November 11 demonstrated just how much a coordinated attack on email inboxes can strain the organizational machinery of the Italian school system. Around 6,000 schools received similar threatening messages, and evacuations were triggered in over 300 cases. No explosive devices were found, but the incident forced principals, teachers, ATA staff, students, and families to confront a decision that cannot be treated as an ordinary administrative issue: assessing a threat, protecting people, and acting within extremely tight timeframes.
The Associazione nazionale presidi (ANP) intervened to express support for the school leaders involved. President Antonello Giannelli highlighted the operational conditions under which differing choices were made: some schools ordered the evacuation of the building, while others decided not to evacuate following an assessment of the context and consultations with law enforcement. According to the association, it is unfair to judge those decisions without considering the information available at that moment and the burden of responsibility carried by those who lead a school community often comprising hundreds of people.
The core issue, in fact, does not merely concern the receipt of a single email. When identical or very similar messages hit thousands of institutional addresses almost simultaneously, schools face a nationwide event, yet the initial response remains left to local structures. Each principal must interpret the signal, mobilize contacts, potentially organize an evacuation, and communicate with families. It is precisely this gap between the scale of the attack and the fragmentation of the response that ANP is calling to bridge.
The pressure on principals and the cost of an immediate decision
A bomb threat poses very concrete problems even when no evidence emerges to confirm its credibility. Evacuating means quickly moving classes, teachers, and staff; managing minors in outdoor spaces; preventing overcrowding; dealing with cold or bad weather, if present; informing families; and coordinating with authorities. On the other hand, not evacuating requires an equally delicate assessment of the potential risk. There is no consequence-free choice, and it is easy to understand why, in the absence of uniform guidelines, different schools may arrive at different outcomes.
Giannelli also extended his recognition to the staff who supported emergency management. Teachers and ATA become the human infrastructure of every safety plan: they escort students, maintain order, verify procedures and attendance, and address requests from families. In a crisis triggered by a digital message, the most demanding part remains physical and relational. This is a critical consideration for school administrators: an information vulnerability can turn, in a matter of minutes, into a dress rehearsal for the entire educational community.
Evacuation drills as operational preparation
According to ANP, the events of November 11 confirmed the value of emergency drills. In schools, these exercises risk sometimes being perceived as a recurring compliance chore, but their purpose becomes much clearer when procedures must be executed under pressure. Knowing escape routes, assembly points, roles, and communication protocols does not eliminate uncertainty surrounding a threat, but it can reduce confusion during an abrupt evacuation.
The takeaway is not that a protocol designed for one type of emergency can be mechanically applied to every other situation. A threat received via email presents specific demands and requires coordination with law enforcement. However, familiarity with emergency management remains a valuable asset: it allows staff and students to move in a more orderly fashion and enables school leadership to focus on evaluations that cannot be automated. Training, in this sense, is not a bureaucratic annex to the safety plan, but a core component of the institution’s response capability.
From public emails to a shared detection system
The most concrete request put forward by the association concerns the technical management of threatening communications. School email addresses are publicly accessible for transparency reasons, and institutional inboxes are centrally managed by the Ministero dell’Istruzione e del Merito. For ANP, this architecture makes it possible to consider shared filtering and recognition tools: systems capable of identifying recurring messages, detecting mass mailings, and promptly alerting the competent authorities that this is not an isolated incident.
It is not a matter of claiming that a filter can determine on its own whether a threat is real. Security assessments remain the responsibility of the designated authorities and cannot be delegated to software or a school's administrative staff. The point is different: promptly collecting the technical signals of a coordinated campaign, distinguishing as early as possible a large-scale distribution from a communication received by a single school, and providing institutions with a shared picture of the situation.
Today, without such coordination, the exact same email can be read and handled separately by thousands of offices. This multiplies uncertainty, complicates communication alignment, and leaves it up to individual schools to determine whether the message is part of a much broader campaign. A centralized model, if designed with clear procedures and direct links to law enforcement, could instead provide real-time alerts and consistent operational guidelines, without replacing local assessments whenever these remain necessary.
The announced protocol and what schools are waiting for
ANP welcomed the announcement from Palazzo Chigi regarding the definition of a shared operational protocol for managing threat alerts within the framework of the Comitato interministeriale per la sicurezza della Repubblica. The association is waiting for these guidelines to be made available to educational institutions as well, as their effectiveness will depend on being able to apply them during an emergency, rather than merely existing at an administrative level.
For schools, a useful protocol will primarily need to clarify who informs whom, within what timeframe, and through which channels. It will also have to coexist with the organizational autonomy of educational institutions and the responsibilities of local authorities. The scenario outlined by Giannelli involves pairing the procedures with a centralized alert channel for massive attacks: a tool designed to reduce the decision-making isolation of school principals and provide a nationwide perspective on phenomena that are already national in the way they spread.
ANP's willingness to help develop these operational tools now opens a phase that will be judged on the details: the ability to detect coordinated campaigns, the quality of alerts, clear instructions for institutions, and coordination with those carrying out on-the-ground checks. The November 11 alert produced no physical consequences attributable to the announced explosive devices, but it exposed a specific organizational weakness. Schools responded, often with clear-headedness, to a threat arriving via the web; the next step is to ensure they do not have to face it each on their own.
