A Runescape player was recently swatted while 60,000 people watched. When he tried to record a video about it, he broke down crying. A 19-year-old in Las Vegas was arrested for coordinating a swatting in Illinois. What motivates someone to take this dangerous step? I tracked down a self-professed swatter to find out.
How I got to that point requires a little setup.
One of my first stories at Kotaku was about a couple recounting their terrifying experience of being swatted while their three children were home with them. Swatting, if you don't know, involves a call being made to police about a violent but imaginary crime. That incident shared a common thread with other swattings: the use of someone else's personal information without their permission. To avoid being swatted, you'd want to keep your personal info offline as much as possible. As a follow-up, I researched ways to learn what parts of our lives are already online, and I published a piece outlining how to remove those items from the Internet.
When that second swatting piece went live, it wound up on the Twitch subreddit. A commenter by the name of ZeroExFF spoke up and said he helped organize several swattings in the past. He then described how he and others had used various techniques to obtain detailed personal information about folks using the customer service departments of PayPal, Amazon, and others.
The techniques ZeroExFF claimed to use are more commonly referred to as social engineering, as it requires tricking a human being to reveal information. Everything he said lined up with what I'd reported about social engineering in the past, and his admission piqued my interest.
When we discuss swatting and other forms of harassment, we understandably focus on the feelings and reactions of victims. We often forget to question the motivations of the harasser. I wanted to know more about that, and I hoped ZeroExFF could explain.
I messaged this self-professed swatter, and he quickly got back back to me. He created a new account on Skype, and we talked for about 90 minutes. What he told me was surprising and revealing about the psychology driving those who spend their time tormenting others on the Internet.
I do not know this person's name, but he claimed to be 16 years old, and he sounded young to me. He said his descent into the Internet underground began when he was 14 years old. Due to, he said, fears over potential legal action for events he was involved in over the past few years, ZeroExFF would not reveal specifics about his actions or disclose details about his life. The irony is not lost on me.
So there's a big caveat to all that follows. I can't prove its true. I can't prove that the stories he told me about how he'd deceive people to get personal information are real. I nevertheless believe it's important to try to understand this murkier side of one of the most notorious and dangerous forms of modern harassment. What follows is an attempt to get a more clear picture.
I ran excerpts from this conversation by several cybersecurity experts, all of whom told me ZeroExFF very much sounded like an individual who knew what they were talking about.
In his own words, here's what he told me.
Warning: There is some strong, potentially offensive language ahead.
Being able to intimidate someone is really fun, whether someone will admit it or not.
I'd get bored and wanted to see if I could trick X service into giving me Z information by doing Y type of call. It was a game to me. I found it fun. I never really released doxxes. I didn't see the point of it. I didn't care. I found it fun tricking the system into giving me information. I felt all-knowing, which is a feeling that a lot of people crave. I felt like I was something special. Not everyone could do this. And it's true! Not everyone can. You're gonna get someone who's just got a fucking terrible knack for it that can't do it, but I'm definitely not special for being able to.
I had that craving of feeling like the smartest person on the call or the smartest person in the room. I had that craving for it. I'm like that in real-life. Honestly, I surround myself with people who are actually really smart. My best friend in the world right now is probably one of the smartest fucking people I know. Again, it's that superiority thing, that you want to be better than people. I thought that would make me better than them. When, in reality, it put me quite a few pegs down. I was this immature kid who wanted to be known. Someone's going to be like "Well, they got bullied in their own school." No. Most of these people were probably the fucking class clowns and loved in their school.
I was learning Python [a programming language] about two years ago, and I ended up in this IRC [channel]. I don't want to call it the scene because that's what everyone's calling it, and it's not a scene. If it's a scene, it's a scene full of retards—self-proclaimed retards, too.
I had a question about the streamer I was watching at the time. I forgot how long it was. This was when Twitch.TV still had their old site design. They just added me to this group call with a few other people, and they were calling an ISP [to get information]. And I went, "OK, that's cool. That's interesting how that happens." I was already aware of it, but I had never been in a call with someone who did it. Honestly, I didn't care. I thought it was petty and stupid, and it is petty and stupid.
I guess they needed another one called in, so they were like "Hey, wanna do it?" And I was like "Sure, I'll do it." It was really easy, and it was fine.
It's like asking a girl out when you don't care, which is also something I did in high school before I left. A lot. My friends would give me $10, and I would just run around asking girls out, who I know would say no. Or breaking up with girls that I'm not going out with publicly. That's funny.
Having the voice is a big part of it. You need to be able to have a representative voice, right? You need to have the proper voice inflection. And I was just-so-lucky to work for DirectTV [through an external third-party service] for a year or two. All I did was talk to retards all day. I don't know if you've ever had a job where you answer phones, but the inflections that you use in your voice are much different than your everyday talk. It's that you want to appear as though you give a shit. Once you have the inflection down, and once you have what tools they use—which are public—you do anything.
I was calling COX for a friend. I called it in at four in the morning my time. The girl was like "COX chat support is currently closed, sir." I was like "Yeah, I'm residential, I take my work really seriously." And she was like "Oh, okay." And I got it [the info] anyways. It was so dumb.
I think COX or Time Warner started to implement this fraud protection, where if someone asks for any information over the phone, they'll just supervisor.exe, which is what we call getting a supervisor on you. If you get supervisored, you're fucked. You're not getting anything. You need to call back.
You can fuck with a supervisor. I got a Filipino supervisor once, and I fucked with him a little bit. I didn't get any information from him, but I offered to suck his dick for the account number. The guy started laughing. I basically fucked with him for 20 minutes about how I'd give him a hand job. I was just sitting there. Everyone was at my house and was just listening to me. "I will suck your dick for the account number." My brother's just looking at me going "What the fuck are you doing?" Maybe he wanted the dick sucking. I don't know.
The exploits are anywhere you give your money. Those are the holes. Anyone you give your money, anyone who has your phone number, anyone who has your address—they're exploits. If their support line is based on human interaction, it's super easy.
I can call any ISP in the world, or I can get on chat support with any ISP in the world. We can get the tools they use. That's what you need to do before you call an ISP. You call them, and you say "Hi, my name is Richard, I work out of this region. This is my first day. I wasn't really listening to what my manager had to say. What is the tool to look up modems? Modem activity?" Stuff like that. Most of the time, they'll just give it to you. You ask them for their name and employee ID [EID], just to verify they're an actual employee is what you say. Most of them will believe it. "Oh, it's just this guy's first day. He doesn't know what the fuck he's doing. What's he going to do with my EID?" But then you call and say "Hi, my name is Elizabeth Wallace. My EID is 20657. Can I please get an IP lookup done? My workstation's having issues."
Most agents, I know more about the program than they do. I have to guide them through it in order to look up an IP. You don't need to be megamind, basically. That's the entire point of what I'm talking about. You can be retarded to do it.
It's really fun. Not to mention, to people who don't know any better, it's impressive. You can make money off it because they don't know they can just go and do it themselves. You can call any ISP left and right for $10 each. You can give them the information. I had a stipulation, though. If I called anyone's ISP and gave them their information and they had a SWAT team at the house within the next month and I was contacted by the police, I would give them their information—the person who bought it.
I didn't always condone swatting. I always thought it to be really immature and really kind of petty. That's why I didn't participate in it as much. The only times where I did—and I haven't done it in a while—was when I just had this uncanny hatred for them.
The first person ran around Minecraft servers getting kids on Skype, promising to give them items. Once he got them on Skype, he would dox them, get their parents on the phone, and basically try to trick their parents into sending them money. [pause] He was exploiting 8-year-olds for their parents' money. I didn't consider myself the fucking Batman of swat teams, but at the same time, he was getting recognition for it, which also bothered me. What's the police department going to do? No one knew his name at the time. Very few people actually go down. You don't get recognition for exploiting eight-year-olds. I'm sorry. You're not getting that, that's not gonna happen. There's no way. On top of that, you're exploiting eight-year-olds. That's so unfair.
Sure, it's one thing to mess with a teenager girl or a young, adult woman. That's one thing that's kinda fucked up. They're old enough to understand what's going on. They're old enough to understand that they can get past it. But an eight-year-old? Sometimes it was an eight-year-old girl. They're crying. That little kid thinks their life is over. They're done. Their Minecraft account's stolen. He would basically just exploit their parents—exploit them to exploit their parents to get money. It would work.
Your voice doesn't matter when you're swatting people. I mean, it matters to an extent, but the amount of shits police departments give is so fucking close to zero. Most people use the same story. "I'm in the basement with hostages at this address." If the place doesn't have a basement, just say in the master bedroom. "I have them tied up, back-to-back in chairs, I have bombs rigged to each window and door, I want a plane out of the country." You just create a hostage situation. Personally, I would say that and get the fuck out. That's how they catch people—people taking credit.
People argue that people can die when they're swatted. People can get shot. Which is true. People would say this on the call with the department: "If I see a police officer without the money, I will shoot him on sight." Once you start threatening police officers, they're more likely to fucking shoot someone. A swatting can work just the same when you say "I'm in the basement of this address with hostages. I'm done. Bye." That would work.
Will it get their door kicked in? Eh, maybe. But the SWAT team is gonna go, which is your main reasoning behind it.
You have to get an ISP that people don't have methods for. And by methods, I mean what tools they use and what they're used for. People can get methods for it easily. Really easily. But a lot of people don't know how to get methods.
Put a lock on your account and make it so no one can call in about your account—at all. They can't call in, they can't even get your first name, they can't get the first digit of your account number, they can't call in about any issues. Once you have your ISP setup, call those motherfuckers every day until they do it. And if they say they've done it, make them do it again. You call them and say "I want to set up a password on my account and I want to verify my identity with the last four digits of my social security number whenever I call." They have a note section when they pull up the account on their tools that, in big bold letters, "get this fag's social security number." Do that.
On top of that, call your police department. That's pretty simple. If you're a streamer, if you have 500 followers, it doesn't matter. Call your police department and say "Hi, my name is so-and-so. I live at this address. This is my cell phone number. This is my home phone number. This is my email address. I do things on the Internet where it involves me being a public figure. My information might get released." Then, you politely ask them if they know what swatting is. If they say no, you're fucked. But they won't. Everyone knows what it is now.
People think that getting swatted is the end game of the Internet. You're done for. It doesn't matter. As long as you don't have anything to hide, it really doesn't matter. If you have weed, put it under your bed or something. It doesn't end your life. You're fine. Are people gonna tweet at you and say "oh, your door got kicked in?" Yeah. Sure. But, I mean, you're still gonna go on about your day like you would have the day before. Once a month, are you gonna have to take take 30 minutes out of a Saturday night to make sure that your door's not getting kicked in? Sure. But that should be the cost of streaming. That should be the cost of being a YouTuber.
13 year olds can fuck up your night. Don't give a shit about it. Even if you care, pretend not to. That's gonna make you the joke. That's gonna make you someone they can go back to next Friday when they don't have to go to school in the morning. The best thing you can do, even if you're scared shitless—which, honestly, I'd call you a pussy for—but even if you're scared shitless and a SWAT team is going to come to your house, you need to play it off like you don't give a shit. A lot of people are put in this situation where they get tweeted at with "SWAT coming!" And their chat blows up. "You're getting swatted, holy shit!" You need to call the police right then and there, even if the team's already dispatched.
Recognition and credit. That's the reason why it's done.
Can I steal your Netflix? Can I call in your Comcast? Can I break down your door? Yeah, sure. And? Should there be something special about that? No. It's [being] a glorified liar. It's all it is. I think a lot of people who are doing it understand it. I think they know, in their minds, they're nothing fucking special. But they have these people who follow them and they know who they are. They think they're special. Those people think that these people are really legitimate.
I have no doubt in my mind that, three years down the road, I'm still going to get questioned for shit I did this year. When I say this year, I do mean 2015.
I recently took a step back from all this from the big picture. I'm 16 years old, okay? I don't want to be risking my life. That's what I would be doing. I would be risking my life. I'm done with high school. That doesn't mean I'm smart—that means I did Internet school. Don't misconstrue that. All I have to do right now is save money and go to college. I can't go to college for another year or two, which is fine. That's all I have to do, and then I'm 20, I could literally fuck all of that up by continuing to do what I was doing. All of it. That just didn't seem reasonable to me.
It just didn't seem like I was getting enough pleasure from it. I was sitting there and this girl just got her door kicked down. She's crying.
I've been swatted before. All I have to say about it is that I didn't care. I told the police officers "This is his Twitter username, he tweeted at me. This is the IP I resolved from Skype. This is this, this is that." They wouldn't do anything with it, and they'd be on their own. I just didn't care. It was a minor inconvenience for me. It's not like they kicked down my door.
I explained this to my real-life friends, too. "What's swatting? Why are you in cuffs? Why are the police always at your house?" And I explained it to them. "Why do you do that?" That was when I questioned myself. My friends are like "What the fuck are you doing? Why are you doing this?" I was like "It's fun." "It's fun to ruin someone's night? What do you mean?"
At the time, I was like 15, and I was like "Yeah, I'm trolling 'em!" They're like "No, you're not. You're not trolling anyone. You're being a dick." And I was like "Damn, dude. Fuck. He's right."
I think trolling is a big part of this. That's this kind of era. It's just fucked up in [and] of itself. Is it fun to troll around with people and fuck with them in a video game? I'm not saying to drop [release] their dox, but is it fun to try and antagonize? Yeah, it can be. Is it fun to spam 8chan with Rick Astley? Sure, it's pretty fun. That's trolling. That's the innocent "Ha ha ha! Got you!" kind of shit. And these people, like I did, are considering this "Ha ha ha, your door's kicked down and your dog is dead! Gotcha!" type of thing.
It's just escalating. It's going to continue to escalate. It's stupid.
The reason why this is such an issue is because everyone seems to care about it on Twitter. These public figures, senators and stuff. They seem to give a shit, right? But what are they doing to stop it? Everyone needs to ask them. They aren't doing anything.
That's really all I have to say about why it's done. They want everyone to know what they are and what they do, and they want people to be scared of them.
You can reach the author of this post at firstname.lastname@example.org or on Twitter at @patrickklepek.
Illustration by Tara Jacoby