Thursday, April 5, 2012

Key Findings and informal ACH: April 5

**UPDATE from the Trib** "It appears the perpetrator in today's threats emailed them via a service that routed them through Austria and then to the intended recipients, Pitt police Chief Timothy Delaney said. Police and the FBI are tracing the emails, but that takes time, he said." ...I think the PPG is laying low on this because they're the ones getting e-mailed. Glad the Trib is getting some info.

A lot to discuss today. There’s been some really great observations in the comments section, so I highly encourage everyone to read through them, as I can’t rehash all of the ideas in my posts. Again, I highly recommend everyone at least browse through this Homeland Security Bomb Threat Report. Thanks again to everyone keeping the Google Doc up to date.

Please keep in mind all these evacuations are for student safety. Yes, they suck, but they’re the only way to keep students safe. I’m sure there are plainclothes agents and police watching every single evacuation for suspects. This would be another excellent source of intelligence.

Also, it seems they just re-opened the Chevron Building, but only one entrance is open, and you must show student ID. Very smart move. Kudos to Pitt.

Key Findings to Date:
Ignore colors, they are just markers.
  • As noted previously, the threats are escalating, both from a day-by-day perspective as well as the number of threats received simultaneously.
  • The geographic area of these threats is expanding. See map.
  • While there was a bomb threat to CMU and Point Park, this latest series of threats is focused exclusively on Pitt, even though CMU is nearby.
  • The suspect almost certainly has a schedule. The 9-10AM/5-6PM cycle continually repeats itself. This means the suspect is likely at work or school in between. Conversely, the suspect could be a night worker and sleeping those hours.
  • Furthermore, no threats have come on Saturday or Sunday.

Intelligence Gaps
  • Is this a single individual, or a group?
  • Are they students, faculty (I’m sure the FBI looked into this immediately) or someone else?
  • What is the motive? Is this a prank gone too far, or something strategically planned?
    • Several people have made references to Virginia Tech, the events leading up to it, and the anniversary of the tragedy on April 16.
    • Other approaching dates of significance: Easter (April 8), Anniversary of Columbine Shooting/Hitler’s Birthday (April 20), Earth Day (April 22).
Let’s try to develop some big picture hypotheses, and then discuss their likelihood. I’m not going to go through a formal ACH (analysis of competing hypotheses) because of the limitations of a single analyst (myself), but I do have the minds and thoughts of dozens of very intelligent commentators, so I welcome them to weigh the evidence against certain hypotheses and we’ll see if we can all agree which hypotheses are most likely, or most unlikely. Remember, absence of evidence is not evidence of absence.

1.      This is a student or group of students looking to pull a really big prank. They have no intent of violence They’ve taken it too far, and can’t go back now.
a.       Actions: Stay the course. Continue to ask students for ID to enter certain buildings. Keep an eye on restrooms for suspicious behavior. See if there are any students that happen to enter all of these buildings in a short period of time. 
2.      This is a coordinated, planned test of Pitt’s emergency systems for an actual violent event in the near future.
a.      Actions: Investigate whether any students have shown signs of violence or anger towards staff and peers.
b.      Ramp up security on dates of significance, let only students with valid ID into buildings.

Just thinking about it, I feel the evidence seems to contradict the latter hypothesis, thus making the first one more likely. I'm open to other possibilities though.