By Jared Chausow
By Katie Toth
By Elizabeth Flock
By Albert Samaha
By Anna Merlan
By Jon Campbell
By Jon Campbell
By Albert Samaha
In other words, if a hacker knows only your Gmail address and can figure out how to access your phone, he's already most of the way into your shit.
That's what happened to a twentysomething woman from the Northern California we'll call Tanya, who has never met or spoken with Kristen. Over Facebook chat, a panicked friend typed that she'd lost her phone and asked Tanya for help. Tanya reflexively sent her e-mail address and phone number, and almost immediately, she got an alert that the password on her Yahoo account had been changed. She was momentarily confused. When she finally fought back into the account, her profile information was replaced with an e-mail address: firstname.lastname@example.org.
That was January 7, 2012. "Two days later around midnight, I got weird messages from people, and I ignored them," Tanya recalls over the phone. "When I woke up the next morning, I had over 30 phone calls from people and over 400 friend requests from Facebook, and I had no idea what was going on." She'd been posted to Is Anyone Up, with her name, hometown, face—and someone else's nude body. Tanya had a shock of recognition: The photos of her breasts were actually those of her friend, pictures Tanya had taken during an exercising spell to help visually track her process. "When I actually looked at my e-mail, I didn't even remember having those."
Tanya is not the sort of person who takes nudes. She is extremely modest—and this was one of the most emotionally damaging scenarios she could imagine. "I didn't even leave my house for a week." When she finally gathered the courage to do an errand, something awful happened. "I went to Taco Bell, and someone came up to me and was like, 'Oh, I've seen you naked.'"
Tanya took no solace in the fact that the site's characteristically crude comments were flattering. ("Does this girl have any flaws?" was a stark contrast to the usual "Jesus, someone call Greenpeace and get her back in the water.") The fact that it wasn't her body didn't make it better; in some ways, the misunderstanding made the situation feel worse. She tried to get the photos down by e-mailing the site to no avail. Eventually, she started talking with other women who had been posted and discovered she wasn't the only one. "Everyone I talked with, we were all hacked by Gary Jones."
More than a month later, Tanya wrote to Jones and said that she knew he had hacked other people for the same reason.
On Monday, February 20, at 12:52 p.m., Tanya wrote, in part: "Do you know how much damage you are doing to people. . . . I have a question why?"
Almost four hours later, she got a reply.
All I can say is I'm sorry. Really. If it makes you feel better, I did nothing other then look at your pictures. Nothing financial or medical, I promise. I truly wish there was something I could do to make it up to you. I'm having a hard time, too. Please feel better and know that nothing else will come from this.
A hacker with a conscience. Also, a hacker who wasn't denying anything. A few hours later, Tanya wrote: "You and Hunter are invading my privacy. . . . I'm sorry, but I don't get how you can be having a hard time. "
He wrote back:
Actually, I just got my 3rd DUI and lost my job last week. . . . I'm 6 days sober. But I get it, that was my choice as opposed to you who did nothing wrong. If it's any comfort, you are absolutely beautiful, and that gives you a leg up on almost every other woman. Hopefully, in the next month, it will fade away, and you'll feel happy again. Want me to send your parents an e-mail for you explaining it to them?
That's the last message in the thread.
"Gary Jones," as it turns out, has been at this for a while. Google "email@example.com," and three anonymous forum posts—two from March 2011 and one from December 9, 2011—single out the address. "I recently got my e-mail password stolen from another account," reads a panicked message from March 15, 2011. "The person who has my account is firstname.lastname@example.org."
That same month, an Australian woman named Danni Suriano alerted her Facebook friends that she'd been hacked in a frantic status update. ("HACKER!!! ON MY PROFILE RIGHT NOW!! do not tell him anything about your contact info!! email@example.com.") On October 18, 2011, Suriano was posted on Is Anyone Up. (She didn't respond to our request for comment.)
"Gary Jones" has a Facebook profile; it doesn't mention his interest in nude photos. Instead, the page identifies him as a 32-year-old who hails from Belize, lives in Australia, and works for the plus-size agency BELLA Model Management. (Reached by e-mail, the director of BELLA Model Management told the Voice, "We don't have a Gary here.") The accompanying photo shows him as a beefy bodybuilder with a bad dragon tattoo, sunglasses on his head, and cartoon-hyena smile.
It's actually a circa-2008 Wikipedia image of Matthew Rush, a gay-porn megastar known for such titles as Splash Shots III and "the first 3-D gay porn feature film," Whorrey Potter and the Sorcerer's Balls. (Rush plays Voldemorecock—it's available on Blu-ray.) Rush's birth name is Gregory Grove, not Gary Jones. (Reached by e-mail, Grove said, "I have no idea who this person is.")