Practice with national-level exam (FACT, FACT Plus, NET, CUET, etc.) mocks, learn from structured notes, and get your doubts solved in one place.
The improvised-explosive chemistry behind the modern IED threat: TATP (triacetone triperoxide) in the 2005 London 7/7 attacks, the 2015 Paris and 2016 Brussels bombings, and the 2017 Manchester Arena attack; ANFO (ammonium nitrate fuel oil) and the Oklahoma City 1995 and Beirut port 2020 detonations; urea nitrate in the 1993 WTC bombing; the precursor-scheduling response (EU Regulation 2019/1148, US Ammonium Nitrate Security Program); and the peroxide-explosive detection workflow.
Last updated:
The transition from military and commercial high explosives to improvised formulations is one of the defining shifts in terrorism forensics since the 1990s. Conventional high explosives such as RDX, PETN, and TNT are manufactured in controlled facilities, subject to strict regulation and tracking, and difficult to acquire outside of military or commercial supply chains. Improvised explosives, by contrast, are made from precursors available in hardware stores, agricultural cooperatives, beauty supply shops, and online retailers.
Three improvised formulations have dominated global IED casework from the 1993 World Trade Center bombing to the 2020 Beirut port explosion: ANFO (ammonium nitrate fuel oil), urea nitrate, and TATP (triacetone triperoxide). These three explosives share no chemistry with each other. ANFO is an inorganic oxidiser-fuel mixture. Urea nitrate is an organic salt. TATP is a cyclic peroxide. They require completely different analytical approaches: ion chromatography for ANFO, ion chromatography plus LC-MS/MS for urea nitrate, and exclusively LC-MS/MS or dedicated peroxide-specific methods for TATP, because TATP has no nitro groups and is essentially invisible to the electron capture detection and spectroscopic methods calibrated for conventional military high explosives.
Understanding the chemistry of these three improvised formulations is inseparable from understanding the precursor-regulation frameworks that attempt to limit their production: the EU Explosive Precursors Regulation 2019/1148, the US Ammonium Nitrate Security Program under the Safe Explosives Act 2002, India's Ammonium Nitrate Rules 2012 under the Explosives Act, and the UK's Precursor and Poisons Act 2022. These frameworks map directly onto the forensic attribution question: when post-blast analysis identifies TATP or ANFO or urea nitrate, the investigation moves to precursor tracing.
TATP is sometimes called the Mother of Satan, a name with a specific origin: Palestinian bomb-makers in the 1980s used it as a slang term for the frothy, unstable, explosive paste that could spontaneously detonate during preparation. The name has outlived its origin and is now in the technical vocabulary of every forensic explosives laboratory in the world.
Triacetone triperoxide (TATP, systematically 3,3,6,6,9,9-hexamethyl-1,2,4,5,7,8-hexaoxacyclononane) is synthesised by the condensation of acetone with hydrogen peroxide in the presence of an acid catalyst. The reaction is:
Test yourself on Forensic Chemistry with free, timed mocks.
Practice Forensic Chemistry questions3 CH3COCH3 + 3 H2O2 produces TATP + 3 H2O (in the presence of mineral acid catalyst)
In practice, concentrated hydrogen peroxide (30-50% aqueous) is added to acetone in the presence of a catalyst such as sulphuric acid, hydrochloric acid, or citric acid, at temperatures controlled below approximately 10°C. Above 10°C the reaction becomes difficult to control and the temperature can run away. The product precipitates as white crystalline solid. A co-product under some conditions is DADP (diacetone diperoxide, the six-membered ring homologue) and small amounts of linear peroxide oligomers.
The molecular structure of TATP is a nine-membered ring containing three oxygen-oxygen (peroxide) bonds alternating with acetone-derived ketal carbons. The formula is C9H18O6, molecular weight 222.24. This structure is responsible for both its extreme sensitivity and its characteristic decomposition pathway. Unlike nitroaromatic and nitramine explosives that release energy by decomposing to CO2, H2O, and N2, TATP detonation (or, more precisely, deflagration-to-detonation transition) produces primarily gaseous acetone and CO2 in a rapid entropy-driven decomposition of the peroxide bonds. This decomposition has been described by Yehuda Yam, Ehud Keinan, and colleagues at the Technion (Haifa) as an "entropy explosion" rather than a purely enthalpy-driven process.
The sensitivity profile makes TATP among the most dangerous improvised explosives to handle. Friction sensitivity: initiates at approximately 50 g friction load (versus RDX at 120 g). Heat sensitivity: initiates at approximately 160°C. Shock sensitivity: lower than military primaries but sufficient to detonate from mechanical shock. TATP also sublimes at ambient temperature (vapour pressure approximately 6.7 Pa at 25°C), making open containers of dry TATP hazardous through vapour accumulation.
From 2005 to 2017, TATP was the common thread in four of the deadliest terrorist mass-casualty attacks in European history. The forensic chemistry that identified it in each case drove both the prosecution evidence and the counter-terrorism response.
The 7 July 2005 London Transport bombings (52 victims killed, 700 injured) involved four simultaneous IEDs detonated on the London Underground network (at Aldgate, King's Cross/Russell Square, and Edgware Road stations) and on a bus at Tavistock Square. All four devices used TATP as the main explosive charge, with organic peroxide-based initiators. The UK Defence Science and Technology Laboratory (DSTL) Forensic Explosives Laboratory at Porton Down identified TATP from debris recovered from the four blast sites. Analysis used LC-MS/MS in positive-ion ammonium adduct mode, detecting TATP as [TATP+NH4]+ at m/z 240, and GC-MS for confirmation. The investigation established that the precursors (acetone from nail polish remover products and hydrogen peroxide from hair bleaching products) had been purchased by the bombers from retail suppliers in West Yorkshire. A parallel network reconnaissance was attempted on 21 July 2005 using near-identical devices that failed to fully detonate, allowing post-blast and recovered device analysis to confirm the TATP formulation.
The 13 November 2015 Paris attacks (130 killed, 413 injured) involved multiple simultaneous attacks at the Stade de France (three suicide vests detonated by bombers), the Bataclan concert hall (suicide vests and shooting), and several cafes and restaurants. French forensic investigators from the Institut national de police scientifique (INPS) and the Laboratoire central de la préfecture de police (LCPP) identified TATP as the explosive in the suicide vests and the unexploded vest recovered from one of the attackers. The Paris investigation traced the TATP synthesis operation to a flat in Saint-Denis, north of Paris.
The 22 March 2016 Brussels attacks (32 killed, 340 injured) involved three TATP-based device detonations at Brussels Airport (Zaventem) and Maalbeek metro station. Belgian federal police forensic chemists identified TATP in post-blast debris from both locations. The Brussels attacks were operationally linked to the Paris attacks and to the same TATP synthesis network. Forensic comparison of TATP samples from Brussels with TATP residue from the Paris scene was attempted but was complicated by the near-zero post-blast residue problem: TATP detonation produces primarily acetone and CO2, with almost no solid crystalline residue.
The 22 May 2017 Manchester Arena attack (22 killed, 1,017 injured, Ariana Grande concert) involved a TATP-based suicide vest detonated in the arena foyer. UK forensic investigators confirmed TATP by LC-MS/MS of swabs from the blast seat. The subsequent public inquiry (the Manchester Arena Inquiry, chaired by Sir John Saunders, reporting in 2021-2022) examined, among other issues, the forensic evidence that established the nature of the explosive and the device construction.
In all four cases, the TATP identification was central to the prosecution or inquiry evidence, and in all four cases the detection was by LC-MS/MS (positive-ion ammonium adduct mode) rather than GC-ECD, because TATP has no nitro groups to trigger electron capture detection.
ANFO has been the world's most widely used commercial explosive for mining and quarrying since the 1950s. Its dual-use status, bulk civilian availability and catastrophic energy output, is the central policy problem that no precursor regulation regime has fully solved.
ANFO (ammonium nitrate fuel oil) is a two-component explosive mixture: approximately 94 per cent ammonium nitrate (NH4NO3) prills (small spherical granules produced by prilling tower solidification of molten ammonium nitrate) mixed with approximately 6 per cent fuel oil. The 94:6 ratio gives an oxygen balance near zero, maximising energy release. The detonation equation for ANFO is approximately:
3 NH4NO3 + CH2 (fuel oil average formula per CH2 unit) produces 3 N2 + 7 H2O + CO2
At the 94:6 ratio, ANFO achieves an oxygen balance of approximately +0.4%, close to ideal. Detonation velocity: 4,500 to 6,000 metres per second depending on density and confinement, significantly lower than military secondary explosives. Density: approximately 0.85 g/cm3, lower than water. The low density means ANFO can fill large boreholes in bulk.
ANFO is the standard bulk commercial explosive for open-cut mining, quarrying, and hard-rock tunnelling worldwide. It is manufactured by mixing ammonium nitrate prills (Agricultural grade AN has a purity of 32-35% N; Technical grade AN used for explosives has purity above 99%) with fuel oil at the blast site. In the US, ANFO is regulated under 27 CFR Part 55 (the ATF federal explosives regulations) as a blasting agent (UN 1.5, requiring a booster explosive or detonator for initiation). In Australia, the National Safety Council of Australia's Mining Safety guidance and state-level Dangerous Goods regulations govern ANFO. In India, the Explosive Rules 2008 classify AN-fuel oil mixtures in Category A.
The Oklahoma City bombing of 19 April 1995 (168 killed, 680 injured, Alfred P. Murrah Federal Building) used approximately 2,200 kilograms of ANFO in a hired Ryder truck, supplemented with nitromethane to boost detonation velocity and emulsion explosives in 55-gallon barrels. Timothy McVeigh and Terry Nichols had acquired agricultural-grade ammonium nitrate (94 50-pound bags from Mid-Kansas Cooperative in McPherson, Kansas), Nitromethane racing fuel, and stolen blasting caps. The FBI Laboratory's explosives examiners identified ammonium, nitrate, and fuel oil residues in the blast debris and at the fertiliser purchase locations. The case produced a precedent in US federal courts for the admissibility of explosive residue analysis as circumstantial evidence of bomb construction.
The Beirut port explosion of 4 August 2020 (218 killed, 6,000 injured, the largest non-nuclear explosion in the 21st century by energy release) involved the detonation of approximately 2,750 tonnes of ammonium nitrate that had been confiscated from the abandoned cargo ship MV Rhosus in 2013 and stored in Warehouse 12 of the Port of Beirut. The detonation was initiated by fire spreading from welding operations on the warehouse. Lebanese forensic and international assistance teams (including French IRCGN forensic scientists) conducted post-blast analysis. The scale of the blast (estimated 2.2 kilotons TNT equivalent) and the remote sensing data (satellite imagery, seismic records, acoustic data) confirmed the detonation of a secondary explosive at a mass consistent with the stored ammonium nitrate quantity.
The 1993 World Trade Center bomb was the first sophisticated IED to detonate on US soil that used an improvised explosive specifically selected because its precursors were commercially available without triggering regulatory notice, an approach that every subsequent bomb-maker in US history has studied.
Urea nitrate is formed by the reaction of urea (CO(NH2)2) with nitric acid (HNO3) in a simple acid-base neutralisation:
CO(NH2)2 + HNO3 produces CO(NH2)2 . HNO3
The product is an ionic salt (urea cation, nitrate anion) rather than a covalently bonded explosive. Melting point: 163°C with decomposition. Detonation velocity: approximately 3,400 metres per second, substantially lower than military secondary explosives. Urea nitrate is classified as a low-performance secondary explosive and requires a booster charge to detonate reliably.
The 26 February 1993 World Trade Center bombing (6 killed, over 1,000 injured) used a device consisting of approximately 680 kilograms of urea nitrate as the main charge, supplemented with hydrogen gas cylinders (as a fuel) and sodium cyanide (intended as a toxic gaseous by-product, though it burned in the explosion). The device was placed in a rented Ford Econoline van in the underground parking garage below the North Tower. Forensic investigation by the FBI Laboratory identified urea nitrate by ion chromatography (urea, nitrate, and ammonium from the decomposition of ammonium nitrate present as a minor co-product) and by Raman spectroscopy of residues on debris. The investigation traced the van rental to Mohammed Salameh and ultimately to the network led by Ramzi Yousef, who had directed the attack and evaded capture until 1995.
Post-blast urea nitrate identification uses ion chromatography to detect the nitrate and urea ions, with urea confirmed by LC-MS/MS (urea [M+H]+ at m/z 61). The nitrate anion alone is not specific (it could derive from ANFO, black powder, inorganic fertiliser, or numerous other sources), so the combination of urea and nitrate in approximately 1:1 molar ratio is the diagnostic criterion. Raman spectroscopy of solid residue particles shows characteristic peaks at 1051 cm-1 (nitrate symmetric stretch) and 1015 cm-1 (urea C-N stretch) that together are diagnostic.
Every kilogram of TATP that detonated in London, Paris, Brussels, and Manchester was synthesised from precursors the bomber could walk into a shop and buy. The regulatory response to this reality has been a decade-long, cross-jurisdictional effort to restrict, track, and flag anomalous purchases.
The EU Regulation 2019/1148 on the marketing and use of explosive precursors (replacing and strengthening the earlier Regulation 98/2013/EU) creates two tiers of restriction. Annex I lists restricted explosives precursors that members of the general public may not make available or possess above specified concentration thresholds without a legitimate purpose licence: hydrogen peroxide (above 12% w/w, lowered from 35% in the 2013 regulation), nitric acid (above 3% w/w), nitromethane (above 16% w/w), ammonium nitrate (above 16% N w/w, from agricultural use), and potassium chlorate and potassium perchlorate (above 40% w/w). Annex II lists regulated explosives precursors that are not restricted in availability but require Member States to report suspicious transactions and losses to national authorities.
The UK Precursor and Poisons Act 2022 (which replaced EU Regulation 98/2013/EU following Brexit) establishes a domestic licensing regime for explosive precursors including acetone (above 60% w/w), hydrogen peroxide (above 35% w/w, with reportable transaction thresholds starting at 12% w/w), nitromethane, and ammonium nitrate. The Home Office maintains the UK licensing register and coordinates with the National Counter Terrorism Policing network on suspicious transaction reporting.
In the United States, the Ammonium Nitrate Security Program (ANSP), mandated by the Food, Conservation and Energy Act 2008 (the Farm Bill) and administered by the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA), requires facilities that sell or transfer ammonium nitrate to register and to verify the identity of purchasers. Purchasers above 25 pounds must provide identification. Oklahoma City's Timothy McVeigh exploited the pre-ANSP regulatory gap; the legislation was a direct policy response. The US also restricts hydrogen peroxide sales to the general public above 12% concentration under various state regulations (not federal law), with California, New York, and other states having specific restrictions.
India's Ammonium Nitrate Rules 2012, promulgated under the Explosives Act 1884, require central government licensing (through PESO) for import, manufacture, storage, and sale of ammonium nitrate above threshold quantities. State governments maintain registers of agricultural users. Industrial ammonium nitrate (Technical grade, above 99% purity) is separately licensed. The Beirut port explosion prompted immediate review of the Indian ammonium nitrate storage framework by the Ministry of Commerce and Industry's PESO in late 2020.
Australia's National Standard for the storage and use of industrial ammonium nitrate (NM 5.3 under the National Standard for Dangerous Goods, administered through state work-health-and-safety regulators) requires licensed storage with security requirements scaled by quantity. Canada's Explosives Regulations 2013 (under the Explosives Act, administered by Natural Resources Canada) similarly classify ammonium nitrate above the critical threshold.
An IMS instrument calibrated for DMDNB and nitro-group explosives is essentially blind to TATP. Understanding why reveals both the detection gap and the methods that close it.
TATP poses a qualitatively different detection challenge from conventional nitroaromatic and nitramine explosives. Ion mobility spectrometry (IMS) instruments at airports and border crossings are calibrated to detect molecules with high electron affinity in the negative-ion drift mode: nitro groups (-NO2) are excellent electron-capture moieties, which is why RDX, TNT, PETN, and DMDNB are readily detected by IMS. TATP contains no nitro groups. Its organic peroxide bonds have moderate but not exceptional electron affinity. Standard IMS in negative-ion drift mode shows very low response to TATP.
TATP detection by IMS requires operation in positive-ion mode, which is not standard for most airport screening instruments optimised for nitro-explosive detection. The Smiths IONSCAN 500DT and 600 can be configured for positive-ion mode TATP detection; the Bruker E2M and Raptor are also certified for TATP in positive-ion mode following post-7/7 software updates. Most airports in the US, EU, UK, India, and Australia now operate dual-mode IMS instruments calibrated for both negative-mode nitro explosives and positive-mode peroxide explosives.
The near-zero solid residue problem affects post-blast analysis. TATP detonation produces primarily gaseous acetone and CO2 at room temperature (or above), with essentially no crystalline solid residue in the detonation product mix. This distinguishes TATP from TNT and RDX, which leave detectable solid residues of DNT and nitramine impurities. Post-blast TATP analysis relies on swabs from surfaces that were not at the centre of the detonation (where TATP may have condensed back as sublimed vapour from pre-detonation handling) and from any surviving device components.
The primary laboratory method for TATP (and its analogue HMTD, hexamethylene triperoxide diamine) is LC-MS/MS in positive-ion ammonium adduct mode. TATP ionises efficiently as [TATP+NH4]+ at m/z 240 (from the molecular mass of 222 plus 18 for NH4+). The diagnostic MRM transition is 240 to 89 (loss of acetone + NH3 moiety). HMTD is detected as [HMTD+NH4]+ at m/z 226. Confirmation requires two MRM transitions plus retention time matching within 0.1 minutes of a certified reference standard.
| Method | TATP detection? | ANFO (AN) detection? | Conventional HE (TNT/RDX)? | Detection limit (ng) | Field or laboratory? |
|---|---|---|---|---|---|
| IMS (negative-ion mode) | No (no nitro groups) | Partial (nitrate mode) | Yes (ppt range) | 0.5-5 ng | Field (primary screen) |
| IMS (positive-ion mode) | Yes [TATP+NH4]+ | No | Partial | 5-50 ng | Field (secondary screen) |
| GC-ECD | No (no nitro groups, no halogen) |
A forensic chemist analyses swabs from a blast seat by LC-MS/MS in positive-ion ammonium adduct mode and detects an ion at m/z 240 with a fragment ion at m/z 89. The retention time matches a certified TATP reference standard. Parallel analysis by GC-ECD shows no peaks in the nitroaromatic or nitramine region. Which explosive is most consistent with this analytical profile?
| No |
| Yes (pg range) |
| 1-10 pg injected |
| Laboratory confirmatory |
| LC-MS/MS positive ESI | Yes m/z 240 [M+NH4]+ | Partial (urea and AN) | Partial (positive adducts) | 1-5 ng | Laboratory confirmatory |
| LC-MS/MS negative ESI | No | No | Yes (all four HE) | 1-10 ng | Laboratory confirmatory |
| Ion chromatography | No | Yes (NH4+, NO3-) | No | 0.1-1 microgram | Laboratory confirmatory |
| Raman spectroscopy | Yes (field portable) | Partial (AN) | Yes | Microgram (bulk) | Field and laboratory |