Confirmed HoaxDetermined to be a hoax. The institutional response is documented because it reveals how the alert system performed under a perceived real threat.
Sophomore Eldo Kim emailed bomb threats at approximately 8:30 a.m. claiming "shrapnel bombs" were placed in four campus buildings, triggering a six-hour evacuation during final exams. The FBI identified Kim within hours by cross-referencing Tor network usage on Harvard's Wi-Fi with the anonymous email service Guerrilla Mail.
Alerts
3
Response
—
Killed
—
Injured
—
Institution
Harvard University
Private R1 · MA
~21,000 studentsMessageMe
Confirmed Timeline
Alert Sequence
3 messages in sequence · 2 verified verbatim
Some alert texts below are approximate reconstructions from news coverage, not confirmed verbatim transcripts. Reconstructed texts are shown in italic with a dashed border. Verified verbatim texts have a solid border and are marked accordingly.
Unconfirmed reports of explosives at four sites on campus: Science Center, Thayer, Sever, and Emerson. Please evacuate those buildings now.
First MessageMe alert sent at 9:02 a.m. EST on December 16, 2013, approximately 30 minutes after the threatening emails were sent at 8:30 a.m.
Buildings listed in a different order than the alphabetical/geographic ordering — Science Center first, then Thayer, Sever, and Emerson — likely reflecting the order in which the threats named them
The four buildings were chosen because Kim had a final exam scheduled in Emerson Hall that morning
'Unconfirmed reports' — Harvard signals epistemic uncertainty in the alert itself, a notable transparency choice for an evacuation directive
Harvard Alert-HUPD and CPD are on the scene and investigating. Please stand by for more info.
Sent 11 minutes after the initial alert at 9:13 a.m. EST on December 16, 2013
'CPD' is Cambridge Police Department; 'HUPD' is Harvard University Police Department — Harvard's MessageMe uses local acronyms without expansion
'Please stand by for more info' is a deliberate brevity tactic appropriate for SMS
94-character message respects SMS standards much more strictly than the initial 139-character evacuation alert
ALL CLEAREmail
Approximate reconstruction·316 chars
HARVARD ALERT: All clear. After extensive investigation by HUPD, Cambridge Police, FBI, ATF, and Secret Service, no explosive devices were found in the Science Center, Sever Hall, Emerson Hall, or Thayer Hall. These buildings are now reopened. Final exams previously scheduled in these buildings will be rescheduled.
This text has been reconstructed from news coverage and may not reflect the exact original wording.
The all-clear came nearly six hours after the initial evacuation, following thorough sweeps by multiple federal, state, and local agencies
The massive multi-agency response included HUPD, Cambridge Police, FBI, ATF (Bureau of Alcohol, Tobacco, Firearms and Explosives), and the Secret Service
Afternoon exams scheduled for the Science Center were also canceled as the investigation continued past noon on December 16, 2013
Context
Background
On the morning of December 16, 2013, during Harvard's final exam period, sophomore Eldo Kim sent anonymous emails to the Harvard University Police Department, the Harvard Crimson student newspaper, and other campus offices with the subject line "bombs placed around campus." The emails claimed "shrapnel bombs" had been placed in four buildings: the Science Center, Sever Hall, Emerson Hall, and Thayer Hall. Kim used the Tor anonymizing browser and the disposable email service Guerrilla Mail to send the threats. However, the FBI was able to identify him by obtaining records showing which Harvard network users had accessed Tor in the hours before the emails were sent. When interviewed that evening, Kim admitted he sent the threats because he wanted to avoid taking a final exam. The case became a widely cited example of how anonymity tools can fail when used on an institutional network that logs connections. Kim ultimately entered a pretrial diversion program rather than facing the maximum penalty of five years in prison.
Analysis
Key Findings
01Kim's use of Tor on Harvard's Wi-Fi network was his undoing; the university's network logs showed he was one of the few users accessing Tor in the hours before the threats, allowing the FBI to quickly narrow the suspect pool
02The 32-minute gap between the threatening email (8:30 a.m.) and the first campus alert (9:02 a.m.) was relatively fast for 2013-era emergency notification systems
03The six-hour building closure during finals week disrupted exams for hundreds of students, exactly the outcome Kim intended
04The case prompted national discussion about the limitations of online anonymity tools and the severity of bomb hoax consequences
Outcome
Kim confessed to the FBI on the evening of December 16. He was charged with making a hoax bomb threat, entered a pretrial diversion program with 750 hours of community service, four months of home confinement, and restitution to law enforcement agencies.