Skip to content
Campus Alert Archive
CU Boulder

False shots-fired reports prompted a shelter-in-place lasting more than three hours

AI-generated · every claim is source-linked
COswattingemergency notificationhigh confidence
Confirmed HoaxDetermined to be a hoax. The institutional response is documented because it reveals how the alert system performed under a perceived real threat.

On August 25, 2025, false reports of shots fired near Norlin Library triggered a campus-wide shelter-in-place order at CU Boulder lasting over three hours. The online extremist group Purgatory later claimed responsibility for the hoax, which was part of a wave of university swatting incidents.

Alerts
5
Response
Killed
Injured
Institution
University of Colorado Boulder
Public R1 · CO
All CU Boulder cases →
~40,000 studentsCU Boulder Alerts
Official alert policy
Read when and how CU Boulder says it will use CU Boulder Alerts: summarized, quoted, and analyzed.
Documented Timeline

Alert Sequence

5 messages in sequence · 5 verified verbatim

INITIAL ALERTTwitter/X
CU EMERGENCY ALERT: Police activity near Norlin Library. Campus-wide shelter in place issued. Emergency personnel responding. Avoid area.
Sent at 4:54 PM MDT on August 25, 2025 by CU Boulder Police via X/Twitter and SMS
Triggered by two calls to Boulder Police and Fire Communications Center reporting shots fired near Norlin Library and Sewall Hall
UPDATETwitter/X
Verified verbatim@cuboulderalerts on X (verbatim)128 chars
CU EMERGENCY ALERT: Campus-wide shelter in place remains in effect. Avoid area around Norlin Library. http://alerts.colorado.edu
Reaffirmed the campus-wide shelter-in-place while officers continued to clear Norlin Library
Norlin Library is a five-story building at the heart of campus that took over two hours to fully sweep
Corrected to exact fxtwitter display text.
UPDATETwitter/X
Verified verbatim@cuboulderalerts on X (verbatim)211 chars
CU EMERGENCY ALERT 5: A shelter in place remains in Norlin Library while CUPD works to clear the building. The campus will send a final alert after Norlin Library has been cleared.. http://alerts.colorado.edu
Narrowed the shelter-in-place to Norlin Library only, lifting it for the rest of campus
Students and staff on upper floors began being escorted out around this time
Corrected to exact fxtwitter display text.
UPDATEEmail+2h 9m
Verified verbatimCU Boulder Alerts archive306 chars
CUPD responded to reports of shots fired at Norlin Library on Monday, Aug. 25 just before 5 p.m. [7:03 p.m., Aug. 25, 2025] If you are still sheltering in place on Floors 1-3 in Norlin Library, please exit from where you are. There are officers in the hallway who will be directing you out of the building.
Update sent at 7:03 PM MDT directing remaining occupants on Floors 1-3 to evacuate with officer assistance
Officers were stationed in hallways to direct evacuees out of the building
ALL CLEAREmail+3h 24m
Verified verbatimCU Boulder Alerts archive163 chars
The CU Boulder Police Department (CUPD) has determined there was and is no threat to campus. CUPD is investigating a potential swatting incident at Norlin Library.
Final all-clear at 8:18 PM MDT, over three hours after the initial shelter-in-place
A third caller had contacted CUPD dispatch to state the school had been swatted, indicating awareness of the hoax
Message elements

How the first alert is built

To check this alert, Claude (an AI) read it in full 25 separate times, independently. Each read decided whether the message answers each of the six questions and gave a short reason. A final reviewer then weighed all 25 and wrote the plain-English verdict you see when you open a row. The score (for example 22/25) is how many reads agreed; the 25 individual reads are tucked underneath if you want to check them.

CU EMERGENCY ALERT: Police activity near Norlin Library. Campus-wide shelter in place issued. Emergency personnel responding. Avoid area.

  • Sourcepresent25/25

    Final assessment

    All 25 reads agree the sender is present; the message opens with the branded "CU EMERGENCY ALERT".

    Who is sending the alert and who is responding. People act faster on a message from a clearly identifiable, credible sender, such as a named department, the police, or a branded alert system, than on an anonymous notice. A branded signature counts.

    See all 25 individual reads
    1. present: It opens with "CU EMERGENCY ALERT:", a branded signature identifying the sender.
    2. present: The branded signature "CU EMERGENCY ALERT" identifies the sender.
    3. present: The branded tag "CU EMERGENCY ALERT" identifies the university sender.
    4. present: It opens with "CU EMERGENCY ALERT" and names "Emergency personnel", identifying the sender.
    5. present: The message opens with "CU EMERGENCY ALERT", a branded sender signature.
    6. present: The message opens with the branded signature "CU EMERGENCY ALERT", which identifies the sender.
    7. present: Opens with "CU EMERGENCY ALERT", identifying the issuing system.
    8. present: Opens with branded signature "CU EMERGENCY ALERT", identifying the sender, and references "Emergency personnel".
    9. present: Opens with "CU EMERGENCY ALERT" and names "Emergency personnel", identifying the sender.
    10. present: It is headed "CU EMERGENCY ALERT", a branded sender tag, and references "Emergency personnel".
    11. present: Opens with "CU EMERGENCY ALERT", identifying the sender.
    12. present: Opens with the branded signature "CU EMERGENCY ALERT", identifying the sender.
    13. present: The branded signature "CU EMERGENCY ALERT" identifies the sender.
    14. present: Opens with the branded signature "CU EMERGENCY ALERT", identifying the sender.
    15. present: Opens with "CU EMERGENCY ALERT" and names "Emergency personnel", a signature and authority.
    16. present: Opens with "CU EMERGENCY ALERT", identifying the sender.
    17. present: Opens with "CU EMERGENCY ALERT", a branded signature identifying the sender.
    18. present: The message opens with "CU EMERGENCY ALERT" and references "Emergency personnel", identifying the sender.
    19. present: The message opens with "CU EMERGENCY ALERT", a branded sender signature.
    20. present: It opens with the branded sender "CU EMERGENCY ALERT", identifying the issuer.
    21. present: Opens with branded signature "CU EMERGENCY ALERT", identifying the sender.
    22. present: It opens with "CU EMERGENCY ALERT", a branded sender signature, and names "Emergency personnel".
    23. present: It is a "CU EMERGENCY ALERT" naming "Emergency personnel", identifying the source.
    24. present: Opens with the branded signature "CU EMERGENCY ALERT", identifying the sender.
    25. present: It opens with "CU EMERGENCY ALERT", a branded signature identifying the sender.
  • Hazardabsent0/25

    Final assessment

    All 25 reads agree no specific hazard is named; the alert cites only "Police activity".

    What the threat actually is. A complete warning names the specific danger, such as a shooter, a fire, a tornado, or a gas leak, rather than a vague emergency, because people decide what to do based on what they are facing.

    See all 25 individual reads
    1. absent: It cites "Police activity" but never names a specific threat.
    2. absent: It names only "Police activity", which is not a specific hazard.
    3. absent: It cites "Police activity", naming no specific hazard.
    4. absent: It cites "Police activity" but names no specific hazard.
    5. absent: It cites only "Police activity" without naming a specific threat.
    6. absent: No specific hazard is named; "Police activity" does not name the threat.
    7. absent: Cites "Police activity" but names no specific threat.
    8. absent: It cites "Police activity" but names no specific threat in this text.
    9. absent: Says only "Police activity" with no specific hazard named.
    10. absent: No specific threat is named; "Police activity" does not state the hazard.
    11. absent: "Police activity" is generic and names no specific hazard in this text.
    12. absent: It says "Police activity", which is generic and does not name a specific hazard.
    13. absent: It cites "Police activity" but names no specific hazard.
    14. absent: No specific hazard is named; it cites only "Police activity", not the threat itself.
    15. absent: Refers only to "Police activity", naming no specific hazard.
    16. absent: Only "Police activity" is cited, with no specific hazard named.
    17. absent: No specific hazard is named, only "Police activity", which does not name a threat.
    18. absent: It cites "Police activity" but names no specific hazard.
    19. absent: It says "Police activity" but names no specific hazard.
    20. absent: It cites only "Police activity", a generic phrase naming no specific hazard.
    21. absent: Only "Police activity" appears, no specific hazard named.
    22. absent: Only "Police activity" is stated; no specific hazard type like shooter or bomb is named.
    23. absent: It cites generic "Police activity"; no specific hazard is named.
    24. absent: No specific threat is named; only generic "Police activity".
    25. absent: It cites "Police activity" but names no specific hazard, only a generic emergency.
  • Locationpresent25/25

    Final assessment

    All reads agree a location is present, naming Norlin Library and the area.

    Where the threat is. Saying whether danger is in a specific building, a part of campus, or area-wide lets people judge their own proximity and choose a safe direction. Without a where, a warning is hard to act on precisely.

    See all 25 individual reads
    1. present: It names "Norlin Library" and "area", specific places.
    2. present: It names "Norlin Library", a specific place.
    3. present: It names "Norlin Library", a specific campus location.
    4. present: It names "near Norlin Library", a specific place.
    5. present: It names "Norlin Library" and "Campus-wide", specific places.
    6. present: It names "near Norlin Library" and is "Campus-wide", specific locations.
    7. present: Names "Norlin Library" and "Campus-wide", specific places.
    8. present: It names "near Norlin Library" and "Campus-wide", specific places.
    9. present: Names "near Norlin Library", a specific place.
    10. present: It names "near Norlin Library", a specific place.
    11. present: Says "near Norlin Library" and "Campus-wide", specific locations.
    12. present: It names "Norlin Library", a specific place.
    13. present: It names "Norlin Library", a specific place.
    14. present: Specifies "near Norlin Library", a named place.
    15. present: Names "Norlin Library", a specific location.
    16. present: Names "near Norlin Library" and "Campus-wide", specific locations.
    17. present: Names "Norlin Library" and "Campus-wide", specific places.
    18. present: It names "near Norlin Library", a specific location.
    19. present: It names "Norlin Library", a specific place.
    20. present: It names the area "near Norlin Library", a specific place.
    21. present: Names "Norlin Library", a specific place.
    22. present: It names "Norlin Library" and "Campus-wide", specific places.
    23. present: It names "Norlin Library", a specific place.
    24. present: Names "Norlin Library", a specific location.
    25. present: It names "Norlin Library", a specific place.
  • Guidancepresent25/25

    Final assessment

    All 25 reads agree guidance is present; recipients are told to shelter in place and avoid the area.

    The protective action to take. A clear, specific instruction, such as shelter in place, evacuate, avoid the area, or run-hide-fight, drives faster and more correct protective behavior than describing the threat alone.

    See all 25 individual reads
    1. present: It instructs recipients to "shelter in place" and "Avoid area", protective actions.
    2. present: It instructs a "Campus-wide shelter in place" and to "Avoid area".
    3. present: It issues a "shelter in place" and instructs recipients to "Avoid area".
    4. present: It instructs "shelter in place" and "Avoid area", protective actions.
    5. present: It instructs a "Campus-wide shelter in place" and to "Avoid area".
    6. present: It instructs recipients via "shelter in place" and "Avoid area", protective actions.
    7. present: Issues a "shelter in place" and instructs to "Avoid area", protective actions.
    8. present: It states a "shelter in place" is issued and tells recipients to "Avoid area", protective actions.
    9. present: States a "Campus-wide shelter in place" and "Avoid area", protective actions.
    10. present: It instructs recipients that a "shelter in place" is issued and to "Avoid area", protective actions.
    11. present: States "shelter in place issued" and "Avoid area", protective actions for recipients.
    12. present: It instructs a "Campus-wide shelter in place" and to "Avoid area".
    13. present: It instructs "shelter in place" and "Avoid area", protective actions.
    14. present: Instructs "Campus-wide shelter in place" and "Avoid area", protective actions.
    15. present: Says a "Campus-wide shelter in place issued" and to "Avoid area", protective actions.
    16. present: Instructs a "shelter in place" and to "Avoid area", protective actions.
    17. present: Instructs recipients via "shelter in place issued" and "Avoid area".
    18. present: It instructs people to "shelter in place" and "Avoid area", protective actions.
    19. present: It says a "shelter in place issued" and instructs to "Avoid area", protective actions.
    20. present: It states "shelter in place issued" and tells recipients to "Avoid area".
    21. present: Instructs recipients to "shelter in place" and "Avoid area".
    22. present: It instructs "shelter in place" and "Avoid area", protective actions.
    23. present: It instructs "shelter in place" and "Avoid area", protective actions.
    24. present: Instructs a "Campus-wide shelter in place" and to "Avoid area", protective actions.
    25. present: It states a "shelter in place" and to "Avoid area", protective actions.
  • Timeabsent0/25

    Final assessment

    All 25 reads agree no timing is present; no clock time, date, or recency cue appears.

    When the message applies. A timestamp, the word now or immediately, or a phrase like until further notice tells the reader whether the danger is current and how quickly to act.

    See all 25 individual reads
    1. absent: No clock time, date, or recency cue such as "now" appears.
    2. absent: No clock time, date, or recency cue appears.
    3. absent: No clock time, date, or recency cue such as "now" or "immediately" appears.
    4. absent: No clock time, date, or recency cue appears in the text.
    5. absent: No clock time, date, or recency cue such as "now" or "immediately" appears.
    6. absent: No clock time, date, or recency cue such as "now" or "immediately" appears.
    7. absent: No clock time, date, or recency cue appears in the text.
    8. absent: No clock time, date, or recency word appears.
    9. absent: No clock time, date, or recency cue such as "now" or "immediately" appears.
    10. absent: No clock time, date, or recency cue appears in the text.
    11. absent: No clock time, date, or recency cue appears in the text.
    12. absent: No clock time, date, or recency cue appears.
    13. absent: No clock time, date, or recency cue appears in the text.
    14. absent: No clock time, date, or recency cue such as now or immediately appears.
    15. absent: No clock time, date, or recency cue such as "now" or "immediately" appears.
    16. absent: No clock time, date, or recency word appears in the message.
    17. absent: No clock time, date, or recency cue appears in the text.
    18. absent: No clock time, date, or recency cue appears in the text.
    19. absent: No clock time, date, or recency word appears in the text.
    20. absent: No clock time, date, or recency word appears in the message.
    21. absent: No clock time, date, or recency cue appears.
    22. absent: No clock time, date, or recency cue such as "now" or "immediately" appears.
    23. absent: No clock time, date, or recency cue appears.
    24. absent: No clock time, date, or recency cue appears in the text.
    25. absent: No clock time, date, or recency cue appears.
  • Impactabsent3/25

    Final assessment

    Final call absent; a strong majority found no stated harm or consequence beyond the hazard or notice, with minimal dissent.

    What the hazard could do to the people in its path. Beyond naming the threat, a complete warning conveys its potential consequences or severity, such as that a tornado can level buildings or that a leak could be explosive, so recipients grasp how much danger they are in. Research on warning message content finds that a concrete impact statement helps people personalize their risk and act sooner.

    See all 25 individual reads
    1. absent: Reports police activity and a shelter in place with no stated harm or danger.
    2. absent: Reports police activity and a shelter in place without stating any consequence or harm.
    3. present: Issues a campus-wide shelter in place for police activity with emergency personnel responding, conveying a danger.
    4. absent: It reports police activity and a shelter-in-place but states no harm or danger detail beyond police activity.
    5. absent: Reports police activity and a shelter in place but states no harm or what the threat could do.
    6. absent: Reports police activity and a shelter in place without stating any explicit harm or danger consequence.
    7. present: It cites police activity and an active threat with a campus-wide shelter in place, implying explicit danger.
    8. absent: Police activity with shelter in place states guidance but no explicit harm or consequence.
    9. absent: Reports police activity and a shelter in place without stating explicit harm or danger.
    10. absent: Reports police activity and a shelter in place without stating any harm or how dangerous it is.
    11. absent: It reports police activity and a shelter-in-place but states no explicit harm or specific danger.
    12. absent: It reports police activity and a campus-wide shelter in place but states no explicit danger or harm.
    13. absent: It reports police activity and a shelter in place without stating any explicit harm or severity.
    14. absent: It reports police activity and a shelter in place but states no explicit harm or danger detail.
    15. absent: Reports police activity and campus shelter in place but states no explicit harm or danger consequence.
    16. absent: Reports police activity and a shelter in place with no stated harm or danger.
    17. absent: It reports police activity and a campus-wide shelter in place but states no explicit harm or consequence.
    18. absent: It reports police activity and a shelter-in-place but states no explicit harm or danger.
    19. absent: It names police activity and a shelter-in-place but states no explicit harm or consequence.
    20. present: Reports police activity and a campus-wide shelter in place for an active threat, implying danger to people.
    21. absent: It reports police activity and a shelter in place but states no explicit harm or specific danger.
    22. absent: It reports police activity and a campus-wide shelter-in-place but states no explicit harm, danger, or severity.
    23. absent: Reports police activity and shelter in place but states no explicit harm or severity.
    24. absent: It reports police activity and shelter in place but states no consequence or harm explicitly.
    25. absent: It reports police activity and a campus-wide shelter in place but states no explicit harm or danger characterization.

Systematic AI judgments with visible reasoning, not human-validated codings.

About this analysis
Context

Background

On the evening of August 25, 2025, CU Boulder Police issued a campus-wide shelter-in-place order at 4:54 PM MDT after the Boulder Police and Fire Communications Center received two calls reporting shots fired near Norlin Library and Sewall Hall. A third call was then received at CUPD dispatch in which the caller told a call-taker the school had been swatted. CUPD, Boulder Police, the Boulder County Sheriff's Office, and Boulder Fire responded in force. Norlin Library, a five-story building at the heart of campus, took more than two hours to fully sweep. Students on upper floors were escorted out beginning around 6:17 PM MDT, and the all-clear was issued at 8:18 PM MDT. The online extremist group Purgatory later claimed credit for the hoax, which also targeted Villanova University and the University of Tennessee at Chattanooga around the same time. CUPD is working with the FBI and state and federal partners to investigate potential connections to other recent swatting incidents.
Analysis

Key Findings

A third caller contacted CUPD to explicitly state the school had been swatted, indicating organized coordination
The five-story Norlin Library took over two hours to fully sweep, causing a three-hour-plus campus disruption
The online extremist group Purgatory claimed credit for the hoax along with swatting at Villanova and UT Chattanooga
Outcome
Police found no evidence of a shooting after sweeping Norlin Library. The incident was confirmed as a swatting hoax. CUPD is working with the FBI and state and federal partners to investigate.
Provenance

Sources

  1. Official
  2. Official
  3. News
  4. News
  5. News
  6. Official
  7. Official
Cite this case

Campus Alert Archive. "University of Colorado Boulder: False shots-fired reports prompted a shelter-in-place lasting more than three hours." Incident of August 25, 2025. Added May 2026; last updated July 2026. https://campusalertarchive.com/case/university-of-colorado-boulder-swatting-2025-08-25/

Download case JSON

Alert text quoted on this page remains the work of the issuing institution; the archive is a secondary source.

Tags
swattingactive-shooter-hoaxpurgatorynorlin-librarycoloradoshelter-in-placefbi-investigationpublic-universityHoax
Added May 2026Updated July 2026Via ingestion