Policy —

“Revenge porn” operator arrested, charged with ID theft

Site's owner told the cops: "I know... people are getting screwed over."

“Revenge porn” operator arrested, charged with ID theft

Websites that post nude pictures of adults without their permission, commonly known as "revenge porn" sites, have recently drawn public scorn and a few lawsuits.

Now, the owner of one revenge porn website is facing prison. Kevin Bollaert, a 27-year-old San Diego resident, was arrested today for running a website called ugotposted.com and has been charged with 31 counts of identity theft, extortion, and conspiracy. The suspect is being held in jail on $50,000 bail.

"This website published intimate photos of unsuspecting victims and turned their public humiliation and betrayal into a commodity with the potential to devastate lives,” said California Attorney General Kamala Harris in a statement about today's arrest. “Online predators that profit from the extortion of private photos will be investigated and prosecuted for this reprehensible and illegal internet activity."

Bollaert allegedly followed a business model similar to a now-defunct site run out of Colorado called IsAnybodyDown. According to court documents, he created ugotposted a year ago, inviting anyone to post nude pictures of others. Bollaert required that along with the photo, identifying information was posted, including a full name, location, age, and Facebook link.

Then, Bollaert refused to take the posts down—unless the pictured victims paid up. When he got e-mails complaining about the practice, users would be directed to a separate website, called changemyreputation.com. Then they would be asked to pay a fee, between $300 and $350, in order to get their pics down.

In addition to those fees, Bollaert collected about $900 per month in advertising revenue. In all, Bollaert is said to have made more than $10,000 from the scheme.

"These pictures need to come down! Please!"

The practice of posting involuntary nude pictures is called "revenge porn" because such pictures are often published by jilted ex-lovers. However, that's not always the case; some people featured on revenge porn sites report that they're victims of hacking attacks, as some victims of ugotposted.com did.

Sites like ugotposted often try to hide behind Section 230 of the Communications Decency Act, which prevents many types of lawsuits against sites that host content posted by their users.

It appears that was Bollaert's strategy, since he didn't post the pictures himself, instead inviting others to do so. However, authorities say he ran afoul of state laws against identity theft, which prevent even simple personal information like names and addresses from being used "for any unlawful purpose, including with the intent to annoy or harass."

Evidence of the harassing effect was published in the state's complaint against Bollaert. One woman e-mailed Bollaert saying she started getting "nonstop harassing messages" after her photos went up on ugotposted. Another told him she was "scared for my life," continuing: "People are calling my work place and they obtained the information from this site! I did not give permission for anyone to put up those pictures or my personal information. I have contacted the police but these pictures need to come down! Please!"

One Jane Doe victim reported receiving dozens of Facebook and Instagram friend requests after she was featured on the site, as well as text messages with lewd photos and several phone calls, which made her "worried for her safety." Another woman had "over a hundred different sources" try to contact her after her information went up on ugotposted, and she ultimately changed her phone number.

Bollaert: "I know a lot of people are getting screwed over"

The webpage is down today, but the police warrant describes how it worked. Tabs on the top of the webpage included "Girls, Guys, Videos, Members, Replies," and finally "Post Nudes."  Once uploaded, pictures were watermarked and then organized by state and gender.

In August, police got a search warrant related to the e-mail account ugotposted@gmail.com, as well as account information from CloudFlare, which served the site. A separate search warrant requested all records relating to the posting of one victim, Jane Doe #6.

Weeks later, a state lawyer sent notice to Bollaert at multiple e-mail addresses, including kevinbollaert@gmail.com, yougotposted@gmail.com, and ugotposted.contact@yahoo.com, as well as posting on the site.

Not long after, Bollaert called the lawyer. The lawyer wrote:

I requested to set up a meeting with him regarding UGOTPOSTED and the records pertaining to the website. I told Bollaert I had to confirm who the site owner was. I also stated that in the current investigation, I would have to subpoena Bollaert as to the records. When I asked for an email or phone number, Bollaert responded that he is "staying off the grid" and none was provided.

The following week, Bollaert agreed to be interviewed, after state lawyers told him he was not under arrest. He told the state lawyer that he had started the site along with his friend Eric Chanson, who wasn't involved any longer.

Bollaert was amazingly candid in the September interview. He mentioned that he got about a hundred e-mails each day asking for photos to be removed and made $800 to $900 a month from the ads.

"At the beginning, it was fun and entertaining, but now it's just like, ruining my life," Bollaert said. "I realize, like, this is not a good situation. I feel bad about the whole thing and like I just don't want to do it anymore. I mean I know a lot of people are getting screwed over on a site like this."

Lawyers served the search warrants and took his Mac Air, two HP laptops, and iPad.

From PayPal to Amazon gift cards

Warrants in hand, investigators began trawling through Bollaert's archives. More than 2,000 e-mails had been sent to yougotposted@gmail.com, and 1,040 of them had the word "remove" in them. Unsurprisingly, they ooze with vitriol at the site's owner.

"Take my pictures DOWN," read the subject line in one e-mail, from a woman named Melinda. She continued: "It makes me sick to my stomach you run this as your little family business... because of this site, my phone has been going off EVERY 2 MINUTES with strange men sending inappropriate things to me... I don't know what gets you off about ruining people's lives, but I was under aged in the photos you posted of me so yes, you are showing child pornography."

Another e-mail had simply "!!!!!!" as the subject line, and read:

I was completely UNAWARE that my photos were posted... As a mother and someone who's trying to go out and look for a job. I don't appreciate you allowing someone with no life, to go and ruin someone that's tryig [sic] to do something with their life. I would like them immediately taken down as well as the email address that posted them as I wish to take this person to court for doing this. Sincerely Kaitly Please get back to me."

Police also found e-mail records showing payments to a PayPal account controlled by Eric Chanson. Payments to the PayPal account continued from January, a month after the site was created, until May, when PayPal limited access to the account, for reasons not spelled out in court documents.

But the PayPal shutdown didn't convince Bollaert to stop. "At that point, BOLLAERT instructed victims to send him $250.00 in Amazon gift cards," states the warrant.

The arrest comes following a six-month investigation by the state attorney general's office. The office is encouraging anyone who feels they were a victim of ugotposted or another revenge porn site to file a complaint against the site with the AG's office.

One of the statutes under which Bollaert was charged was just amended two months ago, when California governor Jerry Brown signed a bill that makes revenge porn a crime. That bill changed the law so that publishing nude photos with the intent of causing "substantial emotional distress or humiliation" would be punishable by fines and jail time.

However, the charges against Bollaert would stand even without that change, since he is alleged to have published personal information for the means of "harassment," which was already illegal.

Channel Ars Technica