A reality based independent journal of observation & analysis, serving the Flathead Valley & Montana since 2006. © James Conner.

19 September 2017 — 2225 mdt

Observations on the Flathead cyber-extortion incident

The ransom letter, and the experience of a group that paid the ransom. The Flathead Beacon, which is providing outstanding coverage of the event, has the latest details, and links to the extortionist’s ransom letter. The extortionist is the same person or group that hacked Hollywood in recent years. In one case (Variety report) a hacked group paid a Bitcoin ransom, but the hijacked information was released anyway because the hacked had notified the FBI (Variety report). Paying the ransom demanded of the Columbia Falls school district is an option that sober judgment will reject. The task now is mitigating the damage done, and making sure there’s never again an unauthorized opening of the barn door.

Flathead Sheriff Chuck Curry was right to release the ransom letter

Releasing the letter undoubtedly helped convince many that the risk of a school bombing or shooting was virtually nil. Our authorities now need to release verbatim transcripts of the threats, names and personal information redacted. Not releasing that information, perhaps with the intention of not frightening people, is a mistake, for the absence of details results in imaginations running wild. The withholding of information in a time of crisis, or perceived crisis, is a sure prescription for panic.

Whitefish City Manager Adam Hammett, who has been sending out frequent and fairly detailed updates on the incident, today addressed the nature of the threats in a question and answer format:

What was the specific nature of the threats?

The threats that were made involved past school shootings and harming students.

That’s slightly helpful, but not nearly helpful enough. Hammett’s summary, while well meaning, obfuscates rather than clarifies. There’s no substitute for the primary document. Civil servents and law enforcement agents must learn to trust the intelligence and good judgment of the public. The more that people know about the incident, the better our community can cope with the situation.

Giving parents time to return their children to school is the right approach

In Kalispell, the Beacon reported:

Mark Flatau, superintendent of Kalispell Public Schools, said families can keep their students home until they feel safe.

“If you need a couple more days, if you need the rest of the week, that’s fine,” he said. “We will work with you. But the goal is, of course, in the days to come to get us back into a normal routine moving forward.”

Quickly returning to the daily round defeats the extortionist. But returning to normality won’t be easy for some. In their hearts, all parents want assurances that their children will be perfectly safe at school. That’s human nature. But there cannot be a zero probability that children in school will not be harmed by evil acts, accidents, or Acts of God. Perfect safety is impossible. The reasonable objective is a low probability of harm.

Meanwhile, there’s likely to be a gendarme at the schoolhouse door; possibly a tendency to view a stranger carrying a briefcase as a madman approaching with a bomb, or a person pointing a camera at a school (a perfectly legal activity) as a terrorist reconnoitering a target. There may be proposals to require a police permit for photographing children in public places. When fear reigns, the Bill of Rights is considered an enemy of safety, and freedom is the first casualty. That was the mindset after 9/11, and there’s a danger that level of fear and illogic could become manifest again.

There’s also a risk of an outbreak of home schooling. Some parents, young mothers especially, will have a very hard time accepting that sending their children to school can never be perfectly safe. That may result in children being held out of school so long that their education is set back. Or, parents may decide to school their children at home, a practice popular among some strongly religious parents and parents who oppose vaccination. In my judgment, almost all home schooling cheats children of a good education and thus hurts children and the community.

The Flathead is divided over the wisdom of discussing the incident in public

Some believe that any discussion of the incident exacerbated the level of fear and helped the extortionist terrorize children. Others believe that law enforcement’s stinginess with information encouraged rumors and wild speculation, thereby raising the level of fear and helping the extortionist terrorize children. On Facebook, I was criticized for my posts on Flathead Memo. Meanwhile, I received emails, one from a former school board member, thanking me for raising issues and providing analysis. No parent has sent me a message disagreeing with my posts, and decision to post. Nor has any school trustee, school administrator, or law enforcement agent. If anyone has concerns over what I have written, he should get in touch with me. I’ll listen.

This conflict — shut up and trust the powers that be versus speak out when important issues arise; between the authoritarian and libertarian approaches to crisis and controversy — dates to Time Immemorial. During the Vietnam conflict, supporters of the war asserted that criticism of the war aided and abetted the enemy; that it killed American soldiers; that dissent was treason; that the time for discussion of the war was after it was over and won; that everyone had a patriotic duty to support the war, praise the President, and pass the ammunition. In a more subdued form, that conflict exists over today’s wars in Afghanistan and Iraq. And now, thus far with much lower intensity, it has arisen with the school threat incident in the Flathead.

Before the shouts of “Shut up and trust the constable” from the very fearful overwhelm all rational discussion of the extortion incident, and because this won’t be the last time cyber mischief torments the Flathead, there needs to be a thoughtful discussion of what a threat is, and how to evaluate a threat.

Four days ago, based on the information then available, I observed:

Most threats are hoaxes. The damage done is from the reaction to the threat, not from the threat’s being carried out. If someone decides to blow up a school, he’s going to plant the bomb, light the fuse, and perhaps make a last minute warning call from an untraceable burner phone. He’s not going to reduce the probability of success by issuing a threat and losing the element of surprise.

But a criminal might issue a bomb threat in an attempt to extort money, to force the release of a prisoner, or to force a change in public policy. Because Sheriff Curry and school officials are being so tight-lipped, we cannot rule out the possibility that someone is trying to extort money by threatening to blow up a school, shoot a student, or do another bad thing. Our schools, of course, by being shut down, are being held hostage right now. Update, 19 September. This is extortion. The person or group that hacked the Columbia Falls school servers issued a demand for ransom.

Not everyone shares my premise that bombings and shootings are seldom if ever announced. Consequently, my analysis evidently increased the fears of some instead of providing them with a measure of relief. All they remembered from my text was “bomb” and “shooting.” A more sophisticated understanding of risk might have prevented some of that angst.

There will be disagreements over what constitutes safety. In everyday discourse, we speak of risk and safety as subjective, not quantitative, properties. We do not formally distinguish the probability of occurrence from the consequence of outcome. Not infrequently, that leads to confusion and conflict. Fortunately, a more rigorous approach to defining and quantifying risk can provide useful clarity.

In formal risk assessment, the probability (expressed mathematically) of an event’s occurring and the outcome of the event — for example, the probability that a jetliner will crash, and the consequence of the crash (hundreds of dead people) — are examined separately. A conclusion that something is safe — for example, flying a fully loaded 747 over the Super Bowl at halftime — is a conclusion that the combination of the risk of an event and its outcome are acceptable. (Generally, the more awful the outcome, the lower the probability the event will occur must be before the activity is considered safe. Conversely, the greater the reward of a success, the higher the tolerable probability of a failure.)

Flathead Community College, perhaps working with groups such as the American Civil Liberties Union, academic experts in terrorism and law enforcement, and others, is in a position to take the lead on helping the Flathead better understand risk, especially threats regarding schools and public places, and I hope that it does.