Faces have been blurred. Screenshot via Facebook
This article originally appeared on VICE Canada.
It was the end of a long day, and Chelsea Clark and her boyfriend had settled in for a Netflix marathon on his laptop. “We were for sure watching Adventure Time,” says the 27-year-old bartender. “Pretty normal Wednesday night stuff.”
Videos by VICE
Yet the couple’s rather unremarkable, rather intimate evening soon became anything but.
Logging into Facebook after work the next day, Clark says her blood ran cold. An anonymous account had sent her a series of photos of the couple’s evening, seemingly taken from the laptop’s camera. “They were so freakishly intimate,” she says.
“Realy,cute couple [sic]” was the only message.
Terrified, Clark immediately called the Toronto police. “It felt so invasive, like someone was in my house with me.”
While this type of incident is not unheard of, Clark’s case is especially peculiar.
The images were taken using her boyfriend’s PC laptop, a computer Clark says she never uses. “It’s just for video games and occasionally we’ll use Netflix on it,” she explains. From there, the perpetrator managed to make the link to Clark, hacking into her Facebook account and adding himself to her contacts to send the images.
“I have my privacy setting set so that no one can message me except friends,” she says of her Facebook account. “So when I got an unknown [message] I thought it seemed weird,” she says. “I went into history to see when [the user] was added and it was just before the messages were sent.”
Cyber security expert Eric Parent says the context suggests the perpetrator knows the couple. “Or we’re dealing with someone who took the time to understand the relationship between these two people,” says Parent. “And that takes digging, since it’s not because I saw you on a webcam that I know who you are.”
The (now-deleted) Facebook profile used to send the photos offers little insight into the perpetrator’s identity (Mahmoud Abdo seems to be an incredibly common name, and is likely a fake). Alongside profile pictures featuring Heath Ledger as the Joker or strange motivational sayings, the person followed a variety of soccer club pages and belonged to a group called “Spammers and Hackers.” The user’s location is listed as Cairo, Egypt.
Screenshot via Facebook
Parent believes this detail could be a red herring. “You’d have to be kind of crazy to be sitting in Egypt and say ‘I’m going to traumatize a couple on the other side of the planet’,” he says, adding this type of long-distance harassment would then typically be accompanied by some form of extortion. “It’s much more likely someone they know.”
Motivation aside, Parent warns that hacking a webcam is relatively easy. “If you have access to the physical computer, all you need is some tech knowledge and a USB key and you’re done,” he says. Remote access, he explains, requires some form of user involvement. “Something has to be clicked, a doc has to be opened,” he says. But all in all, it’s a relatively simple hack that can be hard to detect. “It’s very difficult to protect yourself from this type of attack because the stuff that we do normally, like opening email, is stuff that just happens,” says Parent. “The best thing you can do is to have security software, keep everything up to date, and cross your fingers.”
The couple still has no idea how the computer was accessed. “My boyfriend has nothing outstanding in his browser history, there’s no security alert, no virus,” Clark says. “He ran a scan and it came back normal.”
According to Clark, the police’s initial intervention offered little assistance. “They came over and took a statement, and they were very nice and polite and completely useless.”
She says the officers told her they didn’t have the resources to deal with kind of offence. “They were like, ‘Maybe just block this person and hope they don’t contact you again,’” she says. “Great, sure.”
VICE contacted the Toronto police and was referred to one department after another, a Kafkaesque series of phone calls that illustrates how complicated navigating this type of offence can be.
When we finally reached the detective in charge of Clark’s case, Constable Garth Naidoo said he was unable to share much information. “At this point it’s very early in the investigation.”
Naidoo told VICE his team needed more details from Clark in order to move forward, but had been unable to reach her. He then inquired as to how we had managed to reach her and asked if we could provide them with the name of Clark’s employer or another phone number.
The detective said the first responders’ initial comments, about the force’s lack of cybercrime resources, had been misconstrued. “That is not the case, we do have an entire unit devoted to this kind of thing,” Naidoo said, advising VICE to contact the tech crimes department directly.
Yet calls to both the Toronto police switchboard and duty desk yielded confused responses from staff who seemingly had no idea the force even had a tech or cybercrime force.
When VICE’s call was transferred to Toronto Police Operations Centre, the woman at the end of the line said members of the tech crimes team did not speak directly to reporters, and that the particulars of Clark’s case could only be obtained through an access to information request.
She said Clark was likely withholding details. “Obviously he got her information somehow, she had put it out there,” she said of the hacker. “She’s either missing something or not being forthcoming with you about what happened.”
When asked if she could comment on this type of investigation in general, the woman told VICE they did not “police the internet,” and that it was up to people to “censor themselves.”
“We can’t walk over to Egypt and tell him what to do,” she added, hanging up when VICE requested her name.
Parent says this type of crime is tricky for law enforcement. If the offender is located, police could potentially lay identity fraud, harassment and voyeurism charges.But tracking down the perpetrator can be a challenge. In Clark’s case, Parent says police have the legal power to retrieve the user’s details, including the IP address, directly from Facebook’s administrators. “You have a context where you know there is a false account, so they shouldn’t have any trouble getting that information,” he says.
The possible international angle adds a layer of complication. “If you’re dealing with a country that’s a member of Interpol, then it’s feasible,” he says. “But if the Toronto police calls Interpol and says, ‘Someone hacked a laptop and took pictures,’ well, they have worse issues to deal with.”
He says the frequency and volume of cyber offences, combined with a perceived lack of ‘real’ threat, means the files often linger. “There are so many stories like this one,” Parent says. “It’s only when someone’s life is at stake or when someone has died that the files get floated to the top.”
Clark contacted both Facebook and Netflix to flag the problem. While Facebook told her that the account did not violate their terms of service, a media relations representative told VICE the account had since been removed. Netflix did not respond to VICE’s request for comments, nor to Clark’s concerns.
After VICE’s phone calls, Clark says the police finally got in touch and were soon coming to pick up the laptop and router. “I would just like some peace of mind to know that it’s not going to go any further,” she says.
“If this is just something that happens and we need to be more careful using our computers, that’s fine,” she says, adding she’s now put a band-aid over her webcam. “But I want to know where this person is from, that it’s not someone who knows where I live.”
Follow Brigitte Noël on Twitter.
