Full Report
The inside story of the teenager whose “swatting” calls sent armed police racing into hundreds of schools nationwide—and the private detective who tracked him down.
Analysis Summary
# Incident Report: Spokane School Swatting Incident
## Executive Summary
In May 2023, the Spokane Regional Emergency Center received a highly credible, 45-second hoax call reporting an active school shooting by a perpetrator identifying himself as "Wayne" at Central Valley High School. The incident triggered a massive, immediate deployment of over 50 law enforcement units, causing significant panic among students, staff, and a nearby daycare. The incident was later identified as a "swatting" attack, though the article focuses more on the emotional toll and the subsequent identification of a potential perpetrator ("Torswats") by an independent investigator rather than formal eradication steps by the targeted organization.
## Incident Details
- **Discovery Date:** May 2023 (When the call was received)
- **Incident Date:** Wednesday morning, May 2023, around 10:00 AM
- **Affected Organization:** Spokane Regional Emergency Center (SREC) and Central Valley High School (CVHS)
- **Sector:** Government/Public Safety (Emergency Dispatch) and Education
- **Geography:** Spokane Valley, Washington
## Timeline of Events
### Initial Access
- **Date/Time:** Mid-morning, May 2023 (Approx. 10:00 AM)
- **Vector:** Publicly listed regional emergency line (Voice call).
- **Details:** A caller, identifying himself as "Wayne," reported he was entering Central Valley High School with an AK-47 and planned to kill everyone, including responding police officers. The caller's voice was described as unnaturally deep and close to the microphone.
### Lateral Movement
- **Details:** Not applicable in the traditional sense, as the attack vector was a direct communication designed to trigger an emergency response (swatting).
### Data Exfiltration/Impact
- **Details:** No data exfiltration occurred. The primary impact was massive operational disruption, extreme psychological distress for emergency staff (dispatcher Sarah Jones), and immediate, intense lockdown/survival response from the high school and a nearby daycare center.
### Detection & Response
- **How it was discovered:** The threat was received directly via an emergency call by dispatcher Sarah Jones.
- **Response actions taken:**
- Jones transferred the situation to her supervisor, Andrea Lombard.
- Lombard immediately issued an emergency alert to all regional police units (over 50 units mobilized).
- Lombard separately contacted a nearby children's daycare facility, advising them to lock down immediately.
- Law enforcement entered CVHS, weapons drawn, while students and staff sheltered in place.
- It was later determined that no shooter or gunfire was present upon investigation by law enforcement.
## Attack Methodology
- **Initial Access:** Voice call over a public emergency dispatch line.
- **Persistence:** Not explicitly detailed, but the context implies this was part of a broader "swatting spree" conducted by a known threat actor named "Torswats."
- **Privilege Escalation:** Not applicable (social engineering/deception).
- **Defense Evasion:** Used voice modulation or acoustic tricks to create a highly convincing and terrifying scenario, avoiding immediate detection as a hoax.
- **Credential Access:** Not applicable.
- **Discovery:** Not applicable (attacker initiated contact).
- **Lateral Movement:** Not applicable.
- **Collection:** Not applicable.
- **Exfiltration:** Not applicable.
- **Impact:** Triggering a massive, militarized police response to a non-existent threat (Swatting).
## Impact Assessment
- **Financial:** Not detailed, but involved significant cost associated with deploying 50+ emergency units.
- **Data Breach:** None reported.
- **Operational:** Complete paralyzation of Central Valley High School operations; deployment of major regional law enforcement resources; severe emotional trauma to key dispatch personnel. A nearby daycare was also forced into an emergency lockdown.
- **Reputational:** Not detailed, but the incident caused immense public fear within the local community.
## Indicators of Compromise
- **Network indicators:** None provided (caller used a publicly listed regional line).
- **File indicators:** None provided.
- **Behavioral indicators:** Unnaturally deep, slow, and close-mic voice delivery; explicit threat of mass murder and targeting police; simulated automatic gunfire heard over the line.
## Response Actions
- **Containment measures:** Immediate broadcast of a high-threat alert to law enforcement; physical securing of the targeted high school and nearby daycare facility lockdown.
- **Eradication steps:** Law enforcement swept the premises; the threat actor was not apprehended at the scene.
- **Recovery actions:** Psychological support implicitly needed for staff; verification of safety across the school campus.
## Lessons Learned
- The psychological toll on emergency dispatchers dealing with high-stress, time-critical hoaxes is severe.
- Swatting campaigns rely on exploiting existing fear and established police protocols for mass casualty events.
- The FBI/law enforcement had prior knowledge of the perpetrator ("Torswats") but had "done little to stop his swatting spree," suggesting systemic failure in proactive threat neutralization against known swatting actors.
## Recommendations
- Implement advanced voice analysis or verification protocols for calls reporting active mass casualty events, especially when the threat actor uses suggestive audio cues.
- Review internal protocols for cross-referencing threat actors known to be engaged in coordinated swatting campaigns (like "Torswats").
- Enhance support and rotational scheduling for dispatch staff, particularly those working overtime in high-stress roles, to mitigate burnout and acute trauma from incidents like this.