Madison teen allegedly used Bitcoin to pay for bomb threats at Memorial High School

MADISON, Wis. — A Madison teenager facing multiple felony charges after a string of school bomb threats this past spring allegedly used cryptocurrency to pay others to make the threats, according to a criminal complaint filed in the case.

During interviews with investigators, 17-year-old Joseph Garrison of Madison allegedly admitted that he used Bitcoin to pay for bomb threats at Vel Phillips Memorial High School during the week of February 28 to March 4 using an online contact that offered the threats as a service.

Additional analysis of Garrison’s digital wallet on the Exodus app found multiple payments made shortly before threats were called into several schools — including others outside of Wisconsin.

According to police, Garrison made arrangements for the initial call at Memorial High because he was bored and did not want to be at school. He also allegedly told investigators he had money to pay for the threats because he ran an online store where he sold hacked passwords for online accounts. Garrison said at the site’s peak, it was making $15,000 a day, and at one point he had around $800,000 in his account.

Messages appear to confirm threat plans

Data extracted from Garrison’s phone allegedly found conversations in which he told friends he was “swatting” his school, as well as messages about threats made to East Hempfield High School in Landesville, Pennsylvania on March 1, 2022. Another school of one of Garrison’s friends in Austin, Texas was also targeted with threats in late April, which was also discussed in messages with friends.

Investigators also allegedly found a screen recording video that showed a conversation between Garrison and a person who appears to be behind the threats.

In the messages, the two are going over the details of the threat calls, including Garrison providing the website for Memorial High School and referencing the school’s main office phone number at the bottom of the page as the number to call. Garrison told the person the school was already on lockdown at the time of a conversation on March 1 and appeared to tell the person to wait until the next day to make another call.

According to the complaint, those conversations would line up with the timeline of threats made at Memorial High School, as well as some of the details of the threats that were not publicly reported at the time — including the mention of pipe bombs and anthrax.

Details of Memorial High threats

The threats, which were quickly discredited by local police and the school district, began just before 11 a.m. on February 28, 2022, with calls continuing for much of the week.

Investigators say the first call came from a Google Voice number with a person identifying himself as Mark Johnson, saying he hid pipe bombs in the bushes on the left and right sides of the high school, and that the bombs would go off in 30 minutes. The threat led to the school being evacuated while explosion detection dogs searched the building, with no evidence of any bombs being found.

The next afternoon on March 1, the school received a call from someone calling themselves “Tray” saying he was in the parking lot with bombs and guns and was going to hurt himself in 10 minutes, adding that he was going to start shooting inside the school before killing himself. The person called back a short time later saying he was going to “rush the first classroom he saw” in 5 minutes. The phone number of the person calling was the same number used to make the threat the day before.

During the second threat, Memorial High School was placed on a lockout and hold, preventing anyone from entering or exiting the school. Officers responded and checked the parking lots, but did not find anyone or any evidence of explosives.

The morning of March 2, the school called police about receiving threats for the third day in a row, this time with a person claiming they were going to throw grenades at the school.

While the phone number used to make the call on March 2 was different than the one used the previous two days, officials still thought it was the same person making the calls. After that call, Detective Justine Harris went to Memorial High School to talk with the person in the event they called back.

The person did in fact call back twice that day, saying he was going to plant bombs in the fieldhouse, the planetarium, the library, in the hallways, and in lockers, saying he saw reports of all the fake threats and thought, “Why don’t I just do a real one?”

School officials ultimately decided to continue to school day as usual, but officers did keep their eyes on the school’s parking lot.

According to the criminal complaint, the calls to Memorial High School stopped until April 15, when another bomb threat was placed at about 11:22 a.m. from someone who said they planted the bomb because they were failing school. Two more calls were made at 11:48 a.m. and 11:49 a.m., but school staff again decided to continue with their day as planned.

Another set of threats was made on the morning of April 27, with someone calling police at 10:49 a.m. saying they placed eight pipe bombs at Memorial High. The UW Police Department also received a call about the bomb threat a few minutes later at 11:05 a.m. from the same number.

Again, police were put in the school’s parking lot, but the school day continued as it normally would.

Police approach Garrison

Investigators say they spoke with Garrison on June 14 and showed him a screenshot of a message that had been passed around on social media identifying him as the person behind the bomb threats at Memorial High, and including his address.

Garrison allowed police to search his phone and two computers, where investigators reportedly found screenshots of messages trying to blackmail Garrison after he was “doxxed” for the entire balance in his crypto wallet under threats of “swat calls” being made against him and his family.

During his first interview, Garrison did not provide any information about the threats at Memorial High, but police interviewed him again on June 17, during which he allegedly admitted to paying for the threatening calls.

Verification of Bitcoin payments

Investigators say they took a closer look at Garrison’s Exodus wallet on his phone and found two Bitcoin payments sent to the same address on February 28, 2022 — the first payment worth about $332.56 was made at 9:20 a.m., and the second payment worth about $46.60 was made at 9:48 a.m. Another Bitcoin payment worth about $339.57 was sent to the same wallet address at about 8:20 a.m. on March 1, 2022.

Another payment was sent at about 9:42 a.m. on April 27, 2022 — the same day as the threat made to the school in Austin, Texas — worth approximately $197.46.

Charges filed

Garrison was arrested before being formally charged in Dane County Court on Thursday with nine felonies, including five counts of creating bomb scares as a party to a crime, three counts of making terroristic threats as a party to a crime, and one count of attempted bomb scare as a party to a crime.

He is scheduled to be back in court on August 25 for a preliminary hearing.