Fogbow

For more than a year, the United States Federal Bureau of Investigation has been hunting the person whom experts say is one of the most prolific swatters in American history. Law enforcement now believes they have finally arrested the person responsible.

A 17-year-old from California is allegedly the swatter known as Torswats, according to sources familiar with the investigation. The teenager is currently in custody and awaiting extradition from California to Seminole County, Florida. The Florida State Attorney’s Office tells WIRED that he faces four felony counts.

Seminole County, located in central Florida, had two high-profile swatting incidents within the last 12 months, including one targeting a mosque and another targeting a courthouse. Todd Brown, a spokesperson for Florida’s Office of the StateAttorney in the 18th Circuit, confirmed the charges against the teen and his extradition. Brown says he will be prosecuted as an adult under Florida law. WIRED is withholding the 17-year-old’s name because he is a minor.

The teenager’s arrest comes in the midst of a nationwide swatting surge. Swatting attacks typically involve someone calling in fake attacks to 911 in an attempt to solicit an overwhelming police response. Since Christmas, swatters have targeted the homes of prominent politicians from both parties, judges handling cases involving former US president Donald Trump, and the director of the US Cybersecurity and Infrastructure Security Agency.

Prior to these high-profile swats, a relentless campaign from different, potentially foreign, swatting groups targeted hundreds of schools and universities around the US over the past year and a half. Last May, an officer in Danvers, Massachusetts, accidentally fired his service weapon while responding to a school swat. In February, an officer in Saginaw Township, Michigan, rammed his vehicle through the school’s locked door to get inside the building following a swatting call.

According to the Florida State Attorney’s Office, the charges against the California teenager include making false reports concerning the planting of a bomb or the use of firearms, causing a law enforcement response. All charges are described as related to acts of terrorism and showing prejudice based on race, color, ancestry, ethnicity, or religion.

In private Telegram chats witnessed by WIRED over the past year, a person operating the Torswats handle claimed responsibility for hundreds of false reports of bomb threats and active shootings called into schools, politicians’ homes, courthouses, and religious institutions around the US.

Brad “Cafrozed” Dennis, a private investigator who works for high-profile Twitch streamers who've been swatted, has been hunting Torswats for nearly two years and actively helping the FBI’s investigation. “It’s a beautiful day,” Dennis says. “I am very relieved Tor will no longer be able to conduct his reign of terror on our schools and public officials just doing their jobs.”

According to records shared with WIRED, Dennis engaged someone using the Torswats handle on a peer-to-peer chatting service called Tox under the guise of ordering a swat in December 2022. By recording his network traffic, the investigator surreptitiously captured the swatter’s IP address along with a username that at the time was unknown to law enforcement. According to Dennis, in January 2023, he handed the evidence to the FBI special agents in charge of Torswats’ case. In emails shared with WIRED, the FBI told Dennis this information was used in subpoenas sent to YouTube and Discord. Court records related to the case against the California teen have not yet been made public.

Other messages Dennis shared with WIRED suggest that the FBI has known the identity of Torswats, whose swatting activities were first revealed by Motherboard last April, since at least July 2023, when the agency executed a search warrant and seized Torswats’ devices. The FBI’s Seattle field office, which oversaw the investigation into Torswats, declined WIRED’s request to comment.

"HELLO, I AM going to commit a mass shooting in the name of Satan," a voice with a fake Southern accent drawled to a police dispatcher in Seminole County, Florida, on May 12, 2023. The caller spoke slowly and deliberately when he told the dispatcher that he was armed with pipe bombs and an AR-15 rifle, walking into a mosque to kill everyone he saw. The call ends with the sound of gunshots likely sourced from a video game.

That day, the same voice-over-IP phone number called threats into at least two other mosques in Florida, according to police records obtained by WIRED. That week, in a private Telegram chat, an individual operating the Torswats Telegram channel took responsibility for sending police officers scrambling to as many as 20 schools in Washington state and four historically Black colleges and universities in Texas. Audio from 911 calls reviewed by WIRED and interviews with local law enforcement confirm that many if not all of the Washington state calls were made by someone sounding like an individual associated with the Torswats account. Some used a similar script, referencing an AR-15 rifle and pipe bombs.

The individual’s calls to Washington schools in May affected at least 18,116 students and cost taxpayers $271,173 in lost instructional time, estimates Don Beeler, CEO of TDR Technology Solutions, a company that builds school surveillance tools and tracks and analyzes the costs of school threats.

In private Telegram chats seen by WIRED, an individual behind the Torswats account described their method for carrying out school swattings. After proxying their network traffic through a commercial VPN, the individual would look up the school in every county they targeted using the Public School Review website to find each address. They then would Google the phone number for the nearest police department and use Google Voice to place calls. While most of this appeared to be done on an Android device, they would occasionally use a digital sound board on their PC to introduce gunshot sounds that appeared to be recorded from the video game Counter-Strike: Global Offensive.

“State and local law enforcement often feel like a swatter is doing something sophisticated, and that’s just often not the case,” Keven Hendricks, a cybercrime expert and swatting investigator, tells WIRED. In November, Torswats claimed to have swatted Hendricks and his family. Hendricks declined to comment about the swatting.

During a hoax call allegedly placed by Torswats and obtained by WIRED that targeted La Plata High School in Charles County, Maryland, last year, the school resource officer informed the caller that he was under an active investigation. “I am never going to be caught,” the caller laughed. “I am invincible.”

IN FLORIDA, WHERE the California teenager is facing state charges, swatting is a felony. Late last year, two 14-year-old boys, allegedly part of a national swatting group called LulzSEC, were accused of calling in a mass shooting at Baker School in Okaloosa County in November. The charges for one of the teens included making an electronic threat of a mass shooting, making a false report of firearms being used in a violent manner, use of a two-way communication device to facilitate a felony, and interference with school functions. In a press conference at the time, Okaloosa County sheriff Eric Aden said the investigation into LulzSEC—which shares the name of an early-aughts hacktivist group—is ongoing.

Last May, the FBI initiated an effort to track swatting nationwide. The National Common Operation Picture – Virtual Command Center, or NCOP-VCC, is a collaborative effort between local law enforcement and the FBI to track swatting activity in real time. According to the FBI, there have been over 550 swatting incidents reported to the FBI’s NCOP-VCC since its launch. Because reporting is voluntary, the true number of swattings across the US is likely much higher.

US senator Rick Scott of Florida introduced a bill earlier this month to expand federal charges related to hoaxes to include swatting. The proposed legislation could potentially result in a maximum penalty of up to 20 years in prison for individuals convicted of the activity.

Scott says he was swatted at his home in December. According to the incident report, obtained by The Washington Post, the caller claimed that he had shot his wife with an AR-15 and would blow up the house with a pipe bomb.

In a statement announcing the legislation, Scott said, “We must send a message to the cowards behind these calls—this isn’t a joke, it’s a crime.”

It is unclear whether a single person operated under the Torswats name. On January 20, two days after Dennis, the private investigator, said that Torswats had been arrested, a person using the Torswats’ Telegram handle who had knowledge of previous conversations with WIRED reached out.

“I am pretty sure I’ll never be arrested,” the individual wrote in a direct message on Telegram. “Seems ridiculous that a few bucks a month can allow someone to do crazy shit and never go to jail.”