Article Post

Understanding the Working of Break and Enter Investigations

May 14, 2022

We encounter both legitimate and fraudulent break and enter (B&E) incidents. Therefore, one needs to investigate these instances to confirm the kind of B&E case in each claim.

Reasons for B&E claims

Burglary
Setting a fire
Vandalism
Insurance fraud
Hiding a crime

During B&E investigations, alarm systems and CCTV video footage can be used to extract information. These could provide information regarding the timing of an incident, at the very least. They might show general business operation trends, how the property is typically protected when vacant, or who typically has access to the premises.

More sophisticated CCTV equipment can be tied to a point-of-sale (POS) system. These are better known as video and transaction matching. Systems this sophisticated allow point-of-sales transactions to be automatically matched with surveillance video. Essentially, the surveillance video image is a bookmark of the time when an event or transaction occurred; this could be an additional avenue in adjusting claims.

These advancements in technology have significantly improved the investigative process. For example, an alarm system and video images could provide information about who, how, and when someone entered a building. An alarm system could also provide information that may confirm coverage under a policy. Both systems could corroborate that an incident did take place.

POS systems

Figure 1: A screenshot of a POS system matched to the video equipment.

Figure 1 shows a cash register of a fast-food outlet. This system tells you what was purchased and how it was paid for. It provides a wealth of knowledge that is invaluable during investigations.

Where to find video evidence

We can obtain information from video equipment installed on the property and outside a building. Information can also be obtained from cameras installed next door if the neighbouring building has video equipment outside. Doorbell cameras across the road from the property can also help greatly.

Dash cams usually operate when a car is in motion. However, some will continue to record while the vehicle is parked. Therefore, you could get vital information if you asked a neighbour about their dash cams. In addition, social media outlets such as YouTube and Instagram could also be a wealth of knowledge.

General red flags relating to alarm systems and video systems

1. An alarm or CCTV system is tampered with

Communication lines can be cut outside or inside the building. These phone lines are used for the alarm system to communicate with a remote monitoring station. Therefore, investigating these could help determine if the landlines were tampered.

Cell services utilized by alarm systems can also be blocked with a jamming device. These devices are cheap and readily available for purchase. As such, spending time investigating this possibility may help deal with the client.

2. Motion detector or camera operation hindered by unusual placement of contents

Placing or piling contents against motion detectors can indicate foul play, rendering the devices ineffective. In these cases, the insured may place a floor-to-ceiling product in front of a motion detector to hinder its operation. But, again, this can be done before the incident happens.

3. Door contact hardware was repeatedly defective

Defective hardware in the property entrances enables intruders or the insured to open the door without triggering an alarm system.

4. By-passing of specific alarm zones

People familiar with a property can bypass zones so that their presence in these areas is undetectable by an alarm system. Even when the alarm system is armed, it won’t be triggered in these scenarios. It would be best if you investigated that because telltale signs can be found to suggest that zones have been bypassed moments or days before an incident.

5. Smash and grab

This refers to the suggestion of someone breaking into the property, rushing to the location of an alarm to smash the alarm panel off the wall, and defeating its operation before the entry delay sequence of the alarm system has elapsed. This prevents the alarm panel from communicating with a monitoring station.

Questions to ask in smash and grab scenarios

How is the location of the alarm panel known to the perpetrator?
Did they have inside information?
Is it reasonable for them to break in and make it to the location of the alarm panel in time to have it physically neutralized before it sends out signals?
Or did the perpetrators use a legitimate access code for the alarm system to gain entry? Did they disarm the system? And if so, how did they get access to the access code?
Are there other reasons why someone committing a smash and grab can avoid the alarm system activation?
Is there efficiency in the alarm system?
Is there a subrogation potential?

These possibilities can only be confirmed if time is taken to investigate the alarm system following the incident, assuming that the perpetrators left behind the alarm panel.

6. The alarm panel is removed

Occasionally, the alarm panel is removed from the building during the B&E. Therefore, an adjuster must consider the potential reasons for removing the alarm panel. The same goes for removing a digital video recorder or a network video recorder during the break-in. One must question if removing this equipment is meant to hide the perpetrator’s identity and investigate accordingly. In addition, some alarm systems have varying time delay entries. For instance, an alarm may take 30 seconds to go off after admission or longer. Perpetrators familiar with the property often remove the alarm panel within this time delay.

Questions to ask

How did the perpetrators know the location of the alarm panel?
How did they have enough time to remove it?

7. Weaving a story

The suggestion of an alarm system and CCTV system not working during the incident is another red flag. For example, an alarm company may get phone calls about the alarm system not working on the days leading up to a B&E. This could either be a setup or a genuine concern from the owner. However, a further investigation is required because it may allow for subrogation potential against the alarm company to be assessed. A detailed study also helps the adjuster determine if they can confirm coverage on the policy relating to the alarm warranty.

The same trend can be seen with security cameras; they are reported as malfunctioning and then turned off. The homeowner may sometimes suggest that the digital video recorder was not operational. Others might claim that they don’t use their video equipment to record. Instead, they only use it to watch the screen. This is always odd and calls for further research during investigations.

Case study 1: Personal lines – fire incident

Figure 2: A large house that experienced a fire.

A fire was discovered at approximately 02:00 pm on August 27, 2009. The family had left for Niagara Falls at 11:30 am. The son-in-law stayed with them at the house but left the property at 10:45 am on the same day.

The house was reportedly locked and secured. An alarm system was installed but was not running or set. There was video equipment installed, but they claimed it was not functional. The DVR was thought to have not yet been set up by the installation company.

The son-in-law claimed he would use the cameras to watch the front door from his TV when the doorbell rang. During a discussion with the son-in-law, he indicated that he had issues with some people in the past. However, there was no telling if he was weaving a story. Therefore, we obtained authorization to enter the scene and investigate.

Figure 3: A photograph of the front door.

The stairs in the front hallway leading up to the second level showed evidence of substantial fire damage.

Figure 4: A close-up of the front door.

As shown in figure 4, there was also some physical evidence of the door having been kicked in.

Figure 5: A photograph of a portion of the house.

We brought in our canine unit and had two dogs search the home. We searched all three levels of the house and found several areas of origin. Our dogs both hit on several places in the basement, the main level and the upper level. Fire debris samples were collected and sent to a lab for chemical analysis. The samples showed evidence of the presence of gasoline. There was also evidence of forced entry.

Based on the fire investigation, it was pretty evident that this was an incendiary fire. More fire debris was found in the basement than in other levels of the home. In addition, a DVR digital video recorder was also partially submerged in water. This DVR was connected to several cameras. Despite the owner’s claim that it was not operational, we decided to secure the DVR and investigate further.

Interestingly, police authorities and the Ontario Fire Marshal’s Office conducted the investigation ahead of our attending the site. However, as they were told that the DVR was not functional, they did not secure it as evidence, giving us the potential to obtain some interesting information on the video images.

Figure 6: A screenshot obtained from the video.

One of the videos we obtained from the DVR showed someone coming in and out of the house. The person was trying to kick out the door. He picked up a brick and tried to smack the door. Eventually, he fell right into the house. This person created the conditions to show that the front door was forced open. The video showed that the person lit a piece of paper and threw it into the front door.

Figure 7: Another screenshot from the video shows the fire department’s arrival.

As the fire department arrived, smoke came out of the house’s front door in the DVR footage. We discovered that the individual breaking into the house and setting the fire in the video images was the son-in-law. We reported this information to the police, who then secured the video images from us. They used these images to charge the individual with arson.

Case study 2: Commercial lines – B&E incident

Figure 8: The commercial property.

This incident was reported to the insurance company as a B&E with items vandalized and products removed or stolen. The insured said he left the building at the end of the workday on February 16, 2018. He was alone and did not arm the alarm system before leaving the premises. He claimed that he often did not arm the alarm system when he expected an employee to come in after hours. All employees and cleaners had their alarm codes, so we could tell who disarmed or armed the alarm system.

Cleaners arrived at the building on February 18 and discovered the business had been robbed and vandalized. The owner suggested that the rear door would occasionally not engage or latch shut to the panic bar. Further, he said a gap at the top of the door could allow someone to pry it open. It was, therefore, upon us to determine if this information was being set up to justify that a break-in, whether legitimate or not, had occurred.

Figure 9: The inside surface of the door latched onto the panic bar.

Contrary to the owner’s statement, the door had contact with the panic bar and did not indicate a malfunction. The door formed part of the alarm system.

Figure 10: The alarm system.

All doors were contacted. There were motion detectors within the building and in various areas, including both offices, the warehouse, and the storage and workshop areas. Part of the investigation involved confirming if the door could be open from the outside, given that the panic bar reportedly did not latch properly.

Figure 11: Scuff marks observed on the door.

We looked for pry marks that might indicate that someone had gained entry into the building. We saw some scuff marks, but nothing that would suggest that someone pried the door open. So, there was no clear evidence of someone forcing their way into the building.

Figure 12: A photograph of some of the equipment installed within the commercial property.

There was graffiti on the equipment inside the building and evidence of the place either being burglarized or products being removed from the building. This turned out to be a red flag, mainly because the alarm system was not armed on the day of the incident.

When we interviewed some of the employees, we discovered that the owner always armed the alarm system when they left with him at the end of the business day, which was daily. They always saw him arm the alarm system, but he didn’t that day. Cleaners also confirmed that the alarm system was typically armed when they arrived to conduct their cleaning duties.

The alarm investigation

To corroborate or dispute the information relating to the activation of the alarm system, we reviewed and analyzed its information. In addition, we obtained a detailed report from the alarm company.

The three months of historical Alarm System Monitoring Station reports showed that the alarm system was always armed over a weekend. Getting a few months of records to show the trends and habits relating to alarm system usage is essential. Unfortunately, alarm reports of the day of the incidents are often of little value to the investigation.

An event buffer stores information relating to the activities of the alarm system. We accessed and analyzed data in the panel with the information transmitted in the monitoring station. We also downloaded the event buffer from the alarm panel to corroborate information from the monitoring station report. This is especially important when there is an issue with communication lines and the cellular service being interrupted.

When phone lines are cut or communications have defected, one can usually rely on stored information within the event buffer. There are many instances where alarm systems are not programmed to transmit when armed or disarmed. So, you can rely on the event buffer to determine whether an alarm system was armed, when, or who armed the alarm system.

Event buffers act as a first-in, first-out queue, meaning older information is deleted to make way for new data. The event buffer will typically have more information than perhaps the monitoring station. However, one must rely on both sources of information. It’s equally critical to obtain this information promptly. Otherwise, you risk essential information being overwritten within the event buffer.

In this instance, we tested the alarm system to confirm that any entry through one of the exterior doors would result in alarm activation and communication to the monitoring station. First, we armed the alarm system and simulated the system by entering the building several times. Next, we opened the exterior doors and walked through several areas where items appeared to be vandalized or removed to see how the alarm system would operate. We also checked if signals were transmitted to the monitoring station.

This test revealed that if the system had been armed and would have functioned as intended. In other words, someone gaining access into the building through that door would have triggered a door contact and several motion detectors within the building. The incident only went unnoticed by the monitoring station because the alarm was not armed. Consideration at that point would be given regarding the coverage based on the fact that the alarm system was not armed at the time.

Lessons learned

The biggest lesson, in this case, was the importance of downloading the event buffer promptly. The alarm company can facilitate this by doing the manual download at the premise or through a remote online access feature. If phone lines are still operational, an alarm company technician is not required at the location; they can retrieve the information directly from the buffer. So, one should ensure that the alarm company cooperates and that one of their technicians attends the scene.

If the alarm company is not cooperating, the alarm panel must be powered down to avoid losing vital information from the event buffer. When the alarm panel is powered down, data in the system will not be overwritten.

Video images can be overwritten in time. So, acting quickly will preserve substantial evidence and information. The same goes for security cameras, digital video recorders, and network video recorders.