PHOTO: (L-R) Kelley Misata founder of Sightline Security and Ryan White of Halpern May Ybarra Gelberg. Courtesy photos
The founder of Sightline SecurityΒ said she would never have gotten into the security business if she hadnβt endured years of cyberstalking in the early 2000s. Kelley Misata, who is CEO of the startup that helps nonprofits build cybersecurity into their programs, said she sought advice from law enforcement and nonprofits during that time, but neither had a clue how to help.Β
Ryan White, a former assistant U.S. attorney for the Central District of California, said he wasnβt surprised by the details of Misataβs case. βLaw enforcement traditionally is used to investigating real-world crimeβcrimes they can investigate by going out and interviewing people and looking at real footage.β In the early 2000s, they had a long way to go to catch up to what was beginning to explode. And despite legal and technical advancements, cyberstalking remains difficult to prosecute even now, according to White.Β
A Case Outside the Mold
Misata had described a series of encounters with law enforcement that were frustrating, to put it mildly. The harassment she experienced started in California in 2007 and lasted for about seven years. The man who stalked her was never her boyfriend. There were no nude photographs with which to threaten her. They merely worked at the same company. It says a lot about the state of the law in 2007 that the police reflexively referred to the domestic violence law when they spoke to her. It was the closest one they could find to her situation, even though sheβd never had a personal relationship with this guy, much less a shared domicile.Β
After she moved to Massachusetts, the harassment continued. It wasnβt just about tracking her movements and communicating with her. He started intruding on the lives of the people around her. He contacted her friends and family. And not just once. He persisted until it was annoying. And then scary, because he wouldnβt stop.
When she reported the harassment to the police, one officer said, βHeβs thousands of miles away. He canβt hurt you.β This wasnβt an aberration. No one seemed to understand her plight. When a detective seemed equally mystified, Misata tried a different tack. βAre you on Facebook?β she asked the woman. The detective nodded. βOK, what do you post?β Nothing special: βPictures of my niece, my nephew, this and that.β Misata nodded. βYou know there are bad guys on Facebook, right? Do you have privacy settings turned on?β The detective said she didnβt and suddenly looked concerned. βCan we go set them up right now?β Misata asked. And in the middle of her interview in the police station, they walked into the back office, got on the detectiveβs computer, and Misata showed her what she needed to do.
When Misata first reported the cyber harassment she was experiencing, it had not even been defined in the law. And when Misata talked about cyberbullying, the police wondered what that had to do with her. Theyβd heard about it, but the victims were teenagers, like 13-year-old Megan Meier. She was the school girl who hanged herself after the mother of her former friend bullied her online. The mother, Lori Drew, was convicted by an Los Angeles juryβbefore the judgeΒ reversed the verdict and acquitted her.Β
The cops didnβt see how bullying fit, and Misata didnβt understand how the domestic violence laws did. But there didnβt seem to be alternatives. βI had one law enforcement agent tell me that if you had bruises or some physical harm, they could do something,β she recalled. They seemed stuck βat a time where people were devastated by children committing suicide,β Misata said. And parents were wondering βhow can stuff thatβs happening in social media and through text messages affect my childβs life so badly that they take their life?β But Misata wasnβt mystified. βI understand why they did that,β she said. βI understand how dark and sad they were, and how helpless they were feeling.βΒ
The Problems for Law Enforcement
But Misataβs challenges with law enforcement more than a decade ago were not just a result of a dearth of laws covering online behavior, according to White, who is now chair of the cybersecurity and data privacy department of litigation boutique Halpern May Ybarra Gelberg in Los Angeles. Local cops and prosecutors were frequently hamstrung by their inability to subpoena information outside of state boundaries. And often the dataβthe evidence in online casesβcrossed state and even international lines. So investigation and prosecution had to be done by the fedsβby the FBI and by assistant U.S. attorneys like him. And the laws they used were theΒ federal cyberstalking statute, theΒ Computer Fraud and Abuse ActΒ and theΒ aggravated identity theft statute.Β
One reason these cases can be tricky is precisely because there are not likely to be bruises to corroborate crimes. Threats are delivered by emails and texts. And the defense may insist these are protected by the First Amendment. White argued a case,Β United States v. Osinger,Β before the U.S. Court of Appeals for the Ninth Circuit in which that was a key issue. Christopher Osinger had been convicted of stalking and harassing his former girlfriend.
After sheβd left Illinois and moved to California to get away from him, he spoofed a Facebook page that appeared to be hers and sent sexually explicit photos of her to, among others, colleagues at her new job. In appealing his conviction, Osinger argued that the stalking statute was unconstitutionally vague and violated his free speech rights. The court was not convinced. βAny expressive aspects of Osingerβs speech were not protected under the First Amendment,β the court held, βbecause they were βintegral to criminal conductβ in intentionally harassing, intimidating or causing substantial emotional distress β¦β
Even today, the issue isnβt easy, White said. What is cyber stalking? βIt can be everything from revenge porn, to online impersonation, to text messaging,β he said. βAnd that makes it very difficult to define. And consequently, difficult for the public to understand, for law enforcement to understand, and sometimes to see as a real problem.βΒ
Despite the missteps Misata described, she was able to convince the FBI to open an investigation. And they worked on it diligently, she said. But in the end, there was a problem. She hadnβt saved any of his early communications. That was the last thing sheβd wanted to do at the time. And then he began to anonymize his messages using Tor, software that allows anonymous communication. So all the FBI was able to offer was to do a βknock and talkββknock on his door and talk to him about what he was doing. And that was the very last thing Misata wanted. All that would do was βpoke the bear,β she said.Β
When asked why the FBI couldnβt have gotten a subpoena to learn the origins of these messages, White explained thatβs not really possible with Tor. Messages are sent through a decentralized network of encrypted communications around the world that shuttle randomly through at least three host computers. To trace a message back through these permutations and positively identify it would be next to impossible, White added. Such things are only attempted for national security investigations of the highest priority, he continued, and require the greatest expenditure of resources with no guarantee of success. βFor the U.S. government to use those tools, to the extent they even can, they use them very, very rarely.βΒ
A Question of Resources
During Whiteβs time as a federal prosecutor, βindividual cases became few and far between,β he said. That was βin part because they mushroomed, and in part because technology like Tor became more widespread.βΒ
Those developments ushered in changes in California. As the cases exploded, White noted, the state began passing laws to better address them, outlawingΒ revenge porn,Β cyberbullying, andΒ e-personationΒ (electronic impersonation). There were no comparable laws adopted on the federal level. And California created a specialized unit of prosecutors. This meant that more cases, including the individual ones, could be handled at that level. So the U.S. Attorneyβs Office was even more selective about the cases it pursued.Β
To justify expending substantial resources, White said that prosecutors consider how βegregiousβ the conduct was. βOf course itβs all egregious,β he added, βbut thereβs degrees.β One factor is often the number of victims. Another is how much impact a case will have on the community.Β
He cited examples of cases they took. All involved a substantial number of victims and guaranteed media attention. The most recent, he said, wasΒ Richard Bauer, a NASA contractor who pleaded guilty in 2018 to stalking, computer hacking and aggravated identity theft. He hacked into the computers of women he knew and used the information he obtained, including nude photographs, to demand more of the same by anonymously threatening to publish the images heβd stolenβor send them to the victimsβ families and coworkers.Β
Hunter MooreΒ ran isanyoneup.com, the internetβs best known βrevenge pornβ website. Individuals submitted nude and sexually explicit photographs of women to Moore, without their permission, and encouraged him to post them in order to exact revenge. He pleaded guilty in 2015 to computer hacking and aggravated identity theft. And then there was βCelebgate,β the 2014 scandal in which at least five people broke into the computers of celebrities to steal nude photographs and other private material. The best known victims were actresses Jennifer Lawrence and Mary Elizabeth Winstead, but more than 200 women were victimized.
White summed up the realities. βDefendants can be held to account, and the system certainly can work. And the tools are there,β he said. βIs it going to happen for every victim in every case? No. Thatβs unfortunately the way that law enforcement works. And thatβs not limited to just cyber stuff. Thatβs all crimes.β Maybe 1% of all crime that occurs actually gets investigated, he posited. Whatever that number is, he continued, a lot less than that gets prosecuted. βThatβs just the way it works,β he said.
What Are the Options for Victims?
Ironically, theΒ National Network to End Domestic ViolenceΒ turned out to be one of the most helpful support organizations Misata has found. Itβs not only for victims of domestic violence. Another educational experience came from an even more surprising source. Beginning in 2011, she worked for two years as the communications director at the Tor Project.Β
Sheβd been unemployed at the time and had gone to a talk given by Andrew Lewman, the organizationβs executive director, to get a better handle on what Tor was all about. As sheβd listened, it hit her that the technology wasnβt the harasser. It only facilitated what the people who used it were doing. After his talk was over, Misata went up and asked Lewman for a job. She had a masterβs in marketing, and he needed someone to write an annual report.Β
She went from feeling victimized by Tor to defending and explaining it. This new perspective helped her gain a sense of control over the subject. It solidified her perception that the issue wasnβt about technology; it was about people. And it led to her next big move: earning a Ph.D. in information security at Purdue University.
She has advice now for victims. File a report with the police. Even if youβre not sure a crime has been committed. βGo file the report so you can start that documentation,β Misata said. βSo you can have something to hold on to.β And remember, you donβt know all the things the stalker has been doing, she pointed out, so you canβt know whether heβs been breaking the law. βKeep the evidence,β she urged. βItβs so important to not just close your eyesβ and imagine the horror will disappear.
White concurred. βDonβt stop if the first law enforcement contact doesnβt understand,β he added. βGo to another.β Try to take control, as best you can.
For many victims, Misata emphasized, what they want is not necessarily to see the stalker go to prison. Or to successfully sue him for damages. She and White both noted that the penalties, even for some of the splashy criminal cases, are not as severe as one might imagine. A few years in prison tops. And in a civil case, even if a result looks good on paper, often the defendants never pay up.Β
But thatβs not the biggest issue. βI think for many victims,β Mistata said, βthey just want it to stop.β Their dream is not for their day in court. Their fondest wish is for a magic button they push and heβs gone. But thereβs no Hollywood ending, she continued. Even if they go to jail, βdo you ever have that full assurance that theyβre going to stop?β she asked. βFor many victims, we just donβt.βΒ
Thatβs not the fault of prosecutors or cops. βHonestly,β she said, βthe law enforcement agencies that I worked with were amazing. They were great people who cared a lot, who wanted to help, who just didnβt have either the resources or the knowledge.β And have undoubtedly learned a lot in the intervening years.
She faults herself for not having documented the abuse early on, when there was plenty she could have saved before he started using Tor. Like some forms of disease, catching it early can make a big difference. βIf you can get some of these situations a little bit earlier, where it doesnβt escalate, then maybe you have a chance to defuse it so itβs not so impactful. I lost so much evidence,β she said. βI know that my story would have been very, very different if I had more evidence to show.βΒ
And now, after all that sheβs been through, does she finally feel that itβs over? βSometimes I have to remind myself that I have 10-plus years under my belt,β Misata said. βI have a Ph.D., I have a community around me. I have all these resources. But in the pit of my stomach, the fear is still there.β
David HechlerΒ is editor-in-chief of TAG Cyber Law Journal, which covers cybersecurity and privacy. He was previously a longtime reporter and editor at ALM. He can be reached atΒ dhechler@tag-cyber.com.
Links and Resources:
CA Resources for Victims of Cyber ExploitationΒ Β
The National Network to End Domestic Violence
The FBIβs Internet Crime Complaint Center (IC3)
National Cyber Security Alliance
What to Do If Youβre a Target of Online HarassmentΒ