Federal prosecutors have charged two men with allegedly participating in a series of whacking attacks on more than a dozen owners of compromised Ring security cameras and using that access to livestream police response on social media.
Kya Christian Nelson, 21, of Racine, Wisconsin, and James Thomas Andrew McCarty, 20, of Charlotte, North Carolina, gained access to 12 Ring cameras after compromising each owner’s Yahoo Mail accounts. Central District of California. In one week, beginning Nov. 7, 2020, prosecutors said, the men posted false emergency calls to each owner’s local police departments designed to provoke an armed response, a crime known as whacking. .
For example, on Nov. 8, local police in West Covina, California, received an emergency call purportedly from an underage child who reported that her parents had been drinking and firing guns in the minor’s home. When police arrived at the residence, Nelson allegedly gained access to the residence’s Ring doorbell and used it to verbally threaten and taunt the responding officers. The indictment alleges the men helped carry out 11 similar hit-and-run incidents in the same week, which took place in Flat Rock, Michigan; Redding, California; Billings, Montana; Decatur, Georgia; Chesapeake, Virginia; Rosenberg, Texas; Oxnard, California; Darien, Illinois; Huntsville, Alabama; North Harbor, Florida; and Katy, Texas.
Prosecutors alleged that the two men and a third unnamed accomplice would first obtain Yahoo account credentials and then determine whether each account owner had a Ring account capable of operating a doorbell camera. The men would then use their access to collect the account holders’ names and other information. The defendants then placed the hoax distress calls and waited for armed officers to respond.
“Defendants Nelson and McCarty allegedly accessed the victims’ Ring devices without permission and then sent the audio and video from those devices on social media during the police response,” the plaintiffs wrote. “Defendants Nelson and McCarty allegedly verbally taunted responding police officers and victims through the Ring devices during the police response.”
It is not clear how the defendants obtained the Yahoo account login details.
A separate indictment filed in November in the Arizona District alleged that McCarty participated in swatting attacks on at least 18 individuals.
Nelson, who went by the nickname ChumLul, was already imprisoned in an unrelated case in Kentucky when the charges were filed. McCarty, whose online address was Aspertaine and who lived in Kayenta, Arizona at the time of the alleged crimes, was arrested last week.
Both men are charged with conspiracy to intentionally gain unauthorized access to computers. Nelson was also charged with two counts of willful unauthorized access to a computer and two counts of aggravated identity theft. If convicted, both men face up to five years in prison. Nelson faces an additional maximum sentence of at least seven years on the remaining charges.
Neither man has yet entered a plea.
The incident underscores the importance of securing email and home security accounts with long, randomly generated, unique passwords. Where possible, people should also use multi-factor authentication.
