Live data from Hacker News

How police found Twitter user accused of sending seizure-triggering GIF

documentcloud.org

11–20 of 148 posts

Re: How police found Twitter user accused of sending seizure-triggering GIF

#11
post #5

Desktop browsers allow you to disable auto-playing animated images. I'm surprised mobile browsers don't seem to have this. If I suffered from this, I'd want some sort of reasonable protection from asshats.

> reasonable protection from asshats

Is there a strong argument that distinguishes this case of being "asshat on the internet" vs "homicidal with intent to kill"?

Re: How police found Twitter user accused of sending seizure-triggering GIF

#12
post #7

Earlier quoted context omitted.

Agreed. This appears to be the ordinary process. Can anyone point out what might be of interest here.

The only thing I can point to us this is one of the few cases where some piece of atrocious online harassment actually ended up with someone being held accountable in anyway. There have been plenty of cases of death threats and bomb threats and other such things that didn't seem to trigger any kind of real response.

Good point.

Maybe there are many other cases but they go under- / un-reported?

Re: How police found Twitter user accused of sending seizure-triggering GIF

#13
post #8

Dumb question, but what is the meaning of AT&T "toll records" used to link the user to an iPhone 6? > "AT&T responded and a review of the subscriber information showed the telephone number was associated with a Tracfone prepaid account with no subscriber information. However, a review of the AT&T toll records showed an associated Apple iPhone 6A Model 1586" That is, if you are a Tracfone user and Tracfone uses AT&T t…

[deleted]

Re: How police found Twitter user accused of sending seizure-triggering GIF

#14
post #8

Dumb question, but what is the meaning of AT&T "toll records" used to link the user to an iPhone 6? > "AT&T responded and a review of the subscriber information showed the telephone number was associated with a Tracfone prepaid account with no subscriber information. However, a review of the AT&T toll records showed an associated Apple iPhone 6A Model 1586" That is, if you are a Tracfone user and Tracfone uses AT&T t…

My understanding is that "toll records" simply means the metadata that AT&T keeps to charge Tracfone the usage of their customers.

At minimum they need to keep track of the ICCID for your sim card and the IMEI for your phone [1]. Once you have the IMEI and know that this is an iPhone, it is trivial to ask Apple for the records of who bought that device, or which iTunes account is associated with that SN.

edit: corrected per comment below.

[1] https://www.cnet.com/news/on-call-how-does-my-carrier-know-w...

Re: How police found Twitter user accused of sending seizure-triggering GIF

#15
From an article related to the case [1]:

> charged with criminal cyberstalking with the intent to kill or cause bodily harm and faces a maximum sentence of 10 years in prison if convicted,

What is even more sad:

> More than 40 Twitter users sent similar strobes to Mr. Eichenwald after they realized they could trigger seizures, he tweeted Friday.

The agent went through these steps to identify the suspect:

- Asked Twitter about account information. (w/ search warrant)

- Got phone number

- Phone number was Tracfone prepaid but asked AT&T for information about phone number. AT&T could map [phone number] -> [specific iPhone model] ("DPD sent a request to AT&T")

- Asked apple about iCloud account related to [phone number] (w/ search warrant)

- Find selfie of accused with his DL in hand in iCloud pictures, and also a screenshot of the seizure-triggering GIF, and many other incriminating/stalking behavior items.

[1] http://www.washingtontimes.com/news/2017/mar/18/twitter-user...

EDIT: Added (w/ warrant search) to clarify what "Asked" meant in my summary.

Re: How police found Twitter user accused of sending seizure-triggering GIF

#16
post #7

Earlier quoted context omitted.

Agreed. This appears to be the ordinary process. Can anyone point out what might be of interest here.

The only thing I can point to us this is one of the few cases where some piece of atrocious online harassment actually ended up with someone being held accountable in anyway. There have been plenty of cases of death threats and bomb threats and other such things that didn't seem to trigger any kind of real response.

Isn't it way easier now to find harassers on Twitter because Twitter made a telephone number linked to the account mandatory in some (all?) cases?

Re: How police found Twitter user accused of sending seizure-triggering GIF

#17
post #8

Dumb question, but what is the meaning of AT&T "toll records" used to link the user to an iPhone 6? > "AT&T responded and a review of the subscriber information showed the telephone number was associated with a Tracfone prepaid account with no subscriber information. However, a review of the AT&T toll records showed an associated Apple iPhone 6A Model 1586" That is, if you are a Tracfone user and Tracfone uses AT&T t…

Toll records would be the CDR, I'd imagine. [0]

[0]: https://en.wikipedia.org/wiki/Call_detail_record

Re: How police found Twitter user accused of sending seizure-triggering GIF

#18
post #5

Desktop browsers allow you to disable auto-playing animated images. I'm surprised mobile browsers don't seem to have this. If I suffered from this, I'd want some sort of reasonable protection from asshats.

> reasonable protection from asshats Is there a strong argument that distinguishes this case of being "asshat on the internet" vs "homicidal with intent to kill"?

That would require insight we don't really have. Personally, I had no idea something like this would work. I assumed it would need something more powerful in intensity, like an actual strobe light.

Maybe the suspect in this case knew it would work, maybe not.

Re: How police found Twitter user accused of sending seizure-triggering GIF

#19
post #8

Dumb question, but what is the meaning of AT&T "toll records" used to link the user to an iPhone 6? > "AT&T responded and a review of the subscriber information showed the telephone number was associated with a Tracfone prepaid account with no subscriber information. However, a review of the AT&T toll records showed an associated Apple iPhone 6A Model 1586" That is, if you are a Tracfone user and Tracfone uses AT&T t…

So the lesson is if you are trying to murder people over the internet, don't plug your anonymous sim card into your iphone which is tied to your identity?

Re: How police found Twitter user accused of sending seizure-triggering GIF

#20

TL;DR Twitter gave the police information about the phone number which registered the account that sent the seizure-triggering gif AT&T gave the police information that is was a Tracfone prepaid account with an associated toll record that was an iphone Apple gave them access to his cloud account which had all the incriminating details needed including email / picture of him with his drivers license and data about the…

It should be noted that in the document, Twitter and Apple were provided search warrants whereas AT&T received a "request."
Post reply on HN