Hoax Threats: Implications for General Election 45

The Integrated Threat Assessment Centre (ITAC) is the federal organization specifically mandated to assess threats to Canada and Canadian interests abroad.

What are hoaxes?

Hoax threats are a type of criminal activity knowingly conducted by an individual or group and designed to disrupt, distract, or harass locations or organizations. They may come in via email, social media, publicly available phone numbers, or emergency service communications centres. Hoax threats may include:

• False active shooter reports
• False domestic incident reports
• False hostage situations
• False barricade incidents
• Pranks or impersonation efforts
• Misinformation and disinformation efforts
• False bomb threats: False reports that an explosive is in place at a specific location.

Swatting: Named for police Special Weapons and Tactics (SWAT) teams, swatting is a type of hoax intended to bring about a tactical police response against an unsuspecting victim. It occurs when someone makes a false report to law enforcement claiming there is an in-progress serious crime at the current location of the intended victim.

Hoaxes are intended to incite panic, disrupt planned events or normal routines, or to intimidate or cause harm to a person, group, business or institution. A general election in Canada presents opportunities for threat actors to conduct hoaxes against public campaign events, campaign offices, and polling stations.

Hoax occurrences targeting elections and public officials

In May 2024, United States (US) authorities warned that threat actors could use swatting, bomb threats and other hoaxes to disrupt local election operations and to target electoral offices and vote-counting facilities. A body of media reporting indicates that a wave of swatting calls and bomb threats occurred throughout 2024, targeting the workplaces and homes of American public officials as well as state and federal government sites. In Canada, bomb threats of unknown motivation do infrequently occur at federal government sites; they rarely cause significant disruptions. The impact of a bomb threat can be amplified in cases where the hoax is accompanied by the intentional placement of inert devices, or when unattended items can be mistaken for a potential threat. 

Perpetrators are motivated by a range of factors, including:

• Anti-authoritarian ideology or group membership
• Accelerationist ideology or group membership
• Personal, political or social grievances
• Financial or social gain
• Entertainment

Since technology enables hoax threats to be conducted remotely, perpetrators may be located in Canada or abroad, and need not be in a local jurisdiction to target a Canadian election. Perpetrators may also be state proxies. They may specifically target a public official or their campaign office due to grievances related to that official’s portfolio, actions or perceived lack of action on specific issues. Perpetrators also use swatting as an intimidation tactic to induce a course of action from an official. Hoax threats targeting polling stations can disrupt democratic processes and have the potential to compromise election outcomes. 

Recent examples

On the day of the United States Presidential Election in November 2024, bomb threat hoaxes, which appeared to originate from Russia, were directed at polling stations in Georgia, Michigan, Arizona, Wisconsin, and Pennsylvania.

During the November 2024 Moldovan Presidential Election, bomb threat hoaxes targeted polling stations in the United Kingdom and Germany for Moldovan-residents voting abroad.

Assessment: Hoax threats targeting a Canadian general election, public officials, and sites or events associated with an election are a realistic possibility due to the low capability requirement and the potential for significant effect.

An election presents attractive opportunities to threat actors seeking to undermine public confidence in democratic institutions, disrupt electoral processes or to take action against targets to which they are ideologically opposed. Because perpetrators of swatting choose victims in part based on publicly available information, likely targets include planned political events and locations such as rallies, town halls, candidate debates, polling locations, candidate workplaces or offices, or doxed locations such as candidate residences.

The use of technological tools

Low-capability threat actors can conduct swatting operations with minimal preparation. In addition, a wealth of technological tools can help with such hoaxes:

• Freely available technologies—such as virtual private networks (VPN) and Voice over Internet Protocol (VoIP)—allow perpetrators to easily conceal their identity and improve the credibility of the hoax.
• The proliferation of easy-to-use, text-to-media artificial intelligence (AI) applications significantly lowers capability barriers in the creation of deceptive audio, images or video (i.e. deepfakes).     
• Commercial media-editing platforms can augment the credibility of AI-generated materials.
• Individuals with advanced skill sets and tools offer professional swatting services against client-specified targets for a fee. 
• Web-based communication and VoIP help threat actors overcome proximity limitations associated with physical attacks, allowing them to victimize targets anywhere in the world.
• Threats actors can exploit doxed information revealing the location of homes, workplaces or planned events to target public officials with swatting or hoax bomb threats.

Physical harm

Swatting can create dangerous situations for targets, bystanders, and law enforcement. According to media reporting from 2022 to 2024, at least two people died in the US as a direct result of swatting, including:

• a swatting victim shot and killed by police 
• a swatting victim who died of a heart attack induced by police response 

Implications

For candidates and public officials

Carefully manage your online footprint. Think about how threat actors seeking to disrupt your campaign or otherwise harm you could exploit details you share publicly about frequented locations or planned events. 

For first responders

An election is a time of heightened tension. Be aware when responding to reported threats or crimes in progress that a threat actor could be trying to use your response to disrupt or harm candidates, political parties or events they oppose ideologically.

For any issues or feedback on reports, ITAC can be reached via email ITAC-PRTSHP@smtp.gc.ca.

Further information

Security and Intelligence Threats to Elections Task Force (SITE)

The Security Intelligence Threats to Elections Task Force (SITE TF) is a whole-of-government working group that coordinates Government of Canada collection and analysis efforts concerning threats to Canada’s federal election processes. It consists of experts from the Canadian Security Intelligence Service (CSIS) (current Chair), the Communications Security Establishment Canada (CSE), Global Affairs Canada (GAC), and the Royal Canadian Mounted Police (RCMP). Each member agency works within their respective mandate to monitor and address threats to elections. 

You can reach the SITE Task Force 24/7: SITE-MSRE@smtp.gc.ca.

CSIS Tip Line: 1-800-267-7685

RCMP is Canada’s National Police Service. At the community, provincial, territorial, and federal levels, the RCMP works to prevent crime, enforce the law, and investigate criminal offences.

If you are in immediate danger, or need urgent help, call 911.