SUPPORT ANNEX 12 TO SECTION III

SAMPLING AND EVIDENCE COLLECTION

1. Scope. This annex addresses the collection, transport, and analysis of
samples for agent identification and forensic evidence following a CBRNE
event. The scope encompasses procedures that will ensure adherence to all
applicable safety, scientific, and law enforcement aspects of the process.
2. Support Area Overview. The Southeast Region shall adopt a common sampling
and evidence collection procedure. Collection of CBRNE forensic evidence at
crime scenes related to acts of terrorism is different from investigating
crimes involving illegal disposal or release of hazardous substances.
Sampling protocols commonly used by regulatory agencies (EPA, OSHA) or
military field units (U.S. Army Technical Escort Units or Preventative
Medicine Units) may not always be sufficiently rigorous to withstand legal
challenges in a court of law. Terrorists may employ techniques in the
dissemination of CBRNE agents that demand a higher degree of quality
assurance and quality control (QA/QC) to ensure the integrity of evidence
collected. In any CBRNE event, the primary focus of the response will be
human safety and health. The Incident Commander is responsible for the
safety of all personnel at the incident scene and must ensure proper
employment of PPE during all phases of the incident response, including
evidence collection and crime scene investigation. Refer to Annex E for
guidance on the use of PPE.
3. General Guidance. The following guidance is provided for NAS Pensacola
supporting Navy Region Southeast:
a. Crime Scene Preservation. Once human casualties are extracted and the
hazard is contained, the site is transitioned to a crime scene.
Investigation at the crime scene must precede any effort to decontaminate
equipment or facilities in the potentially contaminated area. If the
incident scene includes areas inside buildings, the area(s) suspected of
contamination must be isolated. Isolation will include shutting down
heating, ventilation, and air-conditioning (HVAC) systems and closing doors
and windows while sampling is performed.
(1) Sampling must be performed as soon as possible because many CB
agents are subject to rapid degradation. Volatile organic chemicals may
dissipate very quickly, leaving small traces or degradation products that may
not be easily traced to the original agent. Blood agents like hydrogen
cyanide (HC) or cyanogen chloride (CK) are highly volatile and will dissipate
within seconds. Agents of biological origin are highly sensitive to heat and
sunlight, while many agents are sensitive to humidity and hydrolytic
degradation. An agents persistence in the atmosphere and its ability to be
detected will be a function of its purity. Many terrorist states and groups
are known to produce weapons that contain only a small fraction of the agent,
with the rest being extraneous material. The higher the level of extraneous
material in the agent, the more rapidly it will degrade and the more
difficult it will be to detect, collect, and preserve as evidence.
(2) In order to identify the components of pure or mixed cocktails
of suspected agents, appropriate preservation techniques and rapid transfer
of the suspected contaminated items to a confirmatory laboratory are
necessary. Two key preservation methods include placing suspected chemically
or biologically contaminated items in sterile, airtight containers and
avoiding extremes in storage conditions.
III-12-1

NASPNCLAINST 3440.4B
b. Field Screening. Samples will be screened in the field to determine
the classification of the CBRNE agent. Screening must be performed prior to
transporting materials to a laboratory for confirmatory analysis.
(1) HAZMAT/EOD teams normally collect initial screening samples for
presumptive analysis/agent identification as well as to rule out safety
hazards, including volatile organic, flammable, corrosive, radioactive, and
explosive material. Collect only what is needed for agent identification.
Presumptive identification is used to determine the appropriate containment
as well as the final destination/disposition of the sample.
(2) A distinction exists between collecting evidence for public safety
verses criminal prosecution. In some instances, there may be an overriding
need by authorities to identify the agents or materials as soon as possible
to ensure the proper response is implemented. In this case, the need for
rapid collection and testing outweighs the normal evidence collection
procedures.
c. Evidence Collection and Documentation Procedures. Law Enforcement
personnel should perform formal collection of physical evidence. FBI
Evidence Recovery Teams and the FBI Hazardous Material Response Unit (HMRU)
handle the collection of forensic evidence from a contaminated crime scene.
(1) Collection prioritization should be in the order of Agent or
device/munitions, Environmental samples within the vicinity of event, and
Biomedical samples.
(2) When possible, a sample blank, or control environmental sample,
should be collected to compare to the contaminated evidence. The matrix of
the control samples should be similar to and within the vicinity of the
contaminated samples. Response forces must consider that decontaminating
evidence may subsequently destroy and/or contaminate critical components of
the criminal investigation. This concern may preclude decontaminating
evidence on the scene to facilitate collection and processing.
(3) To minimize crime scene disturbance, utilize passive evidence
collection procedures whenever possible. The objective of passive evidence
collection is to minimize human activity in the crime scene area. Examples
of passive evidence collection include using DFUs for air sampling.
(4) Collect the evidence as quickly as possible. A general rule of
thumb is to complete all evidence collection within the first 2 hours after
the event.
(5) Note and document the time it takes to collect the evidence, bag
it, label it, and get it to a laboratory for analysis. Keep in mind that
even after a sample is bagged, it may still undergo degradation.
(6) Whenever possible, sterilize all sampling equipment or utilize
pre-packaged sterile equipment. Microbial contamination of sampling
instruments can compromise both biological and chemical contents. (Note:
conventional cleaning techniques such as ethylene oxide will clean and
disinfect instruments but will not remove DNA.)

III-12-2

NASPNCLAINST 3440.4B
(7) Duties of the sampling personnel employed will depend on the
specific circumstances at the incident scene. Techniques used and the types
of samples collected will depend on factors such as the type and quantities
of CBRNE agents present, the deposition of agents, and the sampling equipment
available. See Tab A of this annex on standard operating procedures.
(8) Every effort should be made to ensure the safety of the evidence
collection personnel. All PPE used during evidence recovery operations
should be kept at the lowest level necessary in order to facilitate the
operation. High levels of personal protection (e.g., fully encapsulated
suits and self-contained breathing apparatus) may hinder the evidence
collection process.
(9) Suspected contaminated items must be handled in such a way that
evidence is not lost. For example, ceiling tiles and carpeting that are
removed for sampling must be removed with care and without excessive jostling
of the sample.
(10) Selection of swabs, wipes, and gloves will be critical. Natural
fiber swabs, wipes, gloves, or other PPE should not be used. Unpowdered
rubber gloves should be used. Natural fibers absorb agents, produce lint,
and tend to cling to agents. Permanent markers may also affect evidence and
should be avoided on interior containers. Wipes will be the most effective
for situations where small quantities of agent(s) are suspected of being
dispersed over a wide area. Sample collection using a HEPA filter vacuum
cleaner will also be effective under these circumstances for biological
particulates.
(11) HVAC filters may contain agent deposition and must be sampled.
There may be very little or no agent deposition in the HVAC system, depending
on the method of dispersal. Airborne contaminant collection is difficult to
carry out in a manner that produces legally defensible evidence. Aerosol
sampling is important because it provides a potential link between the
forensic analysis of the dispersal, the contaminated item, and dermal and
clinical (human tissue, hair, fluids) samples. Surfaces should be sampled
with wipes in conjunction with aerosol sampling.
(12) Walls, floors, furniture, and ceilings suspected of being
contaminated should be covered with plastic to contain agents adhering to
them and to minimize reaerosolization or offgassing.
(13) Medical surveillance of casualties will potentially provide the
most significant evidence. Medical surveillance will include visual
monitoring, photographing, videotaping, and general examination of personnel.
(14) Video cameras can provide critical information regarding specific
symptoms experienced by the victims during the attack. Videotaping will also
document the TTPs employed in the attack.
(15) The number of samples taken will depend on the potential area of
contamination, the different media that have potentially been contaminated,
and amount of time that is available to conduct sampling before the agent
dissipates or degrades. Swab sampling is generally most suited for small
spaces (e.g., computer keyboards). Wipe sampling done with a template should
be the forensic standard in order to meet quantification requirements.

III-12-3

NASPNCLAINST 3440.4B
(16) The evidence sampler should place the sample (e.g., a section of
carpet) in a sealable plastic bag with tamper evidence tape. Samples should
be triple contained. The original container (e.g., glass jar, paint can)
must be double bagged in accordance with U.S. Army Technical Escort (USATEU)
and U.S. Environmental Protection Agency Environmental Response Team
(USEPAERT) protocols.
(17) The Technical Support Working Group (TSWG) Weapons of Mass
Destruction Overpack should be considered for certain items that could
otherwise damage the container (e.g., sharp objects, jagged metal, or glass).
(18) Decontamination solutions used should also be sampled and saved
as test blanks for analysis later in the investigation. The run-off from the
decontamination operation should be sampled early in the operation to test
for suspected contamination.
d. Chain of Custody. Immediately establish a chain of custody over
samples once they are brought to the decontamination area. Chain of custody
requirements ensure the security of samples and prevents tampering. Failure
to properly maintain the chain of custody may prevent the evidence in
question from being introduced at trial.
(1) Develop a plan to ensure chain of custody rules are followed.
Each agent may have a different sampling protocol and a different chain of
custody protocol.
(2) Chain of Custody Forms (OPNAV 5580/22) and other written and
electronic documentation of the investigation need to employ a consistent
identification system. This can be a challenge when large numbers of
personnel and multiple organizations are involved and may have little or no
experience working together.
(3) Each chain of custody must be recorded with the date and time of
collection.
(4) The chain of custody documentation for suspected contaminated
items must have information that is appropriate to the hazard.
e. Sample Packaging and Transportation. Samples/Specimens must be
appropriately packaged, labeled, preserved, and transported to a laboratory
for confirmation. Ensure resources and materials are available to package,
label, and transport samples. Develop a checklist for personnel to follow.
The FBI should assist in the development of training on the procedures
necessary for this process. Ensure the chain of custody is maintained and
samples are placed in properly sealed containers to reduce the spread of
contamination. Package sample containers following hazardous materials
procedures. At a minimum, samples should be double bagged and over-packed in
a rugged container for transport. The outside of evidence collection
containers will be decontaminated prior to transport off site.

III-12-4

NASPNCLAINST 3440.4B
f. Transportation. Samples should be transported as environmentally
controlled as possible, avoiding extremes in storage conditions.
Requirements for transporting hazardous materials and/or infectious
substances are outlined in the Hazardous Materials Regulations (HMR) in 49
CFR Parts 171-180. The regulations apply to commercial transportation of all
hazardous materials. Transportation of these substances by a government
agency or the military in a vehicle operated by government or military
personnel is not subject to the HMR. Sample identification may be performed
by either mobile or fixed site laboratories including, but not limited to,
CDC/Public Health Laboratories, NMRC, DOD/DOJ forensic laboratories, EPA/DOE
Radiological Response Teams, BUMED-designated LRN laboratories, NEPMU-2,
NEPMU-5, and NEPMU-6. After the laboratory completes the analysis, the data
shall be turned over to military intelligence channels for further analysis
and dissemination.

III-12-5

NASPNCLAINST 3440.4B
TAB A TO SUPPORT ANNEX 12 TO SECTION III
STANDARD OPERATING PROCEDURE FOR CBRNE CRIME SCENES

Immediately upon arrival, the investigator will meet with the Incident
Commander to receive a full briefing on the events that occurred. The
investigator is to ascertain the following information and conduct the
following procedures:
1.

Ascertain names and current location of all witnesses and victims.

2. Ascertain types of all field tests conducted and the results of those
tests.
3. Ascertain the location of all victims personal effects and secure those
items as evidence.
4.

Conduct a briefing for all investigative team personnel.

5. Dispatch an interview team to interview all available witnesses and

victims.
6. Secure the area as a crime scene. Uniformed police personnel should staff
outer perimeter areas (safe areas). Radio communications should be
established with these units.
7. If personal effects have not been collected, the crime scene coordinator
must dispatch an investigative team to supervise the collection process
utilizing the following procedures (whenever possible, this should be
completed before any decontamination begins):
a. Place all victims personal effects into a large plastic bag.
should be used per victim.

One bag

b. Complete duplicate hazardous evidence recovery sheet and place one

copy into evidence bag.
c.

Seal evidence bag.

d. Take instant photograph of victims face and staple to second copy of

hazardous evidence recovery sheet.
e. Attach second copy of hazardous evidence recovery sheet to outside of
evidence bag.
8. Safety protocols for the hot zone investigation team must be established
by the Safety Officer.
9. Radio communications between the Crime Scene Coordinator, Hot Zone
Investigation Team, Safety Officer, and Emergency Backup Team is to be
established.
10. A minimum of two investigators will enter the hot zone. A corresponding
number of emergency backup personnel shall be standing by. The Hot Zone
Investigation Team shall have the following equipment with them:
II-12-6

NASPNCLAINST 3440.4B
a. Appropriate protective clothing based upon the suspected hazard in
situations of an unknown hazard; Level A is the appropriate protective
clothing.
b.

Steel-toed, chemical-proof boots.

c.

Appropriate protective gloves based on the suspected hazard.

d.

Several pairs of chemical-resistant gloves.

e.

A self-contained breathing apparatus with a full 60-minute air bottle.

f.

An aluminum (non-sparking) clipboard.

g.

A pen for crime-scene notes.

h. A bold marker for filling in sample point identification information

on the sampling placards.
i.

Several preprinted placards for sample-point identification.

j. Duct tape, magnetic clips or suction cup clips for attaching sampling
placards to flat surfaces.
k.

A lower explosive limit/oxygen meter (LEL/O 2).

l.

Radiological measurement instruments.

m.

A dosimeter.

n.

pH paper and a pH chart.

o.

Appropriate field testing unit for CB agents.

p.

A waterproof auto-focus camera with sealed electronic flash.

q.

A waterproof auto-focus video camera.

r.

Evidence bags of assorted sizes.

s.

A knife capable of cutting tape.

t.

A fingerprint kit.

u.

Communications equipment.

v.

Play (childrens) bubbles or dish soap (used to detect gaseous leaks).

w.

Measuring tape.

11. While inside the contaminated area, the Investigative Team should attempt
to complete the following evidence gathering tasks:
a. Photograph and videotape the entire undisturbed crime scene from all
angles.

III-12-7

NASPNCLAINST 3440.4B
b. Complete a radiological survey of the entire crime scene. The
radiological survey should begin at the outermost perimeter with continuous
readings being made up to the surface areas of any suspected devices or to
the point at which a 2mr (milli-rem) reading is obtained.
c. Complete a lower explosive limit (LEL) reading to determine if any
potentially flammable gases are present.
d. Field tests for the suspected CB substances should be conducted near
or at the suspected point of dispersal or detonation. Field tests results
must be recorded and maintained.
e. Determine if the material has been spilled or is leaking from the
device.
f. If required, conduct an immediate air sampling operation utilizing the
appropriate air sampling equipment.
g.

Note, photograph, and cast any footprints and/or tire tracks present.

h. Note, photograph, and lift any fingerprints found within the hot zone.
Special attention should be paid to bottom surfaces of any containers.
i. If drums and/or containers are present, photograph and record any U.S.
DOT information available.
j.

Photograph and record all markings on any containers.

k. Photograph and record all label information on the containers. If the

label is legible and can be removed intact, it should be recovered and placed
into an evidence bag.
l. The surrounding ground area is to be searched for any other physical
evidence. Any closed containers should be lifted and/or tilted so that their
undersides and the ground area underneath the containers may be examined for
possible physical evidence. Special attention must be given to the
possibility of encountering trip wires or other booby traps.
m. A sketch should be made of the entire crime scene, including the
position and location of each container and/or device. The crime scene
sketch should also include the location of any other physical evidence
recovered.
n. If the hazardous substance is in a container and in liquid form, it
should be physically examined using a sterilized coliwasa tube. Any material
stratification should be noted and reported to the sample team.
o. Each area, container, and/or device that has been selected for
sampling should be placarded and photographed. Binary devices must be
placarded for two samples. The sampling placard should contain, at a
minimum, the current date and the field sample number. If the container
and/or device appears to be empty, it should be placed into an airtight
container and seized as evidence.

III-12-8

NASPNCLAINST 3440.4B
12. Upon exiting the contaminated area and after decontamination requirements
have been met, samples of all decontaminant rinsate should be collected and
labeled. The rest of the rinsate should be handled and disposed of
appropriately as waste and the entire investigation team must attend the post
search briefing.
13. Radio communications should be established between the Sample Team, Safety
Officer, Crime Scene Coordinator, and Emergency Backup Team.
14. A two-person Sample Team (as opposed to an Investigation Team) shall enter
the contaminated area to collect the scientific evidence. A two-person
Emergency Backup Team must support the Sample Team.
15. Scientific evidence shall be collected using the appropriate sampling
protocol. Sampling protocols shall be determined based upon the type of
material present and its matrix.
16. After the Sample Team has exited the contaminated area and decontamination
procedures have been completed, all scientific evidence is to be sealed and
photographed. Samples should be triple contained. Sealed jars, paint cans,
or collection tubes serve as the primary containers. Evidence bags are often
used as secondary and tertiary containers. The outermost container is to be
decontaminated before transport.
a. Radiological evidence is to be inventoried and held for U.S. DOE
personnel.
b. CB evidence is to be inventoried, placed into a cooler, and stored at
the appropriate required temperature: Chemical Agents: 4C, Biological
Agents: 5C.
c. Biological evidence samples must be delivered to the appropriate
laboratory within 6 hours.
d. All other physical evidence collected at the crime scene should be
inventoried, photographed, and sealed.
e. Chain of custody paperwork must be completed for all evidence
collected at the crime scene.

III-12-9