Advertisement: Click here to learn how to Generate Art From Text
A California teenager prosecutors say is responsible for hundreds of swatting attacks around the United States was exposed after law enforcement pieced together a digital trail left on some of the internet’s largest platforms, according to court records released this week.
Alan Winston Filion, a 17-year-old from Lancaster, California, faces four felony charges in Florida’s Seminole County related to swatting, or fake threats called into the police to provoke a forceful response, according to Florida state prosecutors. Filion was arrested on January 18 and extradited this week to Seminole County.
Filion’s arrest, WIRED first reported the story on January 26, 2009., the culmination a multi-agency hunt for the person police claim was responsible for swatting at high schools, historically African colleges and Universities, mosques, federal agents and for threats to blow up the Pentagon, members the United States Senate, or the US Supreme Court. YouTube chats, Discord chats and usernames associated with The Lord of the Rings helped lead authorities to Filion’s doorstep.
Florida prosecutors charged Filion with four felony counts, including three related to allegedly making false reports to law enforcement and one for unlawful use of a two-way radio for “facilitating or furthering an act of terrorism” that authorities say targeted people based on race, religion, or other protected classes. While prosecutors alleged that Filion “is responsible for hundreds of swatting and bomb threat incidents throughout the United States,” the charges Filion faces relate to a single May 12, 2023, swatting attack against the Masjid Al Hayy Mosque in Sanford, Florida.
An attorney for Filion was not immediately available to respond to WIRED’s request for comment.
More than a year before the swatting attack on the Florida mosque, agents with the US Federal Bureau of Investigation interviewed Filion’s father, William, at his home in Lancaster, California, according to court documents made public on Wednesday. The interview took place on April 21, 2022, the same day the owner of a Telegram channel linked to swatting activity posted, “SOMEONE JUST REPORTED ME TO THE FBI… LOL!”
In October 2022, while investigating swatting calls made to Anacortes School in Washington, authorities came across a Telegram account associated with multiple swatting or doxing channels. The user, “Nazgul Swattings,” had claimed responsibility in one of these channels for the threats to the Washington schools, according to the same court documents.
Court records indicate that the FBI monitored channels connected to this user over the next few months. One of them, a channel named Torswats, (formerly Nazgul Swats), shared recordings of almost 20 hoax threats threatening locations across the country, including Iowa, Louisiana, Maryland. Oklahoma, Pennsylvania and Texas.
As the FBI tracked Torswats’ public channels, Brad “Cafrozed” Dennis, a private investigator, was running his own parallel investigation on behalf of high-profile Twitch streamers who’d been swatted. Dennis, under the guise that he was ordering a swat, contacted a Torswats user in December and asked them to chat using a peer to peer chatting service called Tox. According to records shared by WIRED and not mentioned in the warrant, Dennis monitored his network traffic using Wireshark while interacting with a user on Tox. In the process, he uncovered an IP address and the username “Paimon Arnum,” which was previously unknown to law enforcement.