The language of uncertainty
Bomb threats and swatting calls force a problem that active-shooter alerts never have: the threat is almost always not real, and the institution knows that statistically as it composes the message. The alerts in this chapter document how universities have learned, slowly and unevenly, to take a credible-but-improbable threat seriously without telling 30,000 students that the building they are in is about to explode.
The 230 cases here cover three overlapping genres: phoned or emailed bomb threats (the genre HBCUs faced in waves in 2022 and again in 2025), suspicious-package incidents, and swatting calls (false 911 reports of an active shooter, designed to elicit a tactical police response).
The HBCU bomb-threat waves of 2022 and 2025
In January and February 2022, historically Black colleges and universities across the country received bomb threats in clustered waves: one around January 4, a larger one on January 31 and February 1, and a tail through February. Institutions canceled classes, evacuated dormitories, and held shelter-in-place orders for hours. The FBI's investigation attributed the bulk of the threats to a single juvenile suspect. The messages preserved here span the genre's whole register, from North Carolina Central's evacuation order ("A BOMB THREAT has been reported on campus. Please proceed immediately to the nearest exit and vacate the building. Leave campus.", closing "THIS IS NOT A DRILL") to Bowie State's quieter "All persons on campus are advised to shelter in place until further information is available."
A second wave hit in September 2025, concentrated on September 11 and again on September 30: the archive's case files from those days cover Alabama State, Bethune-Cookman, Clark Atlanta, Spelman, Morehouse, Florida A&M, Hampton, Southern, and Virginia State, with Alabama A&M, Delaware State, Morgan State, and Prairie View A&M in the later cluster. A difference readable in the texts themselves: some of the 2025 messages respond to the wave as a wave. Spelman's alert opens "We are aware of threats received today by several HBCU’s, including Clark Atlanta University here in the AUC"; Florida A&M's begins "FAMU Police Department is aware of recent email threats reported across the higher education community". The 2022 short-form texts each answer a threat to one campus; in that wave, the wider pattern surfaces only in the slower email register, as when Howard University's January 31 community message opens by naming it: "In recent weeks, several historically Black colleges and universities nationwide have been subjected to anonymous bomb threats". Both waves are preserved side by side for exactly that comparison.
The September 30 cluster reached well past the HBCU list. The same day's case files include Towson, Nazareth University, Monroe County Community College, the University of Delaware, and the University of Alaska Fairbanks, with Colby and Bowdoin hit the day before, and several of the emailed threats named the campus library specifically: Prairie View's John B. Coleman Library, Morgan State's Richardson Library, the library at Bowdoin. At the Cleveland Institute of Art, a roughly 600-student art and design college, the alert preserved here came from a neighbor: "CWRU Alert: Multiple agencies investigating bomb threat at Cleveland Institute of Art. Out of an abundance of caution, CWRU will evacuate buildings in the vicinity." Case Western Reserve warned its own community about the threat next door and evacuated its own nearby buildings, a cross-campus register the district's shared geography makes necessary.
The genre's two failure modes
Bomb-threat response is one trade-off with two failure modes, and institutions land on both sides of it.
Failure mode one is the over-tell. Treat every threat as a campus-wide emergency notification, including the unattended backpack in a library carrel, and the cumulative effect is alert fatigue: recipients who get several false-alarm messages a year have no way to tell the seventh from the real one.
Failure mode two is the under-tell. An institution anxious about that fatigue handles a building evacuation by foot and megaphone and sends nothing campus-wide. When this works, no one notices. When it doesn't, students in adjacent buildings watch a sea of police cars arrive with no explanation, and the trust cost is high.
Swatting: the alert that has to assume the worst
Swatting calls describe an active shooter at a specific building, sometimes with specific casualty counts, in convincing detail; the purpose is to provoke a tactical police response. A concentrated wave hit campuses in April 2023, and this chapter documents it across more than a dozen institutions, including Boston University (April 9, 2023), the University of Pittsburgh (April 10, 2023), and the University of Oklahoma (April 7, 2023), whose first alert read "OU-Norman Emergency: There is an active shooter at the Van Vleet Oval. Take immediate action now. Run. Hide. Fight!"
The institutional question is whether to treat the call as real, and the alerts in this chapter answer: yes, until proven otherwise. A swatting first alert is textually indistinguishable from an active-shooter first alert, because at the moment of composition nobody knows which one it is. The difference appears in the follow-up, sent after building sweeps come up clean. BU's second message concedes the ambiguity in real time: "Although we are still investigating, at this time we are confident that there is no threat to our community." OU's closes it: "OUPD has issued an ALL CLEAR. After a thorough search, no threat was found." Somewhere between those two registers, investigating-but-confident and searched-and-found-nothing, every swatted campus has to land, in writing, the same night.
The wave's densest day in this collection is April 13, 2023, when one round of calls swept Texas: Texas A&M, Baylor, Texas Wesleyan, and a string of two-year and career campuses the collection now documents alongside the flagships, including Collin College, Del Mar College, Tyler Junior College, Lamar Institute of Technology, and Galen College of Nursing in San Antonio. Del Mar's first message hedges in real time: "An emergency, possible active shooter, is reported at DMC Heritage Campus. While this is being verified, shelter in place or avoid the area until advised." Texas A&M's all-clear does something rarer and names the mechanism to its readers: "The report of an active shooter at the Health Science Center is FALSE. There is no threat to campus. The same caller reported an active shooter at other universities today which was also false."
One boundary the archive is strict about: a message is an all-clear only if it actually lifts restrictions. Sweeps end building by building, and the collection preserves messages that read like endings while still restricting movement; this archive types those as updates. The University of Mississippi's November 2024 bomb-threat sequence holds the distinction in a single line, typed here as an update: "REB ALERT: UPD has cleared the SJB Pavilion. Officers are in the process of clearing the Student Union. Avoid the Union until an All Clear has been issued." Readers studying resolution timing should watch for the difference.
What this chapter teaches
Bomb threats and swatting cases are where institutions learn how to be honest about uncertainty in writing. The verbatim language in this chapter rewards careful reading because it documents an institution's evolving epistemology: how does the alert distinguish what is known (a threat was received), what is being investigated (whether the threat is credible), and what is being asked of you (a specific protective action)? Bad alerts collapse all three into vague urgency. Good alerts keep them apart.
When you scroll through the case list below, the cases worth comparing side-by-side are the ones where the same institution issued multiple bomb-threat alerts across different years. The drift in language tells you what that institution learned.