Practice with national-level exam (FACT, FACT Plus, NET, CUET, etc.) mocks, learn from structured notes, and get your doubts solved in one place.
The chemical-weapons + radiological-dispersal-device + dirty-bomb threat and the cross-jurisdictional investigative readiness frame: the Tokyo subway sarin attack 1995 (Aum Shinrikyo, the Japanese Police Agency + scientific-investigation methodology), the Salisbury Novichok 2018 investigation (the GRU Unit 29155 attribution work and the OPCW forensic methodology), the polonium-210 Litvinenko 2006 case (the UK FSS + AWE Aldermaston isotope-fingerprinting work), the CBRN response architecture that India NDMA + DRDE + US DHS + UK CONTEST + EU Civil Protection Mechanism maintain, the OPCW Designated Laboratory network, and the integration of forensic and intelligence streams in attribution.
Last updated:
Chemical, biological, radiological, and nuclear (CBRN) incidents sit at the intersection of forensic science, public health emergency response, national intelligence, and international law. A sarin attack on a subway system, a Novichok poisoning on a provincial English high street, and the murder of a Russian dissident with a polonium-210 solution in a hotel bar are all forensic investigations at their core. But they differ from a conventional homicide scene in every operational dimension: the hazard is invisible, the agent may kill the responders, the attribution question engages geopolitics, and the findings will be scrutinised by international treaty bodies as well as by domestic courts.
This topic examines three landmark CBRN casework investigations, then builds out the institutional architecture for CBRN investigative readiness across major jurisdictions. The Tokyo subway sarin attack (1995) established the operational and scientific methodology for mass-casualty chemical agent response. The Salisbury Novichok case (2018) demonstrated state-level attribution of a chemical weapons use through OPCW verification methods. The Litvinenko murder (2006) used isotope-ratio analysis to trace a novel radiological weapon and identify its likely state origin.
Each case illustrates the same underlying principle: CBRN forensics is forensics under constraint. The agent may be lethal in microgram quantities. The scene may require Level A personal protective equipment. The analytical methods must be validated not just to criminal evidence standards but to the standards of the Chemical Weapons Convention (CWC) or international nuclear safeguards. And the findings must survive challenge by nation-state adversaries with their own analytical capabilities and political interest in disputing the results.
Aum Shinrikyo's March 1995 attack was the first large-scale use of a chemical weapon against civilians in peacetime, and the Japanese Police Agency's response defined the CWA mass-casualty investigation template.
On 20 March 1995, members of the Aum Shinrikyo cult simultaneously released sarin (O-isopropyl methylphosphonofluoridate, also designated GB) on five Tokyo subway lines during the morning rush hour. Packages containing liquid sarin were placed on train floors and punctured with umbrella tips, releasing sarin vapour as the liquid evaporated. Thirteen people died; approximately 1,000 required hospitalisation, and around 5,000 sought medical treatment. The clinical presentation was consistent with organophosphate poisoning: miosis (pupil constriction), excessive secretions, bronchospasm, and in severe cases, seizures and respiratory failure.
The Japanese Police Agency (JPA) conducted the criminal investigation, working alongside the National Research Institute of Police Science (NRIPS). The forensic challenge in a CWA release is that the agent itself may have dissipated or degraded by the time forensic teams enter the scene, particularly for volatile agents such as sarin (boiling point 147°C). The analytical strategy uses a combination of intact agent detection where possible, and signature degradation products where the parent compound has hydrolysed. Sarin hydrolyses in the presence of water to form isopropyl methylphosphonic acid (IMPA) and further to methylphosphonic acid (MPA). IMPA is the primary biomarker in urine of sarin-exposed individuals; MPA persists in environmental matrices.
NRIPS analysis of victim blood and urine confirmed inhibition of acetylcholinesterase (AChE) and butyrylcholinesterase (BChE), the enzymes whose phosphorylation is the mechanism of nerve-agent toxicity. GC-MS and liquid chromatography-tandem mass spectrometry (LC-MS/MS) of environmental swabs from the subway cars and station platforms detected sarin, IMPA, and MPA. The analytical confirmation was performed using the same methodology that OPCW-Designated Laboratories employ for CWC verification analysis: GC with mass spectrometric detection, with retention time and spectral match against CWC Schedule 1 reference standards.
The investigation of Aum Shinrikyo's production capability drew on forensic evidence from raids on the cult's facilities in Kamikuishiki, where a chemical manufacturing plant was discovered. GC-MS of soil and surface samples confirmed precursor chemicals (methylphosphonic dichloride, isopropanol) and synthesis by-products. The sarin batch used in the subway attack was compared forensically to samples from the production facility and from an earlier Aum sarin release at Matsumoto in June 1994 (eight deaths), establishing a common production source.
In India, the analogous institutional capacity for CWA-scene investigation sits with the Defence Research and Development Establishment (DRDE) in Gwalior, which is the nodal laboratory for CWA detection and analysis under the National Disaster Management Authority (NDMA) framework. DRDE has OPCW-accredited analytical capability for schedule chemicals under the Chemical Weapons Convention.
The nerve agent used at Salisbury was not sarin or VX but a fourth-generation Novichok compound: smaller in quantity than a raindrop, and able to kill at a distance of weeks from the initial exposure.
On 4 March 2018, Sergei Skripal, a former Russian military intelligence officer, and his daughter Yulia were found unconscious on a public bench in Salisbury, England. Both had been poisoned with a Novichok nerve agent. Detective Sergeant Nick Bailey, who attended the scene, was also hospitalised. All three survived. On 30 June 2018, Dawn Sturgess, who had been given a discarded perfume bottle containing residual Novichok, died after being exposed. Charlie Rowley, her partner, survived.
The nerve agent was identified by the DSTL Porton Down laboratory as a Novichok compound. Novichoks are organophosphate nerve agents developed under the Soviet Union's Foliant programme, characterised by high acute toxicity (estimated to be five to ten times more potent than VX by some routes of exposure), stability in the environment relative to G-series agents, and specific structural features not previously seen in the open CWC Schedule 1 list. The DSTL identification was confirmed by the OPCW Technical Secretariat, which sent its own inspection team to Salisbury and collected samples independently. OPCW Designated Laboratories in two member states independently confirmed the Novichok identification, and the OPCW Executive Council was briefed under Article VIII of the CWC on 18 April 2018.
The forensic methodology for Novichok analysis required the application of validated GC-MS and LC-MS/MS methods to low-concentration residues in complex matrices (blood, urine, clothing fibres, door handles, restaurant tableware, and environmental surfaces). The persistence of the Novichok agent on environmental surfaces (the Skripal front door handle, where the agent had been applied) for several months under ambient outdoor conditions was itself forensically informative, consistent with the agent being formulated in a carrier gel that retarded evaporation and increased surface residence time.
Attribution of the attack to Russia was made by the UK government and supported by Five Eyes intelligence partners. The specific attribution to GRU Unit 29155 (a covert-action unit within Russian military intelligence) was established through a combination of open-source investigative analysis (notably the Bellingcat and Insider investigation of the passport records of the identified operatives) and classified intelligence. The OPCW confirmed the chemical identification but, consistent with its mandate under the CWC, did not make an attribution determination: attribution is a political and intelligence judgement that the CWC did not assign to the OPCW's technical functions.
This division between forensic verification (OPCW's role) and attribution (state intelligence assessment) is a defining feature of CWA investigations involving state actors and one that forensic investigators in any jurisdiction must understand. The forensic science answers "what was the agent and where was it applied?" The intelligence assessment answers "who made it and who ordered it?" Both are necessary; neither substitutes for the other.
The murder weapon was an alpha-emitting radiological poison that left a forensic trail across London hotels, restaurants, and an aircraft seat before investigators identified it.
Alexander Litvinenko, a former officer of the Russian Federal Security Service (FSB) who had become a British intelligence informant, died in London on 23 November 2006, three weeks after falling acutely ill following meetings at the Millennium Hotel Mayfair and the sushi restaurant Itsu on Piccadilly. The cause of death was radiation sickness caused by polonium-210 (Po-210) ingested in solution, most likely added to a teapot of tea. Litvinenko was the first known victim of deliberate Po-210 poisoning.
Po-210 is a short-lived alpha-emitting radionuclide (half-life 138.4 days) produced by neutron bombardment of bismuth-209 in nuclear reactors. It is not commercially available at the doses required for weaponisation. The investigation by the Metropolitan Police, supported by the UK Atomic Weapons Establishment (AWE) at Aldermaston and the Health Protection Agency (now Public Health England), identified Po-210 in Litvinenko's urine on the day before his death, providing both the clinical diagnosis and the forensic identification simultaneously.
The forensic trace established by the AWE analysis was extraordinary. Because Po-210 emits alpha particles detectable at extremely low concentrations by the specific analytical technique of alpha spectrometry, trace amounts left on surfaces during transport, preparation, and administration could be detected weeks after deposition. AWE and HPA analysts surveyed more than 100 locations in London and traced a contamination trail across the Millennium Hotel pine bar, the Itsu restaurant, a Mercedes car, several other hotel locations in London, and a British Airways aircraft (BA 873, Munich to London) on which the suspected Russian agents had travelled. The contamination pattern reconstructed the physical movements of the suspects in the days before the poisoning.
The isotope fingerprinting element of the investigation was its most technically distinctive component. Po-210 produced in different reactors or from different bismuth targets has slightly different isotopic ratios of Po-210 and accompanying nuclides. AWE's isotope-ratio analysis compared the Po-210 from the London contamination sites against reference data. The analysis pointed to a Russian reactor source. This type of nuclear forensics, using isotopic fingerprinting to trace radionuclides to their production history, is the same methodology applied by the International Atomic Energy Agency (IAEA) to trace illicitly trafficked nuclear materials in the Nuclear Forensics International Technical Working Group (ITWG) framework.
The UK public inquiry (the Litvinenko Inquiry, chaired by Sir Robert Owen, reporting in January 2016) concluded that the killing was "probably approved" by then-FSB Director Nikolai Patrushev and President Vladimir Putin. The inquiry relied on both the forensic science (AWE isotope fingerprinting, Met Police scene evidence) and the classified intelligence evidence heard in closed sessions.
The gap between having a forensic capability and having it deployed correctly at a CBRN scene within the first thirty minutes is the difference between a contained incident and a mass-casualty event.
CBRN incident response requires pre-established institutional architecture: designated laboratories, trained personnel, pre-positioned equipment, and exercised command-and-control procedures. No jurisdiction discovers this architecture adequately at the scene of an actual attack.
In the United States, the Department of Homeland Security (DHS) coordinates CBRN response through the Countering Weapons of Mass Destruction Office (CWMD). The Federal Bureau of Investigation has primary jurisdiction for domestic CBRN criminal investigations and operates the FBI HAZMAT Response Team. The US Army's Edgewood Chemical Biological Center (ECBC) provides laboratory analysis for military and law-enforcement CWA investigations. The National Guard's Weapons of Mass Destruction Civil Support Teams (WMD-CSTs), one per state, provide initial responder technical assessment capability. The FBI Laboratory participates in the OPCW Designated Laboratory network for CWC verification analysis.
In the United Kingdom, the CONTEST strategy (the UK counter-terrorism strategy, updated in 2023) addresses CBRN threats within the "Protect" and "Prepare" strands. Operational response rests on the CBRN Incident Response capability maintained by the Home Office, DSTL Porton Down (for CWA analysis), AWE Aldermaston (for radiological and nuclear analysis), and Public Health England (now UK Health Security Agency, UKHSA) for biological agent identification. The Forensic Explosives Laboratory at Fort Halstead handles conventional explosive analysis; DSTL Porton Down handles CWA and biological. UKHSA operates the UK's OPCW Designated Laboratory accreditation.
In India, the CBRN response framework is coordinated by the National Disaster Management Authority (NDMA). The Defence Research and Development Organisation (DRDO) provides specialist technical capability through DRDE (CWA), the Institute of Nuclear Medicine and Allied Sciences (INMAS, Delhi), and the Bhabha Atomic Research Centre (BARC, Mumbai) for radiological and nuclear analysis. The National Security Guard (NSG) CBRN response unit provides first-response assessment and decontamination. DRDE is India's designated OPCW laboratory for CWC schedule-chemical analysis. The Central Forensic Science Laboratory (CFSL) does not currently have an OPCW-accredited CWA analytical function; DRDE is the designated national focal point.
In the European Union, the EU Civil Protection Mechanism coordinates cross-border CBRN response. EU member states maintain national CBRN response capabilities networked through the EU Joint CBRN Task Force and the European Commission's CBRN Action Plan. OPCW Designated Laboratories in France (Spiez Laboratory affiliate), Germany (Bundesamt für Ausrüstung, Informationstechnik und Nutzung der Bundeswehr), the Netherlands (TNO), and Sweden (FOI) provide the EU's primary CWA verification analytical capacity.
| Jurisdiction | Coordinating body | Primary CWA lab | Primary radiological lab | OPCW Designated Lab |
|---|---|---|---|---|
| United States | DHS CWMD + FBI | ECBC (US Army) | NNSA National Labs | FBI Lab + ECBC |
| United Kingdom | Home Office CONTEST | DSTL Porton Down | AWE Aldermaston | UKHSA (biological) + DSTL (chemical) |
| India | NDMA + DRDO | DRDE Gwalior | BARC Mumbai + INMAS Delhi | DRDE Gwalior |
An OPCW result carries international legal weight because the analytical methodology and chain of custody are independently validated by a treaty body, which is precisely why governments accused of CWA use contest the results so energetically.
The Chemical Weapons Convention (CWC), in force since 1997 with 193 states parties, prohibits the development, production, stockpiling, and use of chemical weapons. The Organisation for the Prohibition of Chemical Weapons (OPCW) in The Hague implements the CWC's verification regime. A central element is the OPCW Designated Laboratory network: currently approximately 20 laboratories globally that have passed OPCW proficiency tests and are authorised to conduct official CWC verification analysis on samples collected by OPCW inspectors.
Designated Laboratory status requires demonstrated proficiency in the analysis of CWC Schedule 1, 2, and 3 chemicals and their degradation products in complex matrices. The OPCW proficiency test scheme provides blind test samples containing CWC chemicals at low concentrations in environmental and biomedical matrices. A laboratory must correctly identify the target chemicals and provide quantitative data within the required measurement uncertainty. Accreditation is reviewed every two years. Designated Laboratories include the DSTL (UK), Edgewood CBCCOM (US), Spiez Laboratory (Switzerland), FOI (Sweden), TNO (Netherlands), and DRDE (India), among others.
The verification methodology requires a specific chain of custody that differs from standard criminal evidence chain-of-custody procedures. Samples collected by OPCW inspectors are sealed with tamper-evident devices and carried under inspector custody to the OPCW laboratory in The Hague, which prepares split samples for distribution to two or more Designated Laboratories. The laboratories perform analysis blind: they do not know the source of the samples. Results are reported to the Technical Secretariat, which compiles them. This blinded, multi-laboratory confirmation model is the reason OPCW findings carry international legal authority under the UN Security Council framework.
The use of the OPCW verification framework in the Salisbury investigation (2018) and in the investigations of alleged chemical weapons use in Syria (2013 to present) demonstrated both the value and the limits of the model. In Salisbury, OPCW confirmation provided the international legal foundation for allied attribution and diplomatic expulsions. In Syria, OPCW findings confirming sarin and chlorine use in multiple incidents (Ghouta 2013, Khan Shaykhun 2017, Douma 2018) have been contested by Russia and Syria, leading to a contested expansion of the OPCW's mandate to attribute as well as verify, approved in 2018 by the Conference of States Parties over Russian objection.
Forensic science tells you what was used. Intelligence analysis tells you who used it. The two streams must be kept methodologically distinct or each corrupts the other.
The three casework investigations in this topic each required the integration of forensic evidence and intelligence information to reach a final attribution. This integration is the most challenging analytical task in CBRN investigation because the two streams have different epistemological standards, different disclosure obligations, and different audiences.
Forensic evidence in CBRN investigations must meet the same standards as forensic evidence in any criminal case: validated methods, documented chain of custody, auditable analytical records, transparent reporting of uncertainty, and disclosure to the defence in adversarial proceedings. Intelligence information is typically classified, sourced through methods that cannot be disclosed without compromising sources and methods, assessed by different analytical frameworks, and governed by statutory prohibitions on disclosure. When forensic findings and intelligence assessments converge on the same attribution, the convergence is persuasive; when they diverge or when one is used to interpret the other without methodological transparency, the risks of confirmation bias and of later legal challenge are substantial.
In the Tokyo subway case, the forensic evidence (sarin, precursors, production equipment) was gathered through criminal search warrants and produced in open court. The attribution to Aum Shinrikyo was public and uncontested. In the Salisbury case, the OPCW verification of the Novichok compound was published; the intelligence-based attribution to GRU Unit 29155 was a government assessment, with some corroborating open-source evidence made public. In the Litvinenko case, the AWE isotope-fingerprinting analysis was presented in an open public inquiry; the classified intelligence evidence was heard in closed session but referenced in the published report.
The distinction matters for investigators and for any forensic practitioner called to give expert evidence in CBRN proceedings. Expert witnesses in UK public inquiries (Litvinenko, Grenfell) and in International Criminal Court proceedings can only speak to their forensic findings; they are not permitted to adopt intelligence assessments as a basis for their expert opinion. This independence requirement is not a procedural formality but a substantive protection for the integrity of both the forensic and the intelligence processes.
In the Tokyo subway sarin attack investigation, why did forensic analysis prioritise detection of isopropyl methylphosphonic acid (IMPA) in victim urine rather than sarin itself?
Test yourself on Forensic Fire, Arson and Explosives with free, timed mocks.
Practice Forensic Fire, Arson and Explosives questions| EU (multi-state) | EU Civil Protection Mechanism | National labs (FOI, TNO, Spiez affiliates) | JRC Karlsruhe + national labs | Multiple: FOI, TNO, Bundeswehr WIS |
| Australia | AFP + ASIS | DSTG Edinburgh (SA) | ANSTO Lucas Heights | ARPANSA (radiological) |