From Cybertips to Justice: How ICAC Fights Sextortion with OSINT

Inside the high-stakes world of ICAC analysts as they combat a growing crisis with OSINT.

‘I feel like he was tortured… and forced to put a gun to his head, or it would ruin his life, in his mind…’ - Jennifer DeMay Buta, Mother of Jordan DeMay [Source: ABC]

Jordan DeMay, the Upper Peninsula Michigan High School homecoming king, received a message on Instagram. Within six hours, he would die by suicide. 

The message came from a teenage girl, ‘dani.roberts’. She befriended him, flirted and offered to trade nudes. 'Is this a scam?', he asked ‘Dani.’ She replied with a resounding ‘no’. However, as soon as she had received the explicit photos she asked for, everything changed in a heartbeat. ‘Dani’ threatened to send the photos to everybody Jordan loved - ‘until it goes viral’ - unless he sent $1000 US, an enormous sum for a high schooler. Jordan’s parents would later learn he had attempted to send $300 of his own savings. But the threats didn’t stop.

‘They were building collages with his compromised photo, with other photos of his friends and family and parents threatening to send it out to them… They never gave him a single minute to think...’ - John DeMay, Jordan DeMay’s Father [Source: ABC]

Jordan told ‘Dani’ that he was out of options, that he was thinking of taking his own life ‘because of you’. He expected some sympathy from his exploiter. ‘Good’, Dani responded. ‘Do that fast.’ 

On March 25th 2022, the homecoming king died of a self-inflicted gunshot wound, in his bed at home.  

Kyla, Jordan’s girlfriend, then received a threatening message on Instagram. This random account had Jordan’s extorted images. Using this scrap of SOCMINT, the FBI subpoenaed Jordan’s social media. They discovered that ‘Dani’ wasn’t a teenage girl at all - in fact, she didn’t exist.

‘The second I stepped foot in the high school office and saw my parents with tears in their eyes, I melted to the floor...’  - Kyla Palomaki, Jordan DeMay’s Girlfriend [Source: ABC]

Jordan was a victim of a crime in which the FBI had seen a ‘shocking’ increase: sextortion. Under the guise of friendship or flirtation, cybercriminals coerce minors to create and send sexually explicit images or videos.

They use this content to extort financial gain, or worse, more Child Sexual Abuse Material (CSAM). It’s a crime of financial motivation, or worse, sexual gratification for the offender; sometimes even both. The offender will inevitably escalate if they get what they want from a child, requesting more or increasingly extreme content, or more money via wire transfer, mobile payment, cryptocurrency, gift cards or apps like Venmo and Cashapp.

‘One person the FBI put in prison for this crime was a man in his 40s who worked as a youth minister so he could learn how teens talked to each other…’ - Federal Bureau of Investigation, ‘Sextortion: How We Can Help You’ [Source: FBI]

Sextorters commonly target males aged 14–17, although any child can become a victim. They will exploit positions of trust, posing as a peer of their target. However, the approachable teenage persona they create is a ghost. As in Jordan’s case, financially-motivated offenders are not always domestic, operating from as far afield as South East Asia or West Africa. Law enforcement GeoINT led to an IP in Nigeria: three Nigerian brothers were behind the ‘dani.roberts’ Instagram account. They had more than 100 other victims, including a 16-year-old New Yorker and a 21-year-old Wisconsinite. Two of the brothers were extradited and sentenced to 17.5 years in prison for their sextortion scheme. The first prosecution of its type, it proved that sextortion is a serious and devastating crime. 

Death of a Homecoming King: Sextortion and Social Media

Still, the National Center for Missing & Exploited Children (NCMEC) also reports disturbing figures. At least 20 victims died of suicide, just like Jordan, in 2023. 1-in-4 sought medical or psychological help; 1-in-8 had to move house; and 45% suffered in silence, unable to turn to friends and family out of fear, embarrassment or shame. NCMEC received 26,718 CyberTips about financial sextortion, up from 10,731 reports in 2022. 

‘Teens are developmentally prone to believe bad things won't happen to them… they are more prone to trust the invisible other on the other end of the line.’ - Lindsay Jernigan, Psychologist and Psychology Today Contributor [Source: Newsweek]

Worst of all, 45% of perpetrators carried out their threats to ‘go viral’. A chain reaction of trauma is unique to sextortion cases, because children are often faced with fighting the proliferation of CSAM featuring their bodies. In 2023, Stanford Internet Observatory, UMass and other academic institutions undertook an OSINT-based research program into sextortion on Meta platforms. As it’s so popular with young people, Instagram hosts a sextortion-fuelled CSAM industry that thrives in the toxic miasma created by companies that prioritize finances over safety. 

‘Instagram doesn’t merely host these activities. Its algorithms promote them.’ - Brian Levine, UMass Rescue Lab Director [Source: WSJ/Archive]

Stanford and UMass used OSINT tools like Maltego to map a large-scale market network where material posted by sextorters is traded and bought. They found 405 seller accounts - often pretending to be teens like ‘Dani’ - 112 of which collectively had 22,000 unique followers. Certain accounts posted ‘menus’ of content created by-demand, commissioning specific acts to be performed by victims. Instagram facilitated searchable hashtags like ‘#preteensex’ and variations on ‘#mnsfw’ (‘minor not safe for work’) to find accounts advertising CSAM, including accounts distributing under the pretence of a minor posting it themselves. Test accounts that interacted with one account were flooded with recommendations that suggested Instagram hosts a network of accounts in the hundreds of thousands, if not millions actively promoting and connecting pedophiles to content sellers and sextorters via recommendation systems.

When test accounts attempted to access obvious CSAM and sextortion content, the only barrier was a warning pop-up that ‘these results may contain images of child sexual abuse’ - featuring a chilling option, ‘see results anyway.’ Enforcement penalties on Instagram are primarily account-based, making it easy to create ‘backup’ accounts. Anonymity has never been easier for these cybercriminals while Meta profits from monetisation and traffic.

‘I hope the company reinvests in human investigators.’ - Alex Stamos, Stanford Internet Observatory Head and ex-Chief Security Officer at Meta [Source: WSJ/Archive]

Meta’s inadequate automated systems are failing. They cannot prevent the distribution market of coerced images that means the pain never goes away for a sextortion victim. For law enforcement, the only way to intercept this devastating chain reaction is to identify the criminals responsible; and to identify victims before they suffer like Jordan did. The best tool for this, without a doubt, is OSINT. Where others couldn’t, OSINT researchers were able to investigate Instagram's pedophile and sextortion networks. OSINT was able to locate Jordan De May’s attackers, and bring them to justice. ‍

A Look Inside the National ICAC Program

On the frontline against cybercriminals that target America’s children is the Internet Crimes Against Children (ICAC) Task Force Program. This nationwide collaboration of multiple law enforcement agencies comprises 61 task forces, covering all 50 U.S. states, and over 5,400 federal, state, and local law enforcement agencies.

Criminal analysts working within an ICAC Task Force have a mission to solve cases for children like Jordan before the unthinkable takes place; and to bring victims to a place of safety. These analysts fight to investigate and prosecute those who exploit children online - including sextorters - and OSINT Industries is a key weapon in their arsenal to protect young people. 

ICAC units are varied. They can be made up of only 1 or 2 staff, or as many as hundreds, depending on location in the United States. These ICAC units field all cybertips directed to their specific task force; this equals massive volumes of data, which can be overwhelming. NCMEC (National Center for Missing and Exploited Children) cybertips number in the millions. In 2023, over 32 million cybertips were filed with NCMEC, and it’s become common for states to receive two to three sextortion cases per week. Task Forces can cope, but not comfortably. To exacerbate this discomfort, all 61 ICAC Task Forces in the United States report significant and escalating fiscal and public awareness challenges. 

OSINT is an investigative innovation that can solve the previously unsolvable, but it's also a much needed helping hand in these circumstances. An ICAC employee reached out to us to describe the difference our tool makes in difficult cases like sextortion, and how a tool like OSINT industries is a way for an ICAC investigator to ‘do the work of several people’, to ‘spend less time investigating more.’ Most importantly, these investigators no longer have to face the frustration of finding ‘there’s a lot of tips that we have to close’ due to lack of intel. With OSINT’s assistance in high pressure circumstances, ICAC staff can correct the ‘balance with a lot of outreach… in the community’, incorporating a proactive approach to safeguarding victims. With OSINT industries, more time and energy is available for not only solving tough cases, but the other life-saving tasks that an ICAC analyst performs.

OSINT and Cybertips: Putting the Pieces Together

The rising threat of sextortion poses distinct challenges to an investigator. An offender might only share scraps of information with the victim: a username, a phone number, an email address, a social media account. Investigating these cases requires an analyst to ‘be able to put those pieces together’. This is where OSINT Industries can help.

Before finding our tool, ICAC units lacked a way to build connections from email addresses or, vitally, usernames. Young people, and young victims, are primarily connected to the world and to offenders via social media; therefore, they often lack the traditional information law enforcement work with to identify their attackers, or themselves. This hamstrung investigations on the social platforms on which sextorters are the most prolific: image-sharing chat platform Snapchat, Instagram and even gaming chat platform Discord.

‘OSINT is something we use for both victims and suspects, depending on case.’ - An ICAC Criminal Analyst [Source: OSINT Industries]

Statistically, Instagram and Snapchat are the platforms offenders most often use to make first contact with victims. Instagram featured in not only Jordan DeMay’s case, but many other tragic incidents, mentioned in 45.1% of reports to NCMEC. Snapchat, where offenders take advantage of ‘disappearing’ images as a ruse, was mentioned in 31.6% of such reports. ICAC units often find that our OSINT tool was the master key required to unlock these platforms, and overcome the specific challenges each posed in reaching a victim or offender. Most helpfully, OSINT Industries presented the ability to discover and link a name to an account on Snapchat; without the tool, investigators told us they often couldn’t make the link.

With victims, overcoming these identification challenges means that children can be rescued from a crime they might be unlikely to self-report. A positive identification of a victim with OSINT can be a trigger for a welfare check, ensuring the safety of a child who may wrongly feel what has happened is their fault. A positive identification of a suspect can provide evidence for the sophisticated coercion and deception that underlies sextortion tactics. This can liberate a young person and their family from commonly reported feelings and fears of blame.

‘Over a third of our cases are sextortion. We need to take the stigma away of victim blaming. It's not your fault, it's theirs…’ - Hayley Laskey, Revenge Porn Helpline [Source: BBC]

OSINT for a Warrant: Getting Visual Evidence 

ICAC Task Forces’ use of OSINT is a much-needed corrective when social media platforms shirk responsibility for the young people effectively in their care. Tools like OSINT Industries are something analysts have begun to use daily, integrating them into their everyday workflow, because seeking subpoenas for social media data has become an investigative hurdle.

Social media companies are not forthcoming with users’ data. However, in order to issue a warrant for law enforcement, ICAC needs to provide sufficient intel to begin legal processes. Open-source data is accessible, but in the past this data could be difficult to marshal; today things are different. In many cases, especially sextortion, OSINT will form the majority of an evidence packet. Without this data, a warrant cannot be issued, and the process of justice can never commence.

The OSINT data submitted to secure a warrant runs the gamut from images to app data, but the former can build the foundation of an investigation. Not only is sextortion an image-based crime, but images gathered by OSINT Industries can provide some of the most important information for a warrant. An image can verify the age of a victim, placing a case in ICAC’s remit.

While on Snapchat or Instagram - photo-sharing platforms - analysts can easily access images that verify a user is a minor, other platforms pose a challenge. On a chat-based, image-free platform like Discord, or other platforms that lack a culture of uploading genuine profile pictures, it can be difficult to obtain this vital eyewitness evidence. OSINT Industries can provide a solution: a username search, or email search, can unearth linked accounts and phone numbers that prove a user’s identity.

Another element that makes profile pictures invaluable stems from the power of Geospatial Intelligence (GeoINT). As well as establishing victim age, profile pictures gathered using OSINT Industries present an opportunity for OSINT geolocation. Through performing GeoINT on a profile picture, ICAC analysts can extract location data, spotting subtle visual cues like landmarks, signage, or environmental features that suggest which part of the world a victim or perpetrator calls home. With sextorters operating worldwide, this intel is vital to narrow down locations of interest and establish which jurisdiction, and which Task Force, will be responsible for the case - it can also link a predator to a digital or offline crime scene. Even when all other identifying details are scarce, uncovering GeoINT from a simple profile picture can provide critical leads and further substantiate evidence for a life-saving warrant.

Before OSINT Industries, these images were beyond ICAC’s reach.

OSINT Industries Access: Keeping Cases Open‍

'I went through my 100 credits fast!’ - An ICAC Criminal Analyst [Source: OSINT Industries]

At OSINT Industries, the philosophy of #OSINT4Good drives everything we do, and working with ICAC is a part of that movement. Through at least one ICAC unit’s missions, our tool has helped to provide a beacon of hope for young people.

Previous OSINT tools had provided no success for these officers. Before OSINT Industries, ICAC staff remember that emails and usernames were ‘nada’ in terms of evidence, despite being the most common footprints young people - and predators like sextorters - leave across the world. OSINT Industries’ ICAC users report how quickly they use up their initial 100 credits demonstrating to fellow officers the efficacy of our platform. They report that soon after seeing our tool in action, multiple other staff will sign up too.

Before, using the team’s previous tool, ‘if we just had a phone number, you’d have to close cases and let victims go’. The latter part of this statement is suffused with heartbreak. Details that now present solid leads had failed in the past. Brave analysts were unable to help victims, leaving officers frustrated and young people unheard. Thankfully, ICAC units ‘no longer have to close those cases’. Cases that once seemed impossible to solve can now be pursued, and no victim needs to be abandoned for lack of actionable leads.

To find out more about ICAC’s work, visit:

https://icactaskforce.org/

‍