Serial ‘swatters’ used Ring cameras to livestream dangerous so-called pranks

A California grand jury indicted two men late last week with orchestrating a “swatting spree” after illegally accessing a dozen Ring home security systems across the country. In November 2020, Kya Christian Nelson, 21, of Wisconsin, and James Thomas Andrew McCarty, 20, of North Carolina obtained private credentials for a number of Yahoo email addresses, which the pair then tested to see if the information corresponded with Ring subscription logins. 

The indictment implies the men then gleaned personal information such as addresses from 12 Ring accounts, and either placed false emergency reports or called local police to those locations, citing fake disturbances. Law enforcement was then dispatched to the unwitting Ring owners’ residences. This dangerous and even occasionally lethal prank is known as “swatting.” Atop the attacks’ logistical and legal consequences, the events can lead to lasting psychological trauma in victims, and have long been a favored form of hate crime harassment.

[Related: Ring camera surveillance puts new pressure on Amazon gig workers.]

As Ars Technica noted on Monday, it still remains unknown how the two men gained the login information. Regardless, Nelson and McCarty then live streamed the ensuing chaos via social media. In one instance cited within the US Attorney’s Office for the Central District of California’s announcement, the pair phoned a police department and posed as a child who claimed their parents were arguing and firing guns in the house following a drunken dispute. Once police arrived at the home, Nelson and McCarty utilized the compromised Ring system’s doorbell speakers to verbally abuse and taunt the responding officers.

The weeklong swatting campaign gained the attention of national news outlets, prompting the FBI to issue a public service announcement urging owners of Ring and other similar smart home security systems to take additional safety measures. Simple habits such as enabling two-factor authentication and choosing complex, unique passwords alongside a password manager have consistently been shown to help deter bad actors attempting to compromise online accounts.

[Related: Amazon’s Ring Nation quietly premieres on cable TV in 35 states.]

If convicted, Nelson and McCarty could face multiple years in federal prison. Ars Technica also reports that a separate indictment was filed against McCarty in November in Arizona for swatting attacks on at least 18 people.

Ring, which was purchased by Amazon in 2018, has faced consistent criticism for its internal security problems. The issues coincide with advocacy groups’ concerns regarding what it calls its fear mongering marketing tactics, under-the-radar data sharing with law enforcement, and most recently, an attempt at a family friendly reality show culled in part from Ring home videos dubbed Ring Nation. A coalition of concerned organizations recently reiterated their call to cancel the series following the conclusion of its first season.