Technical bulletins
October 2014

The Burglar Alarm System: A Powerful Tool for Fire O&C Investigations

By Stéphane Labonté P. Eng., CFEI, IAAI-CFI,

Fire alarm panels certainly provide important information during an investigation to determine the origin and cause of a fire. But, what about burglar alarm systems?

Although this equipment is designed to prevent theft and property crime, it may also provide crucial information to an investigator on the scene of a fire.

This bulletin provides information on how these systems generally operate as well as on how various system components on the scene of a fire are physically examined and data contained in the control panel's internal memory chip are collected. Finally, we will explain the process for analyzing the information obtained during an investigation to determine the origin and cause of a fire.

Burglar Alarm Systems: How do they operate

Although there is a variety of alarm system models, they all essentially work in the same way. Generally, an alarm system is made up of sensors that detect variations in the environment under surveillance (temperature, motion, etc.), particularly magnetic contact, motion or glass break sensors. Smoke and heat detectors may also be added to burglar system components. Data produced by the sensors are sent to the system control panel and, if pre?set conditions are met, an alarm is triggered.

Photo 1: Control panel

The alarm system includes operational control options, i.e. a keyboard or remote control device, to activate, configure and deactivate the system. Finally, the alarm system may be stand-alone (local alarm only) or linked by telephone line, cellular or Internet so that signals can be sent to a central monitoring station. In some cases, the control panel can be directly operated either by cell phone or pager.

Burglar Alarm Systems: What you should check

The investigator will systematically examine the various components of the alarm system in order to discover any sign of sabotage, such as:

Photo 2: Sabotage of a door connection
  • Disconnected or cut telephone line
  • Blocked motion sensor(s)
  • Altered magnetic contact(s) (two areas of the contact glued together)
  • Disconnected zone(s)
  • Disconnected power sources (a.c. supply or backup battery)

In addition to a careful inspection of each component, the inspector will draw a floor plan of the premises (to scale) and indicate, as accurately as possible, the positional relationships of each component. Finally, the manufacturer and model number of each piece of equipment will be recorded in order to obtain technical data sheets on the products as necessary.

Burglar Alarm Systems: Collecting data

Most control panels are equipped with a memory chip that records the system's most recent events (typically the last 128 or 256 events). This is the most complete source of information because all types of events are recorded, including alarm, programming changes, activation, deactivation and disturbances. On the other hand, a remote monitoring station (if any) will receive data on only some of the events recorded by the control panel, depending on system programming and the terms of the service agreement between the station and the client. In most cases, the system is programmed to transmit alarm and disturbance signals only.

There are a number of ways to collect data. If the system is still functional and powered up (a.c. supply or battery), using an alphanumeric keyboard is the easiest and most economical solution. The master access code to the system is required to carry out this operation.

If the system is no longer functional or an alphanumeric keyboard is not available, a portable computer loaded with the appropriate software may be used to establish communications with the control panel. To recover the data, you will need to call in a specialized technician, who may either use a portable computer or place a call to the remote monitoring station to establish communications with the control panel and extract data remotely. Similarly to data recovery via an alphanumeric keyboard, using a portable computer or a telephone line requires the master access code to the system to establish communications with the control panel.

Care must be taken when data is extracted directly from the control panel, as events are stamped with the date and time of the control panel's internal clock, which may be different from the actual time the event occurred. If it is possible to determine the lag between the panel's clock and the actual time, the panel's time stamp may be adjusted as appropriate. Note that this problem does not occur when data are transmitted to a remote monitoring station, as the latter uses clocks synchronized with coordinated universal time (UTC).

Burglar Alarm Systems: Analyzing Information

First, it is essential to establish the exact chronology of events recorded by the alarm system, which are then correlated with information obtained from witnesses or first responders.

For example, if the alarm event report indicates that a door was opened only a short time before the smoke detector was triggered, the possibility of an intentional act must be seriously considered.

If the first device activated is an interior motion sensor and the report does not indicate that a door was opened beforehand and first responders report that all windows were intact upon their arrival, the scenario of intentional fire setting associated with a break-in may be rejected. Note that motion sensors operate using infrared cells that detect variations in temperature triggered by either human presence or an increase in temperature generated by fire. In fact, except when smoke detectors are installed, motion sensors are often the first burglar alarm component to be triggered by a fire.

Photo 3: Motion detector

Another frequent occurrence is the discovery (by the smoke or motion sensor) of a fire only a few seconds after the alarm system is activated. This chronology strongly suggests that the last person to have activated the system could be responsible for the incident (intentional).

Finally, data obtained from a burglar alarm system may also indicate the location where the fire started. Given that they react to heat, the sequence in which motion sensors are triggered in a large building that is badly-damaged can direct the investigator towards the probable area where the fire originated.

As you can see, each case is unique and needs to be thoroughly analyzed. Of course, there are many more examples and we cannot list them all in this newsletter. Generally speaking, successful data analysis is directly related to how quickly the site is accessed and the quality of investigative procedures (floor plan, physical examination of the system, search for signs of sabotage, etc.)


Although burglar alarm systems are basically designed to prevent property crime (theft, break-ins, etc.), they are also very useful for investigating the origin and cause of a fire.

The investigator on the scene of a fire should note whether there is a burglar alarm system installed, systematically examine each of its components, and extract data as necessary to complete the incident report.