Major Bombing Casework: Oklahoma, Mumbai, 7/7, Boston, Manchester

At 09:02 on 19 April 1995, a rental truck containing approximately 4,800 pounds (2,177 kg) of ammonium nitrate fuel oil (ANFO), augmented with nitromethane as an additional fuel, detonated at the Alfred P. Murrah Federal Building in Oklahoma City, Oklahoma. The blast killed 168 people, injured more than 680, and destroyed or damaged 324 buildings in a 16-block radius. It remained the deadliest domestic terrorist attack on US soil until 11 September 2001.

The FBI Explosives Unit, ATF, and the Oklahoma State Bureau of Investigation conducted the post-blast investigation under the direction of FBI Special Agent in Charge Bob Ricks. The site was divided into a primary blast-seat grid and an expanded evidence-collection zone. More than 13,000 items of evidence were recovered, processed, and catalogued. The critical breakthrough in device reconstruction came within hours: the rear axle of the rental truck was found three blocks from the blast seat. The axle carried a legible vehicle identification number (VIN), which linked the vehicle to a Ryder rental agency in Kansas, which in turn provided a description of the renter.

The explosive characterisation relied on residue chemistry from surface swabs of materials near the blast seat and from soil samples at the crater. Ion chromatography identified ammonium and nitrate ions at elevated concentrations indicative of ammonium nitrate residues. NIST and the FBI Laboratory's Explosives Reference Laboratory provided reference ANFO blast-pattern data against which the Oklahoma City crater geometry was compared. The absence of significant military explosive residues (such as RDX or PETN) was consistent with ANFO, a commercially available fertiliser-based explosive that required no access to restricted military supply chains.

McVeigh was convicted in federal court in 1997. The case established the forensic-evidential pathway from blast-seat residue chemistry through device component trace-back to perpetrator identification that has been applied in subsequent VBIED (vehicle-borne improvised explosive device) cases internationally, including by UK and Indian investigators who participated in post-Oklahoma City training exchanges with the FBI.

On 12 March 1993, thirteen improvised explosive devices detonated across Mumbai (then Bombay) between 13:30 and 15:40 local time. The targets included the Bombay Stock Exchange, Air India Building, the Centaur Hotel, the passport office, a gold market, and multiple commercial areas. Two hundred and fifty-seven people died and more than 700 were injured. The attacks were the first mass-casualty coordinated bomb attacks in India.

The investigation was conducted by the Central Bureau of Investigation (CBI), with support from scientific units of the state government and, in later phases, the National Investigation Agency (NIA), which was established in 2008. The key forensic finding was that the primary explosive in the devices was Research Department Explosive (RDX), a military-grade high explosive (cyclotrimethylenetrinitramine, molecular formula C3H6N6O6). RDX requires specialist manufacturing and is not commercially available; its presence indicated a supply chain connecting the perpetrators to a source of military ordnance or to organised smuggling of military explosives. This finding drove the intelligence investigation that identified the Dawood Ibrahim network and the role of Pakistani intelligence services in the supply chain.

Post-blast scene examination at each of the thirteen locations identified blast-seat craters, structural damage patterns, and in several locations, vehicle remnants consistent with car-bomb delivery. Residue analysis on swabs from the blast seats used thin-layer chromatography (TLC) and high-performance liquid chromatography (HPLC) to identify RDX alongside ammonium nitrate, which was used as a bulk booster in some of the devices. The presence of RDX was confirmed at multiple sites, establishing a common explosive batch across the serial attacks, a forensic finding that supported the prosecution's argument of a single organised conspiracy rather than independent events.

The criminal case, prosecuted under the Terrorist and Disruptive Activities (Prevention) Act and subsequently under TADA's successor the Prevention of Terrorism Act 2002, ran for more than two decades and resulted in 100 convictions. The investigation demonstrated the critical value of explosive batch analysis in serial-attack investigations: when the same forensic signature appears across multiple scenes, it proves organisational linkage and defeats the defence of coincidence. Comparable methodology was used by the UK Forensic Explosives Laboratory in linking devices from the IRA mainland bombing campaign of the 1990s.

On 26 to 29 November 2008, a ten-member team of Lashkar-e-Taiba (LeT) operatives conducted coordinated attacks across twelve sites in Mumbai, including the Taj Mahal Palace Hotel, Oberoi Trident Hotel, Chhatrapati Shivaji Maharaj Terminus (CSMT), and Nariman House. One hundred and sixty-six people were killed, including six foreign nationals at Chabad House. The attacks used assault rifles (AK-47 pattern), improvised grenades, and explosives placed at the CSMT and Leopold Cafe.

The forensic investigation was conducted by the Maharashtra Police, CBI, and the National Investigation Agency, with coordination support from the FBI's Legal Attache office in New Delhi (which maintained FBI Laboratory consultation access). A key forensic product of the investigation was the attribution package linking the attackers to Pakistan, which relied on geospatial, communications intercept, and materials analysis combined. The single surviving attacker, Mohammad Ajmal Kasab, was captured alive at CSMT and provided confession evidence supported by forensic corroboration.

In a post-blast context, the 26/11 investigation is significant for its demonstration of multi-scene evidence integration under live-operational conditions. The scenes at the Taj Hotel were partially active for three days as operations to neutralise the perpetrators continued. Crime-scene forensic processing had to work around an ongoing hostage and counter-terrorism operation, requiring protocols for evidence preservation in a non-sterile environment. The NATO-standard military investigative doctrine for such conditions (the STANAG 2934 framework for post-blast investigation in conflict and semi-conflict environments) was referenced by Indian military advisors during the response.

Internationally, the 26/11 investigation influenced the development of multi-agency response protocols for complex attacks in the UK (the CONTEST strategy's "protect" strand), Australia (the National Counter-Terrorism Committee's attack-planning framework), and the United States (the FBI/FEMA Joint Operations Centre model for mass-casualty events with explosive components).

On 7 July 2005, four suicide bombers detonated improvised explosive devices simultaneously on three London Underground trains (at Aldgate, Edgware Road, and Tavistock Square area) and on a double-decker bus at Tavistock Square. Fifty-two people died in addition to the four bombers, and more than 700 were injured. It was the deadliest terrorist attack on British soil since the Lockerbie bombing in 1988.

The forensic investigation was led by the Metropolitan Police's Counter Terrorism Command (SO15), with explosive analysis conducted by the Forensic Explosives Laboratory (FEL) at Fort Halstead, operated by the Defence Science and Technology Laboratory (DSTL). The FEL analysis identified the main charge in each device as triacetone triperoxide (TATP, C9H18O6), a primary explosive synthesised from acetone, hydrogen peroxide, and an acid catalyst. The initiator component included hexamethylene triperoxide diamine (HMTD, C6H12N2O12), another peroxide-based primary explosive synthesised from hexamine and hydrogen peroxide.

Both TATP and HMTD are designated as controlled substances under Schedule 2 of the Explosives Precursors and Poisons Regulations 2014 in the UK (in force with precursor restrictions under the 2005 Explosives (Explosive Precursors) Regulations at the time of the attack). Their synthesis from commercially available precursors without a licence is a criminal offence. However, in 2005, the precursor chemicals (concentrated hydrogen peroxide, acetone) were not yet restricted at the point of sale. Post-7/7 regulatory responses in the UK and EU (Regulation 98/2013 on the marketing and use of explosive precursors) tightened access to high-concentration hydrogen peroxide specifically as a result of the 7/7 and the failed 21/7 bombings that followed.

The identification of TATP was made by gas chromatography-mass spectrometry (GC-MS) of residues recovered from the blast seats and from fragments of the rucksacks used to carry the devices. TATP has a characteristic low-molecular-weight fragmentation pattern in electron ionisation MS, with major ions at m/z 43 (acetyl cation), 58 (acetone), and 75 (protonated acetone dimer). The FEL's reference spectral library and validated analytical methods for peroxide explosives were applied to confirm the identification. Simultaneous ion chromatography of surface swabs confirmed the presence of peroxide ions at concentrations consistent with residual TATP and HMTD.

On 15 April 2013, two pressure-cooker IEDs detonated near the finish line of the Boston Marathon. Three people died and 264 were injured, 16 of whom lost limbs. The Tsarnaev brothers (Tamerlan and Dzhokhar) assembled the devices from commercially available pressure cookers packed with metal fasteners, nails, and ball bearings as fragmentation, with the main explosive charge consisting of pyrotechnic powder extracted from commercial fireworks. The initiators were electronic detonators triggered by remote-control receivers.

The FBI's Joint Terrorism Task Force (JTTF) led the Boston investigation, with forensic support from the FBI Laboratory's Explosives Unit, Massachusetts State Police Crime Laboratory, and the ATF. The explosive identification was accomplished by GC-MS and HPLC analysis of residues recovered from the blast seats, the pressure cooker fragments, and the victims' wounds. The use of commercial fireworks powder (specifically black powder and flash powder from pyrotechnic units) rather than synthesised military or improvised high explosives placed the device in the low-explosive category. The pressure-cooker container and the metallic fragmentation material were identified through manufacturing markings on recovered components, which were traced to purchasing records.

The Manchester Arena bombing on 22 May 2017 used a more sophisticated device. Salman Abedi detonated a bag-bomb containing TATP as the main charge at the end of an Ariana Grande concert in the Arena foyer, killing 22 people (including the bomber) and injuring more than 500. The Manchester Arena Inquiry (Volume 2, reporting in November 2022) heard detailed forensic expert evidence from the Counter Terrorism Division of the Crown Prosecution Service and from the Home Office-appointed forensic pathology and explosives experts. The TATP identification was made by the DSTL Forensic Explosives Laboratory using the same GC-MS methodology as in 7/7. The Inquiry's forensic findings addressed the explosive yield, the directional characteristics of the blast, and the question of whether earlier intervention by Arena staff or security personnel could have identified the bomber before detonation.

1. Scene security and secondary-device sweep
   Before any evidence collection, the Explosive Ordnance Disposal (EOD) team clears the scene for secondary devices. X-ray and manual inspection of suspicious items before moving. Scene remains a live EOD site until declared safe.
2. Perimeter grid establishment
   Mark a primary debris zone (typically 0-100 m from the blast seat) and an extended zone (100 m to the building line or natural boundary). Grid references aligned to a fixed coordinate system. GPS logging of all evidence items.
3. Photography and 3D scanning
   Comprehensive photography of the intact scene before any debris movement. 3D point-cloud scanning (FARO or Leica scanner) of the blast seat and primary debris zone to create a permanent record of evidence in-situ positions.
4. Blast seat sampling
   Collect soil samples at 5 cm intervals from the blast crater and at increasing radii. Swab all hard surfaces within 10 m of the blast seat. Retain all sampled material in forensic evidence bags with exhibit numbers. Soil and swabs go to the explosives laboratory for IC and GC-MS analysis.
5. Component recovery and triage
   All debris, fragments, and items in the primary debris zone are individually collected, photographed, and packaged. Items are scanned for fingerprints and DNA before packaging. Component fragments are assessed for device construction inferences.
6. Extended debris mapping
   In VBIED scenarios, the extended debris zone (up to several hundred metres) may contain vehicle components (as in Oklahoma City) or device-construction items. Metal detectors and systematic visual searches at extended radii.
7. Laboratory explosive identification
   Soil and swab samples analysed by ion chromatography (inorganic ions), GC-MS (organic explosive compounds), and HPLC (nitroaromatic and peroxide compounds). TATP and HMTD by GC-MS. ANFO by IC. RDX and PETN by HPLC and LC-MS/MS.

The forensic methodology for post-blast investigation is broadly consistent across US, UK, Indian, and Australian practice, reflecting the influence of shared training programmes, multilateral information-sharing (particularly through INTERPOL's CBRN Sub-Directorate and the Five Eyes Counter-Terrorism Group), and common reference standards. The primary differences between jurisdictions lie in the legal framework for expert-witness evidence, the admissibility standards applied to the forensic report, and the disclosure obligations that shape how the forensic team records its work.

In the United States, post-blast forensic evidence must meet Daubert reliability criteria (under Federal Rule of Evidence 702) for admission in federal terrorism prosecutions. The FBI Laboratory's Explosives Unit operates under ISO/IEC 17025 accreditation and publishes validated methods. The ATF's National Center for Explosives Training and Research provides standardised post-blast field methodology training that is the de-facto national standard.

In the United Kingdom, forensic evidence in terrorism prosecutions passes through the Crown Prosecution Service's Specialist Fraud Division (Counter Terrorism) and must comply with the Criminal Procedure Rules Part 19 on expert evidence. The FEL at Fort Halstead operates UKAS-accredited analytical methods. Post-Grayling reform, the Forensic Science Regulator's Codes of Practice set the minimum quality standard for all forensic work used in UK courts, including post-blast analysis.

In India, post-blast evidence is produced and examined by the Central Forensic Science Laboratory (CFSL), state forensic science laboratories, and in major cases by the National Investigation Agency's own scientific support team. The admissibility framework is the Indian Evidence Act 1872, now replaced in significant part by the Bharatiya Sakshya Adhiniyam 2023 (BSA 2023), under which expert evidence is admitted under Section 39. A critical gap remains in India: unlike the FBI Lab and the UK FEL, no CFSL division has yet achieved ISO/IEC 17025 accreditation for explosive residue analysis specifically, though NABL-accredited protocols for other analytical chemistry disciplines exist. This accreditation gap was identified in NIA case-management reviews following 2008 and remains an active area of institutional development.

In Australia, the Australian Federal Police National Forensic Services (AFP NFS) and state forensic services provide post-blast analytical support. The Expert Evidence Guidelines under the Evidence Act 1995 (Cth) govern admissibility. The AFP National Bomb Data Centre maintains a national post-blast database and provides post-blast investigator training.