Cybersecurity: Crime and Espionage

Sextortion: The Problem and Solutions

By Benjamin Wittes, Cody M. Poplin, Quinta Jurecic, Clara Spera
Wednesday, May 11, 2016, 10:00 AM

Prosecutors colloquially call it “sextortion.”

Legally speaking, there’s no such thing. The word is a kind a prosecutorial slang for a class of cases that do not correspond neatly with any known criminal offense.

But sextortion turns out to be remarkably common. A great many sextortion cases have taken place―in federal courts, in state courts, and internationally―over a relatively short span of time. Each involves an attacker who effectively invades the homes of sometimes large numbers of remote victims and demands the production of sexual activity from them. Sextortion cases involve what are effectively online, remote sexual assaults, sometimes over great distances, sometimes even crossing international borders, and sometimes involving a great many victims.

We searched dockets and news stories for criminal cases in which one person used a computer network to extort another into producing pornography or engaging in sexual activity. We found nearly 80 such cases involving, by conservative estimates, more than 3,000 victims. This is surely only the tip of a very large iceberg.

We tend think of cybersecurity as a problem for governments, major corporations, and—at an individual level—for people with credit card numbers or identities to steal. The average teenage or young-adult Internet user, however, is the very softest of cybersecurity targets. Teenagers and young adults don’t use strong passwords or two-step verification, as a general rule. They often “sext” one another. They sometimes record pornographic or semi-pornographic images or videos of themselves. And they share material with other teenagers whose cyberdefense practices are even laxer than their own. Sextortion thus turns out to be quite easy to accomplish in a target-rich environment that often does not require more than malicious guile.

The crime takes a number of different forms, and it gets prosecuted under a number of different statutes. Sometimes it involves hacking people’s computers to acquire images then used to extort more. More often, it involves manipulation and trickery on social media. But at the core of the crime always lies the intersection of cybersecurity and sexual coercion. For the first time in the history of the world, the global connectivity of the Internet means that you don’t have to be in the same country as someone to sexually menace that person.

The problem of this new sex crime of the digital age, fueled by ubiquitous Internet connections and webcams, is almost entirely unstudied. Law enforcement authorities are well aware of it, and the FBI has issued numerous warnings about sextortion. More recently, after we completed our study, the Justice Department included a fair bit of information about sextortion in its “National Strategy for Child Exploitation Prevention and Interdiction,” a report to Congress released on April 19. The Justice Department report confirms that “sextortion is by far the most significantly growing threat to children” and that “sextortion cases tend to have more minor victims per offender than all other child sexual exploitation offenses.” The document also references a 2015 FBI analysis of 43 cases of sextortion which found that "at least 28 percent of these cases had at least one victim who committed or attempted suicide.” As of this writing, however, the FBI has not made this analysis available to us. The Justice Department also released this public service announcement:

The National Strategy, like other government statements on the subject of sextortion, suffers from key deficiencies on which we focus in our report. To wit, the government keeps no data on the subject of sextortion. Neither the FBI nor the Justice Department can tell you the scope of the problem or the number of prosecutions. Moreover, the document focuses exclusively on the problem of sextortion as a species of child exploitation, ignoring the many adults victimized.

Indeed, unlike its close cousin, the form of nonconsensual pornography known as “revenge porn,” the problem of sextortion has not received sustained press attention or action in numerous state legislatures, in part because with few exceptions, sextortion victims have chosen to remain anonymous, as the law in most jurisdictions permits. Most people have never heard of it.

But don’t let the problem’s invisibility fool you. The 78 cases we reviewed alone involve at least 1,397 victims. If the prosecutorial estimates in the various cases are to be believed, the number of actual victims probably ranges between 3,000 and 6,500―and, for reasons we explain in the papers, may be much higher even than that.

The first of the two Brookings papers we are releasing today—“Sextortion: Cybersecurity, Teenagers, and Remote Sexual Assault”—represents an effort to study in depth and across jurisdictions the problems of sextortion. In them, we look at the methods used by perpetrators and the prosecutorial tools authorities have used to bring offenders to justice.

Our key findings include:

  • Sextortion is dramatically understudied. While it’s an acknowledged problem both within law enforcement and among private advocates, no government agency maintains data on its prevalence; no private advocacy group does either. The subject lacks an academic literature. Aside from a few prosecutors and investigators who have devoted significant energy to the problem over time, and a few journalists who have written—often excellently—about individual cases, the problem has been largely ignored.
  • Yet sextortion is surprisingly common. We identified 78 cases that met our definition of the crime—and a larger number that contained significant elements of the crime but that, for one reason or another, did not fully satisfy our criteria. These cases were prosecuted in 29 states and territories of the United States and three foreign jurisdictions.
  • Sextortionists, like other perpetrators of sex crimes, tend to be prolific repeat players. Among the cases we studied, authorities identified at least 10 victims in 25 cases. In 13 cases, moreover, there were at least 20 identified victims. And in four cases, investigators identified more than 100 victims. The numbers get far worse if you consider prosecutorial estimates of the number of additional victims in each case, rather than the number of specifically identified victims. In 13 cases, prosecutors estimated that there were more than 100 victims; in two, prosecutors estimated that there had been “hundreds, if not thousands” of victims.
  • Sextortion perpetrators are, in the cases we have seen, uniformly male. Victims, by contrast, vary. Virtually all of the adult victims in these cases are female, and adult sextortion therefore appears to be a species of violence against women. On the other hand, most sextortion victims in this sample are children, and a sizable percentage of the child victims turn out to be boys.
  • There is no consistency in the prosecution of sextortion cases. Because no crime of sextortion exists, the cases proceed under a hodgepodge of state and federal laws. Some are prosecuted as child pornography cases. Some are prosecuted as hacking cases. Some are prosecuted as extortions. Some are prosecuted as stalkings. Conduct that seems remarkably similar to an outside observer produces actions under the most dimly-related of statutes.
  • These cases thus also produce wild, and in in our judgment indefensible, disparities in sentencing. Many sextortionists, particularly those who prey on minors, receive lengthy sentences under child pornography laws. On the other hand, others receive sentences dramatically lighter than they would get for multiple physical attacks on even a fraction of the number of people they are accused of victimizing. In our sample, one perpetrator received only three years in prison for victimizing up to 22 young boys. Another received only 30 months for a case in which federal prosecutors identified 15 separate victims.
  • Sentencing is particularly light in one of two key circumstances: (1) when all victims are adults and federal prosecutors thus do not have recourse to the child pornography statutes, or (2) in cases prosecuted at the state level.
  • Sextortion is brutal. This is not a matter of playful consensual sexting—a subject that has received ample attention from a shocked press. Sextortion, rather, is a form of sexual exploitation, coercion, and violence, often but not always of children. In many cases, the perpetrators seem to take pleasure in their victims’ pleading and protestations that they are scared and underage. In multiple cases we have reviewed, victims contemplate, threaten, or even attempt suicide—sometimes to the apparent pleasure of their tormentors. At least two cases involve either a father or stepfather tormenting children living in his house. Some of the victims are very young. And the impacts on victims can be severe and likely lasting. Many cases result, after all, in images permanently on the Internet on multiple child pornography sites following extended periods of coercion.
  • Certain jurisdictions have seen a disproportionate number of sextortion cases. This almost certainly reflects devoted investigators and prosecutors in those locales, and not a higher incidence of the offense. Rather, our data suggest that sextortion is taking place anywhere social media penetration is ubiquitous.

The second paper, “Closing the Sextortion Sentencing Gap: A Legislative Proposal”—proposes a new federal statute to cover these crimes, for which current law is, at least when the victims are adults, frankly inadequate. The dramatic disparities at issue in sextortion cases all have, we argue in this paper, either the same root cause or a common exacerbating factor: the absence of a federal sextortion law. They also all have the same solution: Congress should pass such a law, incorporating elements already present in federal sexual abuse, extortion, child pornography, and abusive sexual contact statutes.

A federal sextortion law, we argue in this paper, is justified by the sheer volume of sextortion cases already being prosecuted in the federal system, the interstate and international character of many of the cases, and the disparate fashion in which these cases are handled, with respect both to each other and to cases prosecuted at the state level and cases involving physical assaults. Such a law would guarantee that sextortionists nationwide are subject to at least one single criminal statute, that weak state laws are backstopped by something stronger, and that the targeting of adult women victims is not systemically undervalued in sentencing in federal court relative to similar conduct against minors.