A California teenager prosecutors say is answerable for a whole bunch of swatting assaults across the United States was uncovered after regulation enforcement pieced collectively a digital path left on a few of the web’s largest platforms, in response to courtroom information launched this week.

Alan Winston Filion, a 17-year-old from Lancaster, California, faces 4 felony expenses in Florida’s Seminole County associated to swatting, or faux threats known as into the police to impress a forceful response, in response to Florida state prosecutors. Police arrested Filion on January 18, and he was extradited to Seminole County this week.

Filion’s arrest, first reported by WIRED on January 26, marks the end result of a multi-agency manhunt for the particular person police declare is answerable for swatting assaults on excessive colleges, traditionally black schools and universities, mosques, and federal brokers, and for threats to bomb the Pentagon, members of the United States Senate, and the US Supreme Court. Ultimately, a YouTube channel, Discord chats, and usernames associated to The Lord of the Rings helped lead authorities to Filion’s doorstep.

Florida prosecutors charged Filion with 4 felony counts, together with three associated to allegedly making false reviews to regulation enforcement and one for illegal use of a two-way radio for “facilitating or furthering an act of terrorism” that authorities say focused folks based mostly on race, faith, or different protected courses. While prosecutors alleged that Filion “is responsible for hundreds of swatting and bomb threat incidents throughout the United States,” the costs Filion faces relate to a single May 12, 2023, swatting assault towards the Masjid Al Hayy Mosque in Sanford, Florida.

An lawyer for Filion was not instantly accessible to reply to WIRED’s request for remark.

More than a 12 months earlier than the swatting assault on the Florida mosque, brokers with the US Federal Bureau of Investigation interviewed Filion’s father, William, at his residence in Lancaster, California, in response to courtroom paperwork made public on Wednesday. The interview befell on April 21, 2022, the identical day the proprietor of a Telegram channel linked to swatting exercise posted, “SOMEONE JUST REPORTED ME TO THE FBI… LOL!”

In October 2022, authorities investigating swatting incidents involving calls made to a college in Anacortes, Washington, got here throughout a Telegram consumer related to a number of swatting and doxing channels. The consumer, “Nazgul Swattings,” had claimed duty in considered one of these channels for the threats to the Washington colleges, in response to the identical courtroom paperwork.

Over the next months, courtroom information say, the FBI monitored channels linked to this consumer. One of these, a channel known as Torswats (previously Nazgul Swats), had shared recordings of practically 20 hoax calls threatening places across the nation, together with colleges in Iowa, Louisiana, Maryland, Oklahoma, Pennsylvania, and Texas.

As the FBI tracked Torswats’ public channels, Brad “Cafrozed” Dennis, a personal investigator, was operating his personal parallel investigation on behalf of high-profile Twitch streamers who’d been swatted. In December, Dennis reached out to a consumer behind Torswats and requested to speak on a peer-to-peer chatting service known as Tox underneath the guise of ordering a swat. According to information shared with WIRED, not talked about within the arrest warrant, whereas interacting on Tox, Dennis used Wireshark to observe his community site visitors. In the method, he uncovered an IP deal with and the username “Paimon Arnum,” which was beforehand unknown to regulation enforcement.