How Repeated Swatting Incidents and False Threats Are Shaping School Response Protocols
School safety leaders share lessons learned from responding to swatting incidents and false threats, including the importance of information gathering and law enforcement coordination.
Swatting incidents and false threats continue to disrupt schools across the country, forcing administrators, school safety personnel, and law enforcement agencies to respond quickly to reports that may ultimately prove unfounded.
Recent incidents affecting schools in Vermont and New Jersey are the latest reminder that these events remain a persistent challenge. In a recent National Council of School Safety Directors (NCSSD) discussion, several practitioners described how repeated swatting incidents have influenced their response protocols, communications, and coordination with law enforcement partners.
While the responses reflected different local experiences, several common themes emerged.
Verification Before Escalation
Historically, many schools responded to reported threats with an immediate lockdown and large-scale emergency response. Several practitioners said their districts have adjusted aspects of their response protocols following repeated swatting incidents.
One NCSSD member shared that repeated swatting incidents prompted their district and local law enforcement partners to reevaluate their response procedures. The practitioner noted that several reports were received through police dispatch rather than 911. Because some caller-masking applications, such as TextNow, do not support 911 calling, the call path became one factor considered when assessing the credibility of the report.
The member also noted that a true emergency would likely generate multiple calls to dispatch or the school rather than a single report.
When a reported active shooter was not accompanied by any other indicators of an actual emergency, school officials focused on gathering additional information while law enforcement investigated. According to the practitioner, the goal was to tailor the response to the information available rather than automatically defaulting to the most disruptive measures.
Information Gathering and Threat Assessment
Another practitioner pointed to FBI training on swatting incidents and noted that callers involved in false reports often struggle to provide specific information about a school or district when asked follow-up questions.
According to the member, callers may provide vague, inconsistent, or nonresponsive answers because the target was selected at random. The practitioner said these observations can help inform the overall assessment of a reported incident, although they are considered alongside other available information rather than in isolation.
Members also emphasized the importance of communication between schools, law enforcement agencies, and dispatch centers during reported incidents.
Changes to Protocols and Coordination
Practitioners said their experiences with swatting incidents have led to adjustments in response protocols and coordination efforts.
One member described working closely with local law enforcement to review procedures and clarify how information would be shared during future incidents. Others referenced ongoing discussions about communications, decision-making processes, and the balance between maintaining safety and minimizing disruption when responding to reports that may ultimately prove false.
DHS: Swatting and False Threats Guidance
Recent guidance from the U.S. Department of Homeland Security provides additional information on swatting prevention, information sharing, and response coordination for schools and law enforcement agencies.
Join the Conversation
NCSSD members regularly participate in roundtables, discussion forums, and practitioner-led conversations on topics ranging from threat assessment and emergency planning to communications, technology, and school security operations.