Campus Alert Archive
OU

Swatting attack with 23 hoax calls drew more than 100 officers to campus

AI-generated · every claim is source-linked
OKswattingemergency notificationhigh confidence
Compare →
Confirmed HoaxDetermined to be a hoax. The institutional response is documented because it reveals how the alert system performed under a perceived real threat.

On April 7, 2023, the University of Oklahoma was targeted by a swatting attack originating from outside the United States, with 23 fake 911 calls in approximately 90 minutes reporting an active shooter near the South Oval and Bizzell Memorial Library. More than 100 law enforcement officers responded before the all-clear was issued at 10:53 PM CDT.

Alerts
3
Response
—
Killed
0
Injured
0
Institution
University of Oklahoma
Public R1 · OK
All OU cases →
~32,000 studentsOU Alert
Official alert policy
Read when and how OU says it will use OU Emergency Alert (RAVE): summarized, quoted, and analyzed.
Documented Timeline

Alert Sequence

3 messages in sequence · 3 verified verbatim

Confirmed wording is transcribed character-for-character from a primary source. Use Verify this quote under each message to open that source in a new tab and compare the text yourself.

INITIAL ALERTTwitter/X
Verified verbatim115 chars
OU-Norman Emergency: There is an active shooter at the Van Vleet Oval. Take immediate action now. Run. Hide. Fight!
Verify this quote
@UofOklahoma official Twitter/X post (verbatim)x.comarchived copy
Posted verbatim by @UofOklahoma on X/Twitter at 9:25 PM CDT on April 7, 2023, matching the simultaneous Rave Alert push notification
Van Vleet Oval is the formal name for the academic green commonly referred to as the South Oval at OU's Norman campus
The terse 'Run. Hide. Fight!' directive reflects the widely adopted active-shooter response framework
The 'OU-Norman Emergency:' prefix is OU's standard alert template branding
UPDATETwitter/X+20 min
Verified verbatim125 chars
OU-NORMAN Emergency 9:45pm OUPD investigating possible shots fired on Norman campus. Avoid South Oval area. Shelter in place.
Verify this quote
@UofOklahoma official Twitter/X post (verbatim)x.comarchived copy
Posted verbatim by @UofOklahoma on X/Twitter at 9:45 PM CDT on April 7, 2023, mirroring the simultaneous Rave Alert push notification
The embedded '9:45pm' timestamp (9:45 p.m. CDT on April 7, 2023) matches OU's Rave template convention, the time is part of the message body, not just the metadata
Note the location shift: the initial alert specified Van Vleet Oval (the formal name); this update uses the colloquial 'South Oval' that students would recognize
More than 100 law enforcement officers from multiple agencies were converging on campus as this update went out
ALL CLEARTwitter/X+1h 28m
Verified verbatim158 chars
OU-NORMAN Critical 10:53pm: OUPD has issued an ALL CLEAR. After a thorough search, no threat was found. There is no threat to campus. Alert has been canceled.
Verify this quote
@UofOklahoma official Twitter/X post (verbatim)x.comarchived copy
Posted verbatim by @UofOklahoma on X/Twitter at 10:53 PM CDT on April 7, 2023, exactly 88 minutes after the initial active-shooter alert
Notable severity shift: the prefix changes from 'Emergency' to 'Critical'; OU's template appears to use 'Critical' for confirmed-resolution messages
Triple-layered reassurance: 'no threat was found' + 'no threat to campus' + 'Alert has been canceled', written for an audience that had been sheltering for nearly 90 minutes
OU President Harroz later confirmed the incident was a swatting attack with calls from outside the US
Message elements

How the first alert is built

To check this alert, Claude (an AI) read it in full 25 separate times, independently. Each read decided whether the message answers each of the six questions and gave a short reason. A final reviewer then weighed all 25 and wrote the plain-English verdict you see when you open a row. The score (for example 22/25) is how many reads agreed; the 25 individual reads are tucked underneath if you want to check them.

OU-Norman Emergency: There is an active shooter at the Van Vleet Oval. Take immediate action now. Run. Hide. Fight!

  • Sourcepresent25/25

    Final assessment

    Unanimous: it opens OU-Norman Emergency, a branded signature identifying the sender.

    Who is sending the alert and who is responding. People act faster on a message from a clearly identifiable, credible sender, such as a named department, the police, or a branded alert system, than on an anonymous notice. A branded signature counts.

    See all 25 individual reads
    1. present: It opens "OU-Norman Emergency", a branded signature identifying the sender.
    2. present: It opens with "OU-Norman Emergency", a branded sender signature.
    3. present: It opens "OU-Norman Emergency", naming the university.
    4. present: It opens "OU-Norman Emergency", identifying the university.
    5. present: The "OU-Norman Emergency" signature identifies the sender.
    6. present: It opens "OU-Norman Emergency", naming the university issuing it as source.
    7. present: It opens with "OU-Norman Emergency", a branded sender tag.
    8. present: It opens with "OU-Norman Emergency" naming the issuing institution.
    9. present: The "OU-Norman Emergency" signature identifies the sender.
    10. present: It opens with "OU-Norman Emergency", a branded signature identifying the sender.
    11. present: It opens with the branded signature "OU-Norman Emergency".
    12. present: The branded "OU-Norman Emergency" tag identifies the sender.
    13. present: It opens with "OU-Norman Emergency", naming the university.
    14. present: It opens "OU-Norman Emergency", a branded signature identifying the sender.
    15. present: It opens with the branded signature "OU-Norman Emergency".
    16. present: It opens "OU-Norman Emergency", a branded signature identifying the sender.
    17. present: It opens "OU-Norman Emergency", a branded signature identifying the sender.
    18. present: It opens "OU-Norman Emergency", naming the institution.
    19. present: It is headed "OU-Norman Emergency", identifying the university sender.
    20. present: It opens with "OU-Norman Emergency", identifying the university.
    21. present: It opens "OU-Norman Emergency", a branded signature identifying the sender.
    22. present: Opens "OU-Norman Emergency" identifying the issuing university.
    23. present: Opens "OU-Norman Emergency" identifying the university sender.
    24. present: "OU-Norman Emergency" is a branded alert signature identifying the sender.
    25. present: It opens "OU-Norman Emergency", a branded sender tag for the university.
  • Hazardpresent25/25

    Final assessment

    Unanimous: it names an active shooter, a specific threat.

    What the threat actually is. A complete warning names the specific danger, such as a shooter, a fire, a tornado, or a gas leak, rather than a vague emergency, because people decide what to do based on what they are facing.

    See all 25 individual reads
    1. present: It names "an active shooter", a specific threat.
    2. present: It names "an active shooter", a specific threat.
    3. present: It names "an active shooter", a specific threat.
    4. present: It names "an active shooter", a specific threat.
    5. present: It names "an active shooter", a specific threat.
    6. present: It names "an active shooter", a specific threat.
    7. present: It names "an active shooter", a specific threat.
    8. present: It names "an active shooter", a specific threat.
    9. present: It names "an active shooter", a specific threat.
    10. present: It names "an active shooter", a specific threat.
    11. present: It names "an active shooter", a specific threat.
    12. present: It names "an active shooter", a specific threat.
    13. present: It names "an active shooter", a specific threat.
    14. present: It names "an active shooter", a specific threat.
    15. present: It names "an active shooter", a specific threat.
    16. present: It names "an active shooter", a specific threat.
    17. present: It names "an active shooter", a specific threat.
    18. present: It names "an active shooter", a specific threat.
    19. present: It names "an active shooter", a specific threat.
    20. present: It names "an active shooter", a specific threat.
    21. present: It names "an active shooter", a specific threat.
    22. present: Names "an active shooter".
    23. present: Names "an active shooter", a specific threat.
    24. present: It names "an active shooter", a specific threat.
    25. present: It names "an active shooter", a specific threat.
  • Locationpresent25/25

    Final assessment

    Unanimous: it locates it at the Van Vleet Oval, a stated location.

    Where the threat is. Saying whether danger is in a specific building, a part of campus, or area-wide lets people judge their own proximity and choose a safe direction. Without a where, a warning is hard to act on precisely.

    See all 25 individual reads
    1. present: It locates it "at the Van Vleet Oval".
    2. present: It locates it "at the Van Vleet Oval".
    3. present: It locates it "at the Van Vleet Oval".
    4. present: It says "at the Van Vleet Oval".
    5. present: It locates it "at the Van Vleet Oval".
    6. present: It specifies "the Van Vleet Oval", a location.
    7. present: It locates it at "the Van Vleet Oval", a specific place.
    8. present: It names "the Van Vleet Oval".
    9. present: It locates it "at the Van Vleet Oval".
    10. present: It locates it "at the Van Vleet Oval".
    11. present: It specifies "the Van Vleet Oval".
    12. present: It names "the Van Vleet Oval".
    13. present: It locates it "at the Van Vleet Oval", a specific place.
    14. present: It names "the Van Vleet Oval", a specific place.
    15. present: It locates it "at the Van Vleet Oval".
    16. present: It names "the Van Vleet Oval", a specific place.
    17. present: It names "the Van Vleet Oval", a specific place.
    18. present: It locates it "at the Van Vleet Oval".
    19. present: It locates it "at the Van Vleet Oval".
    20. present: It locates it "at the Van Vleet Oval".
    21. present: It locates it "at the Van Vleet Oval", a specific place.
    22. present: Locates it "at the Van Vleet Oval".
    23. present: Locates it "at the Van Vleet Oval".
    24. present: It names "the Van Vleet Oval", a specific place.
    25. present: It locates it "at the Van Vleet Oval".
  • Guidancepresent25/25

    Final assessment

    Unanimous: it instructs Take immediate action now, Run, Hide, Fight, clear protective guidance.

    The protective action to take. A clear, specific instruction, such as shelter in place, evacuate, avoid the area, or run-hide-fight, drives faster and more correct protective behavior than describing the threat alone.

    See all 25 individual reads
    1. present: It instructs "Take immediate action now. Run. Hide. Fight!".
    2. present: It instructs "Take immediate action now. Run. Hide. Fight!".
    3. present: It instructs "Take immediate action now. Run. Hide. Fight!".
    4. present: It instructs "Take immediate action now. Run. Hide. Fight!".
    5. present: It instructs recipients "Take immediate action now. Run. Hide. Fight!".
    6. present: It instructs recipients to "Take immediate action now. Run. Hide. Fight!", protective actions.
    7. present: It instructs recipients to "Take immediate action now. Run. Hide. Fight!", protective actions.
    8. present: It instructs "Take immediate action now. Run. Hide. Fight!".
    9. present: It instructs recipients to "Take immediate action now. Run. Hide. Fight!".
    10. present: It instructs recipients to "Take immediate action now. Run. Hide. Fight!"
    11. present: It instructs recipients to "Run. Hide. Fight!" and "Take immediate action".
    12. present: It instructs "Take immediate action now. Run. Hide. Fight!".
    13. present: It instructs recipients to "Take immediate action now. Run. Hide. Fight!".
    14. present: It instructs "Take immediate action now. Run. Hide. Fight!", protective actions.
    15. present: It instructs "Take immediate action now. Run. Hide. Fight!".
    16. present: It instructs "Take immediate action now. Run. Hide. Fight!", protective actions.
    17. present: It instructs "Take immediate action now. Run. Hide. Fight!".
    18. present: It instructs "Take immediate action now. Run. Hide. Fight!".
    19. present: It instructs recipients to "Take immediate action now. Run. Hide. Fight!".
    20. present: It instructs "Run. Hide. Fight!".
    21. present: It instructs "Take immediate action now. Run. Hide. Fight!", protective actions.
    22. present: Instructs "Take immediate action now. Run. Hide. Fight!".
    23. present: Instructs "Take immediate action now. Run. Hide. Fight!".
    24. present: It instructs "Take immediate action now. Run. Hide. Fight!", protective actions.
    25. present: It instructs "Take immediate action now. Run. Hide. Fight!".
  • Timepresent25/25

    Final assessment

    Unanimous: the word now conveys immediacy, so timing is present.

    When the message applies. A timestamp, the word now or immediately, or a phrase like until further notice tells the reader whether the danger is current and how quickly to act.

    See all 25 individual reads
    1. present: The word "now" conveys immediacy.
    2. present: The phrase "immediate action now" conveys immediacy.
    3. present: It says "now" and "immediate", recency cues.
    4. present: It uses the recency cue "now".
    5. present: The word "now" conveys immediacy.
    6. present: It says "Take immediate action now", a recency cue.
    7. present: It conveys recency with "now" in "Take immediate action now".
    8. present: It uses "now" and "immediate" as recency cues.
    9. present: It uses "now" and "immediate", recency cues.
    10. present: It uses "now" and "immediate", recency cues.
    11. present: It conveys immediacy with "Take immediate action now".
    12. present: It says "now" and "immediate", recency cues.
    13. present: It says "Take immediate action now", a recency cue.
    14. present: It says "now", a recency cue.
    15. present: It uses "now" and "immediate", recency cues.
    16. present: It says "immediate action now", a recency cue.
    17. present: It says "Take immediate action now", a recency cue.
    18. present: It uses recency words "immediate" and "now".
    19. present: The word "now" conveys immediacy and recency.
    20. present: It uses "now", a recency cue.
    21. present: It uses "now", a recency cue.
    22. present: Says "active" hazard plus "now" and "immediate", recency cues.
    23. present: Says "now" and "immediate", recency cues.
    24. present: The word "now" conveys immediacy, a recency cue.
    25. present: It conveys recency with "now".
  • Impactpresent25/25

    Final assessment

    Unanimous present; all reads agree an active shooter with the directive to run, hide, fight conveys imminent lethal danger to people.

    What the hazard could do to the people in its path. Beyond naming the threat, a complete warning conveys its potential consequences or severity, such as that a tornado can level buildings or that a leak could be explosive, so recipients grasp how much danger they are in. Research on warning message content finds that a concrete impact statement helps people personalize their risk and act sooner.

    See all 25 individual reads
    1. present: Reports an active shooter and tells people to run, hide, fight, conveying clear lethal danger (though later a hoax).
    2. present: Reports an active shooter and instructs to run, hide, fight, conveying lethal danger.
    3. present: States there is an active shooter and instructs people to run, hide, fight, conveying immediate lethal danger.
    4. present: It declares an active shooter and orders immediate Run Hide Fight action, conveying explicit lethal danger even though it was a swatting hoax.
    5. present: It reports an active shooter and tells people to Run Hide Fight, conveying a lethal danger.
    6. present: States there is an active shooter and directs run, hide, fight, conveying immediate lethal danger.
    7. present: It reports an active shooter and instructs people to run hide fight which conveys a deadly immediate threat.
    8. present: Reports an active shooter and tells people to run, hide, fight, conveying a lethal threat to people.
    9. present: Reports an active shooter and instructs people to take immediate action with run hide fight, conveying clear deadly danger.
    10. present: The alert states there is an active shooter and tells people to take immediate action and run hide fight, conveying an imminent deadly threat.
    11. present: Reports an active shooter and instructs to run, hide, fight, conveying an active lethal threat.
    12. present: The alert reports an active shooter and tells people to run, hide, fight, conveying a deadly threat regardless of later being a swatting hoax.
    13. present: The alert reports an active shooter and tells people to run, hide, and fight, conveying an immediate lethal threat regardless of it later being a swatting hoax.
    14. present: States there is an active shooter and tells people to run, hide, fight, conveying lethal danger.
    15. present: States there is an active shooter and instructs to run hide fight, conveying an imminent life threat.
    16. present: The alert states there is an active shooter and directs people to run, hide, fight, the active shooter and survival directives conveying lethal danger.
    17. present: It reports an active shooter and directs people to run, hide, fight, conveying an imminent deadly threat though it was a swatting hoax.
    18. present: The message reports an active shooter and directs people to Run, Hide, Fight to take immediate action, conveying a deadly threat requiring protective response.
    19. present: It reports an active shooter and tells people to run, hide, and fight, with the explicit attack directive conveying a lethal threat.
    20. present: Reports an active shooter and tells people to run, hide, fight, conveying clear deadly danger despite being a swatting hoax.
    21. present: States there is an active shooter and instructs run, hide, fight which conveys an explicit life-threatening danger.
    22. present: Reports an active shooter and directs people to run, hide, fight, conveying a clear lethal threat regardless of being a swatting hoax.
    23. present: States there is an active shooter and to run hide fight, conveying an explicit deadly threat and protective urgency.
    24. present: The alert reports an active shooter and instructs people to run, hide, and fight, conveying an imminent deadly threat.
    25. present: Reports an active shooter and instructs run, hide, fight with take immediate action now, conveying deadly danger.

Systematic AI judgments with visible reasoning, not human-validated codings.

About this analysis
Context

Background

On the evening of April 7, 2023, the University of Oklahoma was targeted by a swatting attack in which multiple fake 911 calls reported an active shooter near the South Oval and Bizzell Memorial Library on the Norman campus. The first calls came in at approximately 9:24 PM CDT, and a Rave Alert was immediately sent to the campus community. Released 911 recordings revealed 23 calls over approximately 90 minutes, with four calls arriving in the first 15 minutes alone. More than 100 law enforcement officers from multiple agencies responded and conducted thorough searches of the area. After finding no evidence of a shooting, OUPD issued the all-clear at 10:53 PM CDT. OU President Joseph Harroz confirmed the incident was a swatting attack, stating the calls originated from outside the United States. The incident caused real trauma despite being a hoax, with students describing the terror of sheltering in place during what they believed was an active shooter event.
Analysis

Key Findings

The swatting attack involved 23 separate 911 calls over 90 minutes, an unusually sustained and coordinated hoax
More than 100 law enforcement officers responded, demonstrating the massive resource cost of swatting incidents
The calls originated from outside the United States, making prosecution difficult
Outcome
After a thorough search including Bizzell Memorial Library and surrounding areas, no evidence of a shooting or criminal activity was found. OU President Joseph Harroz confirmed the incident was a swatting attack with calls originating from outside the country. No arrests were made.
Provenance

Sources

Every claim on this page is meant to be checkable. Open the links below—and the Verify this quote control under each confirmed alert—to read the original university, news, or archive page yourself. Hostnames are shown so you can see where you are going; archived copies survive when live pages move or disappear. See also our methodology.

  1. Official
    @UofOklahoma official Twitter/X post (initial alert)
    x.com
    archived copy
  2. Official
    @UofOklahoma official Twitter/X post (9:45pm update)
    x.com
    archived copy
  3. Official
    @UofOklahoma official Twitter/X post (10:53pm all-clear)
    x.com
    archived copy
  4. News
    Fake active shooter calls on OU campus referred to as swatting incident (KOSU)
    kosu.org
    archived copy
  5. Student Paper
    Swatting incident at OU: 911 calls released, timeline revealed (OU Daily)
    oudaily.com
    archived copy
  6. News
    OU President says university was victim of swatting (Fox 25 OKC)
    okcfox.com
    archived copy
  7. News
    OU's swatting event was a hoax, but the trauma it caused was real (KGOU)
    kgou.org
    archived copy
Cite this case

Campus Alert Archive. "University of Oklahoma: Swatting attack with 23 hoax calls drew more than 100 officers to campus." Incident of April 7, 2023. Added April 2026; last updated July 2026. https://campusalertarchive.com/case/university-of-oklahoma-swatting-2023-04-07/

Download case JSON

Alert text quoted on this page remains the work of the issuing institution; the archive is a secondary source.

Tags
swattinghoaxfalse-alarmactive-shooter-false-reportoklahomapublic-universityinternational-originmass-law-enforcement-responseHoax
Added April 2026Updated July 2026Via ingestion