The magazine dedicated exclusively to the technology of evidence collection, processing, and preservationVolume 10, Number 1 • January-February 2012

TOPICS IN THIS ISSUE! Chemical Exposure in Drug Vaults

! Structured Data Systems! Forensic Analysis of Color! Human Factors and Error

Evidence Technology Magazine • January-February 2012www.EvidenceMagazine.com

10

THE CITIZENS of Vancouver,British Columbia, Canada areunlikely to recall anything very

positive regarding the night of June 15,2011. That was when the VancouverCanucks lost the Stanley Cup Finalsto the Boston Bruins—prompting anestimated 150,000 people to riot indowntown Vancouver. In just a fewhours, the offenders managed toamass nearly $4 million in damage.

A handful of arrests were madethat night and more were made during

the next several days, but few officialswere optimistic that many more rioterswould be held accountable for theiractions. Another riot in Vancouver(also following the Stanley Cup) in1994 ultimately resulted in convic-tions of only 110 people—in spite ofan investment of four months worthof investigation and analysis. Somespeculated that the 2011 incidentwould repeat history.

But this time, things were different.An international team of forensics

experts assembled under the auspicesof the Law Enforcement and EmergencyServices Video Association (LEVA), anon-profit professional organizationdedicated to the use and forensicanalysis of video in law enforcement.At the request of the Vancouverregional Integrated Riot InvestigationTeam (IRIT), the group drew morethan 50 experts from three countriesto the LEVA Digital MultimediaEvidence Processing Lab at theUniversity of Indianapolis in Indiana.

5,000 Hours of Riot Video5,000 Hours of Riot Video

The 2011 hockey riots in Vancouver proved the valueof the latest innovations in forensic video technology

Written by Dale Garrison

An incredible amount of video was captured in Vancouver on the night of June 15, 2011, providing evidence of more than 15,000 criminal acts thatoccurred in the course of just a few hours.

Photo:Ross Harvey

11Evidence Technology Magazine • January-February 2012www.EvidenceMagazine.com

Working around-the-clock shifts,analysts and technicians examinedmore than 5,000 hours of video whiletagging more than 15,000 criminalevents and individuals. The approachproved quite powerful. Whereasinvestigators required four months toprocess just 100 hours of video afterthe riots in 1994, the thousands ofhours of video recorded in 2011 wereprocessed and initially tagged in justtwo weeks.

“This will go down as the largestinvestigation of its kind in Canadiancriminal history because of the num-ber of people we are charging,” saidVancouver Police Department SergeantHoward Chow, “but this is significantfor a number of reasons.”

Numbers GameChow explained that a huge advancein technology separated the 1994 riotsinvestigation from the 2011 event. “In1994, we had just 100 hours of video,and it was all in one format: VHStape,” he explained. “For this riot, wehad more than 5,000 hours of videoin more than 100 digital formats.”

More than anything, these differ-ences reflect the recent explosion in thenumber of digital recording devices.Video of the 2011 hockey riots camenot only from hundreds of securityand other institutional cameras, butalso from hundreds of mobile phoneshandled by onlookers and sometimeseven suspects.

Grant Fredericks, lead LEVAinstructor and owner of Forensic VideoSolutions, brought a unique perspectiveto the investigation. He was in chargeof the Vancouver Police Department’s1994 riot video investigation, and wascalled on again to manage the technicalchallenges for the 2011 investigation.He said that one cannot underestimatethe evidence potential of today’subiquitous recording technology. Evenunder everyday circumstances, theaverage person is likely to be recordedon video 30 times a day.

“The Vancouver riot was probablythe most recorded event in NorthAmerica,” Fredericks said. “We havevideo not just from security camerasbut from hundreds of cell phones. Inmany instances, there are dozens anddozens of cameras from 360 degreesaround a single event.”

Fredericks noted one store that washeavily looted during the riots. Innumerous cases, video from mobilephones showed groups and individualsoutside as the violence escalated andthe crowd started breaking windows.Inside, security cameras showed riotersentering the store, breaking things, andlooting. Cell phones added ground-levelperspectives. Still other cell-phonecameras and nearby security camerasshowed people leaving the store. Policewere offered a massive quantity ofpotential evidence. But it would onlyprove useful if they could find a wayto deal with it effectively.

Activation of Know-howThe sheer number of recordings froma large event can be overwhelming,and many of the cameras use different,proprietary formats. Without softwareto unlock each unique code, the videois useless. Fortunately, technologyhas also provided solutions.

Solutions available today—devel-oped, in part, because of lessonslearned from events such as the 1994Vancouver riots—include softwarethat can process nearly any format ofdigital video, and hardware that allowsdozens of analysts and technicians tosimultaneously work on a massivecollection of evidence.

“If we only had the technology theyused in 1994, this would have beenimpossible,” said Chow. “It wouldhave taken months—even years—towade through this.” The VancouverPolice Department—a member ofLEVA—knew the technology andexpertise they needed for this investi-gation was available from LEVA.

The LEVA Digital MultimediaEvidence Processing Lab at theUniversity of Indianapolis serves sev-

eral purposes. Its most frequent appli-cation is as a facility for training per-sonnel from agencies that cover thespectrum from the FBI to small policedepartments. But the lab was alsodesigned to serve as a platform fortaskforce investigation of largeevents. At the request of the VancouverPolice Department, LEVA activatedits Forensic Video Analysis ResponseTeam and deployed the group to theIndianapolis lab.

Technology to the RescueLike the LEVA lab, many policedepartments utilize advanced video-processing software and hardwarethat is based on technology offeredby companies such as Ocean Systemsand Avid.

Ocean Systems Vice PresidentCharles Guarino said his companybegan developing forensic videotechnology in the early 1990s. Inthose early days of the forensic videofield, gathering video evidence wasgenerally a simple matter of ejectinga VHS or PAL tape from the recorderand taking it back to the office. Thechallenge, however, was the fact thatsecurity systems recorded multiplecameras to one tape in a multiplexedformat. Viewing and processing thistype of evidence required a de-multi-plexing solution that could captureuncompressed video and then de-mul-tiplex the video in order to separatethe individual cameras’ views.

Today, a trend video analysts arecoping with is the ability to view andwork with digital video that is recordedto various devices at different framerates, screen sizes, and compressionformats. Now, collecting and playingback the video is a much bigger partof the process. Each recording devicecan have its own means to exportvideo, and different requirements forplaying it back properly. One tech-nology utilized in the 2011 riot caseis Ocean System’s Omnivore digitalvideo capture drive—that, as thename suggests, is able to “ingest” justabout anything.

“The Omnivore is a password-secured thumb drive that containsspecialized digital video capture soft-ware. This allows investigators totake it on location and capture the video

F O R E N S I C V I D E OWith around-the-clockshifts, the analysts andtechnicians examined

more than 5,000 hours ofvideo and tagged morethan 15,000 criminal

events and individuals.

Evidence Technology Magazine • January-February 2012www.EvidenceMagazine.com

12

F O R E N S I C V I D E OThe photos on this page show members of the Integrated Riot Investigation Team in Vancouver,British Columbia as they assembled in the Command Room to work with thousands of hoursof video from the riot. Members of the team included detectives and civilian analysts. (Photosby Ross Harvey, Vancouver Police Department.)

evidence directly from the systemthat recorded it,” Guarino explained.“Or, as in the 2011 riot investigation,evidence can be collected andprocessed after investigators havematched the proper proprietary videoplayer to that unique video format.”

The Omnivore’s capture softwareassists investigators to process the videoby providing smart tools such as“video optimization”—a feature thatsamples the original video’s framerate and screen size and then adjuststhe video-captured settings so the videois captured properly without droppingframes. Once captured, the video can besaved and played back in a standardized,uncompressed format such as QuickTimeor AVI for future processing.

Or, the video can be tagged andcataloged in video-editing softwaresuch as Avid Media Composer, whichwas used in the LEVA lab. This taggingappends a “video database” that issearchable by simple keywords orphrases. “And at any point in thevideo, you can insert a marker andadd notes. It’s like putting a Post-itNote on the video,” said Guarino.

Many of the Vancouver hockey-riotvideo notes contain tags identifyingsuspect clothing or other features. Atag might cite the presence at a burn-ing vehicle of a “white male with ablue team sweatshirt, a black ball cap,and red running shoes.” Racingthrough hours of video, technicianswere able to tag thousands of suchsightings for hundreds of suspects.Police officials can then correlatethese sightings to track a suspect whomay have been involved in severalcrimes over several city blocks. Ariot suspect who thought he wasanonymous during a few hours ofmayhem is now tracked from crimeto crime.

Real-Time InnovationSome of the technological advancesutilized in the Vancouver riot casecame about while analysts and tech-nicians were processing evidence atthe Indianapolis lab.

“As we realized the scale of thiscase and the deadline for processingthe evidence, we arranged for theOmnivore’s key programmer to beon location,” Guarino explained.

13Evidence Technology Magazine • January-February 2012www.EvidenceMagazine.com

F O R E N S I C V I D E O

Members of the LEVA Forensic Video Analysis Response Team met atthe LEVA National Digital Multimedia Processing Lab at the Universityof Indianapolis, Indiana. There, they worked with more than 5,000hours of video evidence that documented the 2011 hockey riots inVancouver. (Photos courtesy of LEVA.)

“Not only was he available as a tech-nical resource to investigators, buthe was also able to make a couple oftweaks to the software that furtherstreamlined the processing.”

A second key to the effort involvedthe video server and storage hardwarethat managed all the video. The labutilized Avid’s ISIS shared-storagesystem that allows numerous techni-cians to work on video evidence atone time from separate workstations.In Indianapolis and later, back inVancouver, that allowed literally dozensof team members to work throughhours of video that otherwise mighthave required months to process.

“The big benefit is speed,” explainedEd Jose, digital media specialist withAvid. “Without that capability, theywouldn’t have a way of bringing it infast enough and be able to have mul-tiple analysts.”

Especially in massive cases such asthe Vancouver riots, that capability iscritical, agreed Jacques Durocher,director of Avid’s media-enterprisesegment marketing. “This workflow

F O R E N S I C V I D E O

Evidence Technology Magazine • January-February 2012www.EvidenceMagazine.com

14

allows a lot of people to descend onthe same media in a short period oftime in a very cost-effective manner,”he explained. “We developed thesetechniques in commercial video, butthere’s a huge opportunity in lawenforcement.”

In addition to enabling an efficientworkflow, Avid’s technology alsoprovides the means for the taggingused so heavily in this case. Since the1990s, Avid has implemented a plug-inarchitecture for its software that allowscompanies such as Ocean Systems toadd specialized enhancements. Avidalso creates the architecture for meta-data—in this case, the non-videoinformation such as tags describingsuspect clothing.

The intense, two-week session inIndianapolis focused on placing thosetags. After that, the tagged video wasreturned to Vancouver and IRIT onOctober 22, 2011. There, a 60-memberteam from eight area agencies beganto identify specific suspects anddevelop individual cases. Because themassive amount of video evidencehad been tagged with such detail, acascade of charges is expected.

“One of the biggest results for lawenforcement is that everyone we’recharging now is looking at a moreserious offense,” Chow explained.“Many are facing multiple chargesrather than a relatively minor, singlecharge. The person who would havebeen charged with just a single ‘mis-chief’ offense is now facing multiplecharges, some of them very serious,indeed. This new technology haschanged the game.”

Fredericks also credited the analystswith sound police techniques. He noted,for example, that along with detaileddescriptions of clothing and other char-acteristics, analysts were often able toidentify suspects because in the riotthey tended to travel in groups. If onesuspect could not be identified in onescene, it was often possible to findthat person elsewhere by locatingthose near the suspect in other scenes.“They don’t travel alone,” Frederickssaid. “They travel in groups.”

Likewise, someone might try towear a disguise, such as a mask.Using clothing matches in other scenes,

however, the analysts could tag thesuspect with and without a mask.

“Our ability to utilize this evidencejust continues to grow,” Fredericksconcluded.

New Science,Traditional Techniques

Although the case may continue todevelop for years, the first substantiallegal impact occurred on October 31,2011 when the first 163 charges against60 individuals were recommended toVancouver prosecutors. The followingmonth, officials there approved thefirst 25 individuals for trial. Expertsinvolved estimate that more than 500people may eventually face charges.Many are turning themselves in andattempting to plea bargain.

Jose at Avid foresees other resultsas well. “I expect an evolution willcontinue as the cases become largerand more complex or just more fre-quent,” he said. “For the larger cases,I believe you’ll see a move towardforensic video task forces. On the bigcrime scenes, it’s going to require thistype of collaborative effort.”

Chow saw law enforcement aschanging qualitatively, not just quan-titatively. “Originally, most of thesetypes of cases were done by witnessaccounts,” he noted. “But in this dayand age, most investigations will havesome component of forensic video.It’s never been so pervasive and, withsomething like this, you can have lit-erally hundreds, even thousands, ofpeople taping with their smart phones.”

Fredericks said such efforts wouldbecome virtually required, even forsmall departments. Citing Brady v.Maryland (1963), he noted thatpolice are required by law to discloseall available evidence. The fact thathundreds or even thousands of hoursof video evidence may be difficult toanalyze is not likely to impress ajudge.

“Law enforcement will need todeal with this, and the Vancouverpolice are paving the way becausethey understood the implications rightaway,” he said. “Police cannot ignorethat this evidence is there. They can’tsay, ‘That’s too much for us to dealwith.’ That’s unlawful, and it couldlead to a challenge of all the evidence.”

For law enforcement agencies ofall sizes, managing the large volumeof video will be the challenge.“Efficiency and accuracy are thefocus at all levels and sizes of organi-zations,” said Guarino. “I believe youwill see more investments being madeat the top end—by task forces andregional labs—in collaborative work-flow solutions. Meanwhile, you willsee powerful portable video-captureand image-clarification softwarebeing distributed to the frontline firstresponders for both large and smalleragencies. This way, cases both largeand small can be processed more effi-ciently by all groups.

“With such an increase in theamount of video being acquired, it isgoing to take increased efficiencies atall levels, from the frontline to thelabs.”

No one is suggesting it will beeasy. “I had a phone call yesterdayfrom an agency that is being over-whelmed with video,” Fredericks said.“That’s new. We never saw thatbefore. But as people become moresophisticated with the video systemsthey have on their hips, it’s now thefirst thing they think about whensomething happens. Where massiveamounts of people gather, you’ll havemassive amounts of video.” !!!

About the AuthorDale Garrison is a freelance writer inLiberty, Missouri. He can be reached at:

daleg@dginform.com

“As people becomemore sophisticated withthe video systems they

have on their hips,it is now the first thingthey think about whensomething happens.

Where massive amountsof people gather,

you’ll have massiveamounts of video.”

Forensic Video Acquisition, Clarification & Analysis Solutions

• Ocean Systems provides the courtroom tested solutions for collecting and processing all forms of multimedia evidence including digital or analog video, still images and audio.

• Regardless of the evidence source or format, we can address your needs and meet your budget with the right solution.

• Our scalable, modular solutions allow us to provide you the right professional mix of tools that meets your specifi c needs and budget.

Lower Your Investigation CostOcean Systems provides the courtroom tested solutions for collecting and processing all forms of multimedia evidence including digital or analog

Regardless of the evidence source or format, we can address your needs and meet your budget

Our scalable, modular solutions allow us to provide you the right professional mix of tools that meets

Request Our Command Sta� Forensic Video Overview CD

301-476-8015sales@oceansystems.com

N E W P R O D U C T !

DVR Video Acquisition

• Omnivore capture software runs from the thumb drive—requires no installation

• Capture hours of uncompressed video with no dropped frames

• Freely distributable Omnivore Viewer with export to uncompressed QuickTime, AVI or sequential images

•

•

32GB

Contact us to arrange a demonstration

Watch the 6-minute video at http://www.oceansystems.com/os/stanleycup/

Investigators process over 5,000 hours of Stanley Cup Riot video with Omnivore

Out� t your � rst responders and forensic video analysts!