Since its creation, the internet has been a convenient tool for criminal activity. Given its ease of use, breadth of scope and relative anonymity, criminals have found a way to adapt and exploit this ever changing technology. This is especially true in relation to sexual exploitation. Illegal transfer of unlimited illicit images can now be conducted remotely and anonymously through a few keystrokes. This ease in exchanging images online through various platforms has also created the growing problem of non-consensual pornography and sextortion. Although colloquially referred to as revenge porn, such actions extend far beyond the common connotation of pictures being shared online after a failed relationship, and delve into the devastating activities of predatory grooming, domination and extortion.
Currently, over 46 states have adopted various statutes addressing the issue of illegal dissemination of intimate images, but there is no singular legal definition of what constitutes non-consensual pornography. The functional definition of non-consensual pornography (hereinafter NCP) is the sharing or distribution of intimate images of another without permission. Although often used synonymously, NCP differs from sextortion in that sextortion requires the threatened exposure or distribution of an individuals intimate images unless the individual provides the perpetrator images of a sexual nature, sexual favors, or money. With NCP, the offender is seeking to publicly humiliate the victim, whereas with sextortion the perpetrator is attempting to privately coerce the victim to comply with their demands.
NCP and sextortion is a growing problem that affects all users regardless of age or gender. A 2016 study encompassing a nationally representative sample of 3,002 internet users 15 years old and older found that overall, 4% of all internet users in the United States had either sensitive images of themselves posted online without their consent, or had someone threaten to post sensitive images of them without their consent. Other findings include:
3% of all male users experienced NCP or threatened NCP
5% of all female users experienced NCP or threatened NCP
10% of users between the ages of 18 – 29 years old (male & female combined) have experienced NCP or threatened NCP
12% of women under the age of 30 years old have experienced NCP or threatened NCP
A similar study was conducted in 2019, involving 3,044 adult online social media users. This study found the rate of victimization for NCP incidents had increased, with 9% of women and 7% of men reporting incidents of NCP victimization.
In focusing specifically on young adult victimization involving sextortion, a study was conducted in June 2016, involving 1,631 respondents between the ages of 18 25 years old. The study looked at instances of sextortion in both personal (face-to-face) relationships (968 respondents) and online only relationships (663 respondents). The results of this studies disclosed:
71% of all respondents knowingly provided their images to the perpetrator
56% of all respondents felt pressured, tricked or threatened/forced into providing images
23% of online only relationships knew the perpetrator less than 1 week before providing an image (as compared with only 7% of personal relationships), with 26% providing an image in one day or less after meeting the perpetrator.
In examining sextortion victimization of minors (12-17 years old), a 2018 study revealed that out of a sample size of 5,578 respondents, a total of 5% of all respondents reported being the victim of sextortion. This study showed an equal split between males and females, with the largest incidence of sextortion occurring amongst 15 year olds. Most disturbingly, when inquiring about the number of respondents committing sextortion offenses, a total of 3% of all respondents stated they had been involved in committing some type of sextortion.
METHODS OF OBTAINING
The methods and manners in which offenders obtain NCP vary, and often depend on the offenders access to the victim. The manner in which an offender obtains NCP generally fall into two categories:
The offender knew the victim from a prior relationship (personal or online) and used pictures obtained during that relationship; or
The offender targeted the victim online and obtained pictures from victim or online source.
In examining the second category of obtaining NCP (wherein there was no previously existing relationship between the offender and victim, and victim was targeted by offender), there are generally two manners in which these pictures are obtained: Voluntary Submission and Hacking.
As previously stated, 71% of victims of sextortion voluntarily provided images to the offender. The process of obtaining images from victims used in NCP and sextortion is very similar to the grooming process many offenders use in child sexual exploitation cases. Grooming is the process wherein the offender develops a relationship with the victim, builds a level of trust with the victim, and then exploits that trust for personal gains. Very often the offender approaches the victim in a chat group, social media account or dating app, posing as a similarly aged user looking for friendship or relationship. After establishing that relationship, the offender begins to engage the victim in conversations of a sexual nature, eventually soliciting incriminating photographs, or inviting the victim to be part of live video streaming contact. As this occurs, the offender takes screenshots of exchanges, saves sensitive photographs, or records live video interactions with the victim, with the ultimate intent of compiling a dossier of compromising material with which to blackmail a victim. If done well, skilled offenders not only quickly gain the victims initial cooperation, but also decrease the likelihood of disclosure by the victim and increase the likelihood of ongoing, repeated access to the victim. This is especially true in situations involving adult offenders and adolescent victims. Experienced sextortionists can easily manipulate multiple victims through multiple accounts and identities, and cases of a single offender victimizing hundreds of victims are not unheard of.
One of the less common (but still statistically significant) method of obtaining NCP is via hacking. Traditionally, people envision hackers as offenders who launch Trojans or other malware attacks to gain access to computer systems, but the more prevalent manner of gaining access to computer accounts (especially social media accounts) is through social engineering. Social engineering is a non-technical strategy cyber attackers use that relies heavily on human interaction and often involves tricking people or manipulating victims into performing certain actions or providing confidential information that is subsequently used to gain access to the victims computer accounts. In a social engineering attack, an attacker uses human interaction (social skills) to obtain or compromise information about an organization or its computer systems. Social engineering can generally be broken down into two manners of data collection: Active social engineering & Passive social engineering.
Active Social Engineering
Active social engineering refers to affirmative actions an offender takes to solicit and obtain personal information or credentials of the victim in order to gain access to a computer account (commonly known as phishing).
Passive Social Engineering
Passive social engineering attempts to gain personal information to hack accounts of the victim by engaging in an individualized form of data mining. The hacker targets a victim and searches through the victims social media postings and other open source information, to gain personal information of the victim that is commonly used to reset passwords on various internet accounts. Once the hacker obtains basic personal information of the victim, they use the information to reset the victims password on that account and gain access to the victims personal information, photos, contact list and other social media accounts.
In both instances, the hackers goal is to obtain access to the victims computer and internet accounts in order to download all the personal information and images of the victim for use at a later point.
Increasingly, sextortionists are utilizing the newest iteration of the scare scam, wherein offenders send out an email or other message claiming they are in possession of NCP or other compromising images, and threaten to release them online or send them to your contacts unless you comply with their demands. The email may provide some basic information or even a previously used password to an online account to provide an indication of authenticity. Very often these messages are sent to email addresses exposed in previous known data breaches in which the user database (email address and password) was indexed online. The majority of extortion complaints received in 2018 were part of a sextortion campaign in which victims received an email threatening to send a pornographic video of them or other compromising information to family, friends, coworkers or social network contacts if a ransom was not paid.Although the offender may not actually have any images or other information about the victim, the fear and psychological damage to victims are just as real as if the offender did actually have pictures.
While significant research has been conducted into online child exploitation and child pornography, there is scant research available on the characterization or typology of sextortion offenders. Many of the typologies developed in relation to child pornography offenders have been found applicable to NCP and sextortion, in that the collection and dissemination of child pornography involves many of the same activities and motivations as those involved in the proliferation of NCP and sextortion. Generally, sextortionists and NCP offenders can be classified into four basic categories of offenders/offense typologies:
Revenge Offender commits offense as revenge without further demands (predominantly seen in NCP offenses, commonly referred to as revenge porn). This type of offense is most commonly committed by someone the victim knows and done due to a failed relationship, with the primary goal of embarrassment of the victim.
Profit Offender seeks monetary gain. Offender demands monetary payment or additional pornographic images from the victim solely for profit. Often, pictures obtained are further traded or sold online.
Domination/Gratification Offender obtains sadistic pleasure or sexual gratification by controlling victim. Offender will often demand victim perform increasingly degrading acts in order to demonstrate full control over the victims actions.
Predatory Offender grooms victim for future in person/real life sexual victimization. Offender will use the sextortion process to gradually lower the victims inhibitions and increase feelings of helpless, in order to arrange personal meetings with the intent to further sexually exploit the victim.
These categories are not mutually exclusive, and often offenders can transition from one category to another (i.e.: Revenge transitions into domination/Gratification) or fall into multiple categories (i.e.: Domination/Gratification & Predatory) based upon the situation.