Rod Ammon: Welcome to the CFITrainer.Net podcast. We open this episode with a quick update on the Australian bushfire season. As of the date this podcast was recorded, even though there have been recent heavy rains and cooler weather, more than 100 fires are still burning in Australia, principally in coastal New South Wales and Victoria. In addition, the area is now enduring massive dust storms, flash flooding, and golf ball sized hail. The forecast calls for fire danger to escalate in the coming weeks as drier weather moves in and temperatures rise. As of January 20, 2020 it is estimated that during the bushfire season, at least 28 people have been killed, 25.7 million acres have been burned, and 2,600 homes have been destroyed. IAAI continues to support the Australian Fire Service and asks you to join them by donating to the Australian Red Cross relief effort. You will find a link on this podcast page.

As we mentioned last month, our podcasts in 2020 will have a technology theme, and our first feature is a wild one. At this year's IAAI International Training Conference, which runs April 26 through May 1 in Las Vegas, there will be a seminar on how spoofing and masking technologies were used to frame an innocent mother and perpetrate an arson fraud. The course is presented by Shane Otto and Zach McCune. Mr. McCune, a partner in Rolfe’s Henry's Cincinnati office, and one of only a few attorneys to hold the IAAI-CFI certification, is with us today to preview this course and talk a little bit about the role of technology in the case. Zach, welcome to the podcast.

Zach McCune: Thanks for having me.

Rod Ammon: First, why don't you tell us a little bit about yourself and the expertise you've developed in the role of technology in fire investigation?

Zach McCune: Sure. So I am a partner in Rolfe’s Henry's Cincinnati office, and I've been with them for about 12 years now, and the one area of focus that I've had throughout the course of my practice, in addition to doing insurance fraud investigations with a heavy emphasis on fire and arson cases, is developing an expertise in cell phone and other technology-related matters.

So in terms of our firm, we assist insurance companies on fraud investigations all throughout the country. Then we also do a lot of fire science litigation all throughout the country. And one of the things that has developed in that area is from cell phone and computer technology, things that range from the Sellbrite technologies to cell phone tower data analysis, computer forensics, and kind of the interplay and the way that has been increasingly used in fraud over about the past 15 years. So I, within our firm, am kind of the go-to person in terms of that technology and the way that it might interact with a given case, and then utilizing different experts to help identify the different types of arsons or other fire science cases where something like that could come up.

Rod Ammon: I'm sure that your firm, as well as your clients, are thrilled that you carry this knowledge. So how did you become involved in this case?

Zach McCune: So this was a case that we assisted all state insurance with. So Shane Otto, who will be co-presenting with me, will be able to speak to more of the insurance side of how this works, but very early on, in certain arson cases, when an insurance company is involved, oftentimes our firm is the first call. So this was a fire where we got a call at some point during the first week after the fire, and the initial role that we were going to be playing, which drastically expanded, was just in terms of getting cell phone tower data records. So with a lot of arsons, one of the first steps from the insurance company's perspective is to get in motion a process where they can get different individuals' cell phone tower data records to attempt to look at locations, communications with witnesses near the time of the actual fire, but a lot of times at other relevant times in their investigation too. So on this claim, it actually started from that kind of discrete function and then drastically grew based upon some of the information that came up early in the investigation.

Rod Ammon: Set the scene for us. What are the basic facts of the case?

Zach McCune: Okay. So you have an arson fire that happens at a house in a rural community outside of Cincinnati, Ohio. The insured represents to the insurance company that he is staying at a hotel multiple hours away from the loss location, and almost immediately, one of the things that's very interesting about this fire is that surveillance on a residential fire has survived the fire. That's somewhat unique. Typically on a residential fire, it will burn up, and you won't have anything left in terms of a significant chunk of surveillance to look at. But here, for a very specific reason, it survived the fire, and the insured immediately started blaming the mother of one of his children as having committed the fire, and then pointing out all of these distinct characteristics of the person who was on the surveillance and basically representing that was the mother of one of his kids, and, "She's responsible for this. Lock her up for a long time. My insurance claim is legitimate."

So that set off the stage of, he has represented he has an alibi hours away, so cell phone tower data is relevant for that purpose. The mother obviously was located at a particular location the night of the fire, so we wanted to look at her cell phone tower data, and then it kind of took off from there. And one of the things that we hope will be helpful with this presentation is in addition to discussions of all of the technology that was involved in the spoofing and framing this particular woman was the communications via what are called immunity requests with law enforcement, that helped the investigation develop. We had a very good working relationship with law enforcement, and responding to their immunity requests, and the investigation grew and grew once information became available throughout that process. But again, it started with fire, rural area, insured is hours away, blames the ex, and then it took off from there.

Rod Ammon: Yeah. I was going to ask you to not give away too much and sort of tease what's going on, because we don't want to take away the seminar's thunder, but you seem to have set that up very well. Any other technologies that were used to frame someone else for the arson that you might want to talk about yet, or no?

Zach McCune: Without giving away too much and without giving away the order in which they were discovered, we will end up touching upon programs like TelTech and SpoofCard that can be used to fake cell phone communications. We will have heavy emphasis on fake social media accounts, including fake Facebook accounts, fake Google accounts, VPN communications, and the way that they can be used to fake communications, more traditional methods of faking or concealing what you're doing, fake debit cards. We had wigs, masks that were created based upon facial recognition technology, fake clothing.

And then in addition to identifying those, and kind of the order in which they came into play in this given case, we'll also talk about the difficulties or challenges that are sometimes faced in a civil investigation versus a criminal investigation, in terms of how you approach these technology groups to attempt to get information from them. So we'll go through what it's like to subpoena Google and Facebook and some of the bigger quote-unquote "big tech" companies in the civil context, when you're investigating insurance fraud, but there's obviously a potential criminal component to that if there is an arson that's the underlying event that triggered that.

And then some of the other companies, like the companies that make these masks, that can create wigs. I think we probably subpoenaed, I don't know, six or seven of the largest cell phone companies in the world, so what it's like to repeatedly come to them for their information, so we'll kind of go through the plethora of that. So those are main topic areas, without giving away too much of what actually happened in this given case,

Rod Ammon: You must have done this just right, because my head's burning. There's so much I want to hear from you. You talked a lot about all different kinds of technologies that were used, services that were used, the social media. What about, are you going to talk a little bit about technologies that were used as investigative tools?

Zach McCune: Yeah. We will jump into, in this case, and one of the things that I hope is also interesting for the audience is, what I would, say the panel of experts who were used in this case. So we had forensic accountants, we had computer experts, we had cell phone experts, we had cell phone tower data experts, which is different from the physical phone, the analysis of how phones are communicating with towers. We had fire origin and cause investigators. We had origin cause investigators who were doing fire debris sift analysis. So you had a whole wide range of them, and all of the expertise that they bring, and then their interaction with some of this technology, we use Sellbrite downloads on some of the phones, Oxygen downloads on some of the phones, and then there was the more traditional gathering of social media evidence, and how you investigate fake social media accounts, fake communications that one way or another would go through a cell phone. So the presentation will hit on all of that. The investigation involved all of that.

Rod Ammon: You know, you're on the same page as us, and you and I haven't met before and I'm sitting here going through some of my questions, and you went right into developing a team of expertise, so thank you for that, because that has often been an issue, whether it's a small or a large department or agency that's working into something. "How do you develop that team?"

So I guess one of the things that I do want to still get out of you is, as you're looking at a case like this, and as you did with this case or some other, what's the light bulb? What's the switch that makes you say, "Why do I need help?" How did you know you needed to reach out? And where can people reach out to get something like this started?

Zach McCune: Sure. Well, it obviously doesn't just happen, in this one case. Over years and years and years, our firm has developed relationships with different experts who are kind of go-to people in given areas. And then you look at whether you want someone close geographically to you, and we have a network of experts that we would use there, or whether you go somewhere national and pull someone in, and then it's a very fact-specific case by case basis of once a new item of evidence comes up, who the best person is to analyze that, get you back results quickly, work well with the other experts, and compliment what they do.

Just an example, a very odd pairing of experts that actually turned out to be incredibly interesting in this case, on some level pairing an analysis from a fire debris sift expert in comparison to a forensic accountant to essentially arrive at the same results, was just one of the ways that we paired that. So it's very fact specific, and as each individual item of evidence comes up, there's a very quick call that goes out to someone, and they're on to assist you throughout the rest of the case.

Rod Ammon: You bring up a couple of good points there, obviously. You know the one that we've talked about with so many different experts who do this well is building these relationships early. Not exchanging the business card, as they say, for the first time at the scene. And that's nice to hear. There's a lot going on here. How long is this class? What's the session like?

Zach McCune: This presentation, I believe we're slotted for four hours, which seems long, but with the facts of this case, I think people will kind of be on their toes. That's actually a somewhat brief period of time to hit on all of the topics that came up in this case. So I think it will be very, very interesting. People will be engaged throughout, and the way that the presentation is set up, because it's in many ways the exact same way that the investigation developed, so again, we got that initial call just about doing cell phone tower data analysis, and then ended up in a case that lasted two and a half to three years, unbelievably long court filings that related to the events underlying the case.

So it kind of builds on itself, on some level, a little bit like a mystery that's being solved, especially when that way that the investigation developed, and it's the same way that the presentation is given. And it helps to explain identifying these issues with technology, how you go about investigating them, how you use your panel of experts, how you tie it in to the greater case or investigation that's going on, and then how you reach your end conclusion. So I think it fits well in that four-hour gap. It gives people enough time to sink their teeth into what was going on, to help identify some of this themselves. Some of the technology are things that the audience will kind of get a chance to watch themselves first and attempt to spot issues themselves, and then we'll come back to how it played into the overall investigation on how everything kind of tied together.

Rod Ammon: You know, it's interesting. Usually when people tell me how long a class is, I go like, "Wow, that's a lot. That's a lot of time." And in this case, when you said four hours, I was thinking a day or two. It sounds like a jam packed four hours to me.

Zach McCune: It absolutely is. It's tough to pare it down to a timeframe that's shorter than that. You could absolutely go longer delving into a lot of these individual topics, some of them, and more details of the case, but four hours is a pretty nice chunk of time, especially in one of these seminars, for hitting on all of these technology issues, telling the story of this case, and it'll make for a nice presentation segment.

Rod Ammon: And that's one of the beauties of being at ITC. Those people, after they get done with this, they're going to chase you to either the bar or the restaurant and try to get more. What have I missed?

Zach McCune: Not much, because I wouldn't want to, in a preliminary podcast segment, give away too much of what occurred here. I think when we've been able to hit on basic facts of the case, people maybe have a little sense of where it's going, and then the different types of technology that we'll be talking about throughout the case. So we basically got it.

Rod Ammon: Well, I feel the same way about being teased, because I'm looking forward to seeing it, and I think people have a lot to unpack from just what we've heard you tell us today. I appreciate you joining us, and all of you out there, you could check out this seminar and more than two dozen other ITC courses at iaaiitc.com. The early bird registration discount ends on February 1. Zach, thanks a lot for your time. I really appreciate it.

Zach McCune: Thank you so much.

Rod Ammon: We'll see you out there.

Zach McCune: Okay, thanks. Bye.

Rod Ammon: Here's a quick news item out of New Jersey that further illustrates the importance of technology and electronic evidence in fire investigation. On January 12, a fire destroyed several buildings in downtown Bound Brook, New Jersey. Initially the investigation was expected to last months, due to the devastation of the fire. However, only two days after the fire, law enforcement had a suspect in custody. Among the evidence investigators quickly uncovered were social media posts threatening to start a fire, allegedly made by the arsonist, and footage from multiple surveillance cameras that allowed them to track the suspect, who was wearing a distinctive shirt design, as he moved through the downtown area an hour or so before the fire began. He was seen on video entering and exiting a liquor store, then walking toward an apartment complex with something in his hand, and returning by the same path, moments later, just two minutes before the massive fire began. The suspect has been charged with arson and hindering an investigation. Dozens of people were displaced by the fire, which caused $52 million in damage.

We also have a new training opportunity to share with you. This month, CFITrainer.Net debuted a new online learning module, Introduction to Appliances. This module is a basic introduction to how many major appliances operate, covering components, explaining operation and heat generation, and describing common safety and thermal protection devices. It's a good foundation for further study in appliances as potential fire causes. The module includes applied examples and 3D animation. Check it out and earn your certificate of completion today.

This podcast and CFITrainer.Net are made possible by funding from a fire prevention and safety grant from the Assistance to Firefighters Grant Program administered by FEMA and the US Department of Homeland Security. There's also support from the Bureau of Alcohol, Tobacco, Firearms, and Explosives, and voluntary online donations from CFITrainer.Net users and podcast listeners.

Thanks for joining us today on the podcast. Stay safe out there. We'll see you next time. For the International Association of Arson Investigators and CFITrainer.Net, I'm Rod Ammon.

McGuirk, Rod. Dust storms, hail and flash floods batter Australian cities amid raging wildfires. 20 Jan 2020.

Donate to the Australian Red Cross' bushfire relief effort

2020 IAAI ITC. April 26 – May 1, 2020. Las Vegas, NV.

Kausch, Katie. Bound Brook man charged with arson in massive downtown fire. NJ.com. 14 Jan 2020.

Introduction to Appliances. CFITrainer.Net