'Hackers leaked intimate photos after my laptop was stolen'

When hackers threatened to leak a film-maker's nude photos stored on her stolen laptop, she turned the cameras on herself to document her ordeal.

Spanish director Patricia Franquesa was sitting in a café in Madrid when thieves made off with her laptop in 2019.

Three months later, hackers got in touch with her demanding money, threatening to leak the intimate photos she had stored on the device if she didn't pay up.

Franquesa didn't know for sure - and still doesn't - whether the person attempting to extort her was the same one who physically stole the laptop.

But in a situation where victims have such little control, she was able to document the whole episode on film from her perspective as it unfolded.

The result is My Sextortion Diary, which has just screened at the Sheffield Documentary Festival.

"Making a documentary was my way of taking some control and power," Franquesa tells BBC News. "It was my way to protect myself, not victimise myself and give me some disassociation, it was like building a bubble."

The distance provided by making the film was valuable, she says, and also helped her process what was going on. "It's still me of course, but I needed to separate myself. I was talking about 'Pati', but there is Pati the character and Pati the director."

She jokes that it's darkly appropriate that such an ordeal "happened to someone who does documentaries, so it's the perfect opportunity to turn [the cameras] around".

Taking, storing and sending nude photos is entirely normal to a whole generation which has grown up with the internet.

But it opens up a whole world of risk which those born in earlier decades never faced.

"My father took pictures of my mother in a swimsuit that might have been a bit see-through," Franquesa smiles as she recalls an era which seems tame by comparison. "But since the digital world came to us, it's our new way of having intimacy."

In her case, the hackers showed how serious they were by leaking some of the images to her friends, family and colleagues, who they found via her social media contacts.

But Franquesa does make some progress as the film goes on. Police write to her to tell her they've made an arrest after examining CCTV footage from the café - which she eventually gets hold of herself and includes in the film.

It shows how the laptop was taken by three men, their faces blurred for the film, working together from different positions within the café.

But regardless of the developing police investigation, hackers continue with their attempts to extort her.

Exhausted, out of options and refusing to pay up, Franquesa eventually decides to upload the images to her own social media - a horrible last resort, but one which took away the hackers' power.

"It was tough, I was crying," she recalls. "It felt like the last moment of a marathon. I did not want to post the pictures, I was hoping and waiting for this person to stop, and you see he is not stopping, so I had nothing else to do."

Getting the hacker to stop was not her only motivation, however. "It was for me to say, 'hey, contacts, this hacker has these pictures, he is using my contacts, help me'."

That altered the balance of power somewhat, and meant Franquesa could enlist her friends and followers to help piece together a picture of the hacker and their behaviour.

"Which changes the formula," she says. "I wanted my contacts to tell me when they got the pictures, because then I will have more proof to take to the police and keep open the investigation.

"It was breaking the shame," she reflects. "The attempt by the other person to shame me is broken because I am owning my own pictures. And then it stopped, magically."

The fact that the hacker ceased contact shortly after Franquesa uploaded the images suggests it was someone who was already following her when she switched her accounts to private after the first blackmail attempt - but she still doesn't know who.

The documentary has gone down well at the festivals it has already played. Mark Adams of Business Doc Europe described it, external as "a powerful and provocative real-life story, prescient in reflecting the unhappy reality facing those people who are forced to deal with the awful behaviour of unscrupulous hackers".

The man who physically stole the laptop was eventually jailed. But for Franquesa, the primary concern was less the laptop itself, and more the way her own data was subsequently used against her.

"He got sentenced to 10 months in prison, just for stealing the computer. And I managed, in the sentence of the judge, to say that he is linked to possible blackmail," she explains.

Franquesa's focus has since shifted to raising awareness of what happened - and asking questions about how these criminal networks operate.

"I told the police, the guy [who stole the laptop] knows what he did with the computer. And the police told me the computer wasn't going to be recovered, and I said, 'I know that, but what are they doing with the stolen devices?'

"Because now there are a lot of mafias. In Spain, you steal devices and sell them, and then they go to people who hack the devices and take the data, find things, and start blackmailing. I want to understand what is that system."

She points out: "It's not just about justice in my case, because it's kind of over for me, but it's for the police to understand what is going on in these kinds of cases. What is the system of these mafias? If I was a police person, I would be super curious."

The biggest challenge was how to make something cinematic out of so little material. Franquesa could only document her own side of the story, and most of the developments happen via written communication - emails from the hackers, letters from the police or instant messages between Franquesa and her friends.

But the director "didn't see it as a limitation" as the purpose of the film was to be a "digital diary".

The hackers are represented by a digitally altered female voice, while text conversations are seen as digital speech bubbles which mimic WhatsApp threads.

But it’s "also this form of storytelling that doesn't allow the film to overstay its welcome, coming in at a tight hour," noted Blake Williams of HyperReal Film Club., external

"My Sextortion Diary is always engaging and finds a way to keep the narrative moving despite its unconventional approach."

The documentary ends prior to the sentencing, because, Franquesa laughs, "We needed to close the film in time for South by Southwest!" - the festival where the film played in March. She says some new text will now be added at the end following the conviction.

Franquesa ultimately hopes the film helps bring about change, because she feels that laws are not changing fast enough to keep up with criminal behaviour.

"I want to scream that this is not working, the laws on our data. Our system that needs to protect us is moving so slowly," she says. "There is a problem here about which protections we have.

"The only satisfaction of this case is we are talking about it now, the end of the film is bittersweet, the success for Pati is making the film, but for the hacker, the justice is incomplete."

She concludes: "I hope my case is used to understand what [criminals] are doing, I'm putting myself up front so they can study my case and help other people."