-
(单词翻译:双击或拖选)
Those fake active shooter calls to schools? A similar thing happened before
Just before 3 p.m. on a sunny Friday in September, police in Chillicothe, Ohio, received a message from dispatch: an active shooter had reportedly injured 24 students at Chillicothe High School and was still on scene.
Bodycam video shows the fraught2 minutes that ensued. Officers rushed to the school, some entering with their rifles and pistols drawn3, running breathlessly through the hallways to find the right classroom.
But there was no shooter.
Students had been placed on lockdown, police units deployed4 and school staff were plunged5 into minutes of terror as a hoax6 unfolded. After finding no threat at the school, the officers regrouped in a school hallway. One said to the others, "Did you see the email we got today? Swatting. Somebody's swatting the schools."
Similar scenes have played out at schools across the country in recent weeks.
NPR has found local reports indicating 182 schools in 28 states received false calls about threats between Sept. 13 and Oct. 21. These have prompted a response known as "swatting," where law enforcement swarms7 a location where a crime is reportedly in progress. Swatting incidents can be particularly dangerous, as officers often enter with force, guns drawn.
But in some of these places, the pattern behind this wave of hoax calls has felt familiar. Authorities in Minnesota have said it echoes what they saw in March and April, when a caller falsely reported bombs at schools in several states.
Now, NPR has obtained records that suggest that there may, indeed, be a connection.
Audio from one of those springtime hoax bomb alerts sounds markedly similar to the voice, accent and narrative8 behind recent active shooter calls that NPR has listened to from Virginia, Minnesota, Ohio and Florida.
Through an open records request, NPR has obtained detailed9 information about the phone number behind that call, made about a high school in Louisiana. The records shed further light on the person or entity10 behind these schemes, and how they systematically11 target local institutions.
'A suspicious backpack'
On the morning of April 21, the Bossier Parish Sheriff's Office in Louisiana received a call from someone saying there was "a suspicious backpack" in a classroom at Benton High School.
The caller, who sounded like a grown man with a North African accent, claimed to be a student. Students were evacuated12 from the school, the parish fire department deployed and the grounds were searched. No bomb was found.
An investigation13 and report by the sheriff's office, obtained by NPR through an open records request, found that the call came from an internet, or VOIP, phone number. It also found that the VOIP account was tied to IP addresses in Ethiopia owned by the AFRINIC network, and specifically to the Ethiopian state-owned phone and internet service called Ethio Telecom, based in Addis Ababa. On the day that Bossier Parish received a call from this number, so, too, had 79 other places across Louisiana, Arizona and New Mexico.
An NPR analysis of the number's call logs between March 12 through April 21 offers a snapshot of how a mass hoax threat campaign may be conducted.
During a 40-day period, the VOIP number received or made 437 calls — all of them on just 10 of those days. But the usage pattern suggests that this phone number was really created with the purpose of making phone calls, because 80 percent of that activity was outgoing calls. The incoming traffic appeared to be mostly return dials from individuals or institutions that this VOIP user had called.
An examination of the number's outgoing calls details a curious pattern of activity.
More than three-quarters of the calls placed were made on just three days: March 15, April 5 and April 21. On those days, the VOIP user spent between 6 and 8 hours systematically dialing — and often re-dialing — phone numbers. Sometimes with as few as four seconds between hanging up one call and dialing the next, the number reached 125 places.
The rapid-fire dialing of numbers also indicates that the user had a list of targets at the ready, and a specific focus on schools, law enforcement agencies, fire departments and emergency dispatchers. Together, these accounted for 92% percent of the places that the VOIP number called. And while the caller blanketed 19 different states, they tended to focus on a small number of states on the days they were most active. On April 5, the number made outgoing calls only to North Carolina and Ohio. On April 21, it was only calls to Louisiana, New Mexico and Arizona.
NPR has reached out to Ethio Telecom for comment, as well as to the email address that was used to create the VOIP account. So far, neither has responded. NPR also called the VOIP number tied to this activity and reached the automated14 voicemail recording15 for the service carrier, a Canada-based company called TextNow.
For experts in VOIP and telephony fraud, the connection to TextNow is unsurprising.
TextNow and VOIP fraud
For several years, Fred Posner has been tracking call center scams, technical support scams, fake threatening calls from the IRS, and more in his spare time.
Posner, a retired16 police officer from Florida who is now a VOIP consultant17, says those numbers often end up being TextNow numbers. He's been sending them to the TextNow company, sometimes tweeting in frustration18. He sometimes hears back, but he worries it's never fast enough.
TextNow is one of many free or low-cost Internet based calling platforms, similar to Zoom19, Skype, or WhatsApp. It is easy to sign up for a new TextNow number. Using an NPR email address, it took less than a minute to choose an area code and generate a new number capable of making calls or texts from an Internet browser20 or phone.
But that facility in creating a number means the service is prone21 to fraud and abuse. Scammers have been known to use these numbers to make spam calls that ultimately aim to persuade targets to wire money. The numbers are also disposable. Users can sign up, use the number for a while, and make a new one if it gets reported. Posner said that while TextNow is a favored carrier for these scammers, it's an industry-wide problem.
TextNow spokesperson Nick de Pass told NPR that "we place a high value on customer safety and privacy." Specifically, he continued, "our internal security team works diligently22 to identify and disable accounts that are being used for illegal activity or violate our terms of service." The company declined to comment on the specific false bomb alert in Louisiana.
But according to the investigative files obtained by NPR, Bossier Parish did receive records from TextNow detailing the email address, username, registration23 date, original IP address, and IP logs of the person behind the spring bomb scares.
"We quickly identified that he had a Gmail account and the registration IP address, along with a consistent IP address on the day that this occurred, [and that it all came] out of Ethiopia," said Captain Shannon Mack, an investigator24 with the Bossier Parish Sheriff's Office.
The Ethiopia Connection
To Mack, the evidence that the caller was operating out of Ethiopia was clear.
The IP addresses tied to both the TextNow activity, as well as the caller's Gmail account, were all based in that country. She and other experts said it doesn't appear that the caller was using a Virtual Private Network, or VPN, to disguise their location. For instance, Mack noted25 that on the day her office received the false bomb alert, the caller stayed on the same IP address through hundreds of calls they made over several hours.
"A VPN will generally change by itself, whether you log in or out, about every 30 seconds," she said.
Additionally, TextNow has publicly said that it doesn't allow its users to use its service if it detects they're on a VPN.
But that doesn't mean that the caller wasn't using other techniques to make it falsely appear that they were in Ethiopia. For instance, it's possible the caller hacked26 or found other means to access digital infrastructure27 in Ethiopia, in order to route their calls through the compromised network.
"I did find a fair amount of compromised Ethio Telecom IPs that are out there on various markets like Genesis and Russian Market," said Keven Hendricks, referring to two online marketplaces on the so-called darknet, where illicit28 goods and services tend to be sold. Hendricks, an expert in cybercrime who has investigated swatting calls and VOIP abuse, said the activity of the caller behind the bomb hoaxes29 is not unprecedented30.
"I have seen similar call patterns from swatters and people who abuse Voice Over IP services to create mass panic," he said.
Ultimately, it may be difficult to track down exactly where this caller is located and who they are. But this is a key reason that experts like Fred Posner are calling for additional regulations or safeguards to allow VOIP providers to better detect fraudulent and abusive call schemes on their networks.
One major step TextNow took last Friday was to ban the entire country of Ethiopia from use of its service, to cut down on a high amount of fraudulent activity.
""Our dedicated31 Trust & Safety team is taking aggressive action and proactively working with law enforcement to respond to these incidents, including banning all accounts associated with these calls," wrote Nick de Pass, TextNow spokesperson in an email to NPR. "We have also added Ethiopia to our list of unsupported countries to help eliminate this activity from our platform, which means that all calling and texting from the country has been banned from our service."
According to an industry source, VOIP services have chosen to ban other countries from their platform in the past when a pattern of abuse is established. Even so, criminals can find ways around measures like these.
TextNow publishes a scam round-up to alert users to potential fraud, and there are third party providers that work to automatically detect fraud which many voice and text providers work with--though they're not infallible. (Without being able to listen in to calls, it's difficult to clearly establish malicious32 behavior.)
Ultimately, there are challenges, and, perhaps, a lack of incentive33, to proactively monitor for fraud on VOIP platforms before law enforcement serves a search warrant. Ultimately, the companies' goal is to make it easier for people to communicate, not harder.
The challenge of investigating
Mack of the Bossier Parish Sheriff's Office said she took the investigation in the Benton High School hoax bomb alert as far as she could.
"Because obviously we can't go to Ethiopia," she said, "and I have never had, in my personal experience as a police officer, anybody from Ethiopia co-operate with an investigation in United States."
Mack said when she investigated the false bomb alert in April, there was no indication that federal authorities were paying attention to the scheme. But with the recent wave of hoax active shooter calls, police at the state level in several places and the FBI are taking an interest. The agency has said "we will continue to work with our local, state, and federal law enforcement partners to gather, share, and act upon threat information as it comes to our attention."
Several localities denied open records requests from NPR, citing pending34 investigations35 by higher authorities. Nonetheless, information that others have released has shown that the active shooter scheme may be much wider-reaching than the bomb hoax was in the spring.
Between Sept. 19 and 23, at least eight different phone numbers were used to make false calls about active shooters. Of those, NPR confirmed that six numbers are offered through TextNow. Calls to the other two numbers either failed or were not returned.
Although it's understood that swatting can have dangerous, and sometimes even fatal, results, experts say it's too often left to local agencies to investigate. In a widespread, and seemingly coordinated36, scheme such as the current wave of active shooter threats, that approach may not be sufficient. Hendricks said it is heartening to see that federal authorities are taking an interest.
"I really feel that it's something we view more of a nuisance versus37 something that can be investigated and hold these people accountable," he said. "That's something that hopefully changes."
In all this, the motive38 itself remains39 a mystery.
"I don't know. [Maybe it's] some type of what they think is an assault on the American way of life," Mack said. "Especially disrupting schools, scaring parents and teachers and children. So I don't know if that is what their gain is, just to cause that chaos40."
收听单词发音 |
1
transcript
|
|
| n.抄本，誊本，副本，肄业证书 | |
参考例句： |
|
|
|
|
2
fraught
|
|
| adj.充满…的，伴有(危险等)的；忧虑的 | |
参考例句： |
|
|
|
|
3
drawn
|
|
| v.拖，拉，拔出；adj.憔悴的，紧张的 | |
参考例句： |
|
|
|
|
4
deployed
|
|
| （尤指军事行动）使展开( deploy的过去式和过去分词 )； 施展； 部署； 有效地利用 | |
参考例句： |
|
|
|
|
5
plunged
|
|
| v.颠簸( plunge的过去式和过去分词 )；暴跌；骤降；突降 | |
参考例句： |
|
|
|
|
6
hoax
|
|
| v.欺骗，哄骗，愚弄；n.愚弄人，恶作剧 | |
参考例句： |
|
|
|
|
7
swarms
|
|
| 蜂群，一大群( swarm的名词复数 ) | |
参考例句： |
|
|
|
|
8
narrative
|
|
| n.叙述，故事；adj.叙事的，故事体的 | |
参考例句： |
|
|
|
|
9
detailed
|
|
| adj.详细的，详尽的，极注意细节的，完全的 | |
参考例句： |
|
|
|
|
10
entity
|
|
| n.实体，独立存在体，实际存在物 | |
参考例句： |
|
|
|
|
11
systematically
|
|
| adv.有系统地 | |
参考例句： |
|
|
|
|
12
evacuated
|
|
| 撤退者的 | |
参考例句： |
|
|
|
|
13
investigation
|
|
| n.调查，调查研究 | |
参考例句： |
|
|
|
|
14
automated
|
|
| a.自动化的 | |
参考例句： |
|
|
|
|
15
recording
|
|
| n.录音，记录 | |
参考例句： |
|
|
|
|
16
retired
|
|
| adj.隐退的，退休的，退役的 | |
参考例句： |
|
|
|
|
17
consultant
|
|
| n.顾问；会诊医师，专科医生 | |
参考例句： |
|
|
|
|
18
frustration
|
|
| n.挫折，失败，失效，落空 | |
参考例句： |
|
|
|
|
19
zoom
|
|
| n.急速上升；v.突然扩大，急速上升 | |
参考例句： |
|
|
|
|
20
browser
|
|
| n.浏览者 | |
参考例句： |
|
|
|
|
21
prone
|
|
| adj.(to)易于…的，很可能…的；俯卧的 | |
参考例句： |
|
|
|
|
22
diligently
|
|
| ad.industriously;carefully | |
参考例句： |
|
|
|
|
23
registration
|
|
| n.登记，注册，挂号 | |
参考例句： |
|
|
|
|
24
investigator
|
|
| n.研究者，调查者，审查者 | |
参考例句： |
|
|
|
|
25
noted
|
|
| adj.著名的，知名的 | |
参考例句： |
|
|
|
|
26
hacked
|
|
| 生气 | |
参考例句： |
|
|
|
|
27
infrastructure
|
|
| n.下部构造，下部组织，基础结构，基础设施 | |
参考例句： |
|
|
|
|
28
illicit
|
|
| adj.非法的，禁止的，不正当的 | |
参考例句： |
|
|
|
|
29
hoaxes
|
|
| n.恶作剧，戏弄( hoax的名词复数 )v.开玩笑骗某人，戏弄某人( hoax的第三人称单数 ) | |
参考例句： |
|
|
|
|
30
unprecedented
|
|
| adj.无前例的，新奇的 | |
参考例句： |
|
|
|
|
31
dedicated
|
|
| adj.一心一意的；献身的；热诚的 | |
参考例句： |
|
|
|
|
32
malicious
|
|
| adj.有恶意的，心怀恶意的 | |
参考例句： |
|
|
|
|
33
incentive
|
|
| n.刺激；动力；鼓励；诱因；动机 | |
参考例句： |
|
|
|
|
34
pending
|
|
| prep.直到，等待…期间；adj.待定的；迫近的 | |
参考例句： |
|
|
|
|
35
investigations
|
|
| （正式的）调查( investigation的名词复数 )； 侦查； 科学研究； 学术研究 | |
参考例句： |
|
|
|
|
36
coordinated
|
|
| adj.协调的 | |
参考例句： |
|
|
|
|
37
versus
|
|
| prep.以…为对手，对；与…相比之下 | |
参考例句： |
|
|
|
|
38
motive
|
|
| n.动机，目的；adv.发动的，运动的 | |
参考例句： |
|
|
|
|
39
remains
|
|
| n.剩余物，残留物；遗体，遗迹 | |
参考例句： |
|
|
|
|
40
chaos
|
|
| n.混乱，无秩序 | |
参考例句： |
|
|
|
购买
在百度中搜索