If the prosecutorial estimates in the various cases are to be believed, the number of actual victims probably ranges between 3,000 and 6,500―and, for reasons we explain below, may be much higher even than that.
As the teenage child of one of the present authors put the matter, “You just can’t put a portable porn studio in the hands of every teenager in the country and not expect bad things to happen.” This paper represents an effort―to our knowledge the first―to study in depth and across jurisdictions the problems of sextortion.
We tend think of cybersecurity as a problem for governments, major corporations, and—at an individual level—for people with credit card numbers or identities to steal.
The average teenage or young-adult Internet user, however, is the very softest of cybersecurity targets.
Teenagers and young adults don’t use strong passwords or two-step verification, as a general rule. They sometimes record pornographic or semi-pornographic images or videos of themselves.
And they share material with other teenagers whose cyberdefense practices are even laxer than their own.
In at least one case, he posted nude photos of a victim on the Myspace account of a friend of the victim, which Mijangos had also hacked, after she refused to comply with his demands.
To make matters worse, Mijangos also used the computers he controlled to spread his malware further, propagating to the people in his victims’ address books instant messages that appeared to come from friends and thereby inducing new victims to download his malware.
Mijangos’ actions constitute serial online sexual abuse—something, we shall argue, akin to virtual sexual assault.
As the prosecutor said in the case, Mijangos “play[ed] psychological games with his victims” His victims reported signs of immense psychological stress, noting that they had “trouble concentrating, appetite change, increased school and family stress, lack of trust in others, and a desire to be alone.” * * * As bizarre as the Mijangos case may sound, his conduct turns out to be not all that unusual.
Sextortion thus turns out to be quite easy to accomplish in a target-rich environment that often does not require more than malicious guile.
It is a great mistake, however, to confuse sextortion with consensual sexting or other online teenage flirtations. It is also a crime that, as we shall show, does not currently exist in either federal law or the laws of the states.
We searched dockets and news stories for criminal cases in which one person used a computer network to extort another into producing pornography or engaging in sexual activity.