Each involves an attacker who effectively invades the homes of sometimes large numbers of remote victims and demands the production of sexual activity from them.
Sextortion cases involve what are effectively online, remote sexual assaults, sometimes over great distances, sometimes even crossing international borders, and sometimes―as with Mijangos―involving a great many victims.
Later in the day, to underscore his seriousness, the hacker followed up with another email threatening the victim: “You have six hours.” This victim knew her correspondent only as [email protected], but the attacker turned out to be a talented 32-year-old proficient in multiple computer languages.
In at least one case, he posted nude photos of a victim on the Myspace account of a friend of the victim, which Mijangos had also hacked, after she refused to comply with his demands.
To make matters worse, Mijangos also used the computers he controlled to spread his malware further, propagating to the people in his victims’ address books instant messages that appeared to come from friends and thereby inducing new victims to download his malware.
We searched dockets and news stories for criminal cases in which one person used a computer network to extort another into producing pornography or engaging in sexual activity.
We found nearly 80 such cases involving, by conservative estimates, more than 3,000 victims. Prosecutors colloquially call this sort of crime “sextortion.” And while not all cases are as sophisticated as this one, a great many sextortion cases have taken place―in federal courts, in state courts, and internationally―over a relatively short span of time.
Sextortion thus turns out to be quite easy to accomplish in a target-rich environment that often does not require more than malicious guile.
It is a great mistake, however, to confuse sextortion with consensual sexting or other online teenage flirtations. It is also a crime that, as we shall show, does not currently exist in either federal law or the laws of the states.The malware Mijangos wrote was sophisticated, and he told federal authorities that he designed it specifically to be undetectable to antivirus programs.He then, according to court documents, “used [those] intimate images or videos of female victims he stole or captured to ‘sextort’ those victims, threatening to post those images or videos on the Internet unless the victims provided more.” Mijangos’s threats were not idle.More often, it involves manipulation and trickery on social media.But at the core of the crime always lies the intersection of cybersecurity and sexual coercion.Teenagers and young adults don’t use strong passwords or two-step verification, as a general rule. They sometimes record pornographic or semi-pornographic images or videos of themselves.