Police Experts: Swatting Hoax Targeting Schools ‘Absolutely’ Coordinated, But May Still Be Kids

After the police in more than a dozen South Carolina communities fielded calls last week alerting them to active school shootings, officers rushed to campuses where students and educators hid in fear for their lives. 

Ever since the mass school shooting in May at a Uvalde, Texas elementary school, families nationwide have been on high alert about the very real concern of such attacks decimating communities. But as South Carolina parents converged on their children’s schools and educators released students early, police statewide reached the same conclusion: This time, there was no real threat.

Instead, officials said the calls appeared to be part of a nationwide “swatting” hoax that’s played out at hundreds of K-12 schools in more than a dozen states since classes resumed this fall. Weeks earlier, dozens of schools in Minnesota, Virginia and Ohio became targets. Now, as the police connect the dots and report commonalities, experts with years of experience chasing down swatting perpetrators believe that many — if not most — of the recent incidents targeting U.S. schools are connected. After all, similar swatting sprees have been coordinated in shady internet outposts for years. 

“If they’re hitting 12 or 15 schools in a particular jurisdiction or a particular state all at once, that is absolutely a coordinated attack,” said James Turgal, a former executive assistant director for the FBI Information and Technology Branch. Turgal is a 21-year veteran of the FBI, which is actively investigating the latest swatting attacks on schools. 

Given its size, he suspects the most recent surge at schools is likely being coordinated by a group of people including foreign actors and swat-for-hire cybercriminals who carry out hoax emergency calls for money. While he does not necessarily believe it’s a government-sponsored attempt to sow chaos on American soil, Turgal thinks U.S. teens may still be pulling the strings with low-level foreign actors.

“Swatting is not something a nation state is going to get involved in,” said Turgal, now the vice president of cyber risk and strategy at Optiv Security. “These are smaller organizations that are trying to sell their services, not what I would call really sophisticated.” 

With the recent wave of swatting incidents targeting schools, news outlets have identified several commonalities across communities and states, including callers with thick accents, state-by-state clusters of hoax calls and similar false crime scene details, 

Such hallmarks are consistent in at least a half dozen states, according to an analysis by Wired magazine, which noted that multiple local police officials had reportedly traced the calls back to Africa. 

In Minnesota, 17 false calls were placed by someone with a distinct accent using the same voice over IP technology, Drew Evans, superintendent of the state bureau of criminal apprehension, told Wired. 

“There’s a lot of different technology that could make it appear to be a single person,” Evans said. “But all the indications we have are that it’s either one person or a single entity.” 

Conceptually, swatting is straightforward and in many ways follows the bomb-threat playbook that’s pushed schools into lockdowns and panic for generations. Often using technology to mask their true identities and locations, threat actors call the police to report an emergency like an active shooting or a hostage situation with the goal of forcing tactical SWAT teams to descend on a target and cause panic. In several cases, these malicious false alarms have ended in death.

“They’re looking for influence. They brag about it and they build up a reputation and then what happens is people start to hire them out to do swattings. That’s where a lot of your school stuff comes in.” 

Edward Dorroh, LAPD detective who’s investigated hundreds of swatting cases

Fame, notoriety and callous oneupmanship has long motivated swatting attacks, which have their origins in the video gaming community. The slew of media coverage on the Uvlade attack and other school shootings in recent months is likely a motivating factor, Turgal said.

In previous swatting cases — including those targeting schools, celebrities like Ashton Kutcher and Justin Bieber and video game rivals — many of the perpetrators turned out to be kids. Other swatting attacks have been politically motivated, ranging from those on extremist Republican Rep. Marjorie Taylor Green to outspoken gun control advocate David Hogg, who survived the 2018 mass school shooting in Parkland, Florida. 

In the last eight years, Los Angeles Police Detective Edward Dorroh has worked on hundreds of swatting incidents — including two that ended fatally. Of those, roughly 90% were carried out by children and teens, he told The 74. Dorroh, who is currently assigned to the FBI Joint Terrorism Task Force, is assisting in police investigations on the latest swatting incidents targeting schools. For that reason, Dorroh said he couldn’t comment on current cases, but discussed his deep experience with these shadowy crimes and how police confront them. 

Among the gaming community which latched onto the practice, Dorrah said the act is considered even more rewarding if they can get a heavily armed, tactical police response on camera as gamers livestream their gameplay on platforms like Twitch — a particular swatting attack “in the category of ‘for the LOLs,’ for the entertainment,” Dorroh said. 

“They’re looking for influence,” he said. “They brag about it and they build up a reputation and then what happens is people start to hire them out to do swattings. That’s where a lot of your school stuff comes in.”

Such paid swat-for-hire schemes, he said, aren’t relegated to the dark web; they’re openly promoted on Discord, the instant messaging platform popular among gamers and young people generally, with more than 150 million monthly active users. 

In a statement, the South Carolina Law Enforcement Division said that while the recent emergency calls “are believed to be a hoax,” it has encouraged local law enforcement agencies “to take any and all threats seriously” while they partner with state and federal law enforcement agencies to investigate. 

The FBI has acknowledged in a statement to The 74 and other media outlets that they’re probing the surge in incidents, but they’ve provided little specific information. 

“The FBI takes swatting very seriously because it puts innocent people at risk,” the bureau said in the statement. “While we have no information to indicate a specific and credible threat, we will continue to work with our local, state, and federal law enforcement partners to gather, share, and act upon threat information as it comes to our attention.”

Swat for profit 

Law enforcement officials have been grappling with swatting attacks against schools for years. In 2015, state cybersecurity officials in New Jersey sounded the alarm on swatting attacks against schools, shopping malls and private homes designed to capture national media attention, wage revenge on video game rivals or to make a profit.

“Incidents of swatting across the country are commonly linked, and investigations often lead to groups of malicious actors outside the U.S.,” the New Jersey Cybersecurity and Communications Integration Cell noted in a bulletin. “These foreign actors are often contacted and paid to conduct the swatting act by a student of the targeted school.” 

Amy Klinger, the co-founder and programs director of The Educator’s School Safety Network, has been tracking school threats and violence incidents for years to provide educators real-time information on emerging trends. Beginning in late August, data indicated the start of an unprecedented school swatting spike. Leaders at every school in the U.S., she said, should assume “at least in the short term” that their campus is likely to become the target of a false active-shooter report and they must be prepared for the call. 

“It is not necessarily within the control of the schools to prevent these events, because clearly they’re happening,” Klinger said.” But I do think it is within the control of the school to anticipate ‘What would we do if that happened to us?’ Being proactive is the responsibility of the school, especially knowing that these are happening at such a high level of frequency.”

Even though the school shooting threats are false, it’s important that educators and police remain diligent in responding to active-shooter calls without overreacting, said Kenneth Trump, president of the Cleveland-based National School Safety and Security Services. While “knee-jerk reactions” like swift school closures can embolden threat actors to carry out additional attacks, he said, failure to react could get someone killed. When school officials receive an emergency call, he said they should “assess and then react, not react and then assess.”

“It’s not a prank, it’s not a joke, it’s a cruel hoax and it’s really causing a lot of anxiety in communities, even more so post-Uvalde,” said Trump, offering a stern message to whomever is targeting schools nationwide. “When law enforcement catches up with you, which they will, you’re facing some very serious consequences — stuff that’s going to stay with you for the rest of your life.” 

Swatting presents real-world dangers

Dorroh, the LAPD detective, knows firsthand the fear that comes with reports of an active school shooting. Just last month, a school in suburban Los Angeles where his wife is a teacher was forced into lockdown when someone swatted a nearby high school. He said that knowledge of the national trend allowed him to offer a measured emotional response.

Aside from psychological harm, there haven’t been any reports of widespread injuries stemming from the school swatting surge. Last month in Georgia, a police officer and another driver were hospitalized from a car accident as the cops raced to the scene of a school that was targeted in a swatting attack. 

But several swatting incidents outside of schools have led to deaths, highlighting the dangers the hoax presents to educators and students. Of two high-profile swatting cases where people died, Dorroh helped investigate both. 

Last year, 20-year-old Shane Sonderman of rural Tennessee was sentenced to five years in prison after he helped carry out a swatting attack on a 60-year-old computer programmer who refused to give up the coveted Twitter handle “@Tennessee.” When police officers surrounded his house, the father of three and grandfather of six suffered a fatal heart attack. Sonderman, who began swatting as a teenager, used Discord to collaborate with others, including a minor in the United Kingdom, to wage the attack. Dorroh said that for Sonderman, swatting was his only social outlet. 

Another swatting attack, carried out by Tyler Barriss of Los Angeles, led to the fatal police shooting of an unsuspecting man in Wichita, Kansas. Dorroh said his first run-in with Barriss was during an earlier investigation into hoax bomb threats targeting schools — phone calls that were never recorded. In that earlier case, police were able to pin him down after he made a hoax call to a television station. 

Then, in 2017, Barriss called police and told them he was at a house in Wichita, where he shot his father and was holding his family hostage. Except it wasn’t his house — it was the home of an unsuspecting 28-year-old man who police said became confused when they arrived. Amid the commotion, an officer shot and killed him.

Barriss had carried out the attack on behalf of two video gamers who were in a feud after a “Call of Duty” match ended in one’s defeat. One gamer used Twitter to recruit Barriss to carry out the attack on a second gamer — who provided Barriss with the Kansas address. All three were charged criminally, and in 2019 Barriss was sentenced to 20 years in prison. 

“I was charging people, depending on how much of a stranger they were to me, anywhere from $20 to $50 per swat,” Barriss said in a recent episode of the Netflix documentary series Web of Make Believe: Death, Lies and the Internet. “But, quite frankly, I enjoyed the thrill of swatting, I just enjoyed doing it, having it appear on the news and bragging about it on Twitter.” 

Between 2015 and 2017, Barriss had been connected to false calls in Ohio, Nevada, Illinois, Indiana, Virginia, Texas, Arizona, Massachusetts, Missouri, Maine, Pennsylvania, New Mexico, Indiana, Michigan, Florida, Connecticut and New York.

“When we had the fatal swatting in Wichita, they thought [Barriss] might be a suspect so when we heard the audio recording it was like ‘Ya, that’s him,’ right off the bat,” Dorroh said. “It was just the matter of finding him and getting him into custody.”

Get stories like these delivered straight to your inbox. Sign up for The 74 Newsletter