The School Shootings Were Fake. The Terror Was Real

The inside story of the teenager whose “swatting” calls sent armed police racing into hundreds of schools nationwide—and the private detective who tracked him down.

The football field at Spokane, Washington’s Central Valley High School, one of around 45 schools that a single individual targeted with “swatting” calls over two days in May of 2023.

Sarah Jones was 11 hours and 49 minutes into her 12-hour shift as an emergency dispatcher for the county sheriff in Spokane, Washington, when she received what she would later describe as the worst phone call of her life.

It was a Wednesday morning in May 2023, around 10 o’clock, when the call—from someone who identified himself only as “Wayne”—came in via a publicly listed regional emergency line. “I’m going to walk into Central Valley High School in Veradale with my AK-47,” Wayne told the operator who first picked up. The voice was unnaturally deep, slow, so claustrophobically close to the microphone that its breath seemed to fill the line. “I’m going to kill everyone I see.”

That operator transferred him to Jones (WIRED has changed her name at her request), a 42-year-old, red-headed mother of three. Jones’ office at the Spokane Regional Emergency Center was chronically understaffed, so she’d been working overtime through that night and morning, drinking Dunkin’ Donuts–branded coffee from the office’s Keurig machine amid the usual marathon of domestic violence and reckless driving reports. Jones had spent years taking 911 calls; only that week she’d been promoted to “law dispatch,” a position that included dealing with callers carrying out crimes in progress—“hot calls,” as dispatchers referred to them. This would be her first.

Sarah Jones, the dispatcher at the Spokane Regional Emergency Center, who received the swatting call that targeted Central Valley High School.

Andrea Lombard, Sarah Jones’ supervisor at the time of the call.

When Jones read the message from the operator that accompanied Wayne’s transfer, she realized with a rush of adrenaline that she was speaking to an active school shooter, and that she had seconds to persuade this stranger not to carry out his plan.

“Hi. Wayne? What’s going on?” Jones asked calmly, taming her racing heartbeat.

“It’s too complicated,” the voice drawled, so grotesque that Jones initially thought the sound might be recorded from a horror movie. “All you need to know is that I want cops here as soon as possible. Because after I kill everyone I see, I want to kill cops too.”

“Wayne,” Jones answered, drawing out the name this time and affecting her most sympathetic and motherly tone. “Are you in front of the school right now?”

“Yes, I’m walking in now.”

“OK, can you stop, please?” Jones said, her words accelerating as desperation crept into her voice.

The only answer was a series of rapid staccato blasts: automatic gunfire.

“Shots heard, Andrea! Shots heard!” Jones called out to her supervisor, her voice now cracking with emotion.

Dispatchers at the Spokane Regional Emergency Center in Spokane, Washington.

A few feet away, Jones’ supervisor, Andrea Lombard, watched Jones put down the phone “as if it were on fire,” as she would later describe it. The caller had hung up; the entire conversation had lasted 45 seconds. Lombard (not her real last name) had already sent out an emergency alert to all police in the region—a high-pitched tone followed by her warning that a school shooting was in progress. More than 50 units, sirens blazing, were on their way to Central Valley High School.

As Jones tried to call the shooter back—“Come on, come on, come on, answer,” she pleaded—Lombard looked at a map and saw that, just a block and a half from the high school, there was a children’s day care. She called and reached the day care’s assistant director, who was outside in the yard with a group of 1-year-olds.

In a quick, controlled voice, Lombard explained that there had been shots fired at the nearby high school and they needed to lock down. The assistant director let out a kind of involuntary wail, then shouted “Get inside!” as she moved to scoop up as many babies as she could carry and run with them into the building.

Lombard quickly hung up and tuned in to police radio communications, listening as officers armed with rifles began to enter Central Valley High School. They moved through its hallways, guns drawn, as teachers barricaded doorways and students hid inside locked, dark classrooms, crouching in silence.

This was not Lombard’s first school shooting. In 2017, she had listened to the same radio chatter as Spokane law enforcement entered a different local high school after a 15-year-old boy shot four classmates. The words of the officer who first came upon one young victim, who would die of his wounds that day, still echoed in Lombard’s memory, his voice breaking as he radioed the news to the rest of the officers.

The Central Valley High School flag in Spokane Valley, Washington. At the time the school was targeted, the FBI already knew the identity of the perpetrator but had done little to stop his swatting spree.

Now she sat in the dispatch office next to Jones, listening to the radio, waiting with dread to hear that sound again.

Instead, as dozens of officers moved through the school that May morning, they found—nothing. The school resources officer who had been posted near the school’s entrance radioed to the police line that he’d seen no sign of a shooter entering. Nor had he heard the automatic gunfire that Jones described.

Slowly, Lombard’s dread gave way to anger. Could the call have been a hoax? As she and hundreds of students and teachers sat in silence, still fearing the worst, two questions entered her mind that she would still be asking herself more than a year later.

Who would do something like this? And why?

The chaos, the fear, the dread and immense disruption triggered by that one haunting voice on the phone wasn’t targeted at Spokane alone. The call was one of dozens that a person who went by the online handle Torswats would make to law enforcement, targeting schools across Washington state over a little more than 24 hours.

In some calls, the person told dispatchers he wanted to kill students for Satan. In others, he said it was because he was new to town and people treated him “like shit.” In others still, like the one to Spokane, he seemed to have become bored enough with the game that he didn’t bother to make up a reason. Armed with little more than his monstrous voice, an internet-based calling application routed through an anonymous proxy server, and a recording of gunfire taken from the video game Counter-Strike: Global Offensive, Torswats terrorized half the state, paralyzing schools, weaponizing civilians’ own police forces against them, temporarily shutting down entire communities, again and again and again.

The screenshots of Washington State that Torswats posted to Telegram, crossing off counties as he hit each one in a two-day school-swatting spree.

Torswats crossed off counties on a screenshotted map of Washington as he targeted one school after another, then posted the screenshots in a private Telegram channel between calls. He boasted that he aimed to hit at least one school in every county in the state and tallied the tens of millions of dollars in disruption he hoped to inflict. “It was funny as allf uck. SHOTS HEARD,” he joked at one point, seeming to mock Jones specifically.

“2/3rds done with washington,” he wrote, then bragged about making a bomb threat against the Pentagon. “There’s nothing I can’t do.”

In fact, over the previous year, Torswats had been tormenting schools all over the country. He was the most active player in a loosely linked network of young trolls who made hundreds of “swatting” calls—hoaxes designed to send heavily armed police to a victim’s door—and bomb threats that triggered mass evacuations.

At a Michigan high school, a police officer had responded to one swatter’s call by ramming his cruiser through the school’s locked front doors. In Pittsburgh, Pennsylvania, an officer fired a round from his gun when he was sent into a university following one hoax call. In other swattings, students hid in janitors’ closets, so scared to move that they urinated in mop buckets before armed officers pulled them out, hands above their heads, to frisk them for weapons. One family member in Texas reportedly lacerated his arm trying to break into a locked-down school to rescue a child.

In the midst of that months-long reign of terror, Torswats had distinguished himself as perhaps the most prolific American school swatter in history. And throughout all of it, federal law enforcement was well aware of the chaos Torswats was inflicting. For months, the FBI had possessed everything it needed to unmask him. In fact, the agency already knew Torswats’ real name and address. But it had still done nothing to stop him—a fact that was particularly appalling to the man who had practically handed Torswats’ identity to the FBI: a lone private investigator living outside Seattle named Brad Dennis.

As Torswats carried out his swatting campaign across Washington in May 2023, Dennis watched it all unfold on his computer screen. He saw the maps Torswats shared on Telegram, where he crossed out counties in Dennis’ state as he targeted schools in each one. A pale, bearish, baby-faced 36-year-old, Dennis was chilled to realize that he was personally familiar with some of these schools; he’d been to them for track meets when he was a teenager.

For months leading up to that May swatting offensive, Dennis had been tracing Torswats’ online footprints, tracking down his various social media accounts, meticulously tying those clues to real-world identifying information and sharing the results with law enforcement. Even after he’d given the FBI everything he thought the agency could possibly need to arrest Torswats, Dennis couldn’t stop monitoring the swatter’s every move. Working from a corner of his one-bedroom apartment, lit only by two dim red and blue lamps on either side of his couch, he had become almost a mirror image of his target: as fixated on taking the swatter down as Torswats was on his malevolent hobby. And now he couldn’t help but feel like it was the swatter who was closing in on him.

By May 2023, Torswats had come to occupy nearly all of Dennis’ waking hours. As spring turned to summer, those hours would become nocturnal, as they did every year, when Dennis sought refuge from the anxiety of heat, traffic, and other people. For days at a time, he was so isolated from other human beings that his only real-world companions were the neighborhood squirrels—Jackie, Jesse, Alvin, Doug—that he’d trained to visit his apartment by feeding them peanuts. When he wasn’t at his desk, which he sometimes cordoned off from the rest of his apartment by a blackout curtain, Dennis would speed down highways along the Puget Sound in his Honda Civic late at night to clear his mind.

Visions of Torswats haunted him at every turn. “It was very difficult to live with every day: that he’s out there, and I physically can’t do anything about it,” Dennis says. “I knew how many people he was terrorizing all over the country.”

Yet when Dennis imagined Torswats, whose face he’d never seen, he actually pictured someone else: a hulking young hacker with short, dark hair—an altogether different delinquent who, 15 years earlier, had sent a caravan of police cars full of heavily armed officers to Dennis’ own childhood home, altering the course of his life.

When Dennis was growing up in the Seattle suburbs in the early 1990s, his mother would sometimes bring him to her office, where she worked as a secretary for the county’s emergency services. He liked wandering into the cavernous room where the dispatchers worked, examining the computer systems and radio equipment, sensing both their technical complexity and the life-and-death work that depended on it.

But rather than a dispatcher, Dennis was destined to be a hacker. When he was just 4 years old, his mother installed an alarm on the fridge door to keep him from raiding it for Diet Cokes. Dennis learned that he could remove the alarm’s batteries, then quietly replace them after he’d taken the soda. When he was 6, his mother bought a Hewlett-Packard PC, and Dennis spent the next years compulsively pressing every button and clicking every option in every software menu for hours. By the time he was a preteen, his mother started taking the keyboard away at night, hiding it in her bedroom to limit his computer time. Dennis would silently army-crawl into the dark room to retrieve it without waking her up.

Technology became an escape from the poverty of Dennis’ childhood: His father came in and out of his life through a “revolving door,” he remembers. And at times, he says, his mother seemed unable to provide him emotional support, even as she worried herself sick about his well-being. Growing up in a crime-ridden and drug-plagued suburb of Seattle, several of Dennis’ childhood friends would later struggle with meth and opiates or be killed in narcotics-related murders. “A lot of the people I grew up with ended up hooked on drugs,” Dennis says. “I got hooked on computers.”

By the time he was 11 years old, Dennis was texting with professional cybercriminals on the early chat protocol IRC. When he was 12, he says, he gained access to 400,000 credit cards insecurely stored by a software company. His brother, Bryan, remembers electronics and toys showing up at their house, stuff they could never afford. At one point, Dennis told Bryan, grinning, that he had hacked into the White House communications network and obtained a list of phone numbers. Bryan rolled his eyes. Dennis showed him a phone number and Bryan dialed it. Someone picked up with a brisk “Situation Room.”

In 10th grade, Dennis learned about a vulnerability in Windows that would have allowed him to gain administrator access on school computers and change students’ grades. Showing off the trick at school, a teacher saw over Dennis’ shoulder that he was browsing a forbidden part of the school network. He was fed up with school anyway, and dropped out before he could face any consequences.

Around 2007, when he was 19, Dennis met a hacker named Dshocker on IRC, and the two developed a system for cleverly exploiting stolen and leaked credit card numbers: They’d order something via UPS and send it to the cardholder’s own address to skirt fraud detection. Then a contact Dshocker had at UPS would use his access to the company’s system to reroute the package to one of their own addresses.

It was a lucrative connection. But Dennis was dismayed to discover that Dshocker was also interested in more malevolent forms of hacking. He turned out to be an early practitioner of swatting, sending armed police to anyone who wronged him and even arbitrary targets. The fact that Dshocker knew Dennis’ own home address because of their shipping scheme made him deeply uneasy.

Private investigator Brad Dennis, who was determined to track down Torswats.

Over his years dabbling in blackhat hacking, Dennis says he’d received occasional, unfriendly visits from law enforcement, including at least one from the Secret Service. This time, he says, he approached the FBI with information about Dshocker and helped the agency identify Dshocker’s online accounts. The hacker had made the mistake of logging in to one without masking his home IP address. Dshocker turned out to be Nathan Hanshaw, a 17-year-old in Massachusetts. Hanshaw was charged, pleaded guilty, and was sentenced to 11 months in juvenile detention—but not before sending a team of police with loaded weapons into Dennis’ home.

On that day in 2008, Dennis was in his bedroom when the cops rapped on the door of his family’s double-wide trailer and pulled his confused mother out at gunpoint. Dennis was so immersed in his computer, with his headphones on, that he hadn’t even heard the sirens of the Snohomish County Sheriff’s cruisers tearing down the block of his quiet neighborhood. Only the sound of a man yelling his name from behind his bedroom door yanked Dennis into reality: He opened the door to see a sheriff’s deputy brandishing an AR-15.

Dennis was cuffed and pushed onto the couch in the living room. He tried to explain to the crowd of heavily armed and armored police officers that he had been swatted. That he knew exactly who had placed the false 911 call. That he was, in fact, working with FBI agents investigating a serial swatter named Dshocker. That whatever crime in progress Dshocker had described was a lie. But sitting in his gym shorts with his hands cuffed behind his back, it all seemed futile: Dennis heard the police describe him to each other using the police code for a mentally ill individual. They threatened to arrest him if he didn’t stop talking.

The standoff ended only when Dennis asked an officer to go into his room and find his wallet. Inside it was the business card of an FBI agent with whom he’d been sharing information about Dshocker. The cops called the number, talked to Dennis’ contact, uncuffed him, and drove away, leaving Dennis and his shell-shocked mother in silence.

Dennis’ mother would blame him for that horrific disruption in their lives, his brother would later remember. She saw it as another indirect result of his all-consuming computer obsession.

For Dennis, the swatting incident would leave him “scarred,” anxious, suffering from panic attacks for years. He still believes Hanshaw never knew he was helping the FBI to track him down. So why would Dshocker swat his own hacking partner, traumatizing him and his mother? Dennis would eventually arrive at an explanation that he now sees as the common denominator among serial swatters: “He did it because he could.”

After that swatting, Dennis knew he needed to quit the cybercriminal world. His hacking schemes, too, were growing in scale; he felt that if he didn’t walk away, he’d eventually end up in prison. But it would take Dennis years longer to extricate himself, a process that involved leaving behind essentially all of his friends.

After a series of odd jobs through his twenties, from network administrator to warehouse muscle, he eventually found work as a skip tracer, tracking down missing people, and then as a repo man. Dennis found that these private investigator gigs suited his skills as a hacker—persistently hunting through datasets for the tiniest clue about someone, pivoting from connection to connection until he could locate them and lure them into the open.

His go-to trick for repossessing cars was the classic honeypot: Create a social media profile posing as an attractive young woman, catfish the target into meeting at a restaurant, then seize their car in the parking lot while they waited for their imaginary date inside. Dennis says he learned from those encounters how the prospect of a sufficiently enticing reward—namely, sex—can switch off a target’s rationality. “You temporarily overload their brain with excitement,” he says, “and you can then get them to do things.”

Eventually he transitioned to the lower-stakes field of tracking down the subjects of divorce proceedings and lawsuits to hand them legal papers. But Dennis, an anxious and private person, hated the work of physically confronting often-dangerous deadbeats. Then, in 2020, the pandemic hit. Courts closed. Unhappily married people held off on divorces. His work dried up. He sold his car to give himself time to establish a new line of employment.

One of Dennis’ favorite Twitch streamers at the time was a gaming celebrity who’d been careful never to reveal his location to millions of fans. On a lark, while casting about for another livelihood, Dennis checked to see if he could track the streamer down using his skip-tracing skills and some scant online breadcrumbs. When he succeeded, he decided to approach the Twitch celebrity and offer to help him clean up his digital profile. Dennis says the streamer took him up on the offer and hired him as a security consultant—then began to refer him to other Twitch streamers. By early 2022, he had around half a dozen clients.

As Dennis expanded his Twitch connection into a budding career, he came to realize that swatting, a source of his own trauma, had plagued video game streamers for years. In many cases, Twitch stars had even been swatted in the midst of their livestreams, thrown to the ground by cops and held at gunpoint.

A few months later, one prominent streamer was brutally swatted—pulled out of his home by police with guns drawn while his wife and baby were inside—and reached out to Dennis for help. Within a week, Dennis’ original Twitch streamer client was hit too. The two streamers pooled together a five-figure sum to hire Dennis as their private investigator, asking him to find out who was responsible.

Dennis had never expected to be drawn back into the swatting underworld—one that he had, in fact, spent years working to escape. But he felt he now had a duty to protect his clients. And, he told himself, he had helped the FBI identify a serial swatter before. Maybe he had the right skills to hunt this one too.

“I believed,” he says, “that I was the perfect person to take this guy down.”

Dennis’ detective work began with a post he found on Doxbin—an anarchic, fully unmoderated bulletin board where hackers frequently publish the private information of their victims or rivals to incite harassment. One user, “Ringwraith,” had published a data dump that included an address for Dennis’ first Twitch client, along with the address and phone number of the streamer’s 75-year-old father.

“I am not responsible for what happens with this info,” Ringwraith added with mock innocence. In other posts to Doxbin, the same account had broadcast the home addresses of other targets and suggested that users enlist “prank call” services available on the messaging platform Telegram to troll them.

Dennis began scouring Telegram and quickly found one such “prank call” service with the name Nazgul’s Swats. He knew his Lord of the Rings references well enough to understand that the Nazgûl, in Tolkien’s world, are synonymous with Ringwraiths: ghostly, lethal figures that hunt the saga’s heroes from the shadowy realm they inhabit. Were Ringwraith and Nazgul in fact the same person?

Nazgul’s Swats, whose profile photo on Telegram showed a black-hooded skull mask, seemed to be openly advertising a swatting-for-hire service. The account priced its calls at $150 per swat or bomb threat, or $100 for hoax gas leaks or fires, to be paid for with the tracing-resistant cryptocurrency Monero. “All swats will be done ASAP,” Nazgul wrote. “Prices will be negotiated if it’s a major target like a semi-famous streamer or a government building.”

As he watched Nazgul’s Telegram account over the summer of 2022, Dennis was dismayed to see that the swatting service appeared to be shifting its focus from Twitch streamers to a more disturbing target: schools. In August of that year, the account posted a “Back-to-School Sale,” with a special rate of just $50 in Monero for school swattings. “Do you want an extra day of summer break?” the post read. “I will shut down a school for the entire day!”

Not long after, on Telegram, Nazgul began posting audio recordings of school swatting calls. In one, targeting a high school near Toronto, the swatter claimed to be a supporter of QAnon, intent on destroying the school with explosives because of the “pedophile transgender” teachers there. In another, the swatter told an emergency hotline they were transgender and had been mocked by their fellow students at their high school in Washington state, and had taken their father’s glock.

“I’m in the bathroom now, and I’m ready to take out the people who bullied me,” the swatter told the dispatcher through a robotic, synthesized voice generated by a Google text-to-speech program. “The transphobes will die.”

Two days later, Nazgul called again, this time telling dispatchers the earlier call had been a hoax meant to throw off the response to the actual school shooting now planned at the same high school that day. “It is too late for you to stop me. I have an illegally modified, fully auto AR-15 and glock with level-four body armor, and I’m right outside the school gates ready to shoot up your faggot-infested school,” the caller said. He claimed that he had planted pipe bombs under administrators’ cars and in classrooms that would detonate minutes after school started. “Afterwards I will walk in and shoot everyone I see. Goodbye.”

Woods close to Dennis’ home in a neighborhood near Seattle, during the nighttime hours he keeps every summer.

The school swatting calls that Nazgul was posting to Telegram were only part of a growing wave hitting schools across the US in the fall of 2022, including more than a dozen hoax calls each in Minnesota, Louisiana, and Virginia. By November, the attacks had swelled to more than a hundred, hitting New Jersey, Florida, California, South Carolina, South Dakota, and Connecticut, seemingly at random. Dennis read news reports in which law enforcement officials blamed the calls on a group of Ethiopians. But he suspected that many of the swattings seemed to be the work of Nazgul alone.

Dennis reached out to an FBI field office in San Antonio, the closest location to one of his Twitch clients, in an attempt to persuade the bureau to investigate Nazgul. Identifying himself as a licensed private investigator, he described what he’d found in a breathless, point-by-point, 897-word email, laying out the evidence of how dangerous this particular swatter was becoming—and throwing in a few initial theories of the swatter’s real-world identity that, he now admits, were all off base.

The San Antonio FBI eventually responded: It had no open case into Nazgul’s Swats, didn’t intend to create one, and didn’t even offer Dennis a point of contact for any future findings, he says. “They gave me nothing at all,” Dennis says. “Nothing.”

Dennis was incensed. As he read news reports of the hoax calls sending schools into lockdown, terrorizing parents and children across the country, he began to feel like he was shouldering the full weight of the investigation. As long as Nazgul was free, it seemed, he would keep targeting more innocent victims. “From the moment he woke up till the moment he went to sleep, he was swatting people,” Dennis says. “And I was going to do whatever it took to catch him.”

Ed Dorroh, a bearded and slightly grizzled detective with the Los Angeles Police Department, was out for dinner with his wife at a romantic wine bar in his hometown of Lancaster, California, when he got a text from a number he didn’t recognize. The sender identified himself as a private investigator, a stranger who wanted Dorroh’s help pursuing what he described as one of the worst serial swatters in history.

Dorroh had famously taken down a notorious swatter named Tyler Barriss, who placed a 2017 hoax call that resulted in the fatal police shooting of a man in Wichita, Kansas. Dennis knew Dorroh would understand the gravity of his case. Dorroh, for his part, did a quick background check from his phone to make sure Dennis was a legitimate PI, to the annoyance of his wife across the table.

The next day he called Dennis, who immediately began to share a deluge of information that conveyed his obsession with Nazgul and his frustration with the FBI’s inaction. Dorroh knew the feeling: He’d often found it difficult to impress the seriousness of swatting cases on his fellow law enforcement agents. He’d once tracked a swatter to the UK who had threatened to have Dorroh’s own family killed, then sent his findings on the suspect to a British agent—only to wait six months for the investigator to even look at the case. Dorroh agreed to help.

A week or two later, Dorroh searched through a law enforcement database with Dennis on the phone and found that the FBI’s Bellingham, Washington, field office did have an open case on Nazgul’s Swats. He connected Dennis with a responsive agent there named Rachel Bennett (not her real name). Dennis was mystified that the San Antonio office hadn’t told him about the investigation. But from talking to Bennett, it seemed to Dennis that the FBI still had virtually nothing on Nazgul. (The FBI asked WIRED to anonymize the names of its case agents, out of concern that they could be swatted in retaliation.)

As he badgered the FBI, Dennis began the long, patient process of insinuating himself into Nazgul’s inner circle—a familiar practice from his years of hunting car-payment debtors and vanished spouses. He created the persona of an aggrieved ex-husband obsessed with revenge following his divorce. Under the guise of that potential customer, he began sending initial messages to Nazgul’s Telegram account, telling him he might need his help at some point and would be willing to pay.

While Dennis searched for any revealing slip-up Nazgul might make, he would emerge into the light of the real world only to eat and caffeinate or to feed the squirrels that visited his apartment. At one point in his hunting, Dennis began to believe that Nazgul might belong to a certain “guild” in the online game World of Warcraft. Dennis became so determined to gain entry to that elite gaming group that he paid more than $1,000 to buy a leveled-up warlock character in the game, asked one of his gaming streamer clients to help him train, and spent more than 80 hours playing WoW to build credibility.

But by the winter holidays of 2022, none of this months-long undercover work had borne fruit. Dennis knew he needed to change tactics.

At some point, Dennis had read about an encrypted texting program called Tox. Although many hackers liked the service’s security features, its peer-to-peer architecture meant that it could leak users’ IP addresses to whichever contact they were chatting with, the equivalent of a phone call that revealed the address of the caller’s home. Perhaps this combination of apparent security and actual vulnerability offered exactly the trap Dennis needed.

On the night of New Year’s Eve, Dennis opened Wireshark, a program for intercepting and deconstructing network communications. Then he messaged Nazgul on Telegram using his aggrieved ex-husband persona.

“Yo, got some bidness to talk to you about,” he typed to the swatter at 9:19 pm. This was the bait he’d lured in front of Nazgul for months, suggesting that he was going to pay grandly for some climactic act of swatting vengeance targeting his ex-wife. “You wanna make some real cash. Add me on Tox.”

Dennis hit Return. Thinking back to the honeypot stings that had worked so well in his days as a repo man, he hoped the promise of a big payday would short-circuit his target’s defense instincts. To help ward off any doubts, Dennis went to Wikipedia and carefully deleted a paragraph mentioning the IP-leaking bug from the page for the Tox protocol. Then he waited.

Less than an hour later, a notification popped up on his screen: A user named “Paimon Arnum” wanted to chat on Tox. The username was unfamiliar to Dennis. But he knew who it must be. As he accepted the chat invitation, Wireshark began capturing dozens of network requests. All of them came from a single IP address.

Dennis had his breakthrough. A fresh pseudonym tied to Nazgul’s Swats and what he believed was an actual IP address might be revelatory new threads for him and the FBI to pull on.

Not long after, Nazgul’s Swats added yet another moniker to the mix, inexplicably changing his Telegram username. Dennis didn’t know whether this additional handle was a reference to the anonymity software Tor—which the swatter didn’t appear to use—or to a Norwegian spelling of the Norse thunder god Thor. But from then on, Nazgul would go by a new name: Torswats.

In late January 2023, Brad Dennis watched through his Ring camera as two FBI agents stepped onto his doormat that read “COME BACK WITH A WARRANT” and rang his doorbell. He opened the door, which was affixed with a sticker that read “BEWARE OF DOG,” though Dennis had never owned one.

Dennis and the two visitors, FBI special agents Rachel Bennett and Lucas Phillips (also not his real name), sat down around a beat-up coffee table. On it was a large, tattered copy of the 9/11 Commission Report, Dennis’ only coffee-table book. The only decoration on the walls was an American flag hung behind a desk chair. Nearly a month after the holidays, a fake Christmas tree with a single ornament in the shape of a pickle stood in a corner of the room. Resting against it were two printed photos of Dennis’ favorite squirrels, Jesse and Alvin, gifts from his mother.

Alvin, one of several squirrels that Dennis befriended and trained to come onto his apartment patio.

Photograph: Courtesy of Brad Dennis

Dennis with another of his squirrel companions, Jesse.

Photograph: Courtesy of Brad Dennis

Dennis did almost all of the talking, briefing the two FBI agents on his months of detective work. In fact, he couldn’t stop talking: He had just drunk a Red Bull and was far too caffeinated. At one point Phillips noticed World of Warcraft on Dennis’ computer screen and commented that he played the game too. Throughout the meeting, some of Dennis’ squirrels hung out on the patio, munching on unsalted peanuts.

When the two agents left Dennis’ apartment 45 minutes later, they carried with them a USB drive that contained the network data Dennis had captured with Wireshark, documenting the IP address leaked in his Tox chat conversation with Nazgul.

Dennis sensed that the Paimon Arnum handle—a possible reference to one of the kings of hell in demonological texts—was also a powerful data point. The FBI hadn’t known about the new name until he shared it with them. When Dennis had searched for Paimon Arnum, he found a YouTube account with the same username. Checking an archived copy of the account, he found that it had once been named Ringwraith and had used a similar Nazgul picture as its profile image. Even if the IP address he’d shared with the FBI was some sort of proxy that Torswats had used to cover his tracks, he thought perhaps a subpoena to Google could reveal this account’s subscriber information. More than ever before, Dennis felt real hope they had solid leads on their target.

As Dennis’ frustration with the FBI’s inaction grew, he would take nighttime walks on the trail behind his apartment, sometimes in pitch-black so complete that he couldn’t see his hand in front of his face.

In the weeks that followed, Dennis and Agent Phillips would text and email each other updates. But as the weeks went on, Dennis started to get impatient. He called Phillips to ask about the subpoenas to Google and other services Torswats had used.

As Dennis recalls it, Phillips told him that the results still hadn’t come back. Dennis asked how it could be taking so long: Hadn’t Phillips filed emergency requests? Google and other major tech firms typically responded to those in a day or less. According to Dennis, Phillips said that he had filed the requests as normal subpoenas, explaining that was the bureau’s policy, and this wasn’t necessarily an emergency case.

Dennis blew up. You motherfucker, he remembers thinking. For months he had been watching TikTok videos of school swattings, torturing himself with clips that students had recorded and posted of themselves hiding in school bathrooms and jumping over fences to escape from imagined shooters. “He’s literally sending out police officers to people’s houses and into schools with their guns drawn,” he says he told Phillips. “How is this not an emergency?”

Not long after, Phillips told Dennis that he had sent the emergency requests. The FBI agent soon began to share hints of the results with Dennis. Sure enough, the bureau now had an IP address for the Google account, one that located the user at a residential internet connection in California.

It seemed the FBI now knew Torswats’ name and address, though Phillips wouldn’t share those details with Dennis. It was only a matter of time, Dennis now felt, until the target of his hunt was behind bars.

In the meantime, Phillips had asked for Dennis’ help in locating and then infiltrating a channel on the chat service Discord that Torswats visited. The group, an offshoot of a larger movement that called itself 764, turned out to be one of the most disturbing and abhorrent corners of the internet, catering to its most callous trolls and sadists. Its members, from what Dennis could tell, seemed to be constantly working to outdo one another with racist memes, child sexual abuse images, animal cruelty clips, and sextortion videos in which members of the group blackmailed children into humiliating or harming themselves, sometimes with razor blades or nooses shipped in the mail to their victims.

Dennis says he saw things in the channel that he wishes he could remove from his memory, that make him physically sick to recall, including one image of child sexual abuse that has horrifically and unpredictably flashed into his mind every day since. “I didn’t even know this kind of evil existed,” he says.

Dennis stumbled into darker and darker layers of the internet as he stalked Torswats, all the while waiting for updates from the FBI on when exactly the swatter would be arrested or have his computers seized. At one point Phillips told Dennis that the FBI wanted to be “extra careful.” But Dennis was beginning to lose his patience and his trust that the bureau was taking the case seriously.

“I can’t believe he’s just walking around free. Even tho we know who he is. Please for the love of god just take him down already FBI,” Dennis wrote to a WIRED reporter on May 6, 2023. “They have enough for the warrant. Good. Write it. Execute it. Done. Every day they wait is more kids being hurt.”

Five days later, on the morning of May 11, Tanner Zahrt, the principal of Port Angeles High School, on Washington’s Olympic Peninsula, heard the scream of sirens approaching. Moments later, an assistant principal came into Zahrt’s office and told him that the police had just called: An active shooter was on the school grounds.

Zahrt scrambled across the hall to the room where the school’s intercom was set up. He spoke into the microphone, trying to broadcast a message telling the school to lock down. Silence. The intercom system wasn’t working. As fast as they could, he and the assistant principal assembled the school’s administrators and asked for volunteers to run to the school’s 13 buildings—a uniquely sprawling, tough-to-secure outdoor campus—and deliver the lockdown warning. Zahrt knew he was asking these volunteers to risk their lives. But he felt he had no other option: Every second might mean more students’ lives lost.

When the volunteers dispersed, Zahrt ran back to the intercom. After several minutes, he got it to sputter to life. “There’s a threat on campus. We’re going into lockdown, this is not a drill,” Zahrt said into the microphone, trying to keep his voice calm. “Lockdown, lockdown, lockdown.”

Police officers soon arrived in Zahrt’s office and played the recording of the 911 call that had brought them: The same deep, languid voice that police dispatchers would hear in a dozen or more counties by the end of that day. Torswats had, by this point, stopped using the text-to-speech software for his swattings; he had discovered his own ghostly and unnerving voice was far more effective and credible. Each call was a variation on the same theme: “I’m going into the school with an AK-47”—or an AR-15, or a glock, or pipe bombs—“and I’m going to kill everyone I see.”

The recording Zahrt heard ended with the sound of a school bell. He immediately recognized that it was the wrong one. “That’s not our school bell,” he thought. But even as he began to suspect a hoax, the officers warned him that it wouldn’t yet be safe to give the all-clear.

Instead, for the next 50 minutes, teachers barricaded their classrooms as students hid in “hard corners,” out of any potential shooter’s sight lines, while police carrying automatic rifles scoured the school, classroom by classroom. Some students, jaded from false alarms and drills, joked and texted with friends. Others hid in silence. Some, says Zahrt, had panic attacks.

By this point, Torswats had moved into the second day of his blitz against the state of Washington, a target area he’d seemingly chosen at random. It was the culmination of a spree that had begun 24 hours earlier with the eastern part of the state—including the “shots heard!” call to Spokane.

For Sarah Jones, the trauma of that call lingered well beyond the hour it had taken for police to officially declare a false alarm. When her shift was finally over, Jones had burst into tears in the arms of her supervisor. On her drive home, she couldn’t stop crying. That weekend she went on a run to try to exorcize the sound of Torswats’ horrifying voice. But she says she can still hear it, even now, a year and a half later. She says she’ll remember the call “for the rest of my career.”

All told, Torswats hit as many as 45 schools in Washington state—then moved on to new targets. As he did, his hoaxes grew more florid in their descriptions and graphic in the horror of the threats he was inventing.

“I just finished reading the devil’s Koran,” he told one dispatcher as he explained why he was about to commit a mass shooting at a mosque in Florida with an “illegally modified, fully auto AR-15” as well as a glock and Molotov cocktails. “It is a false mosque that prays to the demi-urge Saturn,” he added, before hitting his usual last note that he was about to “kill everyone I see.”

A radio tower at the Spokane Regional Emergency Center.

“I took DMT this morning. And I saw Satan,” Torswats told another young woman a few days later after she picked up the phone at Prairie View A&M University in Texas, one in a series of historically black colleges and universities that he had added to his target list. “And he came to me in the form of a serpent. And he told me to put explosives—he told me to put the fragmentation pipe bombs I had made for him inside of stuffed animals that resemble snakes, and he told me to put them in the ceilings and in the trash cans around campus. There are about two dozen total.”

In the midst of another call that spring, this time with a high school resource officer in Maryland, the officer interrupted Torswats in the middle of a bomb threat and told him he would find his IP address and make sure he was criminally charged.

In response, Torswats paused, seeming to break character and stifle ecstatic laughter.

“I am never going to be caught,” he said finally, his voice swelling as if he were almost moved to tears. “I am invincible.”

Dennis’ work was over. He had, he felt, given the FBI what it needed to close the case. Yet he was still watching Torswats post evidence of his ongoing, near-daily swattings to Telegram. The mental dissonance had become almost unbearable.

As the waiting wore on into summer, he began his annual transition to nocturnal life. He went for walks on the trail behind his apartment, sometimes in pitch-black so complete that he couldn’t see his hand in front of his face. On his nighttime drives, he says he’d sometimes reach speeds of 145 miles per hour, so fast that other cars on the highway seemed to be standing still.

All the while, Torswats was still escalating. By July, he’d begun to write on Telegram about something he called “the Grand Offensive”: He posted an incoherent chart of his planned targets, including 25 senators, the FBI, the Pentagon, and the board of directors of the asset management firm BlackRock. “One Swatter to Rule Them All,” his chart read in one corner. He followed up that graphic with a rambling, racist, antisemitic manifesto written as an ironic ode to US law enforcement. “They are the guardians of our luciferian light, the defenders of justice, and the pillars of our society,” it read. “God bless America’s sword of domestic combat to preserve its judeogovernance.”

Around 10 am one morning in July, Dennis was coming out of the drive-through at Taco Time, one of few restaurants in the area that would serve him dinner food at a normal person’s breakfast time. His phone rang. It was Phillips. Dennis took the call on speakerphone without pulling over.

An FBI team, Phillips told him, had just executed a search warrant at Torswats’ home in Lancaster, California—by coincidence the very same town that had been home to the veteran LA detective Ed Dorroh, Dennis’ first fruitful contact in law enforcement. The agents had given their suspect the full SWAT treatment, Phillips told Dennis: A Bearcat armored vehicle had torn the door off its hinges. Agents had used flash-bang grenades to surprise and stun everyone inside the home before searching it and seizing Torswats’ PC.

The computer was encrypted, Phillips told Dennis, and might be useless for obtaining evidence. But Dennis was nonetheless thrilled that the same militarized police apparatus that Torswats had weaponized for a year had finally hit him back with karmic retribution.

Phillips was there at the raid, he told Dennis. Torswats had turned out to be a teenager, he said, and Phillips had heard his voice: The slow, deep, almost sedated drawl that had become all too familiar to both of them. There was no mistaking that they had found him—though after searching the house and seizing his computers, they still didn’t arrest him.

At the end of the nearly 40-minute conversation, Dennis says, Phillips informed him that the Department of Justice planned to shop the case around the country to find a district willing to charge the suspect as a minor—possibly in Texas, Oklahoma, or Florida.

Dennis arrived home, sat down at his desk, ate his chicken burrito, and texted one of the Twitch streamers who had first hired him to hunt Torswats. “Search warrant was executed this morning,” he wrote. “Mission accomplished.”

“LOL. Fuck Em. What a relief,” the client wrote back.

“Serves him right, little shit,” Dennis responded.

He finished the burrito. At 1 pm, he finally went to bed, happy and fulfilled for the first time since he’d taken the case more than a year earlier.

Except Torswats was still free—and somehow, still online.

“My current plan is that I will be temporarily retiring for several weeks,” he wrote, just a few days after the raid, on a new account titled The Actual Fourth Reich of Torswats, adding that he would probably start offering his services on a dark-web marketplace in the winter of that year. Then he seemed to disappear for months.

Within a few weeks, Dennis’ sense of victory had passed. By closing the case, he had put himself out of a job and was now underemployed and despondent. The fact that Torswats still hadn’t been arrested, jailed, or charged—that Dennis still didn’t even know his real name—made his triumph feel all the more illusory.

At loose ends, Dennis began spending nights in his Civic, patrolling the streets of Seattle’s worst neighborhoods. He spent hours staring out of its tinted windows at homeless people and sex workers, trying to match their faces with missing persons photos from human trafficking cases, looking for any outlet for his detective skills that might give him a mission—a reason to continue.

Dennis in his Honda Civic. In the months since the Torswats case, he often patrols Seattle’s worst neighborhood in the car at night, searching for missing people.

Then, in November 2023, ahead of schedule, Torswats came out of retirement. In a new swatting call, the same deep voice affected a dopey, confessional air and warned dispatchers that a friend was planning a mass shooting that day at North Beach Junior/Senior High School in western Washington. “He showed me them. He showed me the pipe bombs,” the voice intoned, adopting the usual themes as if there’d been no break in his now multiyear swatting campaign. “Afterwards he’s going to come in with his AR-15 and kill everyone.”

Torswats then targeted a former federal law enforcement agent and swatting expert—a man named Keven Hendricks who had recently been featured in an Economist interview about the relentless surge of swatting attacks. Torswats sent police to Hendricks’ home and left a voicemail for Hendricks himself. “Hello. I just swatted you and your parents,” he said. “That’s what you deserve for being a filthy fed.” He posted a photo of Hendricks on his public Telegram channel, his eyes blacked out and his address scrawled across the image.

On Telegram, Dennis could see that Torswats had reemerged. But the private eye had run out of outrage. He felt numb. He could no longer muster the energy to track Torswats’ online boasting, to even feel angry at the FBI that it was allowing the swattings to continue. He was done.

Torswats, meanwhile, seemed to still believe he was untouchable. In December, he posted what he called The List, a kind of illustrated catalog of swatting targets—along with pictures of their homes and addresses. It included political leaders such as US senator Chuck Schumer, Chicago mayor Lori Lightfoot, and several judges, public health officials including Anthony Fauci, leaders of civil rights and anti-hate groups, and tech CEOs like Tim Cook and Evan Spiegel.

Then, between Christmas Eve and New Year’s, came a new deluge of swattings. They hit close to a hundred politicians and law enforcement officials in a brazen, coordinated campaign: US Homeland Security secretary Alejandro Mayorkas, Cybersecurity and Infrastructure Security Agency director Jen Easterly, Republican representative Marjorie Taylor Greene of Georgia, and Republican senator Rick Scott of Florida. One of the hoax calls, court documents would later state, caused a car accident that resulted in serious injuries.

But this time, the voice on the calls wasn’t Torswats. Instead, according to US prosecutors, he orchestrated the operation, providing the names, addresses, and phone numbers of the targets to a 21-year-old and a 26-year-old from Serbia and Romania who allegedly organized and carried out the swatting scheme with lines Torswats fed to them.

It was a familiar script. “I shot my wife in the head with my AR-15,” a man identifying himself as “James” said in one such call, targeting the home of Georgia state senator John Albers. He told dispatchers that he had caught his wife sleeping with another man and, after killing her, had taken the man hostage. “I’ll release him for $10,000 in cash,” he added, threatening to detonate pipe bombs and blow up the house if his demands weren’t met.

Finally, Phillips called Dennis and told him that the FBI had a plan to arrest Torswats. And they needed Dennis’ help.

According to the plan, the bureau would ask its teen suspect’s father to come in to a local police station to retrieve the computers they’d seized. While the father was there, Phillips explained, Dennis should use his old aggrieved ex-husband persona and start another Telegram conversation with Torswats about swatting his ex-wife. Then he should stall for as long as possible to keep Torswats at his computer, logged in to his accounts—so police could burst in and arrest him. Dennis, despite being sick with Covid, agreed.

Instead, to his and the FBI’s surprise, Torswats accompanied his father to the police station to pick up his devices. The cops quietly arrested him on the spot. As his nemesis was finally taken into custody, Dennis was too ill to celebrate.

The FBI and Justice Department both declined WIRED’s request for comment, which included questions about why the FBI had taken so many months after learning Torswats’ name—even after searching his house—to arrest him.

Nearly two years into his investigation, Dennis finally learned the teen’s name: Alan Filion. He saw photos of Filion for the first time and mentally replaced the image of Dshocker’s face with that of the actual alleged swatter teen he’d been hunting. Like Dshocker, Filion was big. He had long, lank brown hair. In photos, he wore a wide-eyed, innocent expression.

At the time of his arrest, Filion was 17 years old. When Dennis’ case had begun, Filion had been only 15.

Alan Filion’s booking photo

Courtesy of the Seminole County Sheriff’s Office

Filion fits the profile of plenty of online delinquents. He, like Dennis, appeared to have grown up online, finding community in niche forums more than the physical world. His high school years were defined by the isolation of pandemic lockdowns. According to Lancaster’s Antelope Valley community college, Filion started pursuing a degree in mathematics in the fall of 2022 after graduating from high school early. But a professor at Antelope Valley could hardly remember him at all. One person who knew him says he was quiet and “forgettable,” with few friends.

A person claiming to be Filion’s friend alleges he was part of a group aiming to incite racial violence and that he sought money to “buy weapons and commit a mass shooting.” An anonymous tip, submitted to the FBI’s Internet Crime Complaint Center and obtained by WIRED, alleged that the individual behind the Torswats account was involved in a neo-Nazi cult known as the Order of Nine Angles. The tipster claimed he believed Torswats’ actions were contributing to the “end of days” by “bleeding the finances and man-hours of the system.”

In a May interview with WIRED, Torswats admitted that he made his hoax calls partly for fame and partly for political reasons. “It’s taking money that would normally be used for welfare checks to Jews and to bankers and to oligarchs,” he said in his drawl, “and it’s being spent on searching schools.”

Dennis, for his part, has settled on a simpler theory to explain Torswats’ behavior—and the entire scourge of swatting as a means to blindly terrorize strangers. He defaults to the same principle he used to explain why Dshocker swatted him nearly two decades earlier.

“Power,” Dennis says. “Because they can.”

In November, just weeks after his 18th birthday, Filion pleaded guilty to charges stemming from his nationwide spree of swatting calls. He faces up to 20 years in prison for four counts of making interstate threats to injure another person. As of mid-December, the teenager is awaiting sentencing in a Seminole County, Florida, jail cell.

Dennis remains in a different form of purgatory. On a recent night, when a WIRED reporter visited him, he went through his usual routine: he ate breakfast, checked his email for leads on work, played the video game Rocket League, and idled aimlessly around his apartment. Throughout the evening, he carried a loaded glock in a holster, a round in the chamber, no safety. He drinks Red Bulls every two hours, exactly, now timed with alarms on his phone, to space out his caffeine intake. He no longer gets visits from the squirrels. He can’t be sure, but he believes that his favorites—Jackie, Jesse, Alvin, Doug—have died of old age or been killed by other animals. Dennis doesn’t have it in him to befriend new ones.

On one of his nighttime drives through Seattle’s skid rows, he recently spotted an 11-year-old girl near a Krispy Kreme. He recognized her from a poster of missing and exploited children. She approached his car thinking he might be a customer; he then helped local police to find her and reconnect her with a foster family. He’s proud of that, just as he’s proud of having cracked the Torswats case. But he has received little recognition for either, from police agencies or the FBI. His paid work as a private eye has largely evaporated. To stay afloat, he has sold off possessions—including the very computer he used to find Torswats—and for a time took up driving for Uber Eats. “It’s been the worst year I’ve had in a long time,” he says.

In the meantime, Dennis has watched in dismay as swattings—and school swattings in particular—have continued to spread across the US. There’s been no new Torswats, no single, prominent villain who single-handedly represents the threat. But nor has there been a shortage of new nihilist trolls willing to pick up where Torswats left off.

Dennis has no faith any of that will change. The US remains a country awash in guns, where the prospect of a mass shooting has become a pervasive, looming menace. And American police remain a hair-trigger, militarized force ready to be exploited by anyone with modest technical skills and a convincing voice.

If Dennis is hopeful about anything, it’s that another high-profile case will come his way, one that will give him the same sense of purpose he felt during the Torswats investigation. As he drives around in the dark, he seems to hope that another monster will appear for him to hunt—that it might offer him a chance to repair his career and some part of the world.

“Things will happen that will change the course of your life,” he says from the driver’s seat of his Honda as he peers out of the windshield at the North Seattle streets. “Things will reveal themselves.”

Let us know what you think about this article. Submit a letter to the editor at [email protected].