Monday Gold Standard Security Brief: Preparing Schools for Swatting and Hoax Threats

By Matt Pasquinilli
Head of Security, Jupiter Christian School

School security does not begin with cameras, weapons-detection systems or expensive technology.

It begins with disciplined people consistently following sound procedures.

As we begin another school week, one threat deserves particular attention: swatting, hoax threats and the rapid spread of unverified information online.

The FBI recently reminded parents and school communities that law enforcement agencies investigated numerous hoax threats and swatting incidents targeting schools during the previous school year.

These incidents may not involve a genuine attacker, but they are never harmless.

A false report of an active shooter, bomb or other emergency can generate a large police response, place students and employees into protective actions, interrupt learning, frighten families and expose responding officers to unnecessary danger.

Every threat must therefore be taken seriously until the facts establish otherwise.

What Is a Swatting Threat?

Swatting is the deliberate reporting of a false emergency intended to generate a significant law-enforcement response.

A perpetrator might falsely report that an active shooter is inside a school, that someone has been taken hostage or that an explosive device has been placed on campus.

These reports can be made through telephone calls, Voice over Internet Protocol services, anonymous social-media accounts, emails or online messaging platforms. Offenders may spoof telephone numbers or use publicly available information to make a false report appear credible.

The purpose is often to create fear, disruption and confusion.

Sometimes the school itself is the intended target. In other cases, a student, employee or family may be targeted through harassment, retaliation or an online dispute.

Regardless of the motivation, the operational consequences can be significant.

Why Hoax Threats Are Dangerous

It is tempting to think of a hoax threat as nothing more than a prank. That is a serious mistake.

A swatting incident can cause:

  • An armed law-enforcement response
  • Lockdowns, holds or evacuations
  • Panic among students, employees and parents
  • Traffic congestion around the campus
  • Interference with legitimate emergency calls
  • Miscommunication between responding agencies
  • Rumors spreading across social media
  • Emotional trauma for students and employees
  • Lost instructional time
  • Criminal charges for the person responsible

A false threat can also distract security personnel and first responders from another developing incident.

School leaders must avoid two equally dangerous reactions. We cannot automatically assume that every report is genuine, but we also cannot dismiss a report simply because it resembles previous hoaxes.

Each threat must be documented, communicated, investigated and assessed through established procedures.

The First Priority: A Clear Reporting Process

Every employee should know exactly how to report a threat.

That includes teachers, administrators, office staff, coaches, custodians, volunteers, substitute teachers and security personnel.

The reporting process should answer several basic questions:

  • Who receives the initial report?
  • Who contacts law enforcement?
  • Who notifies school leadership?
  • Who determines the appropriate protective action?
  • Who preserves the available evidence?
  • Who communicates with parents?
  • Who documents the incident in the school’s threat log?
  • Who conducts the after-action review?

A crisis is not the time to search for telephone numbers, debate responsibilities or determine who has authority to make decisions.

Those questions should be answered in advance.

Preserve the Evidence

Digital information can disappear quickly.

Social-media posts may be deleted. Usernames can be changed. Messages can vanish. Links can stop working. A frightened student may close an application before anyone records what appeared on the screen.

Employees and students should be instructed to report threatening material immediately and preserve it when they can do so safely.

Useful information may include:

  • Screenshots
  • Usernames and account names
  • Profile links
  • Telephone numbers
  • Email addresses
  • Web addresses
  • Dates and timestamps
  • Exact wording
  • Images or videos
  • Names of witnesses
  • The platform where the material appeared

Employees should not begin their own online investigation, confront the suspected individual or publicly share the threatening material.

Preserve it. Report it. Allow school leadership and law enforcement to handle the investigation.

Control the Information Environment

During a school emergency, information can spread faster than facts.

Students may begin sending messages to their families before administrators have verified what is happening. Parents may post screenshots in community groups. News organizations may contact the school. Unverified claims can quickly become accepted as fact.

Strong crisis communication is therefore part of strong school security.

Schools should prepare message templates before an incident occurs. These should cover situations such as:

  • A threat under investigation
  • A campus hold
  • A lockdown
  • An evacuation
  • A law-enforcement response
  • A delayed dismissal
  • A reunification operation
  • The conclusion of an incident

The initial message does not need to answer every question. It should explain what protective action has been taken, tell families where official updates will appear and discourage people from traveling to campus unless directed.

Parents rushing toward a school can create traffic problems, interfere with emergency vehicles and complicate accountability and reunification.

Schools should communicate early enough to reduce speculation, but never distribute unverified information simply to fill an information vacuum.

Accuracy matters. Consistency matters. Credibility matters.

Maintain Coordination With Law Enforcement

The first time local police officers see a campus should not be during a reported active-shooter incident.

School leaders should maintain regular communication with law enforcement and provide opportunities for officers to become familiar with the campus.

That coordination should address:

  • Agency notification procedures
  • School and law-enforcement terminology
  • Incident-command responsibilities
  • Campus maps and building identification
  • Traffic-control concerns
  • Parent staging and reunification
  • Communication between school security and responding officers
  • Handling of anonymous or digitally transmitted threats
  • Post-incident communication

Public safety agencies and schools may use different terminology. One organization may use “hold,” another “shelter in place,” and another “secure campus.”

Those differences must be identified before an emergency.

Use Behavioral Threat Assessment Correctly

Behavioral threat assessment remains an important part of school violence prevention, but it is not simply a checklist for deciding whether someone is dangerous.

A properly trained multidisciplinary team examines behavior, communications, circumstances, stressors, access to weapons and movement along a potential pathway toward violence.

The objective is not merely to determine whether a student should be punished.

The objective is to understand the situation, identify risk, intervene appropriately and protect the school community.

A hoax threat may still reveal a student experiencing a crisis, seeking revenge, responding to bullying or demonstrating a dangerous fixation. Even when there was never a genuine plan to attack the school, the behavior may require intervention.

Security, administration, mental-health professionals and law enforcement each bring different information and responsibilities to this process.

Monday’s Operational Security Check

Every school security team should begin the week by checking the fundamentals.

Exterior doors and access points

Inspect exterior doors, gates and controlled entrances. Look for damaged hardware, doors that do not latch, malfunctioning access-control equipment and areas where employees have developed the habit of propping doors open.

A sophisticated security system cannot compensate for an unsecured door.

Radios and emergency notifications

Test radios, panic-alert systems and emergency-notification capabilities.

Confirm that batteries are charged, equipment is available and employees understand what the different alerts mean.

Technology must work under real conditions, not merely during a scheduled demonstration.

Security staffing and patrols

Review assignments, special events, athletic activities, construction projects, visitors and any staffing gaps.

Security personnel should understand that active observation is part of the job. A guard focused on a telephone is not observing people, vehicles, doors or the surrounding environment.

Patrols should remain purposeful and should not become so predictable that they lose their deterrent value.

Threat and incident logs

Make sure reports are complete, current and accessible to authorized personnel.

Patterns are difficult to recognize when information is scattered across emails, handwritten notes, text messages and individual memories.

Repeated suspicious activity may appear insignificant when viewed separately but become more concerning when documented together.

Drills and special events

Review any scheduled fire drills, lockdown drills, chapel services, athletic contests, assemblies, field trips or community events.

A campus operates differently during dismissal, a football game or a worship service than it does during an ordinary classroom period.

Security plans must account for those differences.

Unusual aerial activity

School security planning can no longer stop at the fence line.

Personnel should be prepared to observe and report unidentified drones operating near playgrounds, athletic fields, rooflines, arrival areas or large outdoor gatherings.

For most schools, the appropriate initial response is straightforward:

Detect. Observe. Document. Report. Protect.

Schools generally do not have the legal authority to jam, seize, disable or shoot down an unwanted drone. Awareness, documentation, protective action and coordination with law enforcement are therefore essential.

Questions Every School Leader Should Ask

Leadership teams should consider the following scenario:

A threatening telephone call reaches the front office at 9:15 on Monday morning.

Would the employee receiving the call know what information to record?

Would the school immediately notify the correct people?

Who would contact law enforcement?

Who would determine whether to initiate a hold, lockdown, evacuation or another protective action?

Would security personnel know their responsibilities?

Would teachers understand the terminology?

Could administrators account for students who are outside classrooms?

Would the school be able to send parents an accurate message quickly?

Would responding officers understand the campus layout?

Would anyone preserve the digital evidence?

Would the incident be documented and reviewed afterward?

If those questions cannot be answered confidently, that is the priority for this week.

Vigilance Is Stewardship

For Christian schools, security is more than an operational responsibility. It is part of our stewardship.

Parents entrust us with their children. Teachers and staff come to campus expecting a safe environment in which to serve. Students should be able to learn, worship and grow without unnecessary fear.

That responsibility requires prayer, preparation, wisdom and action.

Vigilance is not paranoia.

Preparedness is not fear.

The watchman does not create panic by remaining alert. The watchman helps others live and work in peace because someone is paying attention.

The Gold Standard

Gold Standard Security is not defined by how much equipment a school owns.

It is demonstrated through consistent daily performance:

  • Doors remain secured.
  • Employees report concerns.
  • Security personnel remain engaged.
  • Radios work.
  • Threats are documented.
  • Leaders communicate.
  • Law enforcement knows the campus.
  • Drills expose weaknesses.
  • After-action reviews produce improvements.
  • Complacency is challenged.

A plan sitting on a shelf does not protect anyone.

People protect people.

Policies, training, technology and equipment should support those people, but disciplined execution remains the foundation.

This week, inspect the fundamentals. Review the threat-reporting process. Test communications. Speak with law enforcement. Update the threat log. Prepare employees for swatting and online hoaxes. Identify the assumptions that may be creating vulnerabilities.

School security is not something we complete.

It is something we practice every day—from the curb to the classroom.

Not our kids. Not on our watch.


Matt Pasquinilli is the Head of Security at Jupiter Christian School and the creator of the Gold Standard Security and Curb-to-Classroom school-security concepts. His work focuses on operational school security, emergency preparedness, CPTED, protector development and emerging threats facing Christian and faith-based schools.

Official FBI resource:
School Swatting Risks and Guidance for Parents