The first 911 call came at 4.30pm. The caller told dispatchers that a man, woman, and boy had been shot and another child was being held hostage. Police responded in force, sending more than half a dozen cruisers and emergency vehicles to a sprawling house in the affluent Atlanta suburb of Johns Creek.

But when they arrived there were no signs of a shooting; inside, police found a nanny with two small children. When the mother returned from shopping she found her home surrounded by emergency vehicles. The father, who had been on a plane, landed at Atlanta’s international airport to see his house on TV, with news reports declaring that his wife and children had been shot.

They were victims of a swatting attack, a malicious form of hoax where special weapons and tactics (Swat) teams are called to a victim’s home under false pretenses, with potentially deadly results.

Just more than a week later, on 25 January 2014, someone launched a second swatting attack on the same home. This time the Johns Creek police were prepared: they responded with two cruisers to make sure everything was OK.

DS Ben Finley was assigned to the case and was told to do whatever it took to find the people who did this. It would take him on a circuitous voyage that lasted nearly a year and involved dozens of local law enforcement agencies, the FBI, and the Royal Canadian Mounted Police.

It’s a case that demonstrates just how difficult it is to track down and prosecute online harassers, thanks in part to the ease with which malicious individuals can operate anonymously on the internet, and a legal system that is still playing catchup to 21st century technology.

A year-long investigation

“When I started out I had never worked one of these cases and had no idea what to do,” says Finley, an amiable man with a buttery Georgia drawl. “I called anyone I thought might know anything about these types of investigations. I would just take each piece of the puzzle and see where it led me. I was baptized by fire.”

Finley started by tracing the numbers the swatters used to call the Johns Creek emergency hotline. Because calling 911 only connects to local emergency services, swatters in distant locations call non-emergency lines and ask to be transferred. To mask their true locations, they use voiceover-IP (VoIP) numbers that appear to be in the same area code as their intended victims.

In late January 2014, Finley issued subpoenas to a half dozen major VoIP providers, obtaining the numbers the swatters had called, logs detailing when each call had been made, and the email addresses and websites swatters used when signing up for VoIP services. Over the next few weeks, Finley scanned the list of numbers looking for those characteristic of public police lines – such as 877-ASK-LAPD – and talked to the dispatchers in each city.

Sure enough, they had received emergency calls on the dates and times in question. Finley then went to the victims of the swatting attacks, some of whom were already working with local law enforcement, and obtained their details. Over the next year he filled a conference room at the Johns Creek station with boxes of police reports, victim affidavits, and audio recordings.

“A lot of the IP addresses that were generated through the subpoena and court order process were from virtual private networks and proxy sites all over the world,” Finley says. “Tracking them down was a hell of a task.”

Canadian police knew exactly who the hoaxer was

At first, Finley says, he was looking for a single perpetrator. But the paths he followed kept diverging – the first call pointed toward a person in New York, the second indicated a swatter in Canada. As it turns out, the second attack was a copycat of the first, which had received broad media attention.

Finley caught a break when he traced the calls from swatter No 1 to a cloud services firm in New York, to whom the swatter had given his real name and address. When Finley contacted local police, he discovered this individual had been linked to similar crimes in the past.

He was a 16-year-old active in online gaming circles, where swatting is a common malicious prank. Finley doesn’t know why swatter No 1 targeted that family in Georgia, but he believes it was a mistake – the location was the former address of another teenager who was a highly visible gamer on YouTube. The Fulton County district attorney agreed to transfer prosecution of the case to the swatter’s local jurisdiction, where it is still pending.

Finley used an email address associated with one Skype account to uncover a personal website for the second swatter, whose online handle was Obnoxious. Using that email, he found a page on the text-sharing website Pastebin where one of Obnoxious’s enemies had revealed his name and address. According to that page, Obnoxious was a minor living in Coquitlam, British Columbia. When Finley called the Royal Canadian Mounted Police (RCMP) in Vancouver, they knew exactly whom Finley was talking about – the youth was already on probation for similar crimes.

With the help of the FBI, Finley pored over the mountains of evidence, eventually connecting Obnoxious to more than 40 incidents. (He was also the subject of a New York Times magazine profile, The Serial Swatter, in November 2015.)

“This kid was unbelievable,” Finley says. “He was calling everyone and everything – schools, businesses, private residences, law enforcement, the FBI’s weapons of mass destruction hotline, even Disneyland. Nothing was sacred to him.”

In November 2014, the RCMP asked Finley to send him evidence for the strongest 10 cases he had built against Obnoxious so they could obtain a search warrant for his home.

Then Obnoxious decided to take his act public. On 1 December 2014, he live-streamed swatting two homes in Ohio on YouTube, boasting about it first on Twitter. The parents of one previous swatting victim saw it and called Finley, who then notified the RCMP. Four days later, the 17-year-old was arrested. In May 2015 he pleaded guilty to 23 counts of extortion, public mischief, and criminal harassment; he was later sentenced to 16 months in youth custody and was due to be released in April 2016.

‘A different perspective when you’re the mom in the doorway’

One of the problems with pursuing swatters is that, in most jurisdictions, swatting itself is not a crime, though the act might violate other local laws such as abuse of emergency response services. Another is that law enforcement agencies usually lack the expertise or the resources to investigate such crimes.

In November 2015, around the same time that reports about Obnoxious became public, congresswoman Katherine Clark, a Democrat from Massachusetts, introduced a bill that made swatting a federal crime. (The bill has been referred to the House subcommittee on crime, terrorism, homeland security, and investigations.) Finley has been working with state officials to introduce a similar bill in the Georgia state legislature.

On 31 January 2016, the second-term congresswoman was the victim of a swatting attack on her home in Melrose, Massachusetts – an attack she believes was directly related to her bill.

“I’d heard all about swatting and have talked to the victims,” she says. “But you get a different perspective when you’re the mom standing in the doorway, with your family in the house behind you, looking at a full police response with long guns drawn on your front lawn. It gave me an idea of how frightening and dangerous this could be. And it made me more determined than ever to do something about it.”

In March, Clark addressed the second part of the problem – the lack of law enforcement expertise – by introducing the Cybercrime Enforcement Training Assistance Act, which would allocate $20m a year to train local police departments on how to investigate and prosecute cybercrime.

“I’ve heard from many victims of severe online threats who say police departments want to be helpful but aren’t sure how to protect someone who’s been harassed online,” she says. “It’s not from a lack of will or compassion, they just don’t know how best to proceed.”

Anonymity is being misused

The third, much more difficult problem, is the relative ease with which individuals can operate relatively anonymously on the internet, using free VoIP numbers, encrypted communications, proxy servers that obscure internet protocol addresses, and similar technologies.

As Finley demonstrated, it’s not impossible to hunt down suspects who use these technologies – it’s just extremely time-consuming and resource-intensive. Finley estimates he spent more than a thousand hours tracking down those two teenagers, neither of whom will spend much time behind bars, yet this is a crime that can cost police departments as much as $100,000 per incident and could result in fatalities. It’s a crime they’re far more motivated to solve than, say, threats issued via Twitter.

Despite all this, there are some who argue that the ability to remain anonymous on the internet is essential, and a sign of a healthy government. “The ability to speak anonymously enables people to express minority opinions,”said Greg Norcie, staff technologist for the Center for Democracy & Technology. “We’re not going to have a situation where we always solve every crime. If you create a situation where society is without crime and risk, it ends up being very totalitarian.”

As a result, successful prosecution of online harassers is likely to remain relatively rare, with only the most egregious offenders being pursued.

“Technology changes every day, and it’s hard to stay on top of it, along with all the other things we have to stay on top of, like terrorism and people shooting things up,” says Finley. “The internet is like the Wild Wild West. People think they can do whatever they want there, but every now and then the marshal comes to town to restore the peace and get the troublemakers.”