Swatting

How it works

CISA describes swatting as criminal activity by an individual or group who knowingly provides false information to law enforcement suggesting that a serious threat exists at a particular location, so that law enforcement responds with tactical units. The caller falsely reports a violent emergency, such as an active shooter, bomb threat, home invasion or hostage situation, hoping to draw the largest possible response.

CISA adds that swatters may use technology to make the call appear to come from the victim's phone number, and often include personal information gathered online to make the call more believable.

Why it matters for executives

CISA's guidance lists company executives among those targeted by foreign and domestic actors who use swatting to harass or intimidate, alongside government officials, schools, journalists and celebrities. It also notes that swatting actors often rely on open-source information or social engineering to learn about their targets, in the same way as doxing and phishing.

The danger is physical. CISA states that confusion on the part of targets and responding officers has had fatal consequences, and that swatting diverts emergency resources from real emergencies.

Exposed data makes the call easier to stage. A swatter needs an address and benefits from a phone number to spoof and personal details that make the story credible, and public records and leaked data can supply all three. Leaked passwords can matter too. In a December 2020 announcement, the FBI warned that offenders were "using stolen e-mail passwords to access smart devices with cameras and voice capabilities and carry out swatting attacks," likely taking advantage of people who reuse their email password on the device. See doxxing and doxxing executives: a first-day checklist.

Reducing the risk

CISA's guidance, written for election workers and law enforcement, suggests several steps that apply more widely. Reduce the personal information available online: WebThreat's Information Removal specialists file the opt-outs and takedown requests that clear home addresses from people-search listings and verify each removal. Use strong, unique passwords and multi-factor authentication on devices and accounts, including smart home devices. Be careful about posting location details. Talk to local law enforcement about how to flag an address, and talk to household members about what to do if officers arrive.

During an incident, CISA advises staying calm, cooperating with officers, keeping hands visible and making slow movements. Afterward, report the incident to local law enforcement and then the FBI.

How it differs from related terms

Swatting is a hoax emergency report. Doxxing is publishing private information, and often supplies the details that make a swatting call credible. Pretexting is a technique for gathering such details by deception. Swatting is a crime with potentially deadly consequences, so questions about a specific incident belong with law enforcement and counsel.