Thousands of schools in Italy, Britain and Ireland have received threatening emails, forcing evacuations and prompting international police investigations less than a week after similar incidents disrupted European aviation.
European security authorities are investigating a wave of bomb threats against schools across several countries after threatening emails caused widespread disruption on Wednesday, 11 November, exposing the vulnerability of public institutions to anonymous communications sent across national borders.
Italy experienced the most extensive disruption, with threatening messages reportedly reaching approximately 6,300 schools and prompting the evacuation of at least 300 educational establishments. Police in Britain and Ireland also investigated similar incidents.
Italian Prime Minister Giorgia Meloni sought to reassure families that the threats did not represent an immediate danger, while investigators worked to establish their origin.
The incidents follow a series of bomb threats against European aviation earlier this month, when anonymous communications caused disruption to passenger services and required extensive security operations.
There is currently no publicly established connection between the aviation incidents and the threats against schools. Nevertheless, their occurrence within a short period highlights a security problem that European authorities are increasingly required to address.
Disruption without physical violence
In Northern Ireland, the Police Service of Northern Ireland confirmed that more than 300 schools had reported receiving threatening messages.
Investigators established that the email originated outside the United Kingdom. Police found nothing to substantiate the threats and assessed the risk to the public as low.
In Scotland, police similarly concluded that the communications did not constitute a credible threat. Police Scotland advised that schools should not be evacuated solely because of the emails, while its specialist cyber and fraud investigators continued enquiries with international partners.
The different responses illustrate the difficulties facing authorities when confronted with anonymous threats distributed simultaneously to large numbers of institutions.
Emergency procedures are designed to protect lives when a threat cannot immediately be dismissed. School administrators have limited discretion to ignore potentially dangerous communications, particularly before police have completed an assessment.
For anyone seeking to cause disruption, these safeguards can themselves become a source of leverage. A threatening email sent to hundreds of institutions can trigger extensive police deployments, emergency inspections, transport disruption and interruptions to education.
Parents may be required to leave work to collect children, while schools can lose hours of teaching and examinations may have to be postponed.
The resources required to initiate such incidents are negligible compared with the public expenditure involved in responding to them.
Digital communications also allow perpetrators to operate across borders, complicating investigations and potentially placing the evidence required for prosecution in jurisdictions outside the affected countries.
The challenge of European security co-operation
The school incidents come amid broader concerns about Europe’s exposure to cyberattacks, sabotage and other activities intended to disrupt public services.
European governments have already faced interruptions to transport networks, telecommunications, energy infrastructure and commercial services. The distinction between criminal hoaxes, politically motivated disruption and operations undertaken on behalf of foreign governments is often difficult to establish during the early stages of an investigation.
There is no evidence at present that a foreign government directed Wednesday’s threats. Premature attribution would risk undermining the credibility of investigators and distracting attention from other possible perpetrators.
Nevertheless, the incidents illustrate why European security planning must extend beyond conventional military threats.
The European Commission has recently expanded its emphasis on civil preparedness, including measures intended to ensure the continuity of essential services during emergencies. As EU Today reported in its examination of European crisis preparedness, responsibility for public resilience cannot rest solely with individual citizens.
School systems, hospitals and transport operators require reliable procedures for assessing threats, maintaining communications and restoring normal operations.
Closer international police co-operation will be essential where threatening messages originate abroad or are transmitted through infrastructure operating across several jurisdictions.
The challenge is to establish rapid procedures for sharing technical evidence and threat assessments without compromising the ability of local authorities to respond to genuine emergencies.
Wednesday’s events demonstrated how rapidly disruption can spread across national borders even when no explosive device has been identified.
For European governments, the practical test will be whether investigators can establish the origin of the messages and whether emergency services can develop sufficiently reliable assessment procedures to prevent repeated hoaxes from paralysing essential public institutions.