A single mastermind, a copycat crime or a ‘false flag’ operation. Investigations to bring order to the chaos. AI may also have been used

False alarms accompanied by threats which, fortunately, have so far come to nothing but which cause chaos and force the police to divert their resources. A barrage of simultaneous attacks arriving via email which, according to experts, may also have exploited the potential offered by artificial intelligence to create a climate of destabilisation.

Intelligence officers and investigators from the postal police are working to trace the person who was at the keyboard this morning when, shortly before 10 am, an email containing a new bomb threat was sent to 6,000 Italian schools. Investigators are also seeking to establish whether there is a common thread or a coordinated campaign linking these incidents to those which last week triggered alerts even at high altitude, with scheduled flights on European routes forced to make emergency landings and military fighter jets scrambled to escort them. The suspicion is that there is some form of coordination behind the wave of incidents in recent days.

For this reason, international cooperation channels have been activated to identify the servers through which the emails passed, and a meeting is due to take place shortly between Europol and the police forces of all the countries involved in the cyber-attacks. This afternoon at Palazzo Chigi, senior officials from the intelligence services and the National Cybersecurity Agency discussed the possibility of a coordinated operation, as well as potential new threats, at a meeting chaired by Prime Minister Giorgia Meloni. At the same time, the possibility of a domino effect cannot be ruled out. According to the Minister of the Interior, Matteo Piantedosi, “there is a string of events which, at the very least in the form of copycat attacks, share the common feature of attempting to overwhelm the public system with alerts which, fortunately, often turn out to be unfounded”.

The email sent this morning announcing “a powerful explosive device” in school complexes was sent from a compromised account at Daye University in Taiwan, a private university on the island. Initial investigations suggest it may be linked to the account of a former student that was hacked. The header also contains Chinese characters that translate as the name Liu Fang-chun. The brief message contains references to similar incidents that have occurred in recent days: firstly, the signature ‘Mikhail Andropov’, which had already appeared in claims of responsibility for false bomb threats on board aeroplanes and at the premises of several European television broadcasters (including Ireland’s RTE and Bulgaria’s Nova TV). In the message, Andropov describes himself as the leader of the ‘Vilayat of Misoginistan’, which may conceal a double clue. The Vilayat-i Faqih is, in fact, a theory according to which, in the absence of the Imam, the jurist (faqih) has the authority to protect and uphold the interests of the community, and it is precisely the founding principle of the government of the Islamic Republic of Iran.

It is precisely the Iranian lead that France is currently pursuing in order to shed light on the cyber-attacks on the cold chain. ‘Misoginistan’, on the other hand, seems to ironically echo the elusive ‘Fighters of the Male State’, who signed other emails containing reports of explosives on aeroplanes and who are linked to the ultra-nationalist and misogynistic Russian group ‘Muzhskoye Gosudarstvo’. A detail that would therefore seem to point towards Moscow. However, amongst the hypotheses being examined by investigators is also that of a red herring. A ‘false flag’ operation orchestrated by someone who might have an interest in shifting the blame onto ‘hostile’ states or rival criminal groups. This is a pitfall that the director of the postal police, Ivano Gabrielli, has also spoken about in recent hours, warning: “The masterminds in this field are difficult to identify; there are attackers who want people to believe they are something else.” At present, there are reportedly some ‘minor leads’ on which the experts are focusing their attention. Inevitably, the timing of the incident is also under scrutiny, given the false alarm that was also sent by email this morning to over three hundred schools in Northern Ireland and a thousand schools in Scotland.