Hacker News new | past | comments | ask | show | jobs | submit login
Teen Arrested for 30+ Swattings, Bomb Threats (krebsonsecurity.com)
98 points by hackthisuk on May 12, 2014 | hide | past | favorite | 95 comments



If it's that easy to get a swat team beating down some innocent persons door then I see bigger problems than a teenager making prank calls.

Anonymous phone calls should not lead to people potentially being killed.


What, from the police's perspective, is the alternative?

If they get a credible report of a dangerous situation, they have to take it seriously. The clock starts running the moment their phone rings, so they have limited time for countermeasures.

I surely hope they're doing their best to prevent obvious fakes from getting through. They have the incentive; getting pranked by a 16-year-old makes them look like idiots. And I really hope that their procedures and training mean that they're well prepared for situations where they caller was lying, confused, panicked, or just mistaken.

But I think mere anonymity shouldn't discourage them much. For a lot of people, calling the police is a complex calculus of risk. Are they safe from the police? Are they safe from retribution from criminals? Are they inviting too much trouble for others? [1] People being anonymous may not be a great sign of a false report.

[1] E.g.: http://tressiemc.com/2014/05/02/calling-the-white-mans-polic...


For one you'd think that the point of termination of the call would have to be near the place where the crime is supposedly taking place. If that's not the case then the default should not be to go in with guns blazing but to use the time in flight to further verify the veracity of the report.

After all, what are the chances of someone reporting a hostage situation from a point of termination in another country, state, county or even town from where the hostage situation is taking place? Such information should be treated as hearsay at best.


Why do you think they can tell? I doubt they can tell the difference between Ooma users, let alone the difference between an Asterisk user on that block versus anywhere else.

Also, I hope they don't go in guns blazing regardless of the report. A troublemaker could just as well be on the block as elsewhere.


It's tricky, right? What percentage of anonymous calls are swattings vs. actual hostage situations? It's a dangerously easy tactic, but I still would guess that it's rare relative to actual calls that require a quick response.

Certainly, law enforcement needs to be thinking hard about how they response. But it's not obvious to me, as an outsider, how to handle this.


After reading the article, it looks like police departments are learning, and it's getting less easy.


He wasn't always this lucky, even after reporting the possibility of a swatting at his location to the police before: http://krebsonsecurity.com/2013/03/the-world-has-no-room-for...


There is zero discussion of accountability for the cops in any of these situations. If they are so easily tricked, they need to either scale back the militarized force they are allowing to be abused, or become more skeptical about these threats.


Krebs notes in TFA:

"I received a phone call from the local police department. It was early in the morning on Apr. 10, and the cops wanted to know if everything was okay at our address.

Since this was not the first time someone had called in a fake hostage situation at my home, the call I received came from the police department’s non-emergency number, and they were unsurprised when I told them that the Krebs manor and all of its inhabitants were just fine."

At least in his part of the world, it seems the cops are exercising a healthy level of discretion.


Please read the link from TFA (linked in the very quote you gave, even) about how previously Krebs opened his door to a large contingent of officers with handguns, shotguns, and assault rifles pointed at him.


Indeed. So last year they were tricked (easily), and they are now more skeptical about these threats. This correlates with my response to the parent.


Unfortunately, that isn't an option at all, because the one time they are skeptical wrongly can result in bad shit. The same way that the fire department has to respond to every single fire alarm, even when they are false alarms. You can't choose where you go or what you do when it comes to people's safety.


Actually there are many cases where the police completely ignore calls for help and courts have found that police have absolutely no responsibility to protect individuals.

The police do however love opportunities to justify large expenditures and fancy equipment.

Many courts have upheld this principle:

BARILLARI v. MILWAUKEE http://www.leagle.com/decision/1995441194Wis2d247_1431

https://en.wikipedia.org/wiki/Warren_v._District_of_Columbia The Court explained that "[t]he duty to provide public services is owed to the public at large, and, absent a special relationship between the police and an individual, no specific legal duty exists."


No one would ever be a police officer if police officers were liable for damages every time they were unsuccessful in protecting someone. This is perfectly reasonable.


I completely agree. It is every individual's responsibility to protect themselves. The police have no obligation to protect the public.


No, they do have an obligation to protect the public in general. That's the point of police.

What they don't have is financial liability for the death of every specific person they aren't smart/fast/legally empowered/well-funded enough to save, because that would be unreasonable.


> No, they do have an obligation to protect the public in general.

I see your point but I think it's a pretty arbitrary one. Have a police force every been held legally accountable for failing to protect the public? The case law that the police have no particular obligation to protect individuals is well established.

What does it mean to have an obligation to protect the public when the public is made up of individuals and the police have no particular obligations to protect individuals?


"can result in bad shit"

Lots of things can result in bad shit--but we seem to be looking at the civic equivalent of rheumatoid arthritis.

If a fire department shows up without need nobody is put in prison, shot, assaulted, or has their dogs killed.


> The same way that the fire department has to respond to every single fire alarm,

I discovered this isn't true, at least not in Lowell, MA (a bit north of Boston, MA). A few years ago I bought a 3-family rental property. There was a big blizzard that froze the badly insulated water pipes in the house, which resulted in the pipes bursting on the 3rd floor. That caused what amounted to a waterfall inside the 2nd and 1st floors.

When I arrived, the fire alarms were on. I was going to head down to the basement to turn off the water main but then I realized I had no idea where the water main was (I had just bought the house) and I figured that venturing into a dark basement full of water with live wires running everywhere probably wasn't the brightest idea.

So I called 911, explained the situation, and waited. They told me they'd "send someone". 20 minutes went by. The waterfall was still going. I called again. They told me they'd send someone. 10 minutes went back. I called a 3rd time and was told "they're busy clearing snow from fire hydrants around the city". I happen to be standing next to a light switch in the house and I happened to smell something that smelled like smoke. "But I smell smoke", I said to the dispatcher.

"Smoke?!", she replied. "We'll send someone immediately."

And within 3 minutes I had a dozen firefighters in the house.


You reported a flooded building and they didn't send anyone. You then reported the hint of a fire and they sent out people very quickly.

Your anecdote seems to support the statement "the fire department has to respond to every fire alarm".


> When I arrived, the fire alarms were on.

And I explained that to the dispatcher.


A fire in a flooded building?


Sure, these are not mutually exclusive. Fire burns upward, heat rises. Water floods downwards. They won't cancel each other.


I think police regularly (have to?) pick and choose where to go, more so than firefighters. I know from friends and anecdotally that e.g. reporting a domestic violence situation in a poor neighborhood is certainly not gaurenteed to get the cops out.


Yeah, they will. The problem is, that's going to result in seriously bad things when a genuine hostage situation arises, the police don't get involved, and a bunch of people die.

It certainly looks as if the situation was pretty well handled in this particular case.


[deleted]


You do realize this happened in Canada, right?


The swatting incidents were in the US.


Thank you for the correction.


Currently in the US when you turn 18 you end up "losing" your juvenile criminal record. A proposal I read that made sense was keeping the juvenile record hidden unless you end up committing a serious crime after 18. Once that happens your juvenile record is opened up again. At least that's an incentive to play it safe after turning 18.


That isn't really true, and a lot of adults learn this if they got into trouble as kids. The juvenile system has a bent towards privacy, but that is all it is -- a bent.

You can either have your juvenile record "sealed" or "expunged" but neither is automatic.

Asking for your records to be sealed is possible a number of years after the conviction dependent on location. In most places it is 3 years of no offenses except minor traffic violations and you can request getting juvenile records sealed.

Asking for expungement is much more restricted and not even available in most locations. In the rare places expungement is possible it is a long and involved process.

Now, here is what sucks more -- getting your records sealed may seem like the obvious choice -- you don't want that shoplifting thing following you around. But, if someone pulls your record and sees "sealed" they are likely going to think you did something FAR worse than shoplifting.

Additionally, sealed records don't mean "from everyone forever" -- those suckers can pop up in adult trials if they fit a pattern, if they should apply to sentencing or just if the judge thinks they should.

Don't fuck up too much when you are kid, it will haunt you.


Also there are certain federal agencies which are able to look into sealed (and even expunged or pardoned) records, such as USCIS.


Ah interesting - thanks for clearing this up. Yea that "sealed" record issue seems odd - I would expect it to be more along the lines of not being available rather than sealed so the requester doesn't actually know that a record actually exists.


If the "normal" punishment is not enough to deter that person, why do you think re-opening juvenile record would made any difference?


You're probably right but I think the cost of implementing this is low enough to give it a shot. It's not going to solve the entire problem and may not even solve 1% but might still be worth doing for the scenario where it does help.


In the UK 17 is a golden age for crime and getting away with it. IANAL, however, I think that you are not an adult in the eyes of a court of law, yet, being over 16, mummy and daddy do not have to be told - so no beatings at home and no prison cell/fine/community service.

Fortunately most teenagers don't know about the relative benefits of being 17, but, if you decided that making an honest living was for losers and that a life of crime was worth giving a go, that year of being 17 is the best time to do some 'apprenticeship'.

Is this the case in the U.S. and Canada?


I've heard of many cases in Québec, where if the crime is judged severe enough, a 16-17 yo would end up being treated as an adult instead of going through juvenile courts.


I think it varies from state to state, but I know in the state of South Carolina one is considered an adult at 17 in court for some reason. I think the prosecutor can also choose to charge you as an adult if the crime is serious enough.


"Fortunately most teenagers don't know about the relative benefits of being 17, but, if you decided that making an honest living was for losers and that a life of crime was worth giving a go, that year of being 17 is the best time to do some 'apprenticeship'."

Sure, but which banks are hiring 17-year-olds as executives? ;)


Even if the legal system pretends they never happened, there is no requirement on other people in the US to pretend you never did those things. Which is both good and bad.


It might make sense but it makes it even more difficult for them to find jobs. People who commit serious crimes generally don't think rationally, so incentives don't help much.


"People who commit serious crimes generally don't think rationally"

This, exactly.

I don't know why so many people seem to think tougher prison sentences/three-strikes laws, etc. will deter much crime. If you're going to commit a crime, you've already convinced yourself that you're going to get away with it.

I think people like to think this way because it's so much easier than trying to solve the problems that lead to crime in the first place.


> I don't know why so many people seem to think tougher prison sentences/three-strikes laws, etc. will deter much crime.

Not only that, but once you go to prison, at least in the United States, you'll likely go again. Going to prison makes you unemployable, makes you lose certain federal assistance, and leads to close contact with gangs. When you finally get out, you often won't even be able to vote, you can't find a job, and you'll probably get evicted. You're pretty much a second-class citizen at that point, worse off than you were before. If we want people to commit fewer crimes, prison should be the last resort (at least for non-violent offenders), not the first step. Better alternatives exist: http://en.wikipedia.org/wiki/Recidivism#Drug-Related_Crime


I'm pretty far removed from this world of crime and only relay what I read coupled with my biased experiences but I suspect crimes build on top of one another. If you get away with a small crime earlier you'll end up breaking the seal and moving on to higher risk crimes. If you keep on getting away with it you end up taking on more and more risk. At the same time there are not enough resources to enforce a low level crime so fixing the underlying problems is a much better idea.

If you're interested in this topic take a look at When Brute Force Fails (http://www.amazon.com/When-Brute-Force-Fails-Punishment/dp/0...) - I found it a good take on crime in the US.


It's interesting to see him named in the article - since he is under 18 in Canada he will be protected by the young offenders act and cannot be identified in the media. I suppose that is only applicable for Canadian media outlets.


Where's the line between "the media" and "people personally involved"?

For example, if a 14 year old comes up to me on the street and commits a crime (e.g. he mugs me) and I know his name, would I not be allowed to tweet "just got mugged by <his name>"?


[deleted]


You might tweet it if you did not believe that you'd get any results from reporting it to the police (or already did report it and got no results).

For example, when stopped at a red light on my bicycle in Brooklyn, a van intentionally (and maliciously) bumped my rear wheel from behind. The local precinct was two blocks away so I went there with the guy's license plate number. The police declined to file a report, telling me they wouldn't be able to verify who the actual driver was given only the plate number (and time, and description, and a second eye witness). If Twitter had been a thing back then I may well have tweeted about it.


Serious question here, what do you hope to accomplish by Tweeting something like this? Vigilante justice from fellow bicyclists?


Outing non-responsive public services/companies/etc. on social media gets a reaction these days if you get some traction with re-tweets etc.


I really have very little sympathy for him. Plenty of people have issues at home, and they don't go on a spree, taking up valuable time from emergency services and causing grief to innocent people.


Whether he is a nice kid or an asshole has nothing to do with how laws against revealing his identity apply.


are victims under the same restrictions as the press? What if they are the same as in this case?


My guess would be that it doesn't matter. The relevant text seems to be [0], and it focuses on the act of publishing, not on who does it.

Being a victim doesn't give you any particular rights to publish this information. But the law says nothing about merely telling it to all your friends. And if you're walking the line between these two, it's probably better to talk to a lawyer before speaking.

[0] http://laws-lois.justice.gc.ca/eng/acts/Y-1.5/page-45.html#h...


Then I would say a bit of extra restraint would be appropriate. Especially if the victim has a habit of trying to engage the perps and has set himself up as an extra visible target. Imagine Billy the Kid picking fights with every kid with a gun (yes, sure it would happen the other way around as well but Krebs is doing everything to fan the flames).

It's a fine line between crime and entrapment, so when your business depends on having these crimes happen to you then you should be extra careful in how you go about dealing with the perps identities, especially if they are minors.


From the first paragraph:

> A 16-year-old male from Ottawa, Canada has been arrested for allegedly making at least 30 fraudulent calls to emergency services across North America over the past few months.

Emphasis mine.

I would agree with you were the "allegedly" missing, and if instead of "arrested for", it said "convicted of".


In the US allegedly or not, is besides the point. Everyone confesses and 'takes the deal', guilty or not.

"For 2011, the US Department of Justice reported a 93% conviction rate." http://en.wikipedia.org/wiki/Conviction_rate


The high rate of convictions for US Attorneys vis a vis state and local prosecutors stems from the higher level of prosecutorial discretion they enjoy. Basically US Attorneys only prosecute slam dunks. From the same source, you'll not that Florida for instance only has a 59% conviction rate.


As others have pointed out, it's hard to make any conclusions from a high conviction rate.

Prosecutors are only supposed to prosecute people if they think the person really did it, and if they think they can convince a jury.

Prosecutors aren't supposed to prosecute "just to find out what happens."


Is that a sign of innocent people pleading guilty or a sign of an efficient judicial system? Got any stats to back up your inference that there are significant amounts of innocent people just pleading guilty? I'm not really sure what the point of your post was, but I don't have the ability to vote it down as irrelevant.


That doesn't have ANYTHING tto do with the grandparent's comment.


I am a bit ambivalent about all this. Krebs makes his living by picking fights with people and then writing about it so if you engage him you shouldn't be too surprised to find your name in print. That said he's a bit too eager about it all, there is a 'bring it on' attitude that makes me wonder if most or any of the things that Krebs has happen to him would happen if he didn't make such a circus out of it.

It's a bit like a big bruiser going downtown to the clubs and trying to pick fights with every drunk and then bragging later about how many he bagged.

And to post the name of the kid before he's convicted (assuming he will be convicted) is out of line and possibly even illegal (he's a minor after all).


Isn't it more like a big bruiser going down to the shady part of town and trying to pick fights with the muggers and drug dealers?

Most of Krebs' targets are carding rings, crackers and other Internet fraudsters and criminals. These aren't clueless people being dumb, these are usually bad people (allegedly) doing intentionally bad things to innocent people..

Also, the kid's name was in the already-published DOX that he linked to in his article. It's not like he was responsible for "outing" this kid's details....


Or maybe because of Krebs' notoriety he gets lots of playback from these thugs trying to boost their street cred by pulling one over on him. Its a high risk/high reward game for the thugs, and their egos are blinding them into jail terms.


Since Krebs doesn't live in Canada, what illegal act may he have committed?


The kind that crosses an international boundary but doesn't involve millions of dollars or major political embarrassment for either nation and therefore will never be fairly adjudicated in this generation. ;)


I'm glad that this trend didn't reach Austria, because as annoying as it may seem, swatting can result in deaths of innocents, if the cops are trigger happy or the victim fears that (possibly armed) robbers are breaking into his/her home.

This kind of hoax should be punished harshly, even for 15-17 year old juveniles.


What punishment do you recommend?


Something up to and excluding the punishment equivalent for negligent homicide.

... and that restriction only to avoid the calculus where the punishments are equivalent, so someone getting their jollies by ordering armed responders to an innocent person's house might as well go drop rocks from the local overpass instead.


Why ask? This is why we have a judicial system. It may be (very) unfair in some cases, but for the most part they are there to dole out appropriate punishment.


Ten years of community service. :)


life imprisonment


> "According to the FBI, each swatting incident costs emergency responders approximately $10,000." (from the article)

So $10k each, and 30+ times: Make him pay that $300k back.


Oh, I'd really like to know where they got that number from first.

If it includes the salaries of the officers involved, by allocating the man-hours consumed by each response, then that number needs to be lowered.

I'll accept the fact that vehicles consume gallons per mile in gas, and that private residences have to repair busted down doors and damaged sheetrock, and maybe if some other expendables were used, if say some shots were fired and it cost 50 cents in bullets, but the officers would have been on the clock anyway (overtime or no), and the taxes are already budgeted for salaries.

Did the counties get sued by the swatted? If that's the source of the number, maybe he owes a large percentage of that, but then again, maybe the lawsuit has a point and how swat teams respond to prank calls should be changed?


It's not just the monetary cost.

Every time first responders of any kind are deployed there is an inherent risk to their lives.

First responders have to drive fast to get to their destination quickly. SWAT teams are heavily armed and accidents do happen. Innocent bystanders could get shot, pets could get shot, other officers could get shot in a confusion. They might get called out on a prank call but end up finding a sovereign citizen freeman-on-the-land at home who hates the government and is willing to get into a firefight anyway.

All these things are potential liabilities on the department, not to mention the danger of having your entire SWAT force deployed to a prank call while there's a real incident on the far other side of town and not enough time to get there.

So yeah, we can argue about the cost as long as we want, but at the end of the day the primary cost on the minds of the police departments are these dangers, and the actual price tag quoted by them must take these into account.


That's exactly why they should be more circumspect when busting down citizens' doors. It's just irresponsible to allow this kid to cause this much damage.


Consider this situation (numbers fictional):

1. It costs 10 dollars an hour to keep a cop on active duty.

2. You need 10 cops to handle a specific region based on the fact that you receive 10 incidents a day.

3. You now get an additional 2 fake incidents a day but you don't know which of the 12 incidents are fake.

4. You therefore need cops to check out these incidents. You must hire them.

5. Your cost of operation goes up.

Lesson #1: There ain't no such thing as a free lunch.


$10k for a major incident sounds in the right ball park including what a couple of SWAT fire teams plus say another 8-12 ordinary coppers to form a cordon.

Plus there might have call out off duty cops on overtime to cover and then there is the paperwork and reports which will have to be written up and analysed.

Plus there is the cost of damage to property, disruption to traffic and so on.

Plus the host of investigating the hoax


Don't forget all the time required to write up all the reports, I'm sure there's a crazy amount of paperwork after an incident.


Bureaucracy is very expensive.


Bureaucracy is very expensive.

But sometimes, accountability makes it worth the expense.


I think a large part of that cost could also be in the paperwork after the event also


You joke... but it happens.

http://nypost.com/2014/04/23/fbi-helping-to-find-call-of-dut...

Kid now is getting prosecuted with $100,000 in fines for his swatting attempt.

    The caller could face multiple charges and may also 
    be required to foot the bill for Tuesday’s police 
    response, which is estimated at $100,000.


I wasn't joking. He should have to pay back the 'damages' or 'pain and suffering' or whatever terminology you would like.


Here is why that won't happen: It makes the PDs look incompetent and liable for running dangerous heavily armed raids on private homes without sufficient care taken to avoid exposing innocent people to violence and potentially deadly errors.


As good a place as any to drop Mr Balko's opus: "Rise of the Warrior Cop: The Militarization of America's Police Forces" which is all about this kind of madness.

http://www.amazon.com/Rise-Warrior-Cop-Militarization-Americ...


+ pay for any damage caused by SWAT response

+ punishment for exploiting the state


He'd only have to sell 10,000 fullz at $30/each.


Two things strike me as sad:

1) This type of reckless, non-violent, anti-social behavior in young males has been quite common for all of recorded history. It's a shame it has to involve so much money and international crime nowadays.

2) We remember everything now. No more can you do some bone-headed thing in your teens that cost 400K and got you sent to juvenile hall for a year, then move on with your life. Now it's all over the interwebs.

I feel sorry for the guy. Don't get me wrong: this was a lot more dangerous than it seemed to him, and something had to be done. Still, as the author points out, this is a shame.


Is it really "non-violent" to make the cops think there is a hostage situation going on?


Fair point, and I debated making that statement.

I do not believe this kid was purposefully being violent. I do believe what he did could have had terribly violent results. But until I receive additional information to the contrary, I'm going to assume that he was engaged in a prank -- a very dumb prank.


Where did all that personal info on the kid come from?


There's a link in the article - looks like the kid also managed to irritate a slightly more competent black hat crew who dumped all his personal info onto Pastebin.

But in general, BK is a very competent journalist who is often able to reconstruct the identities of people in the Russian cybercrime underground. An obnoxious, pimply adolescent in Ontario was unlikely to present him with much in the way of a challenge.


Yeah I saw the pastebin dump. I was more asking specifically how does such a large amount of person information be dumped like that.


I guess the answer is that there are ways of finding such things out, that I'd rather not even think about. If you're the sort of person who calls out SWAT teams to people's houses and then brags about it on Twitter, then you're probably going to be found out - either by more serious black hats, or someone like Krebs.


Its sad that most of the time the parents are to blame.


And all of the time the kids are to blame.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: