Law & Disorder / Civilization & Discontents

Internet criminals: so reliably dumb at hiding their tracks

Shouldn't catching a sextortionist be a little bit harder than this?

Aurich Lawson / Thinkstock

It's a good thing for the rest of us that so few criminals are truly "masterminds"—and thus end up so easy to find. Case in point: the FBI's arrest, announced today, of an alleged sextortionist named Karen "Gary" Kazaryan in California.

First, let's be clear on the charges. According to the FBI, the 27-year-old spent huge amounts of time breaking in to e-mail and social networking accounts—usually Facebook—and then scouring them for sexually provocative photos. If found, the photos were then used to approach the account holders and blackmail them into making further displays, usually over Skype, to the watching hacker. If they didn't comply, the original photos might be posted to their Facebook page.

Here, for instance, is how FBI Special Agent Tanith Rogers describes a November 20, 2010 encounter between the hacker, who had obtained a topless photo of a woman in a hot tub from one victim's Facebook account, and two sisters:

The unknown persons then demanded that [victim 1] and [her sister, victim 2, who was actually in the picture] take their tops off and show their breasts on the Skype camera or he would post the photos on their Facebook walls for all of their friends to see. The unknown person told [the sisters] they had 10 seconds to do this. The girls attempted to stall the unknown person.

In retaliation for not complying within 10 seconds, the unknown person, without authorization, logged into [a friend of both girls'] Facebook account and added the [topless] photo of [victim 2] to [the friend's] Facebook wall. The unknown person then instant messaged [the victim] on Skype and sent the link to Facebook with the compromising photo attached. The link was [sic] the photos he had just put on their Facebook walls since they did not comply to his demands.

[The victims] were scared and felt threatened by the unknown subject. They were crying and both then showed their breasts to the unknown person on Skype. The unknown person said they did not show them for a long enough period of time and demanded that they do it again. The girls again complied to his demand and he took the link to the photos off of their Facebook pages. The victims immediately logged off of Skype.

[Victim 1] stated she is emotionally distraught and stated that [victim 2] said she felt as if she was raped. According to [victim 1], both victims closed down their Facebook and e-mail accounts. They are scared to use the computer and scared to be home alone.

In the end, the government claims that Kazaryan's computer held 3,000 photos of nude or semi-nude women, some seized from their own e-mail and Facebook accounts, some snapped from Skype chats like the one described above. More than 350 women may have been targeted.

So how did the FBI find Kazaryan? Well—pretty easily. They simply asked Facebook. By December 27, 2010, Facebook's internal security team had wrapped up an investigation in which it simply pulled the IP addresses for everyone who had accessed the various victim accounts over the last two months, then correlated them. One IP address was common to each:

So Facebook's team then did a different search, looking for every account that had been logged into from This produced a new list of 176 different accounts, and here was the remarkable thing: a huge number of these accounts had recently been disabled due to hacking or had filed tickets with Facebook complaining about being hacked.

So was likely to be the hacker, but who was he? Facebook wouldn't know for sure without the cooperation of Internet service providers, but it had a pretty good guess. That's because the single most commonly accessed account from—and by a huge margin—was for one Karen Kazaryan. The account had been accessed nearly every day and, just as crucially, Kazaryan had never reported his own account having been hacked.

So the next day, the FBI ran Kazaryan's name through various database and quickly found that he lived in a Glendale, California apartment and had "an arrest and pending trial for a rape charge in 2008."

It took another week for Charter Communications to confirm that the address was registered to the Glendale apartment owned by Kazaryan. On January 18, 2011, a federal magistrate judge agreed to a search warrant of Kazaryan's property, though it took one more year before the evidence was all gathered and an arrest was finally made.

No, seriously, the Internet isn't “private”

I've covered a lot of computer crime, and the one thing that never ceases to amaze me is how few precautions most criminals take. Even in these sorts of the extreme cases where the amount of time spent harassing young women must have amounted to a full-time job, the alleged perpetrators rarely bother to do anything as simple as hide behind a proxy, much less take further measures. That's not a universal rule, of course, especially when it comes to true professionals operating commercial fraud rings, but this idea that operating on the Internet isn't actually all that anonymous has yet to sink in with at least some significant percentage of the online criminal class.

Many of these schemes, especially those in which the perpetrator isn't in it for the money but for some sort of deviant sexual motive, seem premised on the belief that no one with subpoena power will ever come looking for them. The "hackers" appear to conflate the difficulty that their victims have in locating them with being truly hidden; in reality, most are leaving digital trails all over the Internet. Most end up identified with nothing more complicated than an IP address lookup.

Of course, the truly brilliant criminals may simply not get caught at all, and therefore we see only the stupid ones. But let's hope not, because most Internet users aren't particularly savvy, either. In every "sextortion" case I've seen, the victims also believe in the privacy of their online communications. They store compromising photos on Facebook, they e-mail them to other people, they post inadvisable images on sexually oriented dating sites—all in the belief that these things will not be leaked, hacked, or tied back to them. And yet it happens over and over. (Encryption? Fuggedaboutit.)

While using a smartphone or computer from the comfort of one's bedroom feels private and anonymous, it simply isn't once you connect to the 'Net. Both perps and victims would do well to remember it.

Expand full story

You must to comment.