How A Sextortion Victim Hacked Back And Put Her Attacker In Jail

Natalie Claus was used to her student association and prepared a winter holiday one night in December 2019 when the people he knew began to receive an unusual message from him. This Snapchat message, which contains Claus’s nude photos, went to his friends, cousins, ex-girlfriends, and dozens of other people he knew, more than 100 people all. Some recipients responded enthusiastically, others with confusion, as if Claus had played a bad joke. But one of his friends, Katie Yates, immediately recognized the messages as online attacks-and know how to respond to Claus.
Yates is also a student at the State University of New York College in Geneseo, 40 southern miles of Rochester, where Claus is a second -level student. A few months earlier, after Yates reported sexual harassment, someone began to send rough messages on social media. Feeling like he did not get enough support on campus, Yates began to examine ways to identify his harassment.

The vigilante work of this kind, he thought, could be useful for Claus. When Claus reached out to ask for help, the two friends gathered, tried to calm down, and started working. “It’s like a scene from the film,” Claus said later, according to court documents. “You know they say everything that slows down? My ears ring, and I feel unable to breathe, and honestly I don’t think of me.” Yates walked home Claus and removed the scissors and razor knives from his dorm room so that Claus could not hurt himself. “He wants to see if I want to catch this person,” Claus recalled. “Of course I said, ‘Yes.’ “

“Sexttortion,” the term is broad for the scenario where the attacker uses intimate content for extortion or abuse, taking various forms. Although it is difficult to measure how often it happens, it is clearly more common. Last year the national center for missing & exploited children received 44,000 reports from online idols, categories that included sextionation, up from 17,000 two years earlier. The FBI said that he received 18,000 complaints related to Sextortion in 2021, with the victim paying the attacker reporting $ 13.6 million. In September, the bureau said that almost half of the complaints he received in the first seven months of this year came from victims 20 to 39 years.

Law enforcement agencies assigned to face such attacks are hampered by budget constraints and lack of experience dealing with digital crime. Eva Galperin, Siber Security Director at the Electronic Frontier Foundation, said that even simple techniques-such as using fake telephone numbers-were enough to befall the investigators. As a result, many institutions focus on just preventing young people from sharing photos of themselves in a way that they might regret, according to Mac Hardy, Director of Operations in the National Association of School Resources Officers, who investigated many crimes. “We have gone through this for years, and it is always a nightmare,” he said.

Such a suggestion may be counterproductive, because it further stigmatizes people targeted in this attack. “Victims sometimes have difficulty going forward, not only because they feel a lot of guilt and shame internally, but because they feel it is from the community,” said Martha Finnegan, a child and an interviewer of a youth forensic at the FBI.

Technology companies are also often slow to respond. Many Sextortion Schemes begin in dating applications, but for clas the vulnerability is Snapchat. This application was specifically examined and became the subject of the Class Action lawsuit filed by a 16 -year -old girl who accused Snap Inc., the company behind the application, almost did not do anything to prevent sexual exploitation of minors. A SNAP spokesman said in an email that the company had taken steps to stop the intruder from taking over the account and worked to prevent the device from entering many accounts.

The hackers who target Claus pose as a security employee who warned him about violations, then deceived him to share the code that enabled him to take over his account. Once in, he locked it. Snap said it took a hacker from Claus’s profile within 24 hours after learning of the violation. At the end of July, Claus said he still had not regained access to his account.

The intruder entered the private section of the Claus application called “My Eyes Only,” which contains nude photos that he took himself when he tried to recover from rape. He distributed the pictures in the message with the text “Flash Me Back If We Ourties.” The prosecutor said that this seemed to be a way to collect compromise material to be used for other victims. He never asked Claus anything.

Many contact Claus thought the message was real, including members of the student association he said he tried to join, only to be the target of intimidation by the group. A ex -boyfriend called him and shouted at him, asking why he put himself in such a situation.

When Claus reported the incident to the campus police, two male officers came to talk to him. Someone rolled his eyes throughout the interview, according to Claus. “He acted like, ‘You ask him,'” he said. The two officers left him crying in the classroom when the conversation was over. He called Geneseo City Police, who directed him back to the university police.

The investigation path makes the situation a double trauma. “If it wasn’t for my emotional supporting animals and some friends I knew at the time, we would not have this conversation,” Claus said. “I have a pill in my hand to commit suicide.”

In a statement that was held, Geneseo University Police Chief Scott Ewanow said, “The university police treat reporters for alleged crime with respect and officers responded seriously.” When the case of cyberspace crime exceeds the departmental resource capacity, he added, the university sought assistance from other institutions.

With the help of Yates, Claus came with a plan. Yates contacted the Claus account from his own profile, suggested he had a nude image to share and send a link. URL, made to look like a porn site, actually collects anyone’s IP address that clicks on it, using a website called Grabify IP Logger. Hackers can avoid plans using virtual personal networks, one step that is so imperfect that it goes beyond

The person who received a mocking message from Claus and Yates was David Mondore, a 29 -year -old chef who lived in Harlem. He claimed to get unauthorized access to at least 300 Snapchat accounts and finally pleaded guilty to the accusations related to hacking and acting with a view to deceiving, where he received a sentence of six months in prison.

Mondore is really a stranger to Claus, he said. He believes his punishment is too light, but he added that he didn’t think he was a monster. “He is human,” he said. “That’s what makes it scary.”