific challenges and requirements, which must be respected early in the planning phase of the activity. In addition to normal police work at the crime scene, it is necessary to take into account the time to put on protective clothing, walk in a CBRN suit to the target place, detect and identify the source of the CBRN threat, its eventual removal, complicated handling of traces in protective suits, decontamination of persons, evidence and used tools. In this connection, there is a limitation resulting from the use of oxygen bottles capacity, radio-communication glitches or the radiation activity of any source present. All these affect not only individual deployment times, but also the number of police officers who have to be deployed to complete tasks. CBRN crime scenes require much more frequent rotations and replacements of CSIs linked to the level of the hazard and the level of PPE.
IV. Preserving evidence
Detection, identification, collection, decontamination of evidence and packaging of clean, contaminated and decontaminated evidence must be properly performed and recorded to successfully secure and recover them from the crime scene for the chain of custody always bearing in mind the health protection of relevant CSI experts.
Standard operating procedures
The use of the correct methodology and standard operating procedures is therefore of paramount importance in achieving successful prosecutions. Achieving success also depends on multiagency cooperation which is not always the case in a traditional CSI. In all phases of the CSI listed below, there must be effective communication and cooperation between several police forces, forensic institutes, firefighters, paramedics and other authorities responsible for CBRN threats like public health authorities, nuclear regulatory bodies, radiological institutes, biological and chemical laboratories, military CBRN protection battalions etc.

Therefore, based on our practical experience we suggest the following necessary procedures for an effective on-site investigation in a CBRN context:
I. Preparatory phase
One of the most important parts of an on-site investigation is proper preparation in the form of obtaining as much information as possible about the case and the environment, i.e. the crime scene. It is essential to collect relevant information from Special Weapons and Tactics (SWAT), Canine (K9) and Explosive Ordnance Disposal
(EOD) teams and non-police agencies like fire fighters, etc. if they have previously intervened at the scene. All collected data will then serve to ensure the safety of CSIs as well as the efficient securing of evidence. This phase must include the so-called CBRN distance threat recognition (DTR). This is an initial remote detection of CBRN threats through the appropriate standoff detection equipment and visual recognition of CBRN threats remotely (warning signs). Where possible, the investigation team may also use close detection techniques (CDT) in the form of an integrated CBRN threat detection system (UAV – drones and UGV – robots, e.g.: Terriffic system and Sense system). Dispersion or contamination modelling and simulation of CBRN threats, together with the modelling of crime scene parameters and characteristics, are strategic tools in this CSI phase. The crime scene security must also be provided by taping the perimeter and marking dangerous zones. Subsequently, crime scene investigators must set priorities for on-site investigation as well as the correct selection and planning of personal protective equipment based on a precise risk assessment. Measures against COVID-19 must also be part of security procedures at the crime scene. Potential contamination of crime scene investigators can endanger their health as well as the health of their colleagues and relatives. For this reason, it is necessary to think about these elements in the preparatory phase.
II. Crime scene reconnaissance
The crimes scene reconnaissance phase follows the previous one, where no weapon or improvised explosive device (IED) threats have been detected by SWAT, K9 and/or EOD teams. It involves the CBRN close threat recognition (CTR) if UAV and UGV couldn’t been involved in the previous phase. Subsequently, detailed localization and detection of CBRN and other threats is performed using hand-held detection equipment and visual recognition. Furthermore, all possible obstacles, suspicious objects and substances and potential CBRN booby traps are recorded. This phase also includes an initial inspection of the crime scene, in which all access routes to the primary as well as the secondary crime scene are recorded, if they occur in the common area.
3D Mapping or other commonly used methods may be used to register the crime scene. Finally, criminal investigators record the location, occurrence, and condition of potential traces and evidence.
Accurate photographic and video recordings must be made of this phase, as they will serve for subsequent phases and CBRN profiling of the crime scene and perpetrators. The reconnaissance phase is usually carried out in type A protective clothing, unless it is possible to identify the hazardous materials present in advance which allows a risk assessment to determine that a lower level of PPE can be used. Therefore, the default position is type A, which is the highest whole body fully encapsulated protection with independent oxygen flow – self-contained breathing apparatus (SCBA).
As a rule, this part of the crime scene inspection should be carried out, if possible, by the most experienced police officers, as it will result in further action.
III. Planning for sampling, identifying and securing traces and collecting evidence
The next phase is to prepare a plan for collecting samples of CBRN materials and securing identified traces. Planning must include all relevant safety measures as well as a sequence of steps for sampling, securing and collecting evidence. If there are dangerous substances or materials at the crime scene that obstruct investigators from securing evidence, such materials must be safely removed from the crime scene, or neutralized or shielded – in the case of radioactive sources – by specialised experts.
IV. Sampling, securing traces and collecting evidence at the crime scene
Sampling of suspect substances as well as identifying traces and securing evidence should be carried out in accordance with the established plan.
Samples of hazardous materials taken must be carefully recorded, as well as appropriate measurements by detection instruments. If possible, it is also important to record the GPS locations of evidence and samples, especially if it is an outdoor crime scene.
An inventory log of labelled evidence should be created. The inventory should be carefully double checked for accuracy and all the evidence and samples should be reconciled against the log to ensure they have been correctly packaged and recorded before leaving the crime scene.
Crime scene investigators must be dressed in appropriate protective clothing according to pre-detected threats and a risk assessment, usually level B or C. It may happen in a specific case, that they will need to wear an A level of PPE at all times.
V. Decontamination of evidence, crime scene and CSI personnel
The decontamination of selected samples of evidence before proper packaging and before transport to the laboratory or police storage room must be carried out in accordance with the relevant standards in such a way that the evidence is not invalidated, compromised, destroyed or rendered unusable. It should be noted that not all secured traces can be decontaminated.
Staff and crime scene decontamination must comply with national and international standards so as not to endanger the health of investigators and others.
VI. Packaging of seized evidence from the crime scene for transportation
Packaging of seized and labelled evidence from the crime scene has to be performed in a way that prevents any cross-contamination. Their transportation must comply with all legal norms to avoid any harm to the environment or health.
Any evidence or sample transferred from a CBRN crime scene to a laboratory or other suitable evidence storage facility should be accompanied by appropriate records alerting the receiving organisation/staff of any relevant hazards or risks so they can consider how to safely store and manage them.
It is also appropriate to record the various circumstances under which the traces were taken, as this may affect the result of the analysis (e.g. external temperature, contact with other traces, original packaging, etc.).
VII. Profiling – crime scene analysis
Crime scene profiling/analysis in a CBRN context can start directly on-site if a certified profiler/analyst is included in the investigation team or afterwards during the remote desk work using recordings from the crime scene.
In addition to analysis of photographs and video, an integrated approach in assessing the crime scene protocols, investigative, forensic and medicolegal protocols and forensic victimology should be used during the desk work profiling to determine CBRN crime scene characteristics.
If the profiler/analyst takes part in on-site analysis immediately after the crime was committed, they must use appropriate PPE in accordance with the risk assessment.
Further details related to on-site procedures during CSI in a CBRN context, especially in cases of chemical and biological threats, will be elaborated in the framework of the Biological and Chemical Crime Scene Management Guidance Manual for Law Enforcement under the Umbrella of UNICRI’s CBRN Programme in cooperation with the ISEM Institute, the EU CBRN CoE, the European Commission, the Biological Weapon Convention Implementation Support Unit and the Organisation for the Prohibition of Chemical Weapons. It will follow the existing International Atomic Energy Agency Radiological Crime Scene Management Guidelines previously mentioned.

Dr. Marian Kolencik, PhD. works as CBRN-E Security Analyst and Profiler specialised in CBRN-E crime and terrorism. His academic background is in the field of Education and Social Science (Slovakia), CBRN Security Management (Poland), Crime Scene Analysis and Criminal profiling (USA). He was also trained in countering CBRN terrorist threats by French police. Since 1995, he has been providing advisory services, training and various analysis for many security forces around the world, and European and international institutions. He is a founder of International Security and Emergency Management Institute –
First peer review of article: Cameron Mann, Mario Kern, Giorgi Beridze.
Recommended citation:
Kolencik, M., Preprint paper: Crime scene investigation in a CBRN context, ISEM Institute, Slovakia, April 2021, DOI: 10.13140/RG.2.2.21684.37762/1