However, his use of Tor would mean the authorities wouldn't know which surveillance video to look at. He was caught because they probably assumed the threat wa

However, his use of Tor would mean the authorities wouldn't know which surveillance video to look at. He was caught because they probably assumed the threat was an internal hoax, checked the logs and found only one or a few internal users on Tor at the right time, then got a police officer to ask each of them if they had done anything wrong [1]. One confessed, and there you go. Morale of the story: don't do illegal things, and if you do want to do illegal things, have a cover story and don't admit things based on inferences from investigators. [1] In fact, they probably overrepresented the evidence and then left him to talk himself into being convicted.