“My heart dropped,” Madison said. “It’s scary thinking, ‘How did someone get these? Where did they get them? Who else are they sending these to?’”

Whoever was spreading the photos wanted more: Facebook users registered under fake names such as “Joe Bummer” sent her direct messages demanding that she send new, explicit photos, or else they would further spread the already leaked photos.

Some pictures landed in her father’s Instagram messages, while marketing clients told her about the nude images that came their way. Madison was at a friend’s party when she got a panicked call from the manager of a hotel restaurant where she had worked: The photos had made their way to his inbox.

After two years, hoping a new Florida law against cyberharassment would finally end the torture, Madison walked into her local Melbourne police station and shared everything. But she was told that what she was experiencing was not criminal.

What Madison still did not know was that other women were in the clutches of the same man on the internet — and all faced similar reactions from their local authorities. Without help from the police, they would have to pursue justice on their own.

Technology has raced ahead in the 10 years since Madison’s photos first appeared online, and artificial intelligence combined with social media has made it even easier for abusers to distribute intimate images on the internet without consent. But legislation to protect victims still falls short. Most of the 48 states and the District of Columbia that have laws prohibiting the nonconsensual distribution of intimate images, many passed in the past decade, require that victims prove that the distributors of their photos intended to harm them.

The Biden administration has recently pushed for further protections for victims of nonconsensually distributed intimate images. (The widely used term “revenge porn” has fallen out of favor since not all cases are motivated by revenge.) In late April, the White House held a meeting with legislators, survivors, and legal experts on the topic amid what a Pew Research Center survey shows are rising rates of severe forms of online harassment.

A bipartisan bill that Sens. Amy Klobuchar (D-Minn.) and John Cornyn (R-Tex.) introduced in February to combat the nonconsensual distribution of intimate images has not advanced out of committee. “One of the primary strengths of the bill is that it does not include intent to harm as an element of the offense,” said Mary Anne Franks, a professor at the University of Miami School of Law and the president of the Cyber Civil Rights Initiative. The proposed legislation is based on a model federal statute that Franks developed in 2013.

These intent-to-harm requirements often prevent prosecutors from moving forward with cases, according to Danielle Citron, a professor of law at the University of Virginia. In her view, laws need to deter intimate-privacy violations, “and state laws with intent requirements are not serving that interest if cases aren’t brought.”

Although lawsuits can help victims fight back — a woman in Texas was just awarded $1.2 billion in a case against her former boyfriend — there is a downside to the civil route: a lack of privacy in public records if the court doesn’t allow the plaintiff to sue as a Jane Doe or John Doe (it’s up to the judge).

Franks, who welcomed the widespread adoption of state laws, said “a federal law would provide a uniform definition of the crime that would apply across jurisdictions, providing victims with an urgently needed, clear path to justice.”

Florida passed its sexual cyberharassment statute in 2015, making the online publication of sexually explicit images without the depicted person’s consent a misdemeanor — a felony for subsequent convictions — if intent to harm can be proved. And intent is hard to determine when victims do not know their harassers’ true identities. In Madison’s case, her harasser’s anonymity masked whether his intent was to cause her “substantial emotional distress,” a condition required by the statute in Florida, where Madison was living and working.

Even when the perpetrator can be identified, intention is hard to qualify. Who could say whether Madison’s tormentor was motivated by a desire to inflict pain or by his own sexual pleasure?

For Madison, the harassment continued to escalate after she went to the police, so she asked her twin sister, Christine, who had recently passed the bar exam, to help. But Christine, who had taken a particular interest in environmental law, knew almost nothing about cybercrimes. As she researched the issue, she realized how little the law could do to protect her sister.

Meanwhile, Madison felt embarrassment when meeting new people, knowing that they would see her nude photos if they looked up her name online. Still, in 2016, she let a man into her life, dating Jeffrey Geiger, whom she met through the company for which she works, which is affiliated with Geiger’s family business.

Geiger lived in Maine, so they traveled to see each other as much as possible. For Thanksgiving in 2016, they took a vacation to the Florida Keys. Madison tried to stay off social media during their trip, but she made an exception for one beachfront sunset. She posted a photo to Snapchat.

The next morning, she had a Facebook message from one of the accounts that had been harassing her: “You guys having a great time in the keys I see.”

Madison realized he must have seen her Snapchat post. She hurried to take a screenshot of the followers who had seen her story. There were 39 views. And the very last person who opened it was Christopher Buonocore, someone she knew from college.

Still, Madison wondered whether he could be her tormentor. A Snapchat view was far from proof.

By late 2017, Madison said, her relationship with Geiger was falling apart. She always kept watch for her photos resurfacing on 4chan, and it was around that time that Madison found more pictures, including some of Christine, being shared around the internet.

Geiger had helped Madison upload some of her modeling photos from CDs to Dropbox, according to a complaint Madison and Christine later filed in civil court. A few boudoir shots Christine had taken for her husband were in the mix. They were now online, along with sexual photos Madison had privately shared with Geiger. The twins alleged in their complaint that when they confronted Geiger, he admitted to contacting one of the accounts that had been harassing Madison. (In his response to the complaint, Geiger admitted to helping Madison upload photos to Dropbox but denied the other allegations.)

The anonymous marauder finally got the new photos for which he had been asking. And now he was targeting Christine, too.

Madison swiftly ended the relationship, according to the complaint. Geiger left a handwritten note for Christine, a copy of which she included in the court records: “I am an idiot and don’t deserve your sister. I’m not asking you to forget or look past what I did. I’m just hoping one day you’ll forgive me. … I swear on everyone I love that I was only trying to help.”

They reported Geiger to his local police department in Lewiston, Maine, but then-Assistant District Attorney Lisa Bogue decided not to prosecute, according to a police report, citing “one key element missing from the case against Geiger.” That was malicious intent. The report said Geiger had emailed Madison to say he “only wanted to send the photos to the male in New York to gain his trust and obtain more information.” Bogue declined to comment.

In closing the investigation, the reporting officer wrote: “It does not appear Geiger intended to harass, torment or threaten either [sister].” (Geiger declined to comment when reached by phone.)

With the help of a lawyer, Madison and Christine were able to get some of the images removed from 4chan using copyright takedown requests, a method suggested by the Cyber Civil Rights Initiative. But without police assistance — and, also crucial, proof of who was spreading the images and for what reason — they could not hold anyone criminally accountable.

Clues across the internet

In September 2018, the sisters filed a lawsuit against Geiger and a “John Doe,” claiming invasion of privacy, intentional infliction of emotional distress and other torts.

Their primary goal was to open discovery, allowing them to subpoena 4chan and internet service providers for IP addresses and contact information to expose their John Doe.

The sisters also continued their investigation outside of court while they waited for their subpoenas to be answered. They tracked their harasser across the internet, looking for recurring Kik Messenger usernames he shared on 4chan to solicit more photos of victims and for patterns in punctuation — for example, abundant ellipses between clauses but no periods at the end of long paragraphs. It looked like the same 4chan user was sharing images of four other women, too. When Madison and Christine looked up those women on Facebook, they saw they all had one connection in common — Chris Buonocore.

She remembered him as an awkward guy from Long Island, always wearing a Yankees hat over his moppy brown hair. He attended the Florida Institute of Technology with Christine and was a member of the same fraternity as Christine’s future husband, Dana Messier. Madison played softball at the nearby Brevard Community College, so Christine, Dana and some of Dana’s fraternity brothers — including Buonocore — would drive up to watch the games.

Madison and Christine felt immediate relief, followed by a sickening realization: At the height of his harassment campaign against Madison, Buonocore had attended Dana and Christine’s wedding in March 2017.

It was a massive affair with hundreds of family members and friends, including Dana’s fraternity brothers from his graduating class. It did not occur to anyone that, as Madison stood up and sang a parody version of Taylor Swift’s “Love Story” for her maid-of-honor toast, the man who had caused her years of agony was in the audience, watching. “I never even had interactions with him at their wedding at all, but he was definitely there,” Madison said.

The sisters were hesitant to contact the other victims. They did not know whether any of them had strong loyalties to Buonocore. But in spring 2019, Christine decided to make contact.

One was Buonocore’s ex-girlfriend, who had been enduring his sexual harassment since 2013, according to a plea agreement later signed by Buonocore. She filed a report in 2016 in Osceola County, Florida, saying that an unknown person had posted on 4chan nude photographs she had taken for a weight-loss program and kept on her laptop, but the report does not say whether the poster was ever identified.

Another of the women was one of Buonocore’s relatives. In 2016, when she was 14 years old, Buonocore shared photos of her in her school uniform on 4chan, asking others for advice on how to trick her into sending him nudes, according to the plea agreement. He repeatedly expressed wanting to have sex with her, according to the plea agreement. In one post, he wrote, “I have a strong desire to watch [her] get raped,” and he offered to pay someone to do it, the plea agreement said.

The third victim was a childhood friend of Buonocore’s from New York. Although she was now an adult, he had somehow obtained an old photograph of her bare chest that she had sent to a boyfriend when she was just 15, the plea agreement said. Buonocore spread it online, and she started receiving text messages demanding that she “cooperate,” then phone calls from strange voices saying things like “you have on a nice blue sweater,” leading her to believe someone was following her, according to the plea agreement.

Thanks to his trademark punctuation, this woman figured out in late 2016 that Buonocore was behind the posts. After she confronted him and he confessed — and after Buonocore’s brother assured her his family would address the problem — she decided not to press charges, according to screenshots of Facebook messages that she shared with Christine.

The fourth woman was Buonocore’s ex-fiancée in New York. After they split up, he started posting intimate photos of her, which she learned about when Christine contacted her, according to the plea agreement.

(These women are unnamed in court records. To protect their privacy, The Washington Post is not naming them.)

With these developments, Madison and Christine again tried going to law enforcement, this time where Buonocore lived, Suffolk County, New York. But Christine said the police expressed doubt over the illegality of his actions.

“Offenders who share intimate photos without the subject’s consent cause far-reaching trauma. The Suffolk County Police Department considers these cases important and handles them with the utmost care for the rights of the victim,” said Suffolk County spokesperson Dawn Schob.

“The victim in this case, who was not a resident of Suffolk County, was advised to report the incident to the local law enforcement agency that had jurisdiction to open a criminal investigation,” Schob said. However, in 2019, a Suffolk County officer told Christine that the county would have jurisdiction if the photos were posted to the internet from there.

Some officers told Christine she should not have had the photos taken at all. Now well-accustomed to the judgment that came with having her intimate pictures stolen, she says she deployed a quick rebuttal: “Your wife doesn’t send you nudes? That must be so sad for you.”

Undeterred, Christine prepared a 59-page document mapping the entire case with evidence and relevant statutes in each of the victims’ jurisdictions. She sent the document to all the women involved, and each showed up at her respective law enforcement offices, dropped the packet in front of investigators and demanded a criminal investigation.

They were finally making progress. The sheriff in Florida’s Manatee County, Christine’s locality, passed the case up to federal investigators. And in July 2019, the FBI took over on behalf of all six women on the basis of the evidence of interstate cyberstalking that Christine had compiled.

Madison and Christine still had their civil case open. In spring 2020, they received the contact information corresponding to the poster’s IP addresses from the internet service providers, confirming what they already believed. In April, they amended their civil complaint to replace “John Doe” with the name Christopher Buonocore. (Buonocore’s lawyers did not respond to requests for comment. Buonocore never responded to the civil complaint.)

The civil case had essentially done all it could. The sisters unmasked Buonocore. But once that happened, he filed for bankruptcy, and Madison and Christine did not expect to be able to collect damages from him.

Eventually, the sisters settled with Geiger for an undisclosed amount, according to court records. The presiding judge granted default judgment against Buonocore, since he never filed a response in court, ordering him to remove and destroy the images of Madison and Christine.

Criminal charges, meanwhile, were underway.

‘Not a typical cyberstalking case’

The U.S. attorney for the Middle District of Florida took action at the end of December 2020, but without a federal law criminalizing the nonconsensual distribution of intimate images, she charged Buonocore with six counts of cyberstalking instead, which can apply to some cases involving interstate communication done with the intent to kill, injure, intimidate, harass or surveil someone. He pleaded guilty to all counts the following January.

But Madison said she worried that the judge would go easy on Buonocore at sentencing. If the local police response was any sign, they thought, Buonocore could get away without much more than a scolding.

In November 2021, Madison stood at the front of a Tampa courtroom and delivered a statement at Buonocore’s sentencing. She described Buonocore’s reposting his victims’ photos thousands of times. She spoke of her pain and of the senselessness of his actions. “Someone you love could have been his target,” she said to U.S. District Judge Thomas Barber.

Sextortion cases rarely go so far in the courts, and this one was especially foreign to Barber. “I don’t do any of this stuff. I don’t even have Facebook,” he said. The case was further complicated by the fact that Buonocore was charged with cyberstalking, but his actions went beyond that. “This is not a typical cyberstalking case at all,” the judge said.

Buonocore had asked Barber to consider his guilty plea, his otherwise clean record and what he said was his need for mental health treatment. He was seeking a sentence below a minimum guideline of 41 months.

Barber sentenced Buonocore to 15 years in federal prison — almost four years more than the prosecutor had requested. Madison triumphantly let out an expletive that broke the tension in the courtroom. (Buonocore is appealing from prison.)

But as Madison and her sister left the courthouse, they realized that full closure would be impossible.

Buonocore’s four other victims were granted privacy in the public record — something Madison would have had if only investigators had helped her from the beginning. By launching a civil case, Madison and Christine removed Buonocore’s shroud at the cost of their own anonymity.

“The victim in this case, who was not a resident of Suffolk County, was advised to report the incident to the local law enforcement agency that had jurisdiction to open a criminal investigation,” Schob said. However, in 2019, a Suffolk County ok County spokesperson Doaded them to post again at any time. Madison knows she will always have to live with what Buonocore did. “We want to use this to raise awareness and help people,” she said. “All this pain has to have a purpose.”