In the summer of 2012, Hollie Toups got a disturbing call from a friend. Toups is from a small town near Beaumont, Texas, where nobody is that much of a stranger. Her friend had overheard some men talking about a pornographic website with local women on it—and they had mentioned Toups.
Toups couldn’t imagine how a stranger could get naked pictures of her. But it was true: Her pictures were on Texxxan.com, a website she’d never heard of until that day. Some were self-portraits she had taken six years earlier for an ex-boyfriend; another was taken to track the progress of her weight loss efforts. The page also listed her real name, Facebook page and more personal information.
Word got around quickly in her small community.
"I felt like my life was over," she says. "I was being harassed on Facebook; people were sending me messages of solicitation; in public, people were approaching me. They had seen me naked, so they felt like they knew me and assumed I wanted that kind of attention."
Toups doesn’t blame her ex-boyfriend. Because she never shared the weight loss photo with anyone, she believes she was hacked.
But when Rebekah Wells of Naples, Fla., found nude pictures of herself online, she quickly traced them to ex-boyfriend David Avedisian. All of the women posted with her had dated or worked with Avedisian, she says.
"When you have your pictures up like that, you don’t know who’s seen them and who hasn’t," says Wells, a student at Florida Gulf Coast University. "Every time I walked into a classroom, I thought, ‘Has the professor seen them? Is he going to Google me?’ "
PUBLIC EXPOSURE
Wells and Toups are among thousands of victims of "involuntary pornography" or "revenge porn"—nude or sexual photos posted online without their consent. Revenge porn gets its name because many pictures are posted by former lovers who kept sexual photos after the relationship ended. Others are reportedly acquired through hacking, theft by repair people or false personal ads. The victims skew female and young, though experts say they can be of any gender or age. Sites dedicated solely to hosting these pictures have multiplied over the past few years.
Involuntary porn is generally posted with the subject’s real name, city and state, and often links to social media profiles. In addition to potentially threatening the victim’s safety, this helps get the pictures high in Google search results for the subject’s name. And that hurts the victim’s ability to get or keep jobs, dates and more. Some postings have included information for contacting the victim’s work supervisor or family. Attorney John S. Morgan of Beaumont, who represents Toups and others in a class action lawsuit, says several of his clients have lost jobs.
The websites permit visitors to leave comments, which tend to be sexual, crude and insulting. They can also be vindictive: After Toups started sending takedown demands to Texxxan.com, the comments section filled with more of her personal information.
And to make matters worse, a few of the sites ask victims for money in exchange for removing the photos. The operators of Texxxan told Toups they’d be happy to take down her photos—for a fee. Another site, called IsAnybodyDown.com, ran advertisements from a business called Takedown Lawyer, which claimed that a New York attorney named David Blade III could get the photos down quickly for $200 to $300. Las Vegas attorney Marc Randazza and other bloggers established that "Blade" did not exist and was likely the same person who ran IsAnybodyDown. Both sites are now offline.
ONLY TWO
Despite all of this, there’s no clear legal avenue to penalize posters of revenge porn. Only two states, California and New Jersey, make it illegal to post a sexual photo online without the subject’s consent. Though experts say revenge porn may violate other state statutes, it’s common for police to say no law was broken unless the picture is child porn, of those under 18 when a photo was taken.
Instead, victims often turn to copyright law. If they own the copyright to the photos, they can send messages notifying the site that it’s violating their copyrights and liable in a lawsuit. It’s an inexpensive way to get photos taken down—if it works. But website operators overseas or those who believe they’re judgment-proof can and do ignore the notices.
A few have threatened or filed lawsuits alleging privacy violations. Wells cited invasion of privacy in her suit against Avedisian, the revenge porn website PinkMeth.com and its proxy server. (Wells’ attorney, Patrick McGeehan of Miami, says Avedisian has not been served and has apparently left Florida; the other defendants have settled.) Toups is one of 17 named plaintiffs in a proposed class action against Texxxan, its operators, its subscribers and its Web host, GoDaddy.
But while suing the website is efficient, the law may forbid it. Section 230 of the federal Communications Decency Act grants website operators immunity from lawsuits over their users’ speech—a measure intended to preserve online free speech. Revenge porn sites often invoke it, and some experts believe it protects them. A Texas appeals court may take up that question in an interlocutory appeal in the Texxxan case, which was filed in January.
Involuntary porn websites are so new that four years ago, when Bay Area attorneys Erica Johnstone and Colette Vogele started representing victims, there were no such sites. (Their clients’ photos had been sent via email or posted on photo-sharing sites or obscure blogs.)
Johnstone and Vogele (now a senior copyright attorney with Microsoft in Redmond, Wash.) are co-founders of Without My Consent, a nonprofit group intended to "set the table" for a discussion about long-term solutions. It plans to collect information on all federal and state laws that could apply to involuntary pornography, and on suing under a pseudonym. The group has help from students at the Samuelson Law, Technology and Public Policy Clinic at the University of California at Berkeley’s Boalt Hall and an advisory board studded with law professors.
Before the Internet, Johnstone says, compromising photos could do limited harm because they stayed within a few people’s hands. Earlier in the Internet era, online photo-sharing sites would take them down quickly if asked. But there are purpose-built sites today "where the intent is to publicly shame, humiliate and degrade the victim," she says.
"It’s almost a fact of our culture right now that we see this trend of public humiliation and public shaming as a way to take down your rival," says Johnstone, who practices Internet privacy and reputation harm law with Ridder, Costa and Johnstone in San Francisco.
Johnstone and others caution that while revenge porn may seem like a problem for women, men are victims too.
"[At first], I felt like women were most often the victims and it was the next wave of violence against women," Johnstone says. "I think that dynamic is very much alive, but I’m also seeing equal opportunity warfare."
University of Maryland law professor Danielle Citron has studied the issue in depth for her forthcoming book on online harassment, Hate 3.0: A Civil Rights Agenda to Combat Online Harassment. She estimates that 60 to 70 percent of online harassment (including revenge porn) victims are women. And the abuse is often very sexualized—threats of rape, false prostitution ads, calling victims "sluts"—even when the victim is a man.
"When it happens to men, often it happens in ways that [suggest] they are gay. People put up ads that suggest they’re interested in anal rape," she says. Or, she adds, abusers "turn the abuse around and say [victims are] sexual predators."
Mary Anne Franks, a law professor at the University of Miami, adds that women may suffer greater consequences because of the sexual double standard.
"There’s really no way for involuntary porn to be effective unless there are certain misogynist perceptions about women and how they should handle themselves sexually," says Franks, who studies gender and online discrimination.
The handful of victims who have gone public, including Toups and Wells, are all women. Several others have given press interviews anonymously.
By contrast, the people known to run involuntary pornography sites—identified through press interviews, court papers or "hacktivists"—are generally male and young. In fact, some website operators have been sued along with their parents, who allegedly paid for the sites.
THE SHAME FACTOR
In press interviews, some operators have said their activities are protected by the First Amendment and Section 230. They also argue that victims created their own situations by taking and sharing self-portraits. The latter claim is often repeated by observers, who disparage victims as "stupid" or "slutty" for taking the photos.
"The most disturbing experience for the victims has been the reaction not only of anonymous people on the Internet, but others who say, ‘What can you expect? This is what men do,’ " Franks says. "Someone who had the trust of [a victim] has actually made the very malicious decision to do this without the victim’s consent."
Franks analyzes the issue as one of consent in context. Just as a boxer hasn’t consented to be punched outside the ring, someone who sends a naughty picture to a lover has not consented to have that picture distributed online.
When Toups first sought help, she didn’t go to the police because she’d already heard from victims who had tried it. The police not only said they couldn’t help but also told the victims to be ashamed for taking the photos in the first place.
"I just didn’t even bother because if they told me that, I felt like I was going to freak out," she says.
In many states, Johnstone says, nonconsensual pornography violates the state criminal laws on stalking, voyeurism, hacking and more. But the police are used to "brick-and-mortar crime scenes," Johnstone says, and may not think to apply those laws to online behavior.
Jody Westby is the chair of the Privacy and Computer Crime Committee of the ABA’s Science & Technology Law Section. She agrees that existing laws can and should be applied to involuntary porn. In fact, she believes laws that might not be obvious could apply—for example, a federal law prohibiting "obscene or harassing telephone calls" actually applies to any telecommunications device.
But Westby has also found, in her work as a consultant on online privacy and security, that law enforcement isn’t fully aware of how existing laws might apply. With one client who was being cyberstalked, she had to convince the police that criminal laws apply.
"[Officers] want to go after the big guys, and they’re loath to get involved in domestic problems," says Westby, CEO of Global Cyber Risk in Washington, D.C. "And it’s not in their face every day like armed robbery, where they have the instant recall" of what statutes apply.
Then again, she notes, law enforcement used to resist getting involved in physical stalking, a crime that is now taken seriously. Citron believes Americans can and should encourage a similar cultural change about online harassment.
OFFICIAL ACTION
Randazza, the attorney who uncovered the false Takedown Lawyer site, is a First Amendment lawyer for conventional adult entertainment companies. He has also worked on several revenge porn lawsuits, sometimes pro bono. He adds that the police may not choose to follow up even if there clearly is a crime. He mentions an underage client who couldn’t get the police or FBI interested in her case.
"If you can’t get a cop interested in a child pornography case, what priority do you think some 40-year-old mom is going to get?" he asks.
In addition to California and New Jersey, a few other states have considered bills that would make posting revenge porn a crime. A bill in Florida died earlier this year, but Morgan plans to draft one for Texas. New York state legislators announced in October that they plan to introduce legislation, which is based on Franks’ work.
But these laws have been criticized as unduly restrictive of free speech. The Electronic Frontier Foundation and the American Civil Liberties Union both opposed an earlier version of California’s proposed law, arguing that it was unconstitutional because it didn’t have a requirement for actual harm. The version of the bill signed into law in October did add a requirement that the victim "suffers serious emotional distress," but EFF activist Adi Kamdar says the organization generally has concerns about criminalizing speech.
"It seems like the statute still has some vulnerabilities," he says. "You want a bill that minimizes collateral impact, but the current law doesn’t quite do that enough."
It wasn’t clear whether the Florida measure attracted this kind of public criticism before it died. Yet Wells wasn’t sorry to see it go. "The bill said it’s only a crime if the perpetrator posted the woman’s personally identifying information," she says. "That’s ridiculous, because people recognize me by my face."
Franks says she used New Jersey’s law as a starting point when she drafted model state and federal laws. She believes criminal laws are the best approach because they don’t have the financial and privacy concerns of lawsuits, and the laws would provide quick takedowns rather than financial damages. Free speech concerns aren’t necessarily a barrier, she says; statutes against stalking and threats criminalize speech, but they are not unconstitutional if drafted carefully.
Westby agrees. "I’m very much a proponent of free speech, but … free speech has always been curbed by legal interpretation as well as by law," she says. "There is not a least intrusive means of stopping someone who is harming someone by sending private photos around."
But Randazza doesn’t think there should be a criminal law at all. In addition to questioning whether the police care, he questions whether they have the resources to investigate. And he shares the EFF’s free speech concerns.
"I understand that [legislatures] want to do something, but I think the statutes they’re trying to pass are constitutionally infirm," he says. "And even if it passes constitutional muster, is it going to be useful?"
As for copyright law, if the photo was a self-portrait, the victim owns the copyright automatically. Without registering it, he or she is free to send takedown notices to the website’s operator under the Digital Millennium Copyright Act. This doesn’t necessarily require a lawyer’s help, which makes it affordable. Wells has a step-by-step guide at WomenAgainstRevengePorn.com.
"Copyright is a powerful tort," says Eric Goldman, a professor at Santa Clara University School of Law and director of its High Tech Law Institute. "Some sites are overseas or consider themselves judgment-proof, but anyone who has assets and cares about them tends to be pretty responsive to copyright claims."
Victims say website operators often respond to these notices. If they don’t, they lose the DMCA’s "safe harbor" immunity from lawsuit. A copyright lawsuit might not net damages—few victims can register their copyrights within 90 days of first publication, as required for statutory damages. But it can provide an injunction against posting the photos online, and lawyers say that’s usually what victims want.
Unfortunately, a takedown from one site isn’t necessarily the end of the story. Digital photos are easy to reproduce, so the original poster (or an angry site operator) can easily resubmit photos to another site. Wells compares it to the carnival game Whac-a-Mole: as soon as photos are gone from one site, they pop up in two or three other places.
And as Goldman notes, foreign websites don’t care about DMCA takedown notices. Indeed, several sites have reportedly moved to overseas hosts to avoid legal consequences in the U.S. (This backfired for PinkMeth.so, whose domain came from the Islamic Republic of Somalia. The Somali government shut it down after Plano, Texas-based attorney Jason Van Dyke called the content to regulators’ attention.)
Kyle Bristow, an associate with Romanzi Atnip in Waterford, Mich., encourages his revenge porn clients to register copyrights in their pictures—but he hasn’t needed to actually sue. So far, he says, the demand letter he sends to a site has been adequate to get the pictures taken down. And staying out of court is often a goal for his clients, Bristow says.
"When women file suit, they bring unwanted attention to their situation, and oftentimes these websites will retaliate by posting images to other websites," he says.
ATTORNEY OPPORTUNITY
That’s one reason why litigation is not used often. Another is that not too many lawyers do this work.
"There are only about four or five of us in the whole country," Randazza says. "It would be awfully nice to have people competing with us to take cases, so I wouldn’t have to turn away 90 percent" of callers.
Part of the problem is that attorneys, like the police, may not believe any law was broken. Toups went to several lawyers before a private investigator sent her to Morgan. Most told her there was nothing they could do.
In fact, revenge porn lawsuits can come under several different legal theories. The Texxxan suit and others cite violations of the state-law right to privacy. Others file copyright infringement cases. If the picture was taken before the victim reached 18, he or she can sue under child porn victims’ rights laws.
But there isn’t much money in it. Defendants are typically individuals who can’t pay a large judgment. "The general rule is these people are not wealthy," Morgan says. "They’re young men and they think it’s funny."
Hunter Moore, operator of now-defunct IsAnyoneUp.com, has claimed in the press that he made $30,000 a month. But that was when it was the only involuntary porn site, Johnstone notes. Now, there are a lot of smaller sites that seem to make money from advertising the conventional porn industry, or perhaps from payments for takedowns.
The lack of potential recovery doesn’t stop some lawyers from suing. Indeed, Bristow says he would enjoy collecting from this kind of defendant.
"I would absolutely enjoy going after their wages and tax refunds and what would otherwise be permitted by law," he says. "Plus, if they were ever sued, it would be a high-profile case and they would be exposed as the repugnant individuals that they are."
But enjoyment may be one of the only forms of compensation for attorneys. Because the victims are usually also individuals without serious means, attorneys often handle these cases pro bono, or with only limited expectations for compensation. Morgan expects to make no money from the Texxxan suit, though he thinks it’s still worthwhile.
Randazza and colleague Andy Contiguglia, a Denver attorney who has represented victims, agree that state legislatures could change that by amending existing torts. Rather than make criminal laws, they say, legislators could make privacy laws more effective against revenge porn.
"Legislatures should work on getting people to take these images down," Contiguglia says. "If you had injunctive relief and attorneys’ fees, you end up getting a lot more involvement from attorneys wanting to do this kind of work."
When Morgan took the Texxxan case, his research quickly uncovered the Whac-a-Mole problem. "A victim would go to an attorney and the attorney would write a letter and they’d say, ‘We took down the photo,’ " he says. "And then the website would put the photo back up or send it to another website. So it wasn’t helping."
Instead, he decided to go after the sources: Morgan sued Texxxan.com, Web host GoDaddy, the site’s owners and its subscribers. He won an injunction in April requiring GoDaddy not to host Texxxan.com or any similar website, and forbidding the site operator defendants from putting their material back online anywhere.
Not surprisingly, GoDaddy cited Section 230 in its motion to dismiss. (As of October, only GoDaddy had moved to dismiss; attorneys for individual defendants declined to comment.) In response, Morgan argued that Section 230 doesn’t apply because the material is obscenity not protected by the First Amendment. Unlike conventional pornography, he notes, revenge porn requires no consent and no age verification.
The trial court ultimately agreed, but it also allowed GoDaddy to file an interlocutory appeal on the issue. Morgan expects the Texas appeals court to take it up—"it’s a real juicy constitutional issue"—but not rule on it until after the suit’s January trial date.
230 AND THE LAW
The obscenity argument is part of one exception to Section 230, for violations of criminal law. The statute expressly includes obscenity and child pornography. More often, Goldman says, courts permit exceptions for copyright violations.
Goldman believes that exception would apply to involuntary porn sites, but only if the victim owns the copyright to the pictures and the site also ignored DMCA takedown notices. Otherwise, he believes sites would be protected by Section 230 because they are republishing user-submitted content.
Nor does Section 230 apply when the website was a co-developer of the content. Contiguglia believes that’s the case for revenge porn sites, some of which have been accused of hacking victims’ computers or fishing for photos with false personal ads.
"None of these sites are truly user-generated content," he says. "They’re not really Section 230-protected, although they would like to think they are."
Even if Section 230 ultimately ends the Texxxan lawsuit, Morgan might not mind as long as the case generates laws against revenge porn, which he finds "pernicious and disgusting."
Citron believes part of the solution should be civil rights laws that enhance sentences for online harassment based on gender, sexual orientation or race. This would not only address individual cases, she says, but help make online harassment socially unacceptable.
"The more we talk about it, the more we see it as a problem—the more we’re going to address it," she says.
Wells says her invasion-of-privacy lawsuit is less about money than about seeking consequences for her poster’s actions.
"What I really want is to be free to trust a man again, or at least I want to be free to trust our legal system," she says. "Both have betrayed me, but I feel like there’s still hope for the latter."
