Schools have a duty to protect their students and staff from harm against a range of risks from a variety of sources, including online security threats. As recent events in the US and Sweden demonstrate, schools can be vulnerable to attacks by armed individuals with tragic results. In Australia, armed assaults on school grounds are extremely rare, but schools must be vigilant in order to ensure the safety of the school community.

The fact that four educational facilities in Sydney were recently subject to online threats in less than two weeks demonstrates that online security threats are real and should be recognised as legitimate threats to school security. In all instances, the Police were contacted and investigations were made regarding the credibility of the threats and the correct response in the school community.

A key way in which security risks can be monitored is by the identification and evaluation of online threats.

The threats: four real incidents

On 12 October 2015 the University of New South Wales’ Kensington campus was placed on high alert following a post on the website 4Chan. A threat was made on an online forum, accompanied by a picture of a gun. The University stated that it saw the statement as a general threat and would treat the situation extremely seriously. An email was sent to students and staff advising them of the threat and informing them that they would be working alongside police to resolve the matter.

The Sydney Morning Herald reported that the University campus remained open and Police patrolled it throughout the day. Students were permitted to stay home if they felt threatened. Although the threat was not considered credible, precautions were still taken to protect students.

Just over a week later, two Sydney schools were subject to online terror threats. East Hills Boys High School in Panania and Sir Joseph Banks High School in Revesby were both placed on lockdown on 20 October, and counter terrorism Police were dispatched to the schools. The Australian reported that East Hills Boys High School had been vandalised with pro-Islamic State graffiti last year and that Police had asked teachers to monitor the students, following fears that the students were at risk of radicalisation. The NSW Department of Education liaised with parents to keep them informed of any developments, and a lunchtime assembly was held to update students.

Finally, St Andrew’s Cathedral School was placed in lockdown two days later when a threat was made on social media. Police patrolled the school as a precaution and issued a reminder that it is an offence to post threats or incite violence on social media. News.com.au reported that the threats were sent to the school, and it then notified the Police.

Online anonymity

One of the core challenges presented by online threats is that it is often difficult to assess whether threats are credible or not. Online threats can be made anonymously, and so the likelihood of harm occurring is nearly impossible to assess with total accuracy. Social media sites and forums such as 4Chan are commonly used by students, and what may seem to be a prank by a student could be interpreted as a genuine threat. Students can fail to understand the legal ramifications of their social media posts, and so make threats that are only intended to be a practical joke. Regardless of the intention of the poster, the threat can cause expense to both schools and to Police as the matter is investigated and action is taken to protect students.

The fact that a threat may be legitimate must be considered meaning that such a threat should be contemplated as part of a school’s risk management program.

How to respond to threats: risk management and criticial incident planning

The occurrence of four online security incidents in recent weeks involving educational providers demonstrates that a disturbing new trend may be emerging.

Even if the likelihood of the threat eventuating is slim, schools should still be prepared for any type of disruptive event. The introduction of a sound Risk Management Program should contemplate a wide range of possible risk events and capture and prepare for different types of disruptions.

Whatever the source of the potential risk event – be it the threat of a terrorist attack, an actual terrorist attack, or some other disaster, and regardless of how the threat is conveyed, a school should methodically consider these risks and put into place controls either to prevent the incident from occurring (e.g. security) or to reduce the potential impact of the event if it is to occur (e.g. critical incident response plans).

See our previous article about why having a lockdown procedure is an important risk control which should be part of every school’s Risk Management program.

And as part of any Critical Incident Response Plan, a school should have a media and communications policy which outlines who is responsible for communicating with key stakeholders, including students, parents and the media, in the event that a security threat is received, such as those communicated online.

In some circumstances, it may be useful to direct stakeholders to a webpage or a social media site where updates can be posted. It is important to ensure that these incidents are managed in a transparent way which outlines the nature of the threats and the measures being taken by the school, unless it is necessary or desirable to keep the information confidential.

How prepared is your school to response to critical incidents? When was the last time you tested your business continuity plans?