My Friend Had Compromising Info Stolen; Please Help Me Help Him!

July 31, 2012 12:53 PM

A friend has had an old Hotmail account hacked. The hacker used information in the archives there to access a YouTube account where apparently some compromising videos were uploaded. The hacker copied the videos to another YouTube account, and then sent links to the videos to my friend's family - and worse still, to members of the executive board of the nonprofit organization by whom my friend is (was?) employed. He reached out desperately to me, but I know nothing but the most basic things about Internet security and privacy law...

What can I tell him? What should he be doing right now? Both Microsoft and Google have been absolutely no help whatsoever - the Hotmail account hadn't been used in at least two or three years; my friend doesn't even remember what the most recent Hotmail password was. Google / YouTube is simply... not responding at all. Of course, neither of them have any published phone numbers, so the only recourse my friend's had is email and simple "Contact Us" forms onsite.

Secondarily, is there any legal recourse? Is this type of activity covered by any security or privacy law? (The state is Illinois, if that matters). Would it be a local jurisdiction - calling the police? - or are the laws Federal, requiring the FBI?

Thanks in advance for any help or information you can provide. He is one of my very best friends, and although I don't think I understand all of the ramifications, he talks as if his life has been ruined; he is normally a very calm, even-tempered man and he sounds absolutely desperate. I want to do anything I can to help him through this.

posted by OneMonkeysUncle to computers & internet (13 answers total)

I think it's time to consult a lawyer licensed to practice in your jurisdiction. Your friend needs to know about potential criminal charges, potential civil remedies, and what rights he has with regards to actions third parties (like his employer) might take. None of us can answer those questions without knowing a lot more about the details of the situation and about the law that might apply.
posted by decathecting at 12:58 PM on July 31, 2012 [2 favorites]

Lawyer up. A few cease-and-desist letters may get a response from Microsoft and Google's abuse department. Also, this may be a prelude to blackmail - a lawyer will help navigate that thornbush when it finally pops up.
posted by Slap*Happy at 12:58 PM on July 31, 2012

First thing is to file a DMCA complaint against the YouTube video. My understanding is that they will take it down pretty quickly and the burden of proof is on the uploader.
posted by desjardins at 12:58 PM on July 31, 2012 [4 favorites]

Scratch that, get a lawyer and don't listen to me.
posted by desjardins at 12:59 PM on July 31, 2012 [1 favorite]

If he owns the copyright to the videos that were uploaded to YouTube, submitting a DMCA takedown request is probably the fastest way to get them taken down. http://www.youtube.com/t/dmca_policy
posted by primethyme at 12:59 PM on July 31, 2012 [2 favorites]

Aside from the DMCA route your friend should be able to flag the video as infringing on their privacy.
posted by burnmp3s at 1:01 PM on July 31, 2012 [2 favorites]

I figured lawyer up might be the best recourse. Follow on question: what type of attorney should he looking for? Are there firms that specialize in this area, or is there a resource anyone knows of that could serve as a directory or guide...? FWIW, money's going to be an issue (apropos the "nonprofit organization employee" part...).
posted by OneMonkeysUncle at 1:17 PM on July 31, 2012

There's a Get A Lawyer page on the MetaFilter wiki that has some good info, including about low-cost or free legal assistance.
posted by burnmp3s at 1:20 PM on July 31, 2012 [2 favorites]

OneMonkeysUncle, I have some resources for you, but your metamail is disabled. I'm not sure if I can post specific names, but know some lawyers who specialize in this. (Not affiliated.)
posted by beachgrass at 1:38 PM on July 31, 2012

If your friend lives in Chicago, the "what kind of a lawyer do I need" question is a great thing to ask the Chicago Bar Association (312-554-2001.)
posted by SMPA at 1:47 PM on July 31, 2012

beachgrass, thank you for the offer. I've already referred him to the MeFi wiki and he's contacting the state bar for referrals.

Oh, for all above: just having some place to start seems to have made a big difference to him. I can't thank you guys enough for your quick assistance.
posted by OneMonkeysUncle at 1:48 PM on July 31, 2012

I'm not sure if getting a lawyer is going to help repair the obvious damage - the fact that friends and family saw the damaging videos.

Or, say a lawyer could somehow help... how long would that take? Months? What happens with friends and family in the meantime?

The problem still remains. Better to forget the lawyer and work on more immediate damage control, if that's needed at all.

One thing that mystifies me about this situation is "compromising videos uploaded to YouTube".

Can you even do that?

Second, say, yes, it's possible, there's a bit of a leap here to assume that everyone opened the email and then clicked on the link. And even if they did, so what?

It's hugely embarrassing, but it was something that was meant to be private.

Anyway, no matter how you look at it, a lawyer is not going to solve that particular problem.

Getting back to Google and YouTube, it seems to me that it would cost a lot of money to do something your friend could do themselves - report the hack to Google, YouTube and Hotmail, and get the account shut down.

Maybe a lawyer is quicker, but like I said, it does nothing to solve the problem of a damaged reputation (if your friend's reputation is damaged at all).

Your friend is going to have to face the consequences no matter what, and move on with his life.
posted by KokuRyu at 2:57 PM on July 31, 2012

Adding to what has been said above. I think that ultimately it is worth seeing what legal recourse is available because this doesn't sound like a random hack to me.

While I imagine there are people who hack into accounts of people they have no connection to looking for compromising information, and then go to the trouble of targeting the release of that information where it is likely to do the most damage, I think they are probably pretty rare. I think it is more likely that someone deliberately set out to screw with your friend. If so, its probably worth trying to figure out who, and why, and to take action against them. Otherwise, who is to say that this is the last shot they take.
posted by Good Brain at 6:33 PM on July 31, 2012