Police has banned publication of his name, but said he was a dual citizen and would remain in custody until at least March 30.

A 19-year-old American-Israeli Jew was arrested Thursday as the prime suspect in a wave of bomb threats against US Jewish community centers, a startling turn in a case that had stoked fears of rising anti-Semitism in the United States.

The surprising arrest of the man, a hacker who holds dual Israeli and American citizenship, came after a trans-Atlantic investigation with the FBI and other international law enforcement agencies. US Jewish groups welcomed the breakthrough in the case, which had drawn condemnation from President Donald Trump. Israeli police described the suspect as a hacker, but said his motives were still unclear.

“He’s the guy who was behind the JCC threats,” police spokesman Micky Rosenfeld said, referring to the scores of anonymous threats phoned in to Jewish community centers in the US over the past two months. Police banned publication of his name, but said he was a dual citizen and would remain in custody until at least March 30. During the arrest raid, they said he tried to grab an officer’s gun but was stopped by another officer.

The young man appeared briefly in court in the central Israeli city of Rishon Letzion. He wore khaki pants and a blue sweater that he used to cover his face as he walked past reporters. He made no comment.

‘Very serious medical condition’

His lawyer, Galit Bash, said her client had a “very serious medical condition” that might have affected his behavior. She said the condition had prevented him from attending elementary school, high school or enlisting in the army, which is compulsory for most Jewish men.

“That’s why the medical condition can actually affect the investigation,” she said. “This is one of the things the judge told the police to check, to talk to his doctors, to get more documents and to investigate him according to his medical situation.”

Channel 10 TV said the condition was a brain tumor. It also showed images of a large antenna outside the suspect’s house in the southern Israeli city of Ashkelon. Police said the suspect’s father was also detained, apparently because of the equipment. Late Thursday, police said the father’s detention had been extended by eight days.

In Washington, the FBI confirmed the arrest of the main suspect. US Attorney General Jeff Sessions said the Justice Department “will not tolerate the targeting of any community in the country on the basis of their religious beliefs.” He called work by the FBI and Israeli police “outstanding.”

Bomb threats

Since Jan. 9, there have been more than 150 bomb threats against Jewish community centers and day schools in 37 US states and two Canadian provinces, according to the Anti-Defamation League, a Jewish group that battles anti-Semitism. The threats led to evacuations, sent a chill through local Jewish communities and raised fears of rising anti-Semitism. Acts of vandalism on Jewish targets, including cemeteries, have added to those concerns.

As the number of threats grew, Trump was criticized for not speaking out. Then, late last month, he opened a speech to Congress by denouncing anti-Semitism. There was no immediate reaction from the White House to Thursday’s arrest. The ADL, JCC Association of America and Jewish Federations of North America all welcomed news of the arrest.

But Jonathan Greenblatt, chief executive of the ADL, said anti-Semitism in the US remains a “very serious concern.” “JCCs and other institutions should not relax security measures or become less vigilant,” he said. Karen Dombey, whose child attends the David Posnack Jewish Community Center in Davie, Florida, which was evacuated when it received threats Feb. 27 and March 7, said she was surprised that the suspect is an Israeli-American. About 500 students from kindergarten through high school attend classes at the center, where armed guards stood at its entrances on Thursday.

“I hope it doesn’t happen again. I hope it stops. But the fact that it happened raises awareness that we are targeted even when we think we are not,” Dombey said. US authorities have also arrested a former journalist from St. Louis, Juan Thompson, for allegedly threatening Jewish organizations and charged him with one count of cyberstalking.

‘Camouflage technologies’

But Israeli police described the local man as the primary suspect in the wave of threats. Police said he used sophisticated “camouflage technologies” to disguise his voice and mask his location. They said a search of the teen’s home uncovered antennas and satellite equipment.

“In sophisticated cyber activity that I cannot detail, we obtained what we obtained and of course exposed him and his equipment,” national police chief Roni Alsheich told reporters. “This does not bring honor to the state of Israel of course. But I think it does bring respect to Israel’s police.” Police said the threats had caused panic, “significant economic damage” and disrupted public order at locations around the world.

The man is also suspected of placing threatening phone calls to Australia, New Zealand and within Israel. They also said he had disrupted a Delta Airlines flight at New York’s JFK airport in early 2015.

Not too complicated

Harel Menashri, a former cyber expert with Israel’s Shin Bet internal security agency, said it was not “too complicated” for the suspect to do what he did. He said it appeared the suspect had penetrated neighbors’ Wi-Fi systems to create multiple computer addresses.

“One of the things that helped him evade capture was he apparently took control over additional computers on the way and created a kind of computer chain,” he said. Nimrod Vax, a co-founder of the US-Israeli cybersecurity firm BigID, said catching the suspect was a more complicated task.

He said authorities would have had to sift through “billions, if not trillions” of pieces of data, including phone records, routing logs and IP connections. Ron Hosko, a retired FBI assistant director, said such investigations require massive manpower to solve.

Investigating a bomb threat by phone normally means getting a subpoena for a phone company and getting subscriber information to identify the incoming call. But the suspect used computer software, such as Tor, to obfuscate his whereabouts.

The software “puts you in a cloud of IP addresses” that link to different computers and make it extremely difficult to trace, he said.