A California teenager prosecutors say is accountable for tons of of swatting assaults round the USA was uncovered after legislation enforcement pieced collectively a digital path left on a few of the web’s largest platforms, in response to courtroom data launched this week.

Alan Winston Filion, a 17-year-old from Lancaster, California, faces 4 felony costs in Florida’s Seminole County associated to swatting, or pretend threats referred to as into the police to impress a forceful response, in response to Florida state prosecutors. Police arrested Filion on January 18, and he was extradited to Seminole County this week.

Filion’s arrest, first reported by WIRED on January 26, marks the end result of a multi-agency manhunt for the individual police declare is accountable for swatting assaults on excessive faculties, traditionally black schools and universities, mosques, and federal brokers, and for threats to bomb the Pentagon, members of the USA Senate, and the US Supreme Court docket. Finally, a YouTube channel, Discord chats, and usernames associated to The Lord of the Rings helped lead authorities to Filion’s doorstep.

Florida prosecutors charged Filion with 4 felony counts, together with three associated to allegedly making false reviews to legislation enforcement and one for illegal use of a two-way radio for “facilitating or furthering an act of terrorism” that authorities say focused folks based mostly on race, faith, or different protected lessons. Whereas prosecutors alleged that Filion “is accountable for tons of of swatting and bomb risk incidents all through the USA,” the costs Filion faces relate to a single Could 12, 2023, swatting assault towards the Masjid Al Hayy Mosque in Sanford, Florida.

An legal professional for Filion was not instantly out there to reply to WIRED’s request for remark.

Greater than a yr earlier than the swatting assault on the Florida mosque, brokers with the US Federal Bureau of Investigation interviewed Filion’s father, William, at his residence in Lancaster, California, in response to courtroom paperwork made public on Wednesday. The interview occurred on April 21, 2022, the identical day the proprietor of a Telegram channel linked to swatting exercise posted, “SOMEONE JUST REPORTED ME TO THE FBI… LOL!”

In October 2022, authorities investigating swatting incidents involving calls made to a college in Anacortes, Washington, got here throughout a Telegram consumer related to a number of swatting and doxing channels. The consumer, “Nazgul Swattings,” had claimed duty in one in all these channels for the threats to the Washington faculties, in response to the identical courtroom paperwork.

Over the next months, courtroom data say, the FBI monitored channels linked to this consumer. A type of, a channel referred to as Torswats (previously Nazgul Swats), had shared recordings of practically 20 hoax calls threatening places across the nation, together with faculties in Iowa, Louisiana, Maryland, Oklahoma, Pennsylvania, and Texas.

Because the FBI tracked Torswats’ public channels, Brad “Cafrozed” Dennis, a non-public investigator, was working his personal parallel investigation on behalf of high-profile Twitch streamers who’d been swatted. In December, Dennis reached out to a consumer behind Torswats and requested to speak on a peer-to-peer chatting service referred to as Tox underneath the guise of ordering a swat. In keeping with data shared with WIRED, not talked about within the arrest warrant, whereas interacting on Tox, Dennis used Wireshark to observe his community visitors. Within the course of, he uncovered an IP tackle and the username “Paimon Arnum,” which was beforehand unknown to legislation enforcement.