Writing and sending a threatening email can take a matter of minutes. Verifying whether the threat contained in the message is credible, however, takes significantly more time. It is this disproportion that explains, at least in a small part, why a false bomb threat can cause large-scale consequences.
Lessons could be interrupted, students and teaching staff evacuated and the bomb squad called to ensure there is no concrete danger.
The incidents that occurred in these two days demonstrate this. A threatening email was sent to approximately 6,300 Italian schools on November 11th and new reports also arrived today, November 12th, in several other schools. Evacuations were carried out in some institutions, while investigations were launched in others.
The person who signed the threat was a certain “Mikhail Andropov” and it will certainly take some time to understand who is behind this identity, probably false, which in recent weeks has also caused panic in other European schools and in particular in Bulgaria, Ireland and the United Kingdom.
In this in-depth analysis we will see how this email was spread, trying to reconstruct the path it took.
How the email reached thousands of schools: where it came from
Let’s start from the first aspect: how the message was spread to thousands of schools. According to initial reconstructions, the person who sent it would have used an account from the private Da-Yeh university in Taiwan, which belonged to a former student and had been compromised for some time. The university detected an anomalous volume of outgoing messages and suspended the account, preserving the logs, i.e. the digital registers that document accesses and various activities done with that account.
The list of recipients may also have been easy to find. Freely downloadable files containing the data of state schools are published on the opendata portal of the Ministry of Education and Merit, including ordinary email addresses and Certified Electronic Mail (PEC) addresses.
Two elements suggest that precisely that list was used. The private schools, present in a separate file, would not have been reached: the same goes for the institutes of Trentino-Alto Adige and Valle d’Aosta, which manage their school systems independently. Sending to thousands of addresses, therefore, is not a sufficient element to support the hypothesis of a violation of the email accounts of Italian institutions.
Why would attackers use a university account? Probably to more easily evade the anti-spam filters of school mailboxes. Since these filters evaluate different signals to identify suspicious messages, the use of an address believed to be reliable, such as one belonging to a university account, could more easily fool these systems which are not infallible.
What happens when you receive a bomb threat: the evacuation plan
Let us now move on to another aspect, that which concerns the concept of risk. The probability that a threat is real may be low, but the severity of the consequences, if it were, could be high. For this reason it is not possible to ignore a report just because it seems unlikely or because it arrives together with thousands of others.
At the same time, automatically evacuating every building for any generic message would have costs, not only economic, but also and above all social, which cannot be ignored (and we will return to this last aspect shortly).
It is also for this reason that today the Presidency of the Council has indicated a common line for all administrations, establishing that the mere receipt of a mass email, without further concrete elements that suggest a real danger, does not automatically lead to evacuation.
False positives and risk of habituation to alarms
The Government’s position evidently aims to mitigate a side effect of similar alarms which goes by the name of alarm fatigue: if you receive many unfounded and repeated warnings, the risk you run is that of becoming accustomed to similar alarms.
After receiving many without consequences, you risk paying less attention even to well-founded reports. This is a real risk and should absolutely be avoided. It is a problem common to various areas, from cybersecurity to airport controls.
For this reason, improving filtering systems and establishing shared procedures will be fundamental both to avoid disproportionate reactions and to mitigate the risk of underestimating any future dangers.
