Campus Alert Archive
Harvard

Emailed bomb threats evacuated four buildings during finals; a student admitted the hoax

AI-generated · every claim is source-linked
MAbomb threatemergency notificationmedium confidence
Compare →
Confirmed HoaxDetermined to be a hoax. The institutional response is documented because it reveals how the alert system performed under a perceived real threat.

Sophomore Eldo Kim emailed bomb threats at approximately 8:30 a.m. EST claiming "shrapnel bombs" were placed in four campus buildings, triggering a six-hour evacuation during final exams. The FBI identified Kim within hours by cross-referencing Tor network usage on Harvard's Wi-Fi with the anonymous email service Guerrilla Mail.

Alerts
3
Response
—
Killed
—
Injured
—
Institution
Harvard University
Private R1 · MA
All Harvard cases →
~21,000 studentsMessageMe
Official alert policy
Read when and how Harvard says it will use MessageMe: summarized, quoted, and analyzed.
Documented Timeline

Alert Sequence

3 messages in sequence · 2 verified verbatim

Some messages in this sequence are documented (their existence, timing, and channel are sourced) but their exact wording is not preserved in the public record. Those entries appear as placeholders; only confirmed text is displayed.

INITIAL ALERTSMS
Verified verbatimNPR reporting that quotes the verbatim Harvard MessageMe alert139 chars
Unconfirmed reports of explosives at four sites on campus: Science Center, Thayer, Sever, and Emerson. Please evacuate those buildings now.
First MessageMe alert sent at 9:02 a.m. EST on December 16, 2013, approximately 30 minutes after the threatening emails were sent at 8:30 a.m. EST
Buildings listed in a different order than the alphabetical/geographic ordering (Science Center first, then Thayer, Sever, and Emerson) likely reflecting the order in which the threats named them
The four buildings were chosen because Kim had a final exam scheduled in Emerson Hall that morning
'Unconfirmed reports': Harvard signals epistemic uncertainty in the alert itself, a notable transparency choice for an evacuation directive
UPDATESMS+11 min
Verified verbatimNPR reporting that quotes the verbatim Harvard MessageMe follow-up alert93 chars
Harvard Alert-HUPD and CPD are on the scene and investigating. Please stand by for more info.
Sent 11 minutes after the initial alert at 9:13 a.m. EST on December 16, 2013
'CPD' is Cambridge Police Department; 'HUPD' is Harvard University Police Department; Harvard's MessageMe uses local acronyms without expansion
'Please stand by for more info' is a deliberate brevity tactic appropriate for SMS
94-character message respects SMS standards much more strictly than the initial 139-character evacuation alert
ALL CLEAREmail
Wording not preserved
A all clear message is documented at this point in the sequence, but its exact wording is not preserved in the public record. The public edition displays only confirmed alert text.
Message elements

How the first alert is built

To check this alert, Claude (an AI) read it in full 25 separate times, independently. Each read decided whether the message answers each of the six questions and gave a short reason. A final reviewer then weighed all 25 and wrote the plain-English verdict you see when you open a row. The score (for example 22/25) is how many reads agreed; the 25 individual reads are tucked underneath if you want to check them.

Unconfirmed reports of explosives at four sites on campus: Science Center, Thayer, Sever, and Emerson. Please evacuate those buildings now.

  • Sourceabsent0/25

    Final assessment

    All 25 reads agree the source is absent; no sender tag or named authority appears in the text.

    Who is sending the alert and who is responding. People act faster on a message from a clearly identifiable, credible sender, such as a named department, the police, or a branded alert system, than on an anonymous notice. A branded signature counts.

    See all 25 individual reads
    1. absent: No sender tag or named authority appears in the text.
    2. absent: No branded signature, sender, or named authority appears in the text.
    3. absent: No sender tag, branded signature, or named authority appears in the text.
    4. absent: No sender, branded signature, or responding authority is identified.
    5. absent: No sender, branded signature, or issuing authority is identified in the text.
    6. absent: No sender, branded signature, or agency is identified in the text.
    7. absent: No sender tag, university name as sender, or named authority appears in the text.
    8. absent: No sender tag, university name, or named authority appears in the text.
    9. absent: No sender, branded signature, or named authority appears in the text.
    10. absent: No sender, branded signature, or responding authority is named in the text.
    11. absent: No sender or branded signature appears, only "Unconfirmed reports".
    12. absent: No sender, agency, or branded signature appears in the text.
    13. absent: No sender tag, signature, or issuing authority is named in the text.
    14. absent: No sender tag, university name, or agency identifies the source.
    15. absent: No sender, signature, or named authority appears in this message.
    16. absent: No sender, authority, or branded signature is identified in the text.
    17. absent: No sender, branded tag, or named agency appears in the text.
    18. absent: No sender tag, university name, or named agency is identified in the text.
    19. absent: No sender, branded tag, or authority is named in the text.
    20. absent: No sender, agency, or branded signature is identified in the text.
    21. absent: No sender, branded signature, or named authority identifies who issued this message.
    22. absent: No sender, branded signature, or named authority is identified in the text.
    23. absent: No sender, branded signature, or named authority appears in the text.
    24. absent: No sender tag or issuing authority is identified in the text.
    25. absent: No sender tag, agency, or institution names itself in the text.
  • Hazardpresent25/25

    Final assessment

    All 25 reads agree the hazard is present; the alert names explosives at four sites, a specific hazard.

    What the threat actually is. A complete warning names the specific danger, such as a shooter, a fire, a tornado, or a gas leak, rather than a vague emergency, because people decide what to do based on what they are facing.

    See all 25 individual reads
    1. present: It names "explosives at four sites", a specific hazard.
    2. present: It names "explosives at four sites", a specific hazard.
    3. present: It names "explosives at four sites", a specific hazard.
    4. present: It names a specific threat: "explosives at four sites on campus".
    5. present: It names "explosives", a specific threat.
    6. present: It names "explosives at four sites", a specific threat.
    7. present: It reports "Unconfirmed reports of explosives", a specific threat.
    8. present: It names "explosives at four sites", a specific hazard.
    9. present: It names "explosives", a specific threat.
    10. present: It names "explosives", a specific threat.
    11. present: It names "explosives at four sites", a specific threat.
    12. present: It names "explosives" / "Unconfirmed reports of explosives", a specific threat.
    13. present: It names "explosives at four sites", a specific threat.
    14. present: It names "explosives at four sites", a specific hazard.
    15. present: "Unconfirmed reports of explosives" names a specific hazard.
    16. present: It names "explosives at four sites", a specific threat.
    17. present: It names "explosives at four sites", a specific threat.
    18. present: It names "explosives at four sites", a specific threat.
    19. present: "explosives at four sites" names a specific threat.
    20. present: It names "explosives at four sites", a specific threat.
    21. present: It names "explosives at four sites on campus", a specific threat.
    22. present: It names "explosives at four sites", a specific threat.
    23. present: It names "explosives at four sites", a specific threat.
    24. present: It names "Unconfirmed reports of explosives", a specific hazard.
    25. present: It cites "reports of explosives at four sites", a specific threat.
  • Locationpresent25/25

    Final assessment

    All 25 reads agree specific buildings are given: Science Center, Thayer, Sever, and Emerson.

    Where the threat is. Saying whether danger is in a specific building, a part of campus, or area-wide lets people judge their own proximity and choose a safe direction. Without a where, a warning is hard to act on precisely.

    See all 25 individual reads
    1. present: It cites "Science Center, Thayer, Sever, and Emerson", specific buildings.
    2. present: It specifies "Science Center, Thayer, Sever, and Emerson".
    3. present: It names "Science Center, Thayer, Sever, and Emerson", specific buildings.
    4. present: It specifies "Science Center, Thayer, Sever, and Emerson".
    5. present: It specifies "Science Center, Thayer, Sever, and Emerson".
    6. present: It says "Science Center, Thayer, Sever, and Emerson", specific places.
    7. present: It names "Science Center, Thayer, Sever, and Emerson" on campus.
    8. present: It specifies "Science Center, Thayer, Sever, and Emerson".
    9. present: It names "Science Center, Thayer, Sever, and Emerson" buildings.
    10. present: It specifies "Science Center, Thayer, Sever, and Emerson", named buildings.
    11. present: It names "Science Center, Thayer, Sever, and Emerson" on campus.
    12. present: It names "Science Center, Thayer, Sever, and Emerson" buildings on campus.
    13. present: It lists "Science Center, Thayer, Sever, and Emerson".
    14. present: It names "Science Center, Thayer, Sever, and Emerson".
    15. present: "four sites on campus: Science Center, Thayer, Sever, and Emerson" specify locations.
    16. present: It cites "Science Center, Thayer, Sever, and Emerson", specific buildings.
    17. present: It names "Science Center, Thayer, Sever, and Emerson".
    18. present: It names "Science Center, Thayer, Sever, and Emerson" buildings on campus.
    19. present: It names "Science Center, Thayer, Sever, and Emerson."
    20. present: It specifies "Science Center, Thayer, Sever, and Emerson", named buildings.
    21. present: It cites "Science Center, Thayer, Sever, and Emerson", specific buildings.
    22. present: It cites "Science Center, Thayer, Sever, and Emerson", specific buildings.
    23. present: It cites "Science Center, Thayer, Sever, and Emerson", specific buildings.
    24. present: It names "Science Center, Thayer, Sever, and Emerson" on campus, specific buildings.
    25. present: It names "Science Center, Thayer, Sever, and Emerson", specific buildings.
  • Guidancepresent25/25

    Final assessment

    All 25 reads agree guidance is present; the alert instructs recipients to evacuate those buildings now.

    The protective action to take. A clear, specific instruction, such as shelter in place, evacuate, avoid the area, or run-hide-fight, drives faster and more correct protective behavior than describing the threat alone.

    See all 25 individual reads
    1. present: "Please evacuate those buildings now" instructs a protective action.
    2. present: It instructs to "evacuate those buildings now", a protective action.
    3. present: It instructs "Please evacuate those buildings now", a protective action.
    4. present: It instructs recipients to "evacuate those buildings now".
    5. present: It instructs "evacuate those buildings now", a protective action.
    6. present: It instructs "Please evacuate those buildings now", a protective action.
    7. present: It instructs "Please evacuate those buildings now".
    8. present: "Please evacuate those buildings now" is a protective instruction.
    9. present: It instructs "Please evacuate those buildings now".
    10. present: It instructs "Please evacuate those buildings now", a protective action.
    11. present: It instructs recipients to "evacuate those buildings now", a protective action.
    12. present: It instructs "Please evacuate those buildings now", a protective action.
    13. present: It instructs recipients to "evacuate those buildings now".
    14. present: It instructs "Please evacuate those buildings now".
    15. present: "Please evacuate those buildings now" is a protective instruction.
    16. present: It instructs "Please evacuate those buildings now", a protective action.
    17. present: It instructs "Please evacuate those buildings now".
    18. present: It instructs recipients to "evacuate those buildings now".
    19. present: "Please evacuate those buildings now" is a protective action.
    20. present: It instructs "Please evacuate those buildings now", a protective action.
    21. present: It instructs "Please evacuate those buildings now", a protective action.
    22. present: It instructs recipients to "evacuate those buildings now", a protective action.
    23. present: It instructs "Please evacuate those buildings now", a protective action.
    24. present: It instructs "Please evacuate those buildings now", a protective action.
    25. present: "Please evacuate those buildings now" is a protective action instruction.
  • Timepresent25/25

    Final assessment

    All 25 reads agree timing is present; "now" conveys immediacy.

    When the message applies. A timestamp, the word now or immediately, or a phrase like until further notice tells the reader whether the danger is current and how quickly to act.

    See all 25 individual reads
    1. present: "now" conveys immediacy, a time cue.
    2. present: "now" conveys immediacy.
    3. present: "now" conveys immediacy, a time cue.
    4. present: The word "now" conveys immediacy.
    5. present: The word "now" conveys immediacy.
    6. present: It says "now", a recency cue.
    7. present: "now" conveys immediacy.
    8. present: "now" conveys immediacy.
    9. present: "now" conveys immediacy, a time cue.
    10. present: "now" conveys immediacy, a time cue.
    11. present: The word "now" conveys immediacy.
    12. present: The word "now" conveys immediacy.
    13. present: The word "now" conveys recency.
    14. present: "now" conveys immediacy.
    15. present: "now" conveys immediacy, a time cue.
    16. present: It says "now", a recency cue.
    17. present: "now" conveys immediacy/recency.
    18. present: The word "now" conveys immediacy, a time cue.
    19. present: "now" conveys immediacy.
    20. present: "evacuate those buildings now" includes "now", an immediate timing cue.
    21. present: "evacuate those buildings now" includes "now", a recency cue.
    22. present: "now" conveys an immediacy time cue.
    23. present: "now" conveys immediacy.
    24. present: "now" conveys immediacy and recency.
    25. present: "now" conveys immediacy.
  • Impactpresent24/25

    Final assessment

    Present by 24 to 1. The strong majority finds reports of explosives at four sites plus an evacuation order convey clear danger of explosion; the lone dissent saw only the hazard named.

    What the hazard could do to the people in its path. Beyond naming the threat, a complete warning conveys its potential consequences or severity, such as that a tornado can level buildings or that a leak could be explosive, so recipients grasp how much danger they are in. Research on warning message content finds that a concrete impact statement helps people personalize their risk and act sooner.

    See all 25 individual reads
    1. present: Reports explosives at four campus sites and orders evacuation, implying clear danger of explosion to people in those buildings.
    2. present: It reports explosives at multiple sites and orders evacuation now, implying a serious life-threatening hazard.
    3. present: Reports explosives at four named buildings and orders immediate evacuation, implying potential for a deadly blast.
    4. present: Reports explosives at four named campus sites and orders immediate evacuation, implying danger of an explosion.
    5. present: It reports explosives at four named sites and orders immediate evacuation of those buildings, implying a serious risk of explosion and harm.
    6. present: Reports explosives at four named buildings and orders immediate evacuation, implying risk of explosion and harm.
    7. present: Reports explosives at four sites and orders immediate evacuation, implying serious danger to people.
    8. present: Reports explosives at four buildings and orders evacuation conveying potential for an explosion harming people.
    9. present: Reports unconfirmed explosives at four campus sites and urges immediate evacuation, implying risk of explosion and harm.
    10. present: Reports explosives at four sites and orders immediate evacuation, strongly implying a deadly explosion hazard.
    11. present: Reports unconfirmed explosives at four sites and orders evacuation now, implying serious danger from possible explosions.
    12. present: Reports explosives at multiple buildings and orders immediate evacuation, implying serious danger to people.
    13. present: Reports possible explosives at multiple buildings and orders evacuation, implying deadly explosive danger.
    14. present: Reports explosives at four buildings and orders immediate evacuation, conveying the danger of explosion.
    15. present: Reports unconfirmed explosives at four named buildings and orders evacuation, implying serious danger to people.
    16. present: Reports explosives at four named sites and orders evacuation now, implying a serious danger from potential explosion.
    17. present: It reports explosives at multiple sites and orders immediate evacuation conveying the danger of explosion.
    18. present: Reports explosives at four named buildings and orders immediate evacuation, implying serious danger of an explosion.
    19. present: Reports explosives at four named buildings and orders immediate evacuation, implying serious risk of harm.
    20. absent: Reports unconfirmed explosives and orders evacuation but states no explicit harm or severity beyond the hazard name.
    21. present: It reports explosives at multiple sites and orders immediate evacuation, implying a life-threatening explosion hazard.
    22. present: Reports explosives at four named sites and orders immediate evacuation, implying serious danger to occupants.
    23. present: Reports explosives at four named buildings and orders immediate evacuation, implying serious life-threatening danger.
    24. present: Reports unconfirmed explosives at four named buildings and orders evacuation, implying serious danger of explosion to people inside.
    25. present: Warns of explosives at four sites and orders evacuation now, implying the deadly destructive potential of explosives requiring immediate evacuation.

Systematic AI judgments with visible reasoning, not human-validated codings.

About this analysis
Context

Background

On the morning of December 16, 2013, during Harvard's final exam period, sophomore Eldo Kim sent anonymous emails to the Harvard University Police Department, the Harvard Crimson student newspaper, and other campus offices with the subject line "bombs placed around campus." The emails claimed "shrapnel bombs" had been placed in four buildings: the Science Center, Sever Hall, Emerson Hall, and Thayer Hall. Kim used the Tor anonymizing browser and the disposable email service Guerrilla Mail to send the threats. However, the FBI was able to identify him by obtaining records showing which Harvard network users had accessed Tor in the hours before the emails were sent. When interviewed that evening, Kim admitted he sent the threats because he wanted to avoid taking a final exam. The case became a widely cited example of how anonymity tools can fail when used on an institutional network that logs connections. Kim ultimately entered a pretrial diversion program rather than facing the maximum penalty of five years in prison.
Analysis

Key Findings

Kim's use of Tor on Harvard's Wi-Fi network was his undoing; the university's network logs showed he was one of the few users accessing Tor in the hours before the threats, allowing the FBI to quickly narrow the suspect pool
The 32-minute gap between the threatening email (8:30 a.m. EST) and the first campus alert (9:02 a.m. EST) was relatively fast for 2013-era emergency notification systems
The six-hour building closure during finals week disrupted exams for hundreds of students, exactly the outcome Kim intended
The case prompted national discussion about the limitations of online anonymity tools and the severity of bomb hoax consequences
Outcome
Kim confessed to the FBI on the evening of December 16. He was charged with making a hoax bomb threat, entered a pretrial diversion program with 750 hours of community service, four months of home confinement, and restitution to law enforcement agencies.
Provenance

Sources

  1. Student Paper
    Six-Hour Bomb Scare Proves Unfounded - The Harvard Crimson
    thecrimson.com
    archived copy
  2. News
    Harvard student Eldo Kim charged in final-exam bomb hoax - CNN
    edition.cnn.com
    archived copy
  3. News
    Student Is Charged In Harvard Bomb Scare - NPR
    npr.org
    archived copy
  4. News
    Failing grade: Alleged Harvard bomb hoaxer needed more than Tor - NBC News
    nbcnews.com
    archived copy
  5. Student Paper
    Eldo Kim Charged in Bomb Threat Case, Unlikely To Get Jail Time - The Harvard Crimson
    thecrimson.com
    archived copy
Cite this case

Campus Alert Archive. "Harvard University: Emailed bomb threats evacuated four buildings during finals; a student admitted the hoax." Incident of December 16, 2013. Added May 2026; last updated July 2026. https://campusalertarchive.com/case/harvard-university-bomb-threat-2013-12-16/

Download case JSON

Alert text quoted on this page remains the work of the issuing institution; the archive is a secondary source.

Tags
bomb-threathoaxfinals-weektor-anonymityfbiivy-leaguemassachusettsstudent-perpetratorHoax
Added May 2026Updated July 2026Via ingestion