Cyberstalking and the Unexpected Toll of Cybercrime

When people talk about scams and cybercrime, it’s usually in terms of numbers. Statistics declare how many people have gotten caught in a scam, or how much money has been stolen by cybercriminals this year. But what rarely gets discussed is the less measurable costs. It’s hard to put a number on anxiety, feelings of shame, and decreased online confidence. But cybercrime, especially more personal forms like cyberstalking, can be just as devastating emotionally as they are financially, or even more so.

See Cybercrime is Costing Us More than Just Money with Rory Innes for a complete transcript of the Easy Prey podcast episode.

Rory Innes spent his entire career in cybersecurity, including a range of senior management positions in the world’s leading cybersecurity companies. He is also the founder and CEO of The Cyber Helpline, a charity that provides free expert help to victims of cybercrime and online harm. The Cyber Helpline began when Rory saw firsthand how little support is available for victims and how hard it could be for them when they didn’t understand IT and cybersecurity. He saw an opportunity to step in and fill the gap.

Starting The Cyber Helpline

Rory has worked in cybersecurity since his university days. He’s been in the industry a long time. But the inspiration for The Cyber Helpline came while he was working in cybersecurity at a merchant bank. The bank had a wide variety of clients, but Rory’s job was specifically to work with small- to medium-sized businesses.

People kept telling him about how they’d gotten caught in a scam and needed help. At first, Rory was dismissive. He told them to just go to the police, the police would sort it out and they’d be fine. But these people kept coming back. They told him they hadn’t heard anyone from the police and nobody was helping them.

Rory started looking into why these individuals weren’t being helped somewhere else and what it really takes to deal with these issues. He found that there corporate cybersecurity issues, and then there are cybersecurity issues that affect individuals. Most individuals don’t have the option to hire their own cybersecurity team. And a company never has to face human issues like cyberstalking or revenge content. There’s a huge gap in support for individuals who are struggling.

Somebody needed to do something. Rory realized that he could put up a website and offer to help. That was five years ago. Since The Cyber Helpline took their first case, they’ve opened over thirty thousand cases and currently open about two thousand cases a month. There’s lots of demand for these services, and they’re growing quickly.

Expanding to Help More People

The Cyber Helpline offers a range of ways to get help. They have lots of online guidance for each type of attack someone might face, from cyberstalking to common scams to cyberbullying. They also offer a chatbot to walk people through the process. The chatbot and website have always been available to anyone across the world. But the helpline itself is more limited.

The Cyber Helpline started in the UK, and for the first four and a half years, personalized support was only available in the UK. Part of that is because of funding limitations, and part of it is because effective help to get positive outcomes for victims requires specialized local knowledge. Over the last few months, though, they have started a pilot program in the United States. They’re currently working out how to localize advice and help for the US market.

Trends in Cybercrime

When he was designing The Cyber Helpline, Rory thought people would mostly want help with fraud, scams, malicious software, and maybe hacks. He considered what kind of advice he would give in those situations. But when the first cases came in, they were complex issues of the technological combined with the human. People asked for help with cyberstalking, online harassment, revenge content, sextortion, and bullying. Over the last five years, Rory has gotten a real understanding of how people actually become victims.

The true story of cybercrime and online harm is … a real impact on mental health.

Rory Innes

We see headlines about how millions of accounts were hacked and people lost millions of dollars, but that’s not the real story of cybercrime. A third of what The Cyber Helpline deals with is cyberstalking and online harassment. There are other big areas that they help with as well – they see a lot of hacked accounts and lots of fraud and scams. But most of what they see is organized criminal gangs running impersonal scams, or ordinary people harassing or stalking each other.

Cybercriminals Aren’t Cyber Experts

You don’t have to be a technical person or an IT expert to be a cybercriminal. The knowledge required to target the average person is relatively low. What you do have to be good at is making people act and convincing them to do what you want them to do.

Cybercriminals aren’t particularly good at cyber, but they’re excellent at marketing.

Rory Innes

They used to use sob stories shared by email. But their methods have expanded. They hack social media accounts to trick the friends of their victim. They invest a lot of money into fake websites that look just like the real thing. Because they understand how people think, they can go the extra length to bypass your suspicions and convince you to act. Whatever kind of cybercrime they’re committing, cybercriminals succeed because they know how to trick people into acting.

It’s very rare that someone asks The Cyber Helpline to help with something super high-tech. Generally, what Rory sees is non-technical people using everyday technology to harm victims. An ex-partner who still has access to your iCloud account, for example, can still see your location and photos with no need for hacking skills. And cyberstalking through social media doesn’t require much technical skill. But if you don’t know how simple the mechanisms are, it can be terrifying. The Cyber Helpline helps victims understand what’s happening and what actions they can take.

Identifying Cyberstalking

When you think someone is cyberstalking you, you can develop something called hyper-vigilance. You feel like there’s someone out there watching everything you do and trying to hurt you. The fear and anxiety can leave you always switched “on” and always aware that your stalker might be out there.

When you feel like you are being cyber stalked, then you feel that there is a threat actor out there monitoring you who may be there to harm you.

Rory Innes

When you don’t have a strong technical understanding, anything could be part of the cyberstalking. Your printer rebooted itself, or your kettle whistled, or you looked out the window and saw the lamppost flickering. That must be part of the cyberstalking – your stalker is high-tech and managed to hack into the printer, the kettle, and the lamppost to watch you.

It makes it difficult for individuals. Cyberstalking victims are exhausted because they feel like everything around them has been hacked by their stalker. And in the modern world, it’s almost impossible to escape technology that might be compromised. It also makes it harder for victims to be believed. If a police officer shows up and the victim starts talking about how their stalker hacked the lamppost, the officer will be more concerned with getting them mental health assistance. They won’t be able to get immediate help with their stalker.

Another factor that muddles the issue is the news. We read about cyberattacks in the news, but they’re always big things. Generally, they’re organized professional cybercrime gangs or nation-state attackers. But people don’t understand why these big things happen in cybercrime. It’s highly improbable that your ex-boyfriend is using nation-state malware to cyberstalk you.

Finding the Truth Behind the Cyberstalking

Often what Rory and his team do is look at the situation and help the victim find the facts. What does their online footprint look like? What devices and accounts do they have? Do they have other tech in their life? They get a history of what the stalker has been doing and what the victim thinks they’ve been doing.

Technical understanding, I think, is the biggest hole we fill for people.

Rory Innes

Then they go through a process of elimination. The victim has a Gmail account, so they can go through a checklist of indicators of compromise for Gmail. Through the process, they can identify what’s actually compromised. Then they can look at how it happened. How did the stalker get the information? Where does the information exist online? Who else have you told about it? Often, it’s the simplest explanation that’s true.

Reducing Hyper-Vigilance

Working to determine the facts can help reduce the anxiety and hyper-vigilance that comes from dealing with cyberstalking. Seeing the facts can help a victim realize that it’s not malicious software – they just have access to your iCloud because they’re your ex-partner and you told them your password. It gives them something they can control. Not knowing who is stalking you, how they’re doing it, or what they’re even doing, essentially terrorizes you. When it comes to cyberstalking, the unknown is the horrible part.

Getting people in front of the right people at the right time who will understand what’s happening can make such a difference.

Rory Innes

On TV, a cyberstalker has access to nation-state hacker tools and can spy on you through your wifi-enabled refrigerator. But what’s important to understand is who the threat actor might be and what their capability actually is. If the person cyberstalking you works in cybersecurity, that’s a different conversation. But if they don’t work in IT, that lowers the chances that they’re using something highly technical. There’s usually a simpler explanation.

Cyberstalking and Cybersecurity

There’s some common advice victims get when they go to the police or a service that’s designed to help stalking victims but isn’t so great with the “cyber” part of cyberstalking. That advice is to block the person, factory reset your device, and see what happens. That is some of the worst advice you could get. If you factory reset your device, there isn’t any evidence anymore. If the police do decide to do an investigation, you’ve lost all the messages, documents, photos, and all other evidence.

Stalking is about obsession. The stalker is obsessed with the victim. They might only have one place to access the victim online. If they can only see the victim on Facebook and the victim blocks them, you haven’t removed the obsession – you’ve only removed the access. There’s a risk that the stalker’s behavior will become more dangerous. If they can’t see you on Facebook, they may decide to go to your workplace and follow you home.

Nobody teaches you in a computer science degree or in a corporate office on how to deal with cyberstalking.

Rory Innes

When Rory started The Cyber Helpline, he had to work with stalking charities and other people and organizations helping victims. Helping people with cybercrime isn’t just about dealing with the online compromise. It also has to involve protecting the victim while doing it. You don’t want the cyberstalker to escalate their behavior. The goal is not just to help the victim understand what was compromised and how, but also to keep them safe and keep the cyberstalking from getting worse, and then to help them recover.

The Many Impacts of Cyberstalking

The harm cyberstalking does has many dimensions. It’s often financial, because victims buy new devices or try a variety of services to try to feel safe. Living in a state of constant anxiety and hyper-vigilance has a deep impact on their mental health and their physical health. And their ability to feel safe at home and online is damaged.

The impact of cybercrime isn’t just technical. It’s mental health, it’s online confidence, it’s feeling safe at home.

Rory Innes

Part of Rory’s job is to get cyberstalking victims to a point where they feel safe online again. They need a sense of security and privacy, and to build confidence being online. The process is about empowering them. They learn to spot when things are actually compromised and what to do if it happens. If it happens again, they at least feel like they know what to watch out for.

How Cyberstalking Victims can Regain Confidence Online

The Cyber Helpline assists victims to collect evidence, gain credibility with the police, and push for investigations. But the biggest benefit is empowering them to feel safe and secure online after dealing with cyberstalking. The use an assisted self-help model. Nobody at The Cyber Helpline will remote access the victim’s desktop or sign into their Google account. Instead, they walk the victim through a process where they take the actions themselves with The Cyber Helpline’s guidance.

Victims can tell The Cyber Helpline what accounts they have and what devices they use. Then The Cyber Helpline will guide them. They can help victims understand what they’re looking at and make decisions. When they’re taking action and putting their own protections in place, the victim doesn’t feel helpless anymore. It also gives them skills for the future. They don’t have to worry about whether someone has accessed their email. They know how to check the log of recent and failed logins. Sometimes just walking them through the process can help them figure out what’s possible and what’s unlikely for themselves.

Overcoming the Fear of Technology

If you’re dealing with cyberstalking, you’re scared of the stalker and they’re stalking you through technology. The last thing you want to do is get on more technology to help with it. It can be daunting or scary to tell someone to look at their devices and check for compromises. Moving at their pace, with the right support, and making the steps uncomplicated really helps.

Another challenge is that law enforcement solutions are all online. The system asks people who are being targeted online to report online, find evidence online, and report online again. Cyberstalking victims don’t want to be online – that’s where their stalker is. The user engagement model is going to have to change for the whole process if we want to be able to empower victims, make them part of the solution, and help them regain their confidence.

We need to change the way people feel about these things, how easy it is to report, how we support them when they report instead of saying, “Hey, cool, here’s a credit reference number. You’ll never hear from us again. Good luck.”

Rory Innes

Learn more about The Cyber Helpline at thecyberhelpline.com. There you can find web guides with step-by-step processes to help with different kinds of attacks, access to the chatbot and self-help services, and even a technology to describe what happened in your own words that will identify what you’re facing and walk you through solutions. Personal support is only available to those in the UK, but all other resources can be used by anyone across the globe. You can also connect with Rory Innes on LinkedIn or through the Contact Us page on thecyberhelpline.com.