BETA
This is a BETA experience. You may opt-out by clicking here

More From Forbes

Edit Story

The Dogged Digital Detective Work That Busted An Online Harasser

This article is more than 10 years old.

One night in June 2010, six men went to a woman's home in Maine and tapped on the glass of her windows as they had been instructed to do on Facebook. They were hoping to have sex with the woman inside the house after having seen racy photos that she'd posted to her Facebook profile page, and having been invited over. Inside the house, the woman was terrified. She had not in fact made the Facebook profile nor posted the Victoria's Secret style photos of herself, but she was fairly certain she knew who had.

This Internet harassment had been happening to the woman for over two years: ads on Craigslist that included photos of her in lingerie and directions to her home; fake Facebook and MySpace profiles; and the appearance of a video (of the steamy variety) on several porn sites that she had made with an ex-boyfriend, edited so that it displayed her name and address. In 2009, she changed her name and moved to Louisiana for a year to try to get away from the harassment, but the visits from strange men answering her digital avatar's siren call continued. The Internet's reach is a long one. The flow of men to her home, and even her work, looking to get lucky terrified her, causing her to fear she would be raped or assaulted.

She knew who was responsible for the harassment. It was the same person who took the photos of her in lingerie and with whom she had made the sex tape. She contacted the police but it took them two long years to gather the evidence necessary to prosecute him.

For those intent on punishing and harassing an ex, the Internet is a wonderland. Thanks to the power of anonymity and false identity, the options are endless for a determined jerk. But the anonymity of the Internet doesn't mean an online assailant won't get caught, especially if determined police officers get involved.

I've written before about the case of Shawn Sayer, the Maine man accused of inflicting the above on his ex-girlfriend. Prosecutors already convicted him of violating a protective order -- he's currently serving a 22-month sentence for that -- but they're also trying to get him on federal charges of interstate cyberstalking and identity theft. A recent opinion in the case reveals the lengths that Sayer went to try to keep his Internet harassment from being linked to him -- using IP spoofers and signing onto unprotected Wi-Fi networks for his malicious activity -- and the greater lengths the detectives on the case went to in order to bust him.

So what did they do?

This was all horrifying enough that the police, who often seem hesitant to pursue online harassment cases, got serious about unmasking and prosecuting the dude. Detective Laurie Northup of the Maine police led the investigation. She is unable to comment, the assistant U.S. attorney tells me, because the case, U.S. v. Shawn Sayer, is going to trial in August. But a judge's order [PDF], denying Sayer's attempt to suppress evidence in the case for constitutional reasons, sets out what the Maine police department did to hunt the harasser down:

  1. The obvious digital detective work: issuing subpoenas to PayPal, Facebook, MySpace and Yahoo to get identifying information and IP addresses for the person who had posted fake profiles, placed ads, and posted videos online. This led to an unhelpful trove of email addresses that had been created for the purpose of the postings. The IP addresses were more useful, showing the location of the networks from which the postings had been made, including many spots around the town of Maine where Sayer lived, as well as few from the Netherlands.
  2. Law enforcement drove into Sayer's driveway, pretending they were pulling in to turn around, and then used a laptop to determine which wireless signals he could pick up from his house. The judge explains: "Part of the government's case is that the defendant used others' wireless access so that his actions could not be traced to him." For example, a Craigslist ad posting and a new Facebook account created on Sayer's ex-girlfriend's behalf were both linked back to the IP address of Richard Cook in Biddeford, Maine, "who lived across the street from the defendant and had an unsecure wireless internet connection." Tricky, but not tricky enough.
  3. Law enforcement installed a "live-feed video camera" at a neighbor's house, with the neighbor's permission. (They must not have been big fans of Sayer.) Law enforcement apparently wanted to use this to help track Sayer's offline movements and tie them to his online activity. It didn't seem to have been very helpful. In one example of its use, "the camera showed the defendant leaving his house at 1:45 p.m. on April 2, and at 6:37 p.m. a new Facebook account was created purporting to be the victim." It's unclear how that helps their case.
  4. In November 2009, the officers searched Sayer's home (with a search warrant). They found two desktop computers without hard drives, numerous computer components, a laptop case and a digital camera with a USB cable attached. Weirdly, no laptop and no hard drives. "The defendant explained that the laptop had gotten wet so he threw it away and the hard drives had been 'hacked' and were unusable."
  5. In December 2009, Sayer's ex moved back to Maine from Louisiana. Shortly thereafter, "someone" welcomed her back by creating a new MySpace account for her which "linked to pornographic videos of the victim." After Detective Northrup obtained subscriber information and a connection log associated with the MySpace profile, she "learned that the profile was created and accessed by numerous IP addresses all registered to users in Saco, Maine. When Detective Northrup visited each of the addresses, she determined that all had unsecure wireless networks that would allow someone parked near the location to access the internet through their unsecure wireless connection."
  6. In December 2009, they got a court order to put a GPS tracker on Sayer's green Ford Ranger pick-up truck.
  7. More useful than the camera at the neighbor's house was the camera outside the Saco House of Pizza, which was pointed at the parking lot of a sweets shop with a open Wi-Fi network used by the perpetrator. From the judge's order: "The owner of Saco House of Pizza gave Detective Northrup the video surveillance tape from December 12, 2009, the date when Pepperell Sweet's wireless had been used to access the MySpace profile of the victim. The video shows a small green pickup truck pulling into a parking space in front of Pepperell Sweets minutes before the connection was made to the MySpace profile. The truck stayed parked for 21 minutes." Yes, they linked Sayer's truck with a MySpace posting made from the sweet shop's Wi-Fi network. Sweet indeed. The owner of Saco Pizza also later told an agent he saw a man typing on his laptop in the truck.
  8. In January 2010, law enforcement actually installed the GPS tracker on the truck. "Over the next week, the defendant's pickup truck was detected driving and stopping for periods of time in areas corresponding to the IP addresses that accessed the fraudulent MySpace account for the victim."
  9. In July 2010, they searched Sayer's house again. This time, they found a laptop. Once they examined it, they found evidence of 49 different Yahoo! profiles Sayer had created, including "luvmarriedmen29@yahoo.com." (Had the first 28 iterations of that already been claimed?) The account was often accessed from an Amsterdam-based IP address, leading the detective to suggest that Sayer was spoofing his IP address.

Sayer's case is set to go to trial in September, at which time this evidence would be presented.

Update*: "We haven't decided whether we're going to trial or pleading guilty," says Peter Rodway, Sayer's attorney. The sentencing range for Sayer should he admit regret and apologize would be about 4 to 5 years. Should he go to trial and be found guilty, the sentencing range would be 5 to 6 1/2 years, though his lawyer will likely argue he's already served almost two years in prison for the same offenses after his conviction in state court.

It sounds like Sayer was determined to harass his ex, but that law enforcement was equally determined to stop that harassment. The unmasking that law enforcement did here highlights the fact that our online activity is not as anonymous as we may think when we're online under assumed names and on other people's networks.

But it also highlights the fact that ripping off that mask takes some dogged police work.

*Quote from Sayer's attorney was added post-publication.