I'm surprised the feebs haven't charged him with something. Yet. He may find himself in Yemen by week's end.

calling a SWAT team to a private residence... should he be up on attempted murder charges?

assault with an assault weapon by proxy? Did the artical miss something where the swat team smashed the guy around a bit?

You'd think that a 911 system would have a slightly better authentication system for where the call was coming from. I guess I'd be wrong.

Do these _still_ come with open maintenance ports? Is Quality Assurance really this pathetic?

And didn't the BOFH send SWAT teams to nasty callers back in 1990?

in California simply pointing a weapon that is classified as an assault weapon is a separate assault charge assault with an assault weapon. Now the proxy part comes into play cause he caused the cops to point an assault weapon at the family. Personally i think they made that charge up to screw him

It's easy if you have (or can socially engineer...) access to a PABX.

It's fairly trivial to set the outgoing CLI over ISDN lines - this is how companies with big phone systems still manage to send the caller ID of a persons DDI number - despite the fact the actual call may have com from one of many IDSN lines...

Set CLI to random house, make call to 911, bingo.

Despite all the technology - emergency services (and other things - such as mobile phone voicemailboxes etc!) still rely on good old caller ID to to their work (of course emergency services see even CLI blocked numbers)

...if I'm a little short of sympathy for this little degenerate.

SWAT teams are notoriously jumpy. That whole family could have been wiped out by accident! Furthermore, what would have happenned if there had been a real crime somewhere else, but the nearest SWAT team was out chasing non-domesticated waterfowl?

Maybe TPTB *did* just make up a charge to screw him. Tough luck for him. Maybe he *should* be sent to Gitmo. And if they have to release some innocent Afghan goatherd to make space for him, so much the better.

I suggest dumping them in Antarctica naked the pile of frozen bodies will make a nice anti pranking campaign shot.

...or did this guy not hack into the 911 system at all. He hacked into another phone system to place the fake call to 911. A bit easier and less serous than the headline suggests methinks...

Thank god he didn't log a call to the ATF, he'd be up for multiple murder by proxy charges now :)

I think there's confusion here between CLI (the number that the recipients exchange sends to the phone, and which can be hacked) and the actual caller identification in the ISDN signalling info, which is much harder to change since it is added by the callers exchange, and not by the terminal equipment. It is that latter information which is (should be) available to emergency services.

Of course it is possible to add extra information into the stream, so that (for example) when A makes a call to B, and B has diverted his/her line to C, the signalling information arriving at C's exchange contains both the details from A and B. Nornally C's exchange would use the A information to generate the CLI, but it isn't unknown for some operators (certain VoIP ones come to mind) to screw this up and send either B's info or no info. A properly configured emergency services unit should (I would hope) be able to see all the signalling information, originating and divert.

"in California simply pointing a weapon that is classified as an assault weapon is a separate assault charge assault with an assault weapon."

That sentect gives me head ache.

It isn't that simple in the UK (or wasn't when I was in a position to play with it). With good old BT DASS2 lines, you could send a CLI modifier as part of the call setup, but the exchange did a range check on it and if you were outside your approved range, would just substitute the default for your system. So you'd get the base part of the CLI supplied by BT and the last few digits supplied by the PABX if they were valid. There was no easy provision for sending a full number and claiming that as your CLI. Of course, modern ISDN signalling may have that hole in it, and there are valid reasons for wanting to be able to map 0845 and similar numbers onto outgoing calls, but that ought to still be validated by the exchange software.

Normally I love reading about the exploits that hackers get up to but this was a really stupid thing to do.

Hacking a bank is an admin problem, getting armed police running around the countryside is akin to attempted manslaughter.

IMHO the boy was an idiot and deserves a slapping. (Mind you the manic US lawsystem will probably put him away for 999 years which is a little OTT as well)

"Emergency" 911 system - why, is there a non-emergency one as well ?

>> in California simply pointing a weapon that is classified as an assault weapon is

>> a separate assault charge assault with an assault weapon. Now the proxy part

>> comes into play cause he caused the cops to point an assault weapon at the

>> family. Personally i think they made that charge up to screw him

Makes sense I suppose, because having an assault weapon pointed at you is so much more distressing than having a handgun pointed at you.

It does beg the question of whether the police normally considered to have committed an offence of 'assault with an assault weapon' after such a raid.

From the article:

>> Thinking that a prowler was roaming his back yard, a resident of the home,

>> identified only as Doug B. in the district attorney’s complaint filed in court,

>> walked outside with a kitchen knife as SWAT officers from the Orange County

>> Sheriff’s Department waited with assault rifles.

All I can say is that it is a good thing he wasn't wearing a rucksack.

Whilst Ellis deserves to have the book thrown at him, I don't think that should take away from the flawed security which allowed it to happen in the first place. Nowhere in the article does it say that the authorities intend to secure the 911 system so that it can't happen again.

Assault does NOT mean hitting someone - that's battery. Assault means causing someone to reasonably fear they are gonna get whacked upside the head.

If you point a gun at someone without good cause you commit assault in just the same way that if you shake your fist at someone without good cause you commit assault. As the kid caused someone else to do it he committed the offence by proxy. Simple.

The bit that made me laugh was "The commotion woke one of the residents, who armed himself with a kitchen knife and slipped outside". I laugh because he didn't get killed as a result, but damn, that could have ended soooo badly.

Or he'd be looking at a felony and the FBI would no doubt be kicking his door in...

----

armed himself with a kitchen knife

----

This was in the US right? A knife? ... well I'll be ... , how quaint.

where he's going he'll be getting his back door kicked in

Worl, CLI is a subscriber service innit, in the USA CLI spoofing is relatively easy (compared to good old blighty, where telcos take a very dim view of this kind of thing and tend to filter presentation numbers, as described above.). Google CLI spoofing for some gen, but the essential point is that CLI relies on info that can be provided by the subscriber.

ANI on the other hand, is a different beast altogether, and is what US telcos use internally to bill customers. Spoofing ANI (at least to a specific subscriber number) is a truly non trivial hack, probably requiring access to a switch.

Erm, at least, that's what I've heard, anyway :-)

If the 911 system is relying on CLI, rather than ANI information, it's broken by design since it is using information supplied by the subscriber (or which *can* be provided by the subscriber, anyway), not the telephone system itself. The 911 switch will have access to ANI, so there's really no excuse for relying on CLI. Maybe he did find a way to spoof the ANI, in which case he's in even more serious trouble.

Of course I could be wrong, it's been a year or two since I kept up to date with this kind of thing.

OTOH if he *had* managed to spoof ANI, how did the cops find him ? That's me off to google to dig up some more inph0.

Either way, calling a SWAT team to someone's house isn't really all that funny considering the immense risk to life, unless of course it was them that posted the address of your teenage house party on facebook, now *that* would be funny.

For all legal purposes, he did.

"Police allege Randall Ellis of Mukilteo, Washington, illegally accessed a phone system in Orange County, California"

The SWAT team was wrought upon a California home, but the dude's in Washington. That constitutes over-the-state-line crime, especially for "hackers". I remember that being mentioned in "Hackers", and I think it has been used before to unleash the FBI against them.

@The other Steve:

I read an article in 2600 some time ago that claimed that you could get an ani fail by some kind of clever buggering around involving an op divert, at which point the system would generate ani data from your cli or even by the last resort of the operator asking you where you were calling from and manually entering (unverified) whatever number you claim.

Ah, this looks like a bunch of highly relevant info:

http://www.google.co.uk/search?q=%22ani+fail%22+%22op+divert%22&sourceid=mozilla-search&start=0&start=0&ie=utf-8&oe=utf-8&client=firefox-a&rls=org.mozilla:en-GB:official

I know making threats of the phone can be federal charge. I'm sure post 9/11 he broke a whole lot of federal charges .

The "non-emergency" number is designated to be "311" in the NANP. Some towns have this implemented (San Jose, California is one). There are other "N11" numbers in use as well.

311 Non-emergency police, etc. (as mentioned)

411 Information

511 Traffic (at least in the San Frnacisco Bay area)

611 Repair. This is very system specific. Try to use your cell phone to get repair on your land line is a bit difficult.

711 Unknown to me

811 At times has been the "Business office". This changes quite a bit and is locally very different.

911 Emergency (usually life threatining). Expect someone at your door (ready to bash it in if necessary) very soon.

It used to happen that some "portable" phones would dial things as their batteries wore out. Typically "dial pulse" (make-break) style dialing. Sometimes it could do 911 which caused ALL sorts of things. Other times (it has been documented) that a dog got tangled up in a phone cord of one of those phones that had nice big buttons to dial an emergency number. Of course in the tangling up of the cords, the dog got the phone to dial the police. They came to an empty house and recued the dog. Wonderful story re-created for a TV show. Operator: "what is your emergency", Dog "Bark Bark...".

An excellent charge. I wish our police prosecutors could be as inventive here in NZ.

The little wanker nearly got a family shot, he deserves to have the book thrown at him.

Anon Coward #4: "It does beg the question of whether the police normally considered to have committed an offence of 'assault with an assault weapon' after such a raid."

Erm, no. At a guess, the police are permitted to make such a raid with such weapons given reasonable grounds. If, however, I threatened you with an assault weapon in California, I'd be liable to get an "assault with an assault weapon" charge. If I convince someone else to do it for me and I get caught, that's where the "by proxy" would come in.

David Neil: If they ever do release him from prison, it won't take long for him to get ready to leave - his shit would be well and truly packed far in advance...

Tom: "911 Emergency (usually life threatining). Expect someone at your door (ready to bash it in if necessary) very soon."

Here in NZ it's 111 and if you're lucky the cops will call a taxi for you.

Consider me updated, cheers :-)

711 is for deaf relay services - operators that translate TTY/TDD calls to & from voice.