Roberta Liggett O’Malley on Cybercrime’s Unseen Victims
Roberta Liggett O’Malley studies what happens after the breach—not to the network, but to the person left holding it. An Assistant Professor of Criminology at the University of South Florida, she has spent a decade researching cyber-violence and the online deviant communities that enable it. Now she’s asking a harder question: why the systems built to protect victims fail them instead.
“What unites victims isn’t a demographic, it’s that the offender weaponizes something the victim feels they can’t afford to have seen, causing unimaginable fear.”
You study violence and cyber-violence. When did you stop seeing them as two different things?
The dichotomy between online and offline life is muddied. We tend to use “cyber” to distinguish behavior and crimes that have a digital component, but the mechanics are the same. Almost all traditional crimes now have an online component. Still, when you add in online anonymity and the potential for “going viral”, the digital dimension offers nuances that we do not see in real life.
One example is image-based sexual abuse. Although we see similar dynamics of control, humiliation, and antisocial propensity in offending, victims are left to grapple with a distinct loss of control related to the permanence of their images online. It makes them more socially anxious, always wondering if their image will be seen or come back to cause additional disruption to their lives. The digital aspect does influence victim responses and an offender’s access in ways that are different and amplified.
Your work blends criminal justice and psychology, keeping affected communities at the heart of it. What do we know about the victims? Is there a typical victim of cybercrime?
The reality is that anyone can become a victim of cybercrime. Cyber offenders are always adapting. They use social engineering strategies to trick you into letting your guard down. They also hunt for victims in locations where they may be more susceptible to the scam. Financial sextortion shows this well. Most victims are simply on social media or using dating applications. Connecting with strangers on a dating application is kind of the point, right? People are less vigilant and more willing to engage with the scammer. Once they do, the offender will do everything to make the victim feel special and gain their trust.
With financial sextortion, it’s minor boys and young men who are most victimized, usually because they are the ones using these applications or are most vulnerable to manipulation because of their young age. When they are threatened, the shame and fear propel them into complying. What unites victims isn’t a demographic, it’s that the offender weaponizes something the victim feels they can’t afford to have seen, causing unimaginable fear.
Your research focus is on deviant online communities. What do those spaces tell us about how ordinary people become capable of serious harm?
Harm is usually learned socially, not invented alone. Deviant online communities, regardless of their ideology or mission, supply three things at once: a grievance narrative that reframes the perpetrator as the real victim, a vocabulary that neutralizes what they’re doing—“it’s just a joke,” “she deserves it,” “everyone does it”, ”it’s not that serious”—and an audience that rewards escalation. That combination does a lot of work.
The screen also creates distance that makes the other person feel less real. This cognitive bias leads to online disinhibition: people do things they’d never do face to face because the feedback loop of a human reaction is missing.
“They genuinely don’t picture a teenager on the other end having the worst night of their life.”
They genuinely don’t picture a teenager on the other end having the worst night of their life. There is still this pervasive attitude that “the Internet is the Internet” and what happens online isn’t as harmful as behavior that occurs offline. But we know from the research that this isn’t the case. That victims of online crimes are similarly impacted as those who have been victimized in the physical world.
Sextortion harms young people at a scale that we are only beginning to grasp. What is driving its exponential rise?
Social media gives offenders an enormous supply of targets and a believable way to pose as a peer. Instant-payment apps and gift cards mean a stranger can extract money in minutes, across borders, with little trace. The use of smartphones enables people to easily send sexually explicit images and videos or to surreptitiously record other people. At the same time, AI has allowed offenders to create more convincing social engineering ruses or even create the pornographic image.
We live in a digitally connected world. We socialize online, find romantic partners, network, do our schoolwork, and advertise our accomplishments in digital spaces. So much of our information is online, whether we posted it, our school or employer posted it, or a friend or relative shared it. When someone is threatening to publicly expose you, it isn’t some little thing, it has an enormous impact on our social worlds. Sextortion is successful because there is so much information out there that can be used against you. The threat is severe. We have witnessed the devastation that crimes like revenge porn have had on victims’ lives.
Breaches of personal data, such as those collected by schools, can expose sensitive information. What happens when that information reaches the wrong hands—as the Navigate 360 breach shows?
I am devastated by the Navigate 360 breach. These children used a platform they believed to be anonymous to seek help and even report crime, and the information is being used to extort them. This is highly concerning, re-victimizing, and traumatic, also because offenders look for entry points of vulnerability to extort and groom children online.
"These children used a platform they believed to be anonymous to seek help and even report crime, and the information is being used to extort them."
There’s a second-order cost that’s just as serious: the next kid who’s deciding whether to report learns that speaking up isn’t safe, and that their report isn’t secure. We spend years building that trust, and a single breach can dismantle it.
If a parent comes to you because their child has been targeted—what would you advise them to do?
Do not pay! If the offender is threatening to publicly disseminate images unless they pay them money, do not pay. Block the offender and do not engage. Most of the time, they never distribute images. In my research, images were distributed in only a handful of situations, and all were shared through direct messages and not spread widely online. However, this changes if the criminal is trying to coerce a minor into sharing more explicit images. These cases are severe and terrorizing, and it is best to contact law enforcement. If you believe that an image of you has been shared online, you can use resources, such as the National Center for Missing and Exploited Children’s Take It Down application.
Several cases of technology-facilitated violence caused public outcry, most remain invisible. What is the harm that never makes it into the headline?
There are two harms that do not get enough attention. First, the harm associated with “staying offline.” Victims of technology-facilitated violence, like cyberstalking, harassment, and image-based sexual abuse, attempt to regain control and safety by limiting their online activity. It adds to this social norm around “if you can’t handle it, stay off the Internet.” But staying offline comes with a cost.
Not having an online presence means not socializing online, it can also have consequences on one’s employment and finances. I think about the early career graduate who shuts down his LinkedIn page after sextortion. Victims of online crime are never in a post-victimization stage. There is always a worry that they will be found; that an image will resurface, or that the harassment will begin again.
Another harm comes from the secondary victimization—from police and bystanders. When someone is victimized by online violence, it is often not taken seriously, or the burden is placed on the victim to build their own case. When given advice, police and even friends will say “just stay offline,” or “why did you send that picture?” This secondary victimization is invalidating, silencing, and dehumanizing.
Cybercrimes often go unpunished and leave victims without redress. Why do so few cases lead to accountability? Where does the system fail the victim?
Investigating and prosecuting cybercrimes is complex. Many victims don’t report at all, out of shame or because they don’t realize a crime even occurred. But a case that’s never reported is a case that can’t be solved. However, once a case is reported to law enforcement, offenders are frequently overseas, evidence is fragmented across platforms that respond slowly, and most local agencies have neither the cyber capacity nor the cross-border reach to pursue them; the cases also arrive in volumes that swamp the few investigators who can handle them.
Law enforcement has been diligent to pursue digital crimes that involve minors—and they have brought many overseas actors to justice. This isn’t always the case with other forms of technology-facilitated violence. For instance, in cases of online harassment, prosecutors must prove a “course of conduct” in which an individual displays multiple instances of harassment. But what happens when 500 different people send harassing messages? Do you charge the one that sent two? Quickly, we see how the reality of online harm doesn’t neatly match up with existing laws. This is also changing. Talking to law enforcement officers, they want to investigate these crimes and are motivated to assist victims.
You have one year, one change. What would you do?
I’d put enforceable obligations on the platforms where this happens—fast, mandatory takedown of intimate images of minors and rapid preservation of offender data when a report comes in, with consequences when they don’t. I would also mandate all social media applications to have fast-tracked reporting for sextortion and image-based abuse crimes. Platforms are the one place you could design friction into the crime itself—before it ever reaches an investigator.
"Platforms are the one place you could design friction into the crime itself—before it ever reaches an investigator."