How surveillance video can squash swatting attacks

Imagine this. You’re a police officer, and you’ve just been dispatched to a college campus because a 911 caller has reported several people carrying military-style rifles on campus, and said that he’s heard gunfire and shooting inside a classroom building. Now you’re on campus with other officers, and you’re outside the building where the attacker is reported to be, guns drawn and trying to keep away from the windows. 

You need to know whether storming the building might save lives – and you know that breaching the building could cause other, unintentional harm. Finally, just before making that decision, you get a call from a dispatcher to stand down. Turns out, there never was an attack — it was a false alert. No one’s been hurt, but you’ve been distracted from answering other calls where people really were in danger, and you could have endangered people in the building if you’d rushed in to surprise the attackers you believed were there.  

What’s just been described is swatting – a form of criminal attack that uses false emergency reports of a serious threat or a major crime to lure police into action against innocent victims. Sometimes the victim is an individual. Sometimes it’s a workplace, a school, a government office, or a religious institution.

Notable incidents of swatting have played out in the last few years against various celebrities, as well as politicians and other political actors. In August of this year, a string of swatting calls raised tensions and disrupted operations at universities across the U.S., and schools have received many more in the time since. The victims can also simply be ones against whom the swatter has a personal grudge.

The name «swatting» plays on the aggressive tactics and short response times of police SWAT teams. SWAT teams and similar organizations emphasize practical action, and have a reputation for favoring decisive action rather than nuanced measures. Swatting perpetrators hope to use their aggressive tactics as a means to harass or traumatize their victims, or simply to harm their reputations. 

While it might be downplayed as a mere prank, the police are unlikely to take serious allegations lightly, and their aim to protect the public may inadvertently be a source of real danger. When it succeeds, a swatting attack puts the victim in the position of a serious criminal, facing police who believe that he or she is dangerous or especially desperate. 

Both police and swatting targets have been injured or even killed in the course of police reaction to a swatting call. That may have never been the perpetrator’s intent, but once a police response is in progress, it may be difficult to stop.  

How does swatting work in practice?

A perpetrator calls 911 or otherwise contacts police, with allegations of a serious crime or critical situation, such as a kidnapping, a bomb threat, or an imminent murder. Swatting attempts sometimes use threats of suicide or hostage taking as an inducement to quick police action, and in some cases the swatter pretends to be the suicidal or homicidal threat. The caller might claim that the intended victim’s car contains a trafficking victim, or that a store’s loading dock is being used to ship a large cargo of drugs. Swatters have also provided stories about school shooters or snipers like the one in 2017 who killed 59 victims in Las Vegas. Police can’t simply ignore these calls. 

Because 911 call response is highly localized, swatters may use various forms of misdirection to reach an emergency call center. The same is true in Europe, where the U.S. 911 system has counterparts reached by the EU-universal 112 emergency number. They may use faked («spoofed») numbers or call an emergency response center indirectly by reaching a non-emergency number and then being transferred. They may even call a nearby business and persuade them to make a legitimate local call. All of these evasive steps make swatters hard to track down.

Why swatting is so devastating

Whatever the means, the law enforcement response to serious ongoing crimes is understandably swift. It may involve rough treatment or incidental property damage – police may break windows or doors at the reported locations, aim searchlights through windows, or storm in force into a building. All of these are unlikely to be compensated, so the victim suffers real financial harm in addition to mental trauma, or worse.

The confused swatting victim’s behavior is likely to be defensive and worried – all things which may make it seem like the original call was accurate, and heighten the resulting stress and danger. 

Suppose a swatting attack takes place in a school or a workplace. In that case, the presence of armed police who have reason to believe they’re in a serious situation endangers not only the intended victim but everyone else on the premises. To prevent a mass shooting, for instance, police may be primed to shoot an alleged attacker. 

If a swatting perpetrator calls 911 from the vicinity of a victim’s location, the perpetrator may himself actually be caught on camera. However, for a variety of reasons, criminals employing swatting as a weapon are not necessarily nearby. In fact, they can be around the country, or even around the world, and so they make their attacks with little fear.

How can video surveillance help? 

If nearby surveillance cameras are shared with local emergency response centers (911 operators), the reality of a situation can be assessed with more confidence, and without exposing personnel to expected dangers. An easy example: If a caller claims there is a sniper on the roof of a school building, video surveillance can be used to confirm that claim, or to show that it’s false. If one employee is accused of holding another hostage, a live video feed shared with law enforcement or with a video monitoring service could show that nothing of the kind is happening.

Such sharing may be accomplished either with a user-initiated connection to an emergency communications center, by means of municipally owned cameras to which police have always-on access, or (as with Eagle Eye 911 Camera Sharing) via camera access triggered by a 911 call in the immediate vicinity.  

The ways that video surveillance can be used to defuse swatting calls can be thought of as counterparts to the ways that video could help in the event of a truthfully reported crime. A video stream from the scene of an actual serious crime could show the arrival of a criminal, and might show the presence of a claimed attacker. By contrast, if a swatter says a kidnapper has just left a school with two hostages, a live video feed could make it clear that the claims are false, just by comparing the video to the alleged actions.  

The future of swatting — and of stopping it

Besides the real-world visual fact-checking that video surveillance can provide, there are other technological methods that can help mitigate today’s swatting attempts. Unfortunately, these means are necessary only because the expanding tools for emergency communications allow false reports to be made in the same way that legitimate ones are.

Calls can be tagged for confidence level, based on factors such as whether the call has a verified local origin or from a more easily faked IP communication system.

In an age where cell phones are ubiquitous and GPS location information can be requested of callers, matching phone locations to emergency calls is already a routine step. Swatters may also be able to fake location information, but this requires greater sophistication than simply making a false report. 

Swatters have, in some cases, used Telecommunications Devices for the Deaf (TDDs) to deliver their messages, and applying deep scrutiny to such calls may help. The same holds true for 911 messages delivered via text, which are an option for an increasing number of emergency call centers. Real-time analysis of call content may also spot emergency calls using AI-generated voices.  A similar level of verification can also be applied when 911 messages are delivered via phone app, rather than as direct phone calls.

No matter what countermeasures emerge, however, attackers are unlikely to stop using swatting as a technique. It’s cheap, often very effective, and relatively low-risk for the perpetrators. Since cutting such calls off at the source is a near impossibility, deploying ways to confidently vet emergency reports may be the most effective solution.  

Want to know how video surveillance could mitigate the effects of swatting on your premises?

Timothy Lord

Timothy Lord has witnessed and written about IT security trends and the ongoing evolution of SaaS for more than 25 years.