Campus Alert Archive
Northwestern

Swatting call reporting a shooting in a vacant graduate apartment prompts lockdown

AI-generated · every claim is source-linked
ILswattingemergency notificationmedium confidence
Compare →
Confirmed HoaxDetermined to be a hoax. The institutional response is documented because it reveals how the alert system performed under a perceived real threat.

A swatting call placed at 2:17 PM CDT on March 14, 2018 prompted Northwestern University to lock down its Evanston campus for nearly two hours after a male caller reported he had shot his girlfriend inside Engelhart Hall, a graduate residence at 1915 Maple Avenue. Police soon discovered the apartment unit named in the call had been vacant since November 2017, and traced the call to an area near Rockford, Illinois. Three NU Alerts went out warning students to seek shelter, then to remain sheltered, and finally announcing the report had been determined to be a hoax.

Alerts
3
Response
23 min
Killed
0
Injured
0
Institution
Northwestern University
Private R1 · IL
All Northwestern cases →
~22,000 studentsAlertNU
Official alert policy
Read when and how Northwestern says it will use AlertNU: summarized, quoted, and analyzed.
Documented Timeline

Alert Sequence

3 messages in sequence · 3 verified verbatim

INITIAL ALERTSMS
Verified verbatimChicago Sun-Times quoting NU Alert verbatim139 chars
NU EMERGENCY: Person with gun on Evanston campus. If on campus, seek shelter in safe place and stay until further notice. Others keep away.
Sent at approximately 2:40 PM CDT, roughly 23 minutes after Evanston police received the swatting call at 2:17 PM CDT
Despite the initial caller specifying Engelhart Hall, the first NU Alert did not name the building, likely because Northwestern was still confirming the location and did not want to direct students toward or away from a specific building based on an unverified report
The alert opens with 'NU EMERGENCY' rather than 'NU Alert,' a stronger framing reserved for active threat situations
UPDATESMS
Verified verbatimChicago Sun-Times quoting NU Alert verbatim105 chars
Police continue to investigate a reported incident at Engelhart Hall. Remain sheltered or avoid the area.
This update is the first official Northwestern message that names Engelhart Hall, the graduate residence hall at 1915 Maple Avenue that was the subject of the swatting call
The shelter-in-place directive remained in effect; the message does not yet indicate the report is suspect
ALL CLEARSMS+1h 50m
Verified verbatimChicago Sun-Times quoting NU Alert verbatim223 chars
Police have determined that the report of a man with a gun in Engelhart Hall was a hoax. It was made in a call to the Evanston Police Department. No danger to the community exists. Police are investigating the false report.
Sent at approximately 4:30 PM CDT, ending a roughly two-hour campus lockdown (Northwestern tweeted the all-clear at 4:33 PM CDT)
Northwestern explicitly used the word 'hoax' in the all-clear, a notable specificity choice that contrasts with peer institutions that often use vaguer phrasing like 'unfounded' or 'no longer a threat'
The message attributes the false report to a call to Evanston PD specifically, framing the incident as a swatting rather than a misidentification
Message elements

How the first alert is built

To check this alert, Claude (an AI) read it in full 25 separate times, independently. Each read decided whether the message answers each of the six questions and gave a short reason. A final reviewer then weighed all 25 and wrote the plain-English verdict you see when you open a row. The score (for example 22/25) is how many reads agreed; the 25 individual reads are tucked underneath if you want to check them.

NU EMERGENCY: Person with gun on Evanston campus. If on campus, seek shelter in safe place and stay until further notice. Others keep away.

  • Sourcepresent25/25

    Final assessment

    All 25 reads agree the source is present; the branded NU EMERGENCY signature identifies the sender.

    Who is sending the alert and who is responding. People act faster on a message from a clearly identifiable, credible sender, such as a named department, the police, or a branded alert system, than on an anonymous notice. A branded signature counts.

    See all 25 individual reads
    1. present: "NU EMERGENCY" branded signature identifies the Northwestern sender.
    2. present: It opens with the branded signature "NU EMERGENCY".
    3. present: "NU EMERGENCY" branded signature identifies the sender.
    4. present: It opens with "NU EMERGENCY" branded signature identifying Northwestern as sender.
    5. present: It opens with branded "NU EMERGENCY", identifying the sender.
    6. present: It opens with "NU EMERGENCY", a branded signature.
    7. present: The signature "NU EMERGENCY" identifies Northwestern as the sender.
    8. present: "NU EMERGENCY" branded signature identifies the sender.
    9. present: "NU EMERGENCY:" branded signature identifies the Northwestern sender.
    10. present: "NU EMERGENCY" is a branded sender tag identifying Northwestern.
    11. present: It opens with the branded signature "NU EMERGENCY", identifying the sender.
    12. present: The signature "NU EMERGENCY" identifies the branded university sender.
    13. present: The "NU EMERGENCY" branded tag identifies the Northwestern sender.
    14. present: "NU EMERGENCY" identifies Northwestern as the branded sender.
    15. present: "NU EMERGENCY" identifies Northwestern as the sender via branded tag.
    16. present: It opens with branded "NU EMERGENCY" identifying the Northwestern sender.
    17. present: "NU EMERGENCY" identifies the Northwestern University branded sender.
    18. present: The branded tag "NU EMERGENCY" identifies the sender.
    19. present: "NU EMERGENCY" branded tag identifies the sender.
    20. present: "NU EMERGENCY" identifies Northwestern University as the branded sender.
    21. present: "NU EMERGENCY" identifies Northwestern as the branded sender.
    22. present: The "NU EMERGENCY:" branded signature identifies the sender.
    23. present: "NU EMERGENCY" branded signature identifies the sender.
    24. present: "NU EMERGENCY" branded signature identifies the sender.
    25. present: "NU EMERGENCY" is a branded sender tag for Northwestern.
  • Hazardpresent25/25

    Final assessment

    All 25 reads agree the hazard is present; it names a person with a gun.

    What the threat actually is. A complete warning names the specific danger, such as a shooter, a fire, a tornado, or a gas leak, rather than a vague emergency, because people decide what to do based on what they are facing.

    See all 25 individual reads
    1. present: It names "Person with gun", a specific threat.
    2. present: It names "Person with gun", a specific threat.
    3. present: It names a "Person with gun", a specific threat.
    4. present: It names a specific threat: "Person with gun on Evanston campus".
    5. present: It names "Person with gun", a specific threat.
    6. present: It names "Person with gun on Evanston campus", a specific threat.
    7. present: It states "Person with gun", a specific threat.
    8. present: It names "Person with gun", a specific threat.
    9. present: It names "Person with gun", a specific threat.
    10. present: It names "Person with gun", a specific threat.
    11. present: It names "Person with gun on Evanston campus", a specific threat.
    12. present: It names "Person with gun", a specific threat.
    13. present: It names a "Person with gun", a specific threat.
    14. present: It names a "Person with gun", a specific threat.
    15. present: "Person with gun" names a specific threat.
    16. present: It names "Person with gun", a specific threat.
    17. present: It names a "Person with gun", a specific threat.
    18. present: It names "Person with gun", a specific threat.
    19. present: It names "Person with gun," a specific threat.
    20. present: It names "Person with gun", a specific threat.
    21. present: It names "Person with gun", a specific threat.
    22. present: It names a "Person with gun", a specific threat.
    23. present: It names "Person with gun", a specific threat.
    24. present: It names "Person with gun", a specific threat.
    25. present: It names "Person with gun", a specific threat.
  • Locationpresent25/25

    Final assessment

    All 25 reads agree the location is present; it names the Evanston campus.

    Where the threat is. Saying whether danger is in a specific building, a part of campus, or area-wide lets people judge their own proximity and choose a safe direction. Without a where, a warning is hard to act on precisely.

    See all 25 individual reads
    1. present: It cites "Evanston campus" and "on campus", specific places.
    2. present: It specifies the "Evanston campus".
    3. present: It names the "Evanston campus", a specific location.
    4. present: It specifies "Evanston campus".
    5. present: It locates it on "Evanston campus".
    6. present: It says "Evanston campus", a specific place.
    7. present: It says "on Evanston campus".
    8. present: It specifies the "Evanston campus".
    9. present: It locates it on the "Evanston campus".
    10. present: It specifies "Evanston campus", a named location.
    11. present: It locates it on the "Evanston campus".
    12. present: It says "on Evanston campus", a named location.
    13. present: It locates it on the "Evanston campus".
    14. present: It names the "Evanston campus".
    15. present: "Evanston campus" specifies the location.
    16. present: It says "on Evanston campus", a location.
    17. present: It names "Evanston campus".
    18. present: It says "Evanston campus", a specific location.
    19. present: It names "Evanston campus."
    20. present: It specifies "Evanston campus", a named place.
    21. present: It cites "Evanston campus", a specific location.
    22. present: It cites the "Evanston campus", a specific location.
    23. present: It cites "Evanston campus", a specific place.
    24. present: It locates it on "Evanston campus", a specific campus.
    25. present: It cites "Evanston campus" and "on campus", location references.
  • Guidancepresent25/25

    Final assessment

    All 25 reads agree guidance is present; it tells recipients to seek shelter in a safe place and keep away.

    The protective action to take. A clear, specific instruction, such as shelter in place, evacuate, avoid the area, or run-hide-fight, drives faster and more correct protective behavior than describing the threat alone.

    See all 25 individual reads
    1. present: "seek shelter in safe place" and "keep away" instruct protective actions.
    2. present: It instructs to "seek shelter in safe place" and "keep away", protective actions.
    3. present: It instructs "seek shelter", "stay until further notice", "keep away", protective actions.
    4. present: It instructs recipients to "seek shelter in safe place and stay" and "keep away".
    5. present: It instructs "seek shelter in safe place" and "Others keep away".
    6. present: It instructs "seek shelter in safe place" and "keep away", protective actions.
    7. present: It instructs recipients to "seek shelter in safe place" and "keep away".
    8. present: "seek shelter in safe place", "stay until further notice", and "keep away" are protective actions.
    9. present: It instructs "seek shelter in safe place" and "Others keep away".
    10. present: It instructs "seek shelter in safe place" and "Others keep away", protective actions.
    11. present: It instructs "seek shelter in safe place" and "Others keep away", protective actions.
    12. present: It instructs "seek shelter in safe place" and "Others keep away", protective actions.
    13. present: It instructs "seek shelter in safe place" and "Others keep away".
    14. present: It instructs "seek shelter in safe place" and "Others keep away".
    15. present: "seek shelter in safe place", "stay until further notice", "keep away" are protective instructions.
    16. present: It instructs "seek shelter in safe place and stay" and "Others keep away", protective actions.
    17. present: It instructs "seek shelter", "stay until further notice", and "Others keep away".
    18. present: It instructs to "seek shelter in safe place and stay until further notice" and "keep away".
    19. present: "seek shelter in safe place," "keep away" are protective actions.
    20. present: It instructs "seek shelter in safe place" and "keep away", protective actions.
    21. present: It instructs "seek shelter in safe place" and "Others keep away", protective actions.
    22. present: It instructs recipients to "seek shelter in a safe place", a protective action.
    23. present: It instructs "seek shelter" and "keep away", protective actions.
    24. present: It instructs "seek shelter in safe place and stay until further notice", protective actions.
    25. present: It instructs "seek shelter in safe place" and "keep away".
  • Timepresent20/25

    Final assessment

    Majority finds time present; stay until further notice reads as a duration cue, though a minority sees no clock time or date.

    When the message applies. A timestamp, the word now or immediately, or a phrase like until further notice tells the reader whether the danger is current and how quickly to act.

    See all 25 individual reads
    1. present: "stay until further notice" conveys timing duration, a time cue.
    2. present: "stay until further notice" conveys a recency/duration cue.
    3. present: "until further notice" conveys a time/duration cue.
    4. present: The phrase "stay until further notice" conveys a recency/duration cue.
    5. present: The phrase "stay until further notice" conveys a time reference.
    6. present: It says "stay until further notice", a recency cue.
    7. present: "stay until further notice" conveys a recency/duration cue.
    8. absent: No clock time, date, or recency cue appears.
    9. present: "until further notice" conveys a time/duration cue.
    10. present: "stay until further notice" conveys a recency/duration cue.
    11. present: It conveys time with "stay until further notice".
    12. present: It says "stay until further notice", a duration time cue.
    13. present: "stay until further notice" conveys a recency/duration cue.
    14. present: "stay until further notice" conveys a recency/duration cue.
    15. absent: No clock time, date, or recency cue such as "now" appears.
    16. present: It says "stay until further notice", a recency cue.
    17. absent: No clock time or date appears; "until further notice" is a duration, not a recency cue here.
    18. present: "until further notice" is a time reference.
    19. present: "until further notice" conveys timing.
    20. present: "stay until further notice" conveys a recency/duration timing cue.
    21. present: "stay until further notice" conveys a time cue.
    22. present: "stay until further notice" conveys a time cue.
    23. absent: No clock time, date, or recency cue appears; "until further notice" refers to duration not onset but counts as recency cue. Reconsidered: "until further notice" is listed as a Time cue.
    24. absent: No clock time, date, or recency word such as "now" appears.
    25. present: "stay until further notice" conveys a timing reference.
  • Impactpresent22/25

    Final assessment

    Present, with strong agreement (22 of 25). A reported person with a gun on campus with seek-shelter instructions conveys an armed threat of harm; the dissent held the text only names the hazard without stating harm.

    What the hazard could do to the people in its path. Beyond naming the threat, a complete warning conveys its potential consequences or severity, such as that a tornado can level buildings or that a leak could be explosive, so recipients grasp how much danger they are in. Research on warning message content finds that a concrete impact statement helps people personalize their risk and act sooner.

    See all 25 individual reads
    1. present: A person with a gun on campus with seek-shelter instructions conveys a clear weapon-based danger.
    2. present: Reports a person with a gun on campus and orders shelter, conveying an armed threat of potential harm.
    3. absent: Reports a person with a gun and tells people to seek shelter but states no explicit harm or danger beyond the name.
    4. present: Reports a person with a gun with instructions to seek shelter, conveying a threat to people.
    5. present: It reports a person with a gun on campus and directs people to seek shelter, conveying armed danger.
    6. present: It reports a person with a gun and tells people to seek shelter, implying the danger of being shot.
    7. present: Reports a person with a gun on campus and says seek shelter, conveying a clear weapon-based threat.
    8. present: Reports a person with a gun on campus, conveying danger from an armed person.
    9. present: Reports a person with a gun and tells people to seek shelter, implying an armed danger to people.
    10. present: A person with a gun on campus with seek-shelter instructions implies a threat of deadly harm to people.
    11. present: It reports a person with a gun on campus, conveying a weapon-based threat to safety.
    12. present: Reports a person with a gun on campus and orders shelter, conveying a clear armed threat to people.
    13. absent: A person-with-gun report with seek-shelter guidance states no explicit harm or consequence.
    14. present: Reports a person with a gun and directs seeking shelter, conveying danger from a weapon.
    15. present: It reports a person with a gun on campus, conveying an armed threat to people.
    16. present: Reports a person with a gun on campus, conveying threat of armed violence to people.
    17. present: Reports a person with a gun on campus, conveying a clear threat to life.
    18. present: It reports a person with a gun and orders shelter, conveying a clear threat of lethal harm.
    19. present: A person with a gun on campus with seek-shelter guidance conveys the danger of armed violence.
    20. present: Reports a person with a gun and orders shelter, conveying the threat of armed violence.
    21. present: It reports a person with a gun and tells people to seek shelter, conveying a weapon-based danger to people.
    22. absent: It reports a person with a gun and shelter guidance but states no harm or severity beyond naming the hazard.
    23. present: Reports a person with a gun and tells people to seek shelter, conveying an armed threat to people.
    24. present: Reports a person with a gun and tells people to seek shelter, conveying a weapon-based danger.
    25. present: Reports a person with a gun on campus, conveying a weapon-based threat of harm.

Systematic AI judgments with visible reasoning, not human-validated codings.

About this analysis
Context

Background

Northwestern University is a private R1 research university in Evanston, Illinois with approximately 22,000 students across its undergraduate and graduate programs. Engelhart Hall, located at 1915 Maple Avenue about three blocks west of the main Evanston campus, is a graduate residence hall. At 2:17 PM CDT on March 14, 2018, Evanston police received a call from a male who said he had just shot his girlfriend inside an Engelhart Hall apartment. Police converged on the building with a major tactical response, and Northwestern issued the first NU Alert at 2:40 PM CDT directing students to shelter in place. The lockdown affected the entire Evanston campus, sending students into 'surreal' lockdown drills under desks and behind locked doors. As officers cleared Engelhart Hall, they discovered the targeted apartment unit had been vacant since November 2017 and that the call had originated from an area southeast of Rockford. At approximately 4:30 PM CDT, Northwestern issued an all-clear explicitly characterizing the incident as a hoax. The Northwestern lockdown was one of an escalating series of college swatting incidents that would intensify by 2025. Northwestern used the response as a test case for its emergency protocols, and a video on Run-Hide-Fight protocol was released eight months later in part as a response to the gaps the March 14 incident exposed.
Analysis

Key Findings

Northwestern's NU Alert sequence (3 messages over approximately 95 minutes) was unusually direct in its language, using 'NU EMERGENCY' for the initial alert and explicitly calling the incident a 'hoax' in the all-clear
The targeted apartment in Engelhart Hall had been vacant since November 2017, a fact discovered only after Evanston police entered the building
The swatting call was traced to an area near Rockford, Illinois, well outside the Chicago metro area
The incident prompted Northwestern to release an updated Run-Hide-Fight video eight months later as part of its response to gaps in student awareness exposed by the March 14 lockdown
Time from initial 911 call (2:17 PM CDT) to first NU Alert (approximately 2:40 PM CDT) was roughly 23 minutes
Outcome
No injuries. Lockdown lifted at approximately 4:30 PM CDT after Evanston police searched Engelhart Hall and confirmed no shooting had occurred. The targeted apartment had been vacant since November 2017. The call was traced to an area southeast of Rockford. The FBI and Evanston police investigated the false report; EPD ultimately concluded the swatting was linked to the victim's status as a high-end computer gamer, with opponents targeting his (then) girlfriend's address. No perpetrator was publicly identified.
Provenance

Sources

  1. News
    Lockdown lifted after reported shooting inside Northwestern's Englehart Hall deemed a hoax 'swatting' incident (Chicago Sun-Times)
    chicago.suntimes.com
    archived copy
  2. News
    Lockdown Lifted After Reports Of Northwestern Gunman Turn Out To Be Hoax (CBS Chicago)
    cbsnews.com
    archived copy
  3. News
    Report of gunman at Northwestern University was a hoax, police say (WGN-TV)
    wgntv.com
    archived copy
  4. Student Paper
    Northwestern University students recount 'surreal' gun incident scare (The Daily Northwestern)
    dailynorthwestern.com
    archived copy
  5. Student Paper
    Eight months after gun hoax, University releases video on emergency protocol (The Daily Northwestern)
    dailynorthwestern.com
    archived copy
  6. News
    Northwestern gives the all clear, saying gunman report was a hoax (Daily Herald)
    dailyherald.com
    archived copy
Cite this case

Campus Alert Archive. "Northwestern University: Swatting call reporting a shooting in a vacant graduate apartment prompts lockdown." Incident of March 14, 2018. Added May 2026. https://campusalertarchive.com/case/northwestern-englehart-hall-swatting-2018-03-14/

Download case JSON

Alert text quoted on this page remains the work of the issuing institution; the archive is a secondary source.

Tags
swattinghoaxprivate-r1illinoisnorthwesternevanstonengelhart-hallverbatim-confirmedgraduate-residencevacant-apartmentrockford-callnu-alertHoax
Added May 2026Updated May 2026Via ingestion