Revenge Porn victims to get Justice?

Revenge Porn has been one of the more despicable trends on the Internet over the past years, but recent court documents and arrests indicate that the business practices of some of the participants were even worse than the already gutter-level concept appeared to be.

IsAnyoneUp.com & email account hacking

IsAnyoneUp was charged in Federal court on Thursday, January 23, 2014. One of the operators, Hunter Moore, aged 27, was proud of his label as "the most hated man on the Internet" and actually did regular news interviews about his site and his practices. What should have been Moore's shame actually glorified the site and lead to enormous growth as Moore appeared in Rolling Stone magazine, the BBC, and CNN's Dr. Drew show. The website, isanyoneup.com, which earned Moore $20,000 per month in advertising fees, featured pictures of nude and sexually compromised women that were supposedly sent to the site by individuals seeking revenge on former lovers. As many as 350,000 visitors per day came to the site which added between The women were listed with their real names, and often including links to their Twitter accounts or other personal information. Moore boasted that nude pictures of school teachers were the most popular. A comment section under each woman's photo encouraged guests to make crude comments about the woman depicted.

According to a Hunter Moore indictment shared by WIRED Magazine's ThreatPost, beginning in October 2011 Hunter hired Charles Evens to begin hacking into women's email accounts looking for nude photos and sending them to Moore for his website. The indictment charges the pair with:

• 18 USC § 371: Conspiracy
  57 Overt Acts of the conspiracy, including orders and payments for hacking, the hacking itself, and the uploading of stolen images are listed from October 2011 to March 2012.
• 18 USC § 1030(a)(2)(C) & (c)(2)(B)(i): Unauthorized Access to a Protected Computer to Obtain Information 8 specific hacks against Google's email servers are listed from December 2011 to January 29, 2012.
• 18 USC § 1028(a)(1): Aggravated Identity Theft 7 individuals are listed whose "means of identification" were used "during and in relation to felony violations" ... "to obtain information for private financial gain" (Aggravated Identity Theft carries a mandatory +2 years sentence.)
• 18 USC § 2: Aiding and Abetting and Causing and Act To Be Done

Evens received his payments via an anonymous PayPal account set up for this purpose.

(For more on Email Hacking, be sure to see our story: Unprecedented International Cybercrime Cooperation Nabs Email Hackers.)

UGotPosted.com & Extortion

In December a second Revenge Porn hacker was arrested in San Diego and charged with 31 felony counts. UGotPosted.com was run by Kevin Christopher Bollaert, also aged 27, hosted more than 10,000 sexually explicit photos where every photo included the full name, locatoin, age, and a Facebook profile link for each victim. Unlike Hunter Moore, who scoffed at Cease & Desist letters and relocated his servers at least forty times to avoid having his content seized, Bollaert decided to use the opportunity for extortion. Anyone who objected to their nudity or sexual activity being depicted online was invited to visit the website ChangeMyReputation.com, where Bollaert charged a $350 fee to remove the postings on UGotPosted.com. Kevin Christopher Bollaert was charged by the California Attorney General Kamala D. Harris with California Penal Code Violations:

• 182(a)(1) - Conspiracy
• 530.5(a) - Identity Theft
  to willfully obtain someone's personal identifying information, including name, age and address, for any unlawful purpose, including with the intent to annoy or harass *AND* to obtain credits, goods, or services via the identity of another.
• 520 - Extortion
  to receive money via a threat
• 519 - Extortion via exposing or imputing disgrace or exposing a secret affecting the victim

In the Superior Court of California Criminal Complaint, Bollaert is said to have been the administrator of UGotPosted.com from December 2, 2012 to September 17, 2013, posted 10,170 private images of individuals without their permission. The complaint also charges that he collected in excess of $10,000 extortion money from the ChangeMyReputation.com website.

A 22 page Arrest Warrant also gives great detail including the sworn testimony of the investigating officer, and statements from a Legal Analyst in the eCrime Unit of the Attorney General's office, who took interest in the case after identifying 25 California residents who were documented on the site. Many of the 14 Jane Does interviewed stated that their cell phone number, street address, Facebook page, Twitter account, LinkedIn profile, and dating website profiles were shared as people commenting on the pictures seemed to make sport out of finding and sharing additional personal details about the individuals depicted. Several reported being approached in person, including one woman who had her cell phone stolen from her to obtain additional photographs from her phone. When the Attorney General's investigator spoke to Bollaert by telephone he attempted to learn an address where a subpoena could be served. Bollaert replied he was "staying off the grid" and terminated the phone call.

One of the most interesting emails in the arrest warrant to me was a reproduction of the email from CloudFlare on October 18, 2012:

The name servers for changemyreputation.com have been updated and changemyreputation.com has been added to your CloudFlare account. CloudFlare is now accelerating and protecting your website. We are also gathering cool stats on your site, so check the reports & stats section at https://www.cloudflare.com/my-websites.html.

As I've mentioned before, CloudFlare's choice of clientelle leaves something to be desired!