In the last few months, researchers at BlackCloak have found a disturbing increase in swatting attacks targeting high-profile corporate executives. According to their research, these types of attacks have risen from under a handful to several dozen over weeks.
Swatting attacks are conducted by deceiving an emergency service into sending first responders, such as the police or SWAT, to a residence under the false claim that there is a law enforcement emergency at the residence. These emergencies could be an untruthful claim of kidnapping or domestic disturbance that leads police to the resident’s door. Upon arriving, the police assume they are entering a high-risk situation that could necessitate neutralizing a threat.
Swatting attacks are not new. Since at least the 1970s, police have been forced to respond to hoax bomb threats after receiving calls. Even this month, schools across California, Michigan, and Vermont dealt with false reports of shootings in their buildings that generated lockdowns and police response. These types of attacks have also targeted celebrities and been retribution for perceived slights in the world of online gaming.
Young men, often young men, use the technique to prank their rivals. But these “pranks” can turn deadly. In 2017, a Wichita police officer shot an innocent resident in a swatting incident. The victim was inadvertently ensnared in the middle of an argument between two players of Call of Duty: WWII, a first-person-shooter video game. The players had gotten into a disagreement over a $1.50 bet. One of the players called the police to falsely report a hostage situation at a residence that turned out to be the victim’s residence. The victim was not associated with either of the players.
Those who commit swatting attacks sometimes do so for their idea of the “lulz,” meaning they find such attacks humorous in a perverted way. They sometimes do so for retribution, as in the case of Kansas. Or they do so because they are angry. Politicians can be the target of swatting attacks by individuals that disagree with them. Prolific swatters can even make money committing swatting attacks, as people pay them for their services. There have been cases where people have been held for ransom by individuals who claim they will swat victims if a ransom is not paid.
More publicly available information about high-profile executives makes these attacks much more accessible. Attackers can collect personal information about executives and their families from several sources, including the dark web, property records, data broker information websites, or even from company websites’ freely available leadership pages.
Executives that work at companies with missions that some would disagree with could be particularly at risk for such attacks. Executives in the healthcare and biomed sectors are targets because of, presumably according to BlackCloak, drug prices or vaccine development. One could imagine an executive in the energy sector being targeted by a disturbed climate activist. A defense company executive might find themselves in the crosshairs of an attacker friendly to a rival nation-state. If one were to conceive, an executive of a restaurant chain might be a target because somebody had a bad burger. It may sound far-fetched, but is it really that out of the realm of possibility?
Executive protection today doesn’t end with cameras, locks, and guards. Limiting online information about an executive is as essential today as is a strong lock on a door or the cameras surrounding a residence. Executives and their protective teams must be proactive about removing the information about an executive and their families online and monitor for personal information that appears online.
Some ways to limit the amount of information about executives online include:
Remove information from websites: Some services can assist with removing information from the internet and data broker websites. You can use one of these services or work to remove the information yourself. Also, ensure all executive personal information is removed from corporate websites, including addresses, and limit the information on an executive’s bio page.
Limit information on social media: Be careful what appears on social media, especially regarding geography. Many social media platforms have geolocation data turned off by default but ensure that any posts are not tagged with a location. Social media can be particularly challenging for children and teenagers. It is essential to educate them on oversharing. Spend the time to put an executive’s entire family through an advanced cybersecurity awareness course that includes the dangers of sharing online.
Additionally, children should understand swatting and be encouraged to share with an adult if a peer has made a threat against the home. Kids need to be made aware as well that they should not use their real names as online handles, especially in gaming, where virtual exchanges of violence can turn physical under the right conditions.
Also, remember that it is not just children who love to overshare. Adults should understand the importance of limiting information online.
Register with an Anti-Swatting Registry: If you happen to live in Seattle, you can register with the city police department’s novel anti-swatting registry. This is a voluntary database of people who fear they might be vulnerable to a swatting call. Those who don’t live in Seattle can register with Smart911, allowing residents to report information about themselves in case of emergencies. Rave Facilities is Smart911’s commercial counterpart for business and commercial buildings.
Actively monitor for executive personal information: Actively monitoring the internet for executives and their family’s personal information can help you proactively understand threats to the executive in the physical or cyber worlds. Use a service such as TriCorps’ TriWatch, which will monitor executive and corporate information on the open, deep, and dark web and alert you if anything is discovered.High-profile executives are vulnerable in many ways because of the personal information that is available about them online. Swatting is just one example of the threats these executives and their families face. Limiting the amount of data that is available online and proactively monitoring for information about executives can help keep them and their families safe.