It can be challenging to differentiate between an incendiary fire and arson because the differences are subtle. Incendiary fire speaks to willfulness relating to the criminal ignition of property. Arson refers to the criminal act of deliberately setting fire to property or recklessly starting a fire or explosion. The incendiary is the causal factor, whereas arson is more related to the charge.

We look at whether the fire was deliberately ignited during incendiary fire investigations. We consider whether the person knew that the fire should not be ignited. This means such cases rely strongly on Mens Rea, meaning intent or knowledge of wrongdoing that constitutes part of a crime.

When investigating incendiary fires, a fire scene’s approach must be unbiased. We approach it with a systematic and methodical approach and a process of elimination. Therefore, we can only render our conclusion once we’ve gathered all facts relating to the case.

While knowing the motive may be an added advantage, it’s beyond the scope of an investigator. The motive is crucial only to the legal aspects of the investigation. These are amongst the most common motives in incendiary fire claims:

1. Financial
2. Revenge
3. Mental health
4. Mischief
5. Serial arsonists

Incendiary fire indicators

Indicators range from multiple fires, unusual fuel load or configuration, irregular fire patterns, burn injuries, lack of expected fuel load, and incendiary devices to lack of ignition sources. If a home is vacant, it may provide an opportunity for ignition. We may also look at the conditions of doors, windows, and the property if it appears abandoned.

During investigations, it’s also essential to look for disarmed alarm and sprinkler systems that may have been tampered with.

Multiple fire indicators

The site of a previous fire mustn’t be confused with a new one. For example, if a fire occurred in the home, and some of the damage was not fixed, the earlier site could be mistaken for the current one. Therefore, it is incumbent on the investigating team to obtain a fire history of the structure. Because fires that occurred at different times naturally won’t correlate, it’s crucial to get the fire history of the system from the Fire Department.

Irregular fire patterns

Figure 1: An example of an irregular fire pattern.

When at a scene, an investigator must look at irregular fire patterns. Look for anything that suggests that the fire came from other areas. It’s equally important to look for debris that indicates that there could have been an extension cord or anything else that could have been a competent and potential ignition source.

Combustible fuels or ignitable liquids are often used to spread the fire. These may leave distinctive patterns on horizontal surfaces. It’s vital to determine whether these patterns are not from other mechanisms such as electrical failures, smoking, candles, stovetops, spontaneous combustion, or lightning.

Materials that can be used in incendiary fires

While several other combustibles exist, these four remain the most common. In addition, some homeowners use toilet paper or pls as ignition materials for incendiary fires. However, it is not the materials that constitute a fire pattern but how they are used.

Figure 2: A bedroom where a fire occurred.

In figure 2, a protected area is surrounded by surface heat damage stains. There is another protected area on the bed. The secure area on the floor continues down the stairs. In this case, a suspect poured gasoline on the surface, and the fire died due to a lack of ventilation. When we look at irregular fire patterns such as these, we need to pay attention to the protected areas because they’ll often tell us what material was lying there.

Lack of expected fuel load

When visible damage isn’t consistent with the fuel load, it always warrants further investigation. In cases where a protected area is seen, the police may remove the material. The absence of the fuel itself is not enough to classify a fire as incendiary. Sometimes there is an area in a corridor, stairway, or hallway that does not have as much fuel load. But this area will have a burn pattern that needs to be investigated further to confirm that the cause of the fire is not spontaneous combustion, a lit cigarette, or another product that may have oxidized.

Some investigators habitually only look at the burn areas and neglect the debris. It’s essential to search the debris because you may find significant pieces of physical evidence for further analysis.

It’s equally critical to examine the burn area in totality. If you’ve collected enough physical evidence for samples, never leave part of the burn area unexamined. For example, going to scrape the floor in the area could reveal crucial pieces of evidence. Look in areas such as closets, crawl spaces, and attics.

Unusual fuel load or configuration

An arsonist may move furniture and combustibles closer to speed up the fire spread. However, this makes it easier to see that there are no other potential and competent ignition sources for the area. This indicator helps us build our facts during investigations. However, we must be careful not to assume that unusual fuel loads are related to a deliberately set fire. For example, people may have had a party before the fire, resulting in a need for a reconfiguration of furniture. To rule this out, investigators look for potential ignition sources in the area.

Before going into any scenes, one must get as much information as possible from the insured. When taking a statement from the insured, ask them to write where the furniture is or where it should be on a piece of paper. In addition, you may wish to have them indicate if there are any extension cords or other possible electrical ignition sources. This process of elimination can lead to a more efficient fact-finding mission.

When collecting the insured’s statement, information about the furniture materials and the fuel type must also be obtained.

Burn injuries

People that are involved in setting fires can often get injured. Those injuries require analysis to ensure that they are consistent with the fire. For instance, if the exposure to heat is through radiation, chemical, or electrical burns, the injuries should match the insured’s statement.

In the process of elimination, you must attempt to determine the type of burn injury. For example, the extent and type of burn injury sustained from boiling liquids or cooking may differ considerably from one incurred in a drug lab. These are crucial considerations when analyzing body injuries.

If there are bodily injuries and somebody is trying to delay the fire, you’ll probably have incendiary devices.

Incendiary devices

When incendiary devices are seized, it’s vital to ensure proper continuity and analysis. Part of the investigation and analysis process is also ensuring that all vested parties are invited to attend.

There’s a wide range of mechanisms for incendiary devices, and almost any appliance or heat-producing device can be used. These devices include candles, oil lamps, Molotov cocktails, matches, cigarettes, and stovetops.

Remains of incendiary devices can often be found on the scene, making it easy to send them for lab examination. They can also be found in the debris. Upon obtaining the remains of incendiary devices, they must be properly bagged and sealed.

Some incendiary devices are constructed as delay devices to allow the fire setter time to leave the scene. If an explosive device is found in the background, it must not be removed or touched, as it may have a timer. Not touching the device also avoids contamination or spoliation. Spoliation can also be prevented through security.

The presence of incendiary devices does not always mean foul play. For example, the presence of ignitable liquids may be normal in a typical residential garage.

Methodology and Considerations

The two aspects of investigative processes remain the same in commercial and residential claims. Therefore, we look at fire scenes with no preconceived notions to ensure that we provide an unbiased report.

Sometimes, emergency services will be required at the scene, delaying the forensic investigator’s access. During these delays, the investigator must ask the contractor to secure the scene to ensure that it’s not contaminated and that the scene is well-documented. Consider all your hypotheses, the process of elimination, and the patterns offered.

Figure 3: A burnt rubber carpet with an irregular pattern.

Burn patterns are often the key to discovering the cause of a fire. Examining the pattern and its surroundings can provide much-needed physical evidence. In addition, this thorough examination could help confirm if other objects could have dropped in the area of origin.

Forced entry

Figure 4: An example of a forced entry indicator.

In a thorough process of elimination, you must also look at the possibility of forced entry. In the case shown in figure 4, screws were found on the floor, and the door had been replaced. At first glance, you would not tell that the garage door at the back had been removed.

Considerations

As an investigator, key questions and considerations in forced entry claims include:

Key takeaways

Case study: Commercial fire

Figure 5: The commercial building during the fire.

The building, in this case, operated as a pork and meat plant. It also had another tenant who ran a slaughterhouse for pigs and cattle. In addition, the plant was both CFIA and USDA approved.

Figure 6: The location of the first fire.

An employee discovered a fire outside a washroom in the basement at 3:50 am. The fire department attended and extinguished the small fire. They did not raise any concerns about how a fire could start in this location.

Figure 7: The location of the second fire.

After the extinguishment of the first fire, the fire department left. Staff was allowed to enter the building when within approximately 15 minutes, a second alarm was raised in a cooler room on the north side of the plant.

The fire department reattended, but the fire had taken hold as cork, and foam insulation was in the walls. The fire took at least 24 hours to get under control. It was subsequently determined that both fires were entirely separate and deliberately set.

Figure 8: The detached gas line.

During the investigation, a gas line was found disconnected in the boiler room, which was away from both areas of the fire.

Figure 9: The meat processing area after the fire.

All the stock was damaged, and the roof of the plant collapsed due to the second fire.

Figure 10: The roof after the fire.

Challenges at the scene

Unique Coverage issues

Three separate companies were named on the insurance policy, namely:

1. Landlord-owned buildings
2. Operating tenant
3. Tenant (the slaughterhouse)

The mortgage company sought payment under the Mortgage clause. In addition, the operating tenant was subsidized and placed in receivership. We also had a business interruption claim.

The tenant ultimately retained a public adjuster and filed for proof of loss for approximately $9.6 million. There was a claim for both building and equipment damage. Moreover, the receiver filed a lawsuit for $3.2 million that included various components, such as stock, tenant improvements, business interruption, ordinary payroll, and professional fees. The landlord’s lawyer later claimed for equipment and business interruption.

Lessons learned

1. Interview the insured at the first opportunity. The insured was interviewed on day one in this case. The three-hour interview secured some details on the loss. This turned out to be the only opportunity we got to speak to the insured. When the police designated the scene as a crime scene, they did not provide details on why they did that. The insured retained legal counsel, and we never got the opportunity to interview them or secure formal statements over the next eight years, which was the life of the fire.

After the first and only interview, we had no access to the insured as all the flow of information was through solicitors. So, if we hadn’t interviewed the insured early on, we would never have gotten any evidence from them. Adjustors and investigators also need to speak to people who were at the scene. We talked to a mortgage company representative who attended and obtained valuable documents, such as a pre-loss appraisal report and pre-loss photographs. We secured this with the insured’s permission. Had we waited, we would have never received this permission from the legal counsel involved.

2. Retain the good investigation team and counsel early on. It’s essential to have the right people in place. In this case, we retained security to protect the scene and keep a proper log of all persons entering and accessing the site while investigating. In addition, we had engineers identify the structural damage and define the type of building that existed before the fire. This information helped us price what it would cost to repair or rebuild.

We retained a roofing consultant to comment on prior deterioration and poor maintenance. We included an environmental expert in determining what hazards existed at the site. We also had an equipment expert tell us whether the equipment could be lubricated to avoid deterioration. Moreover, we retained a cleaning company and conducted various tests in the building to determine the best cleaning method. Then, we retained accountants to verify the inventory and stock.

3. Tread very lightly on suspected arson cases. Insurers face a lot of pressure from the insured and the authorities to pay for things that require repairs. You’ll have to resist this pressure while the investigation is ongoing.

It’s tough to explain to non-insurance people why the insurer doesn’t want to pay for the cost of emergency work acquired at the site. On day 3 of this case, the adjuster was told that the CFIA had condemned the meat in the building. They were subsequently exposed to return with a plan to remove around 500 carcasses that weighed 700 pounds from a structurally damaged building. After producing this plan, they brokered a deal between the insured and a rendering plant they had contacted, where the insured agreed to pay for removing the contaminated meats.

We then arranged for accountants to count meat before loading it onto trucks. However, as we had 10 trucks lined up outside the following day, the ensured said he wasn’t paying for it. Instead, the bank had appointed a receiver who froze the insured’s assets overnight.

It’s essential to remember that an insurance policy is a legal contract. So, you can use statutory conditions to your advantage. They can back you up when you are faced with a lot of pressure from the insured or the authorities to pay for emergency work that needs to be done. Use these conditions to explain why insurers cannot commit to coverage until the investigation is complete.

Examples of statutory conditions are number 6, which details requirements the insured needs to follow after a loss. Statutory condition 7 details that coverage is invalidated if there’s fraud and action by the insured or persons acting on their behalf.

Statutory condition 10 details the insurer’s rights to enter and control the site to conduct an investigation. Even so, we would usually still get written authorization from the insured to attend the site. That condition also states that insurers cannot abandon salvage. Statutory condition 11 deals with any disputes. So, if you get into a disagreement on quantum, you can use that condition to resolve the dispute.

History has shown that in times of economic hardship and high unemployment, instances of insurance fraud increase dramatically, and the current global recession is no exception. Our observations in the field and conversations with insurers support this narrative. In the past several months, we have seen an increasing number of suspicious claims that represent a growing problem for insurers, including fraudulent water claims.

Water losses aren’t always as straightforward as other types of losses. They come with several challenges, especially in determining the cause of failure. Unlike a fire loss, for example, the absence of the insured from their home does not necessarily make a water loss less likely.

Difficulties with water claims

They often occur passively – Because water supply systems are always pressurized, passive failures can occur anytime. An insured can return from a vacation to find their flex hose or some other fitting has failed. Therefore, the passive nature of the loss makes it harder to identify the intentional act.

The intentional act may occur before the loss – Intentional water losses are hardly ever hammer-to-the-pipe scenarios. Homeowners could create a weakness in the system to make the loss appear more realistic, leading to the pressurized system failing on its own. This is motivated by the fact that water damage does not destroy the evidence like arson does. This means intentional damage to a pipe, for example, won’t be washed away by the water.

To avoid detection, homeowners create a situation where the loss somewhat occurs on its own. For example, a homeowner could loosen a valve or the threads on a connection or turn off a thermostat. In such scenarios, it takes time for the pressure to force a valve or cap open and for the house to reach freezing temperatures that lead to a freezing burst.

Fraudulent claims look like real claims – All fraudulent water claims bear the same elements as accidental claims, in that water escapes through the exact mechanism in either case. And so, only an extensive and fairly detailed investigation can conclusively determine whether a water loss should be classified as intentional or accidental.

Coverage denial issues

As a solicitor, you must consider several factors when you receive a claim. These factors affect coverage and the direction you take when dealing with a lawsuit.

Beware of bad faith claims

Bad faith claims are always the primary concern in the insurance industry. As a result, the industry is constantly searching for ways to avoid these claims and deal with the insured in such cases. Therefore, due diligence requires that we determine whether coverage is appropriate and fair to the insured.

Whiten v. Pilot

The Whiten v. Pilot case is a relatively extreme example of what can happen if you leave your insured in the lurch. However, it is a good reminder that you can’t make decisions based on instinct during coverage claims. You can’t cut your insured off unnecessarily while you’re investigating the loss. Even if you suspect a loss is intentional, you still need to investigate further and deal with the insured almost neutrally while doing so. This means you may incur ALA costs during the investigation, despite suspicion of insurance fraud.

Complete neutrality means doing emergency mitigation. For example, you may need to send someone to dry up premises to prevent further loss. You won’t prejudice your insurance. If damage worsens during the investigation, you must deal with it if coverage is not denied.

Avoid complete mitigation work like removing the walls. Your retained engineer will need to see all the evidence to determine where the water flowed. Removing the drywall may eliminate some proof. Limit your efforts to emergency mitigation.

Look to policy language

The best thing to do is look at your specific policy conditions. Water losses are not subject to the same statutory conditions as fire losses. Many policies incorporate the statutory requirements for fire loss into other losses, but they’re not required to. So, you’ll have to look at the specific policy language to see whether those stack conditions apply. This will allow you to see what other exceptions or limitations may apply.

For example, suppose a water loss occurs in a seasonal home. In that case, a specific policy term may indicate what must be done to winterize that residence if it will be vacant for a certain period. This policy term may also state how long the owners can leave the place empty. Those are easier terms to utilize if you want to deny coverage over a loss. In addition, they’re explicit in the policy, meaning you don’t need to consider whether the failure was intentional or accidental. Instead, you can just look to something outside the bounds of policy as a basis to deny coverage.

Policy exceptions lie more in freeze-up losses. They predominantly stipulate the amount of heat required or how long you can leave the place vacant. Your policy may only cover specific types of water losses. The easiest way to deal with those claims is by looking at the particular policy language.

Denial of claims requires loss to be intentionally caused

If you’re going to deny a claim based on something other than explicit policy language, you must prove that the loss was intentionally caused by the insured. The general rule of first-party insurance is that it covers fortuitous losses only, meaning coverage does not depend on the failure being utterly free of the insured’s fault. Their negligence can still lead to coverage, but it must be unintentional. The onus is on the insurer to prove positively that the insured intentionally caused the loss, which can be tricky.

Investigation of water claims can suggest negligence as being just as likely of a cause as an intentional loss. A thermostat being off when homeowners leave for vacation does that necessarily mean that they did it intentionally; it may be a mistake on their part. If both inferences are equally likely, the court will likely consider negligence over intentional causes.

Sometimes, the insured could destroy evidence to cover up an accidental cause. This makes such losses appear intentional because altering the evidence affects the credibility of the insured. However, it does not necessarily prove that the damage was deliberate.

In water losses, you don’t typically deal with many witnesses; you rely on the insured to tell you what happened. However, as a solicitor or investigator, you may be in a position where you have to disprove what the insured is telling you.

How to investigate water losses

Causation is key

You need to know how the loss occurred, not just the mechanism. For example, you need to know precisely what caused a plumbing component to fail. Loss mechanisms are the same for negligent and intentional losses, so you need to conduct an in-depth investigation to determine the extent of the failure, as well as its origin.

You’ll require an expert to look at the physical evidence directly. Sometimes, the loss mechanism might be perfectly evident, but the exact cause warrants further analysis. Several types of water losses lead to various questions that can only be answered with the help of an expert. An expert will be better positioned to dig into exactly what happened in and around the area of loss and the rest of the house and help you assess whether the claim could be fraudulent.

Investigate early

You’ll want to conduct the investigation immediately after receiving the claim report. This is to ensure that the physical evidence is available and is not disturbed any more than necessary. An early investigation will also allow the engineer to be on-site for the inspection.

We’ve dealt with claims where a contractor informs the homeowner of the leak’s origin and then removes the part to send it to the engineer. While these may not be fraudulent claims, they prevent the success of our investigations. Upon receipt of the failed component, the engineer may determine that the leak did not occur at the original site of failure. Removal of that component, therefore, means evidence is no longer available for a conclusive determination of the loss. So, make sure your expert looks at the scene as it is.

The adjuster also needs to work at the outset of the claim. Early investigating allows all parties involved to get the freshest information from your insured, including maintenance and installation details. Insureds are typically more motivated to help you at the beginning. If you are primarily concerned about fraud or intentional causes, you must get the insured’s story earlier because they won’t have a chance to change it if they are lying. Tweaking their story to account for discrepancies leads to a further basis to suggest that they’re not a credible witness.

Focus on subrogation

The focus on subrogation allows you to look at the cause objectively, which in turn helps you determine if a claim is fraudulent. On the other hand, a strict focus on coverage might lead to the question of whether the insured is at fault. While this is an important question, it doesn’t help you objectively determine the cause of a loss.

The information provided by your engineer will help you determine the express cause of the loss. All that information will lead you to whether a loss is intentional, so there would be a basis to deny coverage. If the loss is unintentional, objectively analyzing the evidence and information provided will help you determine the likely cause.

Altering evidence

Case study 1: Faucet water supply line

Figure 1: A flex hose with failed steel braiding (left). A close-up of the site of failure (right)

A homeowner submitted an insurance claim after a flex hose failure. The industry had several issues with flex hoses years ago. While these failures still occur, they are much rarer than before, and the older flex hoses usually fail.

All flex hoses have steel braiding, an essential component of the hose. Failure of this component could cause the interior rubber hose to burst because the rubber on its own does not have sufficient strength to withstand depressurization.

The exterior of flex hoses can corrode naturally if exposed to a lot of water or other corrosive chemicals. The metal braids are made up of tiny individual strands, making them susceptible to damage, even after mild exposure to corrosive substances.

Figure 2: SEM images of the strands in the failed hose.

We used a scanning electron microscope (SEM) to examine the ends of the steel strands. The right-hand side image shows the material’s smearing, which indicates a mechanical force. The defamation observed was consistent with cutting.

Figure 3: An example of a flex hose that corroded without mechanical force.

Figure 3 shows examples of a naturally eroded flex hose strand. As opposed to figure 2, the strand has no smearing. However, some deposits throughout the end made it brittle, so it fell apart without deformation.

Our investigation revealed that the homeowner or tenant cut the metal braids to cause the water loss or cover up another loss. While this case was a blatant example of altering the evidence, it took a relatively extensive investigation to determine the cause. The SEM made it much easier to identify alterations in the proof because it wasn’t apparent at first glance.

Case study 2: Isolation Valve

Figure 4: The damaged isolation valve

A contractor was replacing the fan coil unit when water discharged from the isolation valve that is connected to it. The contractor, who reported the loss, claimed that he closed the valve, but there was no internal ball valve within. The investigation determined that the ball had been forcibly removed from the interior of the valve.

Figure 5: Observed damage to the internal threads on the valve’s ball.

Presumably, somebody used a pair of pliers or another tool to grab the valve and pull the ball out. Therefore, it was likely that the contractor dealing with this fan coil unit didn’t know what he was doing.

Figure 6: Evidence of other tool marks on the other side of the valve, which led to more suspicion.

There were two plausible scenarios in this case:

Insurance fraud

Case study 3: Fictional Leak

Figure 7: The area that allegedly sustained water damage.

A homeowner reported a water loss to the insurer, claiming that there had been flooding in an upper-floor bathroom. Additionally, the homeowner argued that water from the flooding flowed down and caused severe water damage to the basement. This was another case of a failed flex hose.

In his claim report, the homeowner said he had discovered the problem, shut off the water supply to the flex hose, and then replaced it. This is not an ideal scenario for insurers, adjusters, or solicitors. The insured would be expected to retain the failed hose for further inspection by an engineer. The insured claimed that he discarded the hose, which was cause for concern on our part.

Figure 8: A closeup of the area beneath the sink.

During the investigation, our experts saw few signs of an actual leak. In figure 8, the left-hand photo shows that everything was perfectly dry under the sink, which is inconsistent with a leak. In addition, there was no expansion or buckling of the wooden cabinetry on the tiled floor next to the sink. Had the leak been real, there would be signs of some water influx into the cabinetry in the joints.

Figure 9: The bathroom floor, showing no sign of damage (left) and the inside of the floor register, filled with dust and construction debris (right).

As shown in figure 9, there was no evidence of moisture in any part of the bathroom floor. This confirmed that there was no leak in the area, especially one that could potentially reach the basement floor.

Figure 10: The ceiling space (left) and the kitchen downstairs (right)

None of the areas in figure 10 had evidence of water infiltration either. The chandelier was significantly dusty, indicating that it had not come into contact with water. The basement flooring and baseboards had already been removed when the investigators arrived.

Figure 11: The chandelier (left) and the basement floor (right).

Contrary to the evidence, the basement may have suffered water damage at some point. Presumably, there was water damage somewhere in the basement and the insured attempted to cover it up as a flex hose failure. Another possibility is that it was a blatant attempt to make a false claim after they’d already removed the flooring and baseboards. Further investigation also showed that there was no real evidence of a water loss upstairs.

Case study 4: Freezing

Figure 12: The disconnected thermostat (left) and its internal mechanism (right).

This loss occurred in a seasonal home when the insureds were not present. They discovered a water loss that led to a freeze-up. The homeowners claimed that the furnace had malfunctioned, causing the house to get too cold and freezing the pipes.

By the time experts arrived to inspect the scene, the insured had disconnected the furnace and moved it out of the area. Unfortunately, they had also disconnected the thermostat, making it impossible to pull any history from it. As such, there was no way to investigate the temperature setting at the time of the loss.

After inspection of the furnace, the investigator determined that it worked perfectly. It was bone dry inside, and there was no evidence of malfunction or water damage, which you would typically expect in a freeze-up.

Figure 13: The inside of the furnace.

The furnace is typically in the house’s basement, where the water collects. Any water coming down from floor registers will make its way into the furnace, and you’d expect to see some water damage there. In this case, it was bone dry and perfectly functional. While there was no specific evidence because the thermostat was not available for detailed testing, investigators couldn’t determine whether the insured had turned the thermostat off, set it to an absurdly low temperature, or just flipped a switch and turned the furnace off. There was no evidence to suggest that the furnace shouldn’t function.

Case study 5: Freezing II

Figure 14: A bathroom wall has been taken apart to show the pipes.

A homeowner claimed that there had been a freeze-up that led to a pipe burst, causing several water issues. Only one fitting appeared to have been impacted by the loss, which was suspicious. The freeze-up didn’t seem to affect anything else, which was unusual, especially given this is an interior wall. In typical freeze-ups of this nature, the whole house would get so cold that more components would be affected.

Our extensive examination determined that the fitting had been cut and re-set in place without being properly connected. So, when the water pressure increased, the fitting flew open on its own and caused the flood.

These cases are merely examples of water fraud investigations. While these are the most common, they are not a comprehensive list of water losses that occur regularly.

We encounter both legitimate and fraudulent break (B&E) incidents. Therefore, one needs to investigate these instances to confirm the kind of B&E case in each claim.

Reasons for B&E claims

During B&E investigations, alarm systems and CCTV video footage can be used to extract information. These could provide information regarding the timing of an incident, at the very least. They might show general business operation trends, how the property is typically protected when vacant, or who typically has access to the premises.

More sophisticated CCTV equipment can be tied to a point-of-sale (POS) system. These are better known as video and transaction matching. Systems this sophisticated allow point-of-sales transactions to be automatically matched with surveillance video. Essentially, the surveillance video image is a bookmark of the time when an event or a transaction occurred. This could be an additional avenue in adjusting claims.

These advancements in technology have significantly improved the investigative process. For example, an alarm system and video images could provide information about who, how, and when someone entered a building. An alarm system could also provide information that may confirm coverage under a policy. Both systems could corroborate that an incident did take place.

POS systems

Figure 1: A screenshot of a POS system matched to the video equipment.

Figure 1 shows a cash register of a fast-food outlet. This system tells you what was purchased and how it was paid for. It provides a wealth of knowledge that is beyond invaluable during investigations.

Where to find video evidence

We can obtain information from video equipment installed on the property and outside a building. Information can also be obtained from cameras installed next door if the neighboring building has video equipment outside. Doorbell cameras across the road from the property can also help greatly.

Dash cams usually operate when a car is in motion. However, some will continue to record while the vehicle is parked. Therefore, you could get vital information if you asked a neighbor about their dash cams. In addition, social media outlets such as YouTube and Instagram could also be a wealth of knowledge.

General red flags relating to alarm systems and video systems

1. An alarm or CCTV system is tampered with

Communication lines can be cut outside or inside the building. These phone lines are used for the alarm system to communicate with a remote monitoring station. Therefore, investigating these could help determine if the landlines were tampered with.

Cell services utilized by alarm systems can also be blocked with a jamming device. These devices are cheap and readily available for purchase. As such, spending time to investigate this possibility may help deal with the client.

2. Motion detector or camera operation hindered by unusual placement of contents

Placing or piling contents against motion detectors can indicate foul play because it renders the devices ineffective. In these cases, the insured may place a floor-to-ceiling product in front of a motion detector to hinder its operation. But, again, this can be done before the incident happens.

3. Door contact hardware was repeatedly defective

Defective hardware in the property entrances enables intruders or the insured to open the door without triggering an alarm system.

4. By-passing of specific alarm zones

People familiar with a property can bypass zones so that their presence in these areas is indetectable by an alarm system. Even when the alarm system is armed, it won’t be triggered in these scenarios. You need to investigate that because telltale signs can be found to suggest that zones have been bypassed moments or days before an incident.

5. Smash and grab

This refers to the suggestion of someone breaking into the property, rushing to the location of an alarm to smash the alarm panel off the wall, and defeating its operation before the entry delay sequence of the alarm system has elapsed. This prevents the alarm panel from communicating with a monitoring station.

Questions to ask in smash and grab scenarios

How is the location of the alarm panel known to the perpetrator?

These possibilities can only be confirmed if time is taken to investigate the alarm system following the incident, assuming that the perpetrators left behind the alarm panel.

6. The alarm panel is removed

Occasionally, the alarm panel is removed from the building during the break. Therefore, an adjuster must consider the potential reasons for removing the alarm panel. The same goes for removing a digital video recorder or a network video recorder during the break-in. One must question if the removal of this equipment is meant to hide the perpetrator’s identity and investigate accordingly. In addition, some alarm systems have varying time delay entries. For instance, it may take 30 seconds for an alarm to go off after admission or longer. Perpetrators familiar with the property often remove the alarm panel within this time delay.

Questions to ask
7. Weaving a story

The suggestion of an alarm system and CCTV system not working during the incident is another red flag. For example, an alarm company may get phone calls about the alarm system not working on the days leading up to a B&E. This could either be a setup or a genuine concern from the owner. However, a further investigation is required because it may allow for subrogation potential against the alarm company to be assessed. A detailed study also helps the adjustor determine if they can confirm coverage on the policy relating to the alarm warranty.

The same trend can be seen with security cameras. They are reported as malfunctioning and then get turned off. The homeowner may sometimes suggest that the digital video recorder was not operational. Others might claim that they don’t use their video equipment to record. Instead, they only use it to watch the screen. This is always odd and calls for further research during investigations.

Case study 1: Personal lines – fire incident

Figure 2: A large house that experienced a fire.

A fire was discovered at approximately 02:00 pm on August 27, 2009. The family had left for Niagara Falls at 11:30 am. The son-in-law stayed with them at the house but left the property at 10:45 am on the same day.

The house was reportedly locked and secured. An alarm system was installed but was not running or set. There was video equipment installed, but they claimed it was not functional. The DVR was thought to have not yet been set up by the installation company.

The son-in-law claimed he would use the cameras to watch the front door from his TV when the doorbell rang. During a discussion with the son-in-law, he indicated that he had issues with some people in the past. However, there was no telling if he was weaving a story. Therefore, we obtained authorization to enter the scene and investigate.

Figure 3: A photograph of the front door.

The stairs in the front hallway leading up to the second level showed evidence of substantial fire damage.

Figure 4: A close-up of the front door.

As shown in figure 4, there was also some physical evidence of the door having been kicked in.

Figure 5: A photograph of a portion of the house.

We brought in our canine unit and had two dogs search the home. We searched all three levels of the house and found several areas of origin. Our dogs both hit on several places in the basement, the main level, and the upper level. Fire debris samples were collected and sent to a lab for chemical analysis. The samples showed evidence of the presence of gasoline. There was also evidence of forced entry.

Based on the fire investigation, it was quite evident that this was an incendiary fire. More fire debris was found in the basement, more so than in other levels of the home. In addition, a DVR digital video recorder was also partially submerged in water. This DVR was connected to several cameras. Despite the owner’s claim that it was not operational, we decided to secure the DVR and investigate further.

Interestingly, police authorities and the Ontario Fire Marshal’s Office conducted the investigation ahead of our attending the site. However, as they were told that the DVR was not functional, they did not secure it as evidence, giving us the potential to obtain some interesting information on the video images.

Figure 6: A screenshot obtained from the video.

One of the videos we obtained from the DVR showed someone coming in and out of the house. The person was trying to kick out the door. He picked up a brick and tried to smack the door. Eventually, he fell right into the house. This person created the conditions to show that the front door was forced open. The video showed that the person lit a piece of paper and threw it into the front door.

Figure 7: Another screenshot from the video shows the fire department’s arrival.

As the fire department arrived, smoke came out of the house’s front door in the DVR footage. We discovered that the individual breaking into the house and setting the fire in the video images was the son-in-law. We reported this information to the police, who then secured the video images from us. They used these images to charge the individual with arson.

Case study 2: Commercial lines – B&E incident

Figure 8: The commercial property.

This incident was reported to the insurance company as a B&E with items vandalized and products removed or stolen. The insured said he left the building at the end of the workday on February 16, 2018. He was alone and did not arm the alarm system before leaving the premises. He claimed that he often did not arm the alarm system when he expected an employee to come in after hours. All employees and cleaners had their alarm code, so we could tell who disarmed or armed the alarm system.

Cleaners arrived at the building on February 18 and discovered the business had been robbed and vandalized. The owner suggested that the rear door would occasionally not engage or latch shut to the panic bar. Further, he said a gap at the top of the door could allow someone to pry it open. It was, therefore, upon us to determine if this information was being set up to justify that a break-in, whether legitimate or not, had occurred.

Figure 9: The inside surface of the door latched onto the panic bar.

Contrary to the owner’s statement, the door had contact with the panic bar and did not indicate a malfunction. The door formed part of the alarm system.

Figure 10: The alarm system.

All doors were contacted. There were motion detectors within the building and in various areas, including both offices, the warehouse, and the storage and workshop areas. Part of the investigation involved confirming if the door could be open from the outside, given that the panic bar reportedly did not latch properly.

Figure 11: Scuff marks observed on the door.

We looked for pry marks that might indicate that someone had gained entry into the building. We saw some scuff marks, but nothing that would suggest that someone pried the door open. So, there was no clear evidence of someone forcing their way into the building.

Figure 12: A photograph of some of the equipment installed within the commercial property.

There was graffiti on the equipment inside the building and evidence of the place either being burglarized or products being removed from the building. This turned out to be a red flag, mainly because the alarm system was not armed on the day of the incident.

When we interviewed some of the employees, we discovered that the owner always armed the alarm system when they left with him at the end of the business day, which was daily. They always saw him arm the alarm system, but he didn’t that day. Cleaners also confirmed that the alarm system was typically armed when they arrived to conduct their cleaning duties.

The alarm investigation

To corroborate or dispute the information relating to the activation of the alarm system, we reviewed and analyzed its information. In addition, we obtained a detailed report from the alarm company.

The three months of historical Alarm System Monitoring Station reports showed that the alarm system was always armed over a weekend. Getting a few months of records to show the trends and habits relating to the alarm system usage is essential. Unfortunately, alarm reports of the day of the incidents are often of little value to the investigation.

We also downloaded the event buffer from the alarm panel to corroborate information from the monitoring station report. An event buffer stores information relating to the activities of the alarm system. We accessed and analyzed data in the panel with the information transmitted in the monitoring station. This is especially important when there is an issue with communication lines and the cellular service being interrupted.

When phone lines are cut, or communications defected, one can usually rely on stored information within the event buffer. There are many instances where alarm systems are not programmed to transmit when they are armed or disarmed. So, you can rely on the event buffer to determine whether an alarm system was armed, when, or who armed the alarm system.

The event buffer will typically have more information than perhaps the monitoring station. However, one must rely on both sources of information. It’s equally critical to obtain this information promptly. Otherwise, you risk essential information being overwritten within the event buffer. Event buffers act as a first-in, first-out queue, meaning older information is deleted to make way for new data.

In this instance, we tested the alarm system to confirm that any entry through one of the exterior doors would result in alarm activation and an annunciation to the monitoring station. First, we armed the procedure several times and simulated entering the building. Next, we opened the exterior doors and walked through several areas where items appeared to be vandalized or removed to see how the alarm system would operate. We also checked if signals were transmitted to the monitoring station.

This test revealed that the system had been armed and would have functioned as intended. In other words, someone gaining access into the building through that door would have triggered a door contact and several motion detectors within the building. The incident only went unnoticed by the monitoring station because the alarm was not armed. Consideration at that point would be given regarding the coverage based on the fact that the alarm system was not armed at the time.

Lessons learned

The biggest lesson, in this case, was the importance of downloading the event buffer promptly. The alarm company can facilitate this by doing the manual download at the premise or through a remote online access feature. So, one should ensure that the alarm company cooperates and that one of their technicians attends the scene. If phone lines are still operational, an alarm company technician is not required at the location; they can retrieve the information directly from the buffer.

If the alarm company is not cooperating, the alarm panel must be powered down to avoid losing vital information from the event buffer. When the alarm panel is powered down, data in the system will not be overwritten.

The same goes for security cameras, digital video recorders, and network video recorders. Video images can be overwritten in time. So, acting quickly will preserve substantial evidence and information.