Secure a Wildfire Scene: Protect Evidence Part 2 of 5, Control Access and Prevent Contamination

What you will learn in this module

This resource is general study support for learners. It is not accredited training and it does not replace current legislation, organisational procedures, authorised instruction or workplace assessment.

By the end of this article, you should be able to describe how authorised wildfire investigators:

• follow legal obligations throughout the investigation
• apply scene-security methods before detailed examination
• monitor and record access to the wildfire scene
• use approved strategies for locating and collecting evidence
• preserve evidence at the wildfire scene
• protect the scene from unnecessary damage, destruction or contamination

You will also see how these actions fit with Performance Criteria 2.1 to 2.6, plus a short scenario, a knowledge check and a review checklist.

Why wildfire scene security matters

After a wildfire, the scene can change very quickly. Wind can move ash. Rain can wash away marks. Firefighting crews can need to cross the area again. Landholders may try to check fences, stock or equipment. Curious bystanders may come closer than they should. Even a single footprint can damage a small but important area.

Scene security matters because investigators are trying to understand what happened from the evidence that remains. That evidence may be spread across a wide scene. Some items will be obvious. Others may be small, fragile or partly hidden. If the scene is not protected, the information can be lost before it is seen, recorded or collected.

Security also matters because the wildfire scene is not separate from the emergency response. Investigators must work around active firefighting, rescue work and incident-control arrangements. In other words, preserving evidence is important, but it never comes before life safety. If a scene is unsafe or still part of a live incident, the investigator must stop, withdraw and follow the directions of the incident management arrangements and organisational procedures.

Good security is not about blocking everyone out. It is about controlling access in a practical way so the right people can do the right job, while unnecessary disturbance is reduced as much as possible.

Legal obligations investigators must follow

Performance Criterion 2.1 requires investigators to follow legal obligations throughout the investigation. In practice, this means working within authority and following the current laws, policies and procedures that apply in the relevant state or territory and organisation.

It is not safe to assume that every investigator has the same powers. Some people may be authorised to enter, observe, photograph, collect or retain certain evidence. Others may only be authorised to assist. The investigation team must know who controls the scene, who may enter, who may collect evidence, who may receive information and when another authority must be notified.

Investigators should confirm these matters before detailed work begins. That confirmation helps avoid confusion and prevents people acting outside their authority.

What legal obligations can affect scene security?

• working within the investigator’s delegated authority
• following organisational policies and approved procedures
• respecting the incident control arrangements already in place
• protecting privacy and handling information appropriately
• not interfering with rescue or operational firefighting needs
• not taking possession of evidence unless authorised
• not promising access, results or outcomes that are not within authority

Investigators also need to understand when another agency or authority must be informed. That might happen when the scene involves a separate hazard, a suspicious item, a public safety issue, a utility concern or another matter outside the investigator’s control. This article does not give jurisdiction-specific legal advice, because those requirements can differ.

A good way to think about this is simple: if the investigator is not sure that they are authorised to do something, they should stop and confirm the correct process. That is better than acting first and trying to justify the action later.

Establishing scene security before examination

Performance Criterion 2.2 requires investigators to apply scene-security methods before examination. This does not mean the scene must be perfectly quiet or sealed off like a laboratory. It means the investigator takes sensible steps to protect likely evidence areas before detailed inspection begins.

Scene security starts early. Often, it begins as soon as the investigator arrives and receives the safety and incident briefing. The investigator should first understand what is happening at the incident, what hazards remain and which areas are already affected by suppression activity or operational movement.

Practical scene-security actions

• confirm the investigator’s authority and role
• receive a current safety and incident briefing
• set broad initial boundaries around the wider scene
• identify the suspected origin area and protect it as a priority
• create one controlled entry and exit point if that is appropriate
• limit unnecessary foot traffic and vehicle movement
• review and adjust boundaries as new information becomes available

Broad boundaries are important because the cause may be outside the first area that looks damaged. A scene is usually wider than the first blackened patch. The investigator must keep an open mind and avoid drawing lines too tightly before the scene is understood.

Security controls must not interfere with rescue, firefighting or incident-control arrangements. If emergency crews need access, that access comes first. The investigator’s job is to work around those needs while still protecting the scene as much as possible.

Sometimes the best option is to create a clear path for essential crews and a separate path for investigation work. In other cases, the investigator may need to wait until suppression activity is complete or conditions become safer. A delayed start is better than a rushed and unsafe examination.

What broad boundaries help protect

• fire-pattern indicators
• possible ignition sources
• small debris or residues
• vehicle or machinery marks
• electrical components
• containers, smoking materials or other small items

These controls are not about keeping everyone out forever. They are about reducing the chance that important evidence will be walked on, moved, blown away or mixed with unrelated material before it is recorded.

Monitoring and recording access to the wildfire scene

Performance Criterion 2.3 requires investigators to monitor and record access to the wildfire scene. This is a basic but essential part of evidence preservation. If people move in and out without a record, it becomes harder to explain what happened to the scene.

An access log helps the investigation team keep track of who entered, when they entered, why they entered and what they did. It can also help identify when disturbance may have occurred or whether contamination risks existed.

A scene-access log may include

• name
• role and organisation
• authority to enter
• date
• entry and exit time
• reason for access
• area visited
• significant actions taken

The access log should be started early. That means before the scene becomes busy with examination activity, whenever possible. It should be kept up to date and stored in a way that supports continuity of evidence and accountability.

Access control is not only for investigators. It also applies to other authorised personnel such as fire crew leaders, safety officers, land managers, utility representatives or other workers who may need to enter for a valid reason. The important point is that their entry is recorded and understood.

Monitoring access also means watching for unnecessary movement. If a person has no valid reason to be there, they should not be allowed into the protected area. This protects evidence and reduces the chance of confusion later.

Locating and collecting evidence safely

Performance Criterion 2.4 focuses on approved strategies for locating and collecting evidence. The work should be systematic. Investigators should not start by picking up the first interesting item they see. They should first understand the incident context and then examine the scene in a planned way.

A safe and systematic approach

1. Receive a safety and incident briefing.
2. Review maps, records, photographs and witness information if available.
3. Survey the scene for hazards and likely evidence.
4. Protect important areas before detailed examination.
5. Plan the examination route and methods.
6. Record evidence before moving anything.
7. Use authorised collection methods only.
8. Maintain continuity of evidence.
9. Review the scene before release.

This sequence helps investigators avoid missing important material or creating unnecessary disturbance. It also helps them link items together instead of treating every object as if it can be understood on its own.

What may count as possible evidence?

• fire-pattern indicators
• possible ignition sources
• damaged equipment
• electrical components
• vehicle or machinery parts
• containers
• smoking materials
• samples
• photographs
• notes and maps
• witness information
• suppression records

It is important to remember that an item found near the suspected origin does not automatically prove the cause. A discarded smoking material near a damaged roadside component is not enough, by itself, to explain how a wildfire began. The investigator must assess the full picture.

That full picture may include burn patterns, electrical evidence, weather information, witness accounts, access records, suppression activity and other scene observations. Cause is usually established by combining evidence, not by relying on a single object.

Collecting without causing harm

Only trained and authorised personnel should handle evidence. If an item must be collected, the item should be handled using approved methods that protect both the item and the record of who handled it. Good practice usually includes accurate notes, photographs, labels, seals, separate packaging where needed and secure storage.

The goal is not just to pick up an item. The goal is to preserve its value as evidence. If a small part is dropped, mixed, damaged or labelled poorly, the item may lose much of its usefulness in the investigation.

Preserving evidence at the wildfire scene

Performance Criterion 2.5 requires investigators to preserve evidence at the wildfire scene. Preservation means protecting evidence from loss, damage, movement, alteration or contamination. It begins the moment the item or area is identified as important.

Wildfire evidence is fragile. Even when it looks strong, it may already be weakened by heat, smoke, suppression activity or weather. Wind and rain can change what remains. Vehicles, people, animals and machinery can all disturb material. Poor handling can also damage evidence after it has been identified.

Common preservation methods

• photograph before touching or moving anything
• make clear notes and sketches
• record the exact location of each item
• limit access around fragile evidence
• use approved packaging and separate containers where required
• apply accurate labels and seals
• store items securely
• keep continuity records for every transfer

Preservation is not only about items removed from the scene. It also applies to features left in place, such as burn edges, vehicle tracks, hose lines, electrical components or patterns in vegetation. These features should be recorded carefully before anything changes them further.

Weather is one of the biggest threats to preservation. A shift in wind can scatter ash and light debris. Rain can flatten vegetation and blur marks. If the scene may be affected soon, investigators may need to prioritise photographs, measurements and notes before any collection happens.

Continuity of evidence is part of preservation too. Continuity is the record of who collected, handled, moved, stored or examined an item. Without this record, the item’s evidentiary value can be questioned. Good continuity means each step is recorded clearly and consistently.

Spoliation is the loss, destruction or significant alteration of evidence. Investigators work to avoid spoliation by planning carefully, using approved methods and not rushing when the scene is unstable or poorly understood.

Preventing damage, destruction and contamination

Performance Criterion 2.6 requires investigators to protect the scene from unnecessary damage, destruction or contamination. This is one of the most practical parts of scene management because it is where good intentions can still cause harm if the team is not careful.

It helps to separate three different things:

• Unavoidable disturbance caused by rescue or firefighting activity
• Necessary investigation activity that is approved and controlled
• Unnecessary disturbance that should be avoided because it adds no value

Contamination means material is introduced, transferred or altered in a way that may affect evidence. A contaminated scene can make it hard to tell what came from the wildfire and what came from later activity.

Simple contamination controls

• use designated walking routes where possible
• keep vehicles outside protected areas
• reduce unnecessary access
• avoid eating or smoking within the scene
• keep unrelated tools outside the protected area
• use clean, approved equipment
• record unavoidable changes caused by operations

Investigators should also consider whether their own boots, gloves, tools, vehicles or packaging could transfer material. A clean approach matters. Even small amounts of dirt, ash, plant matter or residue can move from one place to another if the team is not disciplined.

Not every disturbance is a mistake. Firefighting activity may have created tracks, hose lines, hose drag marks, water flow marks or other changes that cannot be avoided. The important thing is to recognise those changes, record them and separate them from later investigation activity.

That is why photographs before movement are so useful. They show the scene as it was found after suppression and before additional investigation work. These early images can help explain later questions about why a mark is present or why an item appears disturbed.

Fictional Australian wildfire scenario

Imagine a grass and scrub wildfire beside a rural road in regional Australia. Fire crews have already completed the most urgent suppression work, but the area is still active. The wind has shifted several times during the day. A landholder wants to get closer to check a fence. Several people are asking to inspect the suspected origin area. Nearby, investigators can see tyre marks, hose lines, a damaged roadside electrical component and a discarded smoking material.

The lead investigator begins by confirming who controls the scene. They receive a current safety briefing from the incident management arrangements and check whether any work in the area still needs to be left to firefighting or rescue crews. They do not start detailed examination yet.

Next, they establish broad scene boundaries around the wider burn area and create one controlled entry point for authorised personnel. The boundary is broad enough to protect likely evidence areas, but it does not block access needed for active operations. The investigator starts a scene-access log immediately.

Before anyone else enters the suspected origin area, the investigator photographs the existing disturbance. The tyre marks, hose lines and roadside component are recorded in place. The discarded smoking material is noted, but it is not treated as proof of cause. The investigator knows that nearby smoking material does not automatically explain the ignition.

The investigator then protects the suspected origin area and prevents unnecessary access while arranging authorised examination of possible ignition sources. A person asking to inspect the area is politely kept outside the controlled zone unless they have valid authority and a real need to enter. The landholder is managed in line with incident arrangements and organisational procedures.

As the work continues, the wind strengthens again. Conditions become less stable, and small debris begins to move. The investigator decides to delay further detailed work until it is safe to continue. That decision protects both people and evidence.

Later, the investigation team assesses fire patterns, electrical evidence, witness accounts, weather information and suppression records together. The scene-access log helps show which changes were caused by firefighting and which changes occurred later. In this scenario, the final cause cannot be decided from one item alone. It must be assessed from the whole scene.

Common scene-security mistakes to avoid

Many scene problems come from rushing or making assumptions. The following mistakes can weaken an investigation:

• starting before confirming authority
• setting boundaries too narrowly
• allowing unrestricted access
• failing to keep an access log
• moving evidence before recording it
• using the same equipment on several items without approved controls
• assuming an object near the origin caused the fire
• failing to record firefighting disturbance
• continuing when conditions become unsafe
• releasing the scene too early

These mistakes are often linked. For example, if access is not controlled, people may disturb the same area that should have been photographed first. If evidence is moved before it is recorded, its original position is lost. If the team keeps working after conditions become unsafe, both people and evidence are put at risk.

Good investigators stay disciplined. They work slowly enough to preserve the scene, but not so slowly that they ignore changing hazards or incident needs. They keep checking that their actions still fit the situation.

Continue Your Fire and Emergency Services Learning

Build your knowledge with practical study resources, learner checklists, presentations and guided course materials from FireRescue Training.

Explore FireRescue Training:
www.firerescue.com.au/members/

Button text: Visit the FireRescue Training Section

FireRescue Training Hub
FireRescue resources provide general study support and are not accredited training.

Practice only — not a formal assessment

Use the questions below to check your understanding. Each answer includes a short explanation.

Question 1: legal authority

Which action should happen first before detailed investigation work begins?

• A. Collect the nearest object
• B. Confirm authority, safety and incident control arrangements
• C. Release the scene to the landholder
• D. Assume the nearest item caused the fire

Correct answer: B

Explanation: Investigators must work within their authority and follow the current safety and incident arrangements before starting detailed work.

Question 2: scene-access logs

True or false: A scene-access log is mainly useful after the investigation is finished.

Correct answer: False

Explanation: Access should be recorded from the beginning so the team can track who entered, when they entered and what changes may have occurred.

Question 3: photographing evidence

What is the best workplace decision when you find a fragile item near the suspected origin area?

• A. Move it quickly so it is safe
• B. Photograph and note it before any approved movement
• C. Let several people look closely first
• D. Brush the area clean to see it better

Correct answer: B

Explanation: Fragile evidence should be recorded in place before anything is moved or handled.

Question 4: contamination

Which action is most likely to reduce contamination?

• A. Allowing free movement so people can move faster
• B. Using designated routes and clean, approved equipment
• C. Smoking outside the protected area but near the scene
• D. Putting unrelated tools on the same surface as evidence

Correct answer: B

Explanation: Controlled movement and clean equipment reduce the chance of material being transferred into the scene.

Question 5: unsafe conditions

What should investigators do if wind or other conditions make the scene less stable?

• A. Continue to finish quickly
• B. Stop, withdraw and follow incident and organisational procedures
• C. Ignore the change if the evidence looks interesting
• D. Ask unauthorised people to hold the scene

Correct answer: B

Explanation: Personal safety comes first. Investigation work stops when conditions become unsafe or uncontrolled.

Performance Criteria 2.1 to 2.6 review checklist

• ☐ 2.1 Follow legal obligations throughout the investigation by confirming authority, scene control and required notifications.
• ☐ 2.2 Apply scene-security methods before examination by setting broad boundaries and protecting likely evidence areas.
• ☐ 2.3 Monitor and record access to the wildfire scene using an access log and controlled entry arrangements.
• ☐ 2.4 Apply approved strategies for locating and collecting evidence using a systematic and authorised approach.
• ☐ 2.5 Preserve evidence at the wildfire scene by recording, packaging, sealing and storing items correctly.
• ☐ 2.6 Protect the scene from unnecessary damage, destruction or contamination by controlling movement and recording unavoidable disturbance.

Five key takeaways

• Scene security starts early and must not interfere with active firefighting, rescue work or incident-control arrangements.
• Legal authority must be confirmed before detailed examination or evidence handling begins.
• An access log helps explain who entered the scene, when they entered and what may have changed.
• Evidence must be recorded in place before movement, and preserved from loss, damage and contamination.
• No single item proves cause on its own; investigators must assess all available evidence together.

In summary, to secure a wildfire scene well, investigators need to balance safety, authority and evidence protection from the first arrival to the final review of the scene. Keep following the approved process, record what you do, and verify current legislation, organisational procedures and local practice before publication or workplace use.