Hot on the Trail of a Mass-School-Shooting Hoaxer

Four times in the past year, the parents, teachers, and police officers of the small, neighboring Minnesota cities of Cloquet and Esko briefly believed that their children were about to be murdered in their classrooms. The calls began in the spring with two bomb threats. In the first, a man claimed to have seen a suspicious backpack with wires coming out of it at Cloquet and Esko high school. In July, he called again, this time reporting a bomb in a red backpack at Fond du Lac Tribal and Community College, according to police records. Then, in September, the same man, described by the Midwestern dispatchers as having a thick Middle Eastern accent, reported that a pair of gunmen, armed with AK-47s, had killed 10 people at Cloquet High School.

All of these calls turned out to be hoaxes. But according to Derrick Randall, Cloquet’s chief of police, each time they came in, it was “all hands on deck” for his department. Officers sprinted to their squad cars, threw on their extra body armor, and chambered rounds in the squad rifles. They may have blasted through stop signs and traffic signals while racing as fast as they could to face what might have been the worst thing they would ever see in their lives. “It’s dangerous, frustrating. It’s a waste, and we feel helpless,” says Randall. “Our job is to hold people accountable, and when there’s a person or group on the other side of the world able to take advantage of us and exploit our systems like this, they are taking away our power and control.”

According to the Minnesota Department of Public Safety, at least 26 schools in the state have received false reports of bomb threats or active shootings from the same individual or group since spring. The calls are part of an ongoing spree of hoax calls that police say are likely coming from overseas and have sent hundreds of thousands of students nationwide into lockdown. According to police records WIRED obtained, the hoax caller began their spree in March, earlier than previously reported, and could be linked to bomb threats called into dozens of colleges during the summer. Earlier this month, WIRED tracked more than 90 false reports of active shooters made to K-12 schools in 16 states around the country during the second half of September, and NPR found that the number may be even higher. The calls haven’t stopped. Scores of schools in New Jersey, Florida, California, South Carolina, South Dakota, Wisconsin, and Connecticut have been targeted in the past three weeks.

“The biggest frustration amongst parents is why no one can do anything to stop it,” says Hayley Katchenske, whose job includes sending messages to parents when there’s an emergency at Cloquet Public Schools. “Why did it happen to us again, why can’t this be traced, and why can’t it be stopped?”

State and federal law enforcement are working to answer these questions. They believe they know how the person carried out these dangerous hoax calls, WIRED has found. But they have yet to discover who is behind this string of attacks and, crucially, why they are doing them. The answers will determine what, if anything, law enforcement can do to stop it.

TextNow, Investigate Later

In an October memo the FBI sent to schools in New York that WIRED obtained, the agency describes a single subject—a male “with a heavy accent described as Middle Eastern or African”—behind many of these hoax calls. Federal and local law enforcement in several states say that the caller appears to be located internationally, perhaps in Ethiopia, and is using VoIP technology to systematically call in threats to targeted schools.

WIRED traced six phone numbers used in the hoax calls to a service called TextNow, a platform that allows users to anonymously place calls using US phone numbers. Unlike with traditional cellular service, where a provider might need a credit card and address to sign up for service, TextNow customers need to provide only an email address to begin making calls. That drastically limits the information the company is able to provide to law enforcement.

According to the October FBI memo, TextNow has provided investigators with subscriber information. The memo also says that an email account behind at least one of the hoax calls was linked to previous hoax 911 calls and that the account had connected to TextNow through the Ethiopian Telecommunications Company, which is owned by the Ethiopian government.