Why Italy was caught off guard by bomb threats emailed to schools

ROME – The intelligence services had warned days earlier that, after aircraft, schools could be the next targets. Politicians have been debating the issue for years. Twelve months ago, Defence Minister Guido Crosetto unveiled a plan setting out the structures, powers and tools needed to respond. A country caught unprepared (lapresse) Yet when an email threatening bombings and massacres reached 6,000 schools across the country, Italy was caught off guard. Not when it came to the investigation, but in its handling of the emergency. In the same family, one child may have been evacuated while another was left in the classroom. The same threat, two different responses. And one question: who decides what action should be taken? Proof of the country's lack of preparedness came the following day, when the authorities scrambled to put things right: new threat emails were ignored, and work began on drawing up a protocol for managing this type of risk. It was a response that should have come sooner. The question of who is actually responsible for making the decisions remains unresolved. An incident that should have come as no surprise Yet no one can claim that the incident was unexpected. On 2 November, 271 schools had already been threatened. Between 3 and 6 November, more than 30 European flights were affected by hoax security alerts, at least eight of them involving Italian airports. Aircraft were diverted and fighter jets scrambled. Meanwhile, supermarket refrigerators came under attack; pro-Russian hacker groups NoName057 and Z-Pentest claimed responsibility for cyberattacks; and the server of the company operating the Brenner Base Tunnel, a strategic infrastructure link between Italy and Austria, was breached. Just days earlier, Aisi, Italy's domestic intelligence agency, had identified schools in a report as a potential target of an attack campaign, in light of previous incidents. Yet no coordinated response followed. Crosetto's plan Bomb threats at numerous schools for the second consecutive day. Carabinieri officers inspect several school buildings. The sign reads: “Bomb threat and you lock us inside? If it had been real, we would all be dead” (franceschi) As mentioned, back in November 2025 Defence Minister Crosetto had presented a document of more than 100 pages entitled Combating Hybrid Warfare: An Active Strategy, in which he highlighted Italy's shortcomings. “Containment is not enough,” he wrote. Hybrid threats sow uncertainty and fear: the perception of vulnerability can cause more damage than an actual attack. Crosetto called for the definition of a national cyber domain and the creation of a civilian and military Cyber Corps comprising 1,200 to 1,500 specialists. The proposed body would coordinate intelligence, defence and other institutions in countering destabilisation campaigns. It was a politically risky move. It set Crosetto against Alfredo Mantovano, Undersecretary to the Prime Minister with responsibility for the intelligence services and oversight of cybersecurity. “At a certain point, Fazzolari stepped in, and the whole thing came to nothing,” says Enrico Borghi, a senator with the Italia Viva party, referring to Giovanbattista Fazzolari, one of Prime Minister Giorgia Meloni's closest advisers. A fragmented system The result is a highly fragmented system. The intelligence services gather information; the National Cybersecurity Agency (ACN) is responsible for IT security; the Defence Ministry manages its own capabilities; the State Police and its Postal and Cyber Security Police Service investigate; the Carabinieri focus on counterterrorism; and the Guardia di Finanza tracks financial flows. What is missing is a strategy for turning intelligence into shared decisions. There is also confusion over cybersecurity funding: budget allocations are scattered across multiple agencies, projects and investments lack transparency, and resources dwindle at every stage of the process. “We need to put a national security strategy down on paper and establish a Security Council,” argues Matteo Pugliese, a Barcelona-based researcher and expert in international security. Spam filters So what should be done? As an immediate response, technical experts have proposed a seemingly simple measure that has yet to be adopted: spam filters on institutional email accounts to detect messages with specific characteristics and prevent anonymous emails from reaching their intended recipients. Simply implementing such a system on the Education Ministry's servers would have been enough to block the 6,000 emails sent simultaneously from the same address. There is another point to consider: the threats against schools are not, strictly speaking, a cybersecurity issue. “It would be like arguing that statements issued by the terrorist group Red Brigades were a postal matter simply because they arrived by mail,” an intelligence source points out. Email is merely the means of delivery. Counterattacks and alarmism Compromising refrigerators or disrupting essential services is a different matter. In France, when refrigeration systems came under attack, the national cyber agency identified Iranian actors as responsible. This is where the question of cyber counterattacks becomes crucial. Italy, which began developing capabilities in this area years ago, now appears to be lagging behind. It is also important not to amplify the attackers' propaganda. One example was when NoName published the switchboard number of the Forza Italia party, presenting it as part of an attack against Foreign Minister Antonio Tajani. “The risk is twofold,” intelligence sources explain. The first is copycat behaviour: every hoax that brings a service to a standstill can encourage others to repeat the tactic. The second is the “cry wolf” effect: after dozens of fabricated threats, a genuine one may no longer be taken seriously. That is why we need to decide how to respond. So that others do not end up deciding for us.