School shooting hoaxes have terrorized kids across U.S. Who's behind it?

SAGINAW TOWNSHIP, Mich. - Snow crunching under their feet, breaths coming quickly, the officers grabbed their duty rifles and ran toward Nouvel Catholic Central High School.

The code had gone out just two minutes earlier on Feb. 7: active shooting in progress.

They didn't hesitate. When they found that the double doors next to the parking lot were locked, one officer rammed them with his cruiser and smashed them open. Another stepped over the shattered glass and into a hallway lined with lockers. "Move, let's move, let's move!" he yelled, in moments captured on body camera.

Lt. James Rich was one of the officers at the scene. He remembers the rush of adrenaline and the strange silence inside the school. It felt like a puzzle whose pieces didn't fit.

Officers checked every room in the building. They found nothing except terrified children and teachers.

The 911 call that led police there had been a hoax.

It got stranger. At least eight other schools across Michigan were targeted with similar hoax calls that morning.

Even months later, one question gnawed at him. Who was behind the calls?

That same question has troubled police departments across the country.

Over the past year, more than 500 schools in the United States have been subjected to a coordinated campaign of fear that exploits the all-too-real American danger of school shootings, according to a review of media reports and dozens of public records requests. The Washington Post examined police reports, emergency call recordings, body-camera footage or call logs in connection with incidents in 24 states.

The calls are being investigated by the FBI and have generated an aggressive response by local law enforcement — particularly after officers in Uvalde, Texas, came under criticism for waiting more than an hour to confront the gunman during the May 2022 elementary school massacre.

In state after state, heavily armed officers have entered schools prepared for the worst. Students have hidden in toilets, closets, nurse's offices. They've barricaded doors with desks and refrigerators. Medical helicopters have been placed on standby while trauma centers have paused surgeries, anticipating possible victims. Terrified parents have converged on schools, not knowing if their children are safe.

The shooting hoax calls often come in waves, with multiple schools in a state targeted on the same day, and most are "remarkably similar," said Drew Evans, the superintendent of the Minnesota Bureau of Criminal Apprehension. More than 20 schools in the state were targeted in two separate incidents, one in September of last year and another this February.

"This is a really serious crime," Evans said. "It places everybody in a situation of potential danger to have police officers rushing into a school."

Many of the calls have followed a distinct pattern, according to police reports and recordings reviewed by the Post.

A male voice says that he is inside a school and that multiple students are shot. Many times, he claims to be a teacher. He says he is in a particular classroom or a bathroom, and tells the police to hurry.

He speaks with a heavy accent, police reports note. The calls first come in on non-emergency lines and are not recordings: The speaker interacts with dispatchers and responds to their questions.

In incidents in at least 12 states, the Post found, the numbers were provided by TextNow, a Canadian company that offers free calls using voice over internet protocol, or VoIP.

TextNow says it works proactively to prevent bad actors from using its service while also keeping it free and accessible. The company "does not condone the use of our platform for harassment, fraud or other illegal activity that jeopardizes public safety," said Derek Ting, TextNow's co-founder, in a blog post in August. "However, when serving millions of people of various backgrounds and needs, you cannot solve every challenge with the biggest hammer you can find."

Three months before the hoax calls in Michigan, something strikingly similar unfolded in northern Louisiana. A male voice described by police as having a "foreign accent" reported an active shooting in progress at a high school in Bossier Parish, near Shreveport. Patrol officers raced to the scene but found no threat.

The detective who took the case, Capt. Shannon Mack, relished the chance to investigate the call. Her probe would unravel fresh details of the shooting hoax mystery, turning up clues and dead ends.

A 15-year veteran of the sheriff's department, Mack has developed a self-taught expertise in cases involving internet-based phone services. "That's my niche," said Mack, 49. She likes that it's technical and sometimes tedious. She especially loves the feeling of "tracking someone who thinks they can't be tracked."

"Nine times out of 10, it's a TextNow number," Mack said.

After Bossier Parish received the school shooting hoax call in November, Mack sought several search warrants. She started with TextNow, asking for all the information the company had about two numbers linked to the incident: call logs, internet protocol addresses, account setup data. Then she moved on to Google and Apple, asking for everything they had on the email addresses that created the TextNow accounts.

The result was a trove of data that offered a minute-by-minute window into the activity of the perpetrator — or perpetrators. The logs revealed hundreds of calls over a roughly two-week period, many to police departments, schools and even restaurants. The caller mostly dialed numbers in the United States, but there were also a few dozen calls made to Australia and Canada.

One TextNow number was linked to school shooting hoaxes in at least six states: Alaska on Nov. 2; California and Texas on Nov. 4; Maine on Nov. 15; Ohio and Louisiana on Nov. 16.

According to the records Mack obtained, the perpetrator connected to TextNow via virtual private networks, or VPNs, which obscure a user's location.

For Mack, the finding pointed to an even bigger pattern — and an even more prolific swatter. In April 2022, she had investigated a bomb threat hoax call targeting a local school. It, too, was made with a TextNow number that was traced to an internet protocol address in Ethiopia. Even the voice on the 911 call sounded the same in the two cases.

When the school shooting hoax call took place in November, Mack recognized the voice from the earlier bomb threat. She quickly called the number back. She heard the same male voice say, "Hello? Hello?"

"Hey, why are you calling schools and doing that to kids?" Mack recalled saying. "You know it's wrong. Where you at?"

The person hung up.

The link to Ethiopia was a crucial — if incomplete — breakthrough. Just because a call originated from an Ethiopian IP address doesn't necessarily mean the perpetrator is calling from that country, experts said, noting that online marketplaces sell access to such addresses.

Still, the hoax calls kept coming. North Carolina, West Virginia, New Hampshire in December. Michigan, Oregon, Minnesota in February. Kansas, Ohio, Massachusetts, Wisconsin, Utah, Pennsylvania, New York in March. Wyoming and Illinois in April. In May, the hoax calls targeted at least 14 schools in Tennessee, just weeks after an actual school shooting left six people dead in Nashville.

Catalin Grigoras, director of the National Center for Media Forensics at the University of Colorado at Denver, conducted a technical analysis for the Post of five of the hoax calls made between September 2022 and April 2023. Grigoras said there was a strong probability that the caller used a device or app to alter their voice in real time. However, it was also highly likely, Grigoras said, that the same person was speaking in each recording.

The swatter's use of technology is notable, said James Turgal, a former senior official at the FBI's information and technology branch who is now vice president at Optiv, a cybersecurity firm. "Gone are the days when someone on a hard-line phone would call in a bomb threat because they didn't want to take their final that day," Turgal said. "That was ye olden days."

Another enigma was the caller's motivation. The perpetrator of the school shooting hoaxes could be driven by hostility, money or some combination of the two, experts said. On platforms such as Telegram, there are groups offering swatting services: one viewed in August by the Post touted the possibility of "extreme harassment" for $100 a day and bragged about being able to close any school.

But the volume of school shooting hoaxes may also suggest a kind of compulsion. "I think they can't stop," said Keven Hendricks, an investigator and cybercrime expert who has worked on swatting cases with police. "This is what this person does."

That Instagram account has no posts, but several others with nearly the same name and imagery contain violent rhetoric toward the United States and white people. One account mentions Bob's on Sheridan, a mom-and-pop breakfast restaurant in Kenosha, Wis., in a post from January 2022 that claims a "missile" was launched there.

That same month, the Kenosha County Sheriff's Department received five calls on its non-emergency line saying multiple people had been shot or injured at Bob's. It was a male voice, with a heavy accent, using VoIP numbers, Sgt. Colin Coultrip said.

Following a query from the Post, Instagram removed the accounts for violating its policy against inciting violence, said a spokeswoman for Meta, which operates Instagram and Facebook.

This spring, detectives in Illinois added another piece to the puzzle. In April, at least 12 schools in the state were targeted by a wave of school shooting hoax calls. Detectives in the towns of Carbondale and Marion determined the calls were made from a TextNow number and asked the company for information about the account.

TextNow provided records to the police showing that the account holder made calls from the phone number for four days. As in previous incidents, the user took steps to obscure their location, connecting through a VPN or a proxy server, another tool that conceals a person's location.

The woman lives in a neighborhood of modest, prefabricated homes. When approached by a Post reporter on a recent sunny afternoon, she reacted with confusion. She had not been contacted by the authorities, she said, and had no idea that her router was connected to the case.

The persistence of the swatting hoaxes pushed TextNow to tighten its policies. Although the company had stated for years on its website that the use of VPNs was not supported by the service, the hoax perpetrator had used that type of secured network to connect to the platform for months.

In the first half of May, TextNow said, it took several new steps. It blocked users from making calls from a web browser when using a VPN, the company said. It also prevented users from creating new accounts on a device that was previously flagged for abuse.

Tristan Huntington, the company's senior vice president, said TextNow adapts its processes to block bad actors but described it as a game of cat-and-mouse. "The moment we make a change and we tell people about it, then immediately there is some kind of workaround," he said.

Some experts are critical of TextNow, where people can sign up for an account with only an email address. "Why are you letting any call go through when you don't know who's making it?" asked Fred Posner, a communications consultant and VoIP expert.

For the FBI, the probe is akin to peeling the layers of an onion, said Todd Hillis, chief intelligence officer at IACI, an information-sharing association that identifies threats to cybersecurity.

Some popular VPNs outside the United States retain logs of customer activity for only a brief period, or do not cooperate with American law enforcement at all, Hillis said. He estimated it would take six months or longer for the FBI to obtain such data through a mixture of persuasion and treaty requirements between countries.

Even then, he said, the user's actual location may not be clear.

"You can make yourself several layers deep if you are so inclined," Hillis said. "The onion gets more and more layers on it, and it gets harder and harder."

A rare glimpse into the federal investigation came in May. An analyst at Utah's Statewide Information and Analysis Center made a presentation to local lawmakers about the swarm of school shooting hoaxes that took place in the state two months earlier. The analysis said that while the perpetrator had used "sophisticated measures to remain anonymous," the FBI had "determined the originating source."

The FBI, too, declined to comment on what exactly the Utah report was referring to, where the hoax calls were coming from and whether it had identified a suspect. It also did not respond to broader questions about its investigation into the school shooting hoaxes, its effort to combat such incidents or its creation of a new database of swatting incidents in May. No arrests have been announced in connection with the hoax calls.

Meanwhile, several other hoax calls have occurred. Last month, two schools in Nashville were targeted with fake active shooter calls, said Kristin Mumford, a spokeswoman for the Nashville police. The calls originated outside the state, and the police noted that "there have been hundreds of similar threats in other American cities." A connection to the larger trend "has not been ruled out," Mumford said.

In Michigan's Saginaw Township, the police say they're eagerly awaiting a call informing them that the FBI has caught the culprit in the shooting hoaxes. "Hopefully, there will be some closure, so at least that person won't do it again," Lt. Rick Herren said.

At Nouvel Catholic Central High School, the doors rammed by the police cruiser were swiftly repaired. Other damage will take longer to heal.

Lydia Schade, 17, was in her pre-calculus class when the lockdown announcement came over the loudspeaker and she saw her teacher's face go white. She knew it wasn't a drill. As she huddled in a corner, she thought of her late grandmother, who used to tell her to be strong, to be a warrior.

Tim Novak, a parent at Nouvel Catholic, recalled the agonizing minutes when his son Max, then a senior, wasn't responding to his text messages. Novak said he knows all too well that the hoax could have been real. He stopped speaking, unable to continue. His eyes filled with tears. "It's because it happens so often," he said.

A little over a year before the shooting hoax in Saginaw, a student in Oxford, Mich., about 80 miles away, opened fire at his high school and killed four people. A week after the hoax, a gunman killed three students at nearby Michigan State University.

The morning of the hoax, Cormac Lynn, the schools superintendent who oversees Nouvel Catholic, was on the phone in his office in an adjoining building when he saw police vehicles with lights flashing and sirens blaring race into the parking lot. He immediately hung up.

When Lynn reached the main floor of the school, he saw officers in tactical gear with weapons raised, yelling at him to put his hands up. They pointed their guns at him and told him to lift his shirt. He carefully complied.

"The cops weren't in a drill. We weren't in a drill," Lynn said. The experience was "as real as you can get without an act of violence."