Friday, April 27, 2012

Final Post: Social Media, Intelligence and Lessons Learned

The 145 bomb threats that occurred over the course of 10 weeks at the University of Pittsburgh presented a unique challenge to law enforcement officials. The investigation remains inconclusive at this time, but who the perpetrators turn out to be (if they are caught) is largely irrelevant to this final post. I want to briefly discuss some big picture topics and develop lessons learned.

The Resource-Impact Ratio

The resources that went into creating these bomb threats were negligible, but the impact was outstanding. From strictly a monetary perspective, the cost of bomb searches, increased security, and teaching hours lost will likely bump this series of threats into the million-dollar range. But considering the impact in the (very!) unlikely event of an actual bomb detonation, the University probably saw this as a fair trade-off. A good deal.

Unfortunately, not all parents are students shared this view. Perhaps even more so than the monetary loss, the emotional impact was felt even beyond campus. Students’ and parents’ emotions ranged from fear, to anger, to frustration. As the perceived likelihood of a violent act began to recede, students began questioning the reason behind evacuating every building due to what now appeared to be empty threats.

While legal liability and moral obligation certainly played a role in University policy, the ultimate problem was the warning-response threshold being incredibly, ridiculously low. Suppose there were no actual threats, but someone just suspected a threat. Evacuations would still likely be necessary. Any intelligence on a violent act at a national university must be responded to. I encourage educational institutions and law enforcement agencies to reconsider the warning-response criteria.

Social Media as an Intelligence Tool

The “Stop the Pitt Bomb Threats” blog began as a low stakes intelligence analysis exercise. I never thought it would become as big as it did. After the first week of threats, I began looking online for information about all of the bomb threats to date. Even a timeline of events would be a helpful tool for an intelligence hobbyist. Unfortunately, apart from a raw count, no media outlets were tracking this data very closely. So I decided to do it myself.

Perhaps the tool of greatest value of the blog was what users informally called the “Google Doc,” which was the publicly-accessible and publicly-editable spreadsheet of every bomb threat detailing time, day of the week, location, delivery method, and any other piece of data attached to each individual threat. By allowing multiple users to edit the document simultaneously, the data inputs were faster and more accurate than I ever could have imagined.

The result was a hit. Students and teachers, hungry for information on the threats and realizing local media outlets were not providing it, sought out the blog and Google Doc to keep abreast on new developments in the series of threats. Local and national media outlets also took notice. As stated before, the ultimate goal was not to somehow “catch” the person responsible, but rather wage a public awareness campaign against the offender using all public data available. If just one tiny shred of information provided someone with a “lightbulb moment” where they connected the dots and provided law enforcement with a credible lead, then that would make the blog a major success.

While certainly significant information was disseminated to the public from the blog, it now appears it was not helpful in catching the perpetrator. So can social media be used as an intelligence tool? Yes, for rapid compilation and dissemination of information. Unfortunately, that seems to be the extent of its usefulness.

Social Media as an Enemy of Intelligence

Richard K. Betts, a (slightly disillusioned) intelligence scholar, loves to use the phrase “enemies of intelligence.” This does not refer to external physical enemies, but rather inherent problems in the intelligence process that can yield poor analytic results. 

Social media serves as a doubled edged sword in this regard. While it was an excellent method of quickly and accurately compiling large amounts of data, this data was also easily accessible to the perpetrator making the threats. This spawned two major issues.

First, it was believed the perpetrator was targeting locations based upon data and comments from the blog. No, causality was never established, but the possibility still existed, and thus self-censorship was necessary to deny the perpetrator any additional information he or she may not have already known.

However, not all self-censorship was possible, as this brings up the second problem. As the FBI profiler and many others hypothesized, the perpetrator likely enjoyed the power rush that came with making the threats. If this was indeed the case, the perpetrator would also enjoy using social media to learn about the fear, panic, and anger his actions caused. Although Facebook, Reddit, and Twitter are useful platforms, the blog in particular allowed a user to view the full range of campus and parent emotions all in a single place. This very likely continued to feed the perpetrator’s ego.

There were many who contacted me privately asking that I take down the blog or enact a much stronger moderation policy. These conversations were often reasonable, well-articulated, and well argued on both sides. I had several hesitations with shutting down the blog. First, the blog was not the only location to find information or individuals expressing emotions (see: Reddit, Facebook, Twitter, WPTS Radio, any other media where comments were permitted). Additionally, if one blog is shut down, surely another would pop up in its place. This is the nature of the internet.

Concluding Remarks

It is absolutely imperative that law enforcement both locally and nationally take a long, hard look at this case. With bare minimal resources, the perpetrators managed to create a disproportionately high level of disruption. If these kinds of anonymous cyber “attacks” are executed at the macro level, the level of disruption could be off the charts. So four important takeaways to consider:

1.      Re-evaluate the warning-response threshold concerning bomb threats, specifically on the campus of educational institutions.
2.      Law enforcement and university policymakers must establish “best practices” concerning anonymous threats. This series of events has shown beyond a doubt the homeland security instructions on how to deal with bomb threats are grossly insufficient in the cyber age.
3.      Social media is a powerful tool to collect and disseminate information to the public, especially in situations where the media is unavailable to perform its duties (if indeed it is ethical to even do so).
4.      Social media is also a tool a perpetrator can use to collect counter-intelligence. Perpetrators can also use social media to analyze and manipulate public emotions.

Finally, I want to thank everyone for supporting the University of Pittsburgh and the Pitt Police. The commitment that went into collecting and analyzing data on this blog was amazing. As social media has demonstrated, bringing together the brainpower of thousands of individuals can yield incredible results. Hopefully the lessons learned from this situation can help future generations become proactive in combating this kind of criminal activity, rather than allowing institutions to fall into a resource-draining series of unnecessary reactions.