The language of uncertainty
Bomb threats and swatting calls force a problem that active-shooter alerts never have: the threat is almost always not real, and the institution knows that statistically as it composes the message. The alerts in this chapter document how universities have learned, slowly, unevenly, and never quite well enough, to take a credible-but-improbable threat seriously without telling 30,000 students that the building they are in is about to explode.
The 197 cases here cover three overlapping genres: phoned or emailed bomb threats (the genre HBCUs faced in waves in 2022 and again in 2025), suspicious-package incidents (almost always backpacks, sometimes laptops, occasionally something more interesting), and swatting calls (false 911 reports of an active shooter, designed to elicit a tactical police response).
The HBCU bomb threat waves of 2022 and 2025
In early February 2022, more than two dozen historically Black colleges and universities received bomb threats over a four-day window. The threats were credible enough that institutions canceled class, evacuated dormitories, and held shelter-in-place orders for hours. Most were eventually traced to a small number of individuals using voice-over-IP services to mask their location; the FBI's investigation eventually identified a juvenile suspect. A near-identical wave hit again in early 2025, targeting the same institutions plus several that had not been hit before. The 2025 alerts in this chapter are a study in institutional learning: messages from Howard, Spelman, Morehouse, FAMU, NC A&T, NCCU, Hampton, Tennessee State, and others were measurably more confident, more directive, and faster than their 2022 counterparts.
The verbatim text matters because the language of the second wave was visibly informed by the first. Where 2022 messages tended toward "out of an abundance of caution, the campus is being evacuated", 2025 messages were more likely to read "due to a credible threat received this morning", the institutional voice having decided that the threat itself, not the institutional caution, was the news.
The genre's two failure modes
Bomb-threat alerts fail in two ways, and the cases in this chapter document both.
Failure mode one is the over-tell. Some institutions, in the 2010s, treated every bomb threat as a Clery-mandated emergency notification, sending campus-wide SMS for a backpack left unattended in a library carrel. The cumulative effect across this archive's earlier cases is alert fatigue: students who receive five or six false-alarm messages a year start ignoring all of them, including the seventh. Several cases in this chapter explicitly cite an after-action review concluding the institution should have used a "timely warning" or building-only notice instead of the full-campus emergency push.
Failure mode two is the under-tell. Some institutions, anxious about alert fatigue, have not sent a campus-wide message even when one was warranted, deciding that a building evacuation handled by foot-and-megaphone was sufficient. When this works, no one notices. When it doesn't, when students in adjacent buildings have no idea why a sea of police cars is outside, the trust cost is high. Several incidents in this chapter resulted in formal complaints to the Department of Education's Clery enforcement office for exactly this failure.
Swatting: the alert that has to assume the worst
Swatting cases in this chapter, including Boston University (April 9, 2023), University of Pittsburgh (April 11, 2023), the April 7, 2023 Oklahoma incident ("OU-Norman Emergency: Active threat on Norman campus. Run, Hide, Fight."), and the 2023 wave that hit roughly thirty institutions over a single week, all share one structural feature: the dispatcher receives a 911 call describing an active shooter at a specific building, with specific casualty counts, in detail. The call is not a prank phoned in by a student. It is a deliberate, professionally-prepared false report whose purpose is to provoke a tactical police response.
The institutional question is whether to treat the call as real. The cases in this chapter say: yes, every time, until proven otherwise. The alerts that come out of swatting events are textually identical to active-shooter alerts. The difference shows up only in the second message, the one sent thirty to ninety minutes later, after building sweeps have come up clean, which switches from "Active threat in [building], shelter in place" to language like "No threat located. Investigation continues. Police presence will remain in the area." That second message is not an all-clear. The all-clear, when it comes, is a third message hours later that explicitly lifts the shelter-in-place. Several cases in this chapter sit on the boundary between the second and third: institutions used "All clear" as a subject line on a message whose body still asked people to avoid the area.
What this chapter teaches
Bomb threats and swatting cases are where institutions learn how to be honest about uncertainty in writing. The verbatim language in this chapter rewards careful reading because it documents an institution's evolving epistemology: how does the alert distinguish what is known (a threat was received), what is being investigated (whether the threat is credible), and what is being asked of you (a specific protective action)? Bad alerts collapse all three into vague urgency. Good alerts keep them apart.
When you scroll through the case list below, the cases worth comparing side-by-side are the ones where the same institution issued multiple bomb-threat alerts across different years. The drift in language tells you what that institution learned.