Slate has relationships with various online retailers. If you buy something through our links, Slate may earn an affiliate commission. We update links when possible, but note that deals can expire and all prices are subject to change. All prices were up to date at the time of publication.
From The United States of Anonymous: How the First Amendment Shaped Online Speech, by Jeff Kosseff. Copyright © 2022 by Cornell University. Reprinted by permission of the publisher, Cornell University Press.
The story of Ryan S. Lin and the cyberstalking campaign that he unleashed on his former roommate and others reveals some of the harmful ways that people can operate anonymously. Although Lin’s story received some media attention in 2018 when he was sentenced to 17.5 years in federal prison, none of the coverage that I read documented the full extent of the harms, and how his ability to shield some of his identifying information contributed to his persistent campaign of harassment.
This story comes from the extensive court record of his prosecution. As a warning, some details are graphic and shocking; I include them because it is important to avoid minimizing the damages of the cyberstalking campaign.
Ryan S. Lin was born in China in 1992 and moved to the United States a few years later. As a young child in Connecticut, his mother said, he had exhibited antisocial behavior, though he received good grades. His behavior appeared to deteriorate in middle school, when he was suspended for, among other reasons, an inappropriate message that he sent to a girl in his school. In seventh grade, he taught himself how to code. Lin was suspended six times in middle school. Lin was seen by a mental health provider, who concluded, “Ryan has his own rules and doesn’t follow social rules.” Due to his father’s health problems, Lin’s family did not continue Ryan Lin’s therapy. As a high school student, he hacked his classmates’ Facebook profiles and harassed them. He was admitted to Carnegie Mellon University, where he studied for three semesters. He studied at a community college, and then Rensselaer Polytechnic Institute, where he graduated magna cum laude with a computer science degree in 2015. He served as webmaster of RPI’s International Chinese Study Association, but as a result of a dispute he deleted the group’s website. Two classmates of Lin from Rensselaer would later tell federal law enforcement that Lin had harassed them, including by creating false social media accounts in one of the student’s names. The students said that they reported Lin to school administration and received cease and desist orders against him.
Lin moved to the Boston area after graduating, though he had problems at work due to conflicts with superiors, difficulties socializing with others, and troubles with focusing.
He responded to an advertisement for a room rental in a Watertown, Massachusetts, house, and moved in in late April or early May 2016. Three other people were living in the house, including Jennifer Smith, a woman in her 20s who worked at a restaurant and in pet care. (Jennifer Smith is not her real name; it is the pseudonym provided to her in an FBI affidavit.)
Within a few weeks of moving into the house, Lin purchased marijuana from Smith, according to the FBI. She awoke to him banging on her bed room door in the middle of the night, alleging that she did not provide the agreed-upon amount of marijuana. Lin sent text messages to Smith, at times referring to her recent abortion.
Smith had not discussed her abortion with Lin or the other people in the house, but she had written about the abortion—and her former romantic partner, Michael—in an electronic journal that could be accessed from her MacBook. Smith’s laptop was not password protected, and contained a document with all her online account passwords. She stored the laptop in her bedroom, which did not lock.
Toward the end of May, when Smith was alone in the house with Lin, their shared toilet overflowed. The plumber found in the toilet the bottles from Smith’s anxiety and depression medications, which had been missing. Lin denied flushing the bottles. Smith moved out of the house within days. About a month later, Smith returned to pack her belongings, and saw printouts of her journal in her bedroom, the FBI wrote. When she confronted Lin, he told her that he had not printed the journal.
In a text message to one of the two remaining roommates, he identified her employer and exact earnings. He allegedly told one of the roommates that he had placed hidden cam eras in the home. The roommates complained to the landlord, and by around Aug. 1, 2016, Lin was no longer living in the home.
A few days before Lin was evicted from the house, an email was sent from an account that appeared to belong to Smith (but did not) to Lin, Smith, the two other housemates, and two other people, according to the FBI. The email included excerpts from Smith’s online journal, along with explicit body images and pictures of Smith’s face. Lin responded to the email chain. “It is fascinating how someone can be so incredibly de- pressed, paranoid, and slutty at the same time,” he wrote. “I am quite sure I will never read such an intense story again that involves so much sluttiness and crazy thoughts.” Smith also began receiving offensive messages on social media. For example, an Instagram account named “jsnmma” in December 2016 posted, “It would be so nice if you could go back in time further and undo your abortion.”
Lin’s unauthorized access to her computer and accounts provided him with not only the diary, but also private images and a sexually suggestive video of Smith, the government detailed in court filings. He created a collage that included pictures of Smith’s face, Smith’s buttocks in underwear, a female’s naked breasts, and a vagina. He distributed the diary, the video, and the images widely. For instance, in April 2017, an email account purporting to belong to Smith sent an email to local university staff, police department employees, staff at Smith’s former schools, and others, that promised to teach the recipients how they could “spice up their sex life.” The email included intimate portions of Smith’s diary, the video, the collage, and her medical records.
Lin also used text messaging services, often one based in Canada, to anonymously send messages to Smith. Among the messages that he sent her: “why get abortion?” “why dont [sic] u kill yourself,” and “SUCH A DISGUSTING GIRL. KEEP YOUR LEGS CLOSED AND KILL YOURSELF!!!!!!” Pretending to be Smith, Lin posted ads on various dating websites, seeking people to fulfill fantasies of rape and violent sex. One ad was titled “Would anyone like to tie me up tonight?”
Lin took advantage of local police departments’ anonymous tip submission system. On July 24, 2017, Lin caused the Waltham, Massachusetts, police to visit Smith’s home by submitting tips that there was a bomb at the house, and that drug activity was occurring at the home. The next month, he sent anonymous tips to four other local police departments about a bomb at Smith’s home address. “The residents are not going to wake up to see the morning, or they will wake up disfigured. BOOM!” Prosecutors also identified more than 100 anonymous bomb threats that Lin had fabricated, claiming that bombs had been planted at Bentley University, Waltham High School, and other nearby locations.
Lin used information from Smith’s online accounts to apply for unemployment benefits in Smith’s name, cancel her driver’s license registration, and apply for financial services from Bank of America.
Smith was not the only target of Lin’s harassment campaign. He repeatedly sent vulgar emails and text messages to Smith’s mother, including threats to rape both Smith and her mother. He emailed the collage and diary excerpts to Smith’s mother and her mother’s coworkers. He emailed child pornography to Smith’s mother, thanking her for the pur chase and including the last four digits of her credit card number.
Smith’s father, a surgeon, also was among Lin’s targets, prosecutors detailed. Pretending to be Smith, Lin sent an email to Smith’s father and his coworkers. The email contained the collage, with a message: “I am very proud of my daddy who is a doctor here! He is such a great doctor and part of that is because I let him ‘operate’ on me when I was little! I still am and always will be daddy’s little girl, so enjoy all.” The harassment caused her father to install an alarm system and security cameras at home and purchase two firearms to protect himself.
Anonymity and pseudonymity fostered Lin’s continued campaign against Smith, her family, and others. When people saw Lin’s messages, at least some may not have had any way of determining with certainty whether they came from the person he was pretending to be or from an impersonator. As federal prosecutors would write in court filings, many of his traumatized victims “suspected Lin but were not certain who their stalker was, why he had targeted them, how he had found them, or how he knew so much detailed personal information about them.”
In a brief filed in federal court, prosecutors described the great care that Lin took to guard his identity when carrying out his crimes. “He used TOR to connect to VPNs and overseas providers, he encrypted his hard drives, he used over 1,000 different IP addresses in connection with his criminal conduct, he used hundreds of separate accounts with well- known overseas encrypted e-mail providers, he used dozens of spoofed text providers, and multiple VPN services,” they wrote. “For the bomb threats in particular, when placing the threats, Lin used TOR and VPNs to then connect to the anonymous online tip lines, knowing that they were not logging his IP addresses. He alternatively used well-known overseas email providers that do not log and do not respond to law enforcement.”
Yet Lin left enough of a trail to allow dogged investigators to eventually link him to the acts. The FBI eventually obtained access to records from his Gmail account, including screenshots of an iPhone that show anonymous texting and encrypted email apps. Lin also responded on Twitter to a VPN provider’s tweet that it did not log its customers’ traffic: “There is no such thing as VPN that doesn’t keep logs. If they can limit your connections or track bandwidth usage, they keep logs.” This tweet would prove prophetic, as the lack of complete anonymity protections on VPNs would be essential to the FBI’s ability to tie him to the cyberstalking.
A key piece of evidence came from Lin’s activities on Rover, a pet service app that Smith used. The app matches pet care providers, such as Smith, with potential clients and allows clients to pay their pet care providers. In April 2017, “Ashley Plano” asked Smith via Rover to walk her dogs. Ashley Plano’s Rover account had recently been created using teleportxf@gmail.com. Smith called Ashley’s phone number, but nobody answered.
Later that day, Ashley messaged to say she did not want Smith to walk her dog, but the communications caused Smith to disclose her phone number by calling “Ashley.”
A user of an anonymous text messaging service began text messaging Smith at that phone number two days later. Also on that day, Ashley Plano requested the deletion of her Rover account.
The FBI associated Lin with the “Ashley Plano” Rover account because the Gmail account that “Ashley Plano” used to create the Rover account was accessed on the same day as a Gmail address known to belong to Lin, from the same IP address. The IP address belonged to WANSecurity, a VPN provider. On three more days in April, the Rover account and Lin’s Gmail account were accessed via the same IP addresses provided by another VPN provider, Secure Internet LLC.
Records from another VPN provider, PureVPN, found that a user had accessed both Gmail accounts from the same IP address provided by WANSecurity. “Significantly, Pure VPN was able to determine that their service was accessed by the same customer from two originating IP addresses: the RCN IP address from the home Lin was living in at the time, and the software company where Lin was employed at the time,” an FBI agent wrote.49
Lin’s former employer allowed the FBI to examine his old computer, but the former employer had already reinstalled the operating system on the computer when the FBI requested access. FBI employees recovered some artifacts, including visits to news articles about area bomb threats, visits to an anonymous text message site, and proof that PureVPN had been installed on the computer.
When law enforcement arrested Lin on Oct. 6, 2017, they conducted a search of his home and recovered parts of an electronic diary that Lin had kept. The diary entries document the methodological way in which Lin carried out his campaign against Smith and the role that ano nymity played in his crimes.
In May 2018, Lin pleaded guilty to cyberstalking, distribution of child pornography, hoax bomb threats, computer fraud and abuse, and aggravated identity theft.
While he was jailed in the Wyatt Detention Center, inmates said that he had tried to hack the Law Library’s computers, and an officer found in Lin’s cell papers that explained how to use anonymity technology such as Tor to access “CP” (presumably “child pornography”). A detainee informed the U.S. Attorney’s Office in August 2018 that Lin had told him that Lin planned to bomb two courthouses and kill two female prosecutors on his case.
Victims, including Smith and her mother, spoke at Lin’s Oct. 3, 2018, sentencing hearing. They told Judge Young about the chaos that Lin caused in their lives and the community. “My life devolved into waiting for Ryan’s next attack,” Smith said at the hearing. “I couldn’t work. I couldn’t hide. I couldn’t use my computer. I was afraid to leave the house. I also was afraid to be at home. The phone in my pocket was a weapon being used against me.”
Smith recounted the seemingly endless torrent of horror that Lin unleashed on her and others and the tremendous emotional and financial toll that it took on her for more than a year.
“I hope that in the future the legal system will be more capable of quickly dealing with internet crimes to protect people from heinous abuse amplified by anonymity and the ubiquity of the current technologies in daily life,” she said.
Despite the government’s overwhelming presentation of individualized and communitywide harm, Lin’s attorney requested that Young sentence Lin to seven years in prison—about 10 years less than what the government sought. At the sentencing hearing, Lin’s lawyer, J. W. Carney Jr., stressed that Lin’s “undiagnosed profound autism” had shaped his behavior, but Judge Young appeared to struggle with that excuse. “The criminal acts are not the pattern of someone who suffers with autism,” Young told Carney. “Even if I grant those things, these criminal acts seem wholly at variance with what I know about autism.”
Lin briefly addressed Young before receiving his sentence. He apologized to his victims. “I’m very sorry for turning your lives into a nightmare and I deeply regret my actions,” Lin said. “And I really wish I could just turn back that clock and undo all those foolish decisions, but unfortunately that’s clearly not possible.”64 Lin said he planned to continue receiving treatment while in prison, and that he hopes to use his “computer skills to, um—to do good things when I get out, to innovate and improve society rather than waste my life and my time just bothering people on the internet.”
Lin’s apology did not appear to sway Young, who sentenced Lin to 17.5 years, which the government requested. Young said that Lin’s conduct was “monstrous,” and the fact that they were committed from a computer does not diminish the crimes. “In fact it ought to bring home to all of us how interconnected we are and what havoc can be wreaked by the improper evil criminal conduct in which you so gleefully engaged,” Young said.
Although I could not understand Lin’s motives, I wanted to get a better understanding of what the impact was, beyond the black-and-white words of the court record. So I arranged to speak with Smith through her attorney, Carrie Goldberg, who specializes in representing victims of cyber harassment, stalking, and revenge pornography. (I count Goldberg as a good friend, and I deeply admire the crucial work that she performs.)
With remarkable candor, Smith discussed what it was like “watching this person who has no control or social aptitude to use every platform I have ever used to steal my identity, harass me.”
Lin was someone who Smith lived with for a month and barely knew, making it hard to explain the barrage of emails and text messages to her coworkers, friends, and family. “That was one of the more confusing things to people who didn’t know what was going on,” Smith said.
From the start, Smith said, she knew Lin was behind the stalking and harassment. But the police were of little help because he disguised himself so well. One local police detective was determined to help her—a warrior, she called him. He even attended cybersecurity classes to learn more about the technology that Lin was using, and he issued subpoenas to many platforms. But he could not unmask Lin. “The police weren’t really able to do anything other than watch my house and try to make sure that nobody showed up.”
Smith sought help from two different law firms, but they were of little use. One firm thought that the perpetrator was another former roommate of Smith and tried to convince her to hire a private investigator, but Smith was certain that it was Lin.
In the early summer of 2017, a coworker told Smith about her former classmate, Goldberg, and the work that she did representing people in similar situations. Smith called Goldberg, and approached her with suspicion, because by that point she was worried that anyone she spoke with might be part of Lin’s harassment. She asked questions about her back-ground to ensure that she was speaking with Carrie Goldberg, and not an impersonator. Goldberg had her secretary call Smith back from her main office line, helping to ease Smith’s concerns.
At that point, Smith knew that she found who she needed. Goldberg worked with her contacts at the US Justice Depart ment, including Mona Sedky, a veteran lawyer in the Justice Department’s Computer Crime and Intellectual Property Section who has prosecuted a number of high-profile and shocking crimes involving cyberstalking, sextortion, and other computer crimes. Within a few months, the Justice Department identified and charged Lin.
Documenting the constant barrage of evidence was like a second full-time job for Smith.
“I was lucky because I was a sympathetic enough victim with the economic means to afford help and the fortitude to get justice,” she said. She also questions whether federal authorities would have been interested if his harassment of her had not included bomb threats and child pornography. “It could have easily not been an FBI case,” she said.
The child pornography and bomb threats contributed to the length of his sentence. Without those factors, the sentence might have been shorter. But to Smith, 17.5 years is like a ticking time bomb. I spoke to her about two years into the sentence, and she was convinced that when he is released, he will continue to target her. “I feel like I have a deadline,” she said. She is taking computer classes to learn how to protect herself online.
As Smith recounted Lin’s persistent campaign against her and the way that it has effectively silenced her, I could not help thinking of feminist legal scholarship, beginning in the 1970s and 1980s with Andrea Dwor kin and Catharine MacKinnon and extending to today’s work by scholars such as Mary Anne Franks. They establish that advocacy for “free speech” often focuses on protecting the speech of men, even when it has a chilling effect on the speech of women.
I spent days immersed in Ryan Lin’s case file, struggling to figure out how to prevent future devastation caused by similar online crimes. There are no easy law-based solutions, in part because Lin’s use of anonymity is not straightforward. The harms arose not because Lin’s identity was a complete mystery, but because he used anonymity protection to temporarily prevent his prosecution. Many of his victims suspected he was behind the harassment campaigns, but the anonymity technology such as Tor and VPNs made it harder for law enforcement to identify him with sufficient certainty for prosecution and likely enabled him to carry out the malicious acts for longer than he could have under his real name.
The First Amendment did not shield Lin’s identity from disclosure. Even the most stringent First Amendment anonymity safeguards allow for unmasking in particularly compelling circumstances, and a plaintiff could have a very strong case against Lin. The likelihood that a court would allow Lin’s unmasking suggests that the First Amendment anonymity framework provides a reasonable balance between free speech and the need to redress harms. A shortcoming of the subpoena-based unmasking system is that by the time the perpetrator is identified, much harm already has occurred. And filing a civil lawsuit against Lin probably would not have helped Smith stop the barrage of harassment, as Lin still would have been free to keep posting, and a lawsuit may have angered Lin and prompted even more persistent online harassment. So reining in the First Amendment protec- tions for anonymity would not necessarily prevent harassment campaigns such as the one carried out by Ryan Lin. The legal system eventually worked to unmask Lin and bring him to justice, but the harassment went on for far too long and had indelible effects on Smith and others.
It would have been harder, if not impossible, for Lin to carry out his campaign for so long had he been unable to use anonymizing technology such as VPNs and Tor and required to operate online under his real name. Yet it is difficult to conceive of how such a requirement could be effective, short of a law that requires all online platforms to register and display people’s real names, while also banning anonymizing technology. Such a law would almost certainly run afoul of the First Amendment, as it would effectively silence not only harassers, but also citizen journalists, political dissidents, and other speakers who have legitimate reasons to seek anonymity. And even if such a prohibition on any online anonymity could somehow pass constitutional muster, a dedicated harasser likely could circumvent the requirement, perhaps by falsifying identifying information or using contraband technology. While a real-name requirement and a legal prohibition on anonymizing technology might prevent some potential harassers from being anonymous online, I question whether such a ban would be effective for computer experts such as Lin.
In her excellent memoir, Nobody’s Victim, in which she recounts representing Smith and many other targets of cybercrime, Carrie Goldberg describes two schools of thought that drive abhorrent anonymous online behavior. The first, known as the “online disinhibition effect,” holds that “people who engage in bad behavior online under masked identities have slipped into a sort of alternate reality,” and that due to their online anonymity, they “feel free to engage in unbridled assholery with zero repercussions.” Another line of thinking, Goldberg writes, is that online trolls are “more than merely a product of their environments,” and are instead “evil, tending toward cruelty even when not online.” The second explanation suggests substantial challenges in combatting online harms, and that we must do more than just address whether people can remain anonymous. How do we combat that underlying cruelty?
Improvements to the criminal justice system might help to prevent some similar crimes, but that also is far from certain. As evidenced by Lin’s 17.5-year sentence, many laws already presented the specter of substantial punishment. Judge Young sentenced him to the maximum number of years in prison allowed under the plea agreement. I agree with Young that the fact that the crimes were committed via computer does not diminish the harms. Lin’s sentence is remarkably long compared to many other computer crime cases. Still, the existence of the federal criminal laws did not deter Lin from committing these persistent crimes. Perhaps Lin truly believed that his computer skills would prevent him from ever being identified. Perhaps Lin was unaware of the possible punishments. Or perhaps something else caused him to disregard the risk of substantial prison time. I can only hope that the media coverage of Lin’s heavy prison sentence deters at least some potential cybercriminals. But Lin’s case is unique in that skilled federal government cyber experts took on the investigation. The FBI’s capacity and jurisdiction are limited, and we cannot expect that federal agents and prosecutors will be able to investigate every cybercrime. At the very least, local and state police need more dedicated cybercrime expertise, along with effective and punitive laws against cyberstalking and other computer crimes.
Ryan Lin’s story reveals a broad societal failure. For years, a young person had harassed others without the necessary intervention from healthcare providers, schools, and law enforcement, despite repeated indications of problematic behavior. The many people who Lin victimized were harmed by the system’s failure to address so many warning signs. Anonymity technology was a tool that allowed his harassment to last longer than it otherwise would have, but the underlying problems were rooted far deeper. Thanks to legal, technological, and social norms that have developed over decades, we live in a culture of anonymity empowerment. While this culture creates many opportunities for society, it also means that some people may misuse their anonymity to harm others. Our institutions must adapt to this culture of anonymity empowerment to better identify potential problems at the outset.
Future Tense is a partnership of Slate, New America, and Arizona State University that examines emerging technologies, public policy, and society.
