The 145 bomb threats that occurred over the course of 10
weeks at the University of Pittsburgh presented a unique challenge to law
enforcement officials. The investigation remains inconclusive at this time, but
who the perpetrators turn out to be (if they are caught) is largely irrelevant
to this final post. I want to briefly discuss some big picture topics and
develop lessons learned.
The Resource-Impact
Ratio
The resources that went into creating these bomb threats were
negligible, but the impact was outstanding. From strictly a monetary
perspective, the cost of bomb searches, increased security, and teaching hours
lost will likely bump this series of threats into the million-dollar range. But
considering the impact in the (very!) unlikely event of an actual bomb
detonation, the University probably saw this as a fair trade-off. A good deal.
Unfortunately, not all parents are students shared this
view. Perhaps even more so than the monetary loss, the emotional impact was
felt even beyond campus. Students’ and parents’ emotions ranged from fear, to
anger, to frustration. As the perceived likelihood of a violent act began to
recede, students began questioning the reason behind evacuating every building
due to what now appeared to be empty threats.
While legal liability and moral obligation certainly played
a role in University policy, the ultimate problem was the warning-response
threshold being incredibly, ridiculously low. Suppose there were no actual
threats, but someone just suspected a
threat. Evacuations would still likely be necessary. Any intelligence on a
violent act at a national university must
be responded to. I encourage educational institutions and law enforcement
agencies to reconsider the warning-response criteria.
Social Media as an
Intelligence Tool
The “Stop the Pitt Bomb Threats” blog began as a low stakes
intelligence analysis exercise. I never thought it would become as big as it
did. After the first week of threats, I began looking online for information
about all of the bomb threats to date. Even a timeline of events would be a
helpful tool for an intelligence hobbyist. Unfortunately, apart from a raw
count, no media outlets were tracking this data very closely. So I decided to
do it myself.
Perhaps the tool of greatest value of the blog was what
users informally called the “Google Doc,” which was the publicly-accessible and
publicly-editable spreadsheet of every bomb threat detailing time, day of the
week, location, delivery method, and any other piece of data attached to each
individual threat. By allowing multiple users to edit the document
simultaneously, the data inputs were faster and more accurate than I ever could
have imagined.
The result was a hit. Students and teachers, hungry for
information on the threats and realizing local media outlets were not providing
it, sought out the blog and Google Doc to keep abreast on new developments in
the series of threats. Local and national media outlets also took notice. As
stated before, the ultimate goal was not to somehow “catch” the person
responsible, but rather wage a public awareness campaign against the offender
using all public data available. If just one tiny shred of information provided
someone with a “lightbulb moment” where they connected the dots and provided
law enforcement with a credible lead, then that would make the blog a major
success.
While certainly significant information was disseminated to
the public from the blog, it now appears it was not helpful in catching the
perpetrator. So can social media be used as an intelligence tool? Yes, for
rapid compilation and dissemination of information. Unfortunately, that seems
to be the extent of its usefulness.
Social Media as an
Enemy of Intelligence
Richard K. Betts, a (slightly disillusioned) intelligence
scholar, loves to use the phrase “enemies of intelligence.” This does not refer
to external physical enemies, but rather inherent problems in the intelligence
process that can yield poor analytic results.
Social media serves as a doubled edged sword in this regard.
While it was an excellent method of quickly and accurately compiling large
amounts of data, this data was also easily accessible to the perpetrator making
the threats. This spawned two major issues.
First, it was believed the perpetrator was targeting
locations based upon data and comments from the blog. No, causality was never
established, but the possibility still existed, and thus self-censorship was
necessary to deny the perpetrator any additional information he or she may not
have already known.
However, not all self-censorship was possible, as this
brings up the second problem. As the FBI profiler and many others hypothesized,
the perpetrator likely enjoyed the power rush that came with making the
threats. If this was indeed the case, the perpetrator would also enjoy using
social media to learn about the fear, panic, and anger his actions caused.
Although Facebook, Reddit, and Twitter are useful platforms, the blog in
particular allowed a user to view the full range of campus and parent emotions
all in a single place. This very likely continued to feed the perpetrator’s
ego.
There were many who contacted me privately asking that I
take down the blog or enact a much stronger moderation policy. These
conversations were often reasonable, well-articulated, and well argued on both
sides. I had several hesitations with shutting down the blog. First, the blog
was not the only location to find information or individuals expressing
emotions (see: Reddit, Facebook, Twitter, WPTS Radio, any other media where
comments were permitted). Additionally, if one blog is shut down, surely
another would pop up in its place. This is the nature of the internet.
Concluding Remarks
It is absolutely imperative that law enforcement both
locally and nationally take a long, hard look at this case. With bare minimal
resources, the perpetrators managed to create a disproportionately high level
of disruption. If these kinds of anonymous cyber “attacks” are executed at the
macro level, the level of disruption could be off the charts. So four important takeaways to consider:
1.
Re-evaluate the warning-response threshold
concerning bomb threats, specifically on the campus of educational
institutions.
2.
Law enforcement and university policymakers must
establish “best practices” concerning anonymous threats. This series of events
has shown beyond a doubt the homeland security instructions on how to deal with
bomb threats are grossly insufficient in the cyber age.
3.
Social media is a powerful tool to collect and
disseminate information to the public, especially in situations where the media
is unavailable to perform its duties (if indeed it is ethical to even do so).
4.
Social media is also a tool a perpetrator can
use to collect counter-intelligence. Perpetrators can also use social media to
analyze and manipulate public emotions.
Finally, I want to thank everyone for supporting the
University of Pittsburgh and the Pitt Police. The commitment that went into
collecting and analyzing data on this blog was amazing. As social media has
demonstrated, bringing together the brainpower of thousands of individuals can
yield incredible results. Hopefully the lessons learned from this situation can
help future generations become proactive in combating this kind of criminal
activity, rather than allowing institutions to fall into a resource-draining series
of unnecessary reactions.
