Friday, April 13, 2012

Space/time Catch-22: Why we are winning

There seems to be some confusion about how things seemed to change after this Tuesday. People are questioning whether the suspect changed his schedule, was taken into custody, or whether this is an entirely new person. I contend none of these are true. Based solely on temporal data, it's highly likely this is still the same person on the same schedule.

Let's factor out all the white noise and look at just the call-ins/e-mails. In other words, let's ignore the location and number of threats, and just focus on when a series of threats was made, regardless of number in the series. The data indicates while there is some variance, the threats are still occurring within the suspect's usual time frame.

Now this may have some people screaming "now he'll vary up his schedule!" which I find to be more or less irrelevant. There is almost a zero percent chance this person gets caught from the e-mail sent times.

Furthermore, I find this data to be rather encouraging. Think about this carefully. The suspect is caught in a bit of a catch-22. If we agree his motive is maximum disruption, then he has to focus on certain buildings at certain times (i.e. dorms at night). This of course places his threats in an incredibly predictable temporal and spatial pattern. Win for us. If his motive is chaos and random impact, then while his temporal and spatial patterns may be frustratingly random, they may end up causing minimal disruption (i.e. Soldiers & Sailors, empty locked buildings, etc.) So again, win for us. 

Again, stay strong, Pitt community! You can see the pickle this person is in. It's only a matter of time as I'm sure the authorities are breathing down his neck. I'll repeat myself: the best thing that can happen is he gives us more data to work with. It may cause some short-term pain, but it will almost certainly help us catch the guy by finals.

PS: I was going to make a Facebook group, but it seems one has already been made.
PPS: I'm pretty sure we'll pass 500,000 hits by the end of the day. UPDATE: Passed 500,000 right before 10PM. Everyone's support, commentary (and criticism!) has been amazing. Tons of credit goes to those working on the Google Doc and keeping it up to date. Mad brains in this town.

INVESTIGATION UPDATE (by Anthony): A group of users at Reddit have begun to explore Mixmaster's capabilities, and track where emails are coming from.  They have discovered that the emails might not have been routed through the nation of Austria, but rather through a server named Austria.  They have also discovered that there are only 19 servers. While their attempts to setup a honeypot have failed, the relatively small number of servers means less searching is needed on the part of the authorities.