Police maintain a presence after responding to false threats of shots fired at Ogden High School in Ogden on Wednesday, March 29, 2023. Police agencies along the Wasatch Front and northern Utah responded to similar reports of school violence on Wednesday morning. (Kristin Murphy, Deseret News)
SALT LAKE CITY — At the time this story is being published, it is about 24 hours since multiple schools across Utah and thousands of people were thrown into chaos by hoaxes warning of fake active shooters on multiple campuses.
Officials soon learned the school calls were all hoaxes, the threats, fake. But not before police armed with heavy weaponry were inside those schools among frightened and confused teachers and students.
And though it’s been less than a day since the calls were made (or swatting calls, which is their official name), public safety officials in Utah have made at least some progress in finding the caller’s identity.
Here’s how that happened.
“All of the calls were made from the same phone number,” Hilary Kellner, the Director of Communications for the Utah Department of Public Safety, told Dave and Dujanovic on Thursday morning.
That information came via Utah’s statewide information analysis Center and the FBI, who traced the number.
“They found that it connected to an IP address that was connected outside of the country,” Kellner said. “Not one specific country, that IP address kind of tagged a couple of different countries.”
IP addresses are assigned to either a country or a block of countries.
But that doesn’t mean the person was outside the country — they could have used a proxy server or virtual private network to mask their actual IP address.
Kellner said they determined a male with a foreign accent called 911. He falsely reported there was an active shooter at Spanish Fork High School. The caller reportedly told 911 that six people had been wounded by this “active shooter.”
Safety officials have confirmed that 911 was called about 13 different schools in Utah. The storyline was “pretty similar with all of them.”
Kellner said it was the same person calling from the same IP address, in each call.
Determining an IP address is just the beginning of the hunt for the hoax caller.
“More experienced cyber criminals will either tunnel to or connect to a … voice over IP server, where they’re making such phone calls from a different location, a different country,” said Earl Foote with Nexus.
Although, was it really a male that was calling?
“The male voice that was heard (on the 911 calls) could be spoofed (or imitated) by AI or bots,” Foote said.
If the caller has a registered account with a cloud service provider, the cloud provider may have contact information for that person. However, if they’re a “smart criminal,” Foote said, they’ll cover those tracks too.
Thirteen schools in Utah were targeted by hoax emergency calls known as swatting calls. Investigators will likely look for a connection between all of the schools.
“It may lead to the source being within the United States or somebody with … specific knowledge of the geo localities .. where the phone calls were placed,” Foote said.