Nearly all of us are giving away reams of sensitive information about ourselves online without understanding how it might be used, or what risks we might face in the future because of it. But what if every bit of information you’ve ever posted online was weaponized against you? Well, for one woman, that’s exactly what happened.
Read her haunting story, and the best WIRED stories from this month, last year, below.
THE FIRST TIME the police arrived on her doorstep, in March of 2015, Courtney Allen was elated.
She rushed to the door alongside her dogs, a pair of eager Norwegian elkhounds, to greet them. “Is this about our case?” she asked. The police looked at her in confusion. They didn’t know what case she was talking about. Courtney felt her hope give way to a familiar dread.
Three days earlier, Courtney and her husband, Steven, had gone to the police headquarters in Kent, Washington, a suburb of Seattle, and reported that, for the past few months, they had been the victims of a campaign of online harassment. They had found a fake Facebook page under Steven’s name with a profile picture of Courtney, naked. Emails rained down in their inboxes; some called Courtney a cunt, whore, and bitch, and one they felt was a death threat. Her coworkers received emails with videos and screenshots of Courtney, naked and masturbating. The messages came from a wide range of addresses, and some appeared to be from Steven.
There were phone calls too. One to Steven’s grandmother warned that her house might burn down, with her in it, if she didn’t stay out of the Allens’ lives. There were so many calls to the dental office where Courtney worked that the receptionists started to keep a log: “Called and said, ‘Put that dumb cunt Courtney on the phone,’ ” one of them wrote in neat, bubbly handwriting. “I said, ‘She is not here at the moment, may I take a message?’ ” At one point Courtney created a Google Voice number to ask, “If I talk to you, will you leave me alone?” Instead, dozens of voicemails poured in: “Do you think I’m ever going away?” one said. “Now that my private investigator went and got all the tax information? There’s no job either one of you guys can have that I won’t know about and be there.”
The Kent police officer who took the Allens’ statement seemed unsure of what to make of their story. Courtney and Steven told him who they believed was behind the harassment: a man in Arizona named Todd Zonis with whom Courtney had an online relationship that she had recently broken off. She says she told the officers that she had sent Zonis the videos of herself while they were still involved and that he had sent ones of himself to her, but that she had deleted their exchange. In a report, the officer noted that, while Courtney and Steven insisted that his role was obvious, Zonis’ name barely appeared in the folder full of printouts and CDs that they had with them. The officer assigned them a case number and advised them not to have any more contact with Zonis.
Courtney began seeing a counselor. Her fear had become “an absolute paranoia.” She had night terrors and panic attacks if she saw police in the neighborhood. Zonis had told her that he was able to fly for free because his wife worked for an airline; Courtney feared he might show up at any time. She stopped letting her son play outside. “It just changed who I was,” she says. “I wasn’t functioning.” Almost worse than the fear was the guilt about what was happening to the people in her life. “No one can say anything to me about the horrible things that I’ve done,” she says, “because I’ve already said them to myself.”
“Me living was how I was going to beat him.”
Courtney had come to see the internet as a danger to which the people around her were oblivious. “Nobody’s safe,” she says. “If you’re on the internet, you’re pretty much a target.” She was appalled at what she saw her friends post—vacation updates that revealed their locations, pictures of their young children. She asked other parents at her son’s school not to post pictures of him, and one asked her, “Aren’t you proud of your son?” When she offered to share the recommendations that the FBI had sent her about keeping information private, only one friend responded—and only to ask whether such precautions were really necessary. Courtney locked down her own social media and stopped giving out her phone number. “Privacy has become top priority to me,” she said. “Anonymity has become sacred.”
In late June 2015, K&L Gates filed the Allens’ lawsuit against Zonis, seeking damages and relief related to defamation, negligence, intentional infliction of emotional distress, electronic impersonation, and invasion of privacy. Two months later, Zonis filed his own suit in federal court in Arizona, making similar claims against Steven. The complaint included excerpts of harassing emails that Zonis alleged were sent to him by Steven: “Too bad your whore wife is still without a child … did I mention that I own [Mrs. Allen] again?” and “All I had to do was act like the benevolent husband, and let you do the work … I plan on continuing to cause you pain like you can’t even imagine.” It took more than a year of motions and replies for the cases to be combined and moved to Washington, where the first case was filed.
In August Courtney received an anonymous email that ended, “Easier if one help everyone and kill self.” She’d had suicidal thoughts before. If she did kill herself, she thought, that might finally make the harassment stop. Maybe this was how she could save her family. She went to get a gun that was kept in a safe. Her hands were shaking and she fumbled the combination to the lock. She began to think about all the things she’d miss if she pulled the trigger—teaching her son to drive, retiring with Steven, the books she would never read. At last, still unable to open the safe, she gave up. “I decided he wasn’t going to win,” she said later. “Me living was how I was going to beat him.”
The following month the Allens took a trip to Hawaii. While they were away there were calls and emails, but none of them mentioned the trip. To Courtney it seemed like a small miracle: one moment in her life that belonged only to her. “It was a breath,” she said later. She would hold onto that precious realization for a long time: “I can keep some things private.”
But it was only a breath. Emails had begun coming to Steven’s account at the University of Washington—a job he thought had gone unnoticed until he got an anonymous email referencing the school’s mascot: “Public record. all. done.” Soon dozens of accounts, from the IT department to the university president, were getting emails about the Allens, often with images of Courtney. According to court records, two preschools in the Kent area also got emails that appeared to be from Steven; they said that he planned to come in with a gun and start shooting.“It wasn’t me!” Steven cried when the police called him at work. “I’m here!”
Gradually the Allens grew somewhat inured to the videos and emails—“There’s no one that I know who hasn’t seen me in very intimate detail,” Courtney says. “He can’t hurt me that way anymore”—though she continued to worry that their son would find the videos one day.
As Halloween neared, the K&L Gates lawyers received a threat they considered credible enough to heighten security. Later that fall, two FBI agents appeared at the Allens’. The couple hoped again that their troubles were ending at last. But while the agents were aware of their case, they said they were required to tell the Allens to cease and desist because Zonis had contacted them with evidence that he said showed the Allens were committing credit fraud against him. Later, Zonis would produce documents that he said showed Steven mocking Jennifer, sending her pictures of his penis, and threatening retribution; in one post, it appears that Steven had asked his Marriage Builders friends to make the threatening call to his grandmother.
“Everything he’s done, he’s claiming I’ve been doing,” Steven said later.
“Every bit of everything that we were accused of was what he did to us,” Zonis says.
IN JANUARY OF 2017, the lawsuit’s discovery process finally ended. Van Engelen and her colleagues had been working on the case for nearly two years. By then Zonis, after cycling through several lawyers, was representing himself, with his wife assisting. Before trial, the parties were required to attempt mediation. The judge encouraged a settlement, telling the Allens that a jury looking at the mess of competing claims would see everyone involved as having unclean hands. The Allens and their lawyers sent an offer to the room next door, where the Zonises were waiting: They would dismiss their suit if Zonis dropped his counterclaim and left the Allens alone. Zonis instead asked them to pay a large sum for what he said he lost. The case proceeded to trial.
On Wednesday, March 22, 2017, the Allens, their lawyers, and the Zonises gathered in a courtroom. Van Engelen watched from her seat as a colleague began questioning potential jurors: How many of you have made a friend on the internet? How many of you have ever taken a selfie? If someone takes and shares intimate pictures and they get published online, is that their fault?
Many of the responses were exactly what Van Engelen had feared. She summed them up: “This is trivial. Why am I here? I don’t want to be part of someone’s Facebook dispute. This is high school.” More than one person thought that if you made explicit videos of yourself, it was your fault if they were shared. Others felt the Allens, with their table of lawyers, had an unfair advantage. Van Engelen listened with growing nervousness. That night she went home and cried in the shower. She kept thinking: “What if somebody just decided that they weren’t going to listen to any of the evidence and they’d already made up their minds?”
Before the trial, Steven created a timeline of the harassment. Bateman decided to present it to the jury during opening arguments; because it had so many details, the lawyers had to print it on a 10-foot-long poster so that the jurors would be able to see the entries. This isn’t trivial, Bateman told the jury, detailing the false police reports, the enormous number of emails, the videos. Van Engelen felt her anxiety ease. “Right away you could see the jurors’ faces change,” she says. “I think they got that this wasn’t what they thought coming in.”
Van Engelen played some of the voicemails aloud. Courtney wept. She told the story of trying to unlock the gun.
Van Engelen called Courtney as her first witness. Courtney described her relationship with Zonis and said that she thought the videos would be private. Zonis had filed a motion to have the images of Courtney withheld from court. (He said later that the images were unimportant “flash” intended to distract the jury from what he had been through.) Van Engelen feared their absence would make the jurors take the case less seriously. In her questioning she described them as clinically as possible, so that Courtney wouldn’t have to: “Do you orgasm?” she asked. “Do they show your inner and outer labia?” Courtney testified for more than a day, the whole time too ashamed to look at the jurors. Van Engelen asked her to read some of the emails and played some of the voicemails aloud; she then read from the Google Plus profile that bore Courtney’s name and image. “I am a real whore wife,” Van Engelen read, continuing, “and have suffered for years with unsatisfying sex with a husband who is hung like a cocktail frank.”
“Did you write that about yourself?” she asked. “Did your husband write this about himself?” “No,” Courtney replied. Van Engelen continued her questions. Courtney wept. She told the story of trying to unlock the gun.
Zonis gave an opening statement. His wife cross-examined Courtney and later testified as her husband questioned her. Together the couple set out their version of the story: that they were Courtney’s friends who had tried to rescue her from an abusive husband. They said that Todd wasn’t romantically interested in Courtney and that Steven had been the one harassing them. The Zonises introduced emails and posts that they said were written by the Allens. But they were paper printouts with no metadata or digital trail to prove authenticity. When the lawyers requested a forensically sound copy of Zonis’ data, Zonis replied that his computer had malfunctioned—he blamed spyware that he claimed Steven had installed via an image file—and he had sold it; that he had copies of the files on CDs but Jennifer had thrown them out by mistake.
On the stand, Steven denied writing most of the emails or posts Zonis claimed were from him. The Allens had kept digital copies of emails that appeared to come from Steven, and the K&L Gates team showed the jury how those had been spoofed. They also showed that the email formatting on some posts didn’t match that of the Allens’ computer and that the time zone was not Pacific but Mountain, where Zonis lived. It appeared, the lawyers suggested, that Zonis had created the posts himself.
Zonis later countered that the discrepancies were proof that Steven had used spyware to steal the emails. The Zonises hired an expert witness to testify over Skype. He said that it was theoretically possible that the forensic trails leading back to Zonis could have been faked—though he conceded that he had never seen it done and had not reviewed the evidence.
The lawyers called Andreas Kaltsounis, a cyberforensics expert who used to work with the FBI and the Department of Defense. He explained to the jury how Tor networks and IP addresses function. He then presented a map showing that many of the seemingly separate accounts from which the Allens had received anonymous harassment were actually linked by overlapping IP addresses. One of the linked accounts was the Facebook page for “Jennifer Jones,” the account that used a picture of a tortoise. It could have been, as Zonis argued, an account that Steven, or some unknown person, created. But the lawyers were prepared. One day, months before the trial, as Van Engelen searched painstakingly through IP addresses associated with logins on the Jones account, she made a discovery: Among the many addresses, there had been one apparent slipup, a login not through Tor but from the Zonises’ home IP address. When she found it Van Engelen ran into Bateman’s office, yelling: “We’ve got him!” It would have been unheard of for someone to fake a login using Zonis’ IP address, Kaltsounis told the jury, because of a safeguard called the three-way handshake that requires hosts to establish a connection with the IP address belonging to the account before any information can be sent.
By the end of arguments, the Allens’ legal team had introduced 1,083 exhibits into evidence. The chart Van Engelen made just to organize the emails was 87 pages long. It was a level of scrutiny that few cyberharassment cases ever receive—and an illustration of what victims face when dealing with such a complicated case, especially if they don’t have access to pro bono help. K&L lawyers and paralegals had spent thousands of hours digging through the evidence. The value of Van Engelen’s time alone was in the ballpark of $400,000.
Zonis never took the stand. He blamed the lawyers for purposefully taking up too much time questioning Courtney and Jennifer, and introducing endless emails that he said had nothing to do with him. Van Engelen was disgusted: “He got his one big chance to tell his side of the story, and he didn’t take it,” she says. “This is somebody who’s very strong behind a keyboard. And when the opportunity arises to actually prove himself and be vindicated, he just folds like a flower.”
On Thursday, March 30, Van Engelen stood up to deliver her closing argument. It was the first time she’d ever done so in a real court.
She began by playing one of the voicemails that Zonis had admitted to leaving—“How does it feel to know that I’m never, ever, ever going to stop?” Then she turned to the jury: “Someone needs to tell him to stop.” She described Courtney’s lowest moment: going for the gun. She reminded them of a message promising isolation, shame, and ridicule, and the email from Zonis’ personal account after Courtney got a protective order: “Glad that bullshit symbolic gesture is out of the way.”
It was impossible to trace all of the harassment directly to Zonis with cyberforensics, Van Engelen told the jury, so she encouraged them to also consider repetition of details (like the sex toy he had sent) that were in both the anonymous messages and voicemails from Zonis. She talked about the problems with the evidence that Zonis had introduced.
“Do not,” Van Engelen concluded, “let this be another bullshit symbolic gesture. Tell him to stop, hold him liable.”
In his own closing statement, Zonis reiterated that “the stuff doesn’t trace back to me,” talked about the difficulty of being cut off from his parents, and cast himself as a scapegoat: “And what if I’m not the devil? Then what do you do? Oh, my God, we were wrong. We can’t have that, can we?” He told the jury that not testifying wasn’t his choice; the judge said this wasn’t true.
The K&L lawyers had not asked for a specific amount of compensation. The Allens told their lawyers that their goal wasn’t money but simply an end to the harassment.
The next afternoon the jury came back with a decision.
The 12 jurors had been given forms to explain which of the Allens’ and Zonis’ claims they deemed true and which they rejected. For the first claim, “Did Todd Zonis electronically impersonate the Allens?” the presiding juror circled yes. The jury also chose yes for “Was the electronic impersonation a proximate cause of the injury or damage to the Allens?” The form offered a blank space to write in the total amount of damages warranted. The jury’s answer: $2 million.
And so it went. The jury found each of the Allens’ other claims against Zonis—intentional invasion of privacy, intentional infliction of emotional distress, and defamation—justified, and to each they affixed a boggling sum. The jury did agree with Zonis on one count: The Allens had “intruded upon the seclusion” of the Zonises, but they found that no harm had resulted. When the amounts awarded to the Allens were totaled, they added up to $8.9 million. It was a record for a cyberharassment case that didn’t involve a celebrity. The jury “didn’t believe it was trivial anymore,” Van Engelen said with satisfaction.
AFTER THE TRIAL was over, the Allens and some of the jurors had the chance to meet outside the courtroom. One of the jurors came up to Courtney, gave her a hug, and said, “You’ve been through so much.” Neither the Allens nor their lawyers expect to actually see the award money, but that moment in the hallway felt just as valuable.
“The fact that other people can see it, and they see the crazy in it, helps me feel that I’m not insane,” Courtney said later. The Allens’ deepest hope, though, remained simple: that the harassment would stop.
For more than a month after the trial, it seemed they would get their wish. Then one afternoon Courtney logged on to her computer and found a new email. It read, “pun ish men t w ill soo n b han ded out to the wic ked. you rti me is sho rt. mis sin g fam ily we wil lno t. pri ce for act ion to be pai d y et it is.” More emails followed. Courtney felt a mixture of dread and exhaustion. It wasn’t over. “I’d love nothing more than for us to be left alone,” she says. “Do I expect that to happen? No. I expect this to be in our lives, in some capacity, forever.”
- ALEX MARAre We Ready for Intimacy With Androids?
- BRIAN RAFTERYThe Replicant: Inside the Dark Future of Blade Runner 2049
- WIRED STAFFHow to Survive the Great Tech Panic of 2017
At the time this story went to press, law enforcement had not yet indicated whether criminal charges would be filed. Gary Ernsdorff, of the King County prosecutor’s office, allowed that he kept an eye on the case. Cyberharassment, especially with private images, “is dropping a bomb in somebody’s life,” he said.
After the trial Zonis filed a notice of appeal. He felt the trial was unfair and that the proceedings hadn’t paid enough attention to what he believed the Allens had done to him. His losses, he said, were real and numerous (to the list he added what he considered stress-induced health problems), while the Allens’ were petty, just “flash” from a “hot-button issue.” He still denied that his relationship with Courtney was an affair or that he had access to the videos of her or sent the anonymous emails. He also said, in a phone interview, “Anything that I said or did was reactionary” and “If they wanted me to plead guilty to harassment, no problem. What am I harassing them about?”
Soon after the trial, a blog appeared in Zonis’ name. In it he questioned the way the trial was run, disputed its findings, excoriated the people involved, and posted much of the same evidence against Steven that the lawyers discredited at trial. “My name is Todd Zonis and I lost my family, my home, my future, and probably my life, and while my life may not teach you anything, hopefully my death will,” the blog began. The evidence he posted included the images of Courtney and a note: “Please feel free to download any and all of the materials that I have posted here, and use or distribute them as you see fit.”
Brooke Jarvis (@brookejarvis) is a writer based in Seattle