HS Home 22.10.2002 - Myyrmanni: Net detectives found the bomber by themselves

By Kari A. Hintikka and Ossi Leander

The after-shocks of the bombing at a Vantaa shopping mall on Friday 11th October have rocked the Internet, with calls for closer surveillance of message boards and counter-claims that the Net itself is not to blame, and in any event it is largely unpoliceable.

Less has been written about the way in which Internet-users carried out their own detective work in the hours and minutes following the fatal explosion. Message board members and chatroom users on IRC (Internet Relay Chat - see attached article for an explanation), operating under online aliases, put together crumbs of information and arrived at the name of the culprit well before either the police or the media was in a position to go public. This is the story of how it happened.

FRIDAY

At 20.04 on Friday evening, some 27 minutes after the main concourse at the Myyrmanni shopping mall was turned into a killing field, the first media reports suggested that police believed a bomb may have been detonated.

20.11. An individual using the sign-on pseudonym or "nick" of teme creates and opens up channel #myyrmanni in the real-time Internet multi-user chat network IRC. Thirty-five minutes have elapsed since the explosion.

20.20. Members of the channel ponder whether the Finnish Broadcasting Company will be able to get camera-crews to the shopping mall before the main evening news bulletin at 20.30. There is discussion of what and/or who might be responsible. A few minutes later the media, including rolling teletext services, announce that the death-toll is five.

20.33. A member of the #myyrmanni channel types in a URL that leads allegedly to the first digital photograph taken at the site by a bystander. Less than an hour has passed.

20.53. One of those chatting on the channel, going under the nick of Artisti, brings up the possibility that it was a bomb, rather than the initial speculation that the explosion might have been gas-related.

"Helium doesn't go up like that", he types, in a reference to early reports of the presence in the mall of a clown-show that involved balloons. His suggestion is derided at first.

The members then compare notes on explosive materials and someone gets additional information from the web-site of Ilmapallokeskus, an importer and wholesaler specialising in helium balloons.

21.06. A Jyväskylä student named Mikael Korpela, who uses the online sobriquet simison, establishes a web-dossier on his own server in order to write up the details of events as they happen; news items, images, and background links to bulletin boards, message boards, and the like.

By this stage the #myyrmanni channel on the Ircnet server already has upwards of 150 individual users. The traffic over the next few days is documented in the Statistics link below.

23.46. Elsewhere, on the Kotikemia ("Home Chemistry") message board, user einstein writes (in Finnish): "There's been an explosion at Myyrmanni. Personally I'd suspect a gas explosion, but who knows... I really wouldn't think anyone would set off a blast like that in the middle of a shopping centre". By Sunday morning, it will become clear that einstein is actually the founder and moderator of this particular bulletin-board discussion forum.

SATURDAY

09.19. The Finnish News Agency announces that police are now convinced the Myyrmäki explosion was caused by a bomb.

16.07. A police press conference reveals the information that the perpetrator was "a university student" living in the Greater Helsinki area and under 20 years of age. The man was killed in the blast, and his body was the last to be identified.

The death-toll is now seven, as two have died in hospital overnight. At this point one of the police officers also mistakenly makes a reference to the University of Helsinki. It is later corrected (see below)

With these crumbs of information, the Net detectives get to work immediately, using the popular Google.com search-engine to scan further education establishments in the Metropolitan region that might have courses in subjects linked to explosives, such as chemistry.

They learn that there are only two such places, and Google.com points them towards the Espoo-Vantaa Institute of Technology (EVTEK). Public files on students at EVTEK suggest a couple of possible candidates, based on the sparse police information thus far.

17.30. Mikael Korpela receives private (off-channel) messages on IRC from two individuals about the probable identity of the bomber. One says he saw the police beginning a search of a house in the eastern Vantaa suburb of Tikkurila, and another says he has heard of the search second-hand, from a friend.

17.55. On the Home Chemistry forum, user NaClO3 is among the first to observe: "I hope this wasn't RC's handiwork... we are already easy targets to get this dumped on our doorstep..."

17.59. In a series of private messages, Mikael Korpela and the nick Judanssi exchange information and educated guesses as to the bomber's name and a link to the EVTEK students' database. The name has not been confirmed publicly at this point, and will not be for at least a day.

18.12. The police have completed their search of Petri Gerdt's home in Vantaa. Net-users pool the information at their disposal and the identity of the suspect is firmed up.

19.32. The police announce the suspect is a 19-year-old Finnish student at a local Institute of Technology, who lived in Tikkurila and studied chemistry.

22.38. Korpela's running dossier on the Web has already recorded more than 11,700 hits (the location is linked below). Within another hour, his server exceeds the maximum allowable monthly bandwidth (3 GB!), and he is obliged to shift to another server.

23.07. The first formal mention on an open channel of the correct name of the suspect. It seems highly likely that the identity has been passed around in private messages for some time prior to this, probably from around 17.30 onwards.

News begins to spread in the early hours of the existence of the Home Chemistry forum, a message board specialising in explosives and pyrotechnics.

There are more than 100 postings from RC, and nearly 200 from einstein. With RC "confirmed", largely on the strength of his message board input and the post-blast comments by einstein and others, the attention of the net sleuths begins to turn towards einstein, and to the picture (a bearded figure with Taleban headgear) he places next to his posts.

There is mention of a registered IRC channel of the same name, #kotikemia. This, remember, is late on Saturday night or early Sunday morning. The actual message board exchanges between einstein and RC are made public only on Tuesday.

Several messages from the Home Chemistry forum are copy/pasted to the IRC channel. There is discussion of whether the police should be informed, and whether RC stands for "radio-controlled". In a rather ironic twist to the normal journalistic patterns, the presumably young chatters ponder whether they should notify the media hotlines about what they have come up with.

SUNDAY

01.17 Over at Home Chemistry, einstein observes in a further post on the thread mentioned above that the forum member known as RC has not been in contact for some time, nor has he been seen in print on the Home Chemistry board for a few days.

This same einstein adds that he has "just come from a friend's place, where they said on Teksti-TV (the Finnish Broadcasting Company's teletext service) that the bomber was apparently a 19-year-old male studying chemistry at a college of further education, and living in Vantaa... it sounds awfully like RC."

11.17. By mid-morning, einstein is already resigned to the fact that RC and the bomber are one and the same person. In a thread entitled "RC:n muistoksi" (In Memory of RC), he suggests closing down the forum for a week. One person recommends that it be taken offline completely, as it may contain incriminating evidence and has already attracted some outside attention.

Other posters, many of whom have clearly only discovered the forum in the days and hours since the explosion, point out that closing the site may hamper the police investigation, but they add - quite correctly - that the material is already "in the wild", through IRC users having passed the messages amongst themselves. This particular thread is shown in part in the photo above.

12.00 Details given by the police confirm that the dead suspect was indeed studying at EVTEK.

So...for those still in doubt, which pupils live on public transport routes to and from the Institute? This can be discovered by using the Helsinki City Map Service on the Web, and the Helsinki Metropolitan Area Council's public transport route planner, also on the WWW. Both are in heavy use.

The EVTEK website is completely inundated with hits; it crashes within an hour of the announcement that the suspect was a pupil.

17.00. The Home Chemistry forum is shut down and goes offline.

19.25. Sami Marttila of Rovaniemi, also known on the Net as maailmanmestari (World Champion) has received a back-up of the entire Home Chemistry forum, complete with all discussion areas and all threads. It dates to 15.48, or just over an hour before the shut-down. He gets this via the file-transfer option that is also possible on IRC.

19.33. The Finnish News Agency publishes the name of the suspected bomber. At almost exactly the same moment, Marttila in Rovaniemi republishes the Home Chemistry forum on a local site (see link below).

The forum is in Finnish, and will therefore not be of much interest to our users, but the careful reader will observe that several of the threads have been viewed a very great number of times relative to the number of messages posted or the number of board users.

In one case, a message that was subsequently reported in the media had already been viewed over 9,750 times before the board was shut down. This is ample evidence that a great many new "members" had registered with the board AFTER the explosion and prior to its being shut down, long before its very existence was made public. Marttila's computer snapshot of the site also becomes extremely popular.

22.09. The pseudonym solver has been following the course of events and passing on information throughout the weekend. He sets up his own web-site (see link below), which also contains a full log of the first hours of the IRCnet #myyrmanni channel.

23.10. Mikael Korpela receives word via IRC that a copy of the Home Chemistry forum has been published on Marttila's server. The URL to this site begins to circulate rapidly via e-mail, either as a link or in the form of an HTML attachment - in just the same fashion as the exposé on the boardroom goings-on within telecoms operator Sonera earlier this year.

Helsingin Sanomat / First published in print 20.10.2002