Why It’s So Hard to Prosecute Cyberstalking

The founder of Sightline Security said she would never have gotten into the security business if she hadn’t endured years of cyberstalking in the early 2000s. Kelley Misata, who is CEO of the startup that helps nonprofits build cybersecurity into their programs, said she sought advice from law enforcement and nonprofits during that time, but neither had a clue how to help. 

Ryan White, a former assistant U.S. attorney for the Central District of California, said he wasn’t surprised by the details of Misata’s case. “Law enforcement traditionally is used to investigating real-world crime—crimes they can investigate by going out and interviewing people and looking at real footage.” In the early 2000s, they had a long way to go to catch up to what was beginning to explode. And despite legal and technical advancements, cyberstalking remains difficult to prosecute even now, according to White. 

A Case Outside the Mold

Misata had described a series of encounters with law enforcement that were frustrating, to put it mildly. The harassment she experienced started in California in 2007 and lasted for about seven years. The man who stalked her was never her boyfriend. There were no nude photographs with which to threaten her. They merely worked at the same company. It says a lot about the state of the law in 2007 that the police reflexively referred to the domestic violence law when they spoke to her. It was the closest one they could find to her situation, even though she’d never had a personal relationship with this guy, much less a shared domicile. 

After she moved to Massachusetts, the harassment continued. It wasn’t just about tracking her movements and communicating with her. He started intruding on the lives of the people around her. He contacted her friends and family. And not just once. He persisted until it was annoying. And then scary, because he wouldn’t stop.

When she reported the harassment to the police, one officer said, “He’s thousands of miles away. He can’t hurt you.” This wasn’t an aberration. No one seemed to understand her plight. When a detective seemed equally mystified, Misata tried a different tack. “Are you on Facebook?” she asked the woman. The detective nodded. “OK, what do you post?” Nothing special: “Pictures of my niece, my nephew, this and that.” Misata nodded. “You know there are bad guys on Facebook, right? Do you have privacy settings turned on?” The detective said she didn’t and suddenly looked concerned. “Can we go set them up right now?” Misata asked. And in the middle of her interview in the police station, they walked into the back office, got on the detective’s computer, and Misata showed her what she needed to do.

When Misata first reported the cyber harassment she was experiencing, it had not even been defined in the law. And when Misata talked about cyberbullying, the police wondered what that had to do with her. They’d heard about it, but the victims were teenagers, like 13-year-old Megan Meier. She was the school girl who hanged herself after the mother of her former friend bullied her online. The mother, Lori Drew, was convicted by an Los Angeles jury—before the judge reversed the verdict and acquitted her. 

The cops didn’t see how bullying fit, and Misata didn’t understand how the domestic violence laws did. But there didn’t seem to be alternatives. ”I had one law enforcement agent tell me that if you had bruises or some physical harm, they could do something,” she recalled. They seemed stuck “at a time where people were devastated by children committing suicide,” Misata said. And parents were wondering “how can stuff that’s happening in social media and through text messages affect my child’s life so badly that they take their life?” But Misata wasn’t mystified. “I understand why they did that,” she said. “I understand how dark and sad they were, and how helpless they were feeling.” 

The Problems for Law Enforcement

But Misata’s challenges with law enforcement more than a decade ago were not just a result of a dearth of laws covering online behavior, according to White, who is now chair of the cybersecurity and data privacy department of litigation boutique Halpern May Ybarra Gelberg in Los Angeles. Local cops and prosecutors were frequently hamstrung by their inability to subpoena information outside of state boundaries. And often the data—the evidence in online cases—crossed state and even international lines. So investigation and prosecution had to be done by the feds—by the FBI and by assistant U.S. attorneys like him. And the laws they used were the federal cyberstalking statute, the Computer Fraud and Abuse Act and the aggravated identity theft statute. 

One reason these cases can be tricky is precisely because there are not likely to be bruises to corroborate crimes. Threats are delivered by emails and texts. And the defense may insist these are protected by the First Amendment. White argued a case, United States v. Osinger, before the U.S. Court of Appeals for the Ninth Circuit in which that was a key issue. Christopher Osinger had been convicted of stalking and harassing his former girlfriend.

After she’d left Illinois and moved to California to get away from him, he spoofed a Facebook page that appeared to be hers and sent sexually explicit photos of her to, among others, colleagues at her new job. In appealing his conviction, Osinger argued that the stalking statute was unconstitutionally vague and violated his free speech rights. The court was not convinced. “Any expressive aspects of Osinger’s speech were not protected under the First Amendment,” the court held, “because they were ‘integral to criminal conduct’ in intentionally harassing, intimidating or causing substantial emotional distress …”

Even today, the issue isn’t easy, White said. What is cyber stalking? “It can be everything from revenge porn, to online impersonation, to text messaging,” he said. “And that makes it very difficult to define. And consequently, difficult for the public to understand, for law enforcement to understand, and sometimes to see as a real problem.” 

Despite the missteps Misata described, she was able to convince the FBI to open an investigation. And they worked on it diligently, she said. But in the end, there was a problem. She hadn’t saved any of his early communications. That was the last thing she’d wanted to do at the time. And then he began to anonymize his messages using Tor, software that allows anonymous communication. So all the FBI was able to offer was to do a “knock and talk”—knock on his door and talk to him about what he was doing. And that was the very last thing Misata wanted. All that would do was “poke the bear,” she said. 

When asked why the FBI couldn’t have gotten a subpoena to learn the origins of these messages, White explained that’s not really possible with Tor. Messages are sent through a decentralized network of encrypted communications around the world that shuttle randomly through at least three host computers. To trace a message back through these permutations and positively identify it would be next to impossible, White added. Such things are only attempted for national security investigations of the highest priority, he continued, and require the greatest expenditure of resources with no guarantee of success. “For the U.S. government to use those tools, to the extent they even can, they use them very, very rarely.” 

A Question of Resources

During White’s time as a federal prosecutor, “individual cases became few and far between,” he said. That was “in part because they mushroomed, and in part because technology like Tor became more widespread.” 

Those developments ushered in changes in California. As the cases exploded, White noted, the state began passing laws to better address them, outlawing revenge porn, cyberbullying, and e-personation (electronic impersonation). There were no comparable laws adopted on the federal level. And California created a specialized unit of prosecutors. This meant that more cases, including the individual ones, could be handled at that level. So the U.S. Attorney’s Office was even more selective about the cases it pursued. 

To justify expending substantial resources, White said that prosecutors consider how “egregious” the conduct was. “Of course it’s all egregious,” he added, “but there’s degrees.” One factor is often the number of victims. Another is how much impact a case will have on the community. 

He cited examples of cases they took. All involved a substantial number of victims and guaranteed media attention. The most recent, he said, was Richard Bauer, a NASA contractor who pleaded guilty in 2018 to stalking, computer hacking and aggravated identity theft. He hacked into the computers of women he knew and used the information he obtained, including nude photographs, to demand more of the same by anonymously threatening to publish the images he’d stolen—or send them to the victims’ families and coworkers. 

Hunter Moore ran isanyoneup.com, the internet’s best known “revenge porn” website. Individuals submitted nude and sexually explicit photographs of women to Moore, without their permission, and encouraged him to post them in order to exact revenge. He pleaded guilty in 2015 to computer hacking and aggravated identity theft. And then there was “Celebgate,” the 2014 scandal in which at least five people broke into the computers of celebrities to steal nude photographs and other private material. The best known victims were actresses Jennifer Lawrence and Mary Elizabeth Winstead, but more than 200 women were victimized.

White summed up the realities. “Defendants can be held to account, and the system certainly can work. And the tools are there,” he said. “Is it going to happen for every victim in every case? No. That’s unfortunately the way that law enforcement works. And that’s not limited to just cyber stuff. That’s all crimes.” Maybe 1% of all crime that occurs actually gets investigated, he posited. Whatever that number is, he continued, a lot less than that gets prosecuted. “That’s just the way it works,” he said.

What Are the Options for Victims?

Ironically, the National Network to End Domestic Violence turned out to be one of the most helpful support organizations Misata has found. It’s not only for victims of domestic violence. Another educational experience came from an even more surprising source. Beginning in 2011, she worked for two years as the communications director at the Tor Project. 

She’d been unemployed at the time and had gone to a talk given by Andrew Lewman, the organization’s executive director, to get a better handle on what Tor was all about. As she’d listened, it hit her that the technology wasn’t the harasser. It only facilitated what the people who used it were doing. After his talk was over, Misata went up and asked Lewman for a job. She had a master’s in marketing, and he needed someone to write an annual report. 

She went from feeling victimized by Tor to defending and explaining it. This new perspective helped her gain a sense of control over the subject. It solidified her perception that the issue wasn’t about technology; it was about people. And it led to her next big move: earning a Ph.D. in information security at Purdue University.

She has advice now for victims. File a report with the police. Even if you’re not sure a crime has been committed. “Go file the report so you can start that documentation,” Misata said. “So you can have something to hold on to.” And remember, you don’t know all the things the stalker has been doing, she pointed out, so you can’t know whether he’s been breaking the law. “Keep the evidence,” she urged. “It’s so important to not just close your eyes” and imagine the horror will disappear.

White concurred. “Don’t stop if the first law enforcement contact doesn’t understand,” he added. “Go to another.” Try to take control, as best you can.

For many victims, Misata emphasized, what they want is not necessarily to see the stalker go to prison. Or to successfully sue him for damages. She and White both noted that the penalties, even for some of the splashy criminal cases, are not as severe as one might imagine. A few years in prison tops. And in a civil case, even if a result looks good on paper, often the defendants never pay up. 

But that’s not the biggest issue. “I think for many victims,” Mistata said, “they just want it to stop.” Their dream is not for their day in court. Their fondest wish is for a magic button they push and he’s gone. But there’s no Hollywood ending, she continued. Even if they go to jail, “do you ever have that full assurance that they’re going to stop?” she asked. “For many victims, we just don’t.” 

That’s not the fault of prosecutors or cops. “Honestly,” she said, “the law enforcement agencies that I worked with were amazing. They were great people who cared a lot, who wanted to help, who just didn’t have either the resources or the knowledge.” And have undoubtedly learned a lot in the intervening years.

She faults herself for not having documented the abuse early on, when there was plenty she could have saved before he started using Tor. Like some forms of disease, catching it early can make a big difference. “If you can get some of these situations a little bit earlier, where it doesn’t escalate, then maybe you have a chance to defuse it so it’s not so impactful. I lost so much evidence,” she said. “I know that my story would have been very, very different if I had more evidence to show.” 

And now, after all that she’s been through, does she finally feel that it’s over? “Sometimes I have to remind myself that I have 10-plus years under my belt,” Misata said. “I have a Ph.D., I have a community around me. I have all these resources. But in the pit of my stomach, the fear is still there.”

David Hechler is editor-in-chief of TAG Cyber Law Journal, which covers cybersecurity and privacy. He was previously a longtime reporter and editor at ALM. He can be reached at dhechler@tag-cyber.com.

Links and Resources:

CA Resources for Victims of Cyber Exploitation  

The National Network to End Domestic Violence

The FBI’s Internet Crime Complaint Center (IC3)

National Cyber Security Alliance

What to Do If You’re a Target of Online Harassment