JK fell in love the old-fashioned way—she met someone in real life. The relationship would fall apart spectacularly, though, in the digital realm. When the 24-year-old accepted a position selling insurance at a Bankers Life branch in the Maryland suburbs in June 2015, she quickly struck up a friendship with Ahmad Kazzelbach, a 23-year-old coworker who helped train her. The two soon began dating and, by December, they were living together. Just as quickly, JK caught Kazzelbach cheating. He moved out and their relationship came to an end. Over the course of the next year, Kazzelbach would exact a wicked revenge on his ex-girlfriend, manipulating the criminal justice system to force her into an alternate reality of his own design. The gaslighting to which Kazzelbach subjected JK was extraordinary in its deviousness, and it was nearly impossible to defend against. The surreal details were eventually laid bare in a lengthy criminal complaint that, in sum, illustrates just how breathtakingly bad a breakup can get in today’s technology-enabled world. Kazzelbach, who court records say is now married, is not a professional hacker. Yet he serves as an example of the ways in which a few bits of information—and some well-placed lies—can be used in new and malicious ways that often confound local police departments. The US government prosecuted its first hacking case in 1989. Roughly 300,000 cyberattacks are now reported each year, but experts estimate fewer than 1% of the people behind them are prosecuted. No network is completely secure, and even the federal court records system has vulnerabilities. Angry exes have hacked their estranged partners’ accounts before—one of NASA’s top astronauts was accused of hacking into her ex-wife’s bank account from space last year—though few are known to have used their illicit access quite as perniciously as Kazzelbach apparently did. JK and Kazzelbach broke up in May 2016. In July, JK realized the password had been changed on her Yahoo account. She tried to log into her Instagram. Her password worked but the username had been changed to “Jvvwhore.” The “vv” is a reference to another last name JK has used. She logged into her Facebook account next, only to discover the words “You took my boyfriend” displayed under her profile picture. JK suspected who might be to blame. She called the Anne Arundel County Police Department to report that she had been hacked, and that said she suspected Kazzelbach’s new girlfriend. (Quartz knows JK’s identity, who is largely identified only by her initials in court filings, but is withholding it to protect her privacy. We have redacted identifying details from the documents linked in this story, such as certain email addresses that include JK’s name. She did not reply to interview requests for this story.) The police failed to identify a suspect and the invasive activity continued. JK’s passwords, usernames, and profile information for her Apple account and an online account with the company servicing JK’s student loans were all changed. She found her TurboTax and online bank accounts locked because someone made too many failed login attempts. Later, Kazzelbach broke into JK’s apartment, a traditional crime police are more accustomed to investigating, and he was briefly jailed. Kazzelbach’s bosses at Bankers Life asked him to resign. He left the company. For JK, it was only the beginning.

Things get weird

On Sept. 30, 2016, about six months after their breakup, JK’s phone buzzed with a text from an unknown Florida number. “Prepare yourself for what’s coming…the last 3 months were just the beginning,” the message read. “I have bigger plans for you…I love how easily manipulated you can be.” He wasn’t lying. In December, Kazzelbach went to Maryland state court and took out an order of protection against JK, claiming she had physically abused him and was texting death threats to his cell phone. She denied the accusations, but the court instructed her not to contact Kazzelbach. Kazzelbach then told authorities that JK violated the order. He called the police to his home four times in six days, showing cops threatening texts sent to him from JK’s number as evidence. She was taken into custody by Baltimore police shortly after New Year’s and thrown in jail. While JK was locked up in Baltimore, Kazzelbach called Anne Arundel police back to his home. He told the responding officer that he had an active protective order against JK, but that she contacted him twice that day. Anne Arundel cops filed a new set of charges against her, and took her back into custody as soon as she was released from the Baltimore jail. When JK got out of the Anne Arundel County lockup the next day, Kazzelbach reported her to cops four more times for violating the protective order. As usual, he had electronic proof in the form of multiple violent text messages and emails from JK’s accounts, including ones in which JK asked Kazzelbach to get back together, and others that seemed to encourage Kazzelbach take his own life. The county duly filed four new sets of charges against JK. In June 2017, Kazzelbach filed another report with police, alleging JK continued to threaten and intimidate him. She was arrested by Baltimore police—yet again—about a week later, and taken to the Baltimore County Detention Center. The following day, JK appeared before a judge who put her on house arrest and had her fitted with an electronic ankle monitor. In all, local police issued at least six separate arrest warrants for JK based on Kazzelbach’s accusations.

Kazzelbach’s story unravels

The evidence Kazzelbach presented to police of JK’s supposed harassment campaign seemed strong. But something still didn’t add up for Baltimore detectives, who opened their own investigation into Kazzelbach. At the beginning of August, Baltimore police and the FBI conducted a joint interview with Kazzelbach. He claimed to have changed his phone number multiple times in response to the supposed harassment from JK. But Kazzelbach’s story was inconsistent, raising investigators’ suspicions. Kazzelbach wouldn’t allow a forensic search of his phone, so investigators obtained his call records from the phone company. They found no record of any communications between Kazzelbach and JK on the dates Kazzelbach claimed she had sent him threats. Detectives reviewed JK’s work email account. They found no messages sent by her to Kazzelbach on the dates he said she did. Baltimore detectives then got permission from JK to let them search her phone. “A review of JK’s phone did not reveal any successful or attempted text or email communication with Kazzelbach on the occasions that Kazzelbach reported to law enforcement having received messages from JK,” the complaint says. So if JK didn’t send the messages, who did? The FBI asked Kazzelbach if he knew about “spoofing,” which lets people send emails and texts that appear to come from other people. According to the complaint, Kazzelbach admitted that he once visited a spoofing site on the recommendation of a friend. Investigators subpoenaed Yahoo for Kazzelbach’s account records, and found an email from JK’s student loan servicer, confirming a password change. It had been sent to a Yahoo email address almost identical to JK’s real one, only the fake one had an underscore between her first and last names instead of a dot. Records supplied by Kazzelbach’s internet service provider revealed the bogus Yahoo account in JK’s name had been created from an IP address that traced back to Bankers Life, but had been verified with a phone number linked to Kazzelbach’s uncle. The IP address used for the failed login attempts on JK’s TurboTax account resolved to the home of another one of Kazzelbach’s relatives. State authorities ultimately dropped all charges against JK, and federal prosecutors filed their own against Kazzelbach. He was charged with cyberstalking and intentional damage to a protected computer in November, and was placed on home detention. The cyberstalking charges carry a potential prison sentence of at least a year, and Kazzelbach can get up to five years for the computer intrusions.

Behind the investigation

The US Attorney’s Office, as a matter of policy, does not discuss cases that are ongoing. However, Alex Iftimie, a former federal prosecutor with the Justice Department’s National Security and Cybercrime units, explained why it took cops a full year to catch onto Kazzelbach’s scheme. “What was going on in this timeframe was really an investigation of JK, and local police acting on the information that Kazzelbach was providing to them,” Iftimie told Quartz. “There was a protective order saying that she is to stay away and not communicate with Kazzelbach. And I think that that may well have been part of the reason that police didn’t figure this all out a little sooner, in the sense that they believed that they were enforcing a lawful court order.” The Kazzelbach filings are “a pretty great example” of building a case after the fact, using a trail of metadata and subscriber information, Iftimie said. However, he continued, the fact that charges weren’t brought until three years after Kazzelbach’s alleged reign of technological terror began, shows how painstaking these types of complex investigations can be. It often takes months to get information back from the providers, Iftimie said. And, of course, the wheels of justice turn slowly. “It’s not a quick process,” Iftimie said. If Kazzelbach is convicted, Iftimie doesn’t think the court is likely to be forgiving. “I think judges would be particularly aghast with this conduct because he was able to manipulate the tools of justice to his advantage,” he said, adding that JK may also have grounds for a civil suit against Kazzelbach. Kazzelbach did not respond to multiple interview requests, and his lawyer declined to comment. He is set to be arraigned in US federal court on Jan. 16.