On 19 August 2026 five magistrates' courts, a government ministry and a shopping plaza in Trinidad received bomb threats on the same day. On 22 August a second wave hit several locations, including the Forestry Division office on Long Circular Road. Both times the Explosive Detection and Disposal Unit (EDDU) swept the buildings and found nothing.
This is the third such wave in Trinidad and Tobago in three years. A threat costs almost nothing to send and a great deal to answer, and courts, ministries and schools have absorbed that cost each time. AI cannot remove the need to search a building, but it can change how fast threats are ranked, linked and cleared.
What happened on 19 and 22 August
The Trinidad and Tobago Police Service (TTPS) confirmed on 19 August that threats had been "received through different mediums" against:
- the Arima, Princes Town, Chaguanas, Siparia and Sangre Grande Magistrates' Courts;
- the Ministry of Rural Development and Local Government;
- the Valpark Shopping Plaza.
EDDU officers, Criminal Investigations Department staff and local police checked all seven sites and cleared them. On 22 August, at the Forestry Division, EDDU officers walked the building with staff present, found nothing suspicious and declared it safe.
The timing drew political attention. Police Commissioner Allister Guevarro had taken five days of emergency leave, approved by Homeland Security Minister Roger Alexander, with Deputy Commissioner Junior Benjamin leading the TTPS from 13 to 19 August. Guevarro said the leave followed procedure and declined to give the reason for his travel. That dispute is separate from the question here, which is how a police service handles a threat wave whoever is in charge.
Trinidad has seen this tactic twice before
| Date | Targets | Outcome |
|---|---|---|
| May 2023 | More than 50 schools, by email in one morning | Evacuations; nothing found; sender hidden behind servers and VPNs in four countries |
| March 2025 | 49 schools in south-east Trinidad | Closures; nothing found |
| August 2026 | Five courts, a ministry, a plaza, then a second wave including the Forestry Division | All sites cleared; nothing found |
In 2023, Hillview College, St Augustine Girls' High School and Bishop's Centenary College were evacuating by 9 a.m. Investigators traced the email through a server in Germany, a resolve host in Cyprus and two VPNs routed through Switzerland and Panama, hiding the sender behind an anonymous mail provider. Police called identifying that provider "key to the investigation" and said the work needed cooperation across several jurisdictions.
The cost falls almost entirely on the state
Sending an anonymised threat email costs close to nothing. Answering it means an EDDU deployment, a CID investigation, an evacuation and lost court sittings or school days. In August that response ran across seven locations and then again days later.
Police cannot choose to ignore threats, because missing the one real threat is not acceptable. So every threat gets the full response, and a sender can multiply the state's cost by adding more buildings to the list. So far the response has grown in step with the number of names.
Four ways AI can support the response
Nothing below replaces a physical search. An EDDU officer with a trained dog or detection equipment is not a step to shortcut. AI works on the triage, linking and scheduling around that search.
1. Scoring the wording of each threat
Threat assessment specialists have long compared the language of hoaxes and credible threats. Credible threats tend to carry specific, checkable detail: a device type, a location inside a building, a demand. Hoaxes tend to be generic, reuse near-identical wording across targets and arrive in bulk. A model trained on Trinidad and Tobago's own threat texts from 2023, 2025 and 2026, plus international examples, can score a new threat within seconds, so a duty officer with seven threats knows which ones match the old template before assigning EDDU teams.
2. Linking incidents by their technical fingerprint
Every emailed threat leaves traces: sending domain, mail relay chain, VPN exit points and wording. A system that logs these for every incident and checks each new one automatically would tell the TTPS within minutes whether the 19 August and 22 August threats came from the same source. If the 2023 infrastructure reappears in a fourth wave, it flags the match without anyone needing to remember a three-year-old file.
3. Sharing fingerprints across CARICOM
On 26 August 2026, South Korean police said they were investigating bomb threat emails sent to about 40 courts, the same tactic against the same kind of target. CARICOM IMPACS, the Community's crime and security agency, already coordinates cross-border work: it led Operation Eclipse in May 2026, which disrupted smuggling networks valued at an estimated US$54.5 million. A shared database of hoax threat fingerprints hosted there would let a signature traced in Port of Spain be checked against threats in Kingston, Bridgetown or Georgetown.
4. Scaling the response to the risk
An AI-assisted dispatch tool does not decide whether to search. It helps a commander decide how many units to send where first, and when a cleared building can reopen. A threat matching a known hoax pattern still gets searched, but a courthouse can resume sittings sooner when the commander is working from a ranked list, not reports in the order they were phoned in.
The weak point is the data. Three waves give a small training set, and a model trained on it will be confident about the old template and weak on anything new. A sender who changes the wording could get a low score, which is why the score should set order and tempo, never whether a site is searched.
The Core Argument
Trinidad and Tobago cannot stop hoax emails being sent, and every threat still has to be physically checked. AI can score a threat against the country's own hoax history, recognise a scattered wave as one campaign, and get cleared buildings back to work sooner. The case history to start exists today.
What the TTPS, CARICOM and the courts should do next
- TTPS cybercrime investigators: build a structured record of every threat from the 2023, 2025 and 2026 waves (full text, headers, delivery path, targets, times) this quarter, as the training base for any scoring model.
- TTPS command: adopt a written triage rule in which every threat is searched but the order and number of teams follow a risk score, and review the rule after each wave.
- CARICOM IMPACS and member police services: agree a common format for hoax threat fingerprints and start sharing them, beginning with Trinidad and Tobago, Jamaica and Barbados.
- The inter-ministerial committee reviewing AI-enabled offences: the review set up after the 2026 deepfakes of Finance Minister Davendranath Tancoo should also cover hoax threats sent through anonymising services.
- Judiciary, ministries and school boards: train front-desk and IT staff to preserve threat emails with full headers and phone threats on a written checklist, so investigators get usable evidence.
Frequently Asked Questions
What should staff do when a bomb threat arrives by phone?
Keep the caller talking, write down their exact words, and note the time, voice, accent and background sounds. Do not hang up first, and if your phone shows the number, record it. Then call the police on 999. The US Cybersecurity and Infrastructure Security Agency publishes a free one-page bomb threat checklist that front desks can keep by the phone.
What should an organisation do with a threat that arrives by email?
Do not delete it and do not forward it around the office. Leave it in the mailbox, tell your IT staff to preserve the full message headers, and report it to the police immediately. Headers carry the routing information investigators need, and a screenshot or forwarded copy often strips them out.
Should a building be evacuated for every bomb threat?
Not automatically. The decision belongs to the site's management with police advice, and the options include searching while occupied, partial evacuation, or full evacuation. Evacuation routes and assembly points should be checked before people are sent to them, because a real attacker could target the crowd. Having a written plan before a threat arrives is what makes the choice quick.
Why are anonymised threat emails so hard to trace?
Each server or VPN in the chain sits in a different country, and police usually need a formal mutual legal assistance request to get records from each one, which can take months. Some VPN and anonymous mail providers keep few or no logs, so there may be nothing to hand over. That is why linking incidents by wording and technical patterns matters: it can identify a campaign even when the sender stays unknown.
What is CARICOM IMPACS?
The CARICOM Implementation Agency for Crime and Security is the Community's regional body for security cooperation, headquartered in Port of Spain. It runs regional intelligence sharing and supports joint operations among member states, such as Operation Eclipse. A police service that wants to share threat information with other member states would work through its national IMPACS contact.