The first 911 call came at 4.30pm. The caller told dispatchers that a man, woman, and boy had been shot and another child was being held hostage. Police responded in force, sending more than half a dozen cruisers and emergency vehicles to a sprawling house in the affluent Atlanta suburb of Johns Creek.
But when they arrived there were no signs of a shooting; inside, police found a nanny with two small children. When the mother returned from shopping she found her home surrounded by emergency vehicles. The father, who had been on a plane, landed at Atlanta’s international airport to see his house on TV, with news reports declaring that his wife and children had been shot.
They were victims of a swatting attack, a malicious form of hoax where special weapons and tactics (Swat) teams are called to a victim’s home under false pretenses, with potentially deadly results.
Just more than a week later, on 25 January 2014, someone launched a second swatting attack on the same home. This time the Johns Creek police were prepared: they responded with two cruisers to make sure everything was OK.
DS Ben Finley was assigned to the case and was told to do whatever it took to find the people who did this. It would take him on a circuitous voyage that lasted nearly a year and involved dozens of local law enforcement agencies, the FBI, and the Royal Canadian Mounted Police.
It’s a case that demonstrates just how difficult it is to track down and prosecute online harassers, thanks in part to the ease with which malicious individuals can operate anonymously on the internet, and a legal system that is still playing catchup to 21st century technology.
“When I started out I had never worked one of these cases and had no idea what to do,” says Finley, an amiable man with a buttery Georgia drawl. “I called anyone I thought might know anything about these types of investigations. I would just take each piece of the puzzle and see where it led me. I was baptized by fire.”
Finley started by tracing the numbers the swatters used to call the Johns Creek emergency hotline. Because calling 911 only connects to local emergency services, swatters in distant locations call non-emergency lines and ask to be transferred. To mask their true locations, they use voiceover-IP (VoIP) numbers that appear to be in the same area code as their intended victims.
In late January 2014, Finley issued subpoenas to a half dozen major VoIP providers, obtaining the numbers the swatters had called, logs detailing when each call had been made, and the email addresses and websites swatters used when signing up for VoIP services. Over the next few weeks, Finley scanned the list of numbers looking for those characteristic of public police lines – such as 877-ASK-LAPD – and talked to the dispatchers in each city.
Tracking them down was a hell of a task
Ben Finley
Sure enough, they had received emergency calls on the dates and times in question. Finley then went to the victims of the swatting attacks, some of whom were already working with local law enforcement, and obtained their details. Over the next year he filled a conference room at the Johns Creek station with boxes of police reports, victim affidavits, and audio recordings.
“A lot of the IP addresses that were generated through the subpoena and court order process were from virtual private networks and proxy sites all over the world,” Finley says. “Tracking them down was a hell of a task.”
At first, Finley says, he was looking for a single perpetrator. But the paths he followed kept diverging – the first call pointed toward a person in New York, the second indicated a swatter in Canada. As it turns out, the second attack was a copycat of the first, which had received broad media attention.
Finley caught a break when he traced the calls from swatter No 1 to a cloud services firm in New York, to whom the swatter had given his real name and address. When Finley contacted local police, he discovered this individual had been linked to similar crimes in the past.
He was a 16-year-old active in online gaming circles, where swatting is a common malicious prank. Finley doesn’t know why swatter No 1 targeted that family in Georgia, but he believes it was a mistake – the location was the former address of another teenager who was a highly visible gamer on YouTube. The Fulton County district attorney agreed to transfer prosecution of the case to the swatter’s local jurisdiction, where it is still pending.
Finley used an email address associated with one Skype account to uncover a personal website for the second swatter, whose online handle was Obnoxious. Using that email, he found a page on the text-sharing website Pastebin where one of Obnoxious’s enemies had revealed his name and address. According to that page, Obnoxious was a minor living in Coquitlam, British Columbia. When Finley called the Royal Canadian Mounted Police (RCMP) in Vancouver, they knew exactly whom Finley was talking about – the youth was already on probation for similar crimes.
With the help of the FBI, Finley pored over the mountains of evidence, eventually connecting Obnoxious to more than 40 incidents. (He was also the subject of a New York Times magazine profile, The Serial Swatter, in November 2015.)
“This kid was unbelievable,” Finley says. “He was calling everyone and everything – schools, businesses, private residences, law enforcement, the FBI’s weapons of mass destruction hotline, even Disneyland. Nothing was sacred to him.”
In November 2014, the RCMP asked Finley to send him evidence for the strongest 10 cases he had built against Obnoxious so they could obtain a search warrant for his home.
Then Obnoxious decided to take his act public. On 1 December 2014, he live-streamed swatting two homes in Ohio on YouTube, boasting about it first on Twitter. The parents of one previous swatting victim saw it and called Finley, who then notified the RCMP. Four days later, the 17-year-old was arrested. In May 2015 he pleaded guilty to 23 counts of extortion, public mischief, and criminal harassment; he was later sentenced to 16 months in youth custody and was due to be released in April 2016.
That is, imho, a very light sentence for all the work it took to track him down! Still atleast they can track these guys down, so that is good to know.