4 ms·

"As Finley demonstrated, it’s not impossible to hunt down suspects who use these technologies – it’s just extremely time-consuming and resource-intensive." Her

"As Finley demonstrated, it’s not impossible to hunt down suspects who use these technologies – it’s just extremely time-consuming and resource-intensive." Here's the big problem. It can be impossible. If the swatter exercises extreme caution, never registers any device or service in their name, never uses their public IP address for so much as a Google search on "how to swat" and doesn't brag about it online, it is in fact impossible to trace. This makes it tough going into an investigation because you don't know if it's some stupid kid or someone who knows a thing or two about how to remain truly anonymous online. To this point, you'll note there's a common thread in all the stories of this type. It's some stupid kid who gets caught and I highly doubt that's because only kids are swatting. It's because they are catching the dumb ones.

cmdrfred 11y ago
I agree, I think most people who comment here are at a level that they could pull it off without getting caught if their life depended on it. Be your method burner phone, bitcoin with a little voip and tor, or something else it's relatively easy to be anonymous enough over the phone to not be worth the effort.
- pakled_engineer 11y ago
  It's no fun if you swat somebody and don't brag about it afterwards on Twitter/IRC/whatever which will lead authorities straight to them like it has most other criminals.
  - patcheudor 11y ago
    Which gets me to an interesting theory of how the cyber security field really resembles an ecosystem not unlike what is found in nature. For the most part, a lot of what we call the bad guys are just dumb people who get caught, as you said because they likely can't help themselves from bragging about it. They pulled of a "goof" and think it's funny, many times likely not even considering the criminal nature of the act. All of these people who pull of these exploits (swatting is just an exploit that involves the unauthorized use of law enforcement instead of a kernel) and do so in a rather large and obvious way illicit immune responses. Many hundreds of responses with no one event causing significant harm to the total ecosystem. It's our jobs in the cyber security community to react to these and develop ways to stop them before the inevitable "big one happens," in this case the mass swatter who remains anonymous because they are disciplined, but who also has at their disposal a rudimentary AI system connected to an Asterisk IVR server that can make large volumes of automated swatting calls, causing the US emergency response system to grind to a halt. This is where there is a very fine line between tackling exploitation via the implementation of technical controls and legal controls. Because the Internet is global, I'm of the mind-set that controlling it via legislative controls has long since past, therefore we'd better be looking for technical solutions before someone exploits the system en masse to cripple a nation.
x5n1 11y ago
You only have to mess up once and they will get you. If I was a betting man, I would bet against the attacker. However, there is a civil disobedience aspect to something like this that I find intriguing.

cmdrfred 11y ago

I agree, I think most people who comment here are at a level that they could pull it off without getting caught if their life depended on it. Be your method burner phone, bitcoin with a little voip and tor, or something else it's relatively easy to be anonymous enough over the phone to not be worth the effort.

pakled_engineer 11y ago
It's no fun if you swat somebody and don't brag about it afterwards on Twitter/IRC/whatever which will lead authorities straight to them like it has most other criminals.
- patcheudor 11y ago
  Which gets me to an interesting theory of how the cyber security field really resembles an ecosystem not unlike what is found in nature. For the most part, a lot of what we call the bad guys are just dumb people who get caught, as you said because they likely can't help themselves from bragging about it. They pulled of a "goof" and think it's funny, many times likely not even considering the criminal nature of the act. All of these people who pull of these exploits (swatting is just an exploit that involves the unauthorized use of law enforcement instead of a kernel) and do so in a rather large and obvious way illicit immune responses. Many hundreds of responses with no one event causing significant harm to the total ecosystem. It's our jobs in the cyber security community to react to these and develop ways to stop them before the inevitable "big one happens," in this case the mass swatter who remains anonymous because they are disciplined, but who also has at their disposal a rudimentary AI system connected to an Asterisk IVR server that can make large volumes of automated swatting calls, causing the US emergency response system to grind to a halt. This is where there is a very fine line between tackling exploitation via the implementation of technical controls and legal controls. Because the Internet is global, I'm of the mind-set that controlling it via legislative controls has long since past, therefore we'd better be looking for technical solutions before someone exploits the system en masse to cripple a nation.

x5n1 11y ago

You only have to mess up once and they will get you. If I was a betting man, I would bet against the attacker. However, there is a civil disobedience aspect to something like this that I find intriguing.