About 14% of dispatchers said AI tools targeted them
In August, a caller using an AI-generated voice reported a bomb threat to Wheatland Union High School in Yuba County, California. Police responded overnight and classes were canceled; there was no bomb and no one was hurt. Authorities said the call was one in a series of swatting hoax calls made to schools across the country over the summer.
911 dispatchers have long dealt with swatting, but the Yuba County incident was different: the call was made by an AI-generated voice, a new and growing challenge for emergency responders.
The FBI defines swatting calls as calls to 911 or police departments that report a bomb threat, mass shooting or another life-threatening emergency with the intention of prompting a massive emergency response. The goal of swatting calls is to harass or retaliate against the targets of the calls — like a public official. They usually trigger a big, chaotic response from police, redirecting public safety resources from real emergencies. People also have been killed and injured in swatting attacks, said Mel Maier, CEO and executive director of APCO International, the Association of Public Safety Communication Officials.
NENA, the 9-1-1 Association, and APCO International, which both represent 911 dispatchers, said incidents like the one in Yuba County reflect their growing worries over how AI could be used by bad actors. Swatting calls made by people using AI-generated voices or background sounds are making the hoax calls sound even more realistic, and harder to determine what is real and what isn’t. Maier said synthetic swatting voices have become harder to recognize. “Those voices [of swatting callers] used to be pretty easy to recognize, but now they’re natural sounding. They can insert pauses. They can use words like, ‘uh’, or ‘maybe, um, let me think about it.’ And it sounds very natural,” he said.
APCO and the Public Safety Threat Alliance, an information-sharing and cybersecurity group, looked into the prevalence of swatting to 911 call centers and published their findings in June based on 766 responses from public safety communications professionals. About 14% of dispatchers said they had been targeted using AI tools. Maier said he expects that proportion to rise as the tools become more advanced.
Brandon May, an assistant professor of forensic psychology at the Florida Institute of Technology, said companies such as ElevenLabs, an artificial intelligence company that creates synthetic voice software, offer tools that are cheap and readily available. “I’m able to clone my voice on ElevenLabs for less than $20, and I can change the intonations. I can change how deep or high-pitch my voice is. I can change the pauses,” he said.
May said this makes AI-generated voices difficult to identify. “It is no longer simple to just look at an image or hear a video or hear a voice and go, ‘That is AI.’ People are duped by this all the time,” he said. He also said elaborate fraud callers using AI chatbots have tricked people into handing over their life savings. As fake voices and sound effects become more sophisticated, May said detection during what he calls “high-stakes, high-consequence” calls is nearly impossible. “It is going to be nearly impossible to detect,” he said.
April Heinze, NENA’s vice president and chief of 911 operations, said swatting calls have some hallmarks — for example, most swatters do not dial 911 directly. The reason, she said, is that 911 supplies a caller’s location, a callback number, the name of the phone’s owner and other data, making it impossible to spoof the location. Swatting calls are usually made to police departments or courthouses and then transferred into 911 centers, Heinze said, which makes tracing them impossible.
APCO and NENA are developing ways to train their members to handle AI-generated swatting calls. Maier and Heinze declined to describe the specifics, saying additional information could make it easier to train AI systems to fool dispatchers in the future. Maier said APCO is working on training criteria for caller interrogations that ask questions at a sufficiently detailed level that an AI cannot pull the answers from a public database, capture them from a social media post or simply guess them.
Despite those concerns, Maier and Heinze said dispatchers will continue assuming that calls reporting life-threatening situations are real and will keep sending emergency resources. “It’s important to understand that no matter what, public safety is going to have a very strong response,” Heinze said. “Even if there are indicators that it is a swatting incident. They are always reporting a life-or-death situation, and if it’s a life-or-death situation, you cannot ever take chances on that.”