A 16-year-old male from Ottawa, Canada has been arrested for allegedly making at least 30 fraudulent calls to emergency services across North America over the past few months. The false alarms — two of which targeted this reporter — involved calling in phony bomb threats and multiple attempts at “swatting” — a hoax in which the perpetrator spoofs a call about a hostage situation or other violent crime in progress in the hopes of tricking police into responding at a particular address with deadly force.
On March 9, a user on Twitter named @ProbablyOnion (possibly NSFW) started sending me rude and annoying messages. A month later (and several weeks after blocking him on Twitter), I received a phone call from the local police department. It was early in the morning on Apr. 10, and the cops wanted to know if everything was okay at our address.
Since this was not the first time someone had called in a fake hostage situation at my home, the call I received came from the police department’s non-emergency number, and they were unsurprised when I told them that the Krebs manor and all of its inhabitants were just fine.
Minutes after my local police department received that fake notification, @ProbablyOnion was bragging on Twitter about swatting me, including me on his public messages: “You have 5 hostages? And you will kill 1 hostage every 6 times and the police have 25 minutes to get you $100k in clear plastic.” Another message read: “Good morning! Just dispatched a swat team to your house, they didn’t even call you this time, hahaha.”
I told this user privately that targeting an investigative reporter maybe wasn’t the brightest idea, and that he was likely to wind up in jail soon. But @ProbablyOnion was on a roll: That same day, he hung out his for-hire sign on Twitter, with the following message: “want someone swatted? Tweet me their name, address and I’ll make it happen.”
Several Twitter users apparently took him up on that offer. All told, @ProbablyOnion would claim responsibility for more than two dozen swatting and bomb threat incidents at schools and other public locations across the United States.
On May 7, @ProbablyOnion tried to get the swat team to visit my home again, and once again without success. “How’s your door?” he tweeted. I replied: “Door’s fine, Curtis. But I’m guessing yours won’t be soon. Nice opsec!”
I was referring to a document that had just been leaked on Pastebin, which identified @ProbablyOnion as a 19-year-old Curtis Gervais from Ontario. @ProbablyOnion laughed it off but didn’t deny the accuracy of the information, except to tweet that the document got his age wrong. A day later, @ProbablyOnion would post his final tweet: “Still awaiting for the horsies to bash down my door,” a taunting reference to the Royal Canadian Mounted Police (RCMP).
According to an article in the Ottawa Citizen, the 16-year-old faces 60 charges, including creating fear by making bomb threats. Ottawa police also are investigating whether any alleged hoax calls diverted responders away from real emergencies.
Most of the people involved in swatting and making bomb threats are young males under the age of 18 — the age when kids seem to have little appreciation for or care about the seriousness of their actions. According to the FBI, each swatting incident costs emergency responders approximately $10,000. Each hoax also unnecessarily endangers the lives of the responders and the public.
Take, for example, the kid who swatted my home last year: According to interviews with multiple law enforcement sources familiar with the case, that kid is only 17 now, and was barely 16 at the time of the incident in March 2013. Identified in several Wired articles as “Cosmo the God,” Long Beach, Calif. resident Eric Taylor violated the terms of his 2011 parole, which forbade him from using the Internet until his 21st birthday. Taylor pleaded guilty in 2011 to multiple felonies, including credit card fraud, identity theft, bomb threats and online impersonation.
In nearly every case I’m aware of, these kids who think swatting is fun have serious problems at home, if indeed they have any meaningful parental oversight in their lives. It’s sad because with a bit of guidance and the right environment, some of these kids probably would make very good security professionals. Heck, Eric Taylor was even publicly thanked by Google for finding and reporting security vulnerabilities in the fourth quarter of 2012 (nevermind that this was technically after his no-computer probation kicked in).
Update, 2:42 p.m. ET: The FBI also has issued a press release about this arrest, although it also does not name the 16 year-old.
Glad these nitwits can’t provoke anything more out of your local PD than a late night phone call and that Family Krebs remains safe.
Might be a good idea to drop a couple boxes of doughnuts at the station in appreciation of no blue lights or broken door frames.
I might add, though apparently intelligent (not smart) and with skills, it is fortunate that their immaturity also combines with narcissism and sloppyness.
I’m wondering if this is the same person who advertises on a .onion address inside of Tor offering to swat innocent people for Bitcoin.
What are you talking about? These nitwits are successful a fair amount of the time, and even BK has had a SWAT incident play out at his home, which he refers to in this article, and which is detailed here: http://arstechnica.com/security/2013/03/security-reporter-tells-ars-about-hacked-911-call-that-sent-swat-team-to-his-house/
Great report and great news. To note, Kurtis’s twitter is @ProbablyOnion2.
Regardless, great writeup Krebs.
Before it was @ProbablyOnion2, it was @ProbablyOnion. His first one was canned by Twitter.
In some ways it is a shame that these offenders are juveniles. Perpetrators of swatting should face serious punishment, but I cannot bring myself to argue for juveniles to be punished in the way that adults would.
We must assume that the young can be rehabilitated, and account for youthful indiscretion.
A bit of researh on the history of New York should yield ancient headlines regarding very young teens being hung for stabbing murders, etc.
It is perhaps more a matter of culture than individual age, whether or not a wayward soul can veer off the road to perdition.
Or not.
I think we should at least make a good attempt at rehabilitating these guys. They obviously have talent with computers, if misguided. It’s like BK says, these kids could probably make good security professionals with the right guidance, Frank Abagnales for the computer age.
I doubt it, they don’t have any real discretion or control, they probably have a solid 2.0 GPA and if the parents are so absent I doubt they ever learned how to chip in and work or stick with things that got hard. They will probably never get admitted to college which basically bars them from 95% of all IT and computing jobs besides entry level. I think they have a far higher chance of being in jail most of their 20s and 30s rather than receiving accolades for achievement, but some of that is how our system is stacked against experimentation in favor of conformity – the job market isn’t hard up enough for workers to take the risk on anybody that isn’t playing the game.
anybody can be rehabilitated, depends on the person not the age.
No preventive care and treat by age, is whats wrong with the American healthcare system and its doctors too.
Great article BK, I was just at a birthday party last weekend, and some girl was telling me some kid tried to swat her for losing in a video game. And about how she doesn’t even use the internet much anymore, after she had her kid, because people steal her passwords and try to ruin her life, posting pics, calling her house her job etc…. She use to frequent alot of those type of sites if you know what I mean, so like Krebs, knew ahead of time to call the police…lol She was shocked to find people talking about her on these sites, and about things she never told anyone.
But luckily the detectives just came to her house instead of the swat team, and got some threads taken down offline. I live in NYC they probably more up on this type of thing.
Happens to alot of people, I believe when airport detectives came to my house last year, saying our address came up, my first thought was these quake gamers, getting me labeled a terrorist….haha All because I don’t believe in cheating. I get my life threatened, my networks destroyed, photoshopped pics of me and threads made about me. They just gave us their card and said to call for any weird calls or packages.
What I find sad is that game developers don’t even care that hackers make more money off their pc games then they do. I would love to see an article about that industry. These guys that hack all the games and then sell subscriptions to their cheats.
But Its just scary how intrusive and immature people online are nowadays, and how untouchable these kids feel. It can actually be very dangerous, they might even become a victim themselves. People still think online is like some different reality.
“Most of the people involved in swatting and making bomb threats are young males under the age of 18 — the age when kids seem to have little appreciation for or care about the seriousness of their actions.”
In males, the prefrontal cortex — the part of the brain that carries out executive function (e.g. determine the difference between good and bad, predict outcomes of one’s actions, or suppress urges) is sometimes not fully developed until the age of 25. It depends on the individual; some develop it more quickly than others, and women tend to develop it more quickly than men.
In other words, these people very likely simply don’t yet own brains that allow them to clearly tell that they’re doing something horrible, to predict that they’re going to hurt themselves, and to stop themselves from carrying out their actions.
I don’t know what this means for how they should be punished, but I think it’s fair to say that these people very likely will develop these brain functions as they grow up, and in that context, past behavior may not necessarily be prologue to future behavior. Like you say, they may yet turn out to be valuable security professionals, once their brains are fully developed.
On a related note, I’m torn on the idea of disallowing people from using the Internet. In today’s world, that effectively means that you’re making it borderline impossible for them to find a job. Even if they manage to apply for a job without using the Internet, how many jobs are there out there that don’t require at least some Internet use?
They should have thought of that before they risk people’s lives and cost the taxpayers tens of thousands of dollars… I’m good with one strike you’re out when it means schools closing and seniors getting denied services so these perps can keep on pranking.
Maybe, but note that for them it’s just a single phone call. There’s very little relation between effort and cost. As kids they may have a hard time seeing that, giving their non-existent upbringing.
The point is that they simply lack the ability to think of all of the ramifications beforehand. You can’t respond to that by saying “well, they should have thought of that”. It makes no sense.
It is a valid response, he obviously had read up on others that have done it, he knew he was playing with fire and it seems pretty dumb that he didn’t expect to get burned by it. He obviously knew it was a crime, and was dancing around begging for the cops to come and get him – if it was murder or setting animals on fire or vandalizing a couple dozen cars would you be saying “Oh poor little simpleton didn’t know it was wrong.”
To quote the great Ron White – “Too bad, he didn’t roll his poop into balls and eat crayons!! The penalty is much less severe!”
Sounds like a lot of psychobabble nonsense. It fails to explain how the vast majority of people (boys and girls) under the age of 25 do NOT get arrested for such criminal actions. Despite being “undeveloped.” And it justifies letting criminals continue committing crimes.
Those teaching the theory that “kids are incapable of telling right from wrong” are more responsible for more juvenile delinquents than any other single source, save possibly those teaching false information about drugs and drug use.
“Sounds like a lot of psychobabble nonsense.”
Sounds like you don’t want facts to interfere with your prejudices. You don’t believe in neuroscience?
“It fails to explain how the vast majority of people (boys and girls) under the age of 25 do NOT get arrested for such criminal actions.”
That makes no sense. The fact that juveniles do not have fully developed prefrontal cortexes does not mean that all of them absolutely must get into swatting. It’s strange that you would suggest otherwise.
However, it does mean that juveniles often do dumb things, which is plainly true. In fact, it’s why we treat them differently when they do offend; we know that juveniles and children can’t be judged the same way adults can.
“Those teaching the theory that “kids are incapable of telling right from wrong” are more responsible for more juvenile delinquents than any other single source.”
That’s like saying “people who teach the theory of gravity are more responsible for suicide by jumping than any other single source.”
Also, please provide sources for your absurd claim.
Glad everything is OK at Castle Krebs, Brian!
Glad to see this swatting kid was apprehended before he was able to do even more damage. I have a question about the Pastebin expose you linked to, how were the people doxing Curtis able to gather so much information, it would imply all his computers and telephones were hacked as well as those of his mother, father, grandfather, girfriend, etc. Even if that is the case it would take many hours of work to build such a dossier.
Finally was the pastebin post the info Polcie used to identify him or they used independent gathered info ?
“girfriend”? If he had a girlfriend he wouldn’t have the desire to do this stupid stuff. Now finding a girlfriend for this idiot is going to be difficult unless Lindsay Lohan could be persuaded to take this charity case.
I’m thinking the same thought. I’ll bet this character’s rage stems from the fact the Canadian government put him on a long waiting list for ‘gender reassignment surgery’. Like with Dylan Klebold, he couldn’t take the bullying.
here is the pastebin in question – http://pastebin.com/G2Yp4wSR
According to Pastebin, Curtis Gervais’ Youtube channel is http://www.youtube.com/user/kooldudehf/videos . He has a video about a Java exploit and a Chrome exploit.
And one of his videos is titled :
http://www.youtube.com/watch?v=SruCFjGVTEY
Bullying Awareness – Make it stop.
He is soon to become the “girlfriend” of his 6’4″ 245lb cellmate!
Because rape is sooo funny when it happens to men, eh?
The jail rape culture is a US thing.
As a Canadian juvenile he is unlikely to face any serious jail time let alone be placed with dangerous offenders. If he has previous convictions then he might see some time in a juvenile facility.
Yes, raping children is the proper response to juvenile crime. Good one.
The kid is a huge troll, many years from now he will think back and realize “how stupid I was for doing such a moronic thing”
In the Pastebin document there is a section where allegedly himself claims to have some (mental) disorder.
I saw that to , my first thought was autism (Asperger syndrome ) with compulsive behavior traits.
This is basically anti-social behavior with all the implications for the future of these kids. They should be watched very carefully and get electronic bracelets to wear for a long time so they can be found again fast.
You call it anti-social behavior but that’s more like being a dangerous person with a psychopathic personality. Their is a research study online that relates autism and Asperger syndrome to males who are hackers
I do like the fact you mentioned this:
“In nearly every case I’m aware of, these kids who think swatting is fun have serious problems at home, if indeed they have any meaningful parental oversight in their lives. It’s sad because with a bit of guidance and the right environment, some of these kids probably would make very good security professionals.”
Because, granted he made a whole bunch of mistakes here, it might as well be a cry for help as well (even without him knowing it).
Glad no-one got hurt though, but, more attention needs to be given to people who do not seem to find a place in this world. (criminal acts are most often just a thing they do, not something they consciously go for like psychopaths do).
Do keep in mind, it is of course not black and white in this grey world we live in, and every situation is different. I do not know this kid or his background. just saying, hope they aren’t too harsh on him either and get him a decent shrink + support to get somewhere in life… enough lost souls as it is.
Well, lots of people have lousy childhoods, yet manage to stay within the law, certainly manage not to harm or cause the deaths of other people or cost municipalities tens of thousands of dollars in faked calls for help.
To say this poor soul is crying out for help is about as logical as saying this kid is a sociopath who should be locked away and treated with powerful drugs. We readers, after scanning 3-4 paragraphs, cannot conclude anything about someone other than that it looks as though he did some very bad things and the power went to his head.
The court has to decide his guilt or innocence. People like Mr. Krebs and other security professionals have to figure out ways to better protect society from this kind of predator. That’s a pretty clear distinction in my mind. I want to wish harm on this kid, but I’m resisting the temptation. Likewise, I’m resisting the temptation to feel sympathy, because in the end, he (like all of us) is responsible for his own behavior. Just my opinions!
People with psychopathic personality disorder are major manipulator , lack empathy, are extremely charming and highly narcissistic along with having no conscious in what they are doing as far as the crime is concerned . Sorry, I don’t see this kid fitting that type of profile.
Save the funding for the kids that are actually trying to make something of themselves, send this kid’s family the bill for all the costs he racked up and let them figure out whether to keep on paying for his free rent, internet, power, and phone bills.
I would be very interested to get such a profile on myself.
Anybody can help what the prices would be and where do I start?
I’m gay.
Brian,
I would like to receive your feeds, but the links in the upper right side of the page have been broken for over a week now. Is this something that is intentional?
I’m going to guess you’re using Adblock. I don’t know why it does that, but if you allow ads on my site (they’re all hosted in-house) the links should work.
You are correct! That worked, thank you!
Remember the days when we used to call drug stores and ask if they “had Prince George in a can?” Then hang up and laugh uproariously. Ah, those were the days. Not so these days. Glad this dope was caught.
Wow, that pastebin leak was extensive. I couldn’t help but laugh when I saw his dog, Biscuit, had also been doxed along with it.
It’s hard to know what the right course of action is for kids like this but he’s broken the law so I guess a judge will make that decision.
Glad he’s been caught. For someone who clearly has the brains to pull stuff like this off, it’s a shame he then acts like such an idiot. Welcome to planet Earth I suppose.
Curious if the kids named here are being tried as adults or if Canada has different rules when it comes to minors charged with crimes. I thot those under 18 were to remain nameless.
Lisa,
He wasn’t named in any of the Canadian stories about this. That was information from his dox that has been independently confirmed as accurate (apart from his age, as stated in the story).
You are correct – his name would be protected in the Canadian press – which in the Internet age for things like this means little to those with the need to find out.
Oops forgot to add – it would be up to the judge hearing his case whether to raise it to adult court or for him to be sent to juvenile court.
Now of course the US authorities could petition for an extradition but that seems like a stretch.
There’s a fine line between good IT Sec Guy and criminal. IT sec guys know the risk/reward. A criminal ignores the risk and always thinks he too smart to get caught.
Dear Mr. Krebs,
Thank you so much for posting this article and naming the offender, Curtis Gervais. My son has been one of his targets as of this past November we had four cop cars show up at our house at 7:30 in the morning saying that my son had emailed in a bomb threat at his high school and that he was under arrest. They literally entered the house and went upstairs and hauled my unsuspecting son, who was asleep, out of his bed. They handcuffed him and took him downtown to the Ottawa Police Station. Of course that day was the first big snow storm of the season and ALL of our neighbors were outside shoveling and witnessed my son being cuffed and put in the back of the police car. He was held for 7 hours until they cleared him from any wrong doing. They said that the person had sent the emails from my son’s email address and had gone through different countries to hide who he actually was.
He had sent emails to the principle, vice principle and two secrataries that he was going to blow up the school and that he had addresses of some teachers who he may go and kill and that he had lots of firearms and ammuniton. Curtis Gervais went to the same high school as my son, John Mcrae Secondary School in Barrhaven(Ottawa),Ontario, Canada, and they had a couple of classes together one of which was a computer tech class in which my son sat beside him. My son played a prank on him by plugging in a mouse to his computer. This threw Curtis into a rage because he thought he was being spied on. That day he went home for lunch and came back bragging that he had all of my sons information and my husbands also. My husband went to the vice principle about it and they said it would be taken care of.
Two days later we had the cops at the door. After my sons arrest Curtis started rumours that my son had been arrested and that he was a terrorist and that he had seen his parents in the office with the police the day that this all happened. The only thing was is that we were never at the school that day so it confirmed that Curtis had set the whole thing up. He also was taunting my son on twitter asking how the cops were and other comments of which we reported to the police. The school said they would change things around so that my son didn’t have to be in class with him or at the very least not have to sit near him but Curtis stopped showing up for class and after mid term exams he quit school and was apparently being home schooled(ya right).
My son was put through hell because of this degenerate and suffered night mares that the cops were coming back to get him. Even up to about a month ago Curtis was up to his tricks. He called in a bomb threat to the middle school my son had gone to and he some how did it through our phone number. A police station in Ottawa, Illinois alerted the police here in Ottawa. My son was brought down to the office and my husband was called in. My son had to prove where he was at the time of the call in which he was in class and my husband was asked if we had made any phone calls that morning in which we had not. We have also received prank phone calls on occasion. We heard on the news on Friday about the arrest of a 16 year old Ottawa teen for swatting incidents and immediately thought it must be Curtis.
Unfortunately though in Canada they can’t name young offenders so we couldn’t be sure until we read your article thismorning. Also, on the news they said the didn’t think any of the swatting incidents had been done in Ottawa which also threw us off from being sure it was him. Now that you have confirmed his name we will be contacting the detective we had delt with to find out if there is anything we can do to hold him accountable for what he has done to my son . Again, thank you for naming Curtis in your article. I just wanted to share our story with you and maybe they’re will be others who have been violated that may come forward after hearing our stories.
Sincerely,
D. G.
Thanks for sharing your story, Dana.
Where are the kid’s parents in all this? Not sure how it plays out there, but in the US the only real recourse would be suing the family, might pucker the kids rear though when his folks get sued for $50k, they are probably already looking at getting a bill for that much from the local authorities.
Dana and Brian,
First Dana,
So sorry this happened to you, and thank God it didn’t become worse than it did. But what an ordeal you went through and I, as a parent cannot believe that these kids do these vicious attacks against each other.
Brian,
This is reason enough to keep doxing these little bastards.
ownt kid.
Love the story, really made my day.
Brian, the link to the Ottawa Police page is dead, it brings up a “not available” error page.
As for the link to the Pastebin information, I think that was inadvisable. There is too much personal information there, not just about the young person who was arrested but about other family members. Personally, I feel sorry for the dog, who is probably innocent …
I don’t know why the Ottawa Police took that link down, but I’ve fixed the link to the cached version.
I obviously disagree with you about posting that dox about him. This kid posted the personal information of lots of innocent people online, and he was counting on Canadian laws that would keep his name out of the press there.
“… he was counting on Canadian laws that would keep his name out of the press there”
Correct. From the Ottawa Police Service report :
“The youth cannot be identified, per Youth Criminal Justice Act”
An interesting case of someone in one country doing something using the internet which may not be illegal in their own country but is certainly illegal elsewhere.
Maybe the kid believes like David Berkowitz, where dogs are the mastermind of the entire operation.
Wow, this guy caused a lot of damage.
I wouldn’t want his knowledge to be thrown away, however.
At first glance it does not sound that bad. Reviewing further it gets a bit scary to me on several fronts. Not just the damage these people are doing to others but the invasion of privacy that exists on the internet. The Pastebin link shows the extent of his activity and it scares me that people can gather so much information about people’s on-line activity. I really do not want people knowing what I do in my spare time.
Over a year or so ago I listened to a television interview given by the CEO of Google in regards to privacy, before all of this monitoring was in the news. Google’s CEO responded that if you are doing something wrong on the internet then perhaps you should not be doing it. The problem I have with that statement is who decides what is wrong.
Canada’s Youth Criminal Justice Act is not necessarily a hollow law. The below snippet from page 70 (http://laws-lois.justice.gc.ca/PDF/Y-1.5.pdf) allows for children of ages 14-17 to be prosecuted as adults. Under 12s receive a get-out-of-jail-free card.
72. (1) The youth justice court shall order that an adult sentence be imposed if it is satisfied that
(a) the presumption of diminished moral blameworthiness or culpability of the young person is rebutted; and
(b) a youth sentence imposed in accordance with the purpose and principles set out in subparagraph 3(1)(b)(ii) and section 38 would not be of sufficient length to hold the young person accountable for his or her offending behaviour.
Good post PC Cobbler – your on a roll! 🙂
“(nevermind that this was technically after his no-computer probation kicked in).”
Did anything happen becasue of that?
Brian,
Grab that Pastebin content before it gets taken down. Posting personal info on pastebin is TOS violation.
I was falsely arrested for the Norte Vista Riverside Ca bomb threat. This has caused my family untold anguish and financial hardship. If you have any information if this man is responsible please contact me.
The Ottawa Police link at http://www.ottawapolice.ca/en/news/index.aspx?newsId=84f8c70d-7fbd-4221-b31e-b2a071345360 seems to work.
Noteworthy that firearms and ammunition were also seized. In Canada, there are some regulations and permits that are to be followed to legally have these things. Now it may be that his dad just lost his hunting rifle or the kid may be in even more serious trouble.
Hopefully the little prick will get the help that he needs and he can turn his life around before it’s too late. If not, he sounds like a psychopath in the making. Glad that he got caught, and that he can no longer pose a danger to those who must respond to these hoaxes, or those who are the target.
Very sad that these actions are making the case for a national internet id and taking away more of our privacy.
They are not making that case. On the internet no one knows you’re a dog, remember? That national internet id can be stolen and faked obviously, would never work, only would make identify theft even more easier.