Bomb threats, suspicious items and threatening messages

Schools receive threats far more often than they face real attacks. Most bomb threats are hoaxes, made by students hoping to cancel an exam, by people trying to cause disruption, or, increasingly, by automated callers and email campaigns that send the same threat to dozens of schools at once. But every threat has to be taken seriously until it is assessed, because the cost of being wrong is too high. This lesson covers how staff receive and report threats, how schools decide what to do, what to do about a suspicious item, and how schools assess threats made by students. It is written for awareness: staff are not expected to search for or handle anything dangerous, and they should never touch a suspicious item.

How threats arrive

Threats reach schools in many ways:

• A phone call to the office or a classroom.
• An email to the school, a staff member or a general inbox.
• A message on social media, sometimes posted publicly and shared widely before staff see it.
• A note left in a washroom, written on a wall or handed to a teacher.
• Something a student says, writes in an assignment or posts online.
• A message passed on by law enforcement or another school that received the same threat.

The first person to receive or see the threat has an important job: get it to the principal quickly and keep the details. Staff should never ignore a threat because it seems silly, and never investigate it on their own.

Receiving a threat by phone

Most schools keep a threat call checklist at every phone that takes outside calls, especially in the main office. The checklist reminds the person who answers what to do and what to note. The basic steps are:

• Stay calm and keep the caller talking as long as possible. Do not hang up, even after the caller does, because the line may help law enforcement trace the call.
• Signal a colleague to call 911 and the principal on another line while you listen.
• Ask questions if the caller allows it: When will it happen? Where is it? What does it look like? Why? Who are you?
• Write down the exact words, as close as you can.
• Note details about the caller: voice, age, accent, speech, background noises, whether the message seemed read from a script.
• Note the time, the number on the call display, and the length of the call.
• After the call, do not discuss it widely. Give the checklist to the principal and law enforcement.

Written, emailed and online threats

For written threats, the rule is to preserve, not destroy. A note should be left where it was found if possible, or handled as little as possible and put in an envelope. An email or online post should not be deleted; staff should take a screenshot, note the time, the sender and the web address, and forward the original to the principal as the district directs. Messages on student phones should be shown to the principal, not forwarded around the school. Copies circulating among students spread fear and can make an investigation harder.

Who decides, and what are the options

The principal decides how to respond, in consultation with law enforcement and the district office. Staff do not evacuate, lock down or send students home on their own after receiving a threat, unless there is an obvious immediate danger. The principal has several options:

• Continue normal operations, with heightened watchfulness, if the threat is judged not credible, for example a mass email sent to many schools that law enforcement have already linked to a hoax campaign.
• Search the building with staff who know it, looking for anything out of place, while classes continue or students remain in rooms.
• Evacuate all or part of the building, using routes and assembly areas that have been checked first.
• Use secure or lockdown if the threat involves a person rather than a device.
• Close the school or dismiss students early.

Law enforcement help assess credibility, but the decision about students rests with the school and the district. A threat that names a specific location, time and device, or that comes from someone with a known grievance, is treated more seriously than a vague, generic message.

Searching and evacuating after a threat

If the principal decides to search, the search is done by staff who know the building, often with law enforcement, because they can tell what is out of place. Each person checks their own area: teachers check their classrooms, custodians check mechanical rooms and storage, office staff check the office and lobby. They look for items that do not belong, without touching or moving anything, and report anything suspicious to the principal.

If the principal decides to evacuate after a bomb threat, the evacuation is different from a fire evacuation in a few important ways:

• The fire alarm may not be used, because the announcement can be made over the public address system and the evacuation can be organized more carefully.
• Routes and assembly areas are checked first, if time allows, because a device could be placed near a usual exit or assembly area.
• The assembly area is further away than usual and away from parked cars, garbage bins and other places where an item could be hidden.
• Staff take their class lists and emergency kits, and students may be asked to take their bags so that unattended bags do not need to be checked later.

Radios and phones near a suspicious item

Many emergency procedures advise people not to use two-way radios or mobile phones close to a suspected device, because of a small chance that radio signals could set off some kinds of device. The district's procedure follows law enforcement advice: if a suspicious item is found, staff move away before using a radio or phone, and the office uses landlines or messages to staff in other areas. This is one more reason to keep a working landline in the main office.

Suspicious items

A suspicious item is anything that is out of place and could be dangerous: an unattended bag or box in an unusual location, an item with wires or a strange smell, a package with no return address and excessive tape, or anything found after a threat. Most turn out to be a forgotten gym bag or a delivery left in the wrong place, but staff should not assume that.

If staff find a suspicious item:

• Do not touch, move, open or cover it.
• Move away and keep others away.
• Note what it looks like and exactly where it is.
• Move out of the area before using a radio or phone, then tell the principal or call 911.
• Follow directions from the principal and law enforcement, which may include evacuating the area or the building.

Packages that arrive by mail or courier are handled with the same care. Office staff should know the warning signs, such as unexpected packages addressed to a staff member by title only, excessive postage or tape, stains, odd smells or wires, and should set a suspicious package down gently, leave the room, close the door and call law enforcement.

Assessing threats made by students

Many threats come from students: a comment in class, a drawing, a post online, a statement made in anger. Most are not serious plans, but a few are warning signs of real danger, and many students who make threats are in distress and need help. Many U.S. districts, including Riverbend, use a behavioral threat assessment team, following federal guidance such as the U.S. Secret Service's threat assessment model, to decide how serious a student's threat is and what support and safety measures are needed. The district's procedure sets out who is on the team, usually the principal, a school counselor or psychologist, and the school resource officer or police liaison, and how quickly they meet.

The key idea of threat assessment is that the question is not only whether a student made a threat, but whether the student poses a threat: whether there is a plan, the means, a target, and a pattern of concerning behavior. The team gathers information, decides on immediate safety steps if needed, and builds a plan to support the student, which might include counseling, family involvement, mental health referral and monitoring. Discipline may be part of the response, but on its own it rarely makes a school safer.

Staff role in threat assessment is to report. Any staff member who hears, sees or reads something that suggests a student might harm others or themselves should tell the principal the same day. Small pieces of information held by different people, such as a teacher who noticed a disturbing assignment, a coach who heard a comment and a classmate who saw a post, often only make sense when they are put together.

Logging threats

Every threat is recorded, whatever the outcome. Over time, the log shows patterns, such as threats around exam weeks or waves of hoax emails. The program below summarizes a year of threat records for the district by how they arrived and what action was taken.

# Summarize a year of threat records: channel and action taken.
from collections import Counter
records = [
    ("email", "continue"), ("email", "continue"), ("email", "continue"), ("email", "search"),
    ("phone", "search"), ("phone", "evacuate"), ("note", "search"), ("note", "continue"),
    ("social media", "assessment"), ("social media", "assessment"), ("student statement", "assessment"),
    ("student statement", "assessment"), ("student statement", "continue"), ("email", "continue"),
    ("phone", "continue"), ("social media", "lockdown"),
]
by_channel = Counter(c for c, _ in records)
by_action = Counter(a for _, a in records)
print("by channel:", dict(by_channel.most_common()))
print("by action: ", dict(by_action.most_common()))
share = sum(1 for _, a in records if a in ("evacuate", "lockdown")) / len(records)
print(f"threats leading to evacuation or lockdown: {share:.0%}")

by channel: {'email': 5, 'phone': 3, 'social media': 3, 'student statement': 3, 'note': 2}
by action:  {'continue': 7, 'assessment': 4, 'search': 3, 'evacuate': 1, 'lockdown': 1}
threats leading to evacuation or lockdown: 12%

Most threats in the year were handled without evacuation or lockdown, which is typical. Emails, many of them part of hoax campaigns aimed at many schools, were the most common channel. Student statements and social media posts more often led to a threat assessment, which is where the real safety work for those threats happens.