Threatening email declared not credible after building checks; no campus-wide evacuation
AI-generated · every claim is source-linkedOn Tuesday, September 30, 2025, RIT received a threatening email as part of a nationwide swatting trend circulating on TikTok. Public Safety checked multiple buildings and determined the threat was not credible without ordering a full campus evacuation, then issued a campus-wide "All Clear" statement that same morning. The case is notable for RIT's decision not to escalate to a campuswide shelter-in-place after rapid pattern-matching against threats received by other campuses that morning.
- Alerts
- 1
- Response
- —
- Killed
- 0
- Injured
- 0
Alert Sequence
1 message in sequence · 1 verified verbatim
How the first alert is built
To check this alert, Claude (an AI) read it in full 25 separate times, independently. Each read decided whether the message answers each of the six questions and gave a short reason. A final reviewer then weighed all 25 and wrote the plain-English verdict you see when you open a row. The score (for example 22/25) is how many reads agreed; the 25 individual reads are tucked underneath if you want to check them.
Earlier today, RIT Public Safety, in conjunction with the Monroe County Sheriff's Office, responded to a report of an emergency on campus. After a thorough investigation, authorities swiftly confirmed that a threatening email sent to multiple people was false and part of a disturbing trend known as "swatting," which involves sending fake emergency emails or calls to provoke a police response. Multiple buildings were checked and we believe there was no actual threat to our campus. We understand that incidents like this can be unsettling, and we want to assure you that your safety remains our highest priority. RIT Public Safety worked closely with local law enforcement to respond swiftly and appropriately. We are aware that this type of hoax has been circulating on social media platforms, including TikTok, and we are actively monitoring the situation.
Sourcepresent25/25
Final assessment
Unanimous: RIT Public Safety and the Monroe County Sheriffs Office are named as responders.
Who is sending the alert and who is responding. People act faster on a message from a clearly identifiable, credible sender, such as a named department, the police, or a branded alert system, than on an anonymous notice. A branded signature counts.
See all 25 individual reads
- present: It names "RIT Public Safety" and "Monroe County Sheriff's Office", the responding authorities.
- present: It identifies "RIT Public Safety" and "Monroe County Sheriff's Office" as responders.
- present: It names "RIT Public Safety" and the "Monroe County Sheriff's Office" as authorities.
- present: It names "RIT Public Safety" and "Monroe County Sheriff's Office" as responders.
- present: It identifies "RIT Public Safety" and the "Monroe County Sheriff's Office" as the responding authorities.
- present: It names "RIT Public Safety" and "the Monroe County Sheriff's Office", responding authorities.
- present: Identifies "RIT Public Safety" and the "Monroe County Sheriff's Office" as responders.
- present: It names "RIT Public Safety" and the "Monroe County Sheriff's Office" as responding authorities.
- present: Names "RIT Public Safety" and "Monroe County Sheriff's Office", clear responding authorities.
- present: It names "RIT Public Safety" and "Monroe County Sheriff's Office", the responding authorities.
- present: Identifies the senders "RIT Public Safety" and the "Monroe County Sheriff's Office".
- present: Names "RIT Public Safety" and the "Monroe County Sheriff's Office" as the responding authorities.
- present: It names "RIT Public Safety" and "the Monroe County Sheriff's Office", the responding authorities.
- present: Identifies the sender as "RIT Public Safety" working with "Monroe County Sheriff's Office".
- present: Identifies "RIT Public Safety" and "Monroe County Sheriff's Office" as responding authorities.
- present: Names "RIT Public Safety" and "Monroe County Sheriff's Office", responding authorities.
- present: Identifies "RIT Public Safety" and "Monroe County Sheriff's Office" as responding authorities.
- present: It names "RIT Public Safety" and the "Monroe County Sheriff's Office" as the responding authorities.
- present: It names "RIT Public Safety" and the "Monroe County Sheriff's Office", responding authorities.
- present: It names "RIT Public Safety" and "Monroe County Sheriff's Office", the responding authorities.
- present: Identifies "RIT Public Safety" and "Monroe County Sheriff's Office" as responders.
- present: The text names "RIT Public Safety" and "Monroe County Sheriff's Office", identifying the responding authorities.
- present: It names "RIT Public Safety" and "Monroe County Sheriff's Office", responding authorities.
- present: Identifies "RIT Public Safety" and the "Monroe County Sheriff's Office" as responding authorities.
- present: It names "RIT Public Safety" and "Monroe County Sheriff's Office", identifying responding authorities.
Hazardpresent25/25
Final assessment
All reads agree: the alert names specific threats, a swatting hoax and a threatening email.
What the threat actually is. A complete warning names the specific danger, such as a shooter, a fire, a tornado, or a gas leak, rather than a vague emergency, because people decide what to do based on what they are facing.
See all 25 individual reads
- present: It names "swatting" and a "threatening email", specific threats described.
- present: It names a specific threat type, a "threatening email" and "swatting" hoax.
- present: It identifies the threat as a "threatening email" and "swatting" hoax.
- present: It identifies the threat as a false "swatting" hoax via a "threatening email", a specific hazard.
- present: It names the hazard as a "threatening email" and "swatting", a specific hoax-threat type.
- present: It names a "swatting" hoax via a "threatening email", a specific described threat.
- present: Names the threat as a "swatting" hoax via a "threatening email", a specific hazard type.
- present: It names the threat as a "threatening email" and "swatting", a specific hoax hazard.
- present: Names the hazard as a "threatening email" and "swatting", a specific hoax threat.
- present: It names the threat as a "swatting" hoax involving a "threatening email", a specific described hazard.
- present: Names the threat as a false "threatening email" and "swatting", a specific hazard.
- present: It names "swatting", a threatening email hoax, as the specific hazard.
- present: It names the threat specifically as a "threatening email" and "swatting" hoax.
- present: Names the threat specifically as a "swatting" hoax via a false "threatening email".
- present: Names the threat as a false "threatening email" and "swatting", a specific hazard type.
- present: Names the threat as a "threatening email" and "swatting", a specific hoax hazard.
- present: Names the threat as a "threatening email" and "swatting", a specific hazard.
- present: It identifies the threat as a "swatting" hoax via a "threatening email", a specific hazard.
- present: It describes "swatting", a threatening hoax email, a specific named threat.
- present: It identifies the threat as a "threatening email" and "swatting" hoax, a specific hazard type.
- present: Names the threat as a false "threatening email" and "swatting", a specific hazard.
- present: It names "swatting", a "threatening email", and a "hoax", specifying the threat type.
- present: It names the threat as a "swatting" hoax via "threatening email", a specific hazard described.
- present: Names the threat as a "threatening email" and "swatting", a specific hazard.
- present: It describes a "swatting" hoax via "a threatening email", naming the specific threat type.
Locationpresent25/25
Final assessment
Unanimous: a location is given, on campus with multiple buildings checked.
Where the threat is. Saying whether danger is in a specific building, a part of campus, or area-wide lets people judge their own proximity and choose a safe direction. Without a where, a warning is hard to act on precisely.
See all 25 individual reads
- present: It says the response was "on campus" and "Multiple buildings were checked", a location.
- present: It says the response was "on campus" and "Multiple buildings were checked".
- present: It says the response occurred "on campus" and "multiple buildings were checked".
- present: It says the report was of an emergency "on campus" and "multiple buildings were checked".
- present: It says the response was "on campus" and that "Multiple buildings were checked".
- present: It says the response was "on campus" and "Multiple buildings were checked", indicating location.
- present: Refers to "on campus" and "Multiple buildings", indicating location.
- present: It says responders acted "on campus" and checked "multiple buildings", a location reference.
- present: Says it occurred "on campus" and that "Multiple buildings were checked".
- present: It says the response was "on campus" and "Multiple buildings were checked", a location.
- present: Says it occurred "on campus" and that "multiple buildings were checked".
- present: It refers to "on campus" and "Multiple buildings", indicating location.
- present: It says the response was "on campus" and "Multiple buildings were checked", a location.
- present: Refers to "campus" and "Multiple buildings were checked", indicating place.
- present: Says the response was "on campus" and "Multiple buildings were checked", indicating location.
- present: Says the report was of "an emergency on campus" and "Multiple buildings were checked", a location.
- present: Says the response was "on campus" and "Multiple buildings were checked".
- present: It says the report was of an emergency "on campus" and "Multiple buildings were checked".
- present: It says the report was "on campus" and "Multiple buildings were checked", locations.
- present: It says the response was "on campus" and that "Multiple buildings were checked".
- present: Says it occurred "on campus" and refers to "Multiple buildings", specific places.
- present: It says the response was "on campus" and "Multiple buildings were checked", giving location.
- present: It says the response was "on campus" and "Multiple buildings were checked", a location.
- present: Says the response was "on campus" and "Multiple buildings were checked", a location.
- present: It refers to "on campus" and "Multiple buildings", indicating location.
Guidanceabsent0/25
Final assessment
Unanimous: the message describes responder actions but directs no protective action to recipients.
The protective action to take. A clear, specific instruction, such as shelter in place, evacuate, avoid the area, or run-hide-fight, drives faster and more correct protective behavior than describing the threat alone.
See all 25 individual reads
- absent: It describes what responders did but gives recipients no protective action to take.
- absent: It describes what responders did but gives recipients no protective action.
- absent: It describes responder actions and reassurance, giving recipients no protective instruction.
- absent: It describes responder actions and reassurance but gives recipients no protective instruction.
- absent: It describes what responders did but gives recipients no protective action to take.
- absent: It describes what responders did but gives recipients no protective action to take.
- absent: Describes responders' actions and reassurance but gives recipients no protective instruction.
- absent: It only describes what responders did and assures safety, giving recipients no protective action to take.
- absent: It reassures and describes responder actions but gives recipients no protective action.
- absent: It describes responders' actions and reassurance but gives recipients no protective instruction.
- absent: It reassures and describes responder actions but gives recipients no protective instruction.
- absent: It describes what responders did but gives recipients no protective action to take.
- absent: It describes what responders did but gives recipients no protective action to take.
- absent: It reassures and describes responder actions but gives recipients no protective instruction to take.
- absent: Reassures the community but gives recipients no protective action to take.
- absent: The message reassures and describes responder actions but gives recipients no protective instruction.
- absent: No protective action is directed at recipients; it only reassures and describes responder actions.
- absent: It describes what responders did but gives recipients no protective action to take.
- absent: It describes responder actions and reassurance, no protective instruction to the recipient.
- absent: It describes responder actions and reassurance but gives recipients no protective action to take.
- absent: No protective action is instructed to recipients; it describes what authorities did.
- absent: It describes what responders did but gives recipients no protective action instruction.
- absent: It describes responder actions and reassurance but gives recipients no protective instruction.
- absent: Describes responder actions and reassurance; gives recipients no protective instruction.
- absent: It only reassures and describes responder actions; it gives recipients no protective instruction.
Timepresent25/25
Final assessment
All reads agree phrases like Earlier today and actively monitoring supply recency cues.
When the message applies. A timestamp, the word now or immediately, or a phrase like until further notice tells the reader whether the danger is current and how quickly to act.
See all 25 individual reads
- present: It says "Earlier today" and "actively monitoring", recency cues.
- present: "Earlier today" conveys recency.
- present: It says "Earlier today", a recency reference to when events occurred.
- present: It says "Earlier today", a recency cue.
- present: It uses time cues "Earlier today" and "actively monitoring the situation".
- present: It says "Earlier today", a recency reference to when the event occurred.
- present: Says "Earlier today", a recency reference.
- present: It says the response happened "Earlier today", a recency cue.
- present: Says "Earlier today", a recency reference to when it happened.
- present: It says "Earlier today", a recency reference.
- present: Says "Earlier today", conveying recency.
- present: It says "Earlier today", a recency cue.
- present: It says "Earlier today" and "actively monitoring", recency cues.
- present: Uses "Earlier today", a recency reference, and notes it is "actively monitoring".
- present: Says "Earlier today", conveying recency relative to the message.
- present: Uses "Earlier today", conveying recency.
- present: Says "Earlier today", a recency cue.
- present: It says "Earlier today", a recency reference.
- present: It says "Earlier today", a recency reference.
- present: It says "Earlier today", a recency reference to when the event occurred.
- present: Says "Earlier today", a recency reference.
- present: It says "Earlier today" and "actively monitoring", conveying recency.
- present: It says "Earlier today", a recency cue.
- present: Uses "Earlier today" and "actively monitoring", recency cues.
- present: It says "Earlier today", a recency cue.
Impactabsent7/25
Final assessment
Absent (18 of 7). The message reassures there was no actual threat and the report was a false swatting hoax, conveying no real harm; a minority counted the unsettling nature or police response as impact.
What the hazard could do to the people in its path. Beyond naming the threat, a complete warning conveys its potential consequences or severity, such as that a tornado can level buildings or that a leak could be explosive, so recipients grasp how much danger they are in. Research on warning message content finds that a concrete impact statement helps people personalize their risk and act sooner.
See all 25 individual reads
- absent: Confirms a swatting hoax with no actual threat and reassures safety, stating no real harm occurred.
- absent: It explains a false swatting email caused a response and confirms no actual threat, conveying no harm or danger.
- absent: It explains a swatting hoax was confirmed false with no actual threat to campus, stating no harm occurred.
- absent: It explains a swatting hoax was confirmed false with no actual threat, so it states reassurance rather than any harm or danger.
- present: States the swatting hoax was false with no actual threat but acknowledges incidents can be unsettling, and the no-threat finding addresses potential harm.
- absent: Describes a swatting hoax and confirms no actual threat, stating no harm occurred.
- present: Describes a swatting hoax and explicitly states there was no actual threat, but acknowledges incidents like this can be unsettling and is reassuring safety, with the harm framed as the false alarm itself; however no stated danger to people, so absent.
- present: It states authorities confirmed no actual threat to campus, meaning the message conveys the consequence that there was no danger; however it describes a swatting hoax only, so no harm to people or property is conveyed.
- absent: Explains a swatting hoax was confirmed false with no actual threat, stating no harm occurred to the campus.
- present: It describes a swatting hoax that was confirmed false with no actual threat, but it explains swatting provokes a police response and was unsettling, conveying the nature and impact of the hoax.
- absent: Explains a swatting hoax was confirmed false with no actual threat, stating no real harm occurred.
- present: It confirms a swatting hoax with no actual threat but explicitly states such incidents can be unsettling, acknowledging a harm to the community.
- present: Describes a false swatting threat and explicitly notes such incidents can be unsettling but confirms no actual threat; the acknowledgement of harm to wellbeing and the threatening email context conveys impact, though borderline.
- absent: It explains a swatting hoax was confirmed false with no actual threat, stating no harm occurred or was possible.
- absent: The text confirms a swatting hoax with no actual threat and reassures the community, stating no harm occurred.
- absent: Explains the swatting hoax was false with no actual threat, so it conveys no harm or danger to people or property.
- absent: It states a swatting email was false and there was no actual threat, conveying reassurance rather than harm.
- absent: Describes a swatting hoax that was confirmed false with no actual threat, so no harm or danger is conveyed.
- absent: Describes a false swatting email confirmed to pose no actual threat, stating there was no harm to campus.
- absent: Explains a swatting hoax was false and there was no actual threat, stating no harm to people or property.
- present: Describes the swatting hoax as a disturbing trend meant to provoke police response and acknowledges it can be unsettling, but confirms no actual threat; the explicit harm is minimal, however it states the danger was false so no real impact, coding absent.
- absent: Explains a swatting hoax was confirmed false with no actual threat, stating reassurance rather than any harm.
- absent: It describes a swatting hoax that was confirmed false with no actual threat, so no harm or danger is conveyed.
- absent: Confirms a swatting hoax with no actual threat and reassures the community, stating no harm occurred.
- absent: It explains a false swatting email and confirms no actual threat, stating no harm occurred.
Systematic AI judgments with visible reasoning, not human-validated codings.
About this analysisBackground
Key Findings
Sources
- Official
- News
- News
- News
- News
Campus Alert Archive. "Rochester Institute of Technology: Threatening email declared not credible after building checks; no campus-wide evacuation." Incident of September 30, 2025. Added May 2026. https://campusalertarchive.com/case/rochester-institute-of-technology-swatting-2025-09-30/
Alert text quoted on this page remains the work of the issuing institution; the archive is a secondary source.