FBI Seeks Victims Of Cyber 'Sextortion'

The FBI is seeking victims of what it's describing as a series of online "sextortion" attacks conducted by an unnamed, 31-year-old California man, arrested in June.

A two-year investigation revealed that he’d secretly installed malicious code on people’s computers using social engineering techniques -- tricking them into thinking he was a family member or friend, so they’d open malicious files. The malicious software enabled him to take control of their PCs and search for explicit images, which he then used to blackmail women, as well as dozens of adolescent girls, into providing even more explicit images.

To date, authorities said they’ve identified 230 victims of the attacks, and last week, after first detailing the attacks in public, urged other victims to step forward.

The FBI said the attacks only came to light because the hacker contacted victims directly. “For example, the hacker attached a pornographic picture of one victim in an e-mail and demanded sexually explicit video of her in return for not telling her parents about the pictures he had downloaded from her computer,” said FBI special agent Tanith Rogers, one of the investigators.

“One of the most disturbing things about this case,” she said, is that “he could have done this forever and gone undetected -- the victims would never have known he was listening and watching.”

This case has strong parallels with a case first disclosed in late October by the California Highway Patrol (CHP), after its arrest of Samuel Bronk, 23, on 30 felony counts. Charges included identity theft, child pornography, extortion and unlawfully accessing 170 e-mail and Facebook accounts.

All told, authorities found a list of 3,200 e-mail profiles, including the unlawfully accessed accounts, on Bronk’s PC, as well as 1,100 images and 50 videos of child pornography.

According to CHP commissioner Joe Farrow, “it’s clear that the suspect in this case had successfully infiltrated numerous accounts of unsuspecting victims.”

The alleged attacks occurred between September 2009 and September 2010. Bronk allegedly targeted many of the victims -- including female minors -- by first identifying them via Facebook, then contacting their email providers and initiating a “lost password process,” through which he guessed people’s security questions and then reset the password, locking users out.

According to the CHP, “after gaining access to the e-mail account, Bronk searched the victim’s ‘sent mail’ folder for nude or semi-nude photographs and videos, which he then sent to the victim’s entire e-mail address book from the victim’s e-mail account.” He allegedly also posted the images to Facebook pages and in at least one case threatened to more widely post sexually explicit images of a victim, unless she provided more explicit photographs.

As Farrow said, “be careful what you post on social networking sites and send via the Internet.”