Sextortion on the internet: Our man refuses to lie down and take it

Exclusive An unpleasant Monday morning kicked off when my personal email account popped up a message of thanks for joining YouTube rival Vimeo. Seven minutes later, I visited the website, where I was confronted by a sexually explicit video stating I was a pedophile.

The video depicted a bearded young man lying back on a bed, pleasuring himself rather vigorously in front of an iPhone. It was titled "Iain Thomson masturbates on webcam in front of 15 year old girl."

As someone who has never owned an iPhone, exposed their shortcomings in such a way, or looks anything like the aforementioned chap with his chap out on show, the video itself wasn't immediately worrying, although it was worth digging into.

Interesting; a @vimeo user has just set up an account in my name and uploaded an obscene clip. This could make a good article...

— Iain Thomson (@iainthomson) May 2, 2016

After discussing the situation with Vimeo, it appears that I'd been caught up in an increasingly common practice of blackmailing people online using embarrassing videos.

Sextortion

Sexual extortion is happening all the time on the internet: typically, a victim is tricked into performing sex acts on webcam by someone pretending to be a potential paramour. The blackmailer then threatens to leak the compromising images to friends, family and colleagues unless more acts are performed or money is paid.

More often than not, such extortion is devastating for the victim and can lead to further abuse. The Feds have been taking an increasing interest in such cases and tough sentences are being handed out to perpetrators: Karen "Gary" Kazaryan was threatened with 105 years in the big house after getting caught, although he got away with just five years inside.

More recently Interpol has warned that organized crime is getting in on the sextortion racket. Victims are identified via social media, dating, webcam or adult pornography sites, recorded, and then warned to pay up if they don’t want their family and friends to find out what they were up to – sometimes in an email purporting to come from the police themselves.

It is, by some accounts, quite a money spinner, and is becoming an increasing problem – not least because victims are unlikely to go to the police. That's particularly true if the video alleges serious criminal behavior, as the one thrown at me did.

However, as a tech journalist I know people at Vimeo, and so I went to the company to find out what was going on. A technical team within the biz trawled through server logs and appeared to find a first for the New York City-based outfit.

Under Vimeo's terms and conditions, videos can be uploaded to an account without any activation by the holder of the email address associated with the account. Activation of an account opens up messaging services and other goodies, but videos can be posted regardless of whether the account's email address has been validated.

This allowed the perp to publish a stranger's private video under my name, using my email address – a stranger who happened to share the same name as me. He is the real victim in this case, wherever in the world he may be: the blackmailer's next step would have been to extort the bloke, or publicly shame him, using the uploaded video. The vid was removed in less than 24 hours.

What to do in these situations

If you are the victim of this kind of sextortion attack there are a number of steps to take that will minimize harm.

1. Firstly, be open about it to break the blackmailer's hold.

   When the video upload notification came up with a screenshot, I thought it was a joke of some kind and showed it to my editor and the other hacks in Vulture West. It was only when I got home and actually viewed the video on a secure machine that the pedophilia accusation was seen and things got serious.

   Since there's no way this person could be mistaken for me (I've never worn a beard, am considerably slimmer than the victim, and have never owned an iPhone) I wasn't too worried. But once something goes online there's always a fear that it could be used to try and trash an online reputation.

2. Secondly, victims should go to the video hosting company and the police if they are being extorted. Vimeo and others want no part of this kind of traffic and are generally pretty good about taking down videos, and the police are more clued in than they used to be. Paying up will most likely lead to demands for more money.

   Crucially, don’t destroy the evidence. Vimeo were able to sort this out so quickly since I'd backed up all the emails but if you are being extorted make sure to keep everything, even logs of the conversations which prompted the original unwise activity.

3. Finally, just don’t do this kind of online sex unless you are 100 per cent certain that the person on the other end is who they say they are, and even then I'd advise against doing it. Even if you are convinced the person at the other end is real, there's no telling what they could do if the relationship breaks down, as revenge porn sites have shown.

Back in the dawn of the World Wide Web, Bruce Schneier gave some excellent advice in the first interview I had with him: never write or post anything online that you couldn’t justify publishing in your local paper. It was good advice then and still holds true today. ®