Twitter threats to planes require delicate decisions

At least 16 times in the past four days, a bomb threat on Twitter disrupted travel and frustrated airlines.

Today, American Airlines Flight 1192 from Los Angeles landed safely in Chicago O'Hare at 5:48 p.m. CT after a tweet purportedly from the Islamic State threatened that there was a bomb on the 737-800.

The tweet, written like some others from the terrorist group, said, "@AmericanAir No, There is a bomb on Flight 1192, We Are ISIS, we will (expletive) you guys up, #ISIS"

Also today, a now-suspended Twitter account called @RansomTheThug claimed there was a bomb on board United Airlines flight 223, which was scheduled to travel from Newark, N.J., to Miami Tuesday afternoon. The flight was cancelled two days ago in preparation for the blizzard-like conditions which hit the Northeast Monday night and Tuesday, United Airlines spokeswoman Mary Ryan said.

In previous incidents, searches turned up nothing, but the incidents made plain the power of one person on social media to make big trouble.

Airlines won't comment on how often it happens, and the FBI, which is investigating, won't say who may be tweeting. But it's clear Twitter has given pranksters and terrorists an easy way to cause chaos.

The problem is growing.

"We're seeing these new threats. In terms of the quantity of (online) threats we're seeing now, you just haven't seen it," said Glen Winn, former head of security at Northwest Airlines and United Airlines and an instructor at the University of Southern California School of Aviation Safety and Security.

At least 10 threats were made Monday, some by hacker-type accounts. One led to a JetBlue flight from Boston to Palm Beach being returned to the gate before takeoff. The flight was canceled. The plane was searched and luggage rescreened; nothing hazardous was found.

That followed a weekend of Twitter bomb threats against flights. Sunday, one commercial flight was diverted, and two others were evacuated. Saturday in Atlanta, two flights in the air were escorted to their landings by military F-16 fighter jets after bomb threats were tweeted.

A Delta Air Lines flight from Los Angeles to Orlando was diverted to Dallas on Sunday after a bomb threat was reportedly made via Twitter.

In Seattle, two arriving flights — a JetBlue flight from Long Beach, Calif., and a regional SkyWest jet from Phoenix — were evacuated away from other aircraft after they landed Sunday. "We're still assessing the online threats," said Ayn Dietrick-Williams, spokeswoman for the Seattle FBI office.

Twitter did not respond to a request for comment Tuesday evening.

How serious is an online threat?

"In the history of aviation sabotage, I don't believe there's ever been a threat called in where there's actually been a bomb," said Douglas Laird, a consultant who is a former security director at Northwest Airlines.

Still, airlines refer all threats to their security divisions, which evaluate their credibility based on confidential criteria, Laird said. Depending on the merit of the threat, a flight could be diverted to the nearest airport, so it could be searched with bomb-sniffing dogs, he said.

Airlines are required to report any security threats to a plane that is in or headed for the USA to the Transportation Security Administration. The guidelines for what requires a report were deliberately left vague because the TSA preferred that airlines report too many incidents rather than too few, according to a Government Accountability Office report in 2007.

"They make a judgment call as to whether they should take it seriously or whether there's not complete information to act on," said Jeff Price, associate professor of aviation management at Metropolitan State University in Denver. "They take all threats seriously, but they have to decide whether they should respond and take it to another level," such as diverting the flight.

He says the response is based on how specific the threat is – whether it names an airline, a flight or a destination. "The more specific things get, the more you have to respond," he said.

Last April, a 14-year-old Dutch girl was arrested after she tweeted a terror threat to American Airlines. A Twitter user calling herself Sarah and using the handle @QueenDemetriax tweeted, "@AmericanAir hello my name's Ibrahim and I'm from Afghanistan. I'm part of Al Qaida and on June 1st I'm gonna do something really big."

American Airlines responded from its Twitter account: "@QueenDemetriax Sarah, we take these threats very seriously. Your IP address and details will be forwarded to security and the FBI." The girl was charged in the Netherlands with "posting a false or alarming announcement," according to a news account of the incident provided by Twitter.

The investigations are looking for online "footprints" of the people who sent the threats, Price said. "There are a lot of people going 'You're so stupid,' because they can track the IP address" where an online threat originated. "That's actually what the FBI is doing. You leave an address footprint wherever you go, and those can be followed."

He compared it to "calling in a bomb threat using caller ID" and says Internet service providers are presumably cooperating with the investigation.

"Probably the biggest question people ask is, 'Why such a serious response? Isn't there a way to tell if there's (an actual threat) with all our technology?'" Price said. "It is a balance. You don't want to land every plane that gets a bomb threat. But you want to err on the side of caution. It's always going to be a judgment call."