7 ms·

Sarin Possibly Discovered in Package at Facebook Mailing Facility

87 points by coloneltcb 7y ago

kabwj 7y ago
Where does someone who thinks mailing Facebook sarin is a good idea get sarin from?
- dsfyu404ed 7y ago
  I'm betting that it's a false positive on a chemically similar substance. Field detection systems for chemicals/drugs/explosives don't tend to prioritize having a low false positive rate because they'd rather be safe than sorry and most customers have enough qualified immunity it doesn't really matter if the security guards dogpile on some little old lady because the system thought her perfume was a bomb.
  - jandrewrogers 7y ago
    This is the best theory. The detectors usually key on specific functional groups characteristic of the molecule rather than the molecule itself. This overfits for a lot of inert chemistry in practice, though they try to pick functional groups that are selective (and cheap to detect).
- trhway 7y ago
  >A machine at a Facebook mailing facility in Menlo Park alerted employees Monday that a package might contain sarin where do one gets such a machine and how one comes with the idea of getting it in the first place. As an employee of a BigCo. such idea has never crossed my mind (and we do have our share of angry/frustrated/on-the-verge-of-nervous-breakdown customers - i mean it is real enterprise software we're dealing in after all :)
  - fipar 7y ago
    I don't know the answer to your questions, but I recently read this and thought you may find it interesting, given your first question, as at some point Kurt Petersen developed devices that scan US mail for anthrax: https://spectrum.ieee.org/geek-life/profiles/kurt-petersen-2019-ieee-medal-of-honor-recipient-is-mr-mems https://spectrum.ieee.org/geek-life/profiles/kurt-petersen-2...
  - tgsovlerkhgsel 7y ago
    You'd get a generic chemical trace detection machine primarily to detect mail bombs, which sounds pretty reasonable when you're any sort of highly visible company. Once you're known enough, you will draw the ire of some unstable person wanting to do bad things to you, no matter what you do.
    - elliekelly 7y ago
      > You'd get a generic chemical trace detection machine Is this what the TSA uses when they swab my dog/my hands? I always assumed it was to look for a bomb but I’ve never asked because I figured using the “b” word at the airport would only bring more trouble.
      - tricolon 7y ago
        I was once pulled aside for secondary screening by the TSA, and I was so bewildered that they asked if I'd taken a cab to the airport—and I had. The agent explained that it's a common cause of false positives like mine—"residue" gets left behind on the seats. I didn't feel like pressing them for more details, though.
      - CaptainZapp 7y ago
        Hand creams can set off that alarm. They often contain glicerine, which can be a compund in explosives.
      - bifrost 7y ago
        I'm not sure what the TSA use but I'm pretty sure they don't really work. I've had multiple friends confirm a negative test for GSR when they'd just been at the shooting range in the same jacket/etc. We still have people accidentally bring guns/knives on planes...
  - dredmorbius 7y ago
    Corporations are, to a large extent, risk externalising engines. An LLC literally has minimising risks (liabilities) in its name. Corporate security, insurance carriers (risk management on sterroids), investors or lenders (also fundamentally risk-oriented), might suggest or require mitigations. Devices are sold through the usual channels: https://duckduckgo.com/?q=mail+screening+chemical+detection&ia=web https://duckduckgo.com/?q=mail+screening+chemical+detection&...
- jandrewrogers 7y ago
  It can be synthesized, it is a simple molecule, though not trivially. There are several ways in which the process could kill an amateur chemist if they weren't very careful, it is significantly more dangerous than DIY explosives.
deleted 7y ago
[deleted]
wlesieutre 7y ago
Submitted title says "two possibly exposed", but article has been updated to say that no one was exposed: >No employees have been exposed to the substance, the Menlo Park Fire District said.
- TallGuyShort 7y ago
  I'm waiting for the update on whether or not it's actually sarin. The article (rightfully) seems to be hedging at this point and referring only to the fact that the machine identified it as sarin, but sadly most readers of online news seem to brush past that...
- ForHackernews 7y ago
  Is that because the mail-screeners are 3rd party contractors, not Facebook employees?
aaron695 7y ago
False positive. Unless the package was afterwards found to be actually very suspicious/stated attack. If it was suspicious then Sarin 'detected', flase positive. Detected and not suspicious, false positive. No word yet on what the package was. (If I trusted the news, we could guess they had more info that it wasn't a false positive but they had to confirm, but false positives get clicks so I'm doubting)
deftnerd 7y ago
Sarin breaks down rapidly in the human body into a metabolite called isopropyl methylphosphonate. IMPA is the first compound for which the laboratories test, and finding it in a blood, urine or tissue specimen has long been considered evidence of exposure to sarin. But that test can be fooled. Isopropyl methylphosphonate is sold commercially by major chemical companies. And IMPA is not only safe to handle but was found by the EPA to be harmless when consumed orally at doses of 3,000 parts per million.
- XMPPwocky 7y ago
  This is nice information, but I don't quite get where you're going with this?
  - deftnerd 7y ago
    Someone who knows this information, which is not hard to find, might have ordered isopropyl methylphosphonate and shipped it to facebook in order to set off a false positive. It's easy to order, unregulated, and most machines out there look for it rather than sarin itself because it's easier to detect.
    - XMPPwocky 7y ago
      I guess, but why that and not just the classic "thing-that-looks-like-a-bomb", if you wanted to cause panic/evacuation? Just seems like a really weirdly specific thing to do.
      - ASalazarMX 7y ago
        "I was handling my fake bombs, one of them must have fallen in the envelope by accident!" is harder to sell than a harmless chemical.
        londons_explore 7y ago
        I could totally imagine some home-chemistry-lab Facebook employee bought this off the web and had it delivered to work because nobody would be home to sign for it.
Diederich 7y ago
Yeah, I was having lunch with a friend nearby and noticed, about two hours ago, a pair of helicopters circling and hovering.
slang800 7y ago
What does Facebook have a mailing facility for? I wasn't aware that they sent or received a large volume of packages.
- reissbaker 7y ago
  For employees to send and receive packages. Most large companies (at least in the Bay Area?) have mail facilities.
  - slang800 7y ago
    Oh, that's cool. I've never worked in a building big enough to need more than a couple people in a mailroom to handle that. Also, I guess I've never had my mail screened for sarin.
    - tgsovlerkhgsel 7y ago
      "Mailing facility" doesn't have to mean "warehouse", it can also be "we want to use more fancy words so we'll call the (large) mail room a mailing facility".
      - tjohns 7y ago
        At the larger bay area companies, it's usually an entire office building dedicated to nothing but processing mail. Similar to college campuses. I think "warehouse" is an appropriate term in these cases. :)
- ma2rten 7y ago
  They have enough employees that they need a central place to receive mail and make sure that it goes to the right place. Also, they scan packages for sarin apparently...
- adrianmonk 7y ago
  A lot of people have all their Amazon Prime stuff (and other online orders) shipped to work. It's better than having it stolen off the front porch while you're not at home. Not sure if Facebook allows this, but most companies I've worked for have been OK with it as long as you don't go overboard.
iamaelephant 7y ago
> Facebook runs all of its mail and packages through a machine that can detect dangerous substances, according to the fire district. That machine notified workers that the package in question might contain sarin. This is very interesting. Is this normal practice at companies of that size? I've worked for medium-large orgs (3,000 people) and never seen anything like this.
- godzillabrennus 7y ago
  Most organizations don't profit from creating news bubbles that incubate hate.
  - Ill_ban_myself 7y ago
    “Incuhater”
- Diederich 7y ago
  FB has well over 30,000 employees now.
- packetslave 7y ago
  Google does... or at least they have a central mail-handling warehouse that "screens" all incoming mail (X-Ray at least, but I wouldn't be surprised if there are other checks they don't advertise). The threat model for high-profile companies is pretty wide-ranging -- everything from the shooting at YouTube HQ to disgruntled or confused people showing up at a random building lobby and causing trouble.
  - the-rc 7y ago
    The Mountain View warehouse is massive, but even "smaller" offices like NYC, which is not that small, have been screening mail for years. It's not just a security measure: employees can relocate from one building to another at any time, so it's just easier for the company to do the final routing. Some places like the headquarters for Walmart and Mayo Clinic also get their own ZIP code.
- 7y ago
mc32 7y ago
Facebook is a target of dissent for good reasons. There are good reasons to protest FB. But hoax threats (and real ones) like these means someone went off the rails. They are no longer functioning within a socially accepted framework. It’s unfortunate that opinions can lead people to despicable actions like these.
- jauer 7y ago
  Facebook is a target of a lot more then dissent: https://fortune.com/2017/06/16/facebook-content-moderators-leak-terrorists/ https://fortune.com/2017/06/16/facebook-content-moderators-l...
- bifrost 7y ago
  I think we as a society have become more agreeable to poor discourse. We have people screaming at eachother in the street due to percieved differences of opinions, thats not acceptable. I'm going to hold out hope that this incident was just a false alarm...
- dgzl 7y ago
  You could argue that Facebook isn't operating in a socially accepted framework either, and that this act is a reaction to their assaults. Not to belittle this crime, of course.

87 points by coloneltcb 7y ago

kabwj 7y ago

Where does someone who thinks mailing Facebook sarin is a good idea get sarin from?

dsfyu404ed 7y ago
I'm betting that it's a false positive on a chemically similar substance. Field detection systems for chemicals/drugs/explosives don't tend to prioritize having a low false positive rate because they'd rather be safe than sorry and most customers have enough qualified immunity it doesn't really matter if the security guards dogpile on some little old lady because the system thought her perfume was a bomb.
- jandrewrogers 7y ago
  This is the best theory. The detectors usually key on specific functional groups characteristic of the molecule rather than the molecule itself. This overfits for a lot of inert chemistry in practice, though they try to pick functional groups that are selective (and cheap to detect).
trhway 7y ago
>A machine at a Facebook mailing facility in Menlo Park alerted employees Monday that a package might contain sarin where do one gets such a machine and how one comes with the idea of getting it in the first place. As an employee of a BigCo. such idea has never crossed my mind (and we do have our share of angry/frustrated/on-the-verge-of-nervous-breakdown customers - i mean it is real enterprise software we're dealing in after all :)
- fipar 7y ago
  I don't know the answer to your questions, but I recently read this and thought you may find it interesting, given your first question, as at some point Kurt Petersen developed devices that scan US mail for anthrax: https://spectrum.ieee.org/geek-life/profiles/kurt-petersen-2019-ieee-medal-of-honor-recipient-is-mr-mems https://spectrum.ieee.org/geek-life/profiles/kurt-petersen-2...
- tgsovlerkhgsel 7y ago
  You'd get a generic chemical trace detection machine primarily to detect mail bombs, which sounds pretty reasonable when you're any sort of highly visible company. Once you're known enough, you will draw the ire of some unstable person wanting to do bad things to you, no matter what you do.
  - elliekelly 7y ago
    > You'd get a generic chemical trace detection machine Is this what the TSA uses when they swab my dog/my hands? I always assumed it was to look for a bomb but I’ve never asked because I figured using the “b” word at the airport would only bring more trouble.
    - tricolon 7y ago
      I was once pulled aside for secondary screening by the TSA, and I was so bewildered that they asked if I'd taken a cab to the airport—and I had. The agent explained that it's a common cause of false positives like mine—"residue" gets left behind on the seats. I didn't feel like pressing them for more details, though.
    - CaptainZapp 7y ago
      Hand creams can set off that alarm. They often contain glicerine, which can be a compund in explosives.
    - bifrost 7y ago
      I'm not sure what the TSA use but I'm pretty sure they don't really work. I've had multiple friends confirm a negative test for GSR when they'd just been at the shooting range in the same jacket/etc. We still have people accidentally bring guns/knives on planes...
- dredmorbius 7y ago
  Corporations are, to a large extent, risk externalising engines. An LLC literally has minimising risks (liabilities) in its name. Corporate security, insurance carriers (risk management on sterroids), investors or lenders (also fundamentally risk-oriented), might suggest or require mitigations. Devices are sold through the usual channels: https://duckduckgo.com/?q=mail+screening+chemical+detection&ia=web https://duckduckgo.com/?q=mail+screening+chemical+detection&...
jandrewrogers 7y ago
It can be synthesized, it is a simple molecule, though not trivially. There are several ways in which the process could kill an amateur chemist if they weren't very careful, it is significantly more dangerous than DIY explosives.

deleted 7y ago

[deleted]

wlesieutre 7y ago

Submitted title says "two possibly exposed", but article has been updated to say that no one was exposed: >No employees have been exposed to the substance, the Menlo Park Fire District said.

TallGuyShort 7y ago
I'm waiting for the update on whether or not it's actually sarin. The article (rightfully) seems to be hedging at this point and referring only to the fact that the machine identified it as sarin, but sadly most readers of online news seem to brush past that...
ForHackernews 7y ago
Is that because the mail-screeners are 3rd party contractors, not Facebook employees?

aaron695 7y ago

False positive. Unless the package was afterwards found to be actually very suspicious/stated attack. If it was suspicious then Sarin 'detected', flase positive. Detected and not suspicious, false positive. No word yet on what the package was. (If I trusted the news, we could guess they had more info that it wasn't a false positive but they had to confirm, but false positives get clicks so I'm doubting)

deftnerd 7y ago

Sarin breaks down rapidly in the human body into a metabolite called isopropyl methylphosphonate. IMPA is the first compound for which the laboratories test, and finding it in a blood, urine or tissue specimen has long been considered evidence of exposure to sarin. But that test can be fooled. Isopropyl methylphosphonate is sold commercially by major chemical companies. And IMPA is not only safe to handle but was found by the EPA to be harmless when consumed orally at doses of 3,000 parts per million.

XMPPwocky 7y ago
This is nice information, but I don't quite get where you're going with this?
- deftnerd 7y ago
  Someone who knows this information, which is not hard to find, might have ordered isopropyl methylphosphonate and shipped it to facebook in order to set off a false positive. It's easy to order, unregulated, and most machines out there look for it rather than sarin itself because it's easier to detect.
  - XMPPwocky 7y ago
    I guess, but why that and not just the classic "thing-that-looks-like-a-bomb", if you wanted to cause panic/evacuation? Just seems like a really weirdly specific thing to do.
    - ASalazarMX 7y ago
      "I was handling my fake bombs, one of them must have fallen in the envelope by accident!" is harder to sell than a harmless chemical.
      - londons_explore 7y ago
        I could totally imagine some home-chemistry-lab Facebook employee bought this off the web and had it delivered to work because nobody would be home to sign for it.

Diederich 7y ago

Yeah, I was having lunch with a friend nearby and noticed, about two hours ago, a pair of helicopters circling and hovering.

slang800 7y ago

What does Facebook have a mailing facility for? I wasn't aware that they sent or received a large volume of packages.

reissbaker 7y ago
For employees to send and receive packages. Most large companies (at least in the Bay Area?) have mail facilities.
- slang800 7y ago
  Oh, that's cool. I've never worked in a building big enough to need more than a couple people in a mailroom to handle that. Also, I guess I've never had my mail screened for sarin.
  - tgsovlerkhgsel 7y ago
    "Mailing facility" doesn't have to mean "warehouse", it can also be "we want to use more fancy words so we'll call the (large) mail room a mailing facility".
    - tjohns 7y ago
      At the larger bay area companies, it's usually an entire office building dedicated to nothing but processing mail. Similar to college campuses. I think "warehouse" is an appropriate term in these cases. :)
ma2rten 7y ago
They have enough employees that they need a central place to receive mail and make sure that it goes to the right place. Also, they scan packages for sarin apparently...
adrianmonk 7y ago
A lot of people have all their Amazon Prime stuff (and other online orders) shipped to work. It's better than having it stolen off the front porch while you're not at home. Not sure if Facebook allows this, but most companies I've worked for have been OK with it as long as you don't go overboard.

iamaelephant 7y ago

> Facebook runs all of its mail and packages through a machine that can detect dangerous substances, according to the fire district. That machine notified workers that the package in question might contain sarin. This is very interesting. Is this normal practice at companies of that size? I've worked for medium-large orgs (3,000 people) and never seen anything like this.

godzillabrennus 7y ago
Most organizations don't profit from creating news bubbles that incubate hate.
- Ill_ban_myself 7y ago
  “Incuhater”
Diederich 7y ago
FB has well over 30,000 employees now.
packetslave 7y ago
Google does... or at least they have a central mail-handling warehouse that "screens" all incoming mail (X-Ray at least, but I wouldn't be surprised if there are other checks they don't advertise). The threat model for high-profile companies is pretty wide-ranging -- everything from the shooting at YouTube HQ to disgruntled or confused people showing up at a random building lobby and causing trouble.
- the-rc 7y ago
  The Mountain View warehouse is massive, but even "smaller" offices like NYC, which is not that small, have been screening mail for years. It's not just a security measure: employees can relocate from one building to another at any time, so it's just easier for the company to do the final routing. Some places like the headquarters for Walmart and Mayo Clinic also get their own ZIP code.
7y ago

mc32 7y ago

Facebook is a target of dissent for good reasons. There are good reasons to protest FB. But hoax threats (and real ones) like these means someone went off the rails. They are no longer functioning within a socially accepted framework. It’s unfortunate that opinions can lead people to despicable actions like these.

jauer 7y ago
Facebook is a target of a lot more then dissent: https://fortune.com/2017/06/16/facebook-content-moderators-leak-terrorists/ https://fortune.com/2017/06/16/facebook-content-moderators-l...
bifrost 7y ago
I think we as a society have become more agreeable to poor discourse. We have people screaming at eachother in the street due to percieved differences of opinions, thats not acceptable. I'm going to hold out hope that this incident was just a false alarm...
dgzl 7y ago
You could argue that Facebook isn't operating in a socially accepted framework either, and that this act is a reaction to their assaults. Not to belittle this crime, of course.