Man Gets 8 Year Prison Sentence For Hacking, Extorting Underage Girls

Months long campaign targeted dozens of high school girls for nude photos

Feb 07, 2017 at 2:16 PM ET

A New Hampshire man has been sentenced to eight years in prison for a long campaign of gaining access to underage girls’ online accounts to extort nude photos from them.

Ryan Vallee, 23, was sentenced Monday after previously pleading guilty to numerous counts of hacking, cyberstalking, extortion, and identity theft. Many of the girls were former high school classmates, but according to the dates of the offenses, Vallee would have been a legal adult at the time of at least some of the offenses, which began in 2012.

Some details of Vallee’s offenses remain unknown, as the victims’ names are private to protect their identity. After he was arrested for extorting photos from 10 girls, investigators discovered a second trove of offenses, leading police to re-arrest him while he awaited trial.

According to his initial indictment, Vallee developed a clear habit of using social engineering tactics to break into a young woman’s email or social media account, changing her passwords, and taunting her over text message to send him nude pictures, and then often using those photos to extort more.

“I hacked your Facebook if you don’t show me your tits, I will set this as your profile picture,” he sent to one underage girl, according to his initial indictment.

He also used access to a girl’s Facebook account as a launching point to break into more girls’ accounts, by posing as one victim online to figure out answers to other girls’ security questions to change their passwords.

In another case, according to the indictment, Vallee broke into a girl’s Amazon account, which stored her address and credit card number, and ordered a sex toy sent to her house. He then demanded further pictures to not make additional charges to her credit card.

At one point Vallee told a victim that he was “untraceable,” possibly referring to his habit of using different people’s Wi-Fi connections to log into the girls’ Facebook accounts. A given internet connection will assign a user an IP address, which usually resolves to a physical address.

But Vallee’s operational security apparently ended there. According to testimony from a Department of Justice lawyer, law enforcement first got a court order to compel Facebook to share the historic IP address used to log onto Facebook to harass Vallee’s victims. They found those addresses resolved to three different places: a Lowe’s Home Improvement Store where Vallee worked; an apartment in the building where Vallee worked, and a Mexican restaurant near where Vallee’s mother’s house, where he lived.