Seizure-triggering attack is stark example of how social media can be weaponized

An attack focused on people following the Epilepsy Foundation's Twitter account shows that even normal use of a social media platform can be used for harm.

Followers of the Epilepsy Foundation’s Twitter handle were targeted last month with posts containing strobe light GIFs and videos that could have caused seizures for people with epilepsy, the foundation announced Monday.

The videos were sent during National Epilepsy Awareness Month, a period of time when, according to the foundation, the largest number of people with epilepsy were likely to be keeping tabs on the account. For about 3% of people with epilepsy, exposure to flashing lights at certain intensities or certain visual patterns can trigger seizures.

“These attacks are no different than a person carrying a strobe light into a convention of people with epilepsy and seizures, with the intention of inducing seizures and thereby causing significant harm to the participants,” said Allison Nichol, director of legal advocacy for the Epilepsy Foundation, in a release. “The fact that these attacks came during National Epilepsy Awareness Month only highlights their reprehensible nature.”

Those behind the attacks did not hack any Twitter account to post the malicious tweets, a foundation spokesperson told CyberScoop. They simply tweeted at the foundation’s followers on Twitter with GIFs or videos flashing and strobe lights.

The foundation doesn’t know who is behind the attacks and told CyberScoop law enforcement is investigating the matter. The FBI did not immediately return request for comment.

While this kind of activity may not bear the hallmarks of a cyberattack, which can trick users into clicking malicious links or knock a website offline by flooding it with junk traffic, this attack shows that platforms can have even their normal functions weaponized in order to cause physical harm.

Twitter says it gives users the option of preventing media from autoplaying in their timelines, as well as preventing any GIFs from appearing when someone searches for “seizure” in GIF search.

“Additionally, if Twitter determines accounts are dedicated to causing offline harm, they will be permanently suspended. We’re exploring additional options to help protect the people on Twitter from this type of abuse,” a company spokesperson told CyberScoop.

This is not the first time Twitter has been weaponized against people with epilepsy. The FBI charged a Maryland veteran, John Rayne Rivello, with criminal cyberstalking two years ago for sending a strobe light GIF to Kurt Eichenwald, a journalist with epilepsy.

Steven Lieberman, Eichenwald’s attorney, told CyberScoop he sees these kinds of attacks as cyberattacks.

“It’s a cyberattack designed to cause physical harm to an individual,” Lieberman said. “If that person [targeted] is driving or operating equipment or if that person is in a place where they can fall a significant distance, such a seizure is highly likely to be fatal.”

This kind of attack can be one with lasting impact. Lieberman said Eichenwald is still dealing with a degraded quality-of-life due to the incident.

“He still has impaired use of his limbs. He’s subject to falls. He’s unable to hold his goddaughter. He’s unable to drive,” Lieberman said.

It is only recently that these attacks have come to be understood in the legal sense as a physical attack. Last year, Chief U.S. District Judge James Bredar sided with Eichenwald when he determined that because GIFs consist of light, and that light interacts with a person’s eyes, this attack can be deemed as “physical.”

“It’s an incredibly important precedent,” Lieberman told CyberScoop. “Prosecutors will be able to bring cases against people who attack individuals with epilepsy using flashing strobe lights.”

For now, the question of how legally responsible perpetrators are for this kind of abuse remains largely unresolved. Lieberman told CyberScoop that a hearing for Rivello’s criminal case in Texas has been postponed until January and a civil suit Eichenwald has filed against Rivello will likely go to trial next year.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure