Terrorism scare from bomb threats

Emails received across Bay Area, rest of country seek bitcoin ransoms

It was clumsy and apparently unbacked by real explosives, but a bomb threat emailed to hundreds of businesses, schools and government agencies around the Bay Area and the rest of the country Thursday sent police and first responders scrambling for several hours.

Reports of the threats first came in to the San Francisco Police Department around 10 a.m., officials said, sending officers to “numerous locations” around the city. Soon similar worried calls were rolling in to other police departments in multiple Bay Area cities, including Oakland and Santa Rosa.

By noon, it was clear that the same threat — written in the stilted fashion of Nigerian prince hoaxes of years past, and demanding bitcoin payments to prevent bombs from exploding — had been received all over the nation, from Atlanta and Alaska to New York. It also became clear that there was a strong likelihood there were no bombs.

San Francisco police received more than 20 calls about bomb threats and continued to investigate Thursday afternoon, said Michael Andraychak, a police spokesman.

“No suspicious devices have been found at any locations,” he said. “Part of our investigation will be to determine if our threats are related to those around the country.”

The FBI’s office in Washington, D.C., posted an update on Twitter, advising people “to remain vigilant and to promptly report suspicious activities which could represent a threat to public safety.” Experts said the cyber attack, dangerous or not, was probably more about

getting lucky with someone sending money than blowing up anything or anyone.

“I can’t recall a cyberterrorism threat this widespread before, or one that was combined with a physical threat like this,” said Eric Hodge, director of solutions for Cyberscout, a cybersecurity company.

Other than that, the emails bore the trademark of threats that come in all the time — mostly empty, except to those who give in to ransom demands rather than deleting the message and moving on. Occasionally, hackers lock up a company’s computer system and demand ransom to free it up, but even then most people don’t give in to the attack.

“Thousands of people get these threats all the time every day around the world — I just handled three of them today, and they weren’t about this bomb threat,” Hodge said. “Only about 25 to 30 percent pay the ransom. But in a situation like the bomb threat today, all you need is one click and you win. Think about the overhead cost of sending an email — it’s no overhead at all. If someone sends money, it’s a good payday for a bad guy.”

Thursday’s threats were poorly written, as one began, “I write you to inform you that my man carried the explosive device (lead azide) into the building ... ”

Few places evacuated, but receipt of the threat alone was enough to worry many.

The Northern California Regional Intelligence Center alerted local law enforcement agencies across the state, but there was no panic in the alert. Mike Sena, executive director of the regional intelligence center, called the emails “just unsubstantiated threats” on Thursday afternoon.

“We get these kinds of threats pretty much on a daily basis,” Sena said.

What was unusual about the communiques, he added, was the scale of the operation, and how the suspect, or suspects, was able to “push it out to so many people at one time.”

Brian Jenkins, a terrorism analyst for RAND Corp., said the somewhat measured response to the threats was wise.

“Look, bomb threats are a fairly common occurrence, whether they’re by phone or by email or by postal service,” he said. “There have to be convincing reasons to take these things seriously — otherwise we’d be evacuating buildings around the country hourly. You have to evaluate each one carefully and take a breath before you start sending thousands of people into the streets.”

That having been said, he said even an apparently baseless threat like Thursday’s can result in state or federal threat and terrorism-related charges that could net the perpetrator years in prison.

At least 13 threats had been emailed to numerous locations around San Francisco as of 12:52 p.m., said Supervisor Aaron Peskin, who was briefed on the incident. Muni re-routed buses across the city for several hours but routes returned to normal by Thursday afternoon.

“Dozens” of emails with similar messages and formatting were sent to Bay Area commercial businesses and government agencies, Sena said. He added that it’s unclear whether the email’s author was operating inside the country. Hodge said many of the threats he handles come from Russia, Southeast Asia or other foreign countries.

“That’s what we’re trying to track down right now,” Sena said.

Oakland police fielded multiple bomb threats Thursday, and multiple schools and businesses in Santa Rosa received messages demanding payment in bitcoin or else bombs would detonate, officials said.

Alameda County’s Office of Emergency Services was monitoring the situation and is in contact with the FBI, said Sgt. Ray Kelly, a spokesman for the sheriff ’s office. He added that no buildings in Alameda County were evacuated to his knowledge.

Staff at the Jewish Community Center of San Francisco and San Francisco Fire Credit Union headquarters in Laurel Heights evacuated at 10:15 a.m., said Glenn Gortney, a senior vice president at the credit union.

One company email address received the notice that an explosive device had been hidden within the credit union and asked for payment, prompting employees to call 911, Gortney said. About 100 workers were evacuated from the location within a few minutes of notifying police. Bombsniffing dogs were brought to the credit union, which was given the all-clear at 12:30 p.m.

“It was pretty effortless. Not an eventful evacuation. There was no panic,” Gortney said. “They seemed somewhat unfazed by it.”

Kevin Fagan, Gwendolyn Wu and Megan Cassidy are San Francisco Chronicle staff writers. Email: kfagan@sfchronicle.com, gwendolyn.wu@sfchronicle.com, megan.cassidy@sfchronicle.com. Twitter: @KevinChron @gwendolynawu @meganrcassidy