Next steps in extortion case - ideas?

Mailman List Mirror (Read Only)
1

Hi list,

nothing operational here, but there are many smart minds on this list and people working for telcos, ISPs and law enforcement agencies, so maybe you are willing to give me some advice in the following case:

There's an individual out there on the web that has been blackmailing hundreds of people and companies in a specific area of business for years. His scheme is: 1. Contact the alleged "debtor" via e-mail and inform him about an existing debt claim by a third party. 2. Offer the debtor a deadline to pay the debt and warn the debtor if he shouldn't pay he'll be prosecuted and his case will be "made public". 3. Once the deadline has elapsed, he'll publish completely false information made out of thin air on the web, in particular Facebook, Twitter, a blog, a website, including pictures of the debtor and serious accusations like "This debtor is a child molestor" or "This debtor is part of the mafia" and other crazy stuff that you can usually only see in movies. All of course with real names, company information (if applicable) and basically everything he can find out about the debtor. 4. Then, the individual hopes that the debtor will be intimidated because the debtor is afraid of the false information about him, which will show up on Google etc., and will finally pay to get this false information removed from the web.

In all cases the published "background information" about the debtors is false, made out of thin air, and over the top. Just the names and pictures are correct. Intentional slander in order to get the debtor to pay. If any of the published information was true, then every 2nd debtor would be a child molestor and every other debtor part of the mafia.

That individual is hiding his real identity really well, obviously, and he knows what he's doing. Domain hosted in Russia, taking good care his IP address won't show up in the mail headers, using false names and identities, phone numbers registered through some DID provider who doesn't collect personal information about the DID owner etc.

I am one of the accused and had lots of false information about myself and my company published by him. This is why I started to have an interest to track his real identity down. I took 2 days out of my life and researched high and low and finally found his personal phone number along with a name, a picture of him and several possible addresses (in the US).

I cannot be sure that the name, picture and addresses are correct, but I called him on his personal phone number and after having spoken with him before under his false identity, I can confirm that it's the same person (the voice is the same). He was quite surprised to say the least.

In case it matters, according to a LRN lookup the number belongs to Omnipoint Communications, which is part of T-Mobile USA, I think.

My idea is to somehow confirm his identity and confirm my research by matching the voice of the false identity (available from a message he left on my voicemail and also from his voicemail intro) to the real person. I'm thinking about hiring a private investigator in the US (I'm in Germany) to drive up to the addresses I can provide the PI with and find the person that matches the voice / maybe even the picture. The PI then must document the outcome in a way that it can be used in court. I'm wanting to go the PI route because it will be the fastest way to possibly gather evidence, I assume, as opposed to commissioning a lawyer who will then in turn contact law enforcement etc.

Unfortunately I do not have the authority to access the personal data of the person that pays the monthly bill for the phone number that I called him on, otherwise that would be the fastest way I suppose. I spent money for some pay-sites that do some reverse phone lookup and stuff like that, and although the information was helpful, I cannot be sure that it's accurate.

My goal is to confirm his real identity/name and address in order to start a lawsuit and have a lawyer, or maybe even law enforcement, investigate this case and ultimately, put an end to his slander activities, not just for my case but for all hundreds before me and those which are to come in the future.

Do you think the PI route makes sense? Any other recommendations? Your feedback in general?

Thanks and sorry for so much text. :slight_smile:
Markus

2

Fair warning: I am not a lawyer, and not an expert in the intricacies of international law. You would be well-advised to seek counsel from a lawyer who specializes in this area.

Have you contacted your local police, or the German equivalent (the BKA?) of the United States' FBI? Law enforcement agencies are going to
have (or can get through court order) the legal authority to get the
information you're after, and if the information is deemed credible and the offense serious enough, charges can be brought against the individual. Most likely the US FBI would get involved after being contacted by their counterparts in Germany, since international crime generally falls under federal jurisdiction in the US.

My personal opinion is that having a PI go to the individual's house would not accomplish more than 'tipping your hand' to that person - letting them know that you've committed resources to tracking them down.

jms

3

Law enforcement.

4

You mentioned that this person resides in the US. Does he always target
people outside the US? (from what you know about him)

5

I haven't contacted any law enforcement agency yet, because I'm not yet certain which one(s), where, and whether it's a good move at this point. According to my experience, German police is too slow, even if it's just passing on the case to the next "higher" agency. Somehow I think it would be most effective to have several investigations, that I start by myself, in parallel. E.g. in Russia -> collect the data of the person who's paying for the domain/hosting, so I guess I need a lawyer in Russia to contact sledcom.ru (the Russian equivalent of the FBI, I think), who in turn hopefully will make the Russian hosting provider provide that data. At the same time, a lawyer in the US to do the same for the phone number. In parallel, the same for the US hosting providers that were used in the past by that individual.

But, before I can do all that, won't I need sufficient proof? What I have at this point is a phone number, but I cannot be sure that the connected name and addresses, which I found solely based on web research, is accurate, and even if they were, that's no evidence for anything. This is why I came up with the PI idea, which I didn't explain properly enough. I didn't mean the PI to knock at some doors and say "Hello there, Markus from Germany sends me, are you <name>?" - hehe. :slight_smile: I meant that the PI should perform surveillance and observe who's arriving and leaving, and if a person matches the picture I provided or maybe ethnicity/age, walk up to him and ask for the way to the bus stop or something, in order to check whether his voice matches. If it does, and if the PI can document this in a way that can be used in court, I have an address and a name I can use to pass to lawyers/law enforcement.

When I write all this I always have in mind that law enforcement research is slow. Talking about Germany now, don't know about the US. Especially in a case like this where no life is in danger or where there's no other immediate threat. This is why I'm thinking: I better do/initiate as much research as I can by myself. Once I've collected everything I can from all kinds of sources I'll throw the whole bunch of documents to a lawyer/LE in the US.

Doesn't make sense? Wrong thinking?

Thanks!
Markus

6

No, he targets individuals and companies all over the world in this particular area of business.

And that's another good aspect. Because my goal is to shut down his activities as a whole, and not simply remove the blog posts about myself. The blog is hosted at blogspot (Google), and I see that they every now and then remove single posts after someone complained for long enough, but I guess the blog as a whole falls under some kind of freedom of information thing, so Google won't shut it down. And even if they would, he'd simply switch to another blog provider.

Regards
Markus

7

Sorry, maybe that line wasn't clear. What I meant is: he targets anyone, everywhere, including individuals and businesses in the US.

8

Have you contacted your local police, or the German equivalent (the

BKA?) of the United States' FBI?

> [...]

My personal opinion is that having a PI go to the individual's house

would not accomplish more than 'tipping your hand' to that person -
letting them know that you've committed resources to tracking them down.

I haven't contacted any law enforcement agency yet, because I'm not yet
certain which one(s), where, and whether it's a good move at this point.
According to my experience, German police is too slow, even if it's just
passing on the case to the next "higher" agency. Somehow I think it would
be most effective to have several investigations, that I start by myself,
in parallel. E.g. in Russia -> collect the data of the person who's paying
for the domain/hosting, so I guess I need a lawyer in Russia to contact
sledcom.ru (the Russian equivalent of the FBI, I think), who in turn
hopefully will make the Russian hosting provider provide that data. At the
same time, a lawyer in the US to do the same for the phone number. In
parallel, the same for the US hosting providers that were used in the past
by that individual.

But, before I can do all that, won't I need sufficient proof?

If you've been a victim of extortion, the simple
existence of the threat and demand for payment
is proof enough for law enforcement to start an
investigation. More information can sometimes
be helpful, but you run a risk of tainting evidence
if you go too far on your own, which may end up
hurting the case in the long term. If you obtain
proof through illegal or questionable means, it
generally can't be used as part of the case
against them.

What I have at this point is a phone number, but I cannot be sure that the
connected name and addresses, which I found solely based on web research,
is accurate, and even if they were, that's no evidence for anything. This
is why I came up with the PI idea, which I didn't explain properly enough.
I didn't mean the PI to knock at some doors and say "Hello there, Markus
from Germany sends me, are you <name>?" - hehe. :slight_smile: I meant that the PI
should perform surveillance and observe who's arriving and leaving, and if
a person matches the picture I provided or maybe ethnicity/age, walk up to
him and ask for the way to the bus stop or something, in order to check
whether his voice matches. If it does, and if the PI can document this in a
way that can be used in court, I have an address and a name I can use to
pass to lawyers/law enforcement.

When I write all this I always have in mind that law enforcement research
is slow. Talking about Germany now, don't know about the US. Especially in
a case like this where no life is in danger or where there's no other
immediate threat. This is why I'm thinking: I better do/initiate as much
research as I can by myself. Once I've collected everything I can from all
kinds of sources I'll throw the whole bunch of documents to a lawyer/LE in
the US.

Doesn't make sense? Wrong thinking?

Thanks!
Markus

It depends on your goal. If your goal is to
get this person off your back quickly, yes,
law enforcement can often seem slow.

But taking action on your own could end
up thwarting the longer-term goal of making
sure this person is never able to do it again,
in that if you obtain proof through means that
do not fall within the strict law enforcement
guidelines, they may escape prosecution
based on those technicalities. It would be
far better to start working with law enforcement
now, to ensure the investigation doesn't
create loopholes they can crawl out of
later as the noose tightens.

Matt

9

I think it will be easier/faster if a US victim pursues this with law
enforcement, since, in general, legal systems often don't take
complaints from foreign nationals very seriously. Maybe you join forces
with a US-victim?

10

Howdy,

Some information for you to consider:

1. There are two things going on here: extortion and libel.

2. Extortion is a crime. However, unless a substantial sum was
requested (much more than $1000) it may not be a felony. It can be
federal crime, but if you know who did it and where that individual
is, you'll have better luck pursuing it under state law. Local cops
don't need to justify travel expenses to investigate a local crime.

3. The first thing the law enforcement officer will ask you is: are
you prepared to come to the US and testify in court that the
individual you accuse in fact did what you accused them of. If the
answer is no, the case is usually over.

4. The next thing they'll want is some evidence. They need to get
enough evidence for "probable cause" so they can ask a judge for a
warrant to search the guy's house, computer, etc. Google the term and
read about it to learn what level of evidence constitutes probable
cause. The more money their department would have to spend to achieve
probable cause, the less attention they'll give the case. Hand it to
them on a platter and you're golden.

5. Understand that criminal law is about punishing crimes, not making
things right for the victim. Law enforcement's agenda is it's agenda,
not yours. They're interested in putting the guy in jail, not making
him undo the damage he did to you.

6. Libel, harmfully lying in writing, is not a crime: it's a tort. You
can sue the guy in court but law enforcement won't get involved. Also,
it's covered under state law, not federal. You'll have to sue him
either in the locality where he posted the libel from or in a locality
where you can prove you were specifically harmed by the libel. Nowhere
else has jurisdiction.

7. You'll have to prove you were actually harmed by the libel. So he
claimed you are a child molester. Boo hoo. How much money did you lose
from who and where as a result? If you can't prove you lost money,
don't waste your time.

8. Chat with a lawyer. Before you hire a PI or contact law enforcement
or do anything else, hire a lawyer in the area where you believe this
creep lives, show him what you have and ask his advice. A few hours of
a lawyer's time doesn't cost a fortune and he'll be able to give you a
realistic picture of your options.

Regards,
Bill Herrin

11

Well, soccer game is over...so here's some information that may help.

You have an interesting dilemma. But I don't think there is much you can
do with law enforcement across borders....except operate a work around
that will attract the attention of media and law enforcement. The law
isn't lazy, it's just busy.

Concept:
I suggest your operate your own campaign against the extortionists. One
that encourages the gathering of data by offering rewards for pieces of
information that lead to the conviction. You have the chance to tell the
world it's extortion - your info is publicly available as proof you are
pursuing the criminal.

Here's why:
Reminds me of the time I was extorted, legally ! I had to teach a US
bank's lawyer about trademark law. Rather than hand it over to that
asshole. Not all lawyers are assholes, my partners son is a lawyer now.
He's new, so he's working at it. :slight_smile: LOL

I had one of the first Internet companies called Easynet.com. I was
threatened to stop using it from a bank's lawyer that had the trademark in
the banking class. Even though I had the valid trademark in the telecom
class. Also bank's trademark used the term internally with other banks not
consumers. I told him. Lawyer was a jerk, we discussed him being paid more
to threaten and sue me than to just agree on 5k for me to market a name
change. Said he knew where I lived and he will create a case I just could
not afford. While I was staring at making payroll, the math took only 5
seconds to calculate that he was right. On the third call I told him I
never stopped, because I never received a letter from him to cease and
desist. That he could just be a voice on the phone, a future competitor
tricking me. Couple days later I got the letter officially threatening to
sue.

After getting the letter it kept me up all night. (I was usually up
resetting stuck dialup modems anyways). I decided to teach this lawyer
International trademark law. I immediately contacted the new Easynet.co.uk
(gee, wonder where they got that name idea). I asked if they wanted the
.com that I had to release it. They offered me some free hosting that I
never used. Told them to call the Internic in 24 hours. They got it. A
week later the lawyer called said what did I do to him! I said, what do
you mean. I did exactly as your letter stated. I stopped using it as it
instructed. You mean someone overseas has the .com now? Oh, well looks
like you need to brush up on international trademark law now. Let's see
you explain this to the bank.

Bank never got the one .com domain name the world can use. You see, while
the law was on my side, it didn't matter. I needed the time and money to
make the law work for me.

Lesson:
So sometimes you have to do something knowing you are in the right and at
the same time something that makes you feel as good as possible about a
bad situation. All the while operate within the law, or as close to the
line as you can walk it.

Concept Basic Outline:
You have an international legal problem, therefore you need to do the math
- math doesn't work out for you unless you're really Bill Gates hiding
behind this email address. Because, one of those law agencies across a
border is likely to take money from the guy you're after and not
cooperate. So give that idea up.

The Concept is work, you will feel good you are doing something about it,
it will be your testimony to the world the things are not true and most of
all if you do it right it may work.

Create a situation that creates public and media awareness. Build a site
against this sort of thing. Post as much info you gather as possible and
gather leads from anyone. Have a little fund to gather the data from
others...for example.

$1000 for the name of the true web site owner extortionist. Explain the
details of what that means clearly. Have a rumor posting blog section
where others that have had this occur can post. Maybe you create something
that locates this operation in good time.

Hire a good SEO person to help - make sure your web domains attract just
as much search attention. Get your domain name in your name - so that if
his info pops up your site link also pops up. Play an SEO war game. If the
exposure is to hot he may pull back rather than get caught. But leave this
in place, make it bigger than yourself and your dilemma. Help others that
end up new victims of the same situation.

After it's functional, maybe you can even use one of those free raise
money sites for this good cause against criminals. Create a place others
can turn, turn it into a .org that makes you and others a paycheck! At the
same time you will end up helping law enforcement. They are always
watching and openly attend ARIN/NANOG meetings. They come to get ideas
from us. ( Isn't that right Bobby ? )

Just a thought.

Bob Evans
CTO

"Rock'n Roll Rules like Old Guys"
We are programmed to receive, You can checkout anytime you like, but you
can never leave.

12

Not sure if anyone else has mentioned this but one reason to get law
enforcement involved, cynicism aside, is a concern for personal,
particularly physical, retribution.

At one time I spent a bit too much time refuting holocaust deniers, it
got rather one-on-one. They came in various flavors but some were easy
to characterize as neo-nazis, some well known to law enforcement and
the media, etc.

There were times I'd look up and down my (fairly long) driveway
carefully when coming home, in a manner of speaking.

13

Try contacting Brian Krebs.

http://krebsonsecurity.com/2014/06/2014-the-year-extortion-went-mainstream/

Also it seems like if you have a industry association you should get
them to notify members and help with a response.

Bill

14

Sue him for slander?

Contact the US DOJ and request extortion charges be filed? I mean if someone was committing a crime against me, I'd certainly be in contact with law enforcement to have charges filed and a warrant out for arrest.

You shouldn't have called him. He has certainly changed his phone number. He also now most likely has your personal phone number.

Contact law enforcement. That's what you should of done instead of calling him. I'd also consult your attorney. Ironically enough , the person you contacted could potentially try and turn the tables on you. Did you record the telephone conversation?

15

Thanks, all.

I'll get some consulting from an US lawyer next. Can anyone recommend a skilled, reliable lawyer offlist who "understands" the Internet respectively is tech-savvy? :slight_smile: Concept of IP addressing, domains, how Google works, web archive, VoIP etc.

In the Maryland / Virginia / Washington area.

Thanks so much!
Markus

16

Markus wrote:

17

IANAL but I believe criminal defamation is (ta-da!) a criminal offense.
Defamation in service of the crime of extortion -- depends on the
jurisdiction you decide to prosecute this in. Since the internet is
everywhere, you might be able to choose the jurisdiction with the harshest
penalty...Singapore? Want to see a scammer flogged? You could sell
tickets.

Furthermore, since this person (we don't actually know "his" gender, now do
we?) has established a clear pattern -- and the victims should be easy to
identify -- getting together with 16 other of them could constitute a
class, for the purposes of waging a class action suit.

Finally, one way to track down this person (I use the term loosely) is to
offer a small partial payment of the "debt" -- and see who cashes the
check.

18

Only 17 of the 50 states have criminal defamation laws and in half a
century only 16 cases have resulted in conviction. More, a 2012 ruling
by the U.N. Commission on Human Rights found that criminalization of
libel is inconsistent with Article 19 of the International Covenant on
Civil and Political Rights, making prosecutors that much less willing
to file defamation charges based on your complaint.

Libel is a civil tort. Pursuing it as a crime won't work out for you.

Also, you don't generally file a class action suit unless the class is
(A) large and (B) readily identified. When you have 16 actual
plaintiffs you file suit with 16 actual complaints. Much easier to
win.

I concur with the suggestion to ask folks at the Electronic Frontier
Foundation to refer you to a good U.S. lawyer. That's a smart move.
The Anti-Defamation League may also be of help though this sort of
thing isn't quite their bread and butter.

Regards,
Bill Herrin

19

17 is generally the number of people required, in the US, to file a case as
a class, which is why I said Markus should find 16 _other_ victims, which
shouldn't be terribly hard, if we believe his claim that this scammer has
targeted numerous others in this way.

Furthermore, since the internet is everywhere, I pointed out (or did you
stop reading after I mentioned that we don't actually know the gender of
the scammer?) Markus has the option of pursuing this in a jurisdiction
where the penalties for criminal defamation are the harshest. It would not
have to be in the US.

Finally, you fail to address the one very simple way I described to
determine who this scammer is: follow the money. Make a small partial
payment on this supposed "debt" and see who cashes the check. Much easier
than trying to follow "him" around on the internet, though that would be
made easier in the course of negotiating a partial payment.

20

Furthermore, since the internet is everywhere, I pointed out (or did you
stop reading after I mentioned that we don't actually know the gender of
the scammer?) Markus has the option of pursuing this in a jurisdiction
where the penalties for criminal defamation are the harshest. It would not
have to be in the US.

Unless one or more of the plaintiffs is located a country with the harshest penalities, or a plaintiff can otherwise demonstrate how people in country XYZ are being harmed by the scammer's actions, I don't see that going very far. A plaintiff in Germany trying to bring a case to court in Singapore against a defendant in the United States isn't going to work so well. I am not a lawyer, but my guess is that the case would be thrown out because the plaintiff would lack standing to bring a case to court in that country.

Yes, the global Internet is a global communications tool, but that doesn't mean you can cherry-pick which country to use in trying a case just because
the extortion is taking place over the Internet.

Finally, you fail to address the one very simple way I described to
determine who this scammer is: follow the money. Make a small partial
payment on this supposed "debt" and see who cashes the check. Much easier
than trying to follow "him" around on the internet, though that would be
made easier in the course of negotiating a partial payment.

This is much easier to do once law enforcement agencies are engaged. They can trace the money trail more throughly and effectively than you or I can, as civilians.

jms