Sally Anscombe / Getty Images

When the FBI confiscated computers that belonged to Luis Mijangos in 2015, agents found a staggering trove of sexual content, including 15,000 webcam videos, 13,000 screen captures, and 900 audio recordings. Forty-four of the people in the images and recordings were minors. But Mijangos hadn’t downloaded the files from porn sites, nor had he obtained most of them by hacking. Instead, he had blackmailed his victims into sending him explicit photos or videos, or into performing sex acts on live streaming video.

Blackmailing victims in order to extort sexual material or activity is often known as “sextortion,” and it’s on the rise. In a Justice Department survey of investigators, prosecutors, and analysts administered earlier this year, there was near-unanimous consensus that the threat of online enticement of children was rapidly increasing.

Even so, there’s a surprising lack of data from the Justice Department and from private sources about sextortion cases and how they’re prosecuted. That’s why a group of researchers at the Brookings Institution, led by Benjamin Wittes, combed through media accounts and federal and state databases, compiling a list of publicly available sextortion cases for a report they published Wednesday.

The researchers unearthed 78 cases, a figure that they acknowledge is minuscule compared to the actual scale of sextortion worldwide. Of those 78 cases, 69 involved minors. All the perpetrators were male, and nearly all of the adult victims were female; more than a quarter of child victims, however, were male. And the researchers found that while some perpetrators focused on a single target (like a stalker might), many spread their net incredibly wide, crossing state and country boundaries to claim hundreds or even thousands of victims.

It’s difficult to know just how many people were harmed by these 78 men, because prosecutors often focus only on a handful of victims for which they can bring the strongest evidence against the perpetrator. But in 13 of the cases, prosecutors said there were more than 100 victims. (One case that the report excluded for lack of concrete data may have involved more than 3,800 victims, the FBI has said.)

Combing through the cases one by one, the Brookings researchers produced an estimated range of possible victims: between 3,000 and 6,500.

The psychological and, in many cases, physical harm to sextortion victims is hard to fathom. Both perpetrators and victims have called sextortion a form of virtual slavery, and perpetrators routinely use their power to demand incredibly degrading and humiliating acts. Victims have been forced to record videos of themselves stripping, masturbating, having sex with strangers, or eating their own ejaculate and solid waste.

Victims’ pleas for the humiliation to end are met with further demands, and some victims have been driven to self-harm. In one case, a 17-year-old girl wrote to her tormentor to say she had attempted suicide the night before, and warned she may try again if the treatment continued. “Glad i could help,” the perpetrator replied.

These ordeals usually began with some sort of “catfishing,” or manipulation over social media. Often, perpetrators win victims’ trust before asking for sexually explicit photos or videos; other times, they impersonate someone else. In about one in five cases, perpetrators hacked victims’ social media and email accounts, or took over their webcams to take surreptitious photos and videos.

But it’s currently impossible to prosecute sextortion cases in a uniform way. “Sextortion as a legal matter does not exist,” Wittes said in a presentation of his research presentation Wednesday. “There is no sextortion in federal law.” Since prosecutors have to lean on existing law, there’s a sentencing gap between cases that involve minors and those that don’t.

Charges of child sexual exploitation carry a mandatory minimum sentence of 15 years, and child-porn charges come with similarly heavy punishments. Sentences in cases with child victims ranged from seven months to 139 years (and some were given life sentences in prison), and the mean sentence was 31 years.

Sentences in cases with only adult victims, however, ranged from one month to six and a half years, and the mean sentence was just over three years. That’s because prosecutors have to rely on a patchwork of existing law in order to bring cases against perpetrators: Many perpetrators are charged as stalking, computer hacking, or identity theft, all of which carry far more lenient sentences.

“Federal law seems to care a great deal more about children than it does about adult women,” the researchers wrote. “It also devalues violence in the virtual world, even very real violence, as opposed to violence in the physical world.”

They offered policy recommendations to even the disparity. Since nearly every sextortion case they analyzed was already prosecuted at the federal level, the researchers advocate for the creation of a federal law specifically about sextortion. Such a law should take the age of victims into account, they said, but should not hinge entirely on age.

The researchers also called on states to criminalize nonconsensual pornography—a wave that has recently accelerated—and on federal law-enforcement agencies like the FBI to gather data about sextortion cases.

Even though one of the biggest obstacles to prosecuting sextortion cases is a reticence among victims to come forward with their ordeals, experts say that codifying sextortion as a discrete federal crime could make a difference. And passing a federal law would give prosecutors and law enforcement a broader mandate for investigating allegations of sextortion, and could increase funding for training and enforcement.

“Law is our teacher. It educates us,” said Danielle Citron, a law professor at the University of Maryland and the author of Hate Crimes in Cyberspace. “It can help shape cultural attitudes even if there aren’t a thousand new cases brought.”

Wittes says taking sextortion seriously requires rethinking our notion of cybersecurity. For years, it’s been a buzzword for Fortune 500 companies seeking to protect their intellectual property and sensitive data. Protecting bank information by requiring strong passwords was a priority, but making sure 15-year-olds logged into Facebook with a strong password wasn’t.

That’s because society didn’t consider that teenagers might have data worth stealing, Wittes says. But in fact, they do, “for the same reasons that they’re attractive targets for rape and sexual assault in person.”

“When it comes to letting kids out into dark alleys, we understand that they have things to steal,” Wittes said. “We need to understand that in online life, too.”

We want to hear what you think about this article. Submit a letter to the editor or write to letters@theatlantic.com.