Final Post: Social Media, Intelligence and Lessons Learned

The 145 bomb threats that occurred over the course of 10 weeks at the University of Pittsburgh presented a unique challenge to law enforcement officials. The investigation remains inconclusive at this time, but who the perpetrators turn out to be (if they are caught) is largely irrelevant to this final post. I want to briefly discuss some big picture topics and develop lessons learned.

The Resource-Impact Ratio

The resources that went into creating these bomb threats were negligible, but the impact was outstanding. From strictly a monetary perspective, the cost of bomb searches, increased security, and teaching hours lost will likely bump this series of threats into the million-dollar range. But considering the impact in the (very!) unlikely event of an actual bomb detonation, the University probably saw this as a fair trade-off. A good deal.

Unfortunately, not all parents are students shared this view. Perhaps even more so than the monetary loss, the emotional impact was felt even beyond campus. Students’ and parents’ emotions ranged from fear, to anger, to frustration. As the perceived likelihood of a violent act began to recede, students began questioning the reason behind evacuating every building due to what now appeared to be empty threats.

While legal liability and moral obligation certainly played a role in University policy, the ultimate problem was the warning-response threshold being incredibly, ridiculously low. Suppose there were no actual threats, but someone just suspected a threat. Evacuations would still likely be necessary. Any intelligence on a violent act at a national university must be responded to. I encourage educational institutions and law enforcement agencies to reconsider the warning-response criteria.

Social Media as an Intelligence Tool

The “Stop the Pitt Bomb Threats” blog began as a low stakes intelligence analysis exercise. I never thought it would become as big as it did. After the first week of threats, I began looking online for information about all of the bomb threats to date. Even a timeline of events would be a helpful tool for an intelligence hobbyist. Unfortunately, apart from a raw count, no media outlets were tracking this data very closely. So I decided to do it myself.

Perhaps the tool of greatest value of the blog was what users informally called the “Google Doc,” which was the publicly-accessible and publicly-editable spreadsheet of every bomb threat detailing time, day of the week, location, delivery method, and any other piece of data attached to each individual threat. By allowing multiple users to edit the document simultaneously, the data inputs were faster and more accurate than I ever could have imagined.

The result was a hit. Students and teachers, hungry for information on the threats and realizing local media outlets were not providing it, sought out the blog and Google Doc to keep abreast on new developments in the series of threats. Local and national media outlets also took notice. As stated before, the ultimate goal was not to somehow “catch” the person responsible, but rather wage a public awareness campaign against the offender using all public data available. If just one tiny shred of information provided someone with a “lightbulb moment” where they connected the dots and provided law enforcement with a credible lead, then that would make the blog a major success.

While certainly significant information was disseminated to the public from the blog, it now appears it was not helpful in catching the perpetrator. So can social media be used as an intelligence tool? Yes, for rapid compilation and dissemination of information. Unfortunately, that seems to be the extent of its usefulness.

Social Media as an Enemy of Intelligence

Richard K. Betts, a (slightly disillusioned) intelligence scholar, loves to use the phrase “enemies of intelligence.” This does not refer to external physical enemies, but rather inherent problems in the intelligence process that can yield poor analytic results. 

Social media serves as a doubled edged sword in this regard. While it was an excellent method of quickly and accurately compiling large amounts of data, this data was also easily accessible to the perpetrator making the threats. This spawned two major issues.

First, it was believed the perpetrator was targeting locations based upon data and comments from the blog. No, causality was never established, but the possibility still existed, and thus self-censorship was necessary to deny the perpetrator any additional information he or she may not have already known.

However, not all self-censorship was possible, as this brings up the second problem. As the FBI profiler and many others hypothesized, the perpetrator likely enjoyed the power rush that came with making the threats. If this was indeed the case, the perpetrator would also enjoy using social media to learn about the fear, panic, and anger his actions caused. Although Facebook, Reddit, and Twitter are useful platforms, the blog in particular allowed a user to view the full range of campus and parent emotions all in a single place. This very likely continued to feed the perpetrator’s ego.

There were many who contacted me privately asking that I take down the blog or enact a much stronger moderation policy. These conversations were often reasonable, well-articulated, and well argued on both sides. I had several hesitations with shutting down the blog. First, the blog was not the only location to find information or individuals expressing emotions (see: Reddit, Facebook, Twitter, WPTS Radio, any other media where comments were permitted). Additionally, if one blog is shut down, surely another would pop up in its place. This is the nature of the internet.

Concluding Remarks

It is absolutely imperative that law enforcement both locally and nationally take a long, hard look at this case. With bare minimal resources, the perpetrators managed to create a disproportionately high level of disruption. If these kinds of anonymous cyber “attacks” are executed at the macro level, the level of disruption could be off the charts. So four important takeaways to consider:

1.      Re-evaluate the warning-response threshold concerning bomb threats, specifically on the campus of educational institutions.

2.      Law enforcement and university policymakers must establish “best practices” concerning anonymous threats. This series of events has shown beyond a doubt the homeland security instructions on how to deal with bomb threats are grossly insufficient in the cyber age.

3.      Social media is a powerful tool to collect and disseminate information to the public, especially in situations where the media is unavailable to perform its duties (if indeed it is ethical to even do so).

4.      Social media is also a tool a perpetrator can use to collect counter-intelligence. Perpetrators can also use social media to analyze and manipulate public emotions.

Finally, I want to thank everyone for supporting the University of Pittsburgh and the Pitt Police. The commitment that went into collecting and analyzing data on this blog was amazing. As social media has demonstrated, bringing together the brainpower of thousands of individuals can yield incredible results. Hopefully the lessons learned from this situation can help future generations become proactive in combating this kind of criminal activity, rather than allowing institutions to fall into a resource-draining series of unnecessary reactions.

Update: 4/24/12

So it appears the threats have stopped [for now]. I'll be turning off comments later this week and will only update with breaking news. The Google Doc will remain. I'll do one more sign off post later in the week.

Facts, unknowns, and other considerations

Okay, so the most recent news was pretty important. Most people are up to speed on it. I apologize for my earlier knee-jerk reaction "huh?" reaction. It's difficult to make sense of things through certain analytic biases...and, well, emotions certainly. So here's a breakdown as I see it.

The facts:
1. A group calling themselves the "Threateners" e-mailed the Pitt news saying they have stopped the threats because Pitt met its only demand, which was to withdraw the $50,000 reward for information leading to the arrest and conviction of the threatener (take notice of the word choices and informal mannerisms).
2. The group said its threats were only those sent in e-mail, not the "earlier" threats written on bathroom walls. Again, this is what the group says. Whether or not any of this is true is undetermined. The implication seems to be these "Threateners" are attempting to protect or take the heat off of the original pranksters, who the "Threateners" call "some young kid who'd pranked the University."
4. The group accurately predicted gaps in threats throughout the series.
5. This narrative is consistent with the original findings which noted that the threats escalated after the reward was offered.
6. See the rest of the story here. Via Pitt News.

Bottom line: The motive, according to the "Threateners" (all of or most of the e-mail threats to date), has been to make the school rescind the $50,000 reward offered for information on the "original" prankster.

The unknowns:
1. Whether the "Threateners" are telling the truth. Are the "Threateners" also the original pranksters? Are there any copycats in this series of threats? How do the "Threateners" know whether the original threats were by pranksters?
Note: Objectively speaking, if they did indeed accurately predict the gaps in threats, then they are very likely telling the truth. Whether they continue to honor their end of the deal is to be determined.
2. Where we go from here. If this is indeed the end of the threats.
3. What the school, the country, and the world have learned from this incident (this will be an entirely separate post).

Other considerations:
1. There is some evidence to suggest the "Threateners" are an outside group. Consider the following:

• Many of the buildings targeted seemed random, chosen at odd times, or chosen for no good reason (example: school for blind children, locked buildings).
• The Pitt News is not officially a UPitt newspaper. It is an independent publication. So it is not clear why the "Threateners" chose that particular publication to send in their demands, apart from the fact it looks like the school newspaper.

2. Also, and I think this is important, a withdrawal of the reward money does not mean the investigation is over. Which is another "unknown" variable. It's not known whether the "Threateners" understand this, or if they were implying they wanted the investigation to cease as well. In any event, it seems unlikely authorities are going to stop pursuing the "Threateners" at this point.

One last caveat: When I refer to decisions the university makes, keep in mind they are probably being heavily advised by the FBI and authorities, so it's unlikely any decision comes from the university itself.

I may have missed some things. I may update as more facts come to light. If people have evidence to provide, I'll be sure to add it to this post.

FYI: If this is the end of the threats, then this blog will shut down. I will leave the Google Doc up for record keeping.

UPDATE (from Anthony): A Wall Street Journal article sheds some light into Pitt's current actions.  It also reveals that the Rutger's threatener from the 70s was actually caught.  But because the WSJ article seems to be subscription only, here is a Pittsburgh Post-Gazette article detailing the same.

Quick update (4/22/12. 11:00AM)

I know it's been awhile since I've done any actual analysis. This is intentional. Bear with me.

I think this blog has gotten away from its true intent, which was to be a forum on data analysis, patterns, trends, and anything else that would be of value to the public. It's now become a place for ranting, venting, and thoughtless speculation. I encourage everyone to take a deep breath and think critically before posting a comment. This blog is reserved for examination of the data and facts (and to a degree, the law enforcement processes). Rants, raves, and frustrations can be expressed on the Facebook page.

With that said, I don't intend to be a scold, I just want to refocus the blog.

UPDATE (from Anthony): KDKA is reporting that the reward for information leading to the capture of the person behind the bomb threats has now been withdrawn.   The University has declined to comment on why.  Does this represent a break in the case, the escalating cost of the investigation, or something else?

This update comes as a second search warrant has been executed on the couple who has been at the center of recent investigations.  There is no official confirmation or proof that the two are connected.  But both represent significant developments in the case.

UPDATE (from Anthony): The PittNews, the University's campus student run newspaper is reporting that the $50k reward was dropped after an anonymous email was received saying that if the reward was dropped, the threats would stop.  Of note, the email uses the term "we", rather than the singular "I".  Does this indicate a group is behind this, or perhaps just an individual wanting to believe a group is behind this?  Also of note, the University said in the past that it would not negotiate, but has now changed its stance.

UPDATE (from Andrew): This really is an unbelievable turn of events. It's so confusing it's hard to make sense of it. Just because the reward is dropped doesn't mean the investigation ends too...does it? Does this group aim to "protect" every prankster who makes bomb threats? Or every situation where a reward is offered for someone's arrest? And why use more bomb threats as a weapon to protect a bomb threatener? As if that's going to bring clarity to the situation.

And let's not forget these people evacuated a school for blind children. And several dormitories in the middle of a freezing night. And now they're lecturing the school on justice and righteousness? It makes me sick. (Sorry. I tend to avoid rants, see above, but I may have to commit a post just to the utter hypocrisy of this).

I'm also surprised all of this information was made public. I guess it was the Pitt News's call, but still, it's weird that all of this comes to a head now. I'm going to need time to sort through all of this. I won't make a new post until I have something conclusive.

Threats Overnight Bring Total to 147 + Saturday Morning to 155

Overnight, more threats forced the evacuations of major dorms at Pitt, including Litchfield Towers A, B, C, Sutherland, Bruce, Lothrop, PA, Holland, and Panther Halls.  The threats came in at 2:29 AM.

Twitter user Jocelyn (@jcolex0) tweeted this picture, giving those on the outside an idea into what it is like for the evacuating students who are forced out  to the Pete in the middle of the night. (Photo credit: @jcolex0)

From the University of Pittsburgh, a web page dedicated to the bomb threats. Not great, but it's a start.

UPDATE (from Anthony): Thanks to Mark for pointing this out to me.  According to the Google Doc, yesterday's threat, number 131 to Alumni Hall at 1:51PM was found written on the mirror in a men's room bathroom.  This report comes from credible eyewitnesses, but no official media confirmation has been given.  Is this a copycat incident?

In other news, the couple who were subpoenaed last Friday testified regarding the Pitt case.  

In addition, more details are coming out now about the FBI's seizure of a MayFirst People's Link server in the on-going efforts to catch the person sending the anonymous emails that have promoted most of the evacuations. 

UPDATE (from Anthony): Saturday morning around 10:00AM Litchfield Towers, Salk Hall, the Cathedral, PA Hall, Ruskin Hall, and Scaife Hall received threats.  They are currently being evacuated and cleared.  I'll let Andrew handle the next formal blog update in case he has any more to say.  This brings the total count to 155 (counting each Tower as one).

Threats 113-128

Litchfield Towers (3), Sutherland, Bruce, Lothrop, Pennsylvania Halls. 8:02 AM.
Alumni Hall. 1:52 PM.
Cathedral, Posvar, Barco, Chevron, Benedum. 4:29 PM
William Pitt Union, University Club. 6:38 PM

UPDATE (from Anthony):
With the flurry of threats and the lack of a capture or information causing frustrations to build amongst parents and students alike,  many users here and on the Facebook group have expressed a desire to contact their elected officials.   Click here for a publicly editable Google Doc that contains contact information for officials.  Feel free to add any contact information for state, local, or national officials you feel would benefit the community.  Because all of this information is publicly available online anyway, I'm not concerned about it. 

Threats 101-112 + Where to go from here

Hillman Library, Allen Hall, Craig Hall, and Alumni Hall. 11:15AM.
Holland Hall. Barco Law Building. Bellefield Hall. 1:50PM.
Sennot Hall. Mervis Hall. Amos Hall. Pennsylvania Hall. 2:06PM.
Thackeray Hall. 2:45PM.

So we're at 100+ threats. Right now, at this point, there seems to be three prevailing courses of action cropping up in the comments section. (Note, this is the action to take from here out, I won't engage with "we should have done X") I'm not going to side with any particular view, I just want to put the leading views out there so we don't have to revisit the same arguments over and over.

1.  Stop evacuating. Many see these threats as no longer credible (if they ever were). We are playing into the threatener's hands/giving them power by constantly evacuating. If we ignore them, they may stop. Many students feel this way.

2. Continue to evacuate, regardless of credibility. This is the current stance of the university. Even though there are security checks at several buildings, evacuations are still necessary in the insanely remote chance something bad does happen. Many parents feel this way.

3. Some middle ground. Since security checks are already in place, why evacuate if security searched everyone who came in the door? Or, how about just doing searches without clearing the building? I also place the "evacuating into large crowds is just as dangerous" view into this category.

In any of these cases, posting the same comments repeatedly won't change the course of action one way or the other. If you sincerely desire change of policy (or not changing policy) then do what you can to meet with administrators, faculty, student government, or any other powers that be to try to develop a better plan. I'm sure Pitt is trying to do the same thing: provide a safe, sensible, cost-effective method of dealing with this problem until the authorities catch the person. Again, the fact there is no clear motive makes this ten times more difficult.

Lots of great discussion in the comments section. I still intend to improve the forum section, but time has not been on my side lately.

Map Below, credit to km1376. Also a great map in the Google Doc with areas shaded. I like this one for the sheer numbers.

This makes blood shoot out of my eyeballs.

UPDATE (from Anthony): Check out WPTS's exclusive interview with Vice Chancellor Hill as he speaks about the bomb threats plaguing the University.  The WPTS show Ex Post Facto also has a segment discussing the security measures being taken in response at Pitt, amongst other topics.  Give them a listen if you have some free time.

New Threats, 98-99...Can we stop now?

Today threats were received for Chevron and the William Pitt Union, generating an ENS alert and subsequent evacuation. Of particular note is the speed with which both buildings were cleared, under 40 minutes.  This is the fastest any buildings have been cleared--roughly a minute and a half per floor.

Andrew's Thoughts:
So I know I haven't done any in-depth analysis in awhile. I haven't thrown up any cool graphs or charts either. I feel like we're just so close to finishing this stupid thing that any sort of deep analysis is a bit tiring at this point.

I think Mike from the comments sums it up best:
"It went from novelty (Chevron on Feb. 13) to mild amusement (the first few Cathedral threats) to annoyance (daily threats) to uneasiness (multiple threats targeting multiple buildings per day) to frustration (multiple threats per day) to apathy (random, declining threats)."

That's a pretty accurate summary of the campus emotional state. So yea. The perpetrator ought to just quit now. He won't of course. And he'll likely be caught and arrested. If I feel motivated I'll do a better post tomorrow.

UPDATE: Letter from Sen. Bob Casey to Attorney General and Homeland Security.

NB: The unconfirmed non-ENS alerts from Saturday night have been officially confirmed by Pitt.  We have updated our number accordingly

Break in the case?

According to Pittsburgh's CBS affiliate there has been a pretty big break in the case. As evidenced by the elementary design of this blog, I'm no tech wizard, so please feel free to correct me if I get any details wrong (I'll keep it as simple to understand as possible). But sources indicate Mayfirst has been subpoenaed and will provide the FBI the necessary data from their servers to continue their investigation. In other words, finally giving authorities the telecommunications lead they needed.

Lessons learned:
1. Every student has heard this lecture: "Watch what you put on Facebook and the internet! Once it's out there, it never goes away!" This is a two way street. The perpetrator left digital "fingerprints" out there (several digital fingerprints!) that are undoubtedly still located somewhere in the Mayfirst servers. There's no erasing these fingerprints.
2. Perhaps if the threatener had only made one or two threats, it might have been difficult to track. Fortunately for authorities, this isn't really a needle in a haystack situation. Heck, even if they stopped now, it wouldn't really matter, they're still toast. There are several unique threats e-mailed in, at pretty regular intervals. It's not going to be hard to connect the dots on this one.

In short, this is probably the biggest break in the case yet. And it comes at a critical time as finals approach. I don't want to be overly optimistic here, but this guy's days are seriously, seriously numbered now. I only wish I could be there when the Feds knock on his door.

There's still a lot of questions unanswered and hoops to jump through. Heck, it may all trace back to a public computer. But it's still a huge step.

I'll let Anthony fill in anything else, he seems much more technologically fluent than me. See the comments section for more details.

UPDATE: As of 1:00 PM on Tuesday, no bomb threats since 9:30AM yesterday. I think this guy  is spooked (and definitely should be).
UPDATE: No less than 10 minutes after I post that, we get another couple threats. My feelings on this.

Threats 93-95

Well, that's how easy it is to make my posts irrelevant. 


Barco Law Building, Holland Hall, Lothrop Hall. 9:23 AM.


UPDATE (by Anthony): Dean Humphrey has released a statement regarding bomb threats and the challenges to the academic process that are now being address by the University.  Coming into finals week, those who have concerns over the bomb threats and how they may effect their finals' schedule should check out this statement.  View it here.


UPDATE (by Andrew): I'll have some analysis and thoughts later tonight.

BREAKING INVESTIGATION UPDATE (by Anthony): Mayfirst People's Link has been issued a subpoena by the FBI and has now given the FBI access to its servers.  The FBI is now actively looking for trace data that will lead them to the originator of the email address.  This is a huge step for this investigation as it means the FBI is essentially now knocking on the digital door of whomever is behind these bomb threats.  I rarely editorialize on my updates, but it seems to me we may be looking at an identification and arrest in the near future if all goes well.  Furthermore, if the threats today were routed through Mayfirst as threats in the past have been, it means the FBI may be closer than anyone thought to ending this entire drama.  Watch the report on KDKA here.

A break in the action...?

So there have been no bomb threats since early morning Saturday. This is the longest stretch of quiet since the threats began escalating in late March.

This is the result of one of the following:

We can have a little fun, right?

1. The suspect is caught. Maybe someone from recent news stories, but likely someone different. In any event, the "real" suspect, not a copy-cat, is in custody.
2. The suspect is still at large. They are either laying low for a period of time or [wisely] decided to stop once and for all.
Please note: the actual suspect may have stopped when other "suspects" began emerging in order to pin the blame on them. I think this is a distinct possibility that shouldn't be dismissed.

I'm not about to go down the "copycats" road...that's a different problem altogether.

Everyone needs to remain calm in the coming days. Yes, there's some "anniversary" dates in the coming days, but you could make that argument about almost any month. The fact remains: these all started in mid-March. It'd be highly unlikely that anyone would have this kind of build-up, followed by silence, followed by an actual event, especially now that everyone is on high alert and there is significant security at the university. Again, if there actually was any intention of violence, now would be the dumbest time to do it, which doesn't seem to fit with the "planned strategy" hypothesis.

I'm open to debate on this, but again, we're not here to point fingers. Nor are we here to brainstorm worst-case scenarios. We're here to share ideas, and regarding this post, whether or not the actual suspect is in custody or is still at large.

Stay on alert and stay vigilant. There is light at the end of the tunnel.

Unconfirmed Bomb Threats Overnight

Last night I posted in a comment regarding several unconfirmed bomb threats to Bellefied Towers, Bellefield Hall, and the Cathedral of Learning.

This is all according to a Reddit thread and the Pitt Police scanner.  The Pitt Bomb Threats Twitter feed is also reporting the story.  No ENS notification was sent out, but enough first and second hand witnesses have come forward to suggest that the threats did indeed occur, and the University and police did indeed react.

As commenters have pointed out both here and on Reddit, those three buildings were locked and mostly empty at this time of day on the weekend, which may be why no ENS alert was sent out.  Apparently, the builders were locked down and swept, but those inside were asked to sit tight until they were cleared.

What does this mean for the University's response to new threats?  Frick Fine Arts and the Music Hall both received threats whilst empty previously on April 4th, spawning an ENS alert, so the precedent for an alert anyway is there.  Does this represent a new response by the authorities in reaction to threats, or did they just not feel it was worth sending an ENS for mostly empty buildings?

I want to repeat that these threats, as of the writing of this post, remain unconfirmed officially.  So I have not updated the threat count.  Someone will update this post if more details develop.

UPDATE: On the topic of University response, here is an audio interview with a "terrorism expert" from KDKA worth a listen.

INVESTIGATION UPDATE: The Pitt Bomb Threats Twitter feed has linked to a press release put out by the Social Democrats, USA on behalf of the couple who were subpoenaed a few days ago (see the last blog update for more details).  It details the events surrounding the subpoenaing of the couple and calls the University "fascists", naming the organization as the best party  "to force the University of Pittsburgh to abide by the ordinances of the City of Pittsburgh and Allegheny County."  It should be noted that one member of the couple is the secretary of this organization, and the other is the acting director. 

Join the conversation on Facebook

Update: More dorms, up to 92

Litchfield, Bruce, Panther, Pennsylvania and Lothrop Halls. 5:27 AM.

Sources say some other apartments off campus were evacuated. No ENS alerts though. I'll keep you posted.

This is sort of what I was getting at in my previous posts. The past four days all had threats called into dorms at roughly the same time in the early morning. 

Also, according to the PPG, a subpoena was issued in the case. I really can't see these people having anything to do with it. I don't want this to turn into an argument about the LGBT community, so please keep those comments to a minimum. We'll see if this leads anywhere.

Continue to stay strong. Check out the Facebook page too. I'm running out of page space (I wanted to include some polling but seriously don't have room, so I'll add some features like that to the Facebook page). Over 100 have joined just this morning. Hoping to build out some features there soon (hat tip: Rohan who created the page).

Space/time Catch-22: Why we are winning

There seems to be some confusion about how things seemed to change after this Tuesday. People are questioning whether the suspect changed his schedule, was taken into custody, or whether this is an entirely new person. I contend none of these are true. Based solely on temporal data, it's highly likely this is still the same person on the same schedule.

Let's factor out all the white noise and look at just the call-ins/e-mails. In other words, let's ignore the location and number of threats, and just focus on when a series of threats was made, regardless of number in the series. The data indicates while there is some variance, the threats are still occurring within the suspect's usual time frame.

Now this may have some people screaming "now he'll vary up his schedule!" which I find to be more or less irrelevant. There is almost a zero percent chance this person gets caught from the e-mail sent times.

Furthermore, I find this data to be rather encouraging. Think about this carefully. The suspect is caught in a bit of a catch-22. If we agree his motive is maximum disruption, then he has to focus on certain buildings at certain times (i.e. dorms at night). This of course places his threats in an incredibly predictable temporal and spatial pattern. Win for us. If his motive is chaos and random impact, then while his temporal and spatial patterns may be frustratingly random, they may end up causing minimal disruption (i.e. Soldiers & Sailors, empty locked buildings, etc.) So again, win for us. 

Again, stay strong, Pitt community! You can see the pickle this person is in. It's only a matter of time as I'm sure the authorities are breathing down his neck. I'll repeat myself: the best thing that can happen is he gives us more data to work with. It may cause some short-term pain, but it will almost certainly help us catch the guy by finals.

PS: I was going to make a Facebook group, but it seems one has already been made.
PPS: I'm pretty sure we'll pass 500,000 hits by the end of the day. UPDATE: Passed 500,000 right before 10PM. Everyone's support, commentary (and criticism!) has been amazing. Tons of credit goes to those working on the Google Doc and keeping it up to date. Mad brains in this town.

INVESTIGATION UPDATE (by Anthony): A group of users at Reddit have begun to explore Mixmaster's capabilities, and track where emails are coming from.  They have discovered that the emails might not have been routed through the nation of Austria, but rather through a server named Austria.  They have also discovered that there are only 19 servers. While their attempts to setup a honeypot have failed, the relatively small number of servers means less searching is needed on the part of the authorities.

Update: 81-85

Sennott Square, Benedum Hall, Mervis Hall, Soldiers and Sailors (?!), and Alumni Hall. 5:45AM.

UPDATE: Cathedral Evacuated

The Cathedral of Learning has once again received a bomb threat, and evacuations began at 6:38PM.  An ENS alert was sent out at 6:46PM.  This marks the first threat of the Cathedral since increased security measures were put into place, so we will see these new measures play into the clearing of the building.

The threat was found written on a wall in a stairwell.  This is different from the anonymous emails sent in previous threats.

Andrew appeared on the CBS evening news and is quoted as saying, "I just want this to stop.  I love Pittsburgh, I love this community, I love this school.  And it drives me crazy that just one jerk is getting away with this.  It drives me nuts."  Thank you for all your hard work, Andrew!


I will leave any more analysis to Andrew, but will continue to update this post if necessary tonight.

Be smart, stay safe, and report anything suspicious to the police immediately.

UPDATE (by Anthony): The Cathedral has been cleared, but will not reopen until tomorrow at 6AM.  Police scanner issued the all clear around 8:00PM, official ENS sent out at 8:30PM.

UPDATE (by Anthony): I have been contacted by someone who saw and reported the threat in the Cathedral.  She reports to me that the threat read, "BOMB 4-12-12".  The authorities have since removed the threat from the stairwell.

INVESTIGATION UPDATE (by Anthony): FBI questions the Director of the Mayfirst People's Link network, a provider of anonymous Internet remailers.  In this statement, Mayfirst declares that they know nothing about the Pittsburgh threats, do not support the person or the acts of said person, but will not cooperate with any investigation for the sake of Internet freedom and privacy. (Reddit)

Stay vigilant! Nine more threats last night...and seven more by noon...

Litchfield Towers and William Pitt Union (11:30PM)...this one seems obvious, a strike at the location of the police banner makes sense...

Forbes, Ruskin, Lothrop, Pennsylvania & Bruce Halls. ENS alert at 5:36AM.

And like, seven more before noon? I can't even keep up. I'm pretty sure he knows he's getting national media attention. So this blog is just small kindling in this growing fire.

Google Doc for displaced students: https://docs.google.com/spreadsheet/ccc?key=0AnJmLqLtYstjdE1rUW9Qa05GUlFEUG5MQWhreHdCUHc#gid=0

Although I definitely want this guy gone for good, I think his continued threats are only going to build the case against him. He's slowly digging his own grave here.

EDIT (by Anthony): According to the ENS system, Hillman, Frick Fine Arts, David Lawrence, Posvar, the Union, University Club, and Panther Central have all received threats.

The Trib is also reporting that a bomb threat was received today at the Western PA School for the Blind, a non-affiliated organization just off of campus.  It is unclear if this is related or a copycat incident, but either way, it seems particularly cruel.

Frequency of threats (as of 4/12/2012 at 5PM)

 

UPDATE (by Anthony): 6:38PM, a bomb threat is reported and the Cathedral of Learning is evacuated.  Pitt ENS alert sent out around 6:46PM.  I'll provide more details if and when they become available.

BREAKING: Someone connected to Pitt bomb threats taken into custody, sources say

From WPXI.

Don't get too excited. I don't want to jinx this.

According to CBS, Mark Lee Krangle was taken into custody. I'm not sure if the WPXI story refers to the Krangle arrest. Now it seems that way.  Disappointing, because I'm 99% sure Krangle isn't the one making the bomb threats.

But still, it's encouraging we've had "only" five threats in the past two days.

Developing...

Also: I added a Twitter feed. All credit goes to the gentleman running it, he's insanely on top of things. Probably the best journalist working on this right now.

Update: Threats 58-62

So this is how it's gonna be.

Ruskin Hall. Panther Hall. Oakwood Apartments. Center Plaza Apartments. Bouquet Gardens. 4:02 AM.

These ones weren't random. They never were. These were residences targeted late at night on a cold night. Malicious.

The PPG also reports the Chancellor's home was targeted. (Should this make it 63? It actually came before the others.) Things may feel haywire right now. Stay calm.

Analysis coming soon. Don't despair. I think yesterday's "day off" may have provided law enforcement with a key data point.

Update: 4/10/2012

So the Pitt bomb threat story has gone national, as most of us know by now. It is sorta funny to see the national news report on a story that's weeks old, reaching critical levels days ago.

We're approaching the longest period of ENS silence since the threats began escalating. I didn't want to post too much information and provoke any copy-catting, but the AP is reporting there is a person of interest.

Although this sounds promising, an expert told the Trib e-mail tracing has been a "dead end."

But. A rumor was circulating the suspect who wrote the threat at Starbucks was caught. Was it the same guy? We'll see how this shakes out. I don't want to turn this into a gossip source, but I thought that one was at least worth mentioning.

Also, there was a bizarre, barely coherent rant about the Chancellor posted and then taken down. I don't need to post the site, you can look it up if you want. The author seems like a pretty disturbed individual and, again, I don't want to engage or talk too much about it, at least in my primary posts. There's other disturbed individuals out there, no names mentioned, who should also be left for the police to investigate.

A group formed on reddit has been doing the same thing as this blog, making efforts to try to smoke the suspect out. I know people have ideas about setting meetings or traps or tracking the guy down, but I don't want to encourage that. While he almost certainly is a prankster, I'm not so sure I'd be willing to risk angering him or backing him into a corner. People with nothing to lose can be pretty dangerous. This forum isn't meant for investigative vigilantism, but for raising awareness and empowering the public.

A great write-up was done in TIME's newsfeed outlining the role of social media. From the comments by the vice-chancellor, he seems comfortable with it, but cautious about its effects on the overall investigation (which is exactly where I stand as well).

Lots of information and rumors circulating. I am still planning to move this over to a different platform by week's end. Hopefully I won't have to. My fingers are crossed way too hard right now.

I'll keep everyone posted as best as I can. Information is coming in pretty rapidly right now, so something big could break any minute.

Changes coming to blog tonight

I'm changing things here. Not sure to what extent. The Google Doc will definitely stay, but the means of communication need improved significantly from this blogspot madhouse.

Stay tuned.

PS: Bomb threats at Point Park/non-Pitt locations? Should we count these towards the total or just keep the counter as Pitt threats?

Update: Threat 57

Amos Hall. Bruce Hall. Brackenridge Hall. Panther Hall. 4:09 AM.

University Club. 11:14AM.

David Lawrence Hall. Frick Fine Arts. Posvar Hall. McCormick Hall. 12:59PM.

Heinz Chapel, Panther Central, Victoria Hall. 2:29PM.

The ENS guy is pretty much my new best friend. He may even be my only friend.

Please, please, don't start turning the comments section into mudslinging and finger pointing. I'm considering moving to a new platform and/or altering the comments section. This is an open discussion, not intended for moderation, but also not intended for paranoia and fear. Everyone stay calm. We're all in this together. 

I'm going to hold off on any in depth analysis for now. Doesn't seem like this guy has even given anyone time to do so anymore. But I'll just throw down a quick frequency chart for chewing on.

New safety policies

New Pitt safety policies, via Pitt Police:
http://www.police.pitt.edu/

I'm not a student or faculty, so I don't have an opinion on the matter, but I'm sure there will be some lively discussion about it.

Update: Bomb threats 40, 41 and 42

Hillman Library. Sennot Square and Benedum Hall.

I'm not one to make ad hominem attacks, especially on such a glorious day as Easter Sunday, but this guy has no soul. None. I thank the campus police for keeping us safe. None of us want to go do bomb searches on Sunday, let alone Easter Sunday. Those who are celebrating the resurrection today, please pray for this offender, pray for strength for the school and police, and pray for a safe and peaceful conclusion of this hysteria. God bless.

I know, I know, more threats...

I'm considering shutting this down.

Are the benefits to the community > the possible benefits to offender?

I don't know anymore.

Don't worry, I won't make any decisions until after the holiday. If it stays up, I may transfer it to a new/better platform. Regardless, no analytic updates until Monday. Everyone enjoy Easter.

*Update* Wow, incredible support from everyone, but also some good back and forth discussion about the true benefits of putting all the information we have out on social media. I don't think anything like this has been done in real-time on a public level. It does raise a lot of interesting questions about intelligence, transparency, crowd-sourcing and creating possible feedback loops. It would make an awesome thesis topic, no?

I also didn't realize the "therapeutic" value it has to so many people...I guess since I'm neither a student or a parent that didn't occur to me. Okay. I'll take the day off and try to work on this on Monday. Like I said, I'm looking at transferring over to a better system where we can discuss ideas in a more organized way. Happy Easter!

Also take a moment to thank the Pitt police: https://www.facebook.com/We.Support.the.Pitt.Police
Seriously, these guys have been working all day, every day for weeks now trying to get this guy. They have my total support and gratitude.

Update: Bomb threat 32 and 33

Saturday 6:56PM. Frick Fine Arts Building and the Music Building.

First Saturday threat, first weekend threat. Are there really that many students in ANY building 7PM before Easter Sunday? (According to @OaklandZoo, both buildings close at 5PM. Good work.)

On the other hand, the last threat was almost exactly 24 hours ago.

Again, every data point puts the FBI and JTTF one step closer to catching him. This seems like a bad, bad play by the perp.

Part 2: Schedule Analysis - 4/7/2012

Key Findings:

Schedule

• Giving roughly a half hour of time before and after a call, the following schedule analysis was created via data from the Google Doc. Any dual-color blocks indicate an overlap of time, or an exact same time occurrence from week to week.
• The suspect appears to have normal sleep hours, apart from a Litchfield Towers call around 2AM. 
• The suspect also has not made threats on weekends. 
• This is either because they have other activities and interests, or because they know few people are on campus and in classes on weekends (very likely the latter).
• Activity between 12PM and 1PM is rare. Again, the suspect could be taking a lunch break, just like anyone else.
• Wednesday, to this date, has the highest number of threats. Apart from weekends, Tuesday has the least.
• 10:30 AM and 5:30PM (roughly) are key time points. This cycle repeats itself almost daily. It's likely the suspect has normal evening activities or interests and is making the threats before these activities.



Frequency

• At this point, it is highly unlikely the suspect will be out of his hidden location at 10:30 AM or 5:30 PM.
• If the suspect is a student, it is unlikely they have class around 10:30AM, but it is very likely they have an earlier class or an afternoon class before 5PM.
• If the suspect is not a student, they are likely unemployed or only working part time. Consider: tt seems highly unlikely they would be able to leave work around 10AM, and get home in time to set up the requirements to cloak their call, then go back to work. Early afternoon threats are relatively rare, meaning the person is likely taking a shift at work (again, assuming they are NOT a student).
• Key analytic assumption: The suspect is not using a scheduling program that is sending out pre-scheduled threat e-mails at various times. This would mean the suspect would not even need to be at home or near a computer for the threats to be sent and received. While this may seem like a "we're screwed" scenario, I see it as a pretty decent outcome, since at some point, the actual professionals in the FBI and JTTF will find him. Again, in my best estimation, I highly doubt this guy makes it another two weeks without getting caught.

Everyone is welcome to analyze the data. I will publish additional key findings that I find are best supported by the evidence so far. Again: Weekends off. 10:30AM/5:30PM. What do these key data points signify?

Part 1: Spatial Analysis - 4/6/12

Key Findings:

I did not make this excellent map. There are a large number
of very intelligent readers/analysts contributing to this
blog, and I appreciate all their hard work.

• The offender is expanding his or her target radius. 
• The offender is expanding his or her locations targeted.
• Even though expanding and varying locations, the offender still targets the Cathedral of Learning, the symbolic "heart" of the university.
• The targets are pushing west, into UPMC and research building areas. 
• However, all buildings are still primarily University of Pittsburgh buildings and not hospitals, memorials, or non-Pitt residences/businesses.
• This evidence strongly supports that the suspect does indeed have some connection to the university, whether they are a student, employee, or have some unknown motive against the school.

I noted earlier a comment about the possibility of it being a disgruntled/frustrated Western Psych employee. I didn't mean to add insult to injury in any way, and I apologize. I want to make clear that this is JUST a hypothesis, and any UPMC anger directed at Pitt, while possible is unlikely right now given the lack of connecting evidence.

And whoever is keeping that Google Doc up to date, please let me know who you are. That is some freaking amazing work. 

Update: Bomb threats 28, 29, 30 and 31

Aaaaand here we go again. Lothrop, Holland, Forbes, Sutherland, all at 6:26 PM.

Analysis coming soon.

So close...threat #27

I thought we'd go the whole day without a call in. 4:24 at the Cathedral of Learning. So close. I don't care to do any analysis unless something significant arises.

Update from the Chancellor.

Bringing in the cavalry...

From the PPG and Trib: Terror task force involved in Pitt bomb threat investigation

I still say Mulder and Scully could solve this in under 45 minutes.

Again, all quiet this morning. Either perps left for break or were caught. Which is good for everyone. We all could use a break from this insanity.

Afternoon Update: Heading home now for a relaxing, (likely) threat free weekend. I'm feeling positive about the situation. Either they  got caught (best scenario), went home (acceptable scenario), or laid low to throw everyone off (worst scenario). Enjoy the weekend everyone.

Limitations of intelligence analysis

This bomb threat story has been getting a lot of publicity. Students are getting involved, people know what’s going on, and overall, I only give this guy a couple more weeks until he’s caught. He’s on borrowed time at this point.

But a lot of people still feel frustrated, and understandably so. There’s a consensus that more needs to be done. That more information needs to be provided to the public. But the truth, is there likely isn’t much more out there that we don’t already know. In the unlikely event this does indeed escalate, people will be screaming, “Why didn’t the police connect the dots? The signs were obvious! We could have stopped this way earlier!"

In defense of law enforcement, it’s not that simple. I’d like to steal an analogy from a favorite professor of mine. Trying to solve this problem is like trying to put together a puzzle. Except you don’t have the cover of the box, so you don’t know what the puzzle looks like. And to make matters worse, several of the pieces are missing. And to top it off, dozens of pieces from other puzzles are mixed in with yours. Now try putting your puzzle together. Not so easy now, is it?

I tend to agree with the FBI profiler from the Tribune-Review. This is a person that gets excitement from this, a very troubles prankster. Which means we just need to stay the course, remain vigilant, and they will almost certainly be found.

Oh, and as for today's prediction, I think a threat before noon is almost certain. Hoping they take the weekend off though, as they have before.


**UPDATE** So a quiet morning for the first time in awhile. Either they have the guys in custody or there's some sort of odd pattern break. If they do have the right guys in custody, then when did they catch them? Way late last night after the 10PM threat? Seems doubtful.

Update: Threats 24, 25 and 26 (or is it just one big threat?)

For Litchfield Towers A, B and C. 10:10 PM.

Almost exactly 12 hours from the last threat. Interesting. I feel terrible for students trying to study.

Holy cow, there's a TON of comments on here. I really do try to read all of the and compile all the evidence and ideas. I'm going to try to make enhancements to this site as soon as time permits.

Great article in the Trib today...it seems the actual experts on this matter favor the "fun/excitement/bad prank" hypothesis, although again, the school has no choice but to treat this like it might lead to violence.

It's that time of day again

Last night's bomb threats were unprecedented up to this point. There hadn't been any simultaneous threats, let alone TWO simultaneous threats on the same night. It was intense escalation.


However, I just can't imagine more than 3-5 threats at the same time. Anything more than that would be pretty darn resource intensive and require some focused planning (both on the offender's part and the school's part). I posited the question in the comments section of whether it would be possible to empty every building on campus all at one time. Not sure it's possible, or even if the administration would be able to get the gears in motion to make it work. So I think the offender has to acknowledge these limits.


Regardless, judging from the way this has escalated, I think it's highly likely there will be another couple threats tonight. Probably between 5 and 6 PM, on my way home from work, so I won't be able to update this blog until I get home.


Thanks for following everyone. More posts to come.


**UPDATE** Man, has it been a quiet night. I guess s/he took the night off.

Key Findings and informal ACH: April 5

**UPDATE from the Trib** "It appears the perpetrator in today's threats emailed them via a service that routed them through Austria and then to the intended recipients, Pitt police Chief Timothy Delaney said. Police and the FBI are tracing the emails, but that takes time, he said." ...I think the PPG is laying low on this because they're the ones getting e-mailed. Glad the Trib is getting some info.

A lot to discuss today. There’s been some really great observations in the comments section, so I highly encourage everyone to read through them, as I can’t rehash all of the ideas in my posts. Again, I highly recommend everyone at least browse through this Homeland Security Bomb Threat Report. Thanks again to everyone keeping the Google Doc up to date.

Please keep in mind all these evacuations are for student safety. Yes, they suck, but they’re the only way to keep students safe. I’m sure there are plainclothes agents and police watching every single evacuation for suspects. This would be another excellent source of intelligence.

Also, it seems they just re-opened the Chevron Building, but only one entrance is open, and you must show student ID. Very smart move. Kudos to Pitt.

Key Findings to Date:

Ignore colors, they are just markers.

• As noted previously, the threats are escalating, both from a day-by-day perspective as well as the number of threats received simultaneously.
• The geographic area of these threats is expanding. See map.
• While there was a bomb threat to CMU and Point Park, this latest series of threats is focused exclusively on Pitt, even though CMU is nearby.
• The suspect almost certainly has a schedule. The 9-10AM/5-6PM cycle continually repeats itself. This means the suspect is likely at work or school in between. Conversely, the suspect could be a night worker and sleeping those hours.
• Furthermore, no threats have come on Saturday or Sunday.

Intelligence Gaps

• Is this a single individual, or a group?
• Are they students, faculty (I’m sure the FBI looked into this immediately) or someone else?
• What is the motive? Is this a prank gone too far, or something strategically planned?
• Several people have made references to Virginia Tech, the events leading up to it, and the anniversary of the tragedy on April 16.
• Other approaching dates of significance: Easter (April 8), Anniversary of Columbine Shooting/Hitler’s Birthday (April 20), Earth Day (April 22).

Let’s try to develop some big picture hypotheses, and then discuss their likelihood. I’m not going to go through a formal ACH (analysis of competing hypotheses) because of the limitations of a single analyst (myself), but I do have the minds and thoughts of dozens of very intelligent commentators, so I welcome them to weigh the evidence against certain hypotheses and we’ll see if we can all agree which hypotheses are most likely, or most unlikely. Remember, absence of evidence is not evidence of absence.

1.      This is a student or group of students looking to pull a really big prank. They have no intent of violence They’ve taken it too far, and can’t go back now.

a.       Actions: Stay the course. Continue to ask students for ID to enter certain buildings. Keep an eye on restrooms for suspicious behavior. See if there are any students that happen to enter all of these buildings in a short period of time. 

2.      This is a coordinated, planned test of Pitt’s emergency systems for an actual violent event in the near future.

a.      Actions: Investigate whether any students have shown signs of violence or anger towards staff and peers.

b.      Ramp up security on dates of significance, let only students with valid ID into buildings.

Just thinking about it, I feel the evidence seems to contradict the latter hypothesis, thus making the first one more likely. I'm open to other possibilities though.

Update: Bomb threats 20, 21, 22, 23

And, right on cue at 10:12 AM.

Cathedral of Learning, Chevron Building, Frick Fine Arts and Posvar Hall.

I'll do a full update on my lunch break.

Data Dump

First, I appreciate everyone spreading the word and getting these ideas out there. This blog went live Tuesday morning, and judging by the comments alone, it's gotten a ton of hits and great ideas/links being share (such as this Homeland Security analysis of bomb threats, a must read).So keep it up, and feel free to create your own blog and analysis and share it with everyone. I'm only one guy with a day job, and considering how frequent these threats have gotten, it's been tough to keep up. If all this does is serve as a record of events for some people, I'm fine with that.


*UPDATE* Now on Google Docs: https://docs.google.com/spreadsheet/ccc?key=0AlvhxmKEu6UpdGZURVFqRTc2NENqVGp3QWxUZ1hOU3c#gid=1


This will probably be out of date by noon, but I figured it would be best to create a timeline of threats to date. Keep in mind these times may be slightly off, as I'm going by when the text threat was received in my phone's inbox.

Here's how it looks from a frequency perspective:

Again, all comments welcome, I'd like to address some of them shortly, primarily the ones recommended using some different analytic tools (ACH, red-team/blue-team). 


Final thought: Great move by the University to just close the Cathedral until morning. 

Update: Bomb threats 17, 18 and 19

At Victoria Hall, Frick Fine Arts Building and Music Building.

I'm struggling to keep up. I'll get to some more analysis and reply to some comments tomorrow. Hopefully I'll have time over lunch.

You could put an entire team on this and still be busy.

Update: Bomb threats 14, 15 & 16

No, that is NOT a typo. Bomb threats at Cathedral of Learning, Posvar Hall, and Litchfield Tower C.

I nailed the time again (I predicted a threat in the early evening based on trendlines) but three at once caught me totally off guard. I'll do a full post later tonight, but it seems the perps are significantly escalating their activity. Which, one one hand, sucks really bad for the campus, but on the other hand, it's only a matter of time before they get caught, especially at this rate.

More details to come...

Update: Bomb threat #13 at Thackeray Hall

Looking back to last week, there were two bomb threats last Wednesday, March 28. I was thinking there was a high likelihood of another occurring today, likely around 10:30 AM. Just as I was tweeting out my thoughts, sure enough, the ENS called and said there was a general bomb threat for Thackeray Hall.

So I nailed the time element (and note, I anticipate another today, sometime in the afternoon or evening). The location is new though, but still within the radius of previous threats. 


I know this isn't the sexiest visualization available, but I do have a day job.


I'm actually really surprised no threat was called in during Congressman Altmire's presentation at the Soldiers and Sailors museum last night. It seems the perpetrators aren't aiming for particular events or situations, but rather just hoping that the sheer volume of threats will cause as much chaos as possible. More to come I'm sure.

Criticism of process so far...

From the Post Gazette: 

More bomb threats disrupt Pitt routine

A few non-intelligence related points.

First, I think Chancellor Nordenberg is doing the right thing by giving the green light to evacuate the buildings for every bomb threat, regardless of how trivial or unlikely they seem. This is a pretty ridiculous situation and is sucking up time and resources, but he's morally (and legally) obligated to defer to student safety first.

However, I have some concerns about the rest of the process. I think the investigation needs to be way more transparent than it is. These aren't state secrets, it's likely a bunch of troubled kids looking for fun. So when the Emergency Notification System warns of a "general bomb threat" that's ALL the information the students are given. Tell us more! Where were the threats found? What kind of writing utensil was used? Was it new or old writings? Did the e-mail threat lead anywhere? What was the e-mail address? Where does it lead? Are there any suspects or leads? What the heck are we supposed to be looking for?

Right now, the student body (and public) is in the dark on this. I understand some level of confidentiality is important, but until the student body is 100% behind this effort, it's going to continue to disrupt classes and cost the school an insane amount of time and money.

Spatial Analysis

Key Findings:

• Seven of the twelve bomb threats were located at the Cathedral of Learning, the symbolic center of campus.
• The perpetrators expanded into other buildings as time passed, but all remain University of Pittsburgh buildings.

• Note: Carnegie Mellon University is nearby. Tighter security at this school may be the reason it hasn't been targeted, but if the perpetrators are Pitt students, it is unlikely they are familiar with the CMU campus, or have the proper access.
• While Cathedral of Learning bomb threats were mostly found in men's rooms, all threats outside of the Cathedral were found in women's rooms.
• Either one of the perpetrators is a woman, which is highly unlikely (statistically), OR
• There is a single male perpetrator who is bold enough to enter restroom's, but not necessarily at a central, crowded building like the Cathedral of Learning. He goes into women's restrooms in "emptier" buildings on the outskirts of campus
• In this scenario, it is also likely that the perpetrator began to see a ramp up in security at the Cathedral and expanded to other buildings
• Finally, it is likely if there is more than one perpetrator, one of them could keep watch while the other wrote threats in women's restrooms. This scenario seems increasingly more unlikely as students are becoming more annoyed by the bomb threats, and thus more suspicious of unusual activity.

April 3rd Update: 3rd threat in single day

I don't think there can be any doubt these threats are becoming more frequent. This is the first time we've had three threats in a single day. All were at different locations. My initial confidence in these being late night occurrences seems undermined by these new developments.

Timeline/Temporal Analysis

Key Findings:

• The frequency of bomb threats is increasing.
• There is a correlation between when the reward was announced and the escalation of threats.
• The majority of threats are reported in the mornings around 10:00 AM written on bathroom stalls. This indicates it is very likely these were written at night and only discovered in the morning (see Intelligence Gaps below).
• The threats went on hiatus after the shooting at Western Psych, although it is likely the very first bomb threat in February was unrelated to this current string of threats.
• There does not appear to be any clear pattern on the day of the week these threats occur.

Intelligence Gaps:

• It is unknown when exactly the threats were written in the bathrooms. The threat itself (writing on the bathroom stall), discovery of said threat, and reporting to the public could all potentially occur at different times.

Supporting Data:

Coming soon (April 3rd early evening): Spatial Analysis

Intro

This is an open blog about finding and stopping these bomb threats which have terrorized the University of Pittsburgh campus for well over a month now. Although these threats started to become regular March 14, 2012, they actually started back in February.

Most recent threat occurred literally as I was writing this:  http://www.pittsburghlive.com/x/pittsburghtrib/news/breaking/s_789612.html

I'm going to use some intelligence analysis techniques and provide some key findings and actionable plans for decision makers.

Disclaimer: I am in no way affiliated with the University of Pittsburgh. The FBI and campus police are already engaged in an intense investigation. I am merely an intelligence analyst who wants to take a shot at figuring this out. All views and opinion are strictly my own.