When Emmi Conley first heard in September about a rash of hoax calls reporting active shooters in schools, she dismissed it. Conley, an extremism researcher who studies groups and people behind public displays of violence, said she found no indication that these calls were connected to fringe online spaces where these pranks often originate.
But as the number of these reports swelled over time, Conley said she began to discern some very strange patterns — including the possibility that the calls may have come from overseas, and perhaps specifically from Africa.
"The scale and the timeline of the events is highly, highly unusual," she said. "The calls are consistent. They are coordinated. They are grouped state-by-state and district-by-district, and they're also sustained. So somebody is putting significant effort to keep these going."
As Conley began digging further, more questions emerged. Elements of these calls were notably different than what she has typically seen in school-based threats. Nobody has taken credit for these calls, even as they stretched over several weeks, and the technological planning and research behind the calls betrayed a level of sophistication not typically seen.
In a statement, the FBI has said it is aware of the incidents, but has "no information to indicate a specific and credible threat."
The agency said it is working with law enforcement at every level to investigate the cases. But some news reports, including in Minnesota and Louisiana, have cited local authorities who said the calls may be originating in Africa or, specifically, Ethiopia. The FBI would not comment on this detail.
For Conley, particulars around these calls suggest that the people or person behind them are, indeed, overseas.
"Our big questions now are whose attention are they after?" she said. "Is it the public? Law enforcement? Media? Something else? And why they're after it?"
Swatting as the new 'bomb threat'
The hoaxes are called "swatting," a term that refers to calls that falsely report an act of violence in progress or about to occur. They are intended to set off a massive and immediate deployment of armed law enforcement to a specific target, including SWAT teams. The results can be quite dangerous, as they were in a fatal incident in 2017, when police swatted a man in Wichita, Kansas.
"It was popularized by extremely online communities with proclivities toward violence and perceived ideological enemies," said Conley. Those have included live-gaming communities and extremist groups, where perpetrators aim to harass specific individuals. The recent targeting of institutions, namely schools, appears to be a new development.
NPR has found, primarily through local news reports, at least 113 instances of hoax calls across 19 states between Sept. 13 and Oct. 5. Louisiana, Minnesota and Virginia tallied the greatest number. This is likely an undercount, as many locations may not have garnered media attention. School safety experts worry that these hoaxes could inspire copycats, putting school communities and law enforcement officers at significant risk.
"You know, for decades, those of us in the school safety world have dealt with false bomb threats," said Mo Canady, executive director for the non-profit organization National Association of School Resource Officers (NASRO). "If we get a call that someone is actively shooting, injuring, killing people, that's a whole different matter. That requires really an all-out response."
Canady said swatting presents a higher set of risks than bomb threats. In Ohio, one father was reportedly detained for arriving at Licking Valley High School with a gun after hearing that there may be an active shooter at that location. That response from a parent is understandable, said Canady, particularly as the horror of a school massacre in Uvalde remains fresh in many parents' minds. But, he notes, it could lead to confusion and worse at the scene.
A shift from bomb threats to false calls about active shooters may also reflect that bad actors understand how heavily school shootings have come to factor into communities' fears in the U.S.
"The underlying reason that it is effective as a disruption or as an emotional, psychological attack is because we know it could be real," said Amanda Klinger, director of operations for the Educator School Safety Network, a national nonprofit organization that does school safety for primarily K-12 educators. "Our fear of school shootings and school-based violence is being weaponized against us."
'A connection to overseas'
In audio obtained by NPR of some calls in Ohio and one call in Minnesota, the person reporting an active shooting breathes heavily and follows a nearly identical narrative. He identifies himself as a student at the school, although he sounds like an adult male. He also speaks with a heavy accent. NPR also requested call records from locations in other states, but many were denied on the basis that the incidents are under investigation.
Drew Evans, superintendent at the Minnesota Bureau of Criminal Apprehension, said he has also heard audio of hoax calls that were placed in states other than Ohio and Minnesota. He said they sounded very similar.
"There was an accent here and it appeared to be a similar person or the same person in all the calls either heard or reported in to us," Evans said. The MBCA is investigating 17 swatting calls that occurred Sept. 21 in Minnesota.
Evans said that the calls in his state were all made directly to schools or to non-emergency dispatch lines, rather than to 911. He said they appeared to be coming from Internet-based phone numbers, which either originated in or were routed through foreign countries through a VPN connection.
"There's indications that there's a connection to overseas," he said. "What we don't know is whether or not overseas could have been used as a mask."
Conley said the possibility that the calls came from a foreign individual or entity may be bolstered by details that the caller provided that are atypical of school shootings in the U.S. For example, the particular model of gun the caller referenced as the weapon was often different from what is commonly used in school shootings.
"America has a very particular relationship with guns," she said. "The the cultural object of the mass shooting in the United States is the AR-15."
But both Conley and Evans noted this campaign indicates a tremendous level of detailed local knowledge or research.
"Whoever is doing this has managed to make phone calls relating to specific schools, reach the correct dispatchers, and give specific information about local school districts and threats within them without being caught," Conley said. "You couldn't do that without some considerable effort and investigation into knowing where you're targeting, how you're targeting it and how you were avoiding detection."
An earlier wave
Some are considering the possibility that the person or group behind the calls is building on prior experience. In the spring, schools in several states reported receiving false calls about bomb threats. In Minnesota, the MBCA confirmed that nine schools were targeted. Evans said there were similarities between how those calls were placed, and the more recent wave of false active shooter reports.
"There [were similarities] in terms of the specificity in which they were calling in the particular threat, it appeared to be one individual that was making the calls, and they certainly seemed to be one individual that was a live person," he said. Evans said that those calls, as with the calls in September, were also made to non-emergency lines.
"Some of the schools believe there's a potential they could be connected," he said.
NPR identified at least six states where schools received bomb threats starting in mid-March and mostly concentrated through April. Minnesota, North Carolina, Maine, Louisiana and Hawaii each saw multiple hoax calls on a single day.
In Louisiana, where at least five schools received false calls about bomb threats on April 21, one local report said that investigators had linked the IP address of the caller to Ethiopia. More recently, a report from Minnesota cited Alexandria Police Chief Scott Kent saying that he believed the calls made in September to schools in his state were linked to an IP address in Ethiopia. Kent did not respond to interview requests.
Evans said the investigation into the April calls to Minnesota schools remains open.
The difficulty of discerning a motive
Whether the source of these hoaxes is domestic or foreign, one perplexing question remains the same: Why?
"I would find myself wondering, especially if it's coming from another country, is someone potentially trying to test our systems to see how we respond to those types of events?" said Canady.
NASRO recently issued guidance to schools on handling swatting calls. Chief among it, said Canady, is to continue to operate under the assumption that each call is a real threat.
"If we hesitate, it can cost lives," he said. "So unfortunately, we have to continue to proceed in an emergency manner... until we know for a fact that it's not a real incident."
But there's also concern that if the dramatic uptick in swatting sustains or continues to rise, that emergency response itself can create trauma. Klinger said even hoaxes can create fearful situations that exact a psychological and emotional toll upon students, educators and parents. She said she would like to see more federal guidance on how to keep school communities safe, but still nurturing.
"If I continue to just shut down the schools, shut down the school, shut down the school... how does it end? How do you ever stop it?" she said.
Without a clear ideological aim behind these calls, or any known organization, the effort may not clearly qualify as terrorism under the FBI's definition of the term. But many note that its effect may be the same.
"There's a significant amount of intentionality based on the information that's been reported," said Evans. "They were doing this with a purpose to cause fear in our communities."
