Response Guide for Internet-based Threat Investigations

Transcription

1 Response Guide for Internet-based Threat Investigations Counterterrorism Division Domestic Terrorism Operations Unit II National Explosives Task Force Cyber Division Major Cyber Crimes Unit November 2015

2 Introduction and Summary (U//FOUO) For decades, individuals have utilized bomb threats to advance personal agendas, such as the harassment of individuals, educational facilities, and government offices. However, with the rise of Internet, bomb threats have increased in sophistication and frequency. According to a 2012 FBI report on bomb threats, over 38% of bomb threats are sent via , making it the most common method of delivery. i (U//FOUO) Additionally, a new disruptive bomb threat technique known as swatting has emerged. In its most basic form, swatting occurs when an individual calls an emergency telephone number and fabricates an emergency designed to elicit the dispatch of law enforcement or SWAT teams to a targeted victim s location. Swatting has been given a hightechnology twist with the emergence of Voice over Internet Protocol (VoIP) services, such as Skype or Google Voice. Swatters exploit VoIP service because they allow a caller to choose the number that the recipient sees. Many companies also offer free web-based software tools that allow swatters to further obfuscate their identities and make overall attribution difficult, if not impossible. (U//FOUO) Internet-based threats are dangerous to first responders and to the victims. The callers often tell tales of hostages or bombs about to detonate. The community is placed in danger as responders rush to the scene and responding officers are also placed in danger as unsuspecting residents may try to defend themselves. In addition, these incidents prevent law enforcement from responding to real emergencies. Future disruption of Internet-based threats will require law enforcement personnel to keep abreast of the continually evolving technology and tactics criminals employ. (U//FOUO) The FBI s Counterterrorism Division s Domestic Terrorism Operations Unit II (DTOU) and National Explosives Task Force (NETF) have developed this response guide to assist law enforcement officers investigate the digital trail associated with these crimes. Through this guide, investigators will learn best practices for contacting social media companies, how to manually search for evidence, and how to use automated research tools. Armed with this information, investigators can apply these processes to their investigations and subsequently increase the likelihood of disruption and preventing future Internet-based threats.

3 (U) One of the most important pieces of evidence in bomb threat investigations is data stored within the . Every contains an electronic postmark called a 'header.' It is similar to an electronic postmark. The header contains basic information, such as the sender and recipient of the the date/time the was sent, and the subject of the . (U) Detailed technical information can be viewed in an 's full header. By default, most e- mail programs display brief headers, but can be configured by users to display full headers. Investigators should always obtain the full header of a bomb threat . (U) Investigators will need to obtain a copy of the original in order to view the full/extended header of the . Extended headers contain important investigative information such as: Section 1: Threats Originating IP address account used to create the message software used to compose the message servers the message passed through on its way to the recipient Time the message was sent from the sender Time zone in which the message was sent from the sender s client Unique-message ID number Caution: (U) Do not have the victim forward the bomb threat e- mail. If you try to view the full header of a forwarded , you will only be able to see the originating IP address of the person who forwarded the . (U) Since there are a variety of providers and they routinely change their interfaces, investigators will need to conduct Internet queries to obtain updated instructions to view full e- mail headers of specific applications. (U//FOUO) The originating IP address in the full header of an may identify the Internet Service Provider (ISP) used by the sender at the time the was sent. To identify the originating IP address, one can use an automated analysis tool listed below or identify the IP address manually. Appendix B outlines methods for manually identifying originating IP addresses in full headers. (U) Automated Header Analysis Tools MxToolBox (mxtoolbox.com/ headers.aspx) IP tracker Online ( Google Apps ( Microsoft (

4 (U) Legal Process (U//FOUO) Once an investigator determines the originating IP address, he/she will need to research this IP address to determine the telecommunications provider that owns the IP address. This process is similar to looking up a phone number in the phone directory to determine ownership. Examples of IP address lookup tools are as follows: (U) IP Address Lookup Tools CentralOps ( Robtex ( InfoSniper ( (U//FOUO) After identifying the ISP, investigators can serve legal process to the appropriate ISP to determine the subscriber information associated with the account. Law enforcement personnel must follow their department s standard operating procedures for submitting legal process to private organizations, such as ISPs. * (U//FOUO) NOTE: Criminal obfuscation tactics and ISP privacy control will impede your investigation. Thus, information discovered through header analysis and IP address lookups may not be 100% accurate. Please consult the next section in this document for further information on these investigative considerations. (U//LES) Investigative Actions Checklist for Bomb Threats Inform recipient of the to keep the open on the computer until assistance arrives. Instruct the recipient to save the and avoid deleting the at all costs. Do not delete the . Save the . Print, photograph, or copy the Obtain full header data from original Perform header analysis to determine originating IP address Research originating IP address to determine ISP used to send the If necessary, submit preservation request to ISP Serve appropriate legal process to ISP for subscriber information (a list of common ISPs is located in Appendix A) Research the language used in the threat to determine if the sender of the references current events or popular culture. In addition, search law enforcement databases to check if similar sentences, phrasing, or unique words were written in other reported bomb threats. Utilize available open source social media search tools (i.e Babelstreet, GeoFeedia) to determine if the or user name that sent the threat has an social media presence

5 Special Considerations for Header Analysis and IP Address Lookups (U) ISP Increasing Privacy Controls (U) Within the last few years, Gmail and Yahoo have stopped including the originating IP address in an header if the was composed and sent from directly from their website, yahoo.com. However, if a bomb threat is sent from a user's client software, this may not be the case. For example, if a bomb threat is sent via Gmail from a desktop computer s Internet browser, the header will not include the originating IP address. If the bomb threat message is sent via Gmail on an iphone/ipad through the ios mail client, the will contain the originating IP address. (U) Spoofed headers (U) Anything up to the last (topmost) Received line in the message header can be 'spoofed,' or faked. Use header analysis to trace the network route (IP addresses) the address uses indicated. Look for suspicious server names or clues to geographical locations. (U) Anonymizers / Proxy systems (U) Anonymizers/proxy systems are servers that strip identifying information from the e- mail message before forwarding it. These systems have names such as TorMail and Secur . Investigators may not determine if the sender used these services unless he/she investigates the headers of the e- mail. Although valid reasons exist for using an anonymizer service, many individuals use the service to conceal their identity. If an individual uses an anonymizer, the investigator may not be able to trace the to its origin because these services often do not maintain logs. (U) Public locations (U) Internet access is available in many public spaces, such as libraries, schools, airports, hotels, and Internet cafes. If an message is sent from one of these locations, determining the actual sender may be difficult. (U) Delayed send (U) Many providers and clients have the ability to allow the sender to schedule the time an is sent. Also, some servers send at prescheduled times. Either of these situations could allow an individual to be at another location at the time the is actually sent.

6 Section 2: VoIP Threats (U) Unlike calls that come from landline phones, which are registered to a fixed physical address and display the address on 911 dispatchers' screens, VoIP calls often originate from a computer or smartphone and can be configured (spoofed) to originate from anywhere. (U) Why Swatters use VoIP (U//FOUO) With the emergence of VoIP services (such as Skype or Google Voice) swatters exploit VoIP service because they allow a caller to choose the number that the recipient sees. Many companies also offer free web-based software tools that allow swatters to further obfuscate their identities and make overall attribution difficult, if not impossible. What is Voice over Internet Protocol (VoIP)? Voice over Internet Protocol (VoIP) is a form of communication that allows individuals to make phone calls over a broadband internet connection instead of typical analog telephone lines. VoIP is becoming an attractive communications option for consumers. Given the trend towards lower fees for basic broadband service and the brisk adoption of even faster internet offerings, VoIP usage should only gain popularity with time. (U) Special Considerations for Investigating VoIP Threats (U//LES) On several occasions, police department have subpoenaed the phone number that called into their 911 system or police department. However, with VoIP technology, it is not uncommon for the call to be routed through several telecommunication companies. At times, one swatting call will be routed through 10 telecommunication providers. After lengthy legal process, it is not uncommon to discover the source of the call is identified as Google Voice or Skype number. (U//LES) A much simpler way to investigate these cases is to simply subpoena major VoIP providers and ask them for any accounts that called a specific number on a specific date and time. By utilizing this approach, investigators may discover that you only need to issue one subpoena instead of ten. (U) Skype cannot trace their trunk numbers (661) , (661) , or (661) They will need further information, which is listed on the next page.

7 Emergency Requests to Skype In urgent situations involving an IMMEDIATE THREAT TO LIFE, Skype does not require subpoena or court order - but they DO require that the request is in writing, meeting the following criteria: Requests to Skype must: 1. Be addressed to Skype Communications SARL, Luxembourg 2. Be signed and dated and provide your address, phone number and official address 3. Explain the nature of the Emergency 4. Provide the PSTN phone number which received the call, as well as the exact date, time and duration of the call(s). Time zone is also helpful. If the request is an emergency situation, send your request to the 24/7 emergency alias (LEALERT@microsoft.com) so that it can be forwarded to the correct member of the Skype team immediately. If the incident is NOT an emergency situation, send your legal request to LERM@skype.net.

8 (U) Caller ID Spoofing (U//FOUO) Currently, it is illegal to spoof on calls placed via traditional phone lines, but there is no such prohibition on calls placed via Internet phone services. Several companies also offer caller ID spoofing services online. For example, in Skype s Premium service, it is possible for a user to enter any phone number they wish as the originating phone call. Caller ID spoofing software has legitimate uses. For instance, a doctor who wants his office number to appear when he is responding to a patient's emergency call from his cell phone, may employ such software. (U//FOUO) Law enforcement personnel should be careful with identifying subjects in investigations involving VoIP. If a target of an investigation were to receive a call from a caller ID spoofing service, the caller ID would display the spoofed number which could cause an investigation to be initiated on the wrong subject. (U) Subpoena Verbiage (U//LES) When issuing legal process to social media platforms, VoIP providers, or ISPs, the FBI recommends that you include a full description of information you are seeking. This may include, but is not limited to, the following: Names (including subscriber names, user names, and screen names) Addresses (including mailing addresses, residential addresses, and business addresses) Date of birth Length of service (including start date) Types of service used (e.g. push-to-talk, text, three-way calling, services, cloud computing, gaming services, etc.) Telephone number and addresses associated with the account Records of session times and durations, and the temporarily assigned network addresses (such as IP addresses) associated with those sessions Telephone or instrument numbers (including MAC addresses, Electronic Serial Numbers ( ESN ), Mobile Electronic Identity Numbers ( MEIN ), Mobile Equipment Identifier ( MEID ), or International Mobile Station Equipment Identities ( IMEI )) Means and source of payment for such service (including any credit card or bank account number) and billing records Date range of the data you are requesting (U//LES) When issuing legal process to telecommunication carriers (e.g., subpoena subscriber info for telephone number xxx-xxx-xxxx), ensure that you ask for a carrier identification code, AKA CIC. In the event the telephone number was spoofed, the CIC would identify other telecommunication providers that accessed a local telephone exchange. (U) Note: Follow your local agency s rules and protocols when issuing legal process.

9 (U) Voice Changing Software (U) While conducting the call, swatters, on occasion, will also utilize text-to speech, voice changing software, or sound boards. Text-to-speech programs allow users to type in messages to a website and a computerized voice will read the messages. Voice changing software, as the name implies, will distort the actual voice of a caller, including adding accents. Sound boards will articulate pre-recorded sounds and the user may simply click on the message that he wants to be read vocally. (U) Web Cameras (U) Swatters also use web camera streaming services, such as UStream or Eartchcam, to view live video feeds of law enforcement response to their calls. (A web camera is a camera that is configured to be accessed over a network via an IP address.) Video game enthusiasts who wish to swat other gamers have utilized the webstreaming website/phone application Twitch.TV to view swatting response. Public Web Camera (U//FOUO) Investigators should canvas the area surrounding a swatting location to determine if public web cameras are in the area. If a camera is identified, investigators should determine who owns or operates the owners of the cameras. The owners of the camera may be able to provide IP address access logs or inform the investigator if the feed from their camera is available on the Internet. Investigators may also be able to request information from web streaming websites (such as UStream). For example, they could subpoena these websites for a list of IP address that accessed an IP camera in a particular location at a specific data and time. (U//LES) Investigative Actions Checklist for VoIP Swatting/Bomb Threats (U//LES) The FBI recommends the following actions in investigating a potential swatting or bomb threat incident that was initiated via VoIP: Acquire a recording of the call. Identify the date/time and victim number called, as well as the telecommunication provider for the victim. Identify the subject inbound number (even if spoofed or caller ID is not displayed). If the call was directed to a non-emergency dispatch line and routed through multiple extensions, attempt to provide the original receiving line number and extension. Was the calling number identified as one of the default Skype numbers: (661) , (661) , or (661) ? Identify if a specific name was utilized during the call (typically a victim of the swatting call, not the subject). Determine if there are any publicly accessible web cameras in the vicinity of the identified swatting location and identify the owner of those cameras. The owner of the web cameras

10 Conduct a thorough interview of the victim. In many cases, the victim is not randomly chosen but instead is familiar with the subject placing the call. Victims may be able to provide information useful for identifying the perpetrator either through an interview and/or gaining Subpoena popular VoIP providers (Google, Skype, Vonage) and ask them for any accounts that called the targeted number on a specific date and time Contact your local FBI field office regarding the tools and techniques they have available for tracking back to the source Section 3: Twitter Threats (U) Twitter is a social media platform in which users post short messages, called Tweets, that are restricted to only140 characters. On Twitter, "following" someone means you will see their tweets (Twitter updates) and followers are people who receive other people's Twitter updates. (U) Research Twitter User Name on the Internet (U//FOUO) In many cases, people will use the same user name (handle) on other social media platforms. If a subject s Twitter user name is identified, investigators may want to conduct Internet queries to determine if an individual uses the same (or similar) user name on other social media platforms. Online tools that support username searches include: Namechk.com Namecheckr.com Checkusernames.com (U) Compare Twitter Followers (U//FOUO) Investigators may want to compare followers between multiple users. This investigative step may yield commonalities with other Twitter users under an investigation. The following websites automate comparing Twitter followers: FollowerWonk ( Twiangualate ( Tweepdiff (tweepdiff.com) (U//FOUO) Photo Analysis -EXIF Data (U//LES) Digital images contain metadata that stores including but not limited to date, time, location, and type of camera that took the picture. This metadata called EXIF (Exchangable Image File Format) data can help investigators track the location of their subjects Social Media platforms, such as Twitter and InstaGram, strip EXIF data when images are posted publicly. However, these platforms often save the EXIF data when the user uploads their photos to their websites. Investigators must specifically request this data when sending legal process to the companies located in this report.

11 (U//FOUO) Photo Analysis -Reverse Photo Recognition (U) Investigators can conduct reverse image searches to engines trace the Internet (especially Google Images and other similar sites) for a similar pixel pattern and instance of another image. Simply right click on your image to copy the image URL and then paste into one of these sites search engine. Or, download the image to your computer and manually upload it into their systems. The following three websites are reverse image search engines: Google ( TinEye ( ImageRaider ( (U) Legal Process Google Images Reverse Image Search Engine (U//FOUO) Twitter's policy is to notify users of legal requests for data associated with their accounts. Prior to issuing a Twitter subpoena, law enforcement agencies should obtain a nondisclosure order signed by a judge. Without a non-disclosure order, social networking companies like Twitter may disclose the existence of the subpoena to the subject. (U//FOUO) Twitter retains different types of information for different time periods. Given Twitter's real-time nature, some information may only be stored for a very brief period of time. If law enforcement personnel are investigating Twitter threats, they should immediately send a preservation letter to Twitter to preserve the data on their servers. Preservation requests must be signed and issued on law enforcement letterhead. The requests should also include a valid return address. (U//FOUO) Twitter s Trust and Safety department is responsible for interactions with law enforcement. When you contact Twitter s Trust and Safety department, you should have a Twitter user name and a Twitter ID number, in order to properly identify a Twitter account. To find a Twitter ID, simply type the Twitter user name into one of the following websites: TweeterID, a website used to find a Twitter ID Number TweeterID (tweeterid.com) ID From User (idfromuser.com) GetTwitterID (gettwitterid.com)

12 (U//LES) Investigative Actions Checklist for Twitter Bomb Threats (U//LES) The FBI recommends the following actions for investigating a potential swatting or bomb threat incident initiated via Twitter: Ask the victim to print, photograph, or copy the Tweet Obtain the perpetrator's Twitter username and user ID Send a preservation letter with the perpetrator's Twitter username and user ID to Twitter Consider researching the user s tweets to identify items of investigative interest Conduct a reverse image search on photos uploaded to a subject s Twitter profile Search the Twitter user name on the Internet. Consider using open source Twitter analysis tools (such as FollowerWonk) Ensure you ask for EXIF data when submitting legal process to Twitter Twitter responds to legal correspondence via and fax. o lawenforcement@twitter.com o Fax Twitter (attention Trust & Safety): Reference Twitter s law enforcement support page for additional guidance at Twitter s law enforcement mailing address is: Twitter, Inc. c/o Trust & Safety - Legal Policy 1355 Market Street, Suite 900 San Francisco, CA 94103

13 Section 4: InstaGram Threats (U) InstaGram is a mobile photo and video sharing social networking service. According to a 2013 study, 90% of InstaGram users were under the age of 35. In 2014, Facebook Inc. acquired InstaGram. (U//FOUO) If you contact InstaGram with legal process, you should identify the InstaGram user name and user ID number, in order to properly identify an InstaGram account. To find an InstaGram ID, simply type the InstaGram user name into one of the following websites: Jelled.com (jelled.com/instagram/lookup-user-id) Otzberg.net (U) Research User Name on the Internet (U//FOUO) In many cases, people will use the same user name (handle) on other social media platforms. Investigators may want to conduct Internet queries to determine if an individual uses the same user name on other social media platforms. Online tools that support username searches include: Namechk.com Checkusernames.com (U//LES) The FBI recommends the following actions in investigating a potential swatting or bomb threat incident initiated via InstaGram: Print, photograph, or copy the InstaGram threat Obtain the perpetrator's InstaGram username and user ID Send a preservation letter with the perpetrator's InstaGram username and user ID to InstaGram Search the InstaGram user name on the Internet. Search the user name on InstaGram search engines (such as FindGram) for previous posts. Previous posts may identify the user s interests and associates of interest. Always ask for EXIF data in legal process. In addition, examine photos of interest. The user may also upload photos with well known landmarks in the area. Consider using reverse image search engines. Reference Instagram s Law Enforcement Guidelines: InstaGram (which is owned by Facebook) uses Facebook s law enforcement portal at facebook.com/records for the submission, tracking and processing of requests. InstaGram s law enforcement mailing address is InstaGram Attn: Law Enforcement Response Team 1601 Willow Road Menlo Park, CA lawenforcement@instagram.com

14 Appendix A: Legal Contacts Search.ORG (ISP List) ISP List is a frequently updated database of Internet service and other online content providers that stores legal contact information and instructions needed to serve subpoenas, court orders, and search warrants. *Important Note: The standard practice for most of these organizations to notify their users prior to information disclosure (i.e. a user will know if law enforcement has requested a subpoena or search warrant). Thus, to prevent this practice, law enforcement officers must obtain a nondisclosure agreement, in accordance with 18 U.S.C. Section 2703(d), when court order or similar document. *This list is current as of November 1, Google (and Google Voice) Google, Inc./ Google Voice 1600 Amphitheatre Parkway Mountain View, CA USLawEnforcement@google.com Telephone: Fax: Skype Skype Communications S.A.R.L (subsidiary of Microsoft Corporation) lerm@skype.net TwitchTV Hassan Bokhari, Legal Department - legal@twitch.tv

15 MagicJack, subsidiary of YMax Communications Corp. YMax Communications Corp. Attn: Rikard Bone Subpoena Compliance 5700 Georgia Ave West Palm Beach, FL Fax: (888) UStream UStream Inc. / Attn: Chris Vail 410 Townsend Street, Suite 400 San Francisco, CA cvail@flexbyfenwick.com InstaGram: (Subsidiary of Facebook) (U) Law enforcement officials are encouraged to use the Law Enforcement Online Request System at facebook.com/records for the submission, tracking and processing of requests. Mail: Attn: Law Enforcement Response Team 1601 Willow Road Menlo Park, CA lawenforcement@instagram.com AOL Inc. Public Safety & Criminal Investigations (703) AOL Way 0r (703) 265-COPS Dulles, VA Fax (703) After Hours Emergencies: (703) Option 1

16 Reddit Reddit.com is message board interface and one the top 30 most visited Web sites in the US. Legal process may be sent electronically to or mailed to: Reddit /Legal Department/Custodian of Records 520 3rd Street San Francisco, CA Fax: Yahoo! Compliance Team Yahoo! Inc. 701 First Avenue Sunnyvale, California Telephone: Legal process and preservation requests may be sent to Yahoo! Inc. via (law enforcement officials only) to: Requests for documents may be faxed to: Custodian of Records at Emergencies: Yahoo! Security at and San Jose FBI Office. General Inquiries (including status checks): 4Chan 4Chan ( is another popular message board interface site. 4Chan s prefers to receive legal process via their address, lawenforcement@4chan.org. Mailing address for informational purposes: 4Chan.org 113 Spring Street, 2nd Floor New York, NY 10012

17 Hotmail/MSN/Outlook Microsoft Online Services Custodian of Records Online Service Address: 1065 La Avenida, Building #4 Mountain View, CA Phone: (law enforcement) (Option 1 or 0 for emergencies only) Fax: (preferred service method) After Hours / Weekend Emergency: (650) Twitter lawenforcement@twitter.com Fax Twitter (attention Trust & Safety): Twitter s law enforcement mailing address is: Twitter, Inc. c/o Trust & Safety - Legal Policy 1355 Market Street, Suite 900 San Francisco, CA Reference Twitter s law enforcement support page for additional guidance at Vonage Vonage Holdings Corp. Attn: Legal Affairs Administrator Legal Department 23 Main Street Holmdel, NJ Phone: (732) , (732) SubpoenaProcessTeam@vonage.com

18 Yik-Yak Law firm representation: DLA Piper LLP (US) One Atlantic Center 1201 West Peachtree Street, Suite 2800 Atlanta, Georgia Zachary M. LeVasseur Tel: Fax: Kik Preferred means of communication: Alternate: Kik Interactive, Inc. 420 Weber Street North Suite 1 Waterloo, ON, N2L 4E7 SnapChat Preferred means of communication: lawenforcement@snapchat.com SnapChat Custodian of Records P.O. Box 1784 Pacific Palisades, CA Telephone:

19 Appendix B: Header Analysis Note: Please attempt to consult your local IT staff if you do not have experience with reviewing headers. (U) As mentioned earlier, an header is similar to an electronic postmark. In a way it is much like the same way the post office would route a letter: every time the letter passes through a post office on its route, or if it is forwarded on, it will receive a stamp. In this case the stamp is an IP address. (U) In the example shown below, there are three Received stamps. Reading from the bottom upwards, you can see who sent the message first, next and last, and you can see when the traversed a mail server. These Received lines provide information on where the message originated and what stops it made before reaching its final destination. Return-path: <sender@senderdomain.tld> Delivery-date: Wed, 13 Apr :31: (3)Received: from mailexchanger.recipientdomain.tld([ ]) by mailserver.recipientdomain.tld running ExIM with esmtp id xxxxxx-xxxxxx-xxx; Wed, 13 Apr :39: (2)Received: from mailserver.senderdomain.tld ([ ] helo=mailserver.senderdomain.tld) by mailexchanger.recipientdomain.tld with esmtp id xxxxxx-xxxxxx-xx for recipient@recipientdomain.tld; Wed, 13 Apr :39: (1)Received: from senderhostname [ ] (helo=[senderhostname]) by mailserver.senderdomain.tld with esmtpa (Exim x.xx) (envelope-from <sender@senderdomain.tld) id xxxxx-xxxxxx-xxxx for recipient@recipientdomain.tld; Tue, 12 Apr :36: Message-ID: <xxxxxxxx.xxxxxxxx@senderdomain.tld> Date: Tue, 12 Apr :36: X-Mailer: Mail Client From: Sender Name <sender@senderdomain.tld> To: Recipient Name <recipient@recipientdomain.tld> Subject: Message Subject (U) Since we are reading from the bottom up, the Received stamp with the number (1) next to it is the IP address we are interested in researching. In this example, is the originating IP address. (U//FOUO) Once an investigator determines the originating IP address, he/she will need to research this IP address to determine the telecommunications provider that owns the IP address.. Examples of IP address lookup tools are as follows: (U) IP Address Lookup Tools CentralOps ( InfoSniper (

20 Appendix C: Information for First Responders Describe the call itself: Detailed description of the nature of the threat. Incident Type: for example, bomb threat, active shooter, hostage situation, or CBRNE threat. Did the caller provide a motivation or reason for the threat? Did the caller specify a timeline for imminent or future threats? Where did the caller claim to be calling from? Was any background noise heard during the call? Detailed description of caller: Did the caller provide a name to identify themselves? What was the caller s gender and accent? Was the caller s voice computerized or masked in any way? What was the caller s demeanor and tone (for example, calm, agitated, excited, hysterical, emotional, or confused)? Did the caller seem prepared with a script or preplanned responses? Suspicious Indicators of a Swatting Call (U) Shortcoming of 911 System (U) The U.S. 911 system was developed in 1968, decades before Internet became a household commodity. Most 911 call centers don't have equipment capable of determining if a call is coming through a computer phone line information that could be used to assess the credibility of an emergency call. A new system named next-generation 911 is slowly being adopted and will provide 911 dispatchers with additional information such as whether a call is coming from a computer. Experienced swatters are aware of next-generation 911 systems and will call a first responder s non-emergency land lines. The caller is unable to answer follow-up questions requesting details such as their full name, phone number, or current location. The caller mispronounces names such as city, street, or building names. Swatting calls are commonly conducted by foreign malicious actors with thick accents who are unfamiliar with the local areas they target. The caller s story changes or escalates throughout the course of questioning. When challenged by follow-up questions or doubts that their claims are true or legitimate, the swatting caller may intensify their threat or change key details of their story. The caller uses specific gun names or terminology to identity their weapon. Swatting callers often refer to weapons commonly depicted in video games, such as an AR-15 assault rifle. (U//LES) Swatting calls can be successfully mitigated using follow-up questioning to identify inconsistencies or weaknesses in the caller s storyline or to make the caller feel their attempt is failing. Those receiving the call should ask multiple questions in quick succession, and repeat questions later in the call to identify inconsistencies. ii

21 i Advisory prepared by the FBI's Behavioral Analysis Unit (BAU), National Center for the Analysis of Violent Crime (NCAVC), Critical Incident Response Group (CIRG) Multiple Anonymous Bomb Threats to U.S. Universities and Colleges 21 September 2012 ii New Jersey Cyber security & Communications Integration Cell, Swatting: Mitigation Strategies and Reporting Procedures, June 17, 2015