December 16, 2025 School Threat Wave

[Dean]

Passing this on for @cw-2-2-2-2-2 as he’s having access issues. Content is his.

——————————–
On December 16, 2025, **at least 18 schools across 9 U.S. states and Canada** experienced threat-related closures, lockdowns, or security incidents in a single day. This represents a significant spike above baseline threat activity and occurred during an elevated threat window identified by federal law enforcement.

## INCIDENT SUMMARY

### Full District Closures

**Lewis-Palmer School District 38 (Monument, Colorado):** The Lewis Palmer School District 38 announced it will be closed on Dec. 16 after receiving information from law enforcement of a potential threat involving schools in the Monument area. The El Paso County Sheriff’s Office (EPSO) says it received information on this threat, but the details did not identify a specific school within D38. EPSO says this is an active investigation and that they are reviewing all information, including the credibility of the threat.

**Independent School District 196 (Minnesota):** Independent School District 196 has closed all four of its high schools and two additional schools for Tuesday, December 16, 2025, following additional social media threats reported late Monday night and brought to the attention of law enforcement and school administrators. The closures affect Eastview High School (EVHS), Apple Valley High School (AVHS), Eagan High School (EHS), the Eagan Area Learning Center, the School of Environmental Studies, and Rosemount High School (RHS).

On Monday, December 15, 2025, at approximately 6:45 PM, the Apple Valley Police Department was contacted regarding potential threats made via social media. Officers were informed of multiple concerning messages posted online that referenced possible harm directed at several high schools within Independent School District 196.

**District 191 (Burnsville, Minnesota):** Burnsville High School and Burnsville Alternative High School are canceling classes on Tuesday and sending students home following an online threat posted this morning. Principal Jesus Sandoval informed families the school entered a “hold state” at 7:50 a.m. as a precaution.

### Lockdowns and Increased Security

**Columbia, South Carolina:** An anonymous person called in bomb threats at Dreher High School and Eau Claire High School the morning of Dec. 16. “The calls were believed to be hoaxes, but both buildings were checked and nothing was found on either campus.” Additional Columbia Police Department officers joined regularly-assigned School Resource Officers (SROs) at the schools after the threats were called in.

**Tallmadge, Ohio:** Tallmadge High School was placed under emergency lockdown Tuesday morning due to an anonymous caller who made threats to the school. According to Tallmadge Police Captain Jeremy McGee, the call originated from a blocked number with a distorted voice.

**Shawnee, Oklahoma:** According to Shawnee Police, an anonymous threat call was reported at Shawnee High School Tuesday morning. Officials say officers searched the school thoroughly and brought in an explosive dog to search the building further. No weapons or threats were found.

**Westfield, Massachusetts:** Westfield Police said Westfield High School officials received a call around 7:55 a.m. Tuesday alleging a possible threat in one of the school’s bathrooms. A shelter-in-place was initiated and additional police officers responded to the school. “This incident appears to be a ‘swatting’ call.”

**Menlo Park, California:** Phillips Brooks Elementary School and La Entrada Middle School are on lockdown after two callers reported to the Menlo Park Police Department that they had seen a man with a firearm. One caller said the man was in a field near St. Denise Church and another said the man was in a car. Negotiators are on route to the scene and a partner agency has deployed at least one drone to assist Menlo Park.

### Suspect Arrested – Deliberate Targeting of December 16

**Kenosha, Wisconsin:** The Kenosha Police Department detained a 15-year-old after the Federal Bureau of Investigation flagged a TikTok post that investigators said referenced a school shooting and included the message, “December 16th, its going down.” Police said a search of the teen’s phone found he conducted an internet search to determine whether Kenosha’s KTEC school would be open on Dec. 16, the same date as the anniversary of the Madison school shooting.

Officials also said the teen is the same person detained in 2024 after an incident at Roosevelt Elementary School in which staff reported a teen entered the school carrying a duffle bag believed to contain firearms.

While at the police department, the juvenile lunged at an officer and attempted to disarm him.

### Prior Day Closure

**Platteville, Wisconsin (December 15):** The school district announced in an email and phone and text messages Sunday night that a Platteville student “was the victim of a ‘swatting’ cyberattack,” and that the school district was working with law enforcement. The school district then announced Monday morning that the threat: an online message to the school district “in which a bomb threat was issued as a means of extortion” “has been determined to be non-credible.”

—

## THREAT ENVIRONMENT CONTEXT

The December 16, 2025 incidents occurred within an elevated threat environment characterized by:

**Active ISIS Holiday Campaign:** ISIS-K launched its “Make It Miserable” propaganda campaign in November 2024, explicitly calling for attacks during the holiday period. This campaign continued through December 2025.

**Recent Attack Activity:**
– January 1, 2025: ISIS-inspired attack in New Orleans killed 14 people
– November 26, 2025: Afghan national killed National Guard soldier near White House
– December 13, 2025: ISIS ambush killed 3 Americans in Syria

**Disrupted ISIS Network:** On October 31, 2025, FBI disrupted a multi-state ISIS network spanning Michigan, New Jersey, and Washington State. The network explicitly referenced “Paris 2015” coordinated attacks and targeted LGBTQ venues, Jewish communities, and Cedar Point amusement park. Investigation remains ongoing with not all connected individuals identified.

**Federal Warning Posture:** FBI/DHS/NCTC issued joint intelligence bulletin in December 2024 warning of holiday violence threats. Schools explicitly listed as “likely targets” in DHS threat assessments.

## ANALYTICAL ASSESSMENT

### Methodology

Analysis employed the **Analysis of Competing Hypotheses (ACH)** structured analytic technique, evaluating five hypotheses:

| Hypothesis | Description |
|————|————-|
| H1 | Copycat/Hoax Wave (Domestic, Uncoordinated) |
| H2 | Coordinated Domestic Extremist Activity |
| H3 | Foreign Terrorist Probing/Reconnaissance |
| H4 | Mixed Phenomenon (Multiple Actors/Motivations) |
| H5 | Operational Cover for Planned Attack |

### Key Findings

**Most Likely Assessment: H4 (Mixed Phenomenon)**

The evidence pattern is best explained by multiple actors with different motivations converging on the same date:
– Copycat hoaxers exploiting Madison shooting anniversary
– At least one serious/repeat threat actor (Kenosha suspect)
– One actual armed individual sighting (Menlo Park – likely unrelated)
– **Unknown:** Whether any component involves foreign terrorist reconnaissance

**Cannot Rule Out: H3/H5 (Foreign Terrorist Involvement)**

The contextual threat environment provides substantial support for foreign terrorist involvement, but ground-level evidence to date trends toward domestic/juvenile actors. This gap could indicate:
1. Ground-level evidence is complete and H3/H5 are less likely, OR
2. Ground-level evidence only captures “noise” while more sophisticated actors remain undetected

### Evidentiary Patterns

**Supporting H1 (Copycat/Hoax):**
– December 16 = anniversary of Madison, Wisconsin school shooting (Abundant Life Christian School, 2024)
– Multiple incidents quickly determined to be hoaxes or swatting calls
– Kenosha suspect is juvenile (15 years old)
– No weapons or devices found in any search to date
– Pattern consistent with post-Apalachee (September 2024) hoax wave

**Supporting H3/H5 (Foreign Terrorist Involvement):**
– Active ISIS-K holiday attack campaign
– Multi-state ISIS network disrupted 6 weeks prior with ongoing investigation
– Schools explicitly identified as likely targets in federal threat assessments
– Geographic dispersion across 9 states + Canada unusual for purely copycat behavior
– D38 (Colorado) threat did not specify a school – atypical for student hoax
– FBI involvement in Kenosha case (flagged TikTok post)

—

## KEY UNCERTAINTIES

| Question | Why It Matters |
|———-|—————-|
| What is the origin of D38, District 191, and District 196 threats? | These represent the largest closures; domestic vs. overseas origin is highly diagnostic |
| Will threat volume remain elevated after December 16? | Date-specific (anniversary) vs. sustained campaign (operational) |
| Are any suspects connected across state lines? | Would indicate coordination rather than independent copycat behavior |
| Will ISIS propaganda reference December 16 activity? | Would indicate foreknowledge or direction |
| How will FBI characterize the pattern? | Federal assessment indicates classified intelligence picture |

—

## CURRENT WARNING LEVEL

**ELEVATED**

Based on:
– Elevated baseline threat environment (ISIS campaign, recent attacks, federal bulletins)
– Unusual threat volume on single date
– At least one “serious actor” identified (Kenosha)
– Key discriminating evidence still pending

**No indicators of imminent attack confirmed at this time.**

**Positive indicator observed:** No weapons or explosive devices recovered in any search.

—

## LINCHPIN EVIDENCE

The following evidence, if obtained, would significantly shift the analytical assessment:

| If Evidence Shows… | Impact |
|———————|——–|
| ISIS channels reference December 16 activity | Strongly supports H3; requires immediate elevation |
| Connection identified between suspects in different states | Strongly supports H2/H5; indicates coordination |
| All suspects are local juveniles with no connections | Strongly supports H1; reduces concern |
| Attack occurs at U.S. school or soft target | Confirms H5; assessment failure |

—

## CRITICAL WATCH ITEMS (Next 72 Hours)

1. **ISIS channel monitoring** for any December 16 references
2. **Post-December 16 threat volume** – return to baseline or sustained elevation
3. **Suspect identification and cross-referencing** across incidents
4. **FBI/DHS public statements** indicating federal assessment
5. **Overseas origin determination** for any threats

—

## BOTTOM LINE

The December 16, 2025 school threat wave most likely represents a **mixed phenomenon** combining anniversary-driven copycat activity with at least one serious threat actor. However, the elevated threat environment—including active ISIS propaganda, recent attacks on U.S. persons, and a recently disrupted multi-state ISIS network—means that **foreign terrorist involvement cannot be ruled out** with currently available evidence. Key discriminating evidence will emerge over the next 72 hours based on suspect identification, threat origin tracing, and ISIS propaganda response.

The analytical concern raised by the original query—whether a hoax pattern could represent terrorist probing or reconnaissance—**remains analytically valid** and warrants continued monitoring through the holiday period.

—

**Assessment Date:** December 16, 2025

**Next Update:** December 17, 2025

[Author]

Posts