The real nonsense about school alarms

We must confess that the temptation to take Defence Minister Guido Crosetto seriously – who irreverently suggested that the false bomb threats sent by email yesterday to thousands of Italian schools might not necessarily be the work of some diabolical state entity, but rather the result of the activism of a mythomaniac or a fool – is very strong. However, focusing solely on the grammatically incorrect message signed by a certain Mikhail Andropov – a pseudonym that had already appeared on 6 November in threats sent to the broadcasters RTÉ (in Ireland) and Nova TV (Bulgaria) and already used to claim responsibility for other false bomb threats on European flights – risks being an exercise in laziness; it is therefore worth taking seriously what happened yesterday morning when parents across half of Italy were informed that their children had suddenly been evacuated from their classrooms due to a (non-existent) bomb threat. The first important factor – which prompted the Prime Minister to convene all political parties, including those in opposition, at Palazzo Chigi today to discuss the scale of the new cyber threat (even if a threatening email is not exactly a cyber threat) – is the sequence of events. In Italy in the last few days alone, a cyber intrusion has affected a server used for exchanging documents relating to the Brenner tunnel project; data on representatives of public institutions has appeared on the so-called dark web; and the cold chain has, in its own way, become a target, with refrigerators in canteens, food warehouses, frozen food companies, hotels and cafés hit by an external attack. (continued on page four)

Meanwhile, across Europe, alongside genuine threats (Putin’s drones encroaching on European airspace), other types of alerts have emerged, causing disruption to air travel (false alarms), in supermarkets (genuine alerts, with an Iranian link in France), in hospitals (blood-cooling systems targeted by hackers), in newspapers (newsrooms evacuated in Ireland, and it is not hard to imagine this being the next target in Italy), in infrastructure (intelligence agencies have been focusing on European railways for days) and in schools (yesterday, schools in Scotland and Northern Ireland were also hit by false alarms; they reacted differently from Italy: in Scotland, some were evacuated, but the police later clarified that emails alone did not justify evacuations, whilst in Northern Ireland the police classified the risk as low).

The sequence of events suggests that the alerts may have been triggered by idiots, or pathological liars, but it would be idiotic, perhaps, or even the behaviour of pathological liars, not to realise that the effects generated by the alerts – even the fake ones – are real and serve to highlight a key word that perhaps deserves further examination: vulnerability, of course. A large number of pupils were evacuated from Italian schools yesterday due to an excess of zeal (an overzealousness that was, however, avoided by a remarkable headteacher, Dr Massimo Nunzio Barrella, head of the Parini Classical High School in Milan, and three headteachers in Potenza, who, after consulting with the police, decided not to evacuate the schools and to treat the threats for what they were: nonsense) were left with mixed feelings. On the one hand, there was the satisfaction of finishing classes a few hours early; on the other, there was the anxiety triggered by reading the threatening text of the email purportedly sent by the infamous Mikhail Andropov. The alarm has been called off, as we know, but it would be useful, when the pupils return to school, if some level-headed teacher were to offer them food for thought on a subject that is difficult to avoid. It is possible that hybrid warfare, or Russia, or Iran, have nothing to do with these false alarms. But is it possible not to realise that a society which regards any attempt to protect itself from external threats as an escalation, and which takes to the streets to protest against additional defence spending – sometimes even occupying schools – is a society that is doing everything it can to make itself more vulnerable to external threats? And secondly, is it possible that those who wish to defend schools—and perhaps take to the streets to defend the right to education, demanding more attention, more investment, and more care—fail to understand that safeguarding the future of schools also means equipping ourselves to be less exposed to those who, with very limited resources, can prevent them from functioning? It is often said—one hears it frequently at school, during occupations, at demonstrations, during marches, and on talk shows—that money spent on defence is money stolen from healthcare and education. Recent news reports suggest it is becoming increasingly clear that, in an era of hybrid conflicts, defence spending may be the very condition necessary to protect healthcare and education. In this specific case, one is led to wonder: if there had been, in Italy, a centralised system for managing threats – for distinguishing a genuine alert from a hoax, entrusted perhaps not to a civilian bureaucracy but to a military one – would there have been as much wasted time and energy as we saw yesterday across half of Italy? Giuseppe Cavo Dragone – as you know, he is an Italian admiral and chairman of NATO’s Military Committee – has for months been trying to raise awareness amongst the public and political leaders on the very issue we began with: investing in defence does not mean diverting attention away from healthcare and education, but rather reducing the vulnerabilities that can weaken healthcare and education. Reached by telephone, Cavo Dragone offered an interesting insight: “Pitting defence against healthcare and education is a mistake in perspective. In this ‘peace of war’, security is what allows a hospital to remain open and a school to hold lessons. Hybrid warfare strikes precisely there: a cyber-attack that paralyses services, a wave of false alarms that empties classrooms, a disinformation campaign that sows fear. It costs little to those who carry it out and a great deal to those who suffer it. In this scenario, from my point of view, investing in defence, in practical terms, means four things. Rapidly identifying the source of an attack, because a false alarm ceases to cause harm once we know immediately who orchestrated it. Protecting the networks of schools and local authorities, which are often the weak link. Working together to prepare the military, the Civil Protection Agency and headteachers to manage these crises, as many of our allies in Northern Europe already do. Educating young people and pupils to recognise manipulated content before sharing it, because school is the first place where resilience is built. What is still lacking is the realisation that security concerns the whole of society. Resilience is built before a crisis strikes: ‘you mend the sail whilst the sea is calm’. We may soon discover that yesterday’s false alarms were generated by mythomaniacs. But the consequences of false alarms – not only in schools – are there to show us vulnerabilities that we simply cannot ignore. And before taking to the streets one day to protest against defence spending, viewing it as antithetical to investment in schools, perhaps it would be worth asking ourselves whether this, too, is not a bit of a daft idea.