Our motto at Unit 221B is “Guided by Integrity. Discreet by Design.” Although we rarely have the opportunity to showcase our work publicly, today we can. As detailed on The Washing Post, Forbes, Polygon, Kotaku, Arstechnica, and other major gaming news sites, the game developers at Bungie have achieved a significant victory and set a precedent for the gaming industry as a whole. What's not yet reported—this lawsuit may have set a speed record for using an international subpoena to identify an anonymous harasser (14 days from first contact to true name).
To be clear, this blog post isn't speaking on behalf of Bungie and our intent is to relate our own experiences. During the Summer of 2022, Unit 221B worked with KUSK law firm and Bungie's physical security vendor (hereafter referred to as "The Team") to address a campaign of racist abuse and harassment against a Bungie employee and their family, and threats to the company. This behavior spawned two lawsuits so far. Last week, our client prevailed against the first of the defendants.
Read the official documents:
Other Resources:
We are grateful for the positive response from the Destiny 2 community. Full credit for this victory goes to The Team. We want to share insights into the investigative process that helped us identify Comer and build a strong case against him. Our goal is to show organizations that accountability is possible, and you can stop anonymous Internet harassment.
On the morning of June 2, 2022, the official Destiny 2 Twitter account tweeted out a video collaboration with Uhmaayze, a prominent Black American Twitch streamer that plays Destiny 2. Fifteen minutes later, the Bungie Community Manager—who we will refer to as "D. Doe" instead of their real name—retweets the video as part of their regular work duties.
The rest of the day continued normally until that evening, at 7pm PST, when D. Doe and his wife K. Doe (again, not the real name) received bizarre racist voicemails and texts sent directly to their personal phone numbers, which are not public and would have required effort to find. Similar abusive messages continued for several hours. The Does immediately reached out to Bungie about this, who began to monitor the situation.
That same night, the attacker escalated in a familiar pattern. He demonstrated knowledge of—and willingness to abuse—the Doe's home address with an inedible, "odiferous" pizza, specified cash on delivery, and included the instructions, “Knock at least five times—I’ll probably be wearing headphones.” The pizza was a 14” Brooklyn Pizza with “no original sauce, extra honey BBQ sauce, extra pizza cheese, ham, sausage, bacon, Philly steak, extra black olives, extra fresh garlic, extra hot buffalo sauce, more original sauce.”
People have a lot of misconceptions about "prank" pizza deliveries. What happened that night was not a prank. Comer used the service's Pizza Tracker functionality to time the abusive messages immediately before and after the driver's arrival. The perfect timing created a menacing scenario where the target would reasonably believe a mentally unstable gamer was threatening to enter their house, and also put the pizza delivery employee at risk of encountering a self-defense scenario. The Does reached out to the police and Bungie immediately. Bungie had physical security at the house 20 minutes later.
At this point, The Team didn't yet know Comer's identity. At the outset we didn’t have much to go on—a pizza order, voicemails, texts, a few clearly fake aliases, and a single TextNow phone number. As part of the investigation, The Team also reviewed the backlog of death threats sent to Bungie by players. Readers outside of the gaming industry may find the previous sentence puzzling, so let's take a moment to explain:
At Unit 221B, we help companies in numerous industry verticals. One of the elements that stands out within the gaming vertical is the presence of a splinter minority that holds extreme beliefs and is easily motivated to attack targets of their hatred, including but not limited to the makers of the games they play. This behavior is irrational to its core. By way of analogy, imagine a company that sells fruit to millions of devoted customers, but among them are several hundred thousand who hold at least one of the following beliefs:
And then, on top of that, somewhere between five and ten thousand of these customers—who, we must stress, are hardcore customers that spend hundreds of dollars on fruit—actively threaten the fruit vendor employees with violence. All while buying more fruit. In the context of any other industry, it is unimaginable; within the gaming industry, this is business as usual.
By June 8th, 2022, The Team realized we would need to subpoena TextNow. Bungie sought a Norwich Pharmacal order in the Canadian courts to compel TextNow to release that phone number's subscriber data. The use of a Norwich order, a feature of UK and Canadian law, was crucial as it prevented TextNow from notifying the subscriber, to prevent them from deleting evidence. The request was filed on June 14th, 2022, and granted on June 15th, 2022. By the 16th, The Team had verified Comer's identity to a satisfactory extent, marking 14 days from first contact to true name using an international subpoena.
On June 22nd, 2022, the West Virginia Personal Safety Order was filed and Comer was served on July 1st, 2022. Despite the Personal Safety Order he continued to play Destiny 2 and on July 12th, 2022, he was permanently banned.
During this time, we at Unit 221B sought to find communities that harbored positive attitudes towards death threats, under the theory that they may harbor people who send death threats. This theory allowed us to find Comer's account where he made his most crucial admissions on July 18 through the 23rd, 2022, which are discussed in detail in our expert report. On August 4th, 2022, he made further admissions concerning his discovery of the TextNow subpoena, and also deleted his July admissions around this time—but it was too late.
Comer wasn't the only recreational death threat maker caught up in this very specific dragnet, but that's a conversation for another day.
Online harassment investigations typically span months or years if they are solved at all. But with precedents like this case, it's increasingly possible to hold individuals accountable, and potentially do it on a reasonable timeline. While there's no Guinness World Record for attacker identification involving an international subpoena, we have yet to see another organization move quicker than 14 days.
Individuals who derive pleasure from tormenting strangers under the guise of anonymity often feel emboldened, but may think twice when they realize that anonymity is only a single layer of protection. Once the harasser loses their only protection, they may suffer years of trouble from lawyers and law enforcement. Even harassers that don't have money can still lose their game console, gaming computer, phone, car, weapons, trading cards, figurines, art, other personal possessions, and have their future wages garnished until the debt is paid. These cases are virtually impossible to discharge in bankruptcy due to the involvement of fraud and willful malicious acts. And unlike criminal cases, in civil cases the Court will not provide a free defense attorney.
Actions taken by companies to protect the safety of their employees should be applauded as we strive to create a safer online environment for everyone. The recent judgment against Comer serves as a clear indication that these measures are necessary and should be implemented more widely. This landmark ruling recognizes a new tort in Washington state—home of many gaming and tech companies. It empowers employers to protect their employees by allowing them to recover investigative and legal expenses incurred as a result. With this significant legal precedent in place, individuals like Comer who engage in harassment can face the appropriate consequences of their actions.
Unit 221B remains dedicated to investigating and combating online attackers, as well as advocating for the protection of the innocent wherever they may be.
To learn more about Unit 221B's threat intelligence, investigations, and incident monitoring cybersecurity services, please contact us.
Authors: