“The building has been mined and at this very moment your life is in danger.” A new email also signed by the self-styled Mikhail Andropov was sent this morning, just before 10 am, to almost 3800 schools in various Italian cities announcing the presence of a bomb in the buildings.
An identical email message for everyone but, unlike yesterday, sent from multiple 'compromised' addresses with domains in the Philippines and other countries. A few lines - which also noted the presence of a bomb in Palazzo Chigi - which alerted the institutes without however causing the same chaos as the previous day.
Only 77 schools were evacuated (of these, 36 resumed teaching shortly afterwards), while in all the others the students remained in class. An indication contained in a government communication sent mid-morning to garrisons and prefects in which they are invited not to evacuate "in the absence of concrete elements further than the simple receipt of massive emails that suggest a danger exists".
The line was then confirmed in the afternoon during the technical level meeting of the Committee for the Security of the Republic, with the heads of intelligence and the Cybersecurity Agency, in the presence of the undersecretary Alfredo Mantovano, the ministers Giuseppe Valditara and Matteo Piantedosi. The objective of the executive is "to prevent unfounded threats from blocking essential services and to guarantee the safety of students, teachers, school workers, families, and more generally of the entire national community". In essence, additional indicators in addition to emails will be needed to evaluate a real risk. All operational indications will be provided promptly by the Minister of the Interior to the Prefectures.
Attention, in any case, remains high and already tomorrow morning there will be a restricted technical table to "provide a basis of procedures and tools, aimed at intervention measures in the short, medium and long term". The focus will not only be on schools but on all potential targets: from hospitals to transport, from telecommunications to local authorities. Useful elements will be provided to quickly recognize unfounded threats and to define a sort of specific behavior protocols. "For each sector - says Palazzo Chigi - the competent central administrations will indicate the useful elements to quickly recognize unfounded threats and to define criteria, procedures and chains of command".
Meanwhile, the prosecutors are moving to find out who is behind the Antropov signature. The anti-terrorism prosecutors of the Rome Prosecutor's Office have opened a case for causing alarm and aggravated threats. While Milan magistrates are investigating unknown persons for causing alarm and public intimidation. The 'change of strategy' also comes under the scrutiny of the investigators with emails sent this morning from multiple addresses and not from a single one as happened yesterday when the 'rain' messages had the hacked account of a Taiwanese student as the sender. This time some compromised addresses lead to the Philippines, specifically to a teacher from Davao, Jorhaida Budiang, and the domination of a school in Batangas City. It cannot be ruled out that behind those profiles there may be groups that have purchased government credentials or already stolen access on the dark web, where there is thriving traffic.
007 and postal police experts aim to establish whether there is a common direction for the latest episodes that have created chaos in schools and alert in European skies, with scheduled flights forced to make emergency landings escorted by military fighters. The suspicion is that there may be coordination. For this reason, international cooperation channels have been activated to identify the servers from which the e-mail messages passed and a Europol meeting is imminent.
