{
  "id": "case-barriss-swatting",
  "slug": "us-v-barriss-serial-swatting",
  "title": "U.S. v. Tyler Barriss (Serial Swatting / Wichita Incident)",
  "summary": "Perpetrator of dozens of fraudulent emergency 911 calls and bomb threats across the United States for hire, culminating in a fatal police shooting in Wichita, Kansas, over a Call of Duty video game dispute.",
  "case_number": "6:18-cr-10028",
  "court": "U.S. District Court for the District of Kansas",
  "district": "D. Kan.",
  "country": "United States",
  "opened_at": "2018-03-20",
  "status": "sentenced",
  "victim_sector": "Emergency Services, Municipalities, Schools",
  "victim_country": "United States",
  "loss_amount_usd": 1500000,
  "loss_amount_note": "Caused tragic loss of innocent human life, massive municipal emergency response mobilization, and $1.5 million in damages.",
  "first_seen_at": "2017-01-01T00:00:00Z",
  "last_updated_at": "2026-08-05T12:00:00Z",
  "actor_slug": "swatting-group",
  "defendant_slugs": [
    "tyler-barriss"
  ],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1090",
      "evidence_excerpt": "Barriss routed VoIP phone communications through anonymous proxies and spoofing apps to simulate local caller ID numbers during emergency calls.",
      "evidence_locator": "Plea Agreement \u00b6 5, Page 4",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Plea Agreement: U.S. v. Barriss",
      "source_url": "https://www.justice.gov/opa/pr/serial-swatter-sentenced-20-years-prison-fatal-wichita-kansas-swatting",
      "technique_name": "Proxy",
      "tactic": "Command and Control"
    }
  ],
  "events": [
    {
      "event_type": "arrest",
      "event_date": "2017-12-29",
      "description": "Barriss arrested by Los Angeles police following the fatal Wichita swatting call."
    },
    {
      "event_type": "plea",
      "event_date": "2018-11-13",
      "description": "Pleads guilty to 51 federal charges including cyberstalking, false emergency reporting, and wire fraud."
    },
    {
      "event_type": "sentencing",
      "event_date": "2019-03-29",
      "description": "Sentenced to 240 months (20 years) in federal prison."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Unauthorized intrusion originating from targeted infiltration directed against Emergency Services, Municipalities, Schools networks. Perpetrator of dozens of fraudulent emergency 911 calls and bomb threats across the United States for hire, culminating in a fatal police shooting in Wichita, Kansas, over a Call of Duty video game dispute.",
    "blast_radius": "Caused tragic loss of innocent human life, massive municipal emergency response mobilization, and $1.5 million in damages. Impacted Emergency Services, Municipalities, Schools infrastructure and associated victim operations.",
    "kill_chain": [
      {
        "phase": "Phase 1: Infiltration",
        "title": "Perimeter Ingress",
        "description": "Operatives secured access to victim infrastructure within the Emergency Services, Municipalities, Schools sector.",
        "technical_artifacts": [
          "Network perimeter logs"
        ],
        "mitre_technique_id": "T1190"
      },
      {
        "phase": "Phase 2: Execution",
        "title": "Payload Deployment",
        "description": "Perpetrator of dozens of fraudulent emergency 911 calls and bomb threats across the United States for hire, culminating in a fatal police shooting in Wichita, Kansas, over a Call of Duty video game dispute.",
        "technical_artifacts": [
          "Malicious payload"
        ],
        "mitre_technique_id": "T1486"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across all external remote access endpoints.",
      "Implement network microsegmentation to prevent unrestricted lateral traversal between internal subnets.",
      "Maintain isolated, immutable backups of critical directory services and transaction databases.",
      "Deploy real-time endpoint detection and response (EDR) agents with automated containment policies."
    ]
  }
}