It was 9:47 A.M. on Feb. 22 when the dispatch center of the Twin Falls Police Department in Idaho got the call. There were shots fired at Canyon Ridge High School, just a few miles north of the station. At least one person was injured in a classroom, and the shooter was still on the loose, according to the man on the other end of the line.
"Officers were there onsite immediately," Lt. Craig Stotts told NPR. "And our goal is to, first of all, stop the killing and then stop the dying. And we go in and take care of the threat."
Officers quickly set up a base of operations at the Church of the Nazarene about 500 yards from the school and got to work coordinating with the Sherriff's Office, the Fire Department, Magic Valley Paramedics and their ambulances and helicopters, the SWAT teams, and, eventually, a horde of panicked parents.
For the next hour, citizens of Twin Falls endured the sheer trauma of waiting. The school's 1,200 or so students cowered in classrooms and bathrooms, texting parents and friends and posting on social media. Law enforcement teams swept the school's two floors three times.
But to everyone's shock, police found nothing.
By nearly 11 a.m., Lt. Stotts was confident: there was no shooter. Twin Falls was the latest victim of what's called swatting — a hoax emergency call designed to trigger a massive law enforcement response to an imaginary threat.
A 'swatting' epidemic
While there was no shooter in Twin Falls, the day itself was resource intensive and psychologically traumatizing, according to interviews with community members.
For one, Travis Rothweiler, the city manager of Twin Falls, got choked up recalling the moment he was notified of the threat to his teenager's school.
"It was an amazing dichotomy of trying to be a father and be a city manager and work through that process," he told NPR.
And while no one was physically hurt, these types of swatting calls can be deadly. In some instances where SWAT teams are called in under false pretenses, innocent people have been shot or killed by accident.
Swatting isn't necessarily a new phenomenon. But the call to Twin Falls doesn't appear to be an isolated incident, and it doesn't appear to have originated locally.
According to a series of previous reports from NPR, these kinds of fake bomb threats and hoax school shooting calls have been happening for nearly a year at hundreds of schools across the country — and they share a pattern similar to what happened at Canyon Ridge.
In March and April last year, authorities tracked a wave of false bomb threats in places like Minnesota, making calls that were eerily similar to hoax school shooting calls made in October 2022 in Virginia, Minnesota, Ohio, and Florida, according to records of the calls obtained by NPR.
Those calls have continued almost weekly. Within the last couple months, hundreds more schools have received mysterious "swatting" calls. The scope and scale is so large that the FBI has stepped in to investigate.
Authorities from local police departments have declined to share recordings of the recent calls to the dispatch centers, citing an ongoing FBI investigation. However, many have shared descriptions in public statements emailed to residents, shared with local journalists, or posted on social media.
And in most instances, there are clear similarities.
In a single day, a mysterious caller described as having an accent will call the non-emergency line of a local police department, reporting an ongoing threat by citing specific information about a classroom or a teacher that doesn't actually exist.
The calls will happen within minutes of each other to schools across an entire state, almost like the caller has an alphabetical list to work from. The caller is often using a free or low-cost third-party calling app, or Voice over IP text and voice service like TextNow.
Voice over IP apps allow users to send messages or make calls over the internet without using phone lines, and they don't often require much information to sign up, disguising the caller even further. Meanwhile, the hoax caller doesn't make any demands.
The Kearney Police Department in Nebraska shared a statement on March 2 that aligned with a lot of those qualities.
"A trend of hoax active shooter calls have been hitting 9-1-1 call centers this week. The voice is typically a male of Middle Eastern descent and claims to be in a school building witnessing a shooting. These calls have been unsubstantiated," the statement read.
Chris Mackensen, the Chief of Police in Jefferson Ohio, said on March 1 in a statement that the local dispatch center received a call "from a male identifying himself as Michael Clark stating that there is a student in the high school with a gun. The call further stated that the student had shot two students in Math Room 35." Mackensen also wrote that "the caller's information did not match the school layout."
And Jeff Schneider, the superintendent of Hastings Public Schools in Nebraska, also wrote on March 2 in a statement that a caller "identified themselves as a teacher in a specific room" and that "the 9-1-1 center was immediately suspicious as the name of the teacher and the room number do not exist."
NPR's previous reporting traced a series of the calls back to Ethiopia. The most popular calling service used by the hoax callers was the third-party calling app TextNow, which provides free or low-cost calling services to low-income communities who can't afford monthly phone bills. Ultimately, TextNow banned the entire country of Ethiopia from use of its services after consultation with law enforcement.
But still, the calls have continued, and no one person or group has been specifically identified as the perpetrator.
One barrier is the difficulty of working with law enforcement in Ethiopia, while another is determining if the true criminals are somehow masking their identity or location.
The mystery behind the hoax calls
Experts have posed a number of theories as to why the person or group of people behind these calls is making them, but no single theory has been proven. Unlike in many previous instances of school swatting calls where a local teenager was responsible, no arrests have been made.
But that doesn't necessarily mean the perpetrator didn't pay someone else to do the deed. In recent weeks, Caleb Barlow, a cybersecurity consultant, has drawn attention to the so-called "dark web" where customers can purchase school shooting and bomb threat "services" for a few dollars.
It's entirely possible that different people have contracted out the same "firm" to call schools, though the sheer number of schools across several different states that have been targeted casts some doubt on the local motivation.
It's also possible the calls have a broader connection to other scams, such as ransomware attacks in which hackers targeting one victim might apply pressure to secure a payment by causing trouble elsewhere.
However, when asked whether or not any financial or extortion demands were made, law enforcement in Canyon Ridge said they knew of no demands, to their department or anywhere else across Idaho.
It's also possible that the ultimate goal is to inspire fear and sow chaos, a prospect that experts have urged U.S. officials and law enforcement officers to pursue, according to previous reporting by NPR.
If the individual or group responsible for these services is truly based in Ethiopia, it will require a lot of coordination between different elements of government and law enforcement between both countries to try to investigate.
The fear of a school shooting is real and pervasive in American communities, given the frequency of these kinds of tragedies, explained Brittany Cooper, another local TV reporter with KMVT. It's always on students' minds. But Twin Falls has relatively little violent crime, and little experience with this kind of threat, she continued.
Cooper recalled covering two previous incidents of fake shooting threats at local high schools, but those were quickly linked back to students, she recalled. The still unsolved mystery of who's making these calls and why has amplified the confusion and fear.
"It was February of last year when we had two back-to-back school shooting threats," said Cooper. "But they were using social media like Snapchat to make these threats. And I don't think they understood the severity of the consequences because they thought it was a joke."
"This community is very much leaning on the conservative side, very family-oriented," she continued. "This is something that's very new for us in terms of actually making the national stage and with the threat that was at Canyon Ridge High School."
The role of social media
There's another element involved in most incidents of hoax swatting calls: the complicating factor of social media.
Within minutes of the Twin Falls Police Department receiving the report of a shooting at Canyon Ridge High School, Josh Palmer, the city's public information coordinator, took to Facebook and other official social media accounts to share updates with citizens.
However, almost immediately, nondescript Facebook accounts began replying to official updates by posting strange videos in the comments section. The people posting the videos alleged to have footage from the scene, but it was clear from the background of the videos they were not taken in Twin Falls, said Palmer. Later on, other anonymous Facebook users shared links to news stories purporting to cover the shooting, leading people to click on what appeared to be fake news sites plastered with advertisements.
"What we were seeing was a very targeted misinformation campaign to the city of Twin Falls," he told NPR.
Panicked parents and other citizens of Twin Falls immediately seized on the videos and comments and took them as fact. Outside the school, even after law enforcement officers told parents the school was clear and there was no shooter, they claimed they had seen footage of the carnage or they pointed to texts from their kids who, in the chaos and confusion, reported hearing gunshots.
Steve Kirch, a local reporter for TV station KMVT, said that parents were demanding to check inside ambulances to make sure the officers weren't hiding evidence of dead or injured students inside.
"There's just this distrust of government right now," Kirch said in an interview with NPR. "I was surprised, many people still believe that three dead kids left that school that day, even though there's no proof of that."
The reason for that strong belief was social media.
"A parent came up to me and said there's three dead kids in there, we know there's three dead kids, we saw it on social media," Kirch said. "They just kept insisting that the police chief was lying to them.
According to Palmer and Lt. Stotts, the Twin Falls Police Department has rehearsed its emergency plan were there to be a school shooting or similar emergency multiple times over, a plan that first responders and law enforcement carried out nearly perfectly in late February.
Palmer had also just completed a training at the nearby community college specifically for public information officers in the region for communications during an emergency.
However, what they didn't practice for was fighting off social media trolls and disinformation, Palmer said.
"Obviously we plan to put out messaging to help direct traffic and clear up any confusion. But what we didn't plan for was the social media side of it," he said.
"It just perpetuated a lot of that confusion and misinformation right at the worst possible time as parents were coming to the school," Palmer concluded.
A recurring theme
Facebook and social media played a huge role in the aftermath of the hoax call in Canyon Ridge, but it wasn't an isolated incident. Doing analysis and research on official law enforcement and local news Facebook posts made during the time of other hoax shooting calls across the country, some of the exact same commenters surfaced in those incidents as well, posting sketchy looking links and videos.
It also happened during an incident at Free State High School in Lawrence, Kan., where people also speculated whether or not the hoax calls were part of a so-called TikTok challenge, where users of the music and video-based app try and copy a popular trend.
It happened in Brighton, Colo., where a commenter shared a fake video purporting to be coverage on Fox News to a post by local news station KUSA. A Facebook user whose name is labeled "My Page" and whose profile picture is a beach scene, frequently posts fake news links to a site called "SNBC13.com," about hoax shooting calls and other tragic events on their main profile and in the comment sections of local official Facebook posts. (The page appeared to "like" and "follow" local police station accounts across the country.)
When NPR shared the links, videos, and social media posts with cybersecurity researchers, it became clear that the sites were fake, at the very minimum.
Selena Larson, an intelligence analyst with the cybersecurity firm ProofPoint, analyzed several links to SNBC13 and other sites. She described a very common phenomenon where the fake news sites mimic real sites in order to lure people into clicking on them in order to get ad revenue.
"We were able to find out some of these websites spoofed or purported to be or looked like legitimate local news websites," she said. Larson also said what those sites had in common was often either stolen or closely copied language from local news, very little information about the publication or its employees, and a focus on tragic, attention-grabbing news across the country.
"A lot of these websites were hosting information on violent crimes, murder, suicide. A lot of things that would potentially drive conversation, get people talking, and would get people sharing opinions or sharing the links," she continued. The goal appears to be "to get eyes on the page to drive traffic to these websites in a likely attempt to get ad revenue."
However, when Larson and her teamed analyzed links to some of the sketchy videos, including one link shared with NPR by the Canyon Ridge Police Department, those links appeared to be laced with malware.
"This appears to be likely bot accounts on Facebook that follow stories posted by police, sheriff's departments, news organizations, etc. and reply via Facebook comments with shortened URLs that purport to link to a YouTube video," Larson said. "These URLs use custom shortening services and, when clicked, the URL will try and capture user data and or redirect them to spam or malicious downloads."
A local news station in Great Falls, Mont., recently covered the same exact phenomenon, where spammers will post "bogus comments on Facebook pages" with "terrible" or "graphic" videos that are actually spam or a portal to infect a device with malware when clicked.
Noticing a pattern
The malicious Facebook links got the attention of Mike Shirley, who lives in the Twin Falls region near Canyon Ridge High School. "I think I stumbled across something very eyebrow raising on the social media comments," he wrote in an email to NPR a few days after the swatting incident in his area.
While Shirely was confident the links were malicious and were allowing spammers to take advantage of the fear generated by the hoax call, he also wondered whether there was any connection between the hoax callers themselves and the social media predators. It would "provide a motive as to why they keep happening all over," said Shirley.
Shirely is right in assuming that digital criminals frequently take advantage of real-world events to prey on people's vulnerability, fear, or interest in order to scam them, whether that's purporting to be the government offering a COVID-19 relief check, or faking a popular online betting service during the NCAA basketball tournament. The ultimate goal is to steal or profit. It would be highly disturbing if online criminals adapted their approach a step further by generating the real-world events that provide the opportunity to profit.
It's hard to definitively disprove Shirely's theory without more information about who is making the hoax calls and why.
The FBI declined to comment on the role of social media in the swatting incidents, but reaffirmed its commitment to taking the ongoing swatting calls seriously.
"While we cannot comment on any specific investigations, the FBI is aware of the numerous nationwide swatting incidents. The FBI takes swatting very seriously because it puts innocent people at risk. We urge the public to remain vigilant and report any and all suspicious activities and/or individuals to law enforcement immediately," an FBI spokesperson wrote in an emailed statement.
However, according to Larson and other cybersecurity researchers consulted by NPR, it's more likely that the scammers on Facebook are pure opportunists, frequently trolling for crises to try and find more gullible victims.
"Social media is a thriving marketplace for scams and spam and potential threat actors," said Larson. "We were not able to identify or correlate any of the actual calls to the websites," she concluded.
Jeremy Kennelly, who researches cybercrime at Google's Mandiant, was surprised by how prevalent the community of fake news commenters responding to the shootings was, but he also felt there probably wasn't "coordination between all of the people doing this."
He concluded that amongst the accounts posting comments on the swatting news, "it didn't seem like swatting was a disproportionate topic of interest." Even so, he concluded he'd need more information about the timeline of the swatting calls and the callers to make any clear assessments.
However, that doesn't mean that the posts aren't further traumatizing people. "Social media makes it very easy for people to pretend to be something or to share potentially incorrect information," Larson continued.
Her advice for people relying on social media for information, particularly in a crisis, is to try and see what information is available about a particular source of news you're seeing.
For example, Facebook now uses a transparency feature for pages that show where the information is being hosted. "If you are unsure about a particular page or information that's being shared, you can oftentimes look on the Facebook page and ask, 'Does this geolocation information match up to where I expect to see it?'" Larson said.
"If it's pretending to be a news outlet located in New York but the person or page is posting from Pakistan, that might not necessarily align with what you expect," she added.
Copyright 2023 NPR. To see more, visit https://www.npr.org.
