Handling anonymous harassment on campus

Overview

The fact that the sender is currently anonymous does not prevent the university from acting. Anonymity is a common feature of threatening and harassing communications, and there are established legal and practical routes both to protect the target and to work towards identifying the person responsible. The university’s obligations fall into three broad areas: protecting and supporting the person being targeted, preserving evidence and pursuing identification, and taking proportionate action once (or even before) the sender is identified.

It is also worth keeping an open mind at the outset about what is actually happening. “Anonymous threats” can range from a serious criminal campaign of intimidation to a one-off offensive message, a misdirected communication, an internal grievance expressed clumsily, or even a hoax. The right response depends on the content, frequency, target and apparent level of risk, so an early assessment of what has actually occurred matters.

Immediate safeguarding and risk assessment

The first priority is the safety of the person or people being targeted, and any wider community risk. The university should carry out a documented risk assessment considering the nature and seriousness of the threats, whether they suggest a risk of physical violence, whether they name specific individuals or locations, and whether the frequency or content is escalating. If there is any indication of an imminent risk to life or safety, this is a 999 matter for the police rather than something to be handled purely internally.

Practical protective steps can be taken regardless of who the sender is. These include reviewing physical security on campus, briefing security staff, temporarily adjusting the target’s timetable or working arrangements if they wish, offering wellbeing and counselling support, and giving practical online-safety advice such as tightening privacy settings, blocking accounts and not engaging with the sender.

Preserve the evidence

Even where the sender is unknown, preserving evidence is essential because it is what later enables identification. The university and the target should keep everything rather than deleting it. Useful material includes:

1. Full screenshots showing the message content, the sender’s display name or handle, and the date and time.

2. The original emails kept in the mailbox, including full email headers, which can contain routing information and originating IP addresses.

3. Any account names, phone numbers, URLs or platform details.

4. A dated log of each communication, recording what was received and when, and any pattern or escalation.

The university should preserve its own server and email logs promptly, because these are often overwritten after a set retention period. If communications came through university systems, IT should be asked to secure the relevant logs before they are lost.

Reporting to the police

Anonymous threats and harassment can amount to criminal offences, and the inability to identify the sender is precisely the kind of thing the police are resourced to investigate. Depending on the content, relevant offences may include sending threatening or grossly offensive messages, threats to kill, stalking or harassment, and offences under the Online Safety Act 2023 covering threatening and false communications. The police have powers the university does not, including the ability to obtain communications data from providers to trace an account or IP address.

You do not need to have identified the sender, or even gathered all the evidence, before reporting. A report can be made online or by calling 101, and 999 if there is an immediate risk. Where there is a credible threat of violence, the university should not delay reporting simply because it wants to run its own internal enquiry first. The university can and should share the preserved evidence with the police.

Working with platforms and providers

If the communications come through a particular platform or service, the university or the target can report the account or content to that provider, which may suspend the account and may retain data that assists identification. Email and social media providers, and the university’s own IT team, may be able to identify an originating IP address. Providers will usually only disclose account-holder identity to the police or under a court order, but reporting still helps by triggering data retention and account action.

Court orders to identify an unknown sender

Where the police do not pursue the matter, or where the university needs to identify the person for its own civil or disciplinary purposes, there is a civil route. A Norwich Pharmacal order is a court order requiring a third party who has become mixed up in wrongdoing, such as an internet service provider, email provider or social media platform, to disclose information identifying the wrongdoer. This can be used to unmask an anonymous account. It is a formal court application, it costs money, and it needs to be justified by evidence of the wrongdoing, so it is generally a step taken with legal advice and where identification really matters. Realistically, for threats and harassment, the police route is usually faster and cheaper because the police can request communications data directly.

If the sender turns out to be a student or member of staff

If identification points to someone within the university community, the matter can be dealt with under the university’s disciplinary procedures in parallel with any criminal process. The university should follow its own published student disciplinary or staff conduct rules, which it is contractually bound to apply fairly. Internal action can proceed even if the police decide not to prosecute, because the standard of proof and the purpose are different, though the university should take care not to prejudice an ongoing police investigation and should take advice on sequencing.

The university’s own duties

A university owes duties of care to its students and staff and has obligations under health and safety law to protect people from foreseeable risks, including risks of violence. If the target is being harassed because of a protected characteristic such as race, sex, religion, disability or sexual orientation, the conduct may also engage the university’s responsibilities under the Equality Act 2010, and the university’s response to complaints of such harassment can itself be scrutinised. This reinforces the need to document the risk assessment, respond promptly and support the person affected rather than treating anonymity as a reason for inaction.

Protective legal measures

If a pattern of harassment continues and cannot be stopped, civil remedies exist under the Protection from Harassment Act 1997, including an injunction, and in serious cases the criminal courts can impose restraining orders. These generally require the respondent to be identified, so they tend to follow rather than precede identification, but they are worth bearing in mind as the eventual endpoint if the person is unmasked and the behaviour persists.

Practical next steps

1. Carry out and record a risk assessment, and call 999 if there is any immediate threat to safety.

2. Support the person targeted and put in place any protective measures they want.

3. Preserve all evidence immediately, including email headers and internal IT and server logs before they are overwritten.

4. Report to the police, sharing the evidence, and obtain a crime reference number.

5. Report the account or content to the relevant platform and ask the university IT team to trace originating data where possible.

6. Consider a Norwich Pharmacal application, with legal advice, only if the police do not act and identification is genuinely needed.

7. Apply internal disciplinary procedures fairly once the person is identified, coordinating with any police investigation.

Key missing facts

The most appropriate response depends on details that are not yet clear. It would help to know the content and seriousness of the threats, whether violence is threatened, how the messages are being sent, whether they are targeted at an individual or the institution, whether any protected characteristic is involved, how frequent and escalating the conduct is, and whether the target is a student, staff member or third party. These points materially affect the urgency, the legal framework and the balance between police, civil and internal routes.