Officials: VPNs linked to school threats can be traced
At least five juveniles, ranging in age from 13 to 17, have been charged this week in connection with a series of threats directed at Connecticut schools.
Among those arrested was a 14-year-old Norwalk boy, who police believe received help from a “conspirator” from outside the United States.
In announcing the arrest on Thursday, Norwalk officials said the boy appeared to receive help concealing three phone calls to the police department in eight days by using a virtual private network, or VPN.
Police said the boy is accused of threatening the presence of a bomb and weapons in Norwalk High School that were all determined to be unfounded.
Authorities have said similar recent threats have been made using VPN networks in Presque Isle, Maine and Lockport, N.Y.
But while VPNs are relatively common and easy to access, the lack of anonymity they provide suggests the threats weren’t well planned, one expert said.
“This doesn’t sound like a professional operation — I don’t think an organized or well thought-through crime,” said Vahid Behzadan, an assistant professor of computer science at the University of New Haven. “But it does sound like something that is relatively easy to implement and doesn’t involve too much technical difficulty.”
A VPN primarily helps enable a secure connection for someone outside an organization’s network to access its resources, according to Behzadan. “But over the past couple of decades, the purpose has shifted more toward anonymity,” he said.
“If you want to do something that you do not want to be traced back to you, you may want to use a VPN to mask the origin of the activity that you perform,” he said.
But the systems are not fool proof.
“It adds one level of complexity — one level of difficulty to tracing transactions and interactions over the web,” Behzadan said.
However, investigators could obtain the connection, network and usage logs from the service — possibly through a subpoena if it falls under their jurisdiction — that would immediately lead them back to the original user, he said.
Investigators may also be able to pinpoint the user through what Behzadan called “cross connection tracking,” where the person using a VPN uses a different device on the same service that’s not connected to the VPN.
Norwalk police have said the Federal Bureau of Investigation was involved in their investigation.
“It’s very challenging if you get a call, and it’s kind of a robocall, and you don’t know where it came from,” Mayor Harry Rilling said during Thursday’s press conference.
Charles Grady, a public affairs specialist with the FBI’s New Haven field office, declined to comment on whether charges are being sought on the other person from outside the U.S. who police suspect of being involved.
Grady said in instances of bomb threats or threats of mass shootings or similar instances, the FBI works with state and local law enforcement on a “daily” basis.
“There’s nothing about that investigation that was different or special,” he said.
The Norwalk 14-year-old was charged with first and seconddegree threatening, three counts of first-degree falsely reporting an incident, three counts of second-degree breach of peace and three counts of conspiracy.
The other youths arrested in connection with similar threats to Connecticut schools include a 17-year-old charged with a threat against Wilbur Cross High School in New Haven. Police said a minor living out of state is also believed to be behind another threat against that school posted on social media.
State police also said this week two teens were charged with making threats against Eli Whitney Technical High School in Hamden. The threats were made separately through Instagram and were “loosely related,” state police said.
A 13-year-old was also arrested Tuesday for making threats against Conte West Hills School, a middle school in New Haven, police said.
Police in Danbury said Tuesday they were “confident” in their efforts to identity those behind three threats directed at the high school last week, including a false report of a shooting. Detective Lt. Mark Williams said Thursday the investigation is ongoing and police anticipate they may be able to release an update next week.
The incidents in Connecticut come as Michigan schools have also faced a wave of threats in the wake of a shooting at Oxford High School where four students were killed. At least two dozen students — including some as young as 9 — have been charged with making threats, USA Today reported.
The Connecticut school threats continued Thursday when officials in Greenwich reported finding a “disturbing message” on the wall of the girls bathroom. Police determined there was no imminent threat to the school, officials said.
Police in three other jurisdictions said they responded to rumors of threats that turned out to be false.
In West Haven, police placed Carrigan Intermediate School on lockdown after they said a post on social media “intimating a threat to schools was misinterpreted by multiple students.” No threat was found after officers searched the building, a spokesperson for West Haven police said.
In Trumbull, school officials said rumors of a threat made against the school circulated on Wednesday that were later determined to be unfounded.
In Fairfield, police said they were alerted to a text message on Thursday that appeared to reference a threat to the town’s high schools. When police investigated, they determined “the text was in reference to an incident from Trumbull that occurred (Wednesday),” the department said.