6 ms·

How the law is tracking down high-tech prank callers

67 points by nols 10y ago

JulianMorrison 10y ago
The police should take a leaf from Corporal Carrot's book, "[...] a number of offences of murder by means of a blunt instrument, to whit, a dragon, and many further offences of generalized abetting [...]" and prosecute these non-pranks as "assault with a deadly weapon".
st3v3r 10y ago
STOP REFERRING TO SWATTING AS A PRANK. IT IS NOWHERE NEAR A PRANK.
- deleted 10y ago
  [deleted]
- omginternets 10y ago
  Your capslock key is broken. Also, it clearly is a prank. A dangerous and reckless one, but the idea is still to have a giggle at someone's expense. I don't see how mischaracterizing the intent of this act will help us fight it.
  - DanBC 10y ago
    The intent is to cause fear, alarm, and distress. That's not pranking someone.
    - 5ilv3r 10y ago
      That's actually the whole point.
    - omginternets 10y ago
      >That's not pranking someone. How so? If the people on doling out the calls are laughing at other people's expense, then it certainly is a prank. It's just a tasteless and dangerous one.
      - maxerickson 10y ago
        Prank carries a connotation that the act should not expose the target to actual danger. So swatting is arguably a prank (in the sense you write about) but people don't like the label because it is dismissive of the danger created by the swatting.
        omginternets 10y ago
        >Prank carries a connotation that the act should not expose the target to actual danger. Says who? Examples of irresponsible and dangerous pranks abound. More to the point, the intent is still to have a laugh at someone's expense which fits the dictionary definition of "prank" quite well: a practical joke or mischievous act. In anticipation of the nitpicking over the term "mischief", I submit the google definition thereof: harm or trouble caused by someone or something. Sorry, but the fact that calling this a prank should get people so upset is really, really bizarre.
        maxerickson 10y ago
        I'm not upset about it and I'm not arguing with you. I simply answered your question. I'm the one saying it carries that connotation for the reason I followed up with. Feel free to think I'm wrong.
  - st3v3r 10y ago
    No. There is no fucking way anyone can consider swatting a prank. The one mischaracterizing the intent here is you.
    - pyre 10y ago
      I'd say that the people doing it (and that enjoy watching it happen) are trying to downplay it (to themselves as well as others) by calling it a "prank." It toes the line of actually ordering a hit on someone. The intent is obviously not to kill the target, but I also doubt that the perpetrators would feel any remorse if it ended up in a death (they would rationalize it away as the police's fault, not their own). It's classification as a prank by the (teenager, gamer, 4chan, etc) culture that encourages this isn't helped by the fact that this is just an escalation of other "use a phone call to rain disorder onto someone's life" pranks: * Placing large pizza delivery orders for the target. * For a while you could order free boxes off of the USPS website, and I remember it being a thing where people would get a group to order a ton of boxes and send them to someone. Many people from that sub-culture see swatting as basically the "nuclear weapon" of those types of revenge "pranks." I can't say that I've personally witnessed the escalation to SWAT'ing, but it seems to be people from that sub-culture/mindset that see SWAT'ing as a funny joke to throw at someone that annoys them.
    - omginternets 10y ago
      Then what on earth is the intent?
      - krapp 10y ago
        Attempted murder? Why else would you send a paramilitary force to someone's home, if not to hope they get shot?
        omginternets 10y ago
        We can call it that too, but it's still still very strange to suggest that we should ignore the motive. The motive is clearly to have a laugh at someone's expense. Where I come from, that's qualified as a prank, and does not preclude the act from also being attempted murder. The extent to which everybody wants to play with words wrt this issue is puzzling.
- UVB-76 10y ago
  Aren't pranks called "social experiments" these days?
- matt_wulfeck 10y ago
  Your caps may take a breath in knowing the article actually refers to them as "swat attacks" and not pranks.
elf25 10y ago
Can we use a smidgeon of this grand technology to stop the unwanted telemarketing calling from phone banks, autodialers and robocalls, all of which ignore the 'DoNotCall' screening procedures?
abritishguy 10y ago
With great difficulty it seems.
ikeboy 10y ago
>Complex anonymity tools mean it can cost $100,000 to identify just one hoax caller. >Finley estimates he spent more than a thousand hours tracking down those two teenagers, neither of whom will spend much time behind bars, yet this is a crime that can cost police departments as much as $100,000 per incident and could result in fatalities. The number seems to have been pulled from this sentence, but it refers to the damage caused by the crime, not the cost to investigate. (This seems more plausible than thinking the number came from the thousand hours quote.) So it appears whoever wrote the sub headline didn't actually read the article. Edit: also re costs in crime to allowing anonymity: The stated argument for allowing anonymity doesn't extend to anonymous calling of emergency services. The article points out that such swatters already need to use the loophole of calling a regular number and getting routed to emergency; why not display to that operator whether the call is anonymous, and if so don't let them route it to emergency services? Are there a significant number of legitimate anonymous calls forwarded this way?
metanoetic 10y ago
>Finley used an email address associated with one Skype account to uncover a personal website for the second swatter, whose online handle was Obnoxious. Using that email, he found a page on the text-sharing website Pastebin where one of Obnoxious’s enemies had revealed his name and address. $100,000 OSINT... the police did no 'heavy lifting' in this case
matt_wulfeck 10y ago
It seems to me that a few simple pieces of information can greatly help police departments know if it's a malicious hoax: 1. Is the call coming from a voip service? 2. Can the residence be reached via their normal phone line? A small amount of caution should be used before local (and often times militarized) police forces go busting down doors.
- spdustin 10y ago
  My normal home phone line is VoIP. What then?
  - Splines 10y ago
    I think the fact that a call is coming from a voip service is not necessarily the problem, the problem is that a voip number can be made extremely easily. Some sort of "non-anonymous" score can be assigned a voip number. Paying via a credit card or cheque can attach an address to the voip number. Does this address match the reported home of the caller? Does the IP originate from the same area as the caller? Has this voip number been used by the same account for several years?
    - nemothekid 10y ago
      >Some sort of "non-anonymous" score can be assigned a voip number. Paying via a credit card or cheque can attach an address to the voip number. Does this address match the reported home of the caller? Does the IP originate from the same area as the caller? Has this voip number been used by the same account for several years? So what you are saying is, before responding to a potentially life threatening emergency call, the police should first obtain a subpoena for the relevant data of the VoIP operator? Or are you saying the police should have unfettered access to payment methods, address and names of everyone who registers a VoIP number?
      - ikeboy 10y ago
        Voip numbers that have emergency dialing access should be required to get that information. In fact, they are, so you'll note the article mentions a loophole of calling a non emergency number, then asking to be transferred to emergency services. I don't know how harmful closing that loophole would be for legitimate calls. Can police track how many legit calls were transferred from non-emergency calls, and came from numbers without emergency calling capabilities? Knowing whether that number is negligible or not is important.
smoyer 10y ago
I suspect we'll be seeing a lot of articles that end with some form of "let's make the Internet safer by giving up our privacy and right to anonymity" while the government is trying to pass the anti-encryption bill. Unfortunately, this police officer spent a ridiculous amount of time tracking down someone with no real op-sec skills simply because he wasn't trained to track someone on the web. Note that I agree we need to treat swatting as a serious and potentially dangerous crime ... But what do we do when all the perps are juveniles?
- DanBC 10y ago
  > But what do we do when all the perps are juveniles? We put them through a restorative justice programme.
- jamesbowman 10y ago
  Yes, that is the Guardian's current project. http://www.spiked-online.com/newsite/article/why-has-the-guardian-declared-war-on-internet-freedom/18247 http://www.spiked-online.com/newsite/article/why-has-the-gua...
  - deleted 10y ago
    [deleted]
  - walshemj 10y ago
    Its telling that the Guardian turn off comments on any of the hacked of stories or stories relating to bad behaviour by the press. Afraid you will get called out by your readers for dounle standards maybe
    - jgome 10y ago
      the same "the Guardian" that called their audience "russian trolls"...
- st3v3r 10y ago
  "Note that I agree we need to treat swatting as a serious and potentially dangerous crime ... But what do we do when all the perps are juveniles?" Try them as adults. You cannot tell me with a straight face that someone trying to pull this crap does not know exactly what they're doing.
patcheudor 10y ago
"As Finley demonstrated, it’s not impossible to hunt down suspects who use these technologies – it’s just extremely time-consuming and resource-intensive." Here's the big problem. It can be impossible. If the swatter exercises extreme caution, never registers any device or service in their name, never uses their public IP address for so much as a Google search on "how to swat" and doesn't brag about it online, it is in fact impossible to trace. This makes it tough going into an investigation because you don't know if it's some stupid kid or someone who knows a thing or two about how to remain truly anonymous online. To this point, you'll note there's a common thread in all the stories of this type. It's some stupid kid who gets caught and I highly doubt that's because only kids are swatting. It's because they are catching the dumb ones.
- cmdrfred 10y ago
  I agree, I think most people who comment here are at a level that they could pull it off without getting caught if their life depended on it. Be your method burner phone, bitcoin with a little voip and tor, or something else it's relatively easy to be anonymous enough over the phone to not be worth the effort.
  - pakled_engineer 10y ago
    It's no fun if you swat somebody and don't brag about it afterwards on Twitter/IRC/whatever which will lead authorities straight to them like it has most other criminals.
    - patcheudor 10y ago
      Which gets me to an interesting theory of how the cyber security field really resembles an ecosystem not unlike what is found in nature. For the most part, a lot of what we call the bad guys are just dumb people who get caught, as you said because they likely can't help themselves from bragging about it. They pulled of a "goof" and think it's funny, many times likely not even considering the criminal nature of the act. All of these people who pull of these exploits (swatting is just an exploit that involves the unauthorized use of law enforcement instead of a kernel) and do so in a rather large and obvious way illicit immune responses. Many hundreds of responses with no one event causing significant harm to the total ecosystem. It's our jobs in the cyber security community to react to these and develop ways to stop them before the inevitable "big one happens," in this case the mass swatter who remains anonymous because they are disciplined, but who also has at their disposal a rudimentary AI system connected to an Asterisk IVR server that can make large volumes of automated swatting calls, causing the US emergency response system to grind to a halt. This is where there is a very fine line between tackling exploitation via the implementation of technical controls and legal controls. Because the Internet is global, I'm of the mind-set that controlling it via legislative controls has long since past, therefore we'd better be looking for technical solutions before someone exploits the system en masse to cripple a nation.
csense 10y ago
The question is why it's necessary to have highly militarized police who respond with overwhelming force at the drop of a hat. Oh wait, that's right, the War on Drugs.
- jessaustin 10y ago
  It was fortunate that in this case the target was "a sprawling house in the affluent Atlanta suburb of Johns Creek". Police knock on that house's front door. In other neighborhoods, they simultaneously demolish all doors just before assaulting all the occupants. Just mentioning this in case anyone had forgotten the purpose of the War on Drugs.
fiatmoney 10y ago
The police are the ones deciding how to respond to these (completely unbelievable) calls, and making them face consequences for their actions would be more effective than going on elaborate after-the-fact hunts for the guy that "tricked" them.

67 points by nols 10y ago

The police should take a leaf from Corporal Carrot's book, "[...] a number of offences of murder by means of a blunt instrument, to whit, a dragon, and many further offences of generalized abetting [...]" and prosecute these non-pranks as "assault with a deadly weapon".

st3v3r 10y ago

STOP REFERRING TO SWATTING AS A PRANK. IT IS NOWHERE NEAR A PRANK.

deleted 10y ago
[deleted]
omginternets 10y ago
Your capslock key is broken. Also, it clearly is a prank. A dangerous and reckless one, but the idea is still to have a giggle at someone's expense. I don't see how mischaracterizing the intent of this act will help us fight it.
- DanBC 10y ago
  The intent is to cause fear, alarm, and distress. That's not pranking someone.
  - 5ilv3r 10y ago
    That's actually the whole point.
  - omginternets 10y ago
    >That's not pranking someone. How so? If the people on doling out the calls are laughing at other people's expense, then it certainly is a prank. It's just a tasteless and dangerous one.
    - maxerickson 10y ago
      Prank carries a connotation that the act should not expose the target to actual danger. So swatting is arguably a prank (in the sense you write about) but people don't like the label because it is dismissive of the danger created by the swatting.
      - omginternets 10y ago
        >Prank carries a connotation that the act should not expose the target to actual danger. Says who? Examples of irresponsible and dangerous pranks abound. More to the point, the intent is still to have a laugh at someone's expense which fits the dictionary definition of "prank" quite well: a practical joke or mischievous act. In anticipation of the nitpicking over the term "mischief", I submit the google definition thereof: harm or trouble caused by someone or something. Sorry, but the fact that calling this a prank should get people so upset is really, really bizarre.
        maxerickson 10y ago
        I'm not upset about it and I'm not arguing with you. I simply answered your question. I'm the one saying it carries that connotation for the reason I followed up with. Feel free to think I'm wrong.
- st3v3r 10y ago
  No. There is no fucking way anyone can consider swatting a prank. The one mischaracterizing the intent here is you.
  - pyre 10y ago
    I'd say that the people doing it (and that enjoy watching it happen) are trying to downplay it (to themselves as well as others) by calling it a "prank." It toes the line of actually ordering a hit on someone. The intent is obviously not to kill the target, but I also doubt that the perpetrators would feel any remorse if it ended up in a death (they would rationalize it away as the police's fault, not their own). It's classification as a prank by the (teenager, gamer, 4chan, etc) culture that encourages this isn't helped by the fact that this is just an escalation of other "use a phone call to rain disorder onto someone's life" pranks: * Placing large pizza delivery orders for the target. * For a while you could order free boxes off of the USPS website, and I remember it being a thing where people would get a group to order a ton of boxes and send them to someone. Many people from that sub-culture see swatting as basically the "nuclear weapon" of those types of revenge "pranks." I can't say that I've personally witnessed the escalation to SWAT'ing, but it seems to be people from that sub-culture/mindset that see SWAT'ing as a funny joke to throw at someone that annoys them.
  - omginternets 10y ago
    Then what on earth is the intent?
    - krapp 10y ago
      Attempted murder? Why else would you send a paramilitary force to someone's home, if not to hope they get shot?
      - omginternets 10y ago
        We can call it that too, but it's still still very strange to suggest that we should ignore the motive. The motive is clearly to have a laugh at someone's expense. Where I come from, that's qualified as a prank, and does not preclude the act from also being attempted murder. The extent to which everybody wants to play with words wrt this issue is puzzling.
UVB-76 10y ago
Aren't pranks called "social experiments" these days?
matt_wulfeck 10y ago
Your caps may take a breath in knowing the article actually refers to them as "swat attacks" and not pranks.

elf25 10y ago

Can we use a smidgeon of this grand technology to stop the unwanted telemarketing calling from phone banks, autodialers and robocalls, all of which ignore the 'DoNotCall' screening procedures?

abritishguy 10y ago

With great difficulty it seems.

ikeboy 10y ago

>Complex anonymity tools mean it can cost $100,000 to identify just one hoax caller. >Finley estimates he spent more than a thousand hours tracking down those two teenagers, neither of whom will spend much time behind bars, yet this is a crime that can cost police departments as much as $100,000 per incident and could result in fatalities. The number seems to have been pulled from this sentence, but it refers to the damage caused by the crime, not the cost to investigate. (This seems more plausible than thinking the number came from the thousand hours quote.) So it appears whoever wrote the sub headline didn't actually read the article. Edit: also re costs in crime to allowing anonymity: The stated argument for allowing anonymity doesn't extend to anonymous calling of emergency services. The article points out that such swatters already need to use the loophole of calling a regular number and getting routed to emergency; why not display to that operator whether the call is anonymous, and if so don't let them route it to emergency services? Are there a significant number of legitimate anonymous calls forwarded this way?

metanoetic 10y ago

>Finley used an email address associated with one Skype account to uncover a personal website for the second swatter, whose online handle was Obnoxious. Using that email, he found a page on the text-sharing website Pastebin where one of Obnoxious’s enemies had revealed his name and address. $100,000 OSINT... the police did no 'heavy lifting' in this case

matt_wulfeck 10y ago

It seems to me that a few simple pieces of information can greatly help police departments know if it's a malicious hoax: 1. Is the call coming from a voip service? 2. Can the residence be reached via their normal phone line? A small amount of caution should be used before local (and often times militarized) police forces go busting down doors.

spdustin 10y ago
My normal home phone line is VoIP. What then?
- Splines 10y ago
  I think the fact that a call is coming from a voip service is not necessarily the problem, the problem is that a voip number can be made extremely easily. Some sort of "non-anonymous" score can be assigned a voip number. Paying via a credit card or cheque can attach an address to the voip number. Does this address match the reported home of the caller? Does the IP originate from the same area as the caller? Has this voip number been used by the same account for several years?
  - nemothekid 10y ago
    >Some sort of "non-anonymous" score can be assigned a voip number. Paying via a credit card or cheque can attach an address to the voip number. Does this address match the reported home of the caller? Does the IP originate from the same area as the caller? Has this voip number been used by the same account for several years? So what you are saying is, before responding to a potentially life threatening emergency call, the police should first obtain a subpoena for the relevant data of the VoIP operator? Or are you saying the police should have unfettered access to payment methods, address and names of everyone who registers a VoIP number?
    - ikeboy 10y ago
      Voip numbers that have emergency dialing access should be required to get that information. In fact, they are, so you'll note the article mentions a loophole of calling a non emergency number, then asking to be transferred to emergency services. I don't know how harmful closing that loophole would be for legitimate calls. Can police track how many legit calls were transferred from non-emergency calls, and came from numbers without emergency calling capabilities? Knowing whether that number is negligible or not is important.

smoyer 10y ago

I suspect we'll be seeing a lot of articles that end with some form of "let's make the Internet safer by giving up our privacy and right to anonymity" while the government is trying to pass the anti-encryption bill. Unfortunately, this police officer spent a ridiculous amount of time tracking down someone with no real op-sec skills simply because he wasn't trained to track someone on the web. Note that I agree we need to treat swatting as a serious and potentially dangerous crime ... But what do we do when all the perps are juveniles?

DanBC 10y ago
> But what do we do when all the perps are juveniles? We put them through a restorative justice programme.
jamesbowman 10y ago
Yes, that is the Guardian's current project. http://www.spiked-online.com/newsite/article/why-has-the-guardian-declared-war-on-internet-freedom/18247 http://www.spiked-online.com/newsite/article/why-has-the-gua...
- deleted 10y ago
  [deleted]
- walshemj 10y ago
  Its telling that the Guardian turn off comments on any of the hacked of stories or stories relating to bad behaviour by the press. Afraid you will get called out by your readers for dounle standards maybe
  - jgome 10y ago
    the same "the Guardian" that called their audience "russian trolls"...
st3v3r 10y ago
"Note that I agree we need to treat swatting as a serious and potentially dangerous crime ... But what do we do when all the perps are juveniles?" Try them as adults. You cannot tell me with a straight face that someone trying to pull this crap does not know exactly what they're doing.

patcheudor 10y ago

"As Finley demonstrated, it’s not impossible to hunt down suspects who use these technologies – it’s just extremely time-consuming and resource-intensive." Here's the big problem. It can be impossible. If the swatter exercises extreme caution, never registers any device or service in their name, never uses their public IP address for so much as a Google search on "how to swat" and doesn't brag about it online, it is in fact impossible to trace. This makes it tough going into an investigation because you don't know if it's some stupid kid or someone who knows a thing or two about how to remain truly anonymous online. To this point, you'll note there's a common thread in all the stories of this type. It's some stupid kid who gets caught and I highly doubt that's because only kids are swatting. It's because they are catching the dumb ones.

cmdrfred 10y ago
I agree, I think most people who comment here are at a level that they could pull it off without getting caught if their life depended on it. Be your method burner phone, bitcoin with a little voip and tor, or something else it's relatively easy to be anonymous enough over the phone to not be worth the effort.
- pakled_engineer 10y ago
  It's no fun if you swat somebody and don't brag about it afterwards on Twitter/IRC/whatever which will lead authorities straight to them like it has most other criminals.
  - patcheudor 10y ago
    Which gets me to an interesting theory of how the cyber security field really resembles an ecosystem not unlike what is found in nature. For the most part, a lot of what we call the bad guys are just dumb people who get caught, as you said because they likely can't help themselves from bragging about it. They pulled of a "goof" and think it's funny, many times likely not even considering the criminal nature of the act. All of these people who pull of these exploits (swatting is just an exploit that involves the unauthorized use of law enforcement instead of a kernel) and do so in a rather large and obvious way illicit immune responses. Many hundreds of responses with no one event causing significant harm to the total ecosystem. It's our jobs in the cyber security community to react to these and develop ways to stop them before the inevitable "big one happens," in this case the mass swatter who remains anonymous because they are disciplined, but who also has at their disposal a rudimentary AI system connected to an Asterisk IVR server that can make large volumes of automated swatting calls, causing the US emergency response system to grind to a halt. This is where there is a very fine line between tackling exploitation via the implementation of technical controls and legal controls. Because the Internet is global, I'm of the mind-set that controlling it via legislative controls has long since past, therefore we'd better be looking for technical solutions before someone exploits the system en masse to cripple a nation.

csense 10y ago

The question is why it's necessary to have highly militarized police who respond with overwhelming force at the drop of a hat. Oh wait, that's right, the War on Drugs.

jessaustin 10y ago
It was fortunate that in this case the target was "a sprawling house in the affluent Atlanta suburb of Johns Creek". Police knock on that house's front door. In other neighborhoods, they simultaneously demolish all doors just before assaulting all the occupants. Just mentioning this in case anyone had forgotten the purpose of the War on Drugs.

fiatmoney 10y ago

The police are the ones deciding how to respond to these (completely unbelievable) calls, and making them face consequences for their actions would be more effective than going on elaborate after-the-fact hunts for the guy that "tricked" them.