Policy —

How police unmasked suspect accused of sending seizure-inducing tweet

Defendant's iCloud account contained "the exact" GIF used in the crime, cops say.

How police unmasked suspect accused of sending seizure-inducing tweet

The man accused of sending a Newsweek writer a seizure-inducing tweet left behind a digital trail that the Dallas Police Department traced—beginning with the @jew_goldstein Twitter handle, leading to a burner mobile phone SIM card, and ending with an Apple iCloud account, according to federal court documents unsealed in the case.

Rivello with driver's license.
Enlarge / Rivello with driver's license.
Court documents

John Rayne Rivello was arrested Friday at his Maryland residence and is believed to be the nation's first defendant accused of federal cyberstalking charges for allegedly victimizing an epileptic with a strobing, epileptogenic online image—in this instance a GIF sent via Twitter.

According to court documents, when Newsweek writer Kurt Eichenwald of Dallas, Texas opened his Twitter feed on December 15, he was met with a strobing message that read, "you deserve a seizure for your post." Eichenwald, who has written that he has epilepsy, went into an eight-minute seizure where he lost control of his body functions and mental faculty. His wife found him, placed him on the floor, called 911, and took a picture of the offending tweet, according to court records.

Three months and several search warrants later, Rivello was arrested at his Maryland residence Friday. He is now free without bond and has not entered a plea, federal prosecutors said. No plea date has been set. An e-mail Ars sent to Rivello went unanswered, as did a phone call left for the Salisbury man and an e-mail to his attorney, Matt Hennessy.

Picture of offending tweet taken by victim's wife.
Enlarge / Picture of offending tweet taken by victim's wife.
Court documents

Court documents show that a search warrant to Twitter concerning the @jew_goldstein handle provided the authorities with information that the account was created on December 11 with a "PhoneDevice." Twitter also divulged the device's phone number and said that the carrier was AT&T. Some of the direct messages to other Twitter users on the account, according to the documents, said, "I know he has epilepsy," "I hope this sends him into a seizure," and "...let's see if he dies."

The Dallas authorities next obtained information from AT&T that the telephone number used to start the Twitter account was a burner SIM card with a Tracfone prepaid account "with no subscriber information."

"However, a review of the AT&T toll records showed an associated Apple iPhone 6A Model 1586 (Apple iPhone)," Nathan Hopp, an FBI agent in Dallas, wrote in the criminal complaint (PDF).

The police then sent a search warrant to Apple "for the iCloud account associated to the telephone number" used to open the Twitter account. Apple provided a wealth of information that ultimately doomed Rivello. Cupertino gave the Dallas Police Department his Apple ID e-mail address, his name, home address, and registration IP address when the account was created in 2012.

"In short, John Rivello, who had this Apple iCloud account since September 2012, used the telephone number associated with the Twitter account that sent the seizure-inducing tweet to operate his iCloud account," Hopp wrote.

The return of the search warrant from Apple, Hopp said, included personal pictures of Rivello, a picture of Rivello posing with his Maryland driver's license, and "the exact seizure-inducting GIF" sent to Eichenwald.

Listing image by Court documents

Channel Ars Technica