When the bomb threat is almost certainly fake

Dear {{ first_name | reader }},

Yesterday morning, more than 300 Italian schools were evacuated after receiving the same bomb threat by email. By the time I sat down to write, the education minister had already called them presumed hoaxes. Most of them almost certainly are.

Still, I kept coming back to one moment. Somewhere between 07:30 and 08:30, in a ministry, a police control room and hundreds of head teachers' offices, someone had to decide what to tell parents. Nobody knew anything for certain yet. All they had was an email.

This edition is late by a day, and the extra day has been useful. It gave me time to think about what these mass threat waves actually demand from us as communicators, and to turn that thinking into something practical.

At the end you'll find a free guide built for exactly this situation, attached to this edition.

Happy reading.

The pattern built quickly.

On 19 October, around 100 Italian schools received emails claiming that explosives had been planted in the name of Sharia. On 2 November, a public holiday, a single message reached 271 schools, eight of them in Rome, threatening an ammonium nitrate bomb and knife attacks. That one claimed to come from Iran's Revolutionary Guards, a claim Italian authorities have not verified. Over the following days, hoax threats hit flights to Rome and other European cities.

Then came Wednesday. At least 300 schools were evacuated, a figure the minister later put at 312. This time the email was signed "Mikhail Andropov, leader of the Vilayat of Misoginistan", the same purported author behind threats to newsrooms in Ireland and Bulgaria a few days earlier. Education Minister Giuseppe Valditara called the threats presumed hoaxes and said there was no need for alarmism, describing a likely cyber attack.

Investigators are still working out who sent the emails and how. Italy's interior ministry is examining whether hacked school email accounts were used in some of the threats against airports.

The most instructive detail came from outside Italy. On the same morning, schools in Northern Ireland received similar emails. There, they were advised to stay open because police did not judge the threat credible.

Near-identical emails, two national responses, a few hours apart. Neither is wrong in itself. Each country weighs its own intelligence, its own history and its own tolerance for risk. But the contrast is exactly what parents, journalists and the sender notice.

Italy isn't alone, either. Over the past two years, versions of this have hit Northern Ireland, Scotland, Slovenia, Slovakia, Czechia, Hungary and Serbia. In Serbia, police reported around 2,500 officers securing schools every day at one point. That is what saturation looks like once it becomes the norm.

Every communicator in this situation faces the same trap.

A wave of identical, generic emails makes any single threat unlikely. It doesn't make it impossible. A genuine attacker could hide one real threat in the noise. A copycat could act on the publicity. And the most dangerous scenario of all: an unrelated, real threat reaches a school that has learned, wave after wave, to assume "it's another hoax".

Say "hoax" too early and you might be wrong once, with consequences nobody recovers from. Treat every email as real and you hand the sender what they wanted: stretched police, exhausted head teachers, frightened families and a public that slowly stops listening.

There is no clean way out of that. There is only a more honest way through it.

Peter Sandman's hazard and outrage distinction fits this case almost perfectly. The physical hazard from any single email is low. The outrage (the fear, the anger, the sense that nobody is in control) is very high. A unit that communicates only about the hazard ("no device was found") misses most of what people are actually reacting to.

It also helps to separate three jobs that tend to get blurred on the day. Emergency communication tells people what to do right now: stay, move, collect or don't collect. Crisis communication protects the credibility of the institutions being tested: the ministry, the police, the schools. Risk communication works in the quiet weeks between waves, preparing families for the next one. Mix them up and you get a reassuring message going out while a building is still being searched.

Then there is the signature. In just over three weeks, the Italian emails have invoked Sharia, Iran's Revolutionary Guards and a mocking pseudo-Russian name. The labels change because the label is part of the attack. A threat signed in the name of an Islamist group is designed to point anger at a community. Every official who repeats the claim as fact extends its reach.

None of this is as simple as it can sound.

First, Italy's school-safety context this year is not abstract. In the spring, two violent incidents inside Italian schools, in Trescore Balneario and San Vito Lo Capo, forced the country to confront a new kind of threat. Neither involved a bomb, and neither is linked to these emails. But it explains why "it's a hoax" is a harder sentence for an Italian official to say than it might look from the outside.

Second, the evidence base is thin. Published after-action reviews of these waves are rare. Most of what we know comes from press reporting, not formal evaluation. The lessons below are my reading of how events have unfolded. They are suggestions, and I'd genuinely welcome challenge from anyone who has been inside one of these waves.

Communicate the assessment, not a verdict.

Replace "it's a hoax" with "assessed as low credibility; checks are under way". Replace "there is no risk" with "no specific information supports this threat". Add one sentence that keeps the door open: if specific or corroborated information comes in, the response will change and people will be told.

Agree the sequence before the next wave.

Police assess. A central unit frames the national picture. The education ministry tells schools. Schools tell families. Only then the public. Slovenia learned this the hard way: after a panic in April 2024, it introduced a protocol, and in January 2025 the ministry sent every school a circular at 08:23 saying the latest wave was generic and low risk. Most schools carried on.

Make your words and your decisions tell the same story.

If the national line says the risk is negligible while hundreds of schools evacuate, explain why. "Local decisions depend on each school's circumstances, within a national assessment" is one sentence. Without it, the gap reads as chaos.

Answer the parent's practical question first.

Should I come to the school or not? A parent without a clear answer will drive to the gate, and a crowd of cars at the gate complicates any real evacuation.

Starve the signature of oxygen.

Never repeat a claimed identity as fact. Brief editors directly on not reproducing the email. Reach out to the community being targeted on the day, not after an incident.

Close every wave, and use the quiet between them.

End the day with a factual close-out, offer support to pupils and staff, and give updates on the investigation when there is something real to say. Then, before the next wave, tell parents how threats are assessed and what they'll be asked to do. A parent who already knows the procedure is far less likely to panic.

I've pulled all of this together in a 16-page guide, Mass Threat Waves Against Schools: Communication Guidance for a Central Emergency Unit. It covers the case studies across Europe, a tiered approach to communicating uncertainty, a coordination model, starting-point message templates for ministries, head teachers and teachers, and a readiness checklist.

It is my thinking and my suggestions, not a blueprint. The case research was gathered with AI assistance; the recommendations draw on 25+ years of practice. You'll find it below as a free PDF download. Please share it with anyone who might need it before the next wave arrives.

These campaigns will not stop because one wave fizzles out. They are cheap, they cross borders easily and they work on exactly the thing our profession is meant to protect: the public's willingness to listen when it matters.

None of us can promise parents certainty. What we can offer is a clear account of what we know, what we don't, what we're doing and what they should do. Given early, consistently and in the right order, that is usually enough.

What is a mass threat wave against schools?

A mass threat wave is a campaign in which the same threatening message, usually a bomb threat sent by email, reaches dozens or hundreds of schools at once. Italy experienced three such waves between 19 October and 11 November 2026, the largest leading to the evacuation of more than 300 schools. The threats are usually false, but each one forces a decision about evacuation and communication.

Why are hoax bomb threats against schools so hard to communicate about?

Because nobody can prove that every single threat in a wave is false, even when almost all of them are. Calling them hoaxes too early risks being wrong in the one case that matters; treating every email as real exhausts responders and frightens families. Communicators have to share an honest assessment without claiming certainty.

How should authorities communicate uncertainty during a school threat wave?

Share the assessment and the reasoning, not a verdict. Phrases such as "assessed as low credibility; checks are under way" stay true even if one threat turns out to be real. Each message should also say what would change the assessment, so parents know it is live rather than a dismissal.

Why did Italy evacuate schools while Northern Ireland kept them open?

On 11 November 2026, near-identical emails led to the evacuation of more than 300 Italian schools, while Northern Ireland's police judged the threat not credible and advised schools to stay open. Each country weighs its own intelligence, history and risk tolerance. The communication lesson is that different responses need explaining, or they look like confusion.

Should officials name the group that claims responsibility for a school bomb threat?

Not as fact. Claimed identities in these campaigns change frequently and are often designed to stir tension between communities; the Italian emails have invoked Sharia, Iran's Revolutionary Guards and an invented "Vilayat of Misoginistan". Officials should say that a claim has been made, that it has not been verified, and that a signature proves nothing about the sender.

What should a central emergency unit do now to prepare for the next wave?

Agree in advance who assesses the threat, who speaks nationally, how schools are told and in what order, so that schools hear before the public does. Prepare templates for national statements, school-to-parent messages and close-outs, and test the whole sequence in an exercise. Between waves, explain the procedure to parents so they know what to expect.

You can have thousands of people following your work and still need an algorithm’s permission to reach them. Creators know the drill: you post, you pray, you check the numbers, you try again tomorrow.

A newsletter changes that relationship. On beehiiv, you can build a subscriber list you own, reach readers directly, and turn their attention into a sustainable business with subscriptions, sponsors, a global ad network, and more.

Get started for free.

_{Transparency & Disclosures}

_{AI Transparency: In alignment with EU AI Act requirements, please note that AI technology was used in the research, drafting, and/or image generation for this edition. All strategic analysis, professional opinions, and final editorial oversight are conducted exclusively by the author. Affiliate Disclosure: Some links in this briefing may be affiliate links. I only recommend tools and services I use personally or have vetted for professional efficacy. Professional Advice: This newsletter is for educational and informational purposes only and does not constitute legal or professional crisis management advice. © 2026 RiskComms FZCO. All rights reserved.}