University of Pittsburgh Deluged With Internet Bomb Threats

An anonymous reader writes "The University of Pittsburgh has been plagued with 78 bomb threats (and counting) since February 14. It started low-tech, with handwritten notes, but has progressed to anonymous emails. Nearly every campus building has been a target. The program suspected is anonymous mailer Mixmaster. The university has been evacuating each building when threats come in (day or night), and police departments from around Allegheny County have offered assistance with clearing each building floor by floor with bomb sniffing dogs. There is a popular tracking blog set up by a student as well as a growing Reddit community. Is there any foreseeable defense (forensic or socially engineered) to a situation like this?"

Comments

Defense

[Sperbels]

Defense=stop taking every bomb threat as a credible threat.

Re:Defense

[Bitsy Boffin]

And how do you know which ones ARE credible?

Who is to say this isn't a program of desensitisation, imagine the headlines "Bomb threat ignored, 300 dead"

Re:Defense

[NoobixCube]

And who do you blame when the one you didn't take seriously is real? The Boy who Cried Wolf has two morals, you know. One for the child, to not make frivolous cries for help because someone may not come when you really need them to, and one for the adult, to treat every threat as credible, because this one could be it.

Re:Defense

[Anonymous Coward]

Easy formula: No bomb threats are credible. Actual bombings are in the vast majority of cases not preceded by threats. You might as well evacuate a building every time a squirrel shits on the lawn, because the correlation between that event and an actual bombing is about as strong as it is between bombings and bomb threats.

Re:Defense

[Anonymous Coward]

Stop and use your head. Consider the result, if just once, they don't evacuate and something horrible happens.

Now you understand the problem.

Re:Defense

[Anonymous Coward]

This "desensitization" theory is something I keep hearing, and it's absolutely silly. Ridiculous.

You're saying that someone who wants to maximize impact by catching people off-guard would:

1. Sensitize people to a potential threat
2. Work for a long time to then re-desensitize them to said threat
3. Act.

It seems the net result would be exactly the same if one skipped straight to step 3 without making any threats in the first place.

Re:Defense

[geekoid]

People spend too much time watching movies.

Bombers don't warn people.

Re:Defense

[Anonymous Coward]

I believe he is right. If someone wants to bomb, they will not warn you, they will just do it. Evacuating on a bomb threat is different than evacuating on a bomb tip. If someone tips that there is a bomb, or that they saw something suspicious, they will usually come forward with their name, you'll be able to track them. An anonymous bomb threat is just that, it means nothing. It's as real as the end of the world scenario, and I better hope that you don't let those control your life.

Re:Defense

[alphatel]

Bomb threats are a federal crime. Remailers aren't open proxies, they are servers designed to provide reasonably anonymous mailflow from a source to a destination and they are operated by generally very law-abiding individuals. The US federal gov't can easily step in, ask remailers to either reveal the sender, log the connections or deny. Ultimately no matter how crafty you are, if you hit a remailer with logging, you will get nabbed no matter how many you walk through on your way to breaking the law. You can get away with this once or twice and if you never do it again it's highly unlikely you will ever be found. But 78 times?
Someone is going to get nabbed and sadly, it might not be the person who started the chain.

Re:Defense

[Ihmhi]

Stop and use your head. Consider the result, if just once, they don't evacuate and something horrible happens.

Now you understand the problem.

Okay. Someone is talented enough to make a pipe bomb, but not something to destroy an entire building.

So, they make a whole bunch of them and bury them in the grass on the quad where everyone assembles in an evacuation.

Then, after everyone evacuates and follows the rules...

Re:Defense

[NeverSuchBefore]

Consider this: sometimes there are casualties. That's a fact of life. If something is highly unlikely, then it can probably be safely ignored.

Re:Defense

[icebraining]

Why don't you blame the perpetrator? The person who planted the bomb?

Despite common beliefs, it is actually possible to blame more than one person for the same event.

Re:Defense

[Anonymous Coward]

Yeah, someone with a a high-pay, low-work job with sweet benefits and pensions will get scapegoated, because that's how modern America works. That's the "something horrible" that might happen. It's better to inconvenience thousands of students and waste God-knows how many police man-hours than have some cushy 10% bureaucrat risk losing his job.

Re:Defense

[pinfall]

True, if you get supercrafty its going to be hard to track you. But if you are supercrafty 250 times, you are going to leave the unmistakeable trail of your own demise. Its just fine if you want to play with your exgf, but the feds got money, power, and nasty fking claws.

Re:Defense

[Phat_Tony]

There's another option here. Think, what if you were a bomber who wanted to maximize the terror you could cause? How about get a good voice scrambler and an anonymous email account and then call and email in bomb threats through several layers of proxies, TOR, etc. They evacuate buildings, cause fear, lots of inconvenience. Keep sending the threats, just keep doing it over and over, more frequently, relentlessly, until they end up with no choice but to ignore you, after incalculable time and expense on the fake threats. Maybe for fear of liability for NOT evacuating for threats, they will go to extremes, but just keep sending them until they're disrupting half the class schedule if they have to... make them cancel major sporting events, whatever it takes to make your threats impossible NOT to ignore. THEN, once they're ignoring you, you actually blow some people up exactly when and where you called in a threat.

Then start up with the threats again, and now what do they do?

The idea that a real bomber won't call in the threat to maximize impact isn't valid, because this scenario involves calling in the threat, and maximizes fear over a random non-reported explosion.

For very few actual bombs, you will cause much more fear and inconvenience this way.

Re:Defense

[ceoyoyo]

One amateur bomb in a field full of people can kill a LOT more people that a bomb of similar effort in a building. You wouldn't have to bury it either. Just walk through the crowd and drop a duffel bag in the middle.

Re:Which is why you don't respond to threats

[Anonymous Coward]

The IRA often called in ahead of time about bombs they had placed.

Pitt != Penn State

[DeadCatX2]

University of Pittsburgh is NOT Pennsylvania State University.

And for what it's worth, why would you want to punish an entire school for what a couple administrative and athletic folks have done? There were a lot of people who went to Penn State who were revolted by Sandusky's behavior. These are people with lives, with bills to pay, with careers to start. If anything, punish the athletic program and the administration, which were both complicit in the scandal. But don't punish the professors and students who are just trying to make a living, and who did nothing to contribute to the scandal.

Power Grab

[MrQuacker]

Soon enough someone will catch on that they can really increase their law enforcement power/budget/detail/department, pass some laws, and maybe get rid of some civil rights because of this. If enough people get pissed off enough, they will happily trade some freedoms for making this all go away.

I'm surprised the TSA hasn't jumped in on this, setting up checkpoints and searching people anywhere they want on campus. Its the perfect situation to lend credibility to their viper program.

Re:Only if you want to ruin your administration

[Overzeetop]

Virginia Tech found a domestic murder case in a dorm five years ago, police came, followed standard procedure. Four hours later 30 more students and the assailant were dead after a horrific shooting spree on the opposite side of campus. Nothing like it had ever happened before on any US campus, and probably had never happened anywhere in the US in historical memory. Two of the victims parents sued the school for not notifying the student body earlier to warn them that the domestic violence case they had contained earlier that morning would erupt into the worst school shooting in US history, and won.

You want to know how to destroy a school - stop responding to any threats, credible or not. If a real bomb does go off, the school will never survive.

Re:Only if you want to ruin your administration

[Sperbels]

You want to know how to destroy a school - stop responding to any threats, credible or not. If a real bomb does go off, the school will never survive.

The real threat seems to be the lawyers.