School shooting hoaxes have terrorized kids across U.S. Who’s behind it?

SAGINAW TOWNSHIP, Mich. - Snow crunching under their feet, breaths coming quickly, the officers grabbed their duty rifles and ran toward Nouvel Catholic Central High School.

The code had gone out just two minutes earlier on Feb. 7: active shooting in progress.

They didn’t hesitate. When they found that the double doors next to the parking lot were locked, one officer rammed them with his cruiser and smashed them open. Another stepped over the shattered glass and into a hallway lined with lockers. “Move, let’s move, let’s move!” he yelled, in moments captured on body camera.

Lt. James Rich was one of the officers at the scene. He remembers the rush of adrenaline and the strange silence inside the school. It felt like a puzzle whose pieces didn’t fit.

Officers checked every room in the building. They found nothing except terrified children and teachers.

The 911 call that led police there had been a hoax.

It got stranger. At least eight other schools across Michigan were targeted with similar hoax calls that morning.

For weeks, Rich would wake up in the middle of the night, replaying the incident in his mind. His colleague had a term for what happened: terror without a body count.

Even months later, one question gnawed at him. Who was behind the calls?

That same question has troubled police departments across the country.

Over the past year, more than 500 schools in the United States have been subjected to a coordinated campaign of fear that exploits the all-too-real American danger of school shootings, according to a review of media reports and dozens of public records requests. The Washington Post examined police reports, emergency call recordings, body-camera footage or call logs in connection with incidents in 24 states.

The calls are being investigated by the FBI and have generated an aggressive response by local law enforcement - particularly after officers in Uvalde, Tex., came under criticism for waiting more than an hour to confront the gunman during the May 2022 elementary school massacre.

In state after state, heavily armed officers have entered schools prepared for the worst. Students have hidden in toilets, closets, nurse’s offices. They’ve barricaded doors with desks and refrigerators. Medical helicopters have been placed on standby while trauma centers have paused surgeries, anticipating possible victims. Terrified parents have converged on schools, not knowing if their children are safe.

The wave of school shooting hoaxes is without precedent, education safety experts and law enforcement officials say. It’s part of a larger phenomenon known as “swatting,” where callers report nonexistent crimes with the goal of triggering a police response — preferably by SWAT teams — at the homes of enemies or celebrities.

The shooting hoax calls often come in waves, with multiple schools in a state targeted on the same day, and most are “remarkably similar,” said Drew Evans, the superintendent of the Minnesota Bureau of Criminal Apprehension. More than 20 schools in the state were targeted in two separate incidents, one in September of last year and another this February.

“This is a really serious crime,” Evans said. “It places everybody in a situation of potential danger to have police officers rushing into a school.”

Many of the calls have followed a distinct pattern, according to police reports and recordings reviewed by The Post.

A male voice says that he is inside a school and that multiple students are shot. Many times, he claims to be a teacher. He says he is in a particular classroom or a bathroom, and tells the police to hurry.

He speaks with a heavy accent, police reports note. The calls first come in on non-emergency lines and are not recordings: The speaker interacts with dispatchers and responds to their questions.

When local authorities tried to trace the fake school shooting calls, they quickly ran into obstacles. Police reports show that the caller used free internet-calling services that allow anyone with an email address to make calls that appear to be coming from a U.S. number.

In incidents in at least 12 states, The Post found, the numbers were provided by TextNow, a Canadian company that offers free calls using voice over internet protocol, or VoIP.

TextNow says it works proactively to prevent bad actors from using its service while also keeping it free and accessible. The company “does not condone the use of our platform for harassment, fraud or other illegal activity that jeopardizes public safety,” said Derek Ting, TextNow’s co-founder, in a blog post in August. “However, when serving millions of people of various backgrounds and needs, you cannot solve every challenge with the biggest hammer you can find.”

A familiar voice

Three months before the hoax calls in Michigan, something strikingly similar unfolded in northern Louisiana. A male voice described by police as having a “foreign accent” reported an active shooting in progress at a high school in Bossier Parish, near Shreveport. Patrol officers raced to the scene but found no threat.

The detective who took the case, Capt. Shannon Mack, relished the chance to investigate the call. Her probe would unravel fresh details of the shooting hoax mystery, turning up clues and dead ends.

A 15-year veteran of the sheriff’s department, Mack has developed a self-taught expertise in cases involving internet-based phone services. “That’s my niche,” said Mack, 49. She likes that it’s technical and sometimes tedious. She especially loves the feeling of “tracking someone who thinks they can’t be tracked.”

At first, people used such services to harass or intimidate a spouse or enemy, believing they couldn’t be identified, Mack said. Then the numbers began to show up in cold-calling scams to swindle people. It’s only in the last few years that Mack has started to see the VoIP numbers used for swatting.

“Nine times out of 10, it’s a TextNow number,” Mack said.

After Bossier Parish received the school shooting hoax call in November, Mack sought several search warrants. She started with TextNow, asking for all the information the company had about two numbers linked to the incident: call logs, internet protocol addresses, account setup data. Then she moved on to Google and Apple, asking for everything they had on the email addresses that created the TextNow accounts.

The result was a trove of data that offered a minute-by-minute window into the activity of the perpetrator - or perpetrators. The logs revealed hundreds of calls over a roughly two-week period, many to police departments, schools and even restaurants. The caller mostly dialed numbers in the United States, but there were also a few dozen calls made to Australia and Canada.

One TextNow number was linked to school shooting hoaxes in at least six states: Alaska on Nov. 2; California and Texas on Nov. 4; Maine on Nov. 15; Ohio and Louisiana on Nov. 16.

According to the records Mack obtained, the perpetrator connected to TextNow via virtual private networks, or VPNs, which obscure a user’s location.

But there was also a tantalizing clue: When the TextNow account was created, the user connected via an internet protocol address assigned to Ethio Telecom, a major telecommunications company in Ethiopia. The user’s Gmail account was also traced to Ethio Telecom. Mesay Woubshet, a spokesman for Ethio Telecom, said the matter was under investigation by the country’s federal police. The Ethiopian Federal Police did not respond to a request for comment.

For Mack, the finding pointed to an even bigger pattern - and an even more prolific swatter. In April 2022, she had investigated a bomb threat hoax call targeting a local school. It, too, was made with a TextNow number that was traced to an internet protocol address in Ethiopia. Even the voice on the 911 call sounded the same in the two cases.

When the school shooting hoax call took place in November, Mack recognized the voice from the earlier bomb threat. She quickly called the number back. She heard the same male voice say, “Hello? Hello?”

“Hey, why are you calling schools and doing that to kids?” Mack recalled saying. “You know it’s wrong. Where you at?”

The person hung up.

A kind of compulsion

The link to Ethiopia was a crucial — if incomplete — breakthrough. Just because a call originated from an Ethiopian IP address doesn’t necessarily mean the perpetrator is calling from that country, experts said, noting that online marketplaces sell access to such addresses.

In November 2022, TextNow blocked the entire country of Ethiopia from its service, the company said, after determining it was a source of significant malicious activity. The previous month, NPR had reported that a TextNow number using an Ethiopian IP address was connected to bomb threat hoaxes against schools. TextNow also removed its app from app stores outside North America, making it slightly more complicated for users elsewhere to access the service on their phones.

Still, the hoax calls kept coming. North Carolina, West Virginia, New Hampshire in December. Michigan, Oregon, Minnesota in February. Kansas, Ohio, Massachusetts, Wisconsin, Utah, Pennsylvania, New York in March. Wyoming and Illinois in April. In May, the hoax calls targeted at least 14 schools in Tennessee, just weeks after an actual school shooting left six people dead in Nashville.

Catalin Grigoras, director of the National Center for Media Forensics at the University of Colorado at Denver, conducted a technical analysis for The Post of five of the hoax calls made between September 2022 and April 2023. Grigoras said there was a strong probability that the caller used a device or app to alter their voice in real time. However, it was also highly likely, Grigoras said, that the same person was speaking in each recording.

The swatter’s use of technology is notable, said James Turgal, a former senior official at the FBI’s information and technology branch who is now vice president at Optiv, a cybersecurity firm. “Gone are the days when someone on a hard-line phone would call in a bomb threat because they didn’t want to take their final that day,” Turgal said. “That was ye olden days.”

Another enigma was the caller’s motivation. The perpetrator of the school shooting hoaxes could be driven by hostility, money or some combination of the two, experts said. On platforms such as Telegram, there are groups offering swatting services: one viewed in August by The Post touted the possibility of “extreme harassment” for $100 a day and bragged about being able to close any school.

But the volume of school shooting hoaxes may also suggest a kind of compulsion. “I think they can’t stop,” said Keven Hendricks, an investigator and cybercrime expert who has worked on swatting cases with police. “This is what this person does.”

Mack’s investigation turned up another potential clue. Google handed over the contents of the Gmail account associated with the number used in the hoaxes. It contained emails from TextNow and other internet telephone providers. There was also an email from Instagram for the holder of a particular account.

That Instagram account has no posts, but several others with nearly the same name and imagery contain violent rhetoric toward the United States and White people. One account mentions Bob’s on Sheridan, a mom-and-pop breakfast restaurant in Kenosha, Wis., in a post from January 2022 that claims a “missile” was launched there.

That same month, the Kenosha County Sheriff’s Department received five calls on its non-emergency line saying multiple people had been shot or injured at Bob’s. It was a male voice, with a heavy accent, using VoIP numbers, Sgt. Colin Coultrip said.

Following a query from The Post, Instagram removed the accounts for violating its policy against inciting violence, said a spokeswoman for Meta, which operates Instagram and Facebook.

A game of cat-and-mouse

This spring, detectives in Illinois added another piece to the puzzle. In April, at least 12 schools in the state were targeted by a wave of school shooting hoax calls. Detectives in the towns of Carbondale and Marion determined the calls were made from a TextNow number and asked the company for information about the account.

TextNow provided records to the police showing that the account holder made calls from the phone number for four days. As in previous incidents, the user took steps to obscure their location, connecting through a VPN or a proxy server, another tool that conceals a person’s location.

This time, however, there was a difference: The IP address used to create the account was traced to a Comcast router in a town northeast of Houston. The subscriber was a 71-year-old woman, according to a police report. Experts say that it can be relatively easy to compromise unsecure home routers and that they doubted the woman had any knowledge of the plot.

The woman lives in a neighborhood of modest, prefabricated homes. When approached by a Post reporter on a recent sunny afternoon, she reacted with confusion. She had not been contacted by the authorities, she said, and had no idea that her router was connected to the case.

The persistence of the swatting hoaxes pushed TextNow to tighten its policies. Although the company had stated for years on its website that the use of VPNs was not supported by the service, the hoax perpetrator had used that type of secured network to connect to the platform for months.

In the first half of May, TextNow said, it took several new steps. It blocked users from making calls from a web browser when using a VPN, the company said. It also prevented users from creating new accounts on a device that was previously flagged for abuse.

Tristan Huntington, the company’s senior vice president, said TextNow adapts its processes to block bad actors but described it as a game of cat-and-mouse. “The moment we make a change and we tell people about it, then immediately there is some kind of workaround,” he said.

Some experts are critical of TextNow, where people can sign up for an account with only an email address. “Why are you letting any call go through when you don’t know who’s making it?” asked Fred Posner, a communications consultant and VoIP expert.

A campaign of fear

For more than a year, law enforcement agencies across the country have fed information about school shooting hoax calls to the FBI, hoping to leverage the bureau’s superior investigative resources. But it’s not clear how much headway the agency has made.

For the FBI, the probe is akin to peeling the layers of an onion, said Todd Hillis, chief intelligence officer at IACI, an information-sharing association that identifies threats to cybersecurity.

Some popular VPNs outside the United States only retain logs of customer activity for a brief period, or do not cooperate with American law enforcement at all, Hillis said. He estimated it would take six months or longer for the FBI to obtain such data through a mixture of persuasion and treaty requirements between countries.

Even then, he said, the user’s actual location may not be clear.

“You can make yourself several layers deep if you are so inclined,” Hillis said. “The onion gets more and more layers on it, and it gets harder and harder.”

A rare glimpse into the federal investigation came in May. An analyst at Utah’s Statewide Information and Analysis Center made a presentation to local lawmakers about the swarm of school shooting hoaxes that took place in the state two months earlier. The analysis said that while the perpetrator had used “sophisticated measures to remain anonymous,” the FBI had “determined the originating source.”

Capt. Tanner Jensen, the center’s director, declined to elaborate on the presentation or provide further details about an ongoing federal investigation. “I have full confidence they’re taking this seriously,” he said.

The FBI, too, declined to comment on what exactly the Utah report was referring to, where the hoax calls were coming from and whether it had identified a suspect. It also did not respond to broader questions about its investigation into the school shooting hoaxes, its effort to combat such incidents or its creation of a new database of swatting incidents in May. No arrests have been announced in connection with the hoax calls.

Meanwhile, several other hoax calls have occurred. Last month, two schools in Nashville were targeted with fake active shooter calls, said Kristin Mumford, a spokeswoman for the Nashville police. The calls originated outside the state, and the police noted that “there have been hundreds of similar threats in other American cities.” A connection to the larger trend “has not been ruled out,” Mumford said.

In Michigan’s Saginaw Township, the police say they’re eagerly awaiting a call informing them that the FBI has caught the culprit in the shooting hoaxes. “Hopefully, there will be some closure, so at least that person won’t do it again,” Lt. Rick Herren said.

At Nouvel Catholic Central High School, the doors rammed by the police cruiser were swiftly repaired. Other damage will take longer to heal.

Lydia Schade, 17, was in her pre-calculus class when the lockdown announcement came over the loudspeaker and she saw her teacher’s face go white. She knew it wasn’t a drill. As she huddled in a corner, she thought of her late grandmother, who used to tell her to be strong, to be a warrior.

Her enduring memory of that day is the moment when students were released, one by one, from the school gym. It is the fear etched on the faces of the parents waiting outside that she remembers.

Tim Novak, a parent at Nouvel Catholic, recalled the agonizing minutes when his son Max, then a senior, wasn’t responding to his text messages. Novak said he knows all too well that the hoax could have been real. He stopped speaking, unable to continue. His eyes filled with tears. “It’s because it happens so often,” he said.

A little over a year before the shooting hoax in Saginaw, a student in Oxford, Mich., about 80 miles away, opened fire at his high school and killed four people. A week after the hoax, a gunman killed three students at nearby Michigan State University.

The morning of the hoax, Cormac Lynn, the schools superintendent who oversees Nouvel Catholic, was on the phone in his office in an adjoining building when he saw police vehicles with lights flashing and sirens blaring race into the parking lot. He immediately hung up.

When Lynn reached the main floor of the school, he saw officers in tactical gear with weapons raised, yelling at him to put his hands up. They pointed their guns at him and told him to lift his shirt. He carefully complied.

“The cops weren’t in a drill. We weren’t in a drill,” Lynn said. The experience was “as real as you can get without an act of violence.”

- - -

Peter Holley in Houston contributed to this report.