---
title: "Mountain Preserve Arson Task Force"
type: "pdf"
year: "2002"
canonical: "/projects/970"
---

# City of Phoenix 

POUCE DEPARTMENT

April 30, 2002

Police Executive Research Forum
Attn: Herman Goldstein Award Selection Committee
1120 Connecticut Ave., NW, Suite 930
Washington, DC 20036
Herman Goldstein Award Selection Committee:
Enclosed you will find eight copies of an application for the Herman Goldstein Award for problem oriented policing. The submission is for the Phoenix Mountain Preserve Arson Task Force. THE task force successfully investigated a serial arsonist that terrorized the Phoenix area for more than a year.

The direct contact for the task force is Lieutenant Robert Handy of the Phoenix Police Department. He can be reached anytime for questions or additional information involving the efforts of the task force. His contact information is listed in the packet.

Thank you for taking the time to review our submission. If Lieutenant Handy or I can be of any assistance during the process, please do not hesitate to contact one of us. I can be reached at (602) 262-6747.

Sincerely,

HAROLD L. HURTT
Police Chief

# Table of Contents

- [City of Phoenix](#city-of-phoenix)
- [Phoenix Police Department Mountain Preserve Arson Task Force Executive Summary](#phoenix-police-department-mountain-preserve-arson-task-force-executive-summary)
- [Phoenix Police Department Mountain Preserve Arson Task Force](#phoenix-police-department-mountain-preserve-arson-task-force)
  - [Scanning:](#scanning)
- [The Phoenix Police Department Mountain Preserve Arson Task Force Page 2](#the-phoenix-police-department-mountain-preserve-arson-task-force-page-2)
- [The Phoenix Police Department Mountain Preserve Arson Task Force Page 3](#the-phoenix-police-department-mountain-preserve-arson-task-force-page-3)
  - [Analysis;](#analysis)
  - [Response (Pre Arrest):](#response-pre-arrest)
- [The Phoenix Police Department Mountain Preserve Arson Task Force Page 4](#the-phoenix-police-department-mountain-preserve-arson-task-force-page-4)
- [Response (Post Arrest):](#response-post-arrest)
  - [Physical Evidence:](#physical-evidence)
- [The Phoenix Police Department Mountain Preserve Arson Task Force Page 7](#the-phoenix-police-department-mountain-preserve-arson-task-force-page-7)
  - [Circumstantial Evidence:](#circumstantial-evidence)
  - [Witness Testimony:](#witness-testimony)
  - [Motive:](#motive)
- [Assessment:](#assessment)
- [The Phoenix Police Department Mountain Preserve Arson Task Force Page 9](#the-phoenix-police-department-mountain-preserve-arson-task-force-page-9)
  - [Agency and Officer Information:](#agency-and-officer-information)

# Phoenix Police Department Mountain Preserve Arson Task Force Executive Summary 

The attached submission for the Herman Goldstein Award for excellence in problem oriented policing is for a task force effort to solve a series of arson fires in the metropolitan Phoenix area. The series of arson fires burned luxury homes that were under construction adjacent to desert preserve land. An unprecedented multi agency effort worked tirelessly for over a year to make an arrest and obtain a 22-count indictment.

The case received intense media scrutiny throughout the investigation as the suspect anonymously taunted victims and law enforcement officials. The suspect created a marketing campaign to garner public support. Property values fell and construction projects were halted throughout the metropolitan area on land near desert preserves. The community's perception of safety was dramatically affected.

The targeted homes bordered thousands of acres of pristine desert land, which offered the suspect a tremendous advantage. Over 150 homes throughout the city were identified as potential targets. The main goal was to stop the fires from occurring. The secondary goal was to identify and arrest the suspect or suspects.

Officers spent hundreds of hours identifying potential targets, educating homeowners, and assisting with security measures. Officers partnered with hiking clubs, mountain bike organizations, and traditional neighborhood groups to educate the public and seek assistance.

The investigative effort involved the analysis of over 1,500 leads where more than 100 people were identified as potential suspects. The task force worked daily around the clock conducting saturation uniformed patrols, covert surveillance, and undercover operations. Hundreds of court orders, subpoenas, and search warrants were executed.

A highly technical undercover construction site was established based on thorough analysis of the suspect's patterns and previous activities. The operation was successful as surveillance teams arrested the suspect after he committed a criminal damage using signature markings of the arsonist.

Two months after the criminal damage arrest, investigators had developed enough information to obtain a 22-count indictment on nine fires and related extortion activities. The case was built using an informant who assisted in secretly recording a confession and the use of the latest DNA technology.

The case had many unique challenges that were eventually overcome. Public concern, political pressure, and media coverage were constant challenges. The arsonist publicly taunted police and secretly met with a journalist who published an "exclusive interview with an arsonist."

A wide variety of officers and investigators were used to put the team together. Many investigators and surveillance people were beat officers who were pulled from patrol duties to work the investigation full time. The officers' combination of working with victims, potential victims, proactive patrols, educational efforts, investigative work and undercover operations were instrumental in solving the case.

# Phoenix Police Department Mountain Preserve Arson Task Force 

## Scanning:

The arson incidents began as isolated cases in which the suspect targeted custom home construction sites on or near Phoenix Mountain Preserve land. The first arson occurred in April 2000. The second, which was preceded by general threats from the suspect, occurred at the same location after reconstruction had begun. Our concerns began to focus on the fires being committed by the same suspect. Two weeks later, the arsonist authored several notes to residents in the area, claiming the fires would continue and were intended to save preserve land from encroaching development. In these declarations, the arsonist claimed to be part of a group calling themselves "CSP." CSP was not a known group and the meaning of the acronym was initially unknown.

Many jurisdictional issues and organizational conflicts for the city arose during the investigation. The weakness of the systems in place for arson investigations was readily apparent. The Phoenix Fire Department had primary jurisdiction on the initial fires. Firefighters, who had little investigative background, were charged with completing what soon would become a complex criminal investigation. To the contrary, the Phoenix Police Department had no formal responsibility for arson cases. During the early stages, investigators focused on the homeowners and construction subcontractors. Police involvement was minimal until after the second fire and subsequent threats were made. Following the second arson, the police department's area manager arranged a meeting with the fire department. Subsequent to this conference, the police department pooled additional personnel and investigative resources with those of the fire department to undertake what would soon become an elaborate and time consuming investigation.

That October and with the inner-agency collaboration still in its infancy, a third arson erupted. With this latest arson came unprecedented media attention, focusing on fires, which were being set in the name of a sinister environmental ideology. Adding to this developing high-profile investigation were the targeted construction sites of million-dollar, custom-built luxury homes of over five thousand square feet, all of which were in vulnerable stages of construction. Workable leads were nonexistent.

By the fourth arson in November, media attention and neighborhood concerns were mounting. In addition, this fourth fire had crossed jurisdictional lines into Scottsdale, Arizona. Neither the task-force investigators nor the media immediately linked the fire in Scottsdale.

By late November, the Phoenix police and fire departments had identified their respective responsibilities for this investigation. The fire department became primarily responsible for processing the fire scenes for point of origin and causation. The police department assumed responsibility for arson-scene perimeters and the follow-up investigation.

That December, the fifth through eighth arsons occurred in Phoenix. By December $21{ }^{5 t}$; the Phoenix Police Department had organized the Phoenix Mountain Preserve Arson Task Force, a multi-agency unit that incorporated the resources of the Phoenix Police Department, Phoenix Fire Department, the Federal Bureau of Investigation, the

# The Phoenix Police Department Mountain Preserve Arson Task Force Page 2 

Scottsdale Police Department, and Scottsdale's Rural Metro Fire Department. The task force began looking at radical environmental groups, both locally and nationally. As the number of arson fires grew, media pressure intensified and the arsonist quickly became a lead news story and topic of radio talk shows, editorials, and news commentaries.

Adding to the existing frenzy, the arsonist sent two letters to focal media outlets on December $28^{\text {th }} \quad$ Each letter boasted of the arsonist's involvement and environmental beliefs. The letters, which incorporated biblical quotes and religious undertones, included valuable information and references known only to the arsonist. Clues, such as the meaning of the acronym CSP-Coalition to Save the Preserves-were revealed. With the media's reluctant cooperation, biblical quotes and the meaning of CSP, which was consistent in all the letters, was not released to become public knowledge.

By January 2001, the arsonist had become yet more brazen. Disguising himself, he blatantly met publicly with a Valley newspaper reporter in a local park. The arsonist gave a full interview to the reporter and portrayed himself as a member of an arsonist group, , dedicated to environmental causes. To prove his credibility, the arsonist had burned yet another home (his $9^{\text {th }}$ ) the preceding night. During the interview, the arsonist revealed information and described evidence the investigators would find at the scene. The reporter used that information to question investigators, victims, and witnesses to determine the arsonist's credibility The reporter's published story of this clandestine interview would soon gain national attention, intensify media coverage, and present many challenges for investigators.

By mid-January 2001, a tenth arson was set in the City of Scottsdale in the Scottsdale Sonoran Desert Preserve. A letter left at the scene by the arsonist claimed this as the second Scottsdale fire, officially linking the Phoenix and earlier Scottsdale fires. The letter also claimed the CSP moniker.

On January 24, 2001, The Phoenix New Times, a local newspaper, published an exclusive interview with the arsonist. The interview described the arsonist as a member of a group of mountain bikers. The article further described the arsonists as a group of four professional people who had families and worked ordinary professional jobs. The interview with the arsonist and follow-up article created extensive public debate on environmentalism, growth management, and journalistic ethics.

The serial arsonistls now became such a public issue, that construction, near the mountain preserves throughout the Valley, was dramatically affected. Property values fell, construction projects were delayed, and current projects incurred enormous security expenses.

Many stakeholders identified. Neighborhood groups became very vocal and influential. Concerns over safety, property values, and quality of life grew as the arsons continued. Politicians became very vocal and started showing up at the fire scenes. Many of the victims were wealthy community members who were very well informed and connected to local officials.

# The Phoenix Police Department Mountain Preserve Arson Task Force Page 3 

## Analysis;

The analysis of the problem evolved overtime as the fires continued, and initially investigative methods were narrowly focused. As the investigation proceeded, the amount of information analyzed grew tremendously.

The following bullet points outline information chronologically and describe how it was examined:

- Resources were pooled. Phoenix Fire Department investigators and Phoenix police officers profiled the initial victims based on location and stage of construction. Several potential victims were contacted and warned about the problem and provided with security assessments.
- Crime analysis became essential. For surveillance purposes, crime analysis was used to identify patterns, such as days of the week, time of day, and other commonalties.
- Motive was analyzed. Early on in the investigation, property owners, contractors, subcontractors, and neighbors were all looked at closely to evaluate any possible complicity.

Organization-membership relationships were considered. As the environmental angle emerged, investigators began looking at extremist environmental organizations, activists, and groups associated with area preserve issues.

- Media coverage became an integral component. Several fires coincided with media coverage. Media members who were sought out by the arsonist were those who published stories and reports with a sympathetic environmental angle. The connection between media coverage and fires was examined thoroughly.

As the case continued, the analysis of the problem broadened our perspective. We continuously learned about groups and individuals who were vehemently opposed to development near the desert preserve areas. Until the fires, these people seemed rather harmless and were ignored by law enforcement. In light of the number of fires and the interview with the journalist, the scope of the investigation widened considerably.

## Response (Pre Arrest):

investigative responses varied throughout the investigation. The goal of the response was to first, stop the fires from occurring and provide a reasonable perception of safety for residents living near preserve land. The secondary goal was to identify, arrest, and prosecute the arsonist or arsonists. A wide variety of reactive, proactive and community efforts were undertaken by hundreds of law enforcement officers and firefighters throughout the metropolitan Phoenix area. The list that follows includes the major efforts undertaken to identify and arrest the arsonistls.

# The Phoenix Police Department Mountain Preserve Arson Task Force Page 4 

Public-meeting records were reviewed. Records from public meetings on the preservation of the Phoenix Mountain Preserve were examined for people who had been vocal about development near the preserve land.

- License plate information was reviewed. Thousands of license plates recorded by surveillances and at guard shacks were entered into a database and analyzed for multiple hits at key locations.
- Suspect profiling was utilized. The FBI profilers in Washington D.C. completed a profile of the suspect.
- Current construction sites and building permits were analyzed.
- A thorough and continuous evaluation of homes under construction near the mountain preserve area was closely monitored and used for surveillance. Over 150 homes were identified as potential targets.
- Building permits were reviewed. It was believed the arsonist was identifying targets in vulnerable stages of construction. Homebuilding permits were examined and tracking systems were developed to flag public inquiries of construction permits Both inperson inquires and Internet inquires were tracked.
- Partnerships with the Development Services Department were formed to streamline inspections and permit requests for homes being built on the preserve
- A potential-suspect database system was developed.
- A database was used to track leads and potential suspects. Over 1500 leads were investigated and over 100 subjects were identified as potential suspects.
- Thousands of telephone records were placed into a database to examine commonalties. Charts and links were developed between potential suspects, media outlets, and others involved in the investigation.
- Information was publicly disseminated.
- Public meetings were held with neighborhood groups in an effort to raise public awareness and get residents to call on suspicious persons.
- Partnerships were formed with hiking and mountain biking clubs. Educational literature was distributed and membership lists were analyzed for potential suspects.

A reward was established. A reward fund was created through public donations and reached $\$ 87,000$. The reward was an attempt to encourage anonymous tips.

Undercover operations were essential.

- Plain-clothes surveillance was conducted in the preserve area with officers posing as hikers and mountain bikers.
- Officers were also utilized for covert surveillance by concealing themselves in the environment throughout the middle of the night in key locations. Three fires occurred during surveillances where officers were watching homes and trails, but not the ones hit by the suspect.
- Officers were placed in homes under construction that were deemed vulnerable or potential targets for the arsonist.
- Based on the sequence of events and timing of the interview with the reporter, it was evident the arsonist was picking up The Phoenix New Times newspaper in the downtown area. Since the interview took place downtown and the timing of the contact with the reporter occurred during the initial distribution of the New Times paper, surveillance of the downtown-area newspaper distribution points was established. Thousands of garage parking stubs were seized and analyzed for fingerprints, security cameras in parking garages were examined, and parking citations were analyzed.

Electronic surveillance equipment was employed.

- Covert surveillance was conducted with sophisticated equipment provided by the U.S. Customs, FBI, Phoenix Police, and the Arizona National Guard.
- Monitoring cameras were set up on preserve trails and homes under construction

Hundreds of court orders and subpoenas were issued. Telephone records, e-mail accounts, and related privileged information about potential suspects were gathered.

Round-the-clock surveillance was used. Several potential suspects were closely monitored until they were eliminated.

Discarded trash was seized. Trash covers were used extensively in several cities on multiple, investigative leads.
y Identity changes became necessary. A complete undercover operation, including complete identity, apartment, and employment, was initiated to infiltrate a close-knit extremist group in a nearby mountain town.

Media coverage was monitored. The media were closely monitored and information was managed and released to coincide with surveillance and undercover operations.

Zoning restrictions were lifted. After recommendations from the police department and residents, the Phoenix City Council endorsed a moratorium to lift temporary fencing restrictions in residential neighborhoods. Previously established zoning codes prohibited the fencing of land that adjoined preserve property or the use of any kind of barbed-wire fencing. The restrictions seriously impeded construction-site security.

T Suspect association with public officials was examined. Based on the published interview with the arsonist, there was widespread belief a firefighter or public safety officer was potentially involved. The arsonist used unique slang words and boasted about knowledge of investigations. This led to extensive follow-up on leads related to government employees.

Using crime data, evidence analysis, and profiles, the task force set up an undercover or mock, construction site in the Phoenix Mountain Preserve. A construction fence surrounded the site, which was closely monitored in real time by surveillance. Using this tactic, the suspect was lured to the site on two occasions and was caught on his second trip to the site on April 20, 2001. The suspect was caught on videotape doing the criminal damage in the name of CSP. He was apprehended a short distance away by surveillance crews who responded to the area after another group of officers observed the activity via night-vision cameras. Once the suspect was arrested and identified, he was released so officers could build a stronger case.

# Response (Post Arrest): 

After the arrest of the suspect, Mark Sands, all task-force efforts were devoted to linking Mr. Sands to each fire. There was little evidence at each fire scene so proving he set the fires was a challenge. Sands and his attorney portrayed him in the media as an educated professional, a soccer coach, a homeowners association board member, in essence, an upstanding citizen. The task force took a multi-facetted approach to link Mr. Sands to the fires through a combination of physical evidence, circumstantial evidence, witness testimony, and motive.

## Physical Evidence:

DNA analysis. The latest form of DNA analysis was used to identify Mark Sands' saliva found on letters sent to the media, including the letter that arranged the meeting with the journalist.

Analysis of media input. Through lengthy analysis of media reports and interviews, a link was made to Sands based on information in the letters that was not in the public domain. For example, the origin of one fire, biblical quotes used in multiple letters, and meanings of acronyms.

# The Phoenix Police Department Mountain Preserve Arson Task Force Page 7 

- Trace evidence Clothing and shoes were seized from Sands' home to be compared with trace evidence at fire scenes.


## Circumstantial Evidence:

Y Personal possessions

- Newspaper clippings, environmental literature, and other evidence found in Sands' possession were used to support the case.
- Video tapes of editorials and news programs related to the arsons were seized from Sands' home.
- Geographic evidence Hiking routes to and from each fire from Sands' house were walked and timed by investigators.
- License plate database Mark Sands' license plate was discovered in the surveillance log database of a home that had been burned by the arsonist. The surveillance log recorded his plate when his car drove by the house to survey arson damage caused two days prior.


## Witness Testimony:

Although there were no eyewitnesses, witness testimony became a very important component.

- Mark Sands observed in the preserve. Through eyewitness interviews, several people identified Sands as walking in the preserve in the middle of the night.
- Friend of Mark Sands turned informant. Investigators were able to gain the confidence of Sands' best friend and turn him into an informant. The informant was used to secretly taperecord conversations with Sands as the investigation continued. After hours of surveillance and recorded conversations, a confession was recorded as Mark Sands talked about the fires while on a hike in the bottom of the Grand Canyon.


## Motive:

Officers were able to build a motive based on a theory of an excitement-based arsonist who could not control himself. They were able to develop a proven history of sexual harassment, hardcore pornographic use, "peeping torn" activity, and surreptitious videotaping of teenage girls in their underwear that supported the theory of an excitement-based arsonist. A multiple year pattern of escalating deviant behavior was discovered that lead up to the month the arsons started. The investigators used multiple avenues to prove the theory that Mark Sands led a double life:

The Phoenix Police Department Mountain Preserve Arson Task Force Page 8

Hundreds of interviews in three states with current and former family members, friends, coworkers, and neighbors.
y Seizure of pornographic evidence and surreptitiously recorded videotape evidence from Sands' home.

Subpoenas of former employers to develop a history of sexual harassment.

Court ordered seizure of material viewed on the Internet by Sands.

# Assessment: 

The result of the investigation was a twenty-one count indictment charging Mark Sands with nine fires and extortion-related activities. He eventually pleaded guilty to all arsonrelated charges and one count of extortion. He was sentenced to 17 years in prison.

The overall investigation was very taxing on city resources. Over \$1,000,000 was spent by the City of Phoenix Police Department alone. Many police officers, detectives, firefighters, and civilian support staff were reassigned to assist with the investigation. The 24-hour-a-day, 7-day-a-week operation utilized thousands of hours of overtime.

Officers and firefighters met with neighborhood groups and victims throughout the investigation. Many strong bonds were forged between the Phoenix Mountain Preserve communities and city employees. Within months of the conclusion of the investigation, neighborhoods returned to normal activities. Construction activity resumed and property values returned to normal levels.

Officers assigned to this taskforce were recruited from patrol and patrol-support squads. The use of beat officers to conduct surveillance and investigations was an integral part of the case, and many became involved before the investigation became high profile. They genuinely cared about the investigation and its effect upon the community, wanting to work it from the start. As the investigation evolved, an organizational decision was made to leave the patrol officers in place and to properly equip and train them for the investigation. Most of their training was accomplished on the job through senior investigators having specific expertise.

The relationship between the fire and police departments improved dramatically during this investigation. Jurisdictional issues concerning fire investigations are currently under review because of this investigation.

Both of the original goals-stopping the fires and arresting the suspect-were accomplished. Initially, the response plan was very broad and included many avenues that were ineffective. However, the taskforce believes that any one of the plans could have been as successful as the mock construction site.

# The Phoenix Police Department Mountain Preserve Arson Task Force Page 9 

With all of the media attention and surveillance of the Valley's mountain preserves, there were concerns of displacement and/or copycat crimes. Six additional arson fires were of concern, but they were eventually not attributed to Mark Sands. Two of the fires were believed to have occurred before Mr. Sands started his arson activity. Another local fire was believed to be an insurance-fraud case. After Sands' arrest, three homes under construction were burned in Tucson, Arizona, 120 miles from Phoenix. CSP graffiti was left at the sites and the homes fit Mark Sands' profile. However, Mr. Sands was under surveillance in Phoenix at the time. Many differences were immediately discovered with the Tucson arsons. The location, style, and composition of the graffiti were all different. The method of ignition was also different from the fire scenes in Phoenix. A link was never established to tie Mark Sands to a place or person in Tucson.

## Agency and Officer Information:

The problem-solving approach to this situation was initially undertaken at the lieutenant level. The Phoenix Police Department adopted the area-manager concept in 1999. Since that time, area managers-lieutenants-have been directly responsible for problem solving in their geographic areas. As it was in this case, the area manager sought information from the fire department and offered police department's assistance.

As the fires continued, it soon became apparent that no individual department group or unit would be able to take full responsibility and complete a successful investigation. Although the fire department had sole responsibility for arson investigations, it soon became evident the fire department was not properly equipped or trained for the complexity they faced.

To assist with this complexity, the area manager sought resources from within the Phoenix Police Department and other agencies. Management personnel from each of the agencies agreed upon a multi-agency task-force concept. They started working the investigation in a cooperative fashion by assigning responsibilities and sharing information. it evolved into a large task-force operation with a common office of operation and accompanying resources. The entire group was organized with and operated on handshake agreements. No MOUs or other agreements were necessary. Any differences were resolved quickly and without serious disruption to the investigation, and all agency personnel and managers focused on the best interests of the case. Details were worked out in the process, and the investigation ran smoothly.

The resources committed to the project were well above and beyond each agency's budget. Budget cuts were made in other areas to absorb the expenses associated with the investigation, and the investigation was given top priority by all involved agencies.

The approach to the problem, the organization of the task force, and the investigation were all centered around fundamental community-based policing and problem-solving models. The area manager and his staff identified the problem, developed a plan, located and coordinated the resources, and solved the problem.

The Phoenix Police Department Mountain Preserve Arson Task Force Page 10

Agency Project Contact Person:
Lieutenant Robert Handy
Area Manager, 63 Squad Area
Desert Horizon Precinct
Phoenix Police Department
16030 North $56^{\text {th }}$ Street
Scottsdale, Arizona 85254
Phone: (602) 534-0343
Fax: (602) 495-3639
e-mail: robert.handy@.phoenix.gov