For months, a slice of the gaming subculture has waged a campaign of online harassment against prominent women in the videogame industry, including game developers Zoe Quinn and Brianna Wu and feminist critic Anita Sarkeesian. The reasoning behind the targeting of these women is too batshit to unspool here—if you’re interested in falling down the rabbit hole, Deadspin has a decent primer on “Gamergate”—but what’s clear is that some people just don’t like seeing women play, design, and discuss video games, and seek to punish them with “virtual” violence.

Quinn has previously detailed how her online critics have spread revenge porn, harassed her family, and released her personal information in an attempt to terrify and silence her. Last Saturday, Wu fled her home after an online stalker posted her address and threatened to rape and kill her in a series of gruesome tweets. And this week, administrators at Utah State University received an anonymous email threatening to carry out “the deadliest school shooting in American history” if they went through with a planned campus event featuring Sarkeesian; she canceled the talk over Utah’s gun laws, which prevent the school from banning concealed firearms at the event.

So far, the anonymous perpetrators of these threats have yet to be unmasked. How hard is it, really, for law enforcement to catch them? I called Tim Ryan, a former FBI supervisory special agent who led investigations into cybercrimes ranging from the distribution of child pornography to corporate espionage, to find out.

“The more I tell you about how law enforcement investigates these [suspects], the less likely they are to get caught,” says Ryan, now a managing director for the corporate risk and security consultancy Kroll. But he did tell me that, while he can’t speak on behalf of the FBI, the outcomes of his own investigations with the agency “varied greatly depending on the person’s motivation and methodology.” An anonymous harasser who sends a single online rape threat using “some sort of tradecraft” to conceal his identity—like a tool to hide a user’s IP address—would be difficult to catch. But one who engages in “continued contact” or uses “poor tradecraft because he doesn’t understand how the Internet works” may slip up and inadvertently reveal himself to investigators.

But it’s rare for incidents of online harassment to spark a federal investigation at all. “It was never a matter of not caring,” Ryan told me of working on the cyber squad, but “the volume of work coming in every day was absolutely staggering. We had to do triage, almost as if we were in a war zone, deciding which patients to treat first.” Cases that posed a serious risk of physical harm or a significant loss of property were prioritized, as were threats to children. When agents are busy investigating operating child pornography rings, they don’t have the bandwidth to look into casual threats against adults. (And if the investigations are unlikely to be successful, they sink further down the list.) In addition, Ryan told me, agents might choose to investigate high-profile incidents—those involving celebrities or newsmakers—that they think might create “a deterrent effect” for similar crimes. Perhaps the Gamergate harassment has risen to that level: Some of the threats against Sarkeesian are being investigated by the FBI.

The light penalties attached to many of these online crimes also deter officials from taking them seriously, because the punishment doesn’t justify the resources required to investigate and prosecute them. “It will never work if it feels like a catch and release program,” Ryan says. “Spending a month getting subpoenas and doing wiretaps for a case where the sentence is six months of probation just doesn’t make sense.”

This all adds up to a mismatch between the written laws—like longstanding federal laws against stalking and emerging state laws that specifically address cyberstalking and revenge porn—and their practical enforcement, and resolving the contradiction won’t be easy. Individuals can hire a private consultancy like Kroll to independently investigate incidents—at a personal cost. Increasing jail time for making online threats or posting revenge porn could encourage law enforcement entities to prioritize these cases—but then again, America doesn’t need more people in its prison system. Federal agencies, which have the expertise to investigate online crimes, can help train local police forces in advanced techniques—but it’s still largely a problem of resources, not just know-how.

This is why some advocates are asking tech companies like Facebook, Twitter, and Google to crack down on abuse on their networks—but even if Facebook punishes bad actors, another site will spring up that welcomes them. The internet has become a conduit for “lots of material that a bad guy can use to shame people,” a platform for sharing it with the world, and also a hideaway where he can easily evade law enforcement, Ryan says. “I think it’s going to get worse.”