Part 2: Schedule Analysis - 4/7/2012

Key Findings:

Schedule

• Giving roughly a half hour of time before and after a call, the following schedule analysis was created via data from the Google Doc. Any dual-color blocks indicate an overlap of time, or an exact same time occurrence from week to week.
• The suspect appears to have normal sleep hours, apart from a Litchfield Towers call around 2AM. 
• The suspect also has not made threats on weekends. 
• This is either because they have other activities and interests, or because they know few people are on campus and in classes on weekends (very likely the latter).
• Activity between 12PM and 1PM is rare. Again, the suspect could be taking a lunch break, just like anyone else.
• Wednesday, to this date, has the highest number of threats. Apart from weekends, Tuesday has the least.
• 10:30 AM and 5:30PM (roughly) are key time points. This cycle repeats itself almost daily. It's likely the suspect has normal evening activities or interests and is making the threats before these activities.



Frequency

• At this point, it is highly unlikely the suspect will be out of his hidden location at 10:30 AM or 5:30 PM.
• If the suspect is a student, it is unlikely they have class around 10:30AM, but it is very likely they have an earlier class or an afternoon class before 5PM.
• If the suspect is not a student, they are likely unemployed or only working part time. Consider: tt seems highly unlikely they would be able to leave work around 10AM, and get home in time to set up the requirements to cloak their call, then go back to work. Early afternoon threats are relatively rare, meaning the person is likely taking a shift at work (again, assuming they are NOT a student).
• Key analytic assumption: The suspect is not using a scheduling program that is sending out pre-scheduled threat e-mails at various times. This would mean the suspect would not even need to be at home or near a computer for the threats to be sent and received. While this may seem like a "we're screwed" scenario, I see it as a pretty decent outcome, since at some point, the actual professionals in the FBI and JTTF will find him. Again, in my best estimation, I highly doubt this guy makes it another two weeks without getting caught.

Everyone is welcome to analyze the data. I will publish additional key findings that I find are best supported by the evidence so far. Again: Weekends off. 10:30AM/5:30PM. What do these key data points signify?

Data Dump

First, I appreciate everyone spreading the word and getting these ideas out there. This blog went live Tuesday morning, and judging by the comments alone, it's gotten a ton of hits and great ideas/links being share (such as this Homeland Security analysis of bomb threats, a must read).So keep it up, and feel free to create your own blog and analysis and share it with everyone. I'm only one guy with a day job, and considering how frequent these threats have gotten, it's been tough to keep up. If all this does is serve as a record of events for some people, I'm fine with that.


*UPDATE* Now on Google Docs: https://docs.google.com/spreadsheet/ccc?key=0AlvhxmKEu6UpdGZURVFqRTc2NENqVGp3QWxUZ1hOU3c#gid=1


This will probably be out of date by noon, but I figured it would be best to create a timeline of threats to date. Keep in mind these times may be slightly off, as I'm going by when the text threat was received in my phone's inbox.

Here's how it looks from a frequency perspective:

Again, all comments welcome, I'd like to address some of them shortly, primarily the ones recommended using some different analytic tools (ACH, red-team/blue-team). 


Final thought: Great move by the University to just close the Cathedral until morning. 

Update: Bomb threat #13 at Thackeray Hall

Looking back to last week, there were two bomb threats last Wednesday, March 28. I was thinking there was a high likelihood of another occurring today, likely around 10:30 AM. Just as I was tweeting out my thoughts, sure enough, the ENS called and said there was a general bomb threat for Thackeray Hall.

So I nailed the time element (and note, I anticipate another today, sometime in the afternoon or evening). The location is new though, but still within the radius of previous threats. 


I know this isn't the sexiest visualization available, but I do have a day job.


I'm actually really surprised no threat was called in during Congressman Altmire's presentation at the Soldiers and Sailors museum last night. It seems the perpetrators aren't aiming for particular events or situations, but rather just hoping that the sheer volume of threats will cause as much chaos as possible. More to come I'm sure.

April 3rd Update: 3rd threat in single day

I don't think there can be any doubt these threats are becoming more frequent. This is the first time we've had three threats in a single day. All were at different locations. My initial confidence in these being late night occurrences seems undermined by these new developments.

Timeline/Temporal Analysis

Key Findings:

• The frequency of bomb threats is increasing.
• There is a correlation between when the reward was announced and the escalation of threats.
• The majority of threats are reported in the mornings around 10:00 AM written on bathroom stalls. This indicates it is very likely these were written at night and only discovered in the morning (see Intelligence Gaps below).
• The threats went on hiatus after the shooting at Western Psych, although it is likely the very first bomb threat in February was unrelated to this current string of threats.
• There does not appear to be any clear pattern on the day of the week these threats occur.

Intelligence Gaps:

• It is unknown when exactly the threats were written in the bathrooms. The threat itself (writing on the bathroom stall), discovery of said threat, and reporting to the public could all potentially occur at different times.

Supporting Data:

Coming soon (April 3rd early evening): Spatial Analysis