Spoofing and Swatting 9-1-1 Incorrectly Being Referred to as Hacking 911 by Journalists

Some news services are incorrectly reporting that hackers are getting into 9-1-1 call centers. The actual 9-1-1 centers are not being hacked, but some phone companies have been hacked to find out the phone numbers of certain customers. Then a process called ‘spoofing’ is used to attempt to fool the 9-1-1 center into reading that a phone call is coming from a false address, often a customer’s number that was obtained by hacking the phone company. The term “swatting” comes from use of “spoofing” to falsely report an emergency that brings out the SWAT team on a false alarm.

Criminals are using Caller I.D. spoofing services, such as phonegangster.com, telespoof.com, and spoofcard.com to masquerade as the phone number of their intended victim, and phone non-emergency police lines with threats that cause a SWAT or other major police response at the victim’s house. It is unclear which phone spoofing service was used, or whether another similar product was used (special hardware can also be used to spoof the ANI — Automatic Number Identification — caller identification system used by some telephone systems).  FLASHBACK: Fooled by Fake Caller ID! Any Phone Can Spoof Your Caller ID with New Websites …

Also, it is not clear if the criminals are actually calling 9-1-1 or an inside line of the 9-1-1 call center. Calls from a certain geographic area are re-directed to the specific 9-1-1 center that corresponds to the geographic region. There is question whether the spoofing service would be able to direct the call to the correct 9-1-1 center, since 9-1-1 is almost nationwide.

About sixty incidents of the fake emergencies were carried out. In one case in September 2006, co-conspirator Guadalupe Santana Martinez targeted the father of a female party line participant. The swatter called the police in Alvarado, Texas while spoofing the father’s number, identified himself as the father and told the police dispatcher that “he had shot and killed members of the … family, that he was holding hostages, that he was using hallucinogenic drugs, and that he was armed with an AK47.” He went on to demand $50,000 and transportation across the border to Mexico, “and threatened to kill the remaining hostages if his demands were not met.”

But how did he get the father’s number? Martinez called an internal AT&T number claiming to be a service representative working in the field in order to get information on victims to “carry out” an AT&T business procedure, such as terminating their phone service. He was part of a group of conspirators known as the Rosoff group.

Stuart Rosoff is facing as much as five years in prison and a USD $250,000 fine after pleading guilty to charges of harassing people by tricking 9-1-1 operators into dispatching police SWAT (Special Weapons And Tactics) teams to the homes of unsuspecting victims. The Ohio man has pleaded guilty to a federal conspiracy charge for being part of a gang of “swatters” — one of them blind — who used Caller ID spoofing to phone the police with fake hostage crises, sending armed police teams into the homes of innocent people.

Stuart Rosoff of Cleveland, Ohio pleaded guilty to one count of conspiracy Friday, November 15, 2007, in federal court in the Northern District of Texas.

The case seems to confirm that swatters are using simple Caller ID spoofing to pull these unfunny hoaxes — and not “hacking into 911” after all.  Rosoff was part of a  sophisticated gang of phone geeks with serious access to at least one phone company’s computers, which they used to get information on their targets.

A mastermind of much of the phone hacking was a blind minor in Boston (identity withheld), who was identified in three separate guilty pleas from Rosoff group members as “M.W.”  He had enough access to phone company systems to actually listen in on calls.

Another unrelated offense involved Randall Ellis, 19, who was arrested after allegedly causing the dispatch of a SWAT team to the home of an unsuspecting couple in Orange County, California on March 29, 2007. Cost to Orange County: About $20,000. On Friday, November 16, 2007 Randall Ellis plead not-guilty to charges for this offense.