The California Attorney General's office said Friday that George Bronk, 23, hacked and took control of the email accounts of dozens of women in the US and England. He then searched the women's Sent folders for nude and seminude photos and videos, and forwarded any he found to all the women's contacts, prosecutors said.
Bronk, who lives in the Sacramento suburb of Citrus Heights, pleaded guilty Thursday to seven felonies in Sacramento County Superior Court, including computer intrusion, false impersonation and possession of child pornography. He will have to register as a sex offender because of his guilty plea.
According to the Attorney General's Office, the investigation began when the Connecticut State contacted the California Highway Patrol because the suspect appeared to be operating in California. The Sacramento Valley Hi-Tech Crimes Task Force joined in the investigation.
From December 2009 through September 2010, Bronk accessed email accounts and Facebook pages of people in 17 states, and residents of England.
Investigators said they used information from Bronk's confiscated computer to email questionnaires to 3,200 of his Internet contacts, asking if they had been victimized. Forty-six women said they had.
Officials said Bronk found answers to the women's email security questions in information they had posted on their Facebook sites. Bronk targeted his victims by scanning Facebook for women who also posted their email addresses there.
He then contacted their email service, pretending he was the legitimate customer, and claimed to have forgotten the password. Bronk was able to correctly answer security questions posed by the email service by finding the answers on the victims' Facebook pages.
Some of the security questions asked for the customer's high school mascot, father's middle name, favorite food and favorite color. Once Bronk gained access to the email account, he changed the password and the victim was locked out.
Investigators found 172 email files containing explicit photographs of women when they searched Bronk's computer in September, according to a court affidavit. They were able to track his victims to England, Washington, D.C., and 17 states: Alabama, Arizona, California, Georgia, Illinois, Iowa, Kansas, Louisiana, Massachusetts, New Hampshire, New Jersey, New York, Ohio, Oregon, Texas, Virginia and Washington.
A victim in Los Angeles, who did not want her name used for fear the story could harm her career, said she, the FBI and other authorities tried for seven hours to remove an album of 10 photographs that Bronk posted on her account before Facebook took it down.
"Then he wrote just crass, racist, disgusting comments on people's walls that I was friends with," she said. She went on say she felt violated, "kind of a rape-like situation."
The woman said she originally had sent the private photos to a boyfriend, only to have them seen by her college professors and co-workers.
Some of the victims, along with Bronk's attorney, said Facebook should have caught Bronk's activities more quickly. The Associated Press said that Facebook spokesmen did not return telephone or email messages Friday. Prosecutors are seeking a six-year prison term when Bronk returns for a sentencing evaluation March 10.
"This case highlights the fact that anyone with an email account is vulnerable to identity theft," Attorney General Kamala Harris said in a statement announcing Bronk's guilty plea.
Attorney General Harris reminded users of email and social networking sites that security questions and answers need to be as secure as passwords. There are steps people can take to avoid being victimized by the so-called security question hacks.
These steps include:
- pick security questions and answers that do not involve any personal information that is available from social networking sites or any other sites
- try to switch the security questions you choose for password protection on email services and social networks.
- add numbers or special characters to your security answers. For example, the question "What was the name of your High School" could be answered "Middle02High@School."
Sending nude photos to anyone is really stupid. At some point adults may learn that nothing is private, if it goes out over the Internet.