Sextortion: How Hackers Blackmail Young Girls into Performing Sexual Acts

Then, one day, a message from a stranger announces itself with a ping.

"I hacked your Facebook if you don't show me your tits, I will set this as your profile picture."

It's a link to a photo of you naked. A picture you had hidden on your laptop, that you thought only you knew about.

Then—

"You have 15 minutes.

"Pussy too girl.

"You don't have a choice. If I don't see your tits by ten everyone will see your pussy. Don't make me do this… I'll leave you alone once you send."

Your entire world is about to implode. You panic; you comply.

Spoiler alert: He does not leave you alone.

Now he has even more leverage. The demands get more explicit, more degrading. He knows where you live. One day a sex toy and lubricant arrive at your home—the stranger has hacked your Amazon account. He hacks into your email, poses as you, and ensnares your friends in the same way.

You see what happens to the girls who do not cooperate: Their nude pictures are released.

This goes on for days, then weeks, then months.

Eventually, you have been producing pornography for a stranger for years.

These are direct quotes and charges described in the indictment of 23-year-old New Hampshire man, Ryan Vallee, sentenced to eight years in prison in February.

Vallee spent years trying to coerce teenage girls into producing pornographic videos and photos through threats and harassment. Prosecutors described Vallee's actions as "remote sexual assault."

"In my view, It's like having someone stand in front of a victim with a baseball bat and threaten to swing it at her unless she takes her clothes off and lets him photograph her naked," Mona Sedky says. "It's forcing someone to engage in sexual activity."

Sedky is a senior trial attorney at the US Department of Justice. She has spent the last six years prosecuting cases where a perpetrator has used a combination of stalking, hacking, harassment, and threats in order to extort sexual services against a victim's will—a phenomenon known as sextortion.

"It definitely changed the way I go about my life and my day-to-day life," one of Vallee's victims, known as Jane Doe 1, told a a local TV station after the sentencing. "He knows where I live now, so that's kind of scary. I have social anxiety, and I don't sleep very well at night."

Another, Jane Doe 3, said, "I'm very happy that he's going away, but the damage he has done to us will never go away."

These sentiments are unsurprising coming from any survivors of abuse. What is surprising is that Vallee was able to inflict the damage without ever setting foot in the same room as his victims.

Sedky was part of the team that prosecuted Vallee. "I spent a lot of time reading through the communications… It's very disturbing."

Sextortion is considered by experts to be distinct from revenge porn, involving instances when a victim is coerced into sexual activity against their will, with the perpetrator often using hacked private photos as leverage. While sextortion is an invasive violation, it is not currently considered a sex crime.

"I think there's another very important difference between revenge porn and sextortion," says Benjamin Wittes of the Brookings Institution. In 2016, Wittes authored Sextortion: Cybersecurity Teenagers and Remote Sexual Assault, the first ever study into sextortion which recommended new laws to tackle the phenomenon.

According to Wittes, sextortion occurs when "the actual sexual activity itself is non-consensual and is being coerced." Revenge porn, on the other hand, is more often than not consensually created material that is maliciously leaked without a participant's consent.

Just this month, an Australian university lecturer was arrested after allegedly sextorting 157 underage girls by posing as Justin Bieber. He has since been charged with over 900 sex offences, including rape, indecent treatment of children, and making child exploitation material.

Sextortion is still not tackled by policy makers in the same way as revenge porn, where laws against the latter have been passed in the UK and in over 30 states in the US. These laws draw on and bolster existing privacy and copyright laws to protect internet users. However, sextortion is not presently classified as a crime so long as it is not perpetrated against children (and therefore prosecutable under child pornography laws).

That is where Sedky comes in. She stitches together existing hacking, privacy, stalking, and fraud statutes to try to make a case where the penalties are at least comparable to what they would be if the sexual violation had been a physical, in-person assault.

"I have a lot of arrows in my quiver, depending on what [the perpetrator] did. Sometimes they'll steal financial data and make purchases," Sedky says, reeling off a list of potential charges that could be brought against those accused of sextortion. "Cyber stalking—that's my favourite [due to the high penalties] … Assuming they've used a form of interstate communications like text, or phone, sending a threat to harm someone's reputation is an easy one to prove and that's three years max."

Vallee's eight years may seem like a light sentence, but it's actually a triumph compared to other similar cases.

Sedky's most high profile case was that of Michael Ford, a State Department employee working out of the US embassy in London where he spent two years hacking into hundreds of online accounts, stealing photographs, and threatening about 75 women to try to force them into providing pornographic material of themselves.

Ford was sentenced to 57 months.

"We think he did a Google Earth search to find out what the outside of [one victim's] apartment looked like. He laced his threats with statements like, 'I like your red fire escape. Easy to climb.' Ford's victims believed that he was nearby, tracking their every move, and that he would jump out and attack them. One was sleeping with a knife under her pillow every night."

Sedky was with the Department of Justice's Computer Crimes and Intellectual Property Unit for five years before she encountered her first sextortion case.

"I'm sure that some of my maternal protective instincts kicked in," she says. "I thought, This is not right. This has to stop."

In order to bring sextortion cases to trial, Sedky has often has to enlist specialized investigators from a slew of organizations, including the Secret Service, FBI, and local police. As privacy apps and technologies advance, perpetrators are increasingly able to hide their online activity.

"It's getting harder and harder to identify them, especially when they're using encrypted communications methods," she admits.

Beyond increasingly secure app and software capabilities, Sedky says that one of the biggest issues is that there is still resistance to recognizing sextortion for what it is.

"This is a violence, domination, and anger [driven] crime," she explains. "Perhaps with a healthy dose of misogyny, too. I don't have a profile of the 'typical' perpetrator… They've ranged in age, teens to early 30s, from all over country, every economic situation—they don't have a common demographic."

While public awareness of revenge porn and its illegality has gained some traction, sextortion itself remains a hidden phenomenon.

"The scope of the problem is big and the number of the people getting hurt is large—I can prove that to you," says Wittes of his study, which was the first to try to define what constitutes sextortion. "We looked at nearly 80 cases of 'sextortionists' and we had a minimum of 1,300 victims."

His team analyzed 78 recent cases that bear the hallmarks of sextortion. It is peppered with extracts from indictments and victim testimony, such as the teenager who was told by a sextortionist that he had a way of remotely blowing up their new computer if they did not comply.

"Some of the cases we looked at involved forced sibling sex, involving seven and eight year olds. Sometimes involving animals. You're talking about really, really bad stuff."

Wittes also points out that when it comes to sextortion, the cases that filter their way through to actual prosecution are just the tip of a very large iceberg.

"If you're a sextortion victim, who wants to talk about that in public? You've already masturbated on camera to prevent yourself from becoming public, why are you now going to talk about it on a television show? This is the reason there's a huge public campaign and a lot of attention around revenge porn and virtually none around sextortion."

Carrie Goldberg is a New York City based lawyer and former victim of revenge porn who now runs her own firm specializing in crimes where sex, coercion, and the internet intersect.

Watch: Inside the Torturous Fight to End Revenge Porn

Speaking by email, Goldberg notes that by the time victims of sextortion come to her, they are traumatized and uncertain as to whether a crime has even been committed against them.

"I had a client who reported to the police eight times and was turned away eight times. For two years she was at the mercy of the anonymous man who was forcing her to have sex with strangers and worse. And police did nothing."

Goldberg's clients are often minors who have been victimized by other minors.

"I've seen offenders as young as 13 doing this. Sometime there is competition at school among boys to amass the most naked pics. This is extremely common," she says. "Their fluency in sextortionist behavior may be something they take with them into adulthood if we don't have better laws and educational measures deterring them."

Wittes points to the same issue that anti-revenge porn advocates encountered when they began to lobby law enforcement to tackle the problem: victim blaming.

"A lot of people really have a hard time getting their heads around the fact that these victims aren't somehow to blame," he says.

Wittes believes it's a larger problem that needs to be tackled at the federal policy level.

"It's hard to get people to think about what a 'new' crime is. It's never been possible to do this before—to commit a sexual crime against somebody who's in a different country," he says. "You can say 'international criminal organization' and that makes intuitive sense… Here you're talking about the violence itself transcending international jurisdictional boundaries."

According to Sedky, many of the perpetrators that she prosecutes do not even realize that they may have committed a criminal act.

"When they're arrested and they're actually in custody, they seem shocked," she says. "Some of them confess right away and some of them deny, deny, deny, until the bitter end."

For Sedky, the remote aspect of the coercion remains irrelevant.

"There is a very real physical component even though this crime is committed remotely. What the perpetrators want to do is terrorize these young women (and in some instances, men, as well). They thrive on it—they want their victims to think they're right around the corner."

Six years on from Sedky's first sextortion case, prosecuting the crime has now become her mission. "I feel very compelled by this," she says. "I feel like it's important; I feel these women and some men—the emotional trauma that they're suffering really speaks to me. I feel protective, energized, and committed to try and get justice for them."