21

Sextortion Typology

It is so important that youth and teens, no matter what their sexual orientation or gender identity, and their parents become more aware of the pretexts, tactics, and strategies being used specific to the clear and present threat of online sextortion. As Sun Tzu, a wise and ancient Chinese warrior once stated, “If you know the enemy and know yourself, you need not fear the result of a hundred battles.”

It has been our experience that there are two categories of sextortion when it comes to youth and teens:

1. Sextortion committed by someone who the intended target knows, loves, or trusts. Nudes are shared in an intimate relationship and are later posted after the relationship ends as a revenge weapon utilized for peer embarrassment, or as a threat to be published if a partner is considering leaving a relationship. and,

2. Sextortion committed by someone the youth or teen does not know and has just met online – someone who we like to call the “capper”, which is short for capturing. In these cases, it has been our experience that the capper is usually associated with a Machalvanian organized online crime group. For this online criminal, it’s often all about the money via a ransom, and sometimes obtaining more nudes.  Although cappers can be located anywhere in the world, it has been our experience that these groups are usually located in Russia, South East Asia, Somalia, or Nigeria.

In this chapter, we are going to be concentrating primarily on the second category – the capper!

From January 2020 to August 2022 we have helped 99 teens, all under the age of 18yrs (the youngest was 13yrs), 97 who identified as male, and 2 who identified as female, who were targeted online by a sexualized troll (Capper) and extorted for money. In most cases, the sextortion began in under thirty minutes of initial contact with a targeted youth.  Sextortion by someone the youth or child does not know, love, or trust is a real threat and one that we need to speak to our kids about!  “Yes”, teen girls can and are being targeted for sextortion online by someone who they don’t know, love, or trust. However, over the past several years, there is an abundance of evidence to show that teen boys have become the bigger target – why?

1. Compared to teen boys, good academic peer-reviewed research shows that teen girls are significantly less likely to engage in risky sexual behaviour or to perceive the benefits of talking or seeking out sex online from people who they did not know, love, or trust” (Baungartner 2010), (Montiel et al 2016). – while boys appear more likely to engage in sexually revealing self-exposure with others online (Jonsson et all 2014). Given this fact, the online “capper” (the person who is the extorter) understands that this makes boys more vulnerable to manipulation, luring, and grooming tactics to get them to engage in sexual acts online that can then be covertly recorded and then used for sextortion.

2. The disinhibition effect of technology provides a false sense of security where teen boys believe that they have insulated themselves without anyone knowing who they are when engaging in sexualized behaviour online. We have found that teen boys are way more likely to believe “This will never happen to me” because they are smarter than those who wish to entrap them.

3. It has been our experience that teen boys are far less likely to report this crime to their parents and law enforcement when compared to young girls because of the embarrassment factor. Again, an advantage to the capper, and

4. According to Dr Scott Hadland, chief of adolescent medicine at Massachusetts General Hospital in Boston, when you mix the above 3 reasons with the fact that  “teen brains are still developing. When something catastrophic happens, like a personal picture is released to people online, it’s hard for the teen to look past that moment and understand that in the big scheme of things they’ll be able to get through this” Again, a psychological effect that cappers knowingly take advantage of.

Some 2022 stats and facts from the Canadian Center For Child Protection specific to youth sextortion.

• Between December 2021 and May 2022, they have seen a 150% increase in youth being sextorted.

• Cybertips.ca on average receives 57 sextortion reports per month from across Canada

• 87% of sextortion incidents were targeted toward those who identified as teen boys

Now although these numbers are concerning, we need to put some perspective into the discussion of sextortion specific to the level of occurrences. In a 2018 peer-reviewed study conducted by Dr Patchin and Dr Hinduja, where they interviewed over 5000 middle school and high school teens, only 5% stated that they had been the victim of a sextortion https://bit.ly/3P4KtfJ.  This is also congruent with some 2022 peer-reviewed research of over 2000 adults (18+) where the researchers found that 4.5% percent of men and 2.3% of women reported experiencing sextortion during the pandemic https://bit.ly/3z3WRXI. So “yes”, sextortion is a reality, and “yes” we have seen an anecdotal spike in reporting especially during COVID, but we would argue that it is still a rarity, but something parents, caregivers, and teens need to be alive to.  The other reality, stats mean nothing if it happens to your child!

The Capper’s Pretext:

Often, the capper will initiate contact with a youth utilizing social media platforms that are popular with teens such as Instagram, Snapchat, TikTok, Omegle, Emerald Chat, and even gaming sites.  Once contact is initiated, one, or a combination of these three strategies are often utilized:

• Baiting/Grooming – here, the capper will connect with the teen, often pretending to be the opposite gender of the intended target. They use a curated fake account (also known as a “Sock Puppet”) that is peppered with screen scraped pictures as the bait.  Once they connect with the teen, usually via a direct message, they will escalate their interaction sexually to the point where they will ask their target to move to a more “private” communication platform such as Google Hangouts, Skype, Instagram private messaging, or Snapchat messages. Once they have moved the teen to a more private communication platform, they will begin to exchange sexualized language which then escalates to nude pictures or live video of sexual acts being shared. Unknown to the teen, everything being shared (text, pictures, and video), is being covertly recorded without their knowledge, and then used for the purpose of extorting money or more nudes.

• Direct Threat –  the capper will forward screen captures of a teen’s friends, followers, or a school’s Facebook or Instagram account, and threaten to send a copy of their recording(s) as a pressure and manipulation tactic. This increases the likelihood of compliance by stating that if the targeted teen doesn’t pay the ransom, or send more nudes, then the nudes the capper does possess will be sent to all their friends, followers, or their school’s public social media account. It has been our experience that although this type of threat is common, it is often not carried out. However, we also know of some rare cases where this threat has been carried out, especially on Snapchat. We have helped one teen, and their family, where this was in fact the case.

• Implied Threat – here, the Capper will connect with the teen on a social media platform where they will send their target a direct message saying that they have seen “nudes” of the teen on a specific site. They will then attach a phishing link that directs the teen to see where their nudes have been posted, like Snapchat.  Once the student clicks the link, it will take them to a fake Snapchat sign-in page, or any other social media account, where the teen will often enter their user name and password which is now captured by the Capper.  The Capper, now having this information, will sign into the teen’s Snapchat account, take it over, lock the teen out, and hold the account hostage unless the teen sends them money or nudes.

Cappers Are Adapting To Teen Counter Measures:

Teens are smart; because of the news, social media safety programs, and learning from their peers who have fallen victim to this crime, many are aware of the tactics being used by cappers to bait them into the sextortion trap.

As mentioned in a previous chapter, often cappers will use screen-scraped nudes from porn sites or looping recorded porn video as their bait. Many teens know this and therefore will employ counter-tactics in an attempt to confirm that the person they are interacting with, via a private live stream is, in fact, a real person and not a looping recorded porn video. However, since January 2022, we have helped several teens, and their families, where the teen ended up being sextorted online by a “real” teen female they first met in an open social network. As the target was being groomed online, they were convinced to transition over to a more private space to engage in sexualized behaviour that no one else could see.

In these cases, rather than using a recorded looping nude video, the teen female was a real person who sexually engaged with their target via a live streaming video. We believe the females in these cases are not often willing participants, but likely the victims of human trafficking that a capper was using as the lure to hook their intended target. However, in some cases, they may be willing participants. Here’s an actual posting that we located on the dark web that was posted by a capper:

“By a happy coincidence, I now have a girl that I will partner with in order to make some money e-whoring with. She is in her mid 20’s, attractive, more the cute type of girl. She told me she would do pictures and video and also send verifications when people ask for it” 

Once their intended target shares an intimate image/video of themselves, the actual capper behind the camera then reveals the trap and begins the extortion process given they now possess a covert recording of the sexual behaviour their target was exhibiting in front of their camera. In all the cases we have assisted with, the capper also sent screenshots they captured from the recorded video to several online friends of the target (that they located on Snapchat or Instagram) as a part of the sextortion process, to increase pressure on the targeted teen to pay a ransom.

Most teens have been educated about capping and sextortion, where pictures and recorded looping video are commonly used as the bait. However, many are not aware that some cappers have upped their game and are now using “real” teen females, who are likely being forced to engage in live sexual acts by commercialized sexual exploiters (cappers), as the lure. As a teen who we recently helped shared with us:

 “I took all precautions to ensure it wasn’t a recording, but I was still fooled because it was a real live person who was my age”

Case Study:

With the permission of the 15-year-old teen and their parents, we are going to share with you an actual grooming process of a teen by a Capper that was conducted in a private messaging stream.  Misspells represent actual communications.

Capper: Hi, how are you

Teen: Good hbu. do you live in France

Capper: I am fine, a little bit bored, font thing we know each other but Facebook was created to make friends. I saw your profile at the right to my screen. I like make new friends. Am I bothering you?

Teen: Where are you from?

Capper: okay, you look cool nice to meet you, I am Esthelle, where do you live

Teen: nice to meet you too

Capper: never been in this part of Suisse I am from France but at the moment I am in Maryland, I came to visit my sister, How old are you?

Teen: ohhh that’s cool im 19

Capper: I just turned 20 last march, and what fo you do for work?

Teen: ive neem to France before on holidays its very cool. I am going to school right now how about you?

Capper: Ok that is awesome, I am hairdresser at home in France, but since I came to America for the summer, I do nothing at this time. But on mu return to France, I will go to a casting to be model. Its my dream to be model lol. Do you have a girlfriend

Teen: haha that awesome, good for you

Capper: ok im single too im looking for a good man one day what do you do for fun? Haha, but youre far away, I have an idea what is your name on gmail? I want to add u on hangout and we will chat in private there.

Teen: what is hangout

Capper: I sent you message on hangout answer me

Teen: I just installed the app it isn’t showing up send another

Capper: add me on hangout, call me now, you see me know?

Teen: yea I see you

Capper: write me I have a problem with microphone ok, I can not wait for you write me ok

Teen: can you hear me

Capper: you are very beautiful

Teen: so are you, can you hear my voice

Capper: I am excited I want to see your beautiful cock and you will see my pussy

Teen: ok you go first

Capper: fo down your cam on your beautiful cock and you’ll see my pussy now

Teen: the video is laggy though

Capper: drop your camera on your beautiful cock ill see and you’ll see my pussy now

Teen: the cams not really working

Capper: So sir right ow this video is on the channel YouTube but in private world. That is to say that it is you and I who know its existence. So if you try to hold me up I swing the link of your video to your loved ones, friends, family and your place of work. So youre going to stay calm and discuss the removal of your video, answer all my questions as I do this for a good cause. OK. I am the devil who came to earth to show you hell on earth. Then if you want to try to stand up to me you’ll regret it all your life. I swear, I swear to you that only one stupidity and I will react very badly by rotting your life so stay calm and listen to me very well if your really want your privacy and your image. You know very well that I can do it. In addition, your video is a video pedophile, this is forbidden on the net and by the law then if published you will do the rest of your life in prison. I swear to you because I am the most determined to make you know hell. So stay calm and answer my questions to end this video case once and for all

Teen: ??? what do you want bro what do you want to delete it

Capper: I swear if you try to block me or withdraw on facebook  I will ruin your life with this well understood video

Teen: what do you want

Capper: I am on the verge of rotting your life, but it will depend upon your actions. If you so not want to see me post this video everywhere, you will calm down and answer my questions and everything will be fine

Teen: okwtf, what do you want ???? what do you want bro

*** UPDATE *** July 2022

One common tactic that we have seen on the Meta platform (Facebook and Instagram) –  cappers will use fake social media accounts, also known as “sock puppets”.  Remember, wherever youth are online, no matter what the platform, there will be those who will want to target our kids for online predation and exploitation via the use of a fake account.

A common feature of these sock puppet accounts that we have identified – often, they will have a high following number, combined with a high follower number, but the actual number of posts made by the owner of the account will be extremely small, usually under 10.  Most will also contain info in the bio that will lead to a link where more private communications can take place like a SnapChat (SC) account.  I’ve attached a great example of one that was just used to target a teen on Instagram that we recently helped.

Here’s a real-world example of an unsolicited first contact text message, initiated by a capper, that was directed at a teen here in Canada, who was then targeted and lured online using the attached sock puppet account mentioned above. This led to the capper convincing the targeted teen to move over to SnapChat, where actual intimate images of the teen were shared, covertly recorded, and then used for the sextortion of the teen.

Capper – Hi , how are you doing?

Teen – Good, how are you?

Capper – not bad either, where are you from??

Teen – BC Canada,

Teen – WBU?

Capper – Vancouver

Teen – Nice I’m from Langley

Teen – How old are you?

Capper – 17

Capper – 18 in a few weeks

Capper – HBU

Teen – 17 in a few months (actually much younger)

Capper – Oh Cool

Capper – What do you do for fun?

Teen – Basketball

Teen – WBU?

Capper – I love to hand out with my friends

Capper – I love tennis and sexy games too

Teen – Nice

Capper – Yeah

Teen – Wdym (what do you mean) by sexy games?? Laughing emoji

Capper – it is just exchange of pictures without screenshot, but on snapchat tho

Teen – What’s your Snap

Capper – xxxx_xxx

Teen – K I’ll add you

Teen – Did you get it

MANAGING SEXTORTION

Sometimes all the awareness and education on this topic may not be good enough, and youth or teens can still fall victim to sextortion. If this happens, here are our recommendations:

• Do not pay any ransom that this person may be asking for (PayPal, Venmo, money order, e-transfer, bitcoin, Apple gift cards). If you pay, you will be labeled a “whale” and they WILL come back for more. If money was paid, connect with your bank or credit card vendor to see if it can be canceled.

• Immediately STOP all communication with this person.

• Screen capture all communications as evidence if possible.

• Given that this is a crime (known as extortion) you should report it to the police. If it is someone who you know personally, often police can assist to get the intimate picture or video deleted. However, if this person is someone you do not know, then it has been our experience that people who do this online are usually located in Russia, South East Asia, Somalia, or Nigeria.  Because of this fact, there is often not much police can do to help.  However, we still recommend that you report it to the police, but that is a choice you need to make. Also by reporting it to the police they can work with the Canadian Center For Child Protection https://bit.ly/3NNythw  If you still have the nude that you sent, they will take it and do something that is called a “hash” (digitally fingerprint the picture) so that if it does appear online, it will immediately be identified by a program that they use called “Project Arachnid”, and action taken to have it taken down wherever possible.

Case Study:

Recently, we helped an adult who was located in Canada who fell victim to a sextortion.  After connecting with us, she followed our suggestions, police got involved, and the offender was located and arrested in the United States. Unfortunately, the offender was able to post both her intimate pictures and videos to several sites online, but we were successful in having all of them removed!

• Do not block or delete this person until after you speak with the police and they let you know to go ahead and do so. However, if you are not going to speak with the police, immediately block and delete this person.  After you have done this, they will attempt to reconnect with you via a different feed or social network for the next 24-48 hours, again block and delete.  Also, do not accept any new friend or follow requests on any of your platforms for the next 48hrs.

• In some cases, you may decide to delete your account. If you do not decide to delete it, privatize it, change your password, and ensure that you turn on two-factor authentication if it is offered.

• It has been our experience, dealing with 82 teens that we have worked with, that the nudes will “likely” not be re-distributed widely. In only two cases, the nude was sent to a few (not widely) select number of friends as a part of the pressure campaign to get you to pay the ransom.  If this happens, and your face was not in the picture, then you have deniability and can say “that’s not me” to those few friends and followers who were sent the picture/video.  If your face was in the picture, it does make it more difficult, but good friends will not re-distribute. Many of the most popular social networks are now using really good artificial intelligence (AI) so that if a nude is posted, it will often, not always, be deleted fairly quickly by the social network. If not, then connecting with the social media site directly to request a takedown is strongly recommended.

• Usually, after 48hrs, this person will move on to another target because time is money to these criminals. If they think they can get anything from you, they will continue to put time and effort into their pressure campaign. Thus, why blocking, deleting, and having no more interaction is so important.

• The next step, set up Google Alerts https://www.google.ca/alerts – you will need a Gmail account to use this tool. In the Google Alerts search bar, type your name in quotation marks “John Smith”.  By doing this, Google will search your full name every day and if the nude gets posted/reposted and tagged with your name on the surface web, Google will likely pick up on it and send you an alert to your Gmail account.  Now if you get an alert don’t panic, there may be hundreds of other people in the world who have the same first and last name as yours.  If you get an alert, click on it and make sure it is you.  If it is your nude, you will now know where it is being hosted online, and can then make an application to have it taken down as child pornography if you are under the age of 18yrs. Will will talk about how to do this later in this chapter.

• You need to let your child know that no matter what the online challenge they face you are there to help without criticism or judgment. If your child does come forward to let you know they are being sextorted, take a few deep breaths then hug your child and let them know you are there to help. Remember, disclosure is the first step in the recovery process for your child. They sought you out for help (not often an easy task for teens), not your criticism or punishment. Reasonable consequences to actions can be discussed after the crisis has passed. Until then, be that supportive mama or papa bear that your child needs to help them navigate their perceived crisis, and don’t play the blame game. Remember, in most families, a parent’s love for their child is unconditional love – your child needs to know that although you may not like the fact that they sent a nude, you will still love them, and are there to help protect them from further harm.

Again, we know how traumatic an intimate image/video that goes or is threatened to go public online can be for youth. Remember, once the capper reveals themselves they will “induce stress, anxiety, or discomfort so that the victim will make decisions that contravene their best interest”, this is especially true with youth & teens!  In fact, Dr. Hadland, chief of adolescent medicine at Mass General Hospital in Boston stated in a CNN story on teen sextortion,

“Teen brains are still developing so when something catastrophic happens like a personal picture is released to people online, it’s hard for them to look past that moment and understand that in the big scheme of things they’ll be able to get through this.”

We must emphasize that in most cases that we have been involved in, where it was a stranger (capper) that targeted a teen for sextortion, in the vast majority of cases the nude is not redistributed – but we can’t guarantee this fact. However, in most cases after 48hrs, these “cappers” will move on to their next target and the nude will not be posted.

It is so important that teens, no matter what their sexual orientation or gender identity, and their parents become more aware of the pretexts, tactics, and strategies being used by online “cappers” specific to this clear and present threat of online sextortion. As Sun Tzu, a wise and ancient Chinese warrior once said, “If you know the enemy and know yourself, you need not fear the result of a hundred battles.”

Intimate Image Takedowns:

CAVEAT:

As social media vendors update their reporting protocols, takedown procedures can change without warning.  The below noted procedures were current at the time of publishing this Chapter in June 2022.

No matter what social media platform you will be connecting with to request a takedown, it is important that you share these six essential elements with the social media vendor if possible:

1. Screen Capture the intimate image/video that was posted as evidence, as well as it’s URL (where it is located on the platform/internet). The URL is required in most takedown requests.

2. Confirm that you are the person in the intimate image/ video that was posted.

3. Confirm your age at the time the intimate image/video was posted, this is especially true if at the time of the production of the picture/video you were under the age of 18yrs, which would make it “child pornography” and is a federal crime in Canada and in most countries.

4. Confirm you did not post the intimate image/video, and you did not give consent to anyone else to post the image/video – which is a federal crime in Canada.

5. If you notified the police, provide the name of the police department, the police case number, and the investigating officer. Often, this can expedite a social media platform to take an image down.

6. Include the section of the social media Terms of Service (TOS) that the image/video violates. Most social media vendors state clearly that the posting of any nudity is a clear violation of their policy and subject to immediate removal.

Important Note:

If you are reporting the non-consensual distribution of an intimate image/video to the police (which we highly encourage), we recommend that before you start connecting with a social media platform to have it taken down, ensure that the police give you the go-ahead to do so first.  In some cases, and depending upon the police agency, law enforcement may need to gather required evidence before a takedown action is initiated.

The White Hatter guide on how to request the removal of non-consensual posted intimate images/video from popular social networks. Click the below-noted link, then click the PDF link, then click open:

https://ln5.sync.com/dl/d501b6eb0#jb2gyj5r-9p8yyu4d-vkd5j56s-n7bvc5ky