The search for the caller behind Utah’s 13 school hoaxes

Mar 30, 2023, 2:00 PM

At the time this story is being published, it is less than 24 hours since multiple schools across U...

Police maintain a presence after responding to false threats of shots fired at Ogden High School in Ogden on Wednesday, March 29, 2023. Police agencies along the Wasatch Front and northern Utah responded to similar reports of school violence on Wednesday morning. (Kristin Murphy, Deseret News)

(Kristin Murphy, Deseret News)

SALT LAKE CITY — At the time this story is being published, it is about 24 hours since multiple schools across Utah and thousands of people were thrown into chaos by hoaxes warning of fake active shooters on multiple campuses.

Officials soon learned the school calls were all hoaxes, the threats, fake. But not before police armed with heavy weaponry were inside those schools among frightened and confused teachers and students.

Related: Multiple Utah schools received fake reports of school shooting, officials say

And though it’s been less than a day since the calls were made (or swatting calls, which is their official name), public safety officials in Utah have made at least some progress in finding the caller’s identity. 

Here’s how that happened.

Tracing the school hoaxes 

“All of the calls were made from the same phone number,” Hilary Kellner, the Director of Communications for the Utah Department of Public Safety, told Dave and Dujanovic on Thursday morning.

That information came via Utah’s statewide information analysis Center and the FBI, who traced the number.

“They found that it connected to an IP address that was connected outside of the country,” Kellner said. “Not one specific country, that IP address kind of tagged a couple of different countries.”

Related: Ogden High School community reacts to active shooter hoax

IP addresses are assigned to either a country or a block of countries. 

But that doesn’t mean the person was outside the country — they could have used a proxy server or virtual private network to mask their actual IP address.

Who made the swatting calls?

Kellner said they determined a male with a foreign accent called 911. He falsely reported there was an active shooter at Spanish Fork High School. The caller reportedly told 911 that six people had been wounded by this “active shooter.” 

Safety officials have confirmed that 911 was called about 13 different schools in Utah. The storyline was “pretty similar with all of them.”

Kellner said it was the same person calling from the same IP address, in each call.

Just the beginning of the search

Determining an IP address is just the beginning of the hunt for the hoax caller. 

“More experienced cyber criminals will either tunnel to or connect to a … voice over IP server, where they’re making such phone calls from a different location, a different country,” said Earl Foote with Nexus.

Although, was it really a male that was calling?

“The male voice that was heard (on the 911 calls) could be spoofed (or imitated) by AI or bots,” Foote said. 

If the caller has a registered account with a cloud service provider, the cloud provider may have contact information for that person.  However, if they’re a “smart criminal,” Foote said, they’ll cover those tracks too.

Did the caller behind the school hoaxes leave a clue?

Thirteen schools in Utah were targeted by hoax emergency calls known as swatting calls. Investigators will likely look for a connection between all of the schools.

“It may lead to the source being within the United States or somebody with … specific knowledge of the geo localities .. where the phone calls were placed,” Foote said.


We want to hear from you.

Have a story idea or tip? Send it to the KSL NewsRadio team here.

Crime, Police + Courts

FILE: An arson investigation is underway after several suspicious fires in Salt Lake City on Tuesda...

Britt Johnson

Salt Lake City Fire conduct arson investigation Tuesday morning

An arson investigation is underway after several suspicious fires in Salt Lake City on Tuesday.

4 hours ago

Brenda Dye, the Fremont County coroner, testified Wednesday about the reasons why she changed Tammy...

Emily Ashcraft,

Coroner describes changing Tammy Daybell’s cause of death to homicide

Fremont County Coroner Brenda Dye changed Tammy Daybell's cause of death to homicide after participating in her autopsy.

8 hours ago

The U.S Supreme Court is photographed on Friday, Jan. 5, 2024, in Washington. The Supreme Court is ...


Supreme Court will consider when doctors can provide emergency abortions in states with bans

The Supreme Court has allowed the Idaho law to go into effect, even during emergencies, as the case played out.

15 hours ago

One of two controlled detonations of old dynamite is seen in Holladay on April 24, 2024. (KSL TV)...


Crews detonate ‘ancient dynamite’ found in Holladay home

HOLLADAY, Utah — Early Wednesday morning, the Unified Fire Authority Bomb Squad detonated ‘ancient dynamite’ that had been found in a Holladay home. A resident found the explosives in a house near 6200 South and 2300 East and reported the find on Tuesday evening.  According to Unified Fire Authority Assistant Chief Riley Pilgrim, the homeowner […]

16 hours ago

Exterior image of the Ada County courthouse in Boise, Idaho, Monday April 3, 2023. As Chad Daybell'...

Emily Ashcraft,

Ex-husband of Lori Daybell’s niece testifies about an attempt to kill him, identifying JJ’s body

Brandon Boudreaux noticed something was off when he turned onto his street in Gilbert, Arizona, on Oct. 2, 2019.

1 day ago

FBI agent Douglas Hart, right, testifies Monday about texts between Chad Daybell and Lori Vallow Da...


‘Angels are angry’: FBI agent describes ‘manipulating’ texts between Lori and Chad Daybell

Testimonies from key people in Chad Daybell and Lori Vallow Daybell's life took the stand on Monday, who talked about strange messages from the couple.

2 days ago

Sponsored Articles

a doctor putting her hand on the chest of her patient...

Intermountain Health

Intermountain nurse-midwives launch new gynecology access clinic

An access clinic launched by Intermountain nurse-midwives provides women with comprehensive gynecology care.

Young couple hugging while a realtor in a suit hands them keys in a new home...

Utah Association of Realtors

Buying a home this spring? Avoid these 5 costly pitfalls

By avoiding these pitfalls when buying a home this spring, you can ensure your investment will be long-lasting and secure.

a person dressed up as a nordic viking in a dragon boat resembling the bear lake monster...

Bear Lake Convention and Visitors Bureau

The Legend of the Bear Lake Monster

The Bear Lake monster has captivated people in the region for centuries, with tales that range from the believable to the bizarre.


Live Nation Concerts

All the artists coming to Utah First Credit Union Amphitheatre (formerly USANA Amp) this summer

Summer concerts are more than just entertainment; they’re a celebration of life, love, and connection.

Mother and cute toddler child in a little fancy wooden cottage, reading a book, drinking tea and en...

Visit Bear Lake

How to find the best winter lodging in Bear Lake, Utah

Winter lodging in Bear Lake can be more limited than in the summer, but with some careful planning you can easily book your next winter trip.

Happy family in winter clothing at the ski resort, winter time, watching at mountains in front of t...

Visit Bear Lake

Ski more for less: Affordable ski resorts near Bear Lake, Utah

Plan your perfect ski getaway in Bear Lake this winter, with pristine slopes, affordable tickets, and breathtaking scenery.

The search for the caller behind Utah’s 13 school hoaxes