Cyberattacks are a growing threat, with children being among the most vulnerable of targets. The internet serves as a platform for criminals to access children under the guise of anonymity. These criminals lurk on popular applications and social media platforms frequented by children, using fake profiles to take advantage of their innocence through deceptive tactics. What is most disturbing is the aspect of sexual exploitation that often accompanies many of these schemes.
Additionally, the advancement of AI technology and the emergence of deepfakes have created new avenues for criminals to carry out cyber threats. These tools provide additional means to exploit and manipulate online environments, further exacerbating the risks that your child may be targeted by a malicious actor. This week, the FBI released a warning detailing the safety risks that synthetic content, or deepfakes, pose to victims, including children. While this development is alarming, there are steps you can take to protect your child from falling victim to cyber-attacks, including those involving deepfakes.
The Dangers Children Face Online
Children have been exposed to cyber-attacks long before the emergence of AI. While AI adds a heightened layer of complexity to internet schemes, it is important to recognize that AI- driven schemes rely on the same foundation as other cyber threats. Here are some cyber-attacks that children face online:
Online Impersonation
Children are at risk of falling victim to identity theft or impersonation, whereby a malicious actor creates a fake profile to assume the identity of a child. These fake profiles can be used to facilitate schemes against other children or damage the child’s reputation through the publication of inappropriate content. Unfortunately, one of the major reasons a criminal would impersonate a child is to engage in the crime of sextortion against other children.
Cyber Extortion and Sextortion
Cyber extortion is a broad term that encompasses any type of online threat where a criminal threatens to harm the target if they don’t meet certain conditions. Sextortion is a form of cyber extortion where a scammer threatens to sexually exploit the victim if they don’t yield to the scammer’s demands. These demands typically involve payment of a large sum of money, but attackers can also demand that the victim engage in certain behavior, including sending explicit photos. While sextortion was once thought to be an issue targeting adults, the FBI published a global warning in February of this year, about the sextortion crisis targeting children and teens.
In a sextortion scheme, a sextortionist poses as young male or female on social media. The sextortionist then adds children as “friends,” and works to earn their trust. In doing this, the sextortionist endeavors to obtain personal information from the child, including explicit images or videos. The scammer then threatens to release the photos by publishing them on the internet and sending them to friends, family members, educational institutions, and law enforcement if the victim doesn’t send monetary payment. The scam relies on the assumption that victims under distress will make quick, irrational decisions. Because any explicit photo of a minor is child pornography, sextortion targeting minors often creates a complicated situation where targeted children and their parents are terrified to seeking assistance for fear of their own criminal repercussions.
The development of artificial intelligence (AI) technology further complicates the issue of sextortion. For example, sextortionists can now generate deepfakes in the form of fake explicit photos by taking a photo of a victim’s face from social media and running it through an AI image program. With AI sextortion, the attacker threatens to release the fake nude images to achieve the same abusive result as traditional sextortion.
To be clear, the PROTECT Act of 2003 prohibits the creation or dissemination of computer-generated child pornography, which means that the generation deepfakes depicting a minor is a crime. Despite the risks involved, malicious actors still pursue these ploys, often operating schemes overseas in an attempt to evade detection and prosecution by law enforcement officials in the United States. Nevertheless, subpoenas can be used to unmask anonymous online actors.
Malware, Hackers, and Phishing
Malware, hacking, and phishing schemes are cybersecurity threats that can put individuals, including children, at risk. While all people can be targeted by these types of threats, children are particularly vulnerable.
Malware stands for “malicious software” and refers to any software designed with malicious intent. It includes various types such as viruses, worms, trojans, ransomware, and spyware. Malware can infect computers, smartphones, tablets, or any device connected to the internet. Malware aims to disrupt or damage a device, steal personal information, or gain unauthorized access to systems.
Children can be at risk from malware because they may be less aware of online security practices. They might unknowingly click on malicious links, download infected files, or visit unsafe websites while playing games, using social media, exploring the internet, or engaging in other online activities. Malware targeting children can be disguised as a game, application, fake contest, or survey.
Hacking involves unauthorized access to computer systems or networks with the intention of gaining control, stealing information, or causing harm. Hackers exploit vulnerabilities in software, networks, or human behavior to gain access to sensitive data or compromise systems.
Children can be at risk of hacking due to various factors. They may have weaker passwords or share them with friends, making it easier for hackers to gain unauthorized access to their online accounts or devices. Additionally, children may be targeted by social engineering attacks, where hackers manipulate children into revealing personal information or performing actions that compromise their security.
Phishing is a deceptive technique where cybercriminals impersonate trustworthy individuals or organizations to trick users into revealing sensitive information such as passwords, credit card details, or social security numbers. Phishing attempts are commonly conducted via email, text messages, or fake websites that mimic legitimate ones.
While phishing schemes are commonly thought of as a workplace threat, children can also fall victim to phishing attacks, and are perhaps more vulnerable because they lack the necessary awareness to identify fraudulent messages or websites. Children may receive emails, texts, or direct messages on social media platforms that appear to be from familiar sources (like a gaming site or a friend), asking for their login credentials or personal information. Disclosure of this sensitive information can lead to identity theft or unauthorized access to their accounts.
AI can be used by cyber-criminals to bolster existing malware, hacking, and phishing schemes. AI can draft emails which seem credible and quickly integrate data about targets. In the case of foreign malicious actors, AI can draft quick, grammatically correct responses to messages. It can also generate deceptive websites or documents that appear authentic to unsuspecting users. Furthermore, AI can be utilized to respond instantly with deepfake voices, obtained by extracting recordings of real voices from suspicious unsolicited spam calls.
Cancel Culture, Content Manipulation, and Other Reputational Risks
Internet use comes with a variety of reputational risks. Children may post or share content online that is inappropriate, offensive, or controversial. This type of content can harm a child’s online presence and result in dire reputational consequences, both online and offline.
Cancel culture refers to the online phenomenon where individuals are called out, criticized, or boycotted for their perceived problematic behaviors or statements. Being “canceled” typically involves a collective social media backlash that can result in significant negative consequences for the targeted person, such as social isolation, reputational damage, and ultimately, a loss of educational and employment opportunities.
When a child falls victim to cancel culture, it can be devastating. The stigma from being canceled can follow children into adulthood and prevent them from moving forward with their lives.
Unfortunately, a child can also be canceled by content manipulation. Content can be manually manipulated by a simple editing program, or convincingly created by AI software. This includes the creation of photo, video, or audio footage of a child doing or saying things they never did or said.
Why Don’t Child Victims Ask for Help?
Cyber criminals capitalize on the quick emotional reactions of others. Child victims are particularly susceptible. When a child is the target of a cyber-attack, especially one involving sextortion, it can place them in a state of panic… and understandably so. Attackers threaten to notify a victim’s friends, family, and school. They threaten to contact colleges where students have pending offers of admittance, and they threaten to report them to law enforcement. Deliberately targeting child victims, cyber attackers exploit their vulnerability, volatility, and limited ability to seek assistance in the same manner as adults. This is why educating children about cyber-attacks is crucial to ensuring their safety.
Real Child Victims: Case Studies from a Law Firm
The Classic Sextortion Case
A sextortionist posed as a minor female and added a minor male on Snapchat. The sextortionist purported to share information her family, obtaining key details about the minor male’s family, high school, and college plans. The sextortionist added the minor male on different social media applications, so that the two were corresponding frequently on Snapchat, Instagram, WhatsApp, and via text message. The sextortionist convinced the minor male to send an explicit photo, which the sextortionist used to blackmail the minor for thousands of dollars. The minor eventually told his mother, who paid the extortionist in the hope that the situation would go away. As the family paid more and more money, the sextortionist’s threats escalated to include phishing schemes. Ultimately, the family engaged the services of a law firm to facilitate cyber investigation, stop the threats by sending a demand letter, and remove the sextortionist’s fake accounts from social media.
In this case, the sextortionist was from the Ivory Coast. Because the sextortionist had access to so much personal information from corresponding with the male, they had more leverage against him and his family. For example, the attacker claimed that they were going to contact the 17-year old’s college to get his admittance offer rescinded and report the child to the FBI. Furthermore, because the attacker had the private cell phone numbers of both the mother and her son, they were able to send phishing schemes to the cell phones in an attempt to hack and control the devices, and ultimately gain more personal information.
Note that the malicious actor in this scenario engaged in the following cyber threats: impersonation, sextortion, threat of cancel culture, phishing.
Canceled on TikTok
A teen participates in a TikTok trend by publishing a video critique of an element of pop culture. The video is taken by a malicious actor, manipulated, and reposted in a montage of several videos containing disturbing content. The teen is canceled on social media and deletes his account. The attacker finds the teens contact information from publicly available sites and threatens to send the video to the teen’s high school and law enforcement if he doesn’t meet the threat actor’s conditions. The teen meets the attacker’s demands until the situation becomes so unbearable that the teen tells his parents. Law enforcement investigates the child, and the teen’s parents hire both criminal and civil attorneys to extinguish the threats.
Note that the perpetuator of a cyber-attack is not always a foreign actor and can sometimes be a person that knows the child. The malicious actor in this scenario engaged in the following cyber threats: content manipulation, cancel culture, extortion.
The Hacked Snapchat Gallery
An adult woman receives a private message on Facebook stating that her nude images leaked. Concerned, she clicked a URL that was sent to her. The URL took her to a pornography forum site, holding a downloadable album of every photo she had saved to her snapchat account from ages 16 to 24. The album contained her name, her high school, her college, her employer, and her contact information. She began receiving threatening and extortionary messages to her personal email, cell phone, and her work email, and the pornography spread until it covered her search results. People began impersonating her and selling her underage photos. Ultimately, she reported the threats to the Federal Bureau of Investigations (FBI) and the National Center for Missing and Exploited Children (NCMEC). She also hired a law firm to assist in tracking the perpetrators and removing the content from her search results. She never knows when the explicit content will be re-uploaded or when new threats will occur.
In this case, the woman assumed that the private content she saved to an application was secure. The application had years of images and personal identifying information stored. When a hacker stole this information, they gained personal information which allowed them to threaten her and damage her search results.
Note that the malicious actors in this scenario engaged in the following cyber threats: hacking, impersonation, sextortion, phishing, and cancel culture.
Unfortunately, a common thread runs through all of the above-mentioned scenarios: the victims were largely unaware of the unfolding dangers until it was too late, and failed to seek assistance until the attacks reached an overwhelming and unmanageable level. The immense pressure these situations place on children is insurmountable and it is often impossible to extinguish these threats without the assistance of adults, including law enforcement and legal teams. Tragically, children who fall prey to these types of scams are often at risk of suicide.
Top Tips to Protect Your Child from Becoming a Victim of a Cyber Attack
1.) Talk to your child about internet schemes, including sextortion and deepfakes, before there is an incident.
To protect children from internet cyber-attacks, it is essential to establish open communication about online safety. Parents should not only educate children about the potential risks associated with communicating with unknown individuals online, but they should also explain the different ploys so that a child is better equipped to identify a scam if they are targeted. Paramount to this discussion is a conversation about sextortion and deepfake scams.
2.) Play an active role in your child’s online activities.
Parents and guardians should play an active role in their child’s online activities by monitoring access and usage. Parental control tools can assist parents in monitoring the types of sites and applications children access, as well as the duration and time they spend online.
3.) Audit your child’s search results.
Your online reputation follows you forever and effects your ability to make meaningful relationships and financially support yourself. Thus, parents should run periodic searches of their child’s name and other personal information (like phone numbers and account names) to have a gauge on their search results. If something concerning shows up in search results, it should be addressed as quickly as possible to control its spread.
4.) Do not allow your child to have public profiles, and explain why remaining private is important.
Most sites have the option of setting a profile to private viewing. Review the privacy settings on each application your child uses and restrict accounts from public access. Social media or application users who have public profiles are at a greater risk of being impersonated and attacked by malicious actors. A public profit also places the user at a greater risk of being canceled for a controversial post.
5.) Consider selecting a nickname or alias for an account name in lieu of your child’s full name.
The more information a threat actor has about a victim, the easier it is to target them. Consider creating accounts with an account alias or nickname in lieu of a child’s full name to help your child maintain anonymity.
6.) Be aware of the personal information you share about your child online.
Even if your child’s profiles are private, you may publish information on your social media that could place them at greater risk of being targeted by a malicious actor. Be mindful of what information you share about your child, and keep in mind that it could be used in a cyber-attack.
7.) Help your child establish strong, private passwords.
Strong passwords on social media sits and applications are crucial because they protect users against unauthorized access to their accounts, reducing the risks of identity theft and privacy breaches. They also safeguard personal information, ensuring that sensitive data remains confidential.
It is crucial that all social media and applications users, including children, create strong passwords that are unique for each account, avoiding common words or easily guessable patterns. Additionally, enabling multi-factor authentication, staying vigilant against phishing attempts, and regularly updating passwords enhance account security and mitigate the risks of password-related attacks. Parents should also stress the importance of not revealing passwords to third parties.
8.) Remember that the internet truly is forever.
Anything shared or posted online can potentially remain accessible indefinitely, even if deleted or hidden. Inappropriate or embarrassing content that resurfaces in the future can harm a child’s reputation, impacting relationships, educational opportunities, and career prospects.
My child has been targeted by an online predator, now what?
Step One: Immediate secure your child’s accounts.
This includes changing passwords and ensuring that privacy settings are enacted
Step Two: Preserve Evidence.
If you child has been targeted by an online predator, you should immediately document all evidence related to the scheme. This includes taking screenshots of all messaging and copying the URLs and profile information of the threat actor. Preserving evidence is important for law enforcement and attorneys to assist in identifying and extinguishing the threat.
Step Three: Determine what information the malicious actors has about your child.
As soon as you become aware of a cyber-attack, you should ask your child what personal information the attacker has about them. Personal information can include your child’s full name, phone number, address, or school, among other things.
Step Four: Notify the website your child was target on.
Most websites and applications that children frequent have zero tolerance policies for individuals targeting children. Reporting online predators will likely breach a term of use for the site, resulting removal and/ or permanent banning of the user from the site.
Step Five: Seek assistance from the appropriate agency.
If your child was targeted, you have options. You can report the crime to your local law enforcement agency or cybercrime reporting center. You can also contact a civil attorney for assistance.
Step Six: NEVER SEND MONEY.
Paying an extortionist reinforces their behavior and motivates them to continue their illegal activities. Even if you pay the demanded amount, there is no guarantee that the person will stop. In fact, if you become a lucrative victim, they are likely to request more money from you in the future.
Step Seven: Seek support.
Cyber criminals prey on causing victims significant distress and isolating them from the support resources they need to extinguish the threat. Friends, family, and professionals can provide support and guidance in the aftermath of a cyber-attack.
Other Helpful Resources to Protect Children
The Federal Bureau of Investigation
If your child was exploited on the internet, they may be the victim of a crime. You can report internet crimes to the FBI via this portal. You can also contact your local FBI field office or call 1-800-CALL-FBI.
The National Center for Missing and Exploited Children
The National Center for Missing and Exploited Children (NCMEC) is a non-profit organization that provides support and resources for families in relation to sextortion and other cybercrimes. NCMEC has a cyber tip line for reporting suspected child sexual exploitation, including sextortion and online enticement, which will in turn is reviewed by the appropriate law enforcement agency, including members of the FBI. NCMEC also has a free service called Take It Down, which could help victims stop the online sharing of explicit images. Victims may reach out to the NCMEC at gethelp@ncmec.org or via their 24-hour hotline 1-800-THE-LOST.
Contact a Civil Attorney
An internet defamation and content removal attorney is a civil lawyer who handles cases related to internet issues. An internet attorney can help guide victims through tough legal issues which arise during and after a cyber-attack.
At KJK, our content removal attorneys have experience tackling a wide variety of internet-related issues and have been able to remove difficult and damaging content from the internet on behalf of our clients. If you are experiencing issues relating to the content expressed in this article and you have questions about your legal options, contact Internet & Defamation Attorney Alexandra Arko (ALA@kjk.com).