Episode Transcript
[00:00:00] Speaker A: You know, I'm a regular reader of Wired, and a few days ago, I came across an article by Edgy Dixon, published September 14, 2026. The title stopped me cold.
A college girl was exploited on camera. A network of anonymous men got to work. I read it once, then went back and read it again.
I was shocked this was happening, but in the digital world we live in, I can't honestly say I was surprised.
[00:00:29] Speaker B: I remember you called me and said, sue, put down whatever you're reading. You need to see this. And I thought, okay, this must be serious.
[00:00:39] Speaker A: And you actually did.
[00:00:40] Speaker B: I did. I put my book down, read the article, and called you straight back. I remember saying, nick, this is horrifying. We need to do an episode on it, and we need to do it now.
[00:00:51] Speaker A: Exactly.
And that is why we moved quickly.
We spent this week working to get this episode ready. Not to repeat the cruelty, but to help more people understand the machinery behind it and recognize the warning signs before another victim is left to face it alone.
[00:01:09] Speaker B: Because this is not simply one awful story. It exposes a broader and deeply harmful online culture known as the Burner verse. A loose network of disposable, anonymous social media accounts, many tied to college sports, campus rivalries, gossip, and cruelty. The accounts feed on humiliation, fear, and the belief that nobody will ever discover who is behind them.
[00:01:37] Speaker A: And once you look past the ugly posts and disposable handles, the operation becomes clearer. This was not isolated online cruelty.
It looked organized. A room with no walls, a crowd with no faces, and a system capable of humiliating one person in front of millions before breakfast, then acting as though nobody touched the switch.
[00:02:02] Speaker B: The name makes it sound temporary, a joke account you light use and toss. But disposable identities can produce permanent harm.
[00:02:10] Speaker A: Dixon's investigation follows University of Florida student Maddie Kowalski's effort to fight back after an alleged campaign of distribution, harassment, and exposure.
[00:02:21] Speaker B: We are not going to repeat private material, describe it, or turn somebody else's violation into spectacle. That is the logic of the burner verse, and we refuse to reproduce it. Our focus is the machinery around the harm. The anonymous accounts, the amplification networks, the threats, the institutional paralysis.
And the investigation that began connecting handles to human beings.
[00:02:48] Speaker A: And doxxing is central to the way these networks turn information into a weapon.
[00:02:52] Speaker B: Wait, Nick. I hear that word doxxing all the time, and I'm not even sure I know exactly what it means, so enlighten me. What is doxxing? And where did that word come from?
[00:03:03] Speaker A: Fair question. Doxxing, sometimes spelled with one X, sometimes Two is when someone gathers information that that can identify or locate you and then puts it online to hurt, frighten or intimidate you.
That might be your real name, home address, phone number, workplace, family details, or financial information.
The Federal Cybersecurity and Infrastructure Security Agency describes it more formally as gathering sensitive information from public sources or or compromised material and publishing it online for malicious purposes.
[00:03:42] Speaker B: So it doesn't necessarily mean somebody hacked a computer.
[00:03:45] Speaker A: Correct, the information may have been stolen, but it can also be assembled from public records. Social media posts, property databases, old newsletters, breach data or details the victim never realized could be connected.
One fact may look harmless.
10. Facts assembled and delivered to a hostile crowd become a targeting package.
[00:04:10] Speaker B: The weapon is not always the secrecy of the information.
Sometimes it is the way the information is gathered, framed and handed to people who want to cause harm.
[00:04:20] Speaker A: Exactly. And the word itself comes from docs, short for documents.
In the 1990s, hacker culture, dropping docs, later written as dropping docs with an X, meant exposing the records or real world identity of an anonymous rival. Britannica traces the term to that phrase and notes that it can include revealing an anonymous person's identity as well as publishing addresses, phone numbers, workplace details, financial information, private correspondence or family information.
[00:05:00] Speaker B: So the tactic began as a way to tear off somebody's digital mask, often
[00:05:05] Speaker A: for retaliation, leverage or intimidation.
The practice of publicly exposing people is much older than the Internet, of course, but the online form grew out of early hacker and forum culture, where anonymity carried status and revealing an opponent's identity could unleash real world consequences.
The terminology entered broader public use much later.
The Oxford English Dictionary dates its earliest evidence for the noun doxing to 2011.
[00:05:40] Speaker B: And now people sometimes use the word for any personal detail posted online too loosely.
[00:05:46] Speaker A: Publishing a publicly listed office number in an ordinary news story is not automatically doxing.
Context and purpose matter.
The danger appears when personal information is exposed or compiled without consent as a means of punishment, coercion, harassment or intimidation. A home address paired with go tell this person what you think is not neutral information, it is an invitation which
[00:06:15] Speaker B: brings us directly back to this case. The information is not merely released in
[00:06:21] Speaker A: it is aimed exactly in the burner verse. Doxing is how anonymous online aggression crosses the boundary into a person's home, family, school and physical safety. Because viewed through an investigative lens, this does not look like random Internet chaos. It looks like an extortion economy.
Not necessarily one boss, one payroll, or one command center, but a repeatable model.
Acquire leverage, announce possession, manufacture, panic, demand money or submission Recruit an audience, punish resistance, and hide the operators behind layers of pseudonyms.
[00:07:00] Speaker B: A shakedown does not stop being a shakedown because the weapon is a trending topic instead of a baseball bat.
[00:07:07] Speaker A: And anonymity does not erase evidence, it merely scatters it.
[00:07:10] Speaker B: This is the story of a 19 year old treated as content of systems that move too slowly. And of a family that refused to accept the Internet's favorite lie.
[00:07:21] Speaker A: That nobody can ever find out who is behind the account.
[00:07:24] Speaker B: I'm Sue.
[00:07:25] Speaker A: And I'm Nick. This is behind the scams. The Burniverse wants you to believe it is smoke.
[00:07:30] Speaker B: Today we follow the fingerprints through the fire. Let's start with the word burner. A burner account is supposed to be expendable. No family photographs, no employer, no history tied to a legal name. Just a handle, a voice and enough distance to say things the operator would never say face to face, in isolation.
[00:07:53] Speaker A: That is simply pseudonymity. People use pseudonyms for legitimate reasons every day. Whistleblowers use them, dissidents use them, victims use them. The problem is not anonymity by itself. The problem is organized conduct carried out under cover of anonymity.
[00:08:11] Speaker B: A mask is not a crime.
[00:08:12] Speaker A: Correct. But a mask can become part of the method. Here's the blueprint I see. First, somebody collects the leverage. A rumor, a screenshot, a phone number, an address. Maybe a family member's workplace. Then the network tests it. Is the target recognizable? Will the information travel? Next comes the controlled release. One account posts, the others reply, quote, tag and tease that there is more. Then the crowd escalates, digging for anything else it can expose. After that comes monetization or control.
Payment. Attention, followers. Compliance.
And finally, intimidation. Resist us and we will make this worse.
[00:08:54] Speaker B: And the cruelty becomes participatory. One account supplies the match. Another supplies oxygen. Hundred supply applause.
[00:09:02] Speaker A: That division of labor matters. In a traditional fraud ring. One person may source leads, another makes calls. Another moves money and another launders proceeds. The Burnerverse can divide work the same way without formal membership cards. One handle acquires the material, another packages it, another distributes it. Another runs an audio room. Another doxes relatives. Another threatens the victim.
Participants do not need to meet in a warehouse or salute a leader. Shared incentives coordinate them.
[00:09:38] Speaker B: Clout is the currency.
[00:09:39] Speaker A: Clout. Fear, access, insider status. And sometimes money. A low tier cybercrime crew may not have sophisticated malware. What it has is asymmetric power. The victim has one identity. One family, one. One reputation. The attackers can cycle through 50 disposable identities. The victim must defend every door. The attackers only need one opening.
[00:10:06] Speaker B: That imbalance is the terror. Imagine being 19 and discovering that an unknown crowd has decided your name is tonight's entertainment. Your phone becomes a threat delivery system.
Every notification may be another insult, another disclosure, another. Another stranger announcing possession of something private.
Sleep becomes surveillance.
Silence becomes suspicious. You are asked to continue attending class as though your life has not been converted into a public feed.
[00:10:40] Speaker A: Reporting about Kowalski's case says anonymous accounts published identifying details about her and her family. And that content connected to the campaign of accumulated enormous reach.
One account's material drew thousands of views within minutes, and the broader wave reached millions.
Separate reporting citing Wired, put the early total above 8.5 million views and more than 1,200 hashtag posts in a day.
Sue, as you know, my career as a special agent started in 1987.
During my career, I investigated things from narcotics trafficking to high technology theft up to counterterrorism.
Back then, personal information was not so readily available as it is now.
Simple precautions, like putting our homes in an anonymous trust and putting covers on our DMV records so they couldn't be accessed, was almost always all you needed. But nowadays, those simple steps are laughable. All anyone needs now is your first and last name and a possible city or state of residence and it's off to the races.
[00:11:58] Speaker B: Wow, Nick. Our world has definitely changed since then. But the numbers like 8.5 million views can flatten the human reality. Eight and a half million views. You is not a stadium. It is thousands of stadiums. But the person at the center still has one nervous system. One set of parents, one front door.
[00:12:21] Speaker A: Now add the coercive demand.
According to the reporting, an anonymous operator demanded payment while threatening continued dissemination.
That is the hinge when somebody says in substance, pay me or I will inflict reputational damage. Investigators recognize a familiar structure. Threat, demand, value, deadline, consequence.
[00:12:50] Speaker B: The Internet has trained us to use softer language. Drama, mess, tea, a pylon.
Those words make the conduct sound social rather than strategic.
[00:13:02] Speaker A: Exactly.
Language can downgrade a crime before anyone investigates it. If a masked person entered a business, took sensitive records and demanded payment to keep them private, nobody would call it drama.
Put the same threat in a direct message and suddenly everyone starts debating platform etiquette.
[00:13:24] Speaker B: The setting changes, the fear does not.
[00:13:26] Speaker A: The evidentiary logic doesn't change. Online, every step leaves something behind. The original file may carry metadata.
Uploads have timestamps. Platforms may retain registration details, Internet protocol, address logs, device identifiers, recovery emails, phone numbers and payment records. Posts reveal habits, word choice, waking hours, sports, loyalties and campus knowledge. Grudges and social connections. Followers overlap, handles migrate. Screenshots survive, deletion.
[00:14:05] Speaker B: But the network's greatest protection is not technical sophistication.
[00:14:09] Speaker A: No, it is social disbelief.
Operators survive because bystanders say that is probably just a troll, because friends treat reposting as observation rather than participation.
Because institutions split one coordinated attack into a hundred isolated incidents and then declare each incident too small to act on.
[00:14:32] Speaker B: That is how a mob hides in plain sight. Nobody claims ownership of the whole thing. Everybody only clicked once.
[00:14:40] Speaker A: In financial investigations, we call that compartmentalization. A money mule may say, I only opened the account. A recruiter says, I only sent the message. A processor says, I only moved the funds. Each person shrinks his role until the enterprise disappears. The investigator's job is to reconstruct the chain.
[00:15:01] Speaker B: And in this case, the chain ran through anonymous handles with ugly names, sports identities, and cultivated Personas. Accounts engineered to look unserious while doing serious harm.
[00:15:14] Speaker A: Never confuse juvenile branding with juvenile capability.
Some of the most damaging schemes I have seen were wrapped in jokes.
Humor gives participants plausible deniability.
We were trolling.
It was satire.
Nobody was supposed to take it literally.
But if the conduct is coordinated, targeted, and designed to extract value or forced behavior, the punchline becomes evidence.
[00:15:44] Speaker B: There is another feature common to extortion. Proof of power. The offender releases a sample to show the victim he can do worse, right?
[00:15:53] Speaker A: In ransomware, criminals encrypt a few files or leak a portion of stolen data in a reputational shakedown. The sample is a post, a screenshot, a family detail, a call to a parent. It says, we can reach you offline.
We can reach the people you love. We can keep widening the circle.
[00:16:15] Speaker B: Which means the threatened commodity is not simply privacy. It is belonging, college, friendships, family peace, future employment, the right to walk into a room without wondering who has seen what.
[00:16:31] Speaker A: That is why investigators must measure loss differently. There may be legal bills, security costs, counseling, missed tuition and reputation management expenses. But the coercive harm is also operational.
Lost time, interrupted education, compromised accounts, changed phone numbers, relocation and constant threat assessment.
[00:16:56] Speaker B: And there is no clean after. A bank can reverse some transactions. A platform cannot make millions of people
[00:17:02] Speaker A: unsee a name, which is why the first institutional response matters so much.
[00:17:07] Speaker B: In Kowalski's case, that response exposed the next layer of the problem.
Not anonymous attackers, but visible institutions that could see pieces of the harm and still failed to contain it.
[00:17:20] Speaker A: When a person reports digital coercion, the first response often determines whether evidence is preserved or lost.
A competent intake should. Should ask, what was posted? Who received demands? Which accounts participated? What timestamps exist?
Were threats made? Was identifying information exposed?
Did money change hands? Are there immediate safety concerns? Has the platform been sent a preservation request instead?
[00:17:51] Speaker B: Victims are frequently told to block the account.
[00:17:54] Speaker A: Blocking can reduce exposure. It is not an investigation.
[00:17:57] Speaker B: Or they are told to delete their profiles.
[00:18:00] Speaker A: Sometimes necessary for safety, but if done before capture, it can also erase context messages and links.
Good guidance balances protection with preservation.
[00:18:11] Speaker B: Or the most minimizing phrase of all. Stay off social media for a while, as if the victim caused the attack by remaining visible.
[00:18:20] Speaker A: Well, that institutional blind spot usually begins with jurisdiction. A university may say the conduct happened off campus.
Local police may see unknown offenders in other cities. A platform may say a post does not violate one narrow rule. Or it may process each Web address as a separate complaint. Everybody handles one fragment, nobody owns the
[00:18:46] Speaker B: pattern, and the family becomes the emergency operations center. Parents make spreadsheets, friends archive posts, lawyers draft notices, specialists search for copies. The people under attack perform the coordination that institutions should have provided.
[00:19:05] Speaker A: In a traditional financial fraud, a bank has a fraud desk, suspicious transactions can be frozen, account owners can receive provisional credits, and investigators can trace a wire.
In digital coercion, there is no universal incident commander. The university worries about policy.
Police worry about statutes and venue. Platforms worry about individual content decisions. Prosecutors worry about attribution.
Meanwhile, the campaign runs at network speed.
[00:19:38] Speaker B: Network speed versus committee speed. That is the central mismatch.
[00:19:42] Speaker A: Yes, an anonymous post can reach a million views, while an institution decides which office should open the email.
[00:19:49] Speaker B: The student is asked to document trauma with bureaucratic precision while experiencing it in real time.
Save every link, take every screenshot, record every call, remember every username, fill out another form, explain it again to another stranger.
[00:20:08] Speaker A: And repetition itself can become a burden. But from an evidentiary standpoint, chronology is vital.
Investigators need the first known possession, the first publication, the first demand, the first threat, the first doxing post, the first contact with family, and the first report to each institution.
[00:20:31] Speaker B: That creates a cruel paradox. The victim should not have to become an investigator. But without early preservation, the case may become harder to prove.
[00:20:41] Speaker A: Institutions can solve that paradox by standing up digital response teams. One intake, one case number, one preservation protocol, one liaison to platforms and law enforcement. Specific training on coercive control, doxing, impersonation and non consensual distribution.
Stop treating each malicious post as a separate customer service ticket.
[00:21:05] Speaker B: And stop treating reputational harm as cosmetic. Reputation is access.
It affects housing, employment, education, relationships and safety. When attackers flood search results with a target's name, they are not merely embarrassing her. They are attempting to rewrite the public record of who she is.
[00:21:30] Speaker A: That is is a form of control.
It is also why the family's financial burden can grow rapidly. Attorneys may need to issue preservation letters, seek emergency relief, identify defendants, serve subpoenas, challenge platform resistance, and file civil actions. Digital forensics professionals may need to authenticate captures and map accounts. Reputation firms may need to push accurate information into search results.
None of that is cheap.
[00:22:02] Speaker B: The offender creates the emergency for free. The victim pays market rates to survive it.
[00:22:07] Speaker A: And the platforms benefit from scale.
Outrage creates engagement. Engagement creates distribution.
The algorithm does not need to understand the content to amplify the conflict. It only sees velocity replies, reposts, searches, audio rooms and people returning to see what happened next.
[00:22:30] Speaker B: A human being experiences a crisis. The system experiences strong engagement.
[00:22:37] Speaker A: Platforms will rightly say they cannot pre screen every post, but that should not excuse slow action after credible notice, especially where coordinated harassment, identifying information, threats and demands are converging.
Pattern detection is what these companies do for advertising and fraud prevention.
They know how to map networks when the incentive exists.
[00:23:05] Speaker B: Universities also know how to move quickly when the institution's brand is threatened. They can send alerts, retain counsel, issue public statements, suspend access, and activate crisis communications.
The question is whether they recognize the student's safety and dignity as an institutional emergency before national attention arrives.
[00:23:29] Speaker A: Reporting indicates Kowalski withdrew from classes, returned home and pursued treatment after the online campaign.
It also reports that Gainesville police later charged three students in connection with alleged distribution, while Kowalski filed civil lawsuits against them.
[00:23:47] Speaker B: Later carries a lot of weight in that sentence. Later means after the posts, after the views, after the calls, after the family absorbed the first wave.
[00:23:58] Speaker A: To be fair, attribution takes time. Police cannot arrest a username. They need probable cause. Tying conduct to a person that requires records, witnesses, devices, admissions or corroborating digital evidence. But urgency and due process are not enemies. Agencies can preserve evidence, assess threats, coordinate jurisdictions, and communicate with victims while the attribution work proceeds.
[00:24:28] Speaker B: Silence is not neutrality. When officials say nothing, the attackers fill the information vacuum. They portray inaction as proof that are untouchable.
[00:24:38] Speaker A: An impunity is contagious. The first account posts because it expects no consequence. The 20th account reposts because 19 others appeared to get away with it.
[00:24:49] Speaker B: So how do you reverse that contagion?
[00:24:51] Speaker A: You make consequences visible. You turn aliases into subjects, posts into exhibits, and timelines into affidavits.
[00:24:59] Speaker B: That is where the story changes. Not because the harm disappears, but because the direction of scrutiny reverses every counter.
[00:25:06] Speaker A: Investigation begins by replacing panic with Structure
[00:25:10] Speaker B: not because the fear is irrational, because
[00:25:13] Speaker A: structure is how investigators keep fear from controlling the case. You build a master chronology.
You preserve original files.
You record exact handles and profile web addresses.
You distinguish firsthand messages from reposts. You identify witnesses.
You document every demand and every transfer of value.
You keep untouched copies and working copies. You create a chain of custody in ordinary language.
[00:25:44] Speaker B: You stop letting the attackers define reality exactly.
[00:25:48] Speaker A: Their reality is chaotic by design. Our answer is a timeline.
[00:25:52] Speaker B: The Kowalski family's response, as described in the reporting, was relentless.
Police affidavits, digital evidence, lawyers, subpoenas, and public exposure began doing what the Burniverse presumed could not be connecting Personas to people.
[00:26:10] Speaker A: Let's slow that down. A subpoena can require a platform to turn over records connected to an account, its registration, email, phone number, login history, Internet protocol addresses, device information, and account changes. One record may not identify the operator.
An Internet protocol address could lead to a house, a dorm, a workplace, or a mobile carrier. The recovery email may be disposable. The phone number may be prepaid. But each record gives investigators another place to look.
[00:26:47] Speaker B: So one record opens the next door, right?
[00:26:50] Speaker A: And this is where investigators start connecting records. Maybe the account logs in through a campus network. Maybe a phone number leads to a billing record.
A recovery email might repeat a username used somewhere else. The same device identifier may appear across several accounts. A posting time may line up with a witness placing a suspect at a particular location.
Or a private message may reveal something only a small group knew. You don't need one cinematic clue. You need separate pieces that keep pointing to the same person.
[00:27:25] Speaker B: The online Persona says, you do not know me. The evidence says you logged in from here using this device after receiving this file. While talking to these people.
[00:27:38] Speaker A: And behavioral evidence matters, people reuse phrases, misspellings, punctuation, jokes, and posting rhythms. They follow the same teams. They complain about the same coaches. They reveal class schedules and travel days. They switch between a burner account and a personal account too quickly. They upload a screenshot that contains a notification, a battery level, a contact name, or a unique crop. Tiny acts of carelessness more often acts of arrogance.
Pseudonymity creates confidence, and confidence produces repetition. Repetition produces pattern. Pattern supports attribution.
[00:28:18] Speaker B: The burnerverse also relies on social trust. Someone has to send the file. Someone has to know who is in the group chat. Someone knows which person controls which account.
[00:28:30] Speaker A: That is the human vulnerability.
Digital crews fracture for the same reasons financial crews do. Self preservation grudges, fear, immunity and blame.
The mythology says everyone is loyal. The interview room says otherwise.
[00:28:50] Speaker B: And once one identity becomes public, the rest of the network starts looking different. Followers become associates, old jokes become admissions, deleted posts become consciousness of guilt or, at minimum, evidence someone knew the content had become dangerous.
[00:29:09] Speaker A: We have to be precise. Deletion alone does not prove guilt.
Following an account does not prove participation.
Being named in a lawsuit is not a conviction. Investigators distinguish connection from culpability.
The question is who possessed, who published, who demanded, who threatened, who amplified with knowledge and what evidence supports each act.
[00:29:38] Speaker B: That precision is also a form of respect.
Accountability is not another mob. It should be evidence driven, individualized and subject to challenge.
[00:29:49] Speaker A: Public reporting identifies former University of Florida baseball player Jacob Gomberg among those facing allegations.
The Indiana Daily Student reported that Gomberg was charged in Alachua county with stalking involving sexual cyber harassment, that a separate federal civil complaint alleged publication through pseudonymous burner accounts and that he declined comment through an attorney. The allegations remain unproved as unless established in court.
[00:30:22] Speaker B: Reporting also indicates that other individuals face charges, including an alleged offense involving financial gain. A Sept. 17 report stated that Gainesville police charged Cameron Ahmed and Brendan Pitfield with misdemeanor sexual cyber harassment and that Ahmed faced an additional third degree felony allegation tied to financial gain.
Again, allegations, not convictions.
[00:30:50] Speaker A: This is where the extortion analysis becomes more than metaphor.
Financial gain is a legal and investigative hinge. If an operator demands money in return for suppressing material, payment records can become some of the cleanest evidence in the case.
Cash apps, bank transfers, cryptocurrency addresses, account verification records, device logins all create trails.
[00:31:18] Speaker B: The burner account may be nameless. The payment processor is less romantic.
[00:31:22] Speaker A: Exactly. Criminals think the Internet is one system. It is actually many systems stitched together, each keeping different records. The platform knows logins. The carrier knows subscriber data. The bank knows the destination account.
The device knows application activity. The school knows network access.
A good investigator does not ask one database to solve the case.
He makes the databases corroborate one another,
[00:31:53] Speaker B: and public exposure changes the power balance. An anonymous handle can ridicule a named victim with little personal cost.
Once reporting links alleged operators to real world identities, the asymmetry narrows. Schools must answer questions. Teams must review conduct. Employers can see the allegations. Courts can compel responses.
[00:32:19] Speaker A: Indiana University said it referred the allegations involving Gomberg to its Office of Civil Rights Compliance to gather information and assess next steps.
That does not determine guilt.
It does demonstrate that an online Persona can collide with real institutional processes.
[00:32:39] Speaker B: The future the Burnerverse threatened to destroy belonged to only one person until accountability made the accused confront their own futures.
[00:32:50] Speaker A: Civil litigation adds another track.
Criminal cases ask whether the government can prove charged offenses beyond a reasonable doubt.
Civil suits can seek damages and discovery under a different standard. Depositions, interrogatories, document requests and third party subpoenas can surface communications that criminal investigators may also find significant, subject to legal rules.
[00:33:21] Speaker B: Public reporting, says Kowalski, filed more multiple federal civil complaints arising from the alleged distribution.
One report described three federal cases and alleged use of pseudonymous accounts to publish material alongside identifying information.
[00:33:41] Speaker A: A civil complaint is one side's allegation. It is not a judicial finding, but filing it creates a formal venue where claims must be answered and evidence can be tested.
[00:33:52] Speaker B: It also creates a counter narrative not look what happened to her, but look what was allegedly done, how it spread, and who may be responsible.
[00:34:03] Speaker A: That shift matters. In investigations, offenders often frame the victim as the event.
The proper frame is the conduct.
Who created or obtained the material?
Who distributed it, who attached a name?
Who exposed family information?
Who demanded value?
Who continued after notice, the subject of
[00:34:28] Speaker B: the story becomes agency, not spectacle.
[00:34:30] Speaker A: There's a practical lesson here for anyone caught in a coordinated, anonymous campaign.
First, protect your physical safety. If the threat is immediate, contact emergency services.
Second, do not negotiate alone. Bring in a lawyer or trusted advocate. Third, when it is safe, preserve the evidence before you block the account.
Full screen captures, web addresses, timestamps, message headers, payment requests and account identifiers. Fourth, report the pattern, not only the individual posts.
Fifth, ask for evidence to be preserved quickly because platform retention periods vary. And sixth, do not guess publicly about who is behind the account.
A wrong accusation can harm an innocent person and damage the investigation.
[00:35:24] Speaker B: And seventh, tell somebody. Shame is the offender's preferred encryption. Isolation keeps the victim manageable.
[00:35:31] Speaker A: Well said.
[00:35:32] Speaker B: There is also a lesson for bystanders. Do not repost two to condemn. Do not forward the material for awareness. Do not enter the group chat to see what everyone is talking about. Save only what is necessary to report. Then send it to the proper channel. Your curiosity can become distribution, and if
[00:35:53] Speaker A: you possess relevant evidence, preserve it. Do not edit, crop, annotate, or run it through multiple apps.
Record how you received it. Speak to investigators or counsel.
Digital cases die when everyone assumes someone else kept the original.
[00:36:11] Speaker B: What pierced the veil here was not one superhero hacker. It was persistence across systems, a victim who would not disappear, a family that kept records, journalists who mapped the culture, lawyers who forced disclosure, and investigators who reduced anonymous bravado to evidence.
[00:36:32] Speaker A: The bulletproof handle was never bulletproof. It was simply untested and once tested,
[00:36:39] Speaker B: the mystique began to collapse. Nick One of our goals with this episode is not to rehash all the investigative details surrounding this case. Rather, we want to give victims and families something the Internet rarely gives them in the first hours a route map.
[00:36:55] Speaker A: First Question where do you report if anyone faces immediate physical danger? Call 911 or local police for stalking, repeated threats, doxing tied to safety, or a course of conduct causing fear? Make a local police report and ask for the incident or case number. The Justice Department directs stalking victims to local police and points them to the numerous resources that are available online, including our very own main website of stampoutscams.org we have a whole webpage devoted to where to report these type of crimes.
[00:37:32] Speaker B: Reporting locally does two things. It creates an independent record and it helps officers see escalation over time.
[00:37:40] Speaker A: Justice Department guidance notes that police reports can support a threat assessment and may help with a protection order application or proof that an existing order was violated.
If the first officer treats each post as an isolated incident, respectfully ask that the report describe the full pattern account names, dates, threats, demands, exposed addresses, contact with relatives, and prior reports for cyber
[00:38:15] Speaker B: enabled extortion, account compromise, impersonation or online fraud. You can also file a report with the Internet Crime Complaint center, which is run by the Federal Bureau of Investigation.
You do not have to know exactly which law may have been broken before you report.
The center serves as the federal hub for cyber enabled crime complaints and uses those reports to identify broader patterns.
Although not every person who files will receive an individual response, a report to
[00:38:51] Speaker A: the Internet Crime Complaint center should include the platform, exact username, links to the profile and posts, dates and times, methods of contact, demands, payment instructions, destination accounts or wallets, and a short chronology.
The Federal Government Bureau of Investigation advises victims to include the scammer or company name, contact methods, dates, payment method, destination of funds, and a thorough account of what happened and to report as soon as possible.
[00:39:25] Speaker B: Also report the account and every offending post through the platform's own safety tools.
Save the report, confirmation, ticket number and any response. If the victim is connected to a school, workplace, athletic program or professional association, report through that institution's safety conduct, civil rights or security channel. 2.
[00:39:51] Speaker A: Multiple reports are not duplication when they serve different functions, Police assess crimes and safety. The Internet Crime Complaint center analyzes cyber patterns and federal leads.
Platforms control accounts and content.
Schools and employers control access and conduct within their communities.
Sue When I was with the Treasury Department, each agent had a specific day that they had to remain in the office to answer incoming calls for the public to report potential crimes or relay information to a suspected illegal activity. It's Call Duty Agent Day.
I can't tell you how many times I answered a call on my assigned Duty Agent Day of someone passing along information, then asking me how long it would take for us to start investigating.
Unfortunately, in the real world, it doesn't work like that.
[00:40:48] Speaker B: Good point, Nick, because many people falsely believe that as soon as they report a cross crime, law enforcement is rolling out with lights and sirens to investigate. Just doesn't work like that. But reporting definitely matters. Even if no arrest comes tomorrow, your report may be the first dot. Someone else's report may be the second.
A dozen complaints with the same handle payment, account recovery, email, or phrasing can turn random traffic trolling into a recognizable operation.
[00:41:23] Speaker A: Next question what should a victim preserve?
[00:41:26] Speaker B: Not everything forever, just preserved.
[00:41:28] Speaker A: Deliberately capture full screens showing the username, web address, date, time, and surrounding context. Save original emails with headers when possible.
Export direct messages if the platform permits it. Keep voicemails, payment requests, transaction records, account security alerts, login notices, and platform report receipts. Write a daily incident log. Keep originals untouched and make copies for review.
[00:41:59] Speaker B: Ask a trusted person to help. Evidence collection can force a victim to repeatedly look at material that is distressing. A lawyer, advocate, investigator, or family member can manage the archive so the victim does not have to live inside it.
[00:42:17] Speaker A: Do not crop or annotate the only copy.
Do not forward sensitive material through multiple accounts. Do not install questionable recovery software on the device and do not publicly accuse a suspected operator before counsel or investigators evaluate the evidence.
[00:42:35] Speaker B: Now the question everyone asks can digital data be deleted?
[00:42:39] Speaker A: Sometimes, but usually not everywhere. A copy may be removed from one account, device, search result, or platform, and that still matters. But anyone promising to delete something from the entire Internet is making a promise they probably cannot keep.
Copies may remain in backups, caches, archives, screenshots, recipient devices, reposts, platform logs, or forensic remnants.
Even after material disappears from public view, related records may remain for a limited time.
[00:43:16] Speaker B: And what if the image is fake? Something fabricated with artificial intelligence rather than an authentic photograph?
[00:43:23] Speaker A: The response is much the same, because a fabricated image can cause very real harm. Preserve a copy before requesting removal, when it is safe to do so. Capture the account name, web address, date, time surrounding post messages, and any statement suggesting how the image was created or altered.
Keep the original downloaded file untouched. If possible. Also preserve a known authentic photograph that may have been used to generate the fake. But do not circular either image more widely.
[00:44:01] Speaker B: Can a specialist prove that it was generated or manipulated.
[00:44:05] Speaker A: Sometimes a qualified digital forensics examiner can identify inconsistencies, file history editing traces, source images or account records that support that conclusion.
But there is no universal test that can identify every artificially generated image with certainty.
Detection tools can be useful leads. They should not be treated as courtroom proof by themselves. Removal firms, platform safety teams, search engine services, lawyers and reputation management specialists may be able to reduce visibility by reporting the image, seeking removal, requesting that search engines stop displaying it, and monitoring for reposts. Hash matching tools can also help participating platforms detect exact or closely matching copies, although heavily altered or newly generated versions may evade a match.
The honest promise is reduction and containment, not guaranteed. Erasure from every device, private message or website.
Now I know I can sometimes spew tech. Turns out, like everybody in the world knows what I'm talking about.
I apologize. That is a carryover practice from my days investigating high tech crimes in Silicon Valley.
One such tech term is hash, so a quick explanation is in order.
Hash is a process that takes any piece of data like a password, a file or text and and scrambles it into a fixed length string of letters and numbers.
[00:45:46] Speaker B: Thanks for the explanation, Nick. Must have been cued by my puzzled look after you said hash. So the realistic goal is remove what is visible, reduce rediscovery, interrupt reposting, preserve evidence, and monitor for recurrence for qualifying
[00:46:04] Speaker A: adults who still possess the source file. StopNCII.org creates a digital fingerprint on the user's device and shares only that hash with participating companies so matching copies can be detected and removed. It is a prevention and removal tool, not a promise that every copy everywhere will vanish.
[00:46:25] Speaker B: Victims in the United States can also contact the Cyber Civil Rights Initiative's free 24 hour image abuse helpline at 8448.
Its safety center walks victims through personal safety documentation, removal requests, legal rights, and finding help. The guide begins with safety, then moves
[00:46:50] Speaker A: through documentation and removal for confidential emotional support and local referrals. The Rape, Abuse and Incest National Network's National Sexual Assault Hotline is available around the clock at 800-656-HOPE by chat or by texting HOPE to 64673.
The Justice Department also lists national hotlines and state by state victim service providers.
[00:47:18] Speaker B: Do specialist companies exist?
[00:47:20] Speaker A: Yes, but victims should understand what these companies actually do. A digital forensics firm can preserve phones and computers, cloud accounts, email, social media evidence and metadata while documenting who handled the evidence and when.
Some firms can recover deleted artifacts, reconstruct timelines, authenticate screenshots, and prepare expert reports.
Federal cybersecurity Workforce Guidance describes this work as the analysis of digital evidence with an emphasis on preservation, admissibility, and chain of custody.
[00:48:00] Speaker B: An incident response or cybersecurity firm can secure compromised accounts and devices. An e discovery provider can collect large volumes of cloud and message data for litigation.
A licensed investigator may map accounts and open source connections.
A reputation management or removal service may send platform requests, de index search results, and monitor reappearances.
[00:48:30] Speaker A: But no reputable company can honestly promise to erase every copy, guarantee identification, guarantee an arrest, or guarantee recovery of money.
Be especially wary of anyone demanding cryptocurrency, claiming to work with the Federal Bureau of Investigation or promising secret access to the Internet Crime Complaint Center. The center warns that it does not partner with law firms or cryptocurrency services to recover funds and will not contact victims asking for money.
[00:49:07] Speaker B: Before hiring, ask who will perform the work, what certifications or licenses apply, whether the methods are forensically defensible, how evidence will be stored, what the written scope and total cost are, whether the firm carries insurance and whether it has testified in court.
Have counsel review the engagement. When litigation is possible, a strong provider
[00:49:34] Speaker A: should separate three what it can preserve, what it can investigate, and what it can ask platforms to remove.
Those are different services with different limits
[00:49:46] Speaker B: and a final warning. Removal comes after preservation. When safety allows, a clean search result is helpful. A clean search result without evidence may make accountability harder.
[00:49:59] Speaker A: The sequence is simple. Get safe, preserve report secure accounts, request removal, and bring in qualified help.
Not every victim will use every route, but nobody should be told there is no route at all.
[00:50:17] Speaker B: The Internet often asks the wrong question after a targeted campaign.
It asks why the victim had an account, why she trusted someone, why she did not leave sooner, why she looked, why she answered, why she could not simply ignore millions of strangers saying her name.
[00:50:36] Speaker A: Investigators should ask different who initiated the conduct, who had access, who coordinated, who profited, who threatened, who amplified after knowing the material was unauthorized? Which institution had notice? What did it preserve? What did it fail to do do?
[00:50:58] Speaker B: Accountability begins when attention moves from the exposed person to the exposing system.
[00:51:03] Speaker A: And the burnerverse is a system even when it lacks a formal leader. It has norms, it has status, it has initiation rituals, it rewards access and cruelty. It has distribution channels, trusted nodes, and repeat operators. It teaches new participants that anonymity is immunity.
[00:51:24] Speaker B: But immunity is another word for a consequence that has not arrived yet.
[00:51:28] Speaker A: What makes modern digital extortion dangerous is its low barrier to entry.
You do not need to write malware. You need a private item, a target's name, a platform account and an audience conditioned to reward humiliation.
The tools are ordinary.
The harm is industrial.
[00:51:50] Speaker B: The same tools can also support accountability.
Screenshots establish the chronology.
Metadata helps authenticate evidence.
Subpoenas identify infrastructure.
Civil discovery exposes communications, and responsible reporting connects isolated incidents into a recognizable pattern.
[00:52:12] Speaker A: And law enforcement needs to catch up to that pattern. Agencies should train officers to identify coercion embedded in online harassment. Prosecutors should analyze extortion, stalking, identity exposure, unauthorized access, witness intimidation, and financial gain theories where the facts support them.
Universities should treat coordinated digital attacks as safety incidents, not reputation inconveniences.
Platforms should preserve evidence promptly and detect networks, not just individual posts.
[00:52:48] Speaker B: None of those reforms restores what a victim lost. Justice is not an undo button.
[00:52:54] Speaker A: No, but consequences can interrupt the next attack.
They can tell the next operator that a handle is not a safe house. They can tell the next victim that the chaos has a structure, and structures can be investigated.
[00:53:09] Speaker B: Maddie Kowalski's public fight matters. Because she refused the role assigned to her, a network tried to reduce her to a search term. She became a witness against the network.
[00:53:21] Speaker A: The case also reminds us to resist easy certainty.
Criminal charges are allegations.
Civil complaints are claims. Courts determine liability and guilt.
Responsible accountability is patient enough to make distinctions and forceful enough not to hide behind them.
[00:53:39] Speaker B: Empathy and rigor belong together. We can protect a victim's dignity, avoid repeating abusive material and still examine the machinery with precision.
[00:53:51] Speaker A: In fact, that is the only useful way to examine it.
[00:53:54] Speaker B: So here is the broader anonymous cruelty thrives on three attention, isolation, and delay. Attention turns harm into currency.
Isolation silences the target.
Delay gives evidence time to disappear.
[00:54:11] Speaker A: The countermeasures are equally clear. Deny gratuitous amplification, surround the victim, preserve the record, and move across jurisdictions before the network can reorganize.
[00:54:23] Speaker B: If you are listening because something like this is happening to you, the shame is not yours. The existence of a post does not make its claims true. The size of the crowd does not make the crowd right. Ask for help. Preserve what you safely can. Bring in people who can carry part of the load.
[00:54:43] Speaker A: If you are in law enforcement, do not dismiss the first report because the suspect is is a username. The username is a lead. Treat the account like a vehicle fleeing a scene. Record the description, preserve the camera footage, trace the registration, identify the occupants.
[00:55:02] Speaker B: If you run a university, remember that off campus no longer means outside your community.
A phone in a dorm room can launch an attack across state lines. The student still walks into your classroom the next morning.
[00:55:16] Speaker A: If you operate a platform, stop confusing scale with helplessness. The network is visible to you in ways it is not visible to any victim. Use that vantage point.
[00:55:26] Speaker B: And if you are tempted to join the pylon because everybody else is laughing, remember, the crowd does not absorb your responsibility. It distributes the damage.
[00:55:37] Speaker A: Cowards behind screens leave footprints because operating requires contact with the real world.
A device, a network, a payment account, a friend, a mistake, a boast, a login.
There is always a seam.
[00:55:53] Speaker B: The work is finding it before another life is pulled apart.
[00:55:56] Speaker A: For behind the scams in the SOS Media Network, I'm Nick.
[00:55:59] Speaker B: And I'm Sue. Take care of one another and do not mistake anonymity for innocence.
[00:56:04] Speaker A: We'll see you next time. Bye for now.
