Internet safety/ security help

My daughter is an online blogger, and has a pretty big internet presence.

Recently, she's been receiving threatening emails. Not your normal online whining and negativity. Specific targets. They identify her by name, know her physical address, call her foul names, and threaten her bodily harm. Clear threats designed to make her fearful. They have gotten to the point where she is afraid to be home alone (she works from home), and her husband is concerned for her physical safety.

All of them come from multiple Gmail addresses, with random names. The Gmail accounts were opened with names of people she knows, apparently lifted from her Facebook account. So, it's someone who has (or had) access to her Facebook page.

Some of the threats have also come through her website. Her host can identify the location of the originator on a map, and most of the threats pin the map in the same block in Atlanta.

She has contacted the police, but APD will not respond until there is an actual physical event.

She has also has contacted Gmail. Gmail says she should contact the police.

There is an individual she knows who is just mean enough and conniving enough to do something like this, simply because she is a hateful (and perhaps unstable) person. Let's call her Cruella. Cruella works in the block that the website host has pinned on the map.

So, we actually think we may know who this is, but can't act. And Cruella is not going away- she's in the family. And the police won't act either. If we could catch her red-handed, she MIGHT be forced to get the help she needs (which would be good), but it is unlikely. She is extremely manipulative, and has bulwarked herself in, surrounded by a circle of friends and family who think she is innocent, and my daughter is the problem. Her family will never encourage her to seek help, and will always enable her.

Of course, it might not be Cruella.

So, what would you do? I'm asking because you guys as a group are just smart enough and just sneaky enough that you may have a few ideas outside of the normal channels.

Obviously, I'd like to catch the person in the act before it escalates to something bad. If it means prison, or rehab, or medicine, so be it. I'd like a method to trace enough good info that authorities would have to respond before there is physical harm.

Suggestions?

Sweep the leg....

or

Buy a gun, dont feed the troll.

OK the best news is that if your daughter's spilling all the private info this person has on Facebook, it could be anyone, which means it's more likely just yet another idle Internet threat (and not some creepy IRL stalker who also uses the Internet).

Now the bad news is that positively identifying her without doing anything illegal will be quite tricky. The best bet might be to use some kind of "supercookie"-like browser privacy exploit. If you can identify where she's visiting from you can probably also identify which browser she's using, those details would be very helpful in crafting something to pin her identity down with.

Sounds like you need a hacker on your side. I mean in the movies its easy, right?

Not helpful, I know.

Can you respond to the emails, saying something like, " Leave me alone, Cruella!"? If its not her, no harm, but if it is, you might get a clue in a response...

Or, you and all your internet friend can bombard her with unpleasantries. I mean hundreds of them. Put her on a gay porn mailing list, report her as a jihadist. Possibilities are endless. Would not directly help your kid, but might slow Cruella down a bit. I'm really not this nasty, but mess with my kids?

In reply to GameboyRMH:

I was hoping you'd check in.

My daughter is not spilling any info about Cruella anywhere.

Whoever opened the Gmail accounts used names of people my daughter knows, which were probably lifted from her Facebook account.

This isn't a computer/internet/security issue. You know who it is. This is a private "chat". Chat is in quotes for a reason.

In reply to cwh:

Keep in mind, Cruella is a nasty person (and she has been banned from Facebook, etc, multiple times), but we are NOT certain these emails are from her.

It's the kind of thing she might do, and some of them originated on the block Cruella works on, but we do not know she did it.

I kind of hope it is Cruella. She's a family problem we will have to continue to deal with. If it's not her, it's far creepier and scarier. But I am not ready to trash her.

SVreX wrote: In reply to GameboyRMH: I was hoping you'd check in. My daughter is not spilling any info about Cruella anywhere. Whoever opened the Gmail accounts used names of people my daughter knows, which were probably lifted from her Facebook account.

I mean if your daughter is spilling the private info about herself (which Cruella/the harasser is using - friend's names etc) on Facebook, then anyone could easily find it for casual long-distance harrassment.

In reply to Huckleberry:

No, we DO NOT know who it is. We suspect it COULD be her.

Sorry if I worded it badly.

GameboyRMH wrote:

SVreX wrote: In reply to GameboyRMH: I was hoping you'd check in. My daughter is not spilling any info about Cruella anywhere. Whoever opened the Gmail accounts used names of people my daughter knows, which were probably lifted from her Facebook account.

I mean if your daughter is spilling the private info about *herself* (which Cruella is using - friend's names etc) on Facebook, then anyone could easily find it for casual long-distance harrassment.

Got it.

I don't think that is the case either. She uses her privacy settings pretty carefully.

I think that means it is someone who is inside her circle of friends, or once was. (She has an enormous circle of friends, from all over the world).

I may be talking out my rear, because I don't even have a Facebook account, and can't say I know how their security settings actually work.

SVreX wrote: In reply to Huckleberry: No, we DO NOT know who it is. We suspect it COULD be her. Sorry if I worded it badly.

OK, so the game is to lay a trap. Something as simple as spamming one of those email addresses using her real name along with the email from saaaay "Dildos are Us" and an "unsubscribe" button. Make sure the link sends you her browser info/user/etc. That is as good as an admission.

There are other things you can do with things embedded in an email and/or given the IP address from the host but I have a friend who found himself in quite a bit of trouble with the authorities in NJ for hacking into his business partner's computer systems. You have to not get caught.

Frankly, I'm surprised that the authorities would not investigate a death threat coming from a local IP address. Perhaps call the Attorney General's office or the FBI.

Just an FYI, depending on the privacy settings your daughter has setup on her FB profile, it may be possible for people outside of her circle of friends to get the names of her FB friends. It's even possible to do it without a FB account period if her settings are lax.

If she's got her privacy settings maxed, and the friends list is still being abused, then we can assume that it's someone with direct access, or a very shifty hacker type.

In reply to STM317:

That's good to know.

Huckleberry wrote: Frankly, I'm surprised that the authorities would not investigate a death threat coming from a local IP address. Perhaps call the Attorney General's office or the FBI.

I didn't say it was a death threat- yet.

Atlanta is so overloaded that they have guidelines just to cut the work load. My daughter was arrested, shackled and jailed a few years ago because she called 911. SOP in a domestic disturbance- arrest everyone and let the courts sort it out. She had zero priors- not even a traffic violation.

APD sucks.

In reply to SVreX:

You've pinned it down to the block Cruella works on. Presuming she isn't self-employed, I imagine her IT/HR department would be thrilled to find out this was occurring on work systems and/or time. The question is would possible termination from her job quell the issue or only fuel the flames?

An easy way to get that sort of stuff to stop while appearing unrelated is for your daughter to not respond to those emails, then get a firearm and blog about the process. I know someone who has used that tactic, and the perp in that case backed off immediately. Something about speaking softly and carrying a large stick.

In reply to petegossett:

Well, I think you are on to something. Earlier today, I suggested to my SiL going directly to her employer, and telling them threatening emails were being sent from their computers, and asking their IT department's assistance in the matter.

I think most companies would rather deal with it in-house than have it elevate to a criminal investigation that involved their company servers.

I have no idea whether the possibility of termination would calm things down or fan the flames.

In reply to SVreX:

Probably fan them, although it's worth a shot if you can remain more or less anonymous.

In reply to SVreX:

One thing about that - you'd have to at least try to prove that the emails were sent from an IP address used by said employer at that point in time. The IP-to-location mapping isn't quite as reliable as people think it is, plus not everybody has a fixed IP address.

Doesn't mean that you're not onto something, just means that some more digging is required.

I know squat about computers, but make a friend over at pirate 4x4. Those guys tracked down a troll in no time and harassed the hell out of him.

SVreX wrote: Some of the threats have also come through her website. Her host can identify the location of the originator on a map, and most of the threats pin the map in the same block in Atlanta.

First off, I'm sorry you are all going through this. That's a horrible situation, and I am afraid it will only become more common until better tools are made to combat it. (And, mental health care is improved .. not holding my breath there.)

Do you have the IP addresses of the messages sent from her website? Because rather than worrying about the location, worry about who owns / controls those IP addresses. What you want to do is a "reverse DNS" lookup on those IP addresses. If those IP addresses correspond to Cruella's employer then you have a pretty clear smoking gun. If her employer is smaller they may not have a block of IPs that they own but might rather be assigned random (dynamic) IPs from their provider. I know there's a legal procedure for finding out who those dynamic IPs were assigned to in a given time frame but I don't know the actual procedure.

Here's one reverse DNS: https://remote.12dt.com/

I missed this thread earlier, sorry for that. If the Atlanta PD were less than helpful (not really a surprise) I'd suggest a call to the Georgia Bureau of Investigations. They should take internet threats more seriously and have the tools to deal with it appropriately. If not, then a call to the FBI, and so on until you get satisfaction. But there have been enough cases of these things goings sideways when law enforcement failed to get involved that they should be motivated to take it seriously.

Thank you guys for your help and your concerns in this matter.

Unfortunately, there has been no real progress. They've gotten worse.

I had lunch with my daughter today, and asked her if she felt they had reached the point where they were truly credible threats, or just someone trying to scare her. She said they had definitely reached the level of being credible threats, and that the perp knew much more about her than any random person should. She definitely believes it is one single source- 1 person or group, not random different internet weirdos.

APD has at least allowed her to file a report. That's all they've done.

We are following up with some of your suggestions. Thank you for your help, and keep the ideas coming.

I think such people are simple haters who will not act just send emails to make her afraid. It would be good for you to find a hacker so to say someone who would be able to track the IP from which the emails are sent. If you think that you know who sent the emails you might be able compare this person's address and the address of the IP.