School Swatting Threats: Assess First, Respond Strategically

School Swatting Prevention, Threat Assessment, Emergency Response, and Crisis Communications

On this page

1. What is school swatting?
2. Why hoaxes are dangerous
3. Assess and then react
4. Three essentials of preparedness
5. Six response steps
6. Swatting indicators
7. Federal guidance and research
8. Legal issues
9. Questions for school leaders
10. FAQ
11. Resources
12. Final thoughts

School swatting threats are a serious and increasingly disruptive challenge for K–12 school administrators, law enforcement, students, parents, and communities across the United States.

A fabricated report of an active shooter, bomb threat, hostage situation, or other violent emergency can trigger an immediate police response, school lockdown, evacuation, frightened students, anxious parents, and widespread social media rumors. Even when a reported threat turns out to be a hoax, the consequences are very real.

National School Safety and Security Services has researched and monitored school threats, including swatting incidents, since 2014. Our research, school safety assessments, consulting, training, and media commentary have consistently emphasized the importance of thoughtful threat assessment, coordinated emergency response, and effective crisis communications.

Our foundational recommendation to school leaders is simple: Assess and then react. Don’t react and then assess.

This does not mean delaying immediate protective actions when a threat may be imminent. School officials must take threats seriously and implement appropriate emergency measures when circumstances warrant.

It means schools should have trained people, established procedures, and coordinated decision-making processes that allow them to rapidly evaluate a threat, protect students and staff, and avoid unnecessarily disruptive or potentially dangerous responses driven by speculation, misinformation, or public pressure.

Swatting is not simply a law enforcement problem. It is also a school threat assessment, emergency preparedness, strategic leadership, and crisis communications challenge.

What Is School Swatting?

School swatting is the intentional reporting of a fabricated emergency involving a school, generally designed to trigger a significant law enforcement or emergency services response.

Swatting incidents may involve false reports of:

• An active shooter or shooting in progress
• A bomb or explosive device inside a school
• An armed person threatening students or employees
• Students or school personnel being held hostage
• A violent assault or mass casualty incident underway

Perpetrators may use telephone number spoofing, Voice over Internet Protocol (VoIP) systems, social media, anonymous messaging platforms, or other technologies to conceal their identities or locations.

Some incidents target individual schools. Others involve coordinated threats directed at multiple schools, sometimes across different states or countries.

The term swatting originated from incidents designed to provoke responses by Special Weapons and Tactics (SWAT) teams. Today, it is used more broadly to describe malicious false emergency reports intended to provoke significant police or emergency services responses.

Not every anonymous school threat is swatting. Not every threat ultimately determined to be unsubstantiated was intentionally fabricated. School and law enforcement officials should evaluate the available evidence before reaching those conclusions.

The FBI’s August 4, 2026, swatting advisory identifies educational institutions among the targets of these incidents and describes their operational disruptions, psychological consequences, and public safety dangers.

Why Are School Swatting Threats Dangerous Even When They Are Hoaxes?

A false report can produce a very real emergency response.

Swatting incidents can result in:

• Armed police responding to a school where no actual attacker is present
• Students and staff experiencing fear, panic, or emotional distress
• Lockdowns, evacuations, school closures, and lost instructional time
• Parents rushing toward schools or attempting to pick up their children
• Traffic congestion that interferes with emergency responders
• Social media rumors and misinformation spreading throughout the community
• Police, fire, and emergency medical resources being diverted from legitimate emergencies
• Financial costs associated with investigations and response operations
• Erosion of public confidence in school safety leadership

There are also potential dangers associated with the emergency response itself. A police response to a reported active shooter may involve heavily armed officers, rapid tactical decisions, and significant confusion among students, employees, and responders. Swatting should never be dismissed as a harmless prank.

Repeated swatting incidents create another concern: complacency. When several threats turn out to be hoaxes, school employees, students, parents, or public safety personnel may begin assuming future reports will also be false.

A history of swatting hoaxes does not establish that the next reported threat will be a hoax.

School leaders must avoid two dangerous extremes: becoming desensitized to repeated false reports and automatically implementing the most disruptive emergency measures in response to every unverified threat.

Both underreaction and overreaction can create safety risks.

Assess and Then React: The Foundation of School Swatting Response

For decades, National School Safety and Security Services has encouraged school administrators to make cognitive, analytical, evidence-informed decisions rather than purely emotional or reactionary decisions when managing school threats.

The principle is straightforward: Assess and then react. Don’t react and then assess.

School administrators face understandable pressure to act immediately when a threat is reported: Parents may demand that schools close. Social media may spread unverified claims of an active shooter. News media may begin asking questions before administrators have established basic facts.

These pressures can push school leaders toward immediate, highly visible actions that may or may not be appropriate to the actual circumstances. Automatically closing, evacuating, or locking down schools in response to every anonymous threat is not necessarily the safest response.

At the same time, school leaders should never delay protective action when credible information or observable circumstances indicate an immediate danger to life.

Rapid Assessment and Immediate Protection Must Work Together

Assessing a threat does not mean waiting for law enforcement to complete its investigation before protecting students and staff. When circumstances indicate an imminent threat, established emergency procedures and appropriate protective measures should be implemented immediately.

When a report is uncorroborated, school administrators and law enforcement should rapidly evaluate the available information while implementing proportionate security precautions and remaining prepared to escalate their response.

A coordinated initial assessment should consider:

• What exactly was reported or threatened?
• How and when was the information received?
• Is there independent corroboration of the alleged emergency?
• Have school employees or others observed weapons, violence, injuries, or suspicious activity?
• What is known about the source, specificity, and credibility of the communication?
• Does the report resemble known swatting patterns or threats directed at other schools?
• What information can emergency dispatchers, school resource officers, or responding police provide?
• What protective measures are appropriate while the investigation continues?
• What circumstances would require escalating, modifying, or ending those protective measures?

Threat assessment should be an organized process involving trained people, not an improvised judgment made by a single administrator under intense pressure.

Schools need to recognize that the absence of corroboration is not proof that a threat is false. Assessment must remain ongoing as information develops.

The objective is neither to minimize threats nor to create unnecessary disruption. It is to take appropriate action based on the best available information while continuing to reassess the situation.

Effective school safety leadership requires the ability to make timely, thoughtful, coordinated, and defensible decisions under uncertainty.

For more guidance, see our School Threat Assessment: School Threats, Social Media, Texting and Rumors resource and our Strategic School Safety Leadership Guide.

Three Essential Elements of School Swatting Preparedness

Every K–12 school district should have three core capabilities in place before a swatting incident occurs:

1. Threat assessment teams, protocols, and training to evaluate threats systematically and coordinate with law enforcement.
2. Steps to enhance school security while an investigation is underway without automatically imposing unnecessary or disproportionate measures.
3. Crisis communications strategies to address rumors, misinformation, parent concerns, and community anxiety.

These three elements should function together as part of the school’s broader emergency operations and strategic school safety leadership framework.

1. Threat Assessment Teams, Protocols, and Training

Schools should have established multidisciplinary threat assessment capabilities and procedures for promptly evaluating and managing threatening communications. Threat assessment teams should not exist solely as names on an organizational chart or as a compliance checkbox.

Members need clearly assigned responsibilities, appropriate training, access to relevant information, and procedures for rapidly coordinating with school administrators and public safety partners.

Depending on state law and local organizational arrangements, teams may include school administrators, safety and security personnel, student support and mental health professionals, and law enforcement representatives.

Schools should also establish relationships and communications protocols with emergency dispatch centers, school resource officers, responding police agencies, and other appropriate public safety partners.

For swatting incidents, the process should address receiving and documenting threats, determining who conducts the initial assessment, coordinating law enforcement notifications, identifying protective measures, reassessing new information, and documenting decisions.

Behavioral Threat Assessment Versus Anonymous Swatting Investigations

An important distinction is necessary. Behavioral threat assessment and management typically involves evaluating concerning behavior, communications, circumstances, and risk factors associated with an identifiable individual or situation.

An anonymous swatting incident may require a different or additional investigative process, including emergency dispatch analysis, digital evidence preservation, telecommunications records, and criminal investigative resources.

A school behavioral threat assessment team is not a substitute for law enforcement investigation of a swatting threat.

However, multidisciplinary threat assessment principles can help support coordinated decision-making, information sharing, and appropriate school protective actions.

National School Safety and Security Services supports and recommends the Comprehensive School Threat Assessment Guidelines (CSTAG) model based on our extensive research and evaluation of school threat assessment approaches. We recognize that other behavioral threat assessment models exist and that state mandates, district policies, and local conditions may determine which model schools adopt.

Whatever model is used, personnel must be trained, procedures must be practiced, and implementation must be consistent.

CSTAG should not be misrepresented as a specialized criminal investigative model for tracing or determining the origin of anonymous swatting calls.

Train and Exercise the Response

Training should include more than threat assessment team members. Principals, district administrators, school resource officers, secretaries, receptionists, and other employees who may receive threatening communications should understand how to recognize, document, and promptly report them.

Schools should conduct tabletop exercises that introduce realistic swatting scenarios, incomplete information, conflicting reports, changing threat assessments, and parent communications challenges. Exercises should evaluate whether participants understand who makes decisions, who contacts law enforcement, what triggers protective actions, and who communicates with school employees and families.

A written plan is only the starting point. The question is not whether the district has a threat assessment protocol. The question is whether its people can effectively implement that protocol when a real threat is reported.

Our School Tabletop Exercises for Emergency Preparedness can help school and public safety leadership teams evaluate their operational readiness.

2. Enhance School Security While the Investigation Is Ongoing

Schools do not need to choose between conducting a threat assessment and taking immediate, reasonable security precautions.

While law enforcement investigates a report, administrators should have preplanned options for enhancing security consistent with the nature of the threat and available information.

Possible measures include:

• Increasing the visible presence of administrators, school resource officers, or other security personnel
• Confirming that exterior doors, access controls, and visitor management procedures are functioning properly
• Increasing active supervision at entrances, hallways, common areas, and other relevant locations
• Alerting staff to maintain situational awareness and immediately report concerning activity
• Reviewing outdoor activities, student movement, arrival and dismissal procedures, and other operations when warranted
• Coordinating additional police patrols or presence when appropriate
• Maintaining frequent communication between school leadership, dispatchers, and law enforcement
• Preparing to implement stronger protective actions if additional evidence warrants them

These measures should not be applied mechanically. An increased police presence may be appropriate in one situation while different protective actions may be necessary in another.

Lockdown, evacuation, shelter-in-place, early dismissal, and school closure should be considered based on the reported threat, available evidence, operational circumstances, applicable requirements, and established emergency procedures.

School officials must also consider whether a protective action could inadvertently create additional risks. vFor example, evacuating students from a secure building without sufficient information about the nature or location of a possible threat may introduce new dangers. Conversely, remaining inside may be unsafe when circumstances indicate a hazard within the building. These decisions require sound judgment and coordination with trained public safety professionals.

Schools should also resist reflexive purchasing decisions following highly publicized swatting incidents. Additional cameras, weapons detection equipment, panic buttons, or other technology may have legitimate applications in a comprehensive school safety program. But purchasing technology does not replace trained personnel, effective supervision, operational coordination, or appropriate threat assessment.

Evaluate the actual risk and operational needs before selecting a response.

School safety is ultimately about the consistent implementation of reasonable protective practices, not simply the appearance of security.

3. Crisis Communications Strategies for Rumors, Misinformation, and Community Anxiety

A swatting incident can quickly become a communications crisis even when investigators later determine that the reported emergency was fabricated.

Parents may learn about an alleged shooting from a student’s text message or a social media post before receiving official school information. Students may circulate partial accounts. Community members may speculate about police activity. News organizations may seek immediate statements.

In the absence of timely, credible information, rumors can quickly become the dominant explanation of events. School leaders need crisis communications strategies that begin before an incident and continue after the immediate safety concern is resolved.

Plans should establish:

• Who has authority to issue school and district communications
• Who verifies information before release
• How school officials coordinate information with law enforcement
• Which communication channels are used for employees, students, families, and the community
• Who monitors significant rumors and misinformation
• How parents will receive instructions concerning school operations, pickup, or reunification
• How the district will communicate when important facts remain unknown
• When and how follow-up information will be provided

Five Questions Every School Safety Message Should Address

Our Strategic School Safety Communications Guide recommends five questions that are particularly valuable during swatting incidents:

1. What do we know?
2. What don’t we know yet?
3. What are we doing?
4. What do you need to do?
5. When will you hear from us again?

School officials should acknowledge legitimate parent anxiety without amplifying unverified threats or sensational allegations. Communications should avoid prematurely declaring an incident to be a hoax or stating that no danger exists before the available evidence supports that conclusion.

The September 2026 federal swatting guidance encourages a “Report, Don’t Repost” approach to threatening social media messages. Students, parents, and employees should be encouraged to report concerning communications to appropriate authorities rather than spreading potentially false information to broader audiences.

School officials also should recognize that a parent’s anxiety does not necessarily disappear when law enforcement concludes there was no credible threat. Families may have questions about what occurred, why particular protective measures were used, and whether anything needs to change.

Transparent, timely, and appropriately limited follow-up communications can help maintain public confidence while protecting student privacy, sensitive safety information, and continuing investigations.

School Swatting Response: Six Steps for School Administrators

School districts should establish and practice a coordinated operational response process before a swatting incident occurs.

Step 1: Take the Initial Threat Seriously

Do not dismiss a threat because similar incidents elsewhere were hoaxes or because a caller’s information appears suspicious. Immediately follow applicable school and emergency notification procedures.

When an imminent danger is reported or reasonably indicated, initiate appropriate emergency protective actions without waiting for a complete investigation.

Step 2: Coordinate Rapid Assessment With Law Enforcement

Designate a school administrator or other authorized official to maintain communication with emergency dispatchers and responding law enforcement.

Share available information, relevant observations, and any evidence that may support or contradict the reported threat. Personnel receiving a threatening call should follow their training and dispatcher guidance for gathering useful information without delaying emergency notification or placing themselves at risk.

School employees should not attempt independent criminal investigations.

Step 3: Implement and Reassess Protective Measures

Use the school’s emergency operations plan and current information to determine appropriate protective measures. These may include lockdown, evacuation, shelter-in-place, temporary restrictions, enhanced supervision, or additional security presence.

Continue reassessing the situation as new information becomes available.

Step 4: Communicate With Employees, Students, and Families

Issue timely, accurate information through established communication channels.

Distinguish confirmed facts from information that remains under investigation. Provide clear instructions when action is required and establish expectations for additional updates.

Step 5: Document Decisions and Preserve Evidence

Maintain a timeline of reported information, notifications, actions, communications, and investigative updates. Document important decisions and the information available when they were made.

Preserve relevant messages, screenshots, call records, emails, and other evidence in coordination with law enforcement and applicable records requirements.

Step 6: Communicate the Outcome and Conduct an After-Action Review

Explain the status of the incident once sufficient information has been verified.

Distinguish between a confirmed fabricated report, an unsubstantiated threat, and an investigation that remains open.

Review the response with school and public safety partners. Identify areas for improvement in threat assessment, protective actions, emergency communications, documentation, and operational coordination.

Recognizing Possible Swatting Indicators

The FBI has identified several characteristics commonly associated with swatting incidents.

These may include:

• Telephone calls using spoofed numbers or internet-based calling systems
• A single emergency report without corroborating calls or witnesses
• Vague, inconsistent, or contradictory descriptions of the alleged emergency
• Callers unable to provide basic details about their location or the situation
• Mispronunciation of local streets, schools, buildings, or geographic locations
• A caller’s demeanor or delivery appearing inconsistent with the reported emergency
• Threats appearing in clusters across different institutions or communities

These indicators may assist trained professionals in evaluating a reported threat. However, no single indicator proves that a threat is fabricated.

A legitimate emergency caller may be frightened, confused, unfamiliar with a location, or unable to provide complete information.

Indicators should be considered collectively and in context, alongside available evidence and information from law enforcement.

The purpose of recognizing possible swatting characteristics is to improve situational awareness and assessment, not to provide an excuse for dismissing threats.

See the FBI’s Ongoing Threats of Swatting and Indicators for Community Members, August 4, 2026.

Federal School Swatting Guidance and Research

September 2026: U.S. Departments of Education and Justice Guidance

On September 25, 2026, the U.S. Departments of Education and Justice issued joint guidance addressing swatting threats against educational institutions.

The guidance emphasizes the importance of preparing in advance, establishing coordinated procedures, training personnel, evaluating threats, and communicating with law enforcement.

Among its recommendations are:

• Training employees who may receive threats
• Establishing multidisciplinary threat assessment capabilities
• Developing coordinated procedures with law enforcement and emergency dispatchers
• Conducting tabletop exercises to test decision-making
• Designating officials responsible for threat evaluation and communications
• Taking appropriate steps to protect students and employees while determining whether a threat is real
• Preparing communications procedures that address rumors and misinformation

The guidance supports the central premise that schools need both preparedness and sound judgment when managing anonymous threats. It also emphasizes that schools should not mistakenly classify a real threat as a hoax.

This federal guidance is advisory and expressly nonbinding. Schools should evaluate it alongside applicable state laws, local requirements, and their own emergency operations plans.

Read the September 25, 2026, Guidance to Educational Institutions on Swatting Threats.

CISA: Anonymized Threat Response Guidance for K–12 Schools

The Cybersecurity and Infrastructure Security Agency (CISA) published Anonymized Threat Response Guidance: A Toolkit for K–12 Schools in 2024.

Developed with federal and school safety partners, the toolkit helps school and district personnel evaluate anonymous threats and develop coordinated response processes.

It provides information intended to support:

• Threat assessment and decision-making
• Coordination with law enforcement
• Appropriate operational responses
• Communications and preparedness planning
• Training and exercises

The toolkit provides a valuable reference for school leaders developing or reviewing their own procedures.

Read CISA’s Anonymized Threat Response Guidance: A Toolkit for K–12 Schools.

Our Earlier Research: School Threats and Swatting Since 2014

National School Safety and Security Services was examining the operational and communications challenges created by anonymous school threats long before the latest federal guidance.

Our national study documented 812 reported school threats during the first five months of the 2014–2015 school year, from August through December 2014.

The study found a 158% increase in reported threats compared with the previous year’s corresponding research period.

The research examined broader shooting, bomb, and other school threats, including those communicated electronically. It was not a dedicated study of swatting prevalence. However, the study documented seven references to swatting and highlighted the emerging challenges associated with electronic anonymity and threats originating across geographic boundaries.

Those early findings reinforced the need for school leaders to establish procedures for threat assessment, law enforcement coordination, and crisis communications.

Our research also highlighted how threatening communications and rumors can create fear, operational disruption, and significant pressure on school administrators even when investigations ultimately determine that threats were not credible.

The leadership lessons remain highly relevant today.

Read our national school threats research.

Legal Issues and Considerations Related to School Swatting

Swatting can involve serious criminal offenses under federal and state laws. School officials should also understand the potential legal and administrative implications of their emergency response decisions.

The legal issues associated with swatting extend beyond the person making the false report. They can involve emergency notification obligations, institutional policies, student privacy, records preservation, and questions about the reasonableness of school and public safety responses.

Criminal Penalties for Swatting

Depending on the facts, federal laws potentially applicable to swatting include:

• 18 U.S.C. § 875: Certain interstate threatening communications
• 18 U.S.C. § 1038: False information and hoaxes concerning specified federal offenses
• 18 U.S.C. § 844(e): Certain threats and malicious false reports involving fire or explosives
• 18 U.S.C. § 1030: Certain computer-related crimes when the required elements of the offense are established

Additional federal laws may apply in particular cases, including offenses involving cyberstalking or conduct motivated by unlawful discrimination.

States may have their own laws addressing false emergency reports, bomb threats, misuse of emergency communication systems, harassment, and related offenses.

Not every false report violates every listed federal statute. Criminal charges depend on the circumstances, available evidence, jurisdiction, and statutory requirements.

Swatting incidents originating outside the United States can present additional investigative and prosecution challenges.

The Congressional Research Service has examined these issues in its School Swatting: Overview of Federal Criminal Law.

School Emergency Preparedness and Response Responsibilities

Schools may be subject to state or local requirements involving emergency operations plans, threat assessment teams, notifications, law enforcement coordination, training, and incident reporting. These obligations vary by jurisdiction and school type.

A school’s responsibility to take reasonable safety measures does not disappear because a reported threat is anonymous or subsequently found to be false. At the same time, the appropriate response may differ depending on the information available, the potential immediacy of danger, applicable requirements, and the circumstances of the incident.

Schools should work with their legal counsel and public safety partners to ensure emergency procedures are consistent with applicable laws and professional safety practices.

Documentation, Decision-Making, and Potential Civil Liability

School safety decisions may later be reviewed by school boards, parents, employees, regulators, insurers, attorneys, or courts.

Questions may arise concerning whether administrators:

• Followed established emergency procedures
• Adequately evaluated the available threat information
• Coordinated appropriately with law enforcement
• Implemented reasonable protective actions
• Communicated accurate and timely information
• Preserved relevant documentation
• Responded appropriately to changing circumstances

Legal issues may include negligence allegations, employee safety responsibilities, institutional liability, or other claims. The standards governing these matters depend on the jurisdiction, school type, applicable immunity protections, specific facts, and other legal considerations.

For school leaders, accurate contemporaneous documentation is an important governance and operational practice. This includes recording what was known, when information became available, which decisions were made, and the reasons for those decisions.

Student Privacy and Confidentiality

Swatting investigations may involve student information, digital communications, disciplinary matters, or allegations concerning identifiable individuals.

Schools should consider applicable privacy requirements, including the Family Educational Rights and Privacy Act (FERPA), where relevant, and state confidentiality laws.

Communications should protect sensitive information and avoid prematurely identifying suspected perpetrators or distributing unverified allegations.

Federal Guidance Does Not Automatically Establish a Legal Mandate

The September 2026 federal guidance on swatting is expressly nonbinding. School officials should distinguish between recommended practices and legal requirements.

They should also recognize that certain federal campus safety provisions, including the Jeanne Clery Campus Safety Act, generally apply to covered postsecondary institutions and should not automatically be treated as requirements for K–12 schools.

Legal disclaimer: National School Safety and Security Services provides independent school safety, security, and emergency preparedness consulting and educational resources. We do not provide legal advice. School leaders should consult qualified legal counsel regarding applicable laws, legal responsibilities, and institution-specific legal questions.

Ten Questions School Boards and Superintendents Should Ask About Swatting Preparedness

Swatting preparedness is a leadership and governance responsibility, not simply a law enforcement or school security assignment.

Superintendents and school boards should be able to answer the following questions:

1. Do we have trained personnel and established procedures for evaluating anonymous school threats?
2. Have we clarified the roles of our school threat assessment team, administrators, emergency dispatchers, and law enforcement partners?
3. Can key decision-makers communicate and coordinate rapidly when a threat is reported?
4. Do our procedures distinguish between immediate emergency protective actions and continuing threat assessment?
5. What measures can we take to enhance security while an investigation is underway?
6. Have we conducted a tabletop exercise involving a potential swatting incident?
7. Are school secretaries, receptionists, and other frontline employees trained to recognize, document, and report threatening communications?
8. Do we have crisis communications procedures to address parent anxiety, media inquiries, rumors, and misinformation?
9. How are decisions documented, and how do we evaluate performance following an incident?
10. How do we prevent repeated false reports from creating complacency while avoiding unnecessary overreactions?

These questions should be used to assess actual readiness, not simply whether the district possesses written policies.

A school may have a comprehensive emergency operations plan and still discover significant weaknesses when employees attempt to implement it during a developing incident.

Assess the school’s operational readiness, not just the existence of a written plan.

Frequently Asked Questions About School Swatting

What is a school swatting threat?

A school swatting threat involves a knowingly false emergency report intended to trigger a significant police or emergency services response to a school. Common examples include fabricated reports of active shooters, bomb threats, hostage situations, or other violent emergencies.

What should school administrators do when a swatting threat is reported?

Administrators should immediately follow established emergency notification procedures, coordinate with law enforcement, implement protective actions appropriate to the reported danger, and continue assessing the threat as information develops. They should also communicate accurately with staff and families, preserve evidence, and document important decisions.

Should schools automatically lock down after receiving an anonymous threat?

Not every anonymous threat warrants an identical response. Schools should use established emergency procedures, trained personnel, available evidence, and law enforcement coordination to determine appropriate protective actions. If an immediate danger is reasonably indicated, necessary emergency measures should not be delayed.

How can school officials determine whether a threat is a swatting hoax?

School officials and law enforcement should evaluate the original report, available corroboration, potential indicators of false reporting, and any additional evidence. No single characteristic proves that a report is fabricated. Investigators may need to examine telecommunications or digital evidence.

What is the difference between swatting and a school bomb threat?

A bomb threat is a communication alleging or threatening the presence or use of an explosive device. Swatting involves a knowingly false emergency report intended to provoke an emergency response. A fabricated bomb threat designed to trigger a significant police response may constitute swatting, but not every bomb threat is swatting.

Can swatting threats originate outside the United States?

Yes. Swatting reports can originate outside the community, state, or country where the targeted school is located. Technology may conceal the perpetrator’s location, making investigations more complex.

How can schools prevent swatting incidents?

Schools cannot guarantee prevention of malicious false reports. However, they can reduce vulnerabilities and the likelihood of unnecessary disruption through advance planning, trained personnel, coordinated threat assessment, appropriate protective measures, relationships with law enforcement, and effective crisis communications.

Are school swatting threats illegal?

Knowingly making fabricated emergency reports may violate federal or state criminal laws. Applicable offenses and penalties depend on the circumstances, including the content of the report, the method used, and other criminal conduct.

Should schools notify parents during a suspected swatting incident?

Schools should follow applicable emergency notification requirements and established crisis communications procedures. Messages should be timely, accurate, and appropriate to the circumstances, while providing necessary instructions and avoiding unverified claims.

What should schools do after a swatting threat is determined to be false?

Schools should communicate the verified outcome, coordinate any continuing investigation, preserve relevant records, address student and employee concerns, and conduct an after-action review to identify improvements.

What are the three most important elements of school swatting preparedness?

Schools should have trained threat assessment teams and protocols, preplanned measures to enhance security while investigations continue, and crisis communications strategies that address misinformation, parent concerns, and community anxiety.

School Swatting Resources and Research

The following federal resources, original research, and independent school safety guidance can help school administrators and public safety professionals strengthen their preparedness.

Federal Swatting Guidance and Resources

U.S. Departments of Education and Justice

Guidance to Educational Institutions on Swatting Threats, September 25, 2026

Joint federal guidance addressing swatting preparedness, threat evaluation, law enforcement coordination, protective actions, training, and emergency communications.

Federal Bureau of Investigation

Ongoing Threats of Swatting and Indicators for Community Members, August 4, 2026

FBI guidance on the nature of swatting, potential indicators, mitigation, evidence preservation, and incident reporting.

Cybersecurity and Infrastructure Security Agency

Anonymized Threat Response Guidance: A Toolkit for K–12 Schools

Federal toolkit supporting K–12 preparedness, anonymous threat assessment, coordinated responses, and decision-making.

Congressional Research Service

School Swatting: Overview of Federal Criminal Law

Congressional legal research examining federal criminal statutes and investigative challenges associated with school swatting.

FBI Internet Crime Complaint Center

Report Internet Crime and Related Threat Information

Federal reporting resource for qualifying internet-related criminal activity. Emergencies and immediate threats to life should be reported to 911.

National School Safety and Security Services Resources

Strategic School Safety Leadership

Independent guidance addressing leadership, governance, decision-making, preparedness, and managing ambiguity and uncertainty.

Strategic School Safety Communications

Practical leadership guidance for communications with students, employees, parents, school boards, the news media, and communities before, during, and after school safety incidents.

School Threat Assessment: School Threats, Social Media, Texting and Rumors

Our earlier guidance emphasizing assessment before reaction, law enforcement coordination, and proactive planning for rumors and anonymous threats.

Study Finds Rapid Escalation of Violent School Threats

Our original national study of 812 reported school threats during the first five months of the 2014–2015 school year.

School Threat Assessment Training

Information on developing effective threat assessment practices and strengthening school personnel preparedness.

School Tabletop Exercises for Emergency Preparedness

Scenario-based exercises for testing leadership decisions, emergency procedures, threat assessment coordination, and crisis communications.

School Safety, Security, and Emergency Preparedness Assessments

Independent school safety evaluations emphasizing operational realities, implementation fidelity, human factors, and preparedness.

Media Coverage and Expert Commentary

Education Week | September 28, 2026

Swatting Disrupts Schools. New Federal Guidance Shows How to Respond

Education Week interviewed Kenneth S. Trump, Ed.D., following the September 2026 federal swatting guidance.

Trump emphasized the importance of advance planning, clearly designated school and law enforcement contacts, and maintaining vigilance even after repeated hoax threats.

As he told Education Week: “School officials and law enforcement must thoroughly investigate all threats to determine their credibility, but threats must initially be taken seriously.”

Final Thoughts: School Swatting Requires Strategic Leadership, Not Reactionary Decisions

Swatting exploits a fundamental responsibility of school administrators: their obligation to protect students and staff from potential violence.

A perpetrator may intentionally seek to create fear, confusion, emergency response activity, and disruption throughout a school community.

School officials cannot prevent every malicious individual from targeting their schools. They can, however, strengthen their capacity to manage such incidents through thoughtful preparation, trained personnel, coordinated procedures, and credible communications.

This begins with three essential elements: multidisciplinary threat assessment capabilities, appropriate security measures while investigations continue, and crisis communications plans that acknowledge the understandable concerns of students, employees, parents, and communities.

School leaders must also resist the dangerous extremes of assuming every reported threat is a hoax and responding to every unverified report with the most disruptive measures available.

Assess and then react. Don’t react and then assess.

Take threats seriously. Protect students and staff. Work with law enforcement. Evaluate available evidence. Communicate accurately. Reassess as circumstances change.

Effective school safety leadership is not measured simply by the number of written plans, emergency drills, security products, or highly visible protective measures a district has implemented.

It is measured in part by whether school leaders and frontline personnel can make thoughtful, coordinated, and defensible decisions when confronted with ambiguity, uncertainty, and rapidly changing information.

The objective is not simply to react to a reported crisis. It is to lead effectively through it.

About the Author and Our Independent School Safety Consulting

Kenneth S. Trump, Ed.D., is President of National School Safety and Security Services, an independent, non-product-affiliated school safety consulting firm.

With more than 40 years of experience in K–12 school safety, security, and emergency preparedness, Dr. Trump provides school safety assessments, strategic leadership consultation, emergency preparedness training, tabletop exercises, crisis communications guidance, and expert witness services in school safety litigation.

His doctoral research at Johns Hopkins University examined strategic school safety leadership and communicating school safety in highly ambiguous and uncertain environments.

National School Safety and Security Services does not sell or receive compensation from school security hardware or technology products. Our focus is helping school leaders make informed, independent, practical, and defensible school safety decisions.

Learn More About Our Independent School Safety and Security Assessments

Contact: ken@schoolsecurity.org | (216) 251-3067