Threat Intelligence Blog

Posted December 20, 2012

In the aftermath of tragedy (natural or man-made), people are struggling to comprehend what has happened, how to cope and how to move on. Amidst the emotional and psychological mix of shock, anger, frustration, and bereavement, people are attempting to comprehend the event and make sense of a new reality. It is unfortunate that among the many people who sincerely and altruistically assist and support the victims of such tragedies, there are some who capitalize on the pain of others and are pure opportunists, scammers, and deviants. Tragedies such as mass shootings or acts of nature (i.e., tornados, hurricanes and earthquakes) bring out both the best and worst in people.

It is sadly very important to recognize and understand the types of post-incident behaviors and actions that will target victims, victims’ families, law enforcement… and in the case of the Sandy Hook Elementary School shooting, the school, teachers, and administrators. Regrettably in addition to working through the grief, uncertainty and pain of an event, victims, their families and others must protect themselves and become far more aware of their physical security and cyber security in a post-incident environment.

Based on disastrous events that have transpired over the last 2 years, Cyveillance has recognized a pattern of maliciousness which occurs following each event. Protect yourself, your family and your community by recognizing these 10 security concerns.

Fraudulent Campaigns

These email, Internet, social media, and/or text-messaging campaigns are designed by scammers to lure an audience to click on malicious links, contribute to phony fund raising efforts, or to post impersonated social media pages of victims/families. Some of the typical scams could include:

  • Malware: Click here – “Exclusive photos from within the school”
  • Theft Scam: Give to the victims of the shooting/hurricane/tsunami
  • Solicitation of Money, Post False and Misleading Information: This (Twitter page, Facebook page, Website) is in “Memory of the Victim”

In some cases a fraudulent campaign could target the affected community and tailored to the surrounding areas. Other campaigns are more global in nature where the scammers take advantage of large numbers of people who are curiosity seekers or who legitimately want to help.

Issue Advocates and Extremists

Issue advocates and those with extreme viewpoints will try to use the incident to support their specific views. Numerous persons may infiltrate the community and take advantage of post-incident events (i.e., funerals, clean-up efforts, memorials) to further their cause. Some notable protesters, demonstrators, and harassers rally around topics such as:

  • Religion
  • Politics (i.e., gun control, global warming)
  • Mental Illness
  • Violence Against Children
  • Violence in the Media (TV, movies, video games)

Some extremists could go “over the line” with victims’ families, law enforcement or others representing an opposing cause.

Identity Theft

Whenever there are deaths involved in an incident, identity thieves may try to profit from the expired identity. Following many tragic events, the names, ages, etc., of the victims are made public. While dealing with the aftermath, no one is going to think about this in the first days or weeks after a tragedy which makes it a perfect time for criminals to steal their IDs.


Due to the media attention and publication of many of those people who are impacted by the incident, spear phishing of victims’ families, school administrators, law enforcement occurs based on particulars published in news reports.


There are intruders or individuals who want to insert themselves directly into the lives and crisis of those who are impacted. Intruders are those people who want to desperately make contact with someone close to the incident through pretexting or unscrupulous means. The target could be a victim, a member of a victim’s family, law enforcement or a witness. The motivation for contacting and intruding upon victims could be:

  • to solicit information for a sensationalized news story
  • to gather “insider information” to post on social media
  • to satisfy a curiosity seeker
  • to offer services (i.e., psychics, ghost hunters)
  • to social engineer information for criminal purposes
  • to be near a person because of obsession
News reporter approaches a Newtown Connecticut resident with questions about the Newtown massacre.
A news reporter’s eager attempt to gain information from members of the Sandy Hook Elementary community.

Some of these intruders may not only attempt to contact persons via phone, social media or through US mail, but may also be inclined to show up on their property/homes.

Vendor Overload

People directly involved with or impacted by a tragedy may be contacted by vendors – some legitimate, some scammers. Depending on the type of incident, different service offerings may be presented. In the case of a school shooting, the school, administrators and teachers may receive “scams” and legitimate vendors offering security services, surveillance, protective detail services, Xray machines, and security guards. While many of these services may be genuine, the volume of solicitors, marketing materials, and sales presentations could be overwhelming. It is also a difficult time to sort out the real services from the scams.

Excess of Good Wishes

When an event attains prominence in the mass media and has a great deal of focus and attention, many very good hearted individuals and groups from around the US and the world come together to show support for the victims and those impacted. It is mostly assumed that those who appear to send good wishes, thoughts and prayers to the victims are actually doing a good thing…and they are. However, sometimes from the victim’s perspective, the overabundance of mail, email, phone calls, media attention, cards, teddy bears, candles, etc. can be extremely overwhelming and create more stress. In an instant a potentially unknown person or family is thrown into the spotlight and is getting massive attention from strangers… and strangers who seemingly know a lot about them.

Increase in Firearm Sales

Highly publicized violent crimes will always result in an upsurge of gun sales nationwide. The public should be made aware of the risks associated with purchasing and owning a firearm to include keeping it in a home with children and individuals with psychiatric disorders. Local law enforcement and gun clubs should be proactive and provide communities free and easy access to firearm safety / training classes and gun safety locks to reduce the possibility of additional gun-related deaths.

National Instant Criminal Background Check
Image credit: USAToday.

Copy-Cat Watch

Children (elementary, middle and high school) may be expressing sentiments of empathy with the shooter (“that was cool”, “maybe I’ll shoot-em up in my school”). Post-incident is a critical time to monitor for additional chatter (in person, voice, or social media) which may indicate that a child or adult is expressing sympathetic sentiments about the tragedy. While this may not indicate that the person is going to literally copy the shooter, it may be indicative that the person is having difficulties dealing with the emotion of the event and having psychological difficulties processing the meaning of the event.

Escalation of Deviants

The aftermath of a tragedy also increases the probability that deviant persons will surface with the desire to inflict more pain on an already traumatized victim or community. Individuals or groups may reach out personally via mail, email, phone, fax, or text with the intent to:

  • prolong or exacerbate the hurt on victims and/or their families by sending inflammatory or explicit photos or messages
  • stalk, cyber-stalk or harass those who were impacted
  • blame the survivors; not only may victims’ families and members of law enforcement receive unwanted attention, but survivors of the incident maybe targeted (i.e., “this should have been your child,” “you were a terrible teacher, too bad the shooter didn’t get you…”)
  • terrorize, scare, or torment by creating diversions or may be an act that follows the main incident, such as a bomb threat or a death threat after the primary incident.
A Facebook page honoring Adam Lanza
This inflammatory page appeared on Facebook shortly after the tragedy in Newtown.

Additional Posts

The Right to Bear Low Orbit Ion Cannons

DDoS Attacks as Constitutional Problem: Germany's Experience A distributed denial of service (DDoS) ...

“Like” My Company, Win a Prize??

Five Tips to Spot Promotional Scams and How to Ensure Your Promotion is Legal Sweepstakes and ...