Sextortion – Were you aware of it?

As so many are flocking to cell phones and the ages of the users are getting younger, there is a topic that parents need to be aware of.

Sextortion is a form of sexual exploitation that employs non-physical forms of coercion to extort sexual favors from the victim. Sextortion refers to the broad category of sexual exploitation in which abuse of power is the means of coercion, as well as to the category of sexual exploitation in which threatened release of sexual images or information is the means of coercion.^[1]

We as a society need to be able to band together to combat this psychological attack against our youth. 83% of the victims are female, and 46% are minors. Like physical sexual assault, it is estimated that only a third or less of the victims report the crime. 60% of the perpetrators knew the victim before the incident.

I have reviewed the evidence of one of these cases personally. No, I will not share that data as the victim does not deserve that. The portrayal below is based on that incident but is sanitized for her privacy. This was properly reported to the appropriate authorities.

Here is how this abuse occurred:

Victim received a text from an unknown source
criminal claimed that they had nude photos of the victim
They also recited her street address, including which room within her apartment was hers
the pictures were going to be shared on all forms of social media unless she complied with the criminal
the criminal wanted her to disrobe for more pictures
on a the second day the criminal resumed texting with a more aggressive tone
the same intent of getting more pictures
Criminal escalated to calling the victim and pressuring her to an online video chat service in Scandinavia (I believe in Norway) to excuse herself from family to go to a bathroom to disrobe and put herself on display.

As I and my colleagues tried to trace the evidence and find the personal data exposure, we were impressed with the victim’s awareness of protecting her data. She does not have her college address shared with any databases other than Amazon, and even they did not have which room was hers.

Text messages are very hard to trace unless you are law enforcement. Even for them, they are not easy. Because of my role, I was able to provide the FBI with the owner (not the user) of the phone numbers used to text and call the victim. I was also able to alert the abuse team at the video chat service so that they could review the actions of their users. Since I did not have a subpoena, I was unable to get data to relay to the FBI.

When the victim returned to campus, she found that her roommates were also victims. Since the issue was clearly involving a local perp, the apartment management was advised. They had a very lame excuse that this was a data breach when someone restarted the internet. I am still stunned with how stupid this answer is. The apartment management company did say that seven women had come forward. This number ended up rising to twenty when published by a local media source. The article was a plea for other victims to come forward. It is my personal opinion that the apartment complex has a rogue employee that needs to be identified, arrested, and prosecuted. So far this particular incident is limited to the complex.

When I asked if the abuse has continued, the victim stated that there has not been a peep since the police report was filed. The situation is getting great exposure on campus so the student body is much more aware. [Update: There was an arrest in the case, but I do not know the disposition of the case.]

If you check the links below, you will find that this situation is not isolated, but becoming more and more common.

Parents need the same level of awareness. This is the tool that you need to arm your kids (regardless of how grown that they are) so that they can fend off these pond scum samples.

Obviously the first line is to make sure that they do not have these kinds of pictures TO BE shared in the first place. I also know that this is wishful thinking, just like abstaining from sex before committed relationships. It is talking to them so that they know if they do not have content for the criminals to share, then why co-operate with their demands. Do not delete the texts, call logs or any other evidence. The local police (and likely the FBI) need to be contacted. Take the time to file the report. The perp needs to be caught. This is nothing to be ashamed of. Even if your kids DID have content that could be exposed, this is not the time to blame the victim. They did nothing to deserve this. My thought is to treat that situation as you would when your kid calls form a party/bar after drinking. Get them to safety then discuss when it is more mentally safe to do so. If your kids know without a doubt that you will stand with them, then they will be more likely to tell you of the incident so you can help them through it.

I hope that neither you, nor anybody that you know has to go through this, but the numbers indicate that it will hit close to home.

This is a sample email that is opening the door to sextortion, I found it in one of my mailboxes (I am sanitizing it a little to render it useless to the bad actor). In the case that I reviewed, it was done by text message and not email.:

Subject: I RECORDED YOU!

Hello there!

Unfortunately, there are some bad news for you.

Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.

My trojan allowed me to access your files, accounts and your camera.

Check the sender of this email, I have sent it from your email account.

To make sure you read this email, you will receive it multiple times.

You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.

I RECORDED YOU (through your camera) SATISFYING YOURSELF!

After that I removed my malware to not leave any traces.

If you still doubt my serious intentions, it only takes couple mouse clicks to share the video of you with your friends, relatives, all email contacts, on social networks, the darknet and to publish all your files.

All you need is $1800 USD in Bitcoin (BTC) transfer to my account.

After the transaction is successful, I will proceed to delete everything.

Be sure, I keep my promises.

You can easily buy Bitcoin (BTC) here:

[SNIP]

Or simply google other exchanger.

After that send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine.

My Bitcoin (BTC) address is: 1LJsS3xXP[SNIP}An5NmCcqbp

Yes, that’s how the address looks like, copy and paste my address, it’s (cAsE-sEnSEtiVE).

You are given not more than 3 days after you have opened this email.

As I got access to this email account, I will know if this email has already been read.

Everything will be carried out based on fairness.

An advice from me, regularly change all your passwords to your accounts and update your device with newest security patches. [How nice that they provided a cybersecurity tip.]