A threatening email sent to thousands of Italian schools has caused evacuations and alarms. It all started from a hacked university address of the University of Taiwan, with the list of recipients easily available thanks to the MIM portal, which also contains the email addresses of state schools.
Writing and sending a threatening email can take a matter of minutes. Verifying whether the threat contained in the message is credible, however, takes significantly more time. It is this disproportion that explains, at least in small part, because a false bomb threat can cause large-scale consequences.
Lessons could be interrupted, students and teaching staff evacuated and the bomb squad called to ensure there is no concrete danger.
The episodes occurred in these two days they prove it. A threatening email was sent to approximately 6,300 Italian schools on November 11th and new reports also arrived today, November 12th, in several other schools. In some institutes this has been done to evacuationwhile in others investigations have been launched.
A certain person signed the threat «Mikhail Andropov» and it will certainly take time to understand who is behind this identity, probably false, which in recent weeks has also caused panic in other European schools and in particular in Bulgaria, Ireland and the United Kingdom.
In this in-depth analysis we will see how this email was spreadtrying to reconstruct the path he took.
How the email reached thousands of schools: where it came from
Let’s start from the first aspect: how it was propagated the message to thousands of schools. According to initial reconstructions, whoever sent it would have used a account of the private Da-Yeh University, Taiwanwhich belonged to a former student e compromise for some time now. The university detected an abnormal volume of outgoing messages and suspended the account, retaining the logi.e. the digital logs that document accesses and various activities done with that account.
Also the list of recipients it might have been easy to find. Freely downloadable files containing the data from state schoolsincluding ordinary e-mail addresses and Certified Electronic Mail (PEC) addresses.
Two elements suggest that it was used that very list. The private schools, present in a separate file, would not have been reached: the same goes for the institutes of Trentino-Alto Adige and Valle d’Aosta, which manage their school systems independently. Sending to thousands of addresses, therefore, is not a sufficient element to support the hypothesis of a violation of the email accounts of Italian institutions.
Why would attackers use a university account? Probably for evade anti-spam filters more easily of the boxes mail from schools. Since these filters evaluate different signals to identify suspicious messages, the use of an address believed to be reliable, such as one belonging to a university account, could more easily fool these systems which are not infallible.
What happens when you receive a bomb threat: the evacuation plan
Let’s now move on to another aspect, that which concerns the risk concept. The probability that a threat is real may be low, but the severity of the consequences, if it were, could be high. Because of this it is not possible to ignore a report just because seems unlikely or because it arrives together with thousands of others.
At the same time, evacuate automatically every building for any generic message would have of costsnot only economic, but also and above all social, which cannot be ignored (and we will return to this last aspect shortly).
This is also why today the Presidency of the Council indicated a common line for all administrations, establishing that the mere receipt of a mass emailwithout further concrete elements that suggest a real danger, does not automatically lead to evacuation.
False positives and risk of habituation to alarms
The Government’s position evidently aims to mitigate a side effect of similar alarms and which takes the name of alarm fatigue: if you receive many unfounded and repeated warnings, the risk you run is that of get used to such alarms.
After receiving many without consequences, you risk pay less attention even to well-founded reports. This is a real risk and should absolutely be avoided. It is a problem common to various areas, from cybersecurity to airport controls.
For this reason, improving filtering systems and establishing shared procedures will be fundamental both to avoid disproportionate reactions and to mitigate the risk of underestimating any future dangers.
