University of Pittsburgh Deluged With Internet Bomb Threats

An anonymous reader writes "The University of Pittsburgh has been plagued with 78 bomb threats (and counting) since February 14. It started low-tech, with handwritten notes, but has progressed to anonymous emails. Nearly every campus building has been a target. The program suspected is anonymous mailer Mixmaster. The university has been evacuating each building when threats come in (day or night), and police departments from around Allegheny County have offered assistance with clearing each building floor by floor with bomb sniffing dogs. There is a popular tracking blog set up by a student as well as a growing Reddit community. Is there any foreseeable defense (forensic or socially engineered) to a situation like this?"

Comments

Defense

[Sperbels]

Defense=stop taking every bomb threat as a credible threat.

Re:Defense

[Bitsy Boffin]

And how do you know which ones ARE credible?

Who is to say this isn't a program of desensitisation, imagine the headlines "Bomb threat ignored, 300 dead"

Re:Defense

[NoobixCube]

And who do you blame when the one you didn't take seriously is real? The Boy who Cried Wolf has two morals, you know. One for the child, to not make frivolous cries for help because someone may not come when you really need them to, and one for the adult, to treat every threat as credible, because this one could be it.

Re:Defense

[Sperbels]

Desensitization to what? Why would a real bomber warn anyone? I'm wondering... in the whole country, how many bomb threats actually turned out to be real? Have there even been any real ones? At some point we just have to say this is ridiculous and ignore them.

Re:Defense

[Anonymous Coward]

Stop and use your head. Consider the result, if just once, they don't evacuate and something horrible happens.

Now you understand the problem.

Re:Defense

[Anonymous Coward]

This "desensitization" theory is something I keep hearing, and it's absolutely silly. Ridiculous.

You're saying that someone who wants to maximize impact by catching people off-guard would:

1. Sensitize people to a potential threat
2. Work for a long time to then re-desensitize them to said threat
3. Act.

It seems the net result would be exactly the same if one skipped straight to step 3 without making any threats in the first place.

Re:Defense

[Spudley]

Why would a real bomber warn anyone?

Many terrorist groups routinely send bomb warnings when they have planted a bomb. During the troubles in Northern Ireland, the practice was so common that the IRA and the police had recognised code words they could use so that the police would know it was a real bomb rather than a hoax call.

Re:Defense

[alphatel]

Bomb threats are a federal crime. Remailers aren't open proxies, they are servers designed to provide reasonably anonymous mailflow from a source to a destination and they are operated by generally very law-abiding individuals. The US federal gov't can easily step in, ask remailers to either reveal the sender, log the connections or deny. Ultimately no matter how crafty you are, if you hit a remailer with logging, you will get nabbed no matter how many you walk through on your way to breaking the law. You can get away with this once or twice and if you never do it again it's highly unlikely you will ever be found. But 78 times?
Someone is going to get nabbed and sadly, it might not be the person who started the chain.

Re:Defense

[Ihmhi]

Stop and use your head. Consider the result, if just once, they don't evacuate and something horrible happens.

Now you understand the problem.

Okay. Someone is talented enough to make a pipe bomb, but not something to destroy an entire building.

So, they make a whole bunch of them and bury them in the grass on the quad where everyone assembles in an evacuation.

Then, after everyone evacuates and follows the rules...

Re:Defense

[hrvatska]

Easy formula: No bomb threats are credible. Actual bombings are in the vast majority of cases not preceded by threats. You might as well evacuate a building every time a squirrel shits on the lawn, because the correlation between that event and an actual bombing is about as strong as it is between bombings and bomb threats.

I have no idea what the ratio of warnings of bombings to actual bombings is, but there are certainly examples of groups that issued warnings before they bombed. The US group the Weather Underground did.

The bombing attacks mostly targeted government buildings, along with several banks. Most were preceded by evacuation warnings, along with communiqués identifying the particular matter that the attack was intended to protest. For the bombing of the United States Capitol on March 1, 1971, they issued a communiqué saying it was "in protest of the U.S. invasion of Laos." For the bombing of the Pentagon on May 19, 1972, they stated it was "in retaliation for the U.S. bombing raid in Hanoi." For the January 29, 1975 bombing of the United States Department of State building, they stated it was "in response to escalation in Vietnam."

The IRA frequently sent warnings before it bombed.

The bombing of the King David hotel in Jerusalem on July 29, 1946, was allegedly preceded by warnings. Menachem Begin claimed that three warnings were sent out on July 22nd 1946 about the planned attack to keep casualties to the minimum. Warnings were sent by telephone, including one to the hotel's own switchboard, which the hotel staff decided to ignore, but none directly to the British authorities. A possible reason why the warning was ignored was that hoax bomb warnings were rife at the time. The British did not evacuate the hotel and the bombing killed 91 people and injured 45. Imagine the repercussions for the University of Pittsburgh if it ignored a bomb warning and 91 people died and 45 were injured.

Re:Defense

[Smallpond]

I believe he is right. If someone wants to bomb, they will not warn you, they will just do it.

Wrong. The IRA routinely planted actual bombs AND reported them, because it caused just as much fear and disruption and didn't turn as many people away from them.

Re:Defense

[pinfall]

True, if you get supercrafty its going to be hard to track you. But if you are supercrafty 250 times, you are going to leave the unmistakeable trail of your own demise. Its just fine if you want to play with your exgf, but the feds got money, power, and nasty fking claws.

Re:Defense

[Phat_Tony]

There's another option here. Think, what if you were a bomber who wanted to maximize the terror you could cause? How about get a good voice scrambler and an anonymous email account and then call and email in bomb threats through several layers of proxies, TOR, etc. They evacuate buildings, cause fear, lots of inconvenience. Keep sending the threats, just keep doing it over and over, more frequently, relentlessly, until they end up with no choice but to ignore you, after incalculable time and expense on the fake threats. Maybe for fear of liability for NOT evacuating for threats, they will go to extremes, but just keep sending them until they're disrupting half the class schedule if they have to... make them cancel major sporting events, whatever it takes to make your threats impossible NOT to ignore. THEN, once they're ignoring you, you actually blow some people up exactly when and where you called in a threat.

Then start up with the threats again, and now what do they do?

The idea that a real bomber won't call in the threat to maximize impact isn't valid, because this scenario involves calling in the threat, and maximizes fear over a random non-reported explosion.

For very few actual bombs, you will cause much more fear and inconvenience this way.

Re:Defense

[Altrag]

Absolutely not. Surprisingly enough, most people aren't all that excited about murdering dozens or hundreds of innocents. Some will do so with enough provocation, and you get the odd psychopath who really is hell-bent on killing, but for the most part the idea of a "terrorist" is to spread "terror", not outright kill people. Killing people spreads terror to be sure, but there are other ways to do so that don't involve destroying your own soul (or not so much of it, at least.)

With your 3-step program, the goal step is actually step 2 -- a drawn out period of time when your target is afraid of you without you having to do much to incite the fear. Only after you've dragged out step 2 as long as you can possibly manage are you forced to move on to step 3 and reset the cycle.

The entire world, primarily the US, are mired somewhere in the middle of step 2 still after 9/11. There's no reason for terrorist cells to risk attacking the US again until Homeland Security finally runs out of new ways to disrupt American life. The terrorists can just sit back and laugh as internally you all work yourselves into a paranoid frenzy, and externally you run around starting wars with random nations whose primarily link to terrorism is a shared religious background.

Re:Defense

[ceoyoyo]

One amateur bomb in a field full of people can kill a LOT more people that a bomb of similar effort in a building. You wouldn't have to bury it either. Just walk through the crowd and drop a duffel bag in the middle.

Re:Defense

[Arrepiadd]

And so did ETA in Spain. In fact, when after the bombings in Madrid people started pointing fingers at ETA, one of the first things that was offered as a rebuttal was their track record at informing of previous bombings.

Re:Defense

[BeardedChimp]

While my Mum was still at school in Belfast, they were getting daily/weekly bomb threats for a quite a while. The headmaster then declared that any time lost due to bomb scares would be made up at the end of term over summer. The bomb threats stopped immediately...

Re:Defense

[Tom]

The US federal gov't can easily step in, ask remailers to either reveal the sender, log the connections or deny.

You obviously don't know anything about remailers. I operated one for a few years, so allow me to say what should've been blatantly obvious:

The operator can not identify the sender. Mixmaster is a type II remailer. Those are specifically designed to make such attacks unfeasable, and continue to operate and provide anonymity even in the event that one or several remailers in the chain have been subverted.

Re:Which is why you don't respond to threats

[Anonymous Coward]

The IRA often called in ahead of time about bombs they had placed.

Re:Which is why you don't respond to threats

[jfengel]

Actually, some do. The IRA was famous for telling people where their bombs were going to be. Real bombs, too. It achieves an awful lot of terror with less blood on your hands: they know that the bomb could have gone off. As long as there's some blood on your hands, your opponents know that you're willing to do it. Most of the terror, far less mess.

The goal of terrorism is to make people so upset that they give in to your demands. In this case, it may be simply to make people upset. It's working very well.

Not just Pitt

[DeadCatX2]

Lots of universities in the Pittsburgh area are getting bomb threats. I know CCAC is getting a bunch of them, too. They're now checking everyone's bags when they go into the building.

Re:Only if you want to ruin your administration

[Overzeetop]

Virginia Tech found a domestic murder case in a dorm five years ago, police came, followed standard procedure. Four hours later 30 more students and the assailant were dead after a horrific shooting spree on the opposite side of campus. Nothing like it had ever happened before on any US campus, and probably had never happened anywhere in the US in historical memory. Two of the victims parents sued the school for not notifying the student body earlier to warn them that the domestic violence case they had contained earlier that morning would erupt into the worst school shooting in US history, and won.

You want to know how to destroy a school - stop responding to any threats, credible or not. If a real bomb does go off, the school will never survive.

Re:Only if you want to ruin your administration

[Sperbels]

You want to know how to destroy a school - stop responding to any threats, credible or not. If a real bomb does go off, the school will never survive.

The real threat seems to be the lawyers.

Re:Which is why you don't respond to threats

[horza]

The IRA were as pissed as the police with false bomb threats as theirs would be taken less seriously, hence the IRA giving code words to go along with the threat so the police could verify it was from them.

Phillip.