Cybersecurity expert explains Scottish school bomb hoax

Schools across Scotland were targeted with “threatening messages” on Monday, prompting more than 300 calls to police and a rise in school absences.

Police Scotland said it was treating the incident as a hoax with similar messages sent to schools in Europe.

The threat came as many schools in Scotland were on holiday, while some had an in-service day, and others had just returned following the October break.

STV News has asked a cybersecurity expert how common threats like these are and how we can prepare for similar incidents in the future.

How common are threats like this?

Dr Junade Ali is an Edinburgh-based cybersecurity expert and fellow at the Institution of Engineering and Technology.

He told STV News that threats of this nature have been seen across the world, but they are very rarely credible.

“We have definitely in the UK and more generally in Europe seen bomb threats sent to schools,” he said.

“But fortunately, we haven’t seen them materialise into real-world threats.

There are concerns these types of incidents may be on the rise, but Dr Ali said they tend to “come and go”.

He added: “We have seen recent examples over recent years of these types of things happening, but fortunately they have continued to be relatively rare”.

Can they find those responsible?

Police Scotland confirmed staff from its Cyber and Fraud Unit are carrying out extensive enquiries to establish the source.

But what exactly does that process look like?

“Police would investigate and they would try and identify who has sent these emails,” Dr Ali said.

“That would typically involve going to the email service providers of the email addresses this was sent from, getting that information and then going to the broadband providers and trying to track that back to an individual.”

Dr Ali says the police would then attempt to locate the perpetrators and seize their electronic devices to identify what has happened.

What’s the motivation?

The threats have caused disruption to schools across Scotland, with many seeing attendance plummet on Tuesday as parents worry about sending in their children.

Dr Ali says financial gain is often a motivating factor in cyber crime, which is why these kind of threatening messages are more rare.

“In terms of cybercrime in general, disruption alone is something we’re seeing a lot less of as a motive,” he said.

“What we’re increasingly seeing is that people try and profit from cybercrime. They try and achieve both disruption and also try and profit from them and so these types of incidents there often isn’t the capability for people to be able to profit from them so that they aren’t as frequent.”

How should people prepare?

Police are treating Monday’s incident as a hoax, but many people will be concerned that something similar could happen again.

Many parents and carers took to social media to share theories about how and why this happened, and who could be responsible.

“I think it’s something we will probably definitely see happening again like it’s happened in the past so it’s something where there will be people who will who will want to want to try and do this,” Dr Ali said.

Police Scotland said it had received more than 300 calls following the incident.

Dr Ali thinks it’s important to have plans in place if this type of incident were to happen again.

“Obviously during live investigations there are things they can’t share but I think that’s that’s really the critical step is ensuring that there is some kind of communication in place and for things you can prepare for it obviously helps to prepare for them,” he said.

“But obviously there are lots of things in life that we can’t prepare for entirely so it’s worth just making sure that you have kind of the those communication systems in place so when things do happen you can you can react to them.”

What has Police Scotland said?

In an updated statement on Tuesday, Police Scotland confirmed there is nothing to suggest there is any threat to the public, and that its Cyber and Fraud Unit are carrying out extensive enquiries to establish the source.