How Phantom Fireworks Traced An NYC Terror Suspect: Inside The Retailer's Digital Paper Trail

When media reports named suspects in an alleged ISIS-inspired plot near New York City, Phantom Fireworks — a national fireworks retailer — immediately searched its own sales and surveillance records and found a match.

What Phantom Found

Company records show that at 12:46 p.m. on March 2, an 18-year-old identified as Emir Balat entered a suburban Pennsylvania Phantom Fireworks outlet and purchased a single item: a 20-foot coil of green consumer safety fuse for $6.89. At the time of sale, staff said nothing about the transaction appeared out of the ordinary.

Phantom’s surveillance footage appears to show the person believed to be Balat ring a bell at the counter, present a driver’s license to be scanned, sign the printed registration form, pay at the register and leave with a small, plastic-wrapped package.

Why The Sale Mattered

By itself, a consumer safety fuse is not explosive. The company’s vice president and general counsel, Bill Weimer, described the product as thin, green and designed to burn slowly and be extinguished if needed. “It’s called Safety Fuse,” he said. “They’re designed not to chain-ignite or mass detonate.”

Tamerlan Tsarnaev, 26, left, and Dzhokhar Tsarnaev, 19, carried out the Boston Marathon bombings, though at trial, Dzhokhar claimed his older brother was mainly responsible.

What proved consequential was Phantom Fireworks’ long-running recordkeeping system: detailed transaction logs stretching nearly two decades, timestamped receipts, scanned driver’s licenses where required by law, retained registration forms and in-store surveillance video that can be matched to purchases down to the minute.

How Phantom’s System Is Used

When a suspect’s name appears in headlines — particularly when fireworks or improvised devices are alleged to be involved — Phantom employees routinely query the database. Because sales records are timestamped, staff can quickly pull the corresponding video without manually reviewing hours of footage. Weimer said the company does not wait for subpoenas to begin searching its own records once suspects have been publicly identified.

History And Context

Phantom’s reflex to check its records stems from past incidents. After the 2013 Boston Marathon bombings, the retailer’s search showed that one of the Tsarnaev brothers purchased fireworks at a Seabrook, New Hampshire, outlet. Investigators later determined the bombers had harvested powder from consumer products to build pressure-cooker bombs. In the failed 2010 Times Square attempt, the suspect also tried to use consumer fireworks to ignite a larger device.

Phantom operates nearly 100 year-round stores across the United States, plus seasonal tents and wholesale distribution. The tracking system primarily exists to comply with state laws, verify ages and maintain consistent records across many locations, but in cases like this it becomes a consequential digital paper trail for investigators.

Company Reaction

Weimer said the association of fireworks with violent incidents is troubling for the company and for public perception. “It sort of feels like we’ve been invaded,” he said. “Violated is the word I’m looking for.” He added that such incidents can deter customers and harm a business built around celebration.

Bottom line: A seemingly ordinary $6.89 purchase produced a precise timestamp and video that investigators can use — not because the product was explosive on its own, but because Phantom’s recordkeeping created a clear, retrievable trail.