Anonymous Twitter attacker tied to iCloud account via SIM card


The Verge:

While AT&T didn't have any directly identifying data, the company's toll records showed that the SIM card had been used by an iPhone 6. That sent investigators looking for an iCloud account linked to the same number. After another search warrant to Apple, they got what they were looking for. According to the complaint, the number was linked to a five-year-old iCloud account owned by John Rivello of Salisbury, Maryland.

The individual allegedly sent a reporter a tweet intended to trigger an a seizure.

It's interesting the individual apparently went lengths to conceal their identity with an untraceable phone, but set up the SIM SIM in their iPhone. That set up process indicated the device type, which then gave info they needed to find more evidence with Apple. Presumably since iCloud accounts are tied to phone numbers, and using that SIM registered that number, there was a thread linking the individual's iCloud account and the phone used to send a malicious tweet.