Estimated read time: 5-6 minutes
MOAB — In January, a teacher at Grand County High School couldn't figure out why the electronics in her room kept going out for a whole week straight.
"(The) class electronics were not working during first hour. This resulted in a high level of frustration on the part of (the teacher), because without the computers, projectors and other hardware not functioning, she could not teach her class effectively, and her students' education was set back as a result, putting the class a week behind in curriculum for the quarter," according to court documents.
A cellphone owned by another instructor in the classroom also stopped working during this time and had to be replaced.
As the school tried to figure out what was happening, administrators learned that a student may have been responsible for the chaos. That's when Moab police were contacted and became involved, Chief Alexander Bell told KSL.com.
What police soon discovered was the student was using a device called a Flipper Zero.
Bell admits that he was unaware of what a Flipper Zero was prior to the incident at the high school. And while the incidents at the school ultimately resulted in only misdemeanor charges in juvenile court, Bell says after researching the device, he's highly concerned about how else it could be used.
"People should become familiar with them and what they're capable of," he said. "It's a little worrisome."
On its website, Flipper Zero advertises itself as a "multi-tool device for geeks" while proclaiming "it loves hacking digital stuff, such as radio protocols, access control systems, hardware and more. It's fully open-source and customizable, so you can extend it in whatever way you like."
The small device, which looks like a portable toy video game, is able to read, copy and emulate radio-frequency identification waves, or infrared signals. For example, it can be programmed to be a remote for a television.
But Bell says the device can also act as an access badge and unlock doors of businesses, unlock cars and open garage doors, which he says is highly concerning when used illegally by those who wouldn't normally have access to a business or someone else's car or garage. Hackers can use the device as a kind of bluetooth skimming device, he said.
A spokeswoman for Flipper Zero, however, says that's not necessarily true.
"Flipper Zero can't generally be used to unlock cars and garage doors. Any modern car, built after the 1990s, or garage doors utilize rolling codes and other protective measures. With cars, it'd also require actively blocking the signal from the owner to catch the original signal, which Flipper Zero's hardware is incapable of doing. Modern near field communication cards are also protected, and you'd never be able to clone a credit card with our device," the company said.
The company points to a 2023 report from the state agency in New Jersey that oversees cybersecurity, which notes: "While users were able to read the signal of credit and debit cards, the tool was unable to clone or replay encrypted signals and was therefore unable to make purchases with contactless payment systems."
The report also noted that "although Flipper Zero reportedly has not been used for criminal activity, it — like other legitimate tools and similar devices — has the potential for intentional misuse and abuse."
Last week, a Canadian regulatory agency — after initially stating it would fully ban Flipper Zero in Canada — announced it planned to ban illegitimate uses of the device. The company responded to the initial ban proposal by stating the "accusations are ill-informed" and that the device is not capable of stealing cars.
In 2022, U.S. Customs and Border Protection agents seized a shipment of 15,000 Flipper Zero devices being shipped into the country, though they eventually released the shipment.
The company criticized the proposed Canadian ban as highly selective, saying the internal electronics Flipper Zero uses have been widely available for years and are used by numerous other devices, according to BleepingComputer, an information security and technology news publication.
Flipper Zero told KSL.com that the device actually "helps researchers and hobbyists find insecure hardware around them" and can be used "to discover the vulnerability in the iOS Bluetooth stack," something that "could have been easily exploited with any Android phone or even a laptop. There's no need for a dedicated device."
In Moab, as police continued their investigation, they learned the student with the device had also tampered with several other students' electronic devices by temporarily disabling their phones, according to court documents.
"The more (the student) did this, the more 'confident he became with it, he was barely even hiding it,'" one student told police, according to a search warrant affidavit. "He was able to turn off the smart board and projector, causing the teacher to work on IT all class instead of teaching."
Detectives say it reached a point at the high school that the teen walked into a classroom "and other students yelled at him to leave because he'd been using a device to turn off their phones," court documents state. "The students told (that teacher that his) device was capable of ruining their phones."
The Grand County School District declined comment for this story. The affidavit says the student was expelled from the high school.
The student was referred to juvenile court on charges of electronic communication harassment and property damage for permanently disabling a teacher's phone, Bell said.
Bell encourages parents and even adults who don't have children to be aware of the Flipper Zero devices and what they are capable of doing, while also encouraging teens not to engage in illegal activity just because they think it's funny.
Likewise, New Jersey state officials recommend "users and organizations educate themselves and others on these continuing potential threats and tactics to reduce victimization. Remain vigilant, keep systems and devices up to date, and maintain cybersecurity best practices, including physical security. Additionally, exercise caution when reading social media posts that may contain misinformation."
