This piece is part of Mashable Spotlight, which presents in-depth looks at the people, concepts and issues shaping our digital world.

"Nice tits, honey. Haven't I seen you online?"

The man says it casually, with a suggestive grin, as he walks past Hollie Toups down the grocery store aisle. She's bothered by the remark, of course, but it's not the first time she's heard it; for the better part of the past year, this treatment has become routine. She's mainly just embarrassed her mother is standing next to her and had to hear the bawdy comment.

Toups, a 33-year-old teacher's aid and criminal justice student, discovered last summer that topless photos of her had been leaked online across dozens of websites. Some pictures included her email information and social media links — some even shared her home address.

In her hometown of Nederland, Texas — a small community of 17,000, about 90 miles east of Houston — the chances of being recognized are high. Case in point: this afternoon.

But she's far from the only one. Over the past few years, hundreds of women and men across the world have fallen victim to this new form of cyber bullying, spawning harassment and costing jobs and relationships in the process.

"Revenge porn," it's called, is the act of online publishing intimate photos, videos and contact information of a person without his or her consent. Usually, it's the work of a disgruntled ex-partner or random hacker (the latter in Toups' case).

Two weeks ago, California become the second state in the U.S. behind New Jersey to ban the practice. Now, New York is considering similar action.

And while it may seem like a black-and-white issue, revenge porn has opened up debates about the First Amendment and the ethics of criminalization.

Toups is one of a handful of victims fighting to make it a criminal offense. But, like most things sex-related, it's a highly sensitive subject — and still largely a work in progress.

Hunter Moore is often referred to as the "Internet's most-hated" person; he helped launch the revenge porn empire.

In 2010, the 27-year-old set up the now-defunct site, IsAnyoneUp?. The rules were simple: Anyone could submit naked photos of another person (almost always an ex-lover) to the site's database. As the site's popularity grew, so too did the trendiness of posting nude photos as a form of vengeance. It didn't take long for copycat sites to appear. Traffic was booming, which meant prime real estate for advertisers. Moore eventually shut the site down in 2012, after he claimed receiving an abundance of underage submissions, but by that point hundreds of sites like it had already launched.

Toups was at work just a few months later when she found out her photos had been posted on a site called Texxxan.com.

"I got a phone call from a friend who had overheard this group of girls talking about this website," she tells me. "She said there were tons of nude photos of different girls, including me. Of course, I didn't believe it."

Toups hung up the phone and tried to get back to work, but the thought burned in her mind.

Since she couldn't look at the pictures at work, Toups drove home and opened Texxxan.com from her personal laptop. The site's homepage showed a map of Texas, where visitors could click on various regions to view that area's victims. Toups clicked on the southeast portion, where Nederland is located, and saw a picture of her next to 12 other girls from the area. When she expanded the image, her full name, a map with her home address pinpointed, a link to her Facebook page and a long list of photos appeared.

Hunter Moore in a 2011 interview with Anderson Cooper. Moore voluntarily shut down IsAnyoneUp? in April 2012.

"The first picture I saw was this one I had posted to Facebook — it was me at a pool party wearing a bikini. So that wasn't a big deal," she says.

"But then I scrolled down. There were these topless photos I had sent to a boyfriend back when I was 24 — and I was 32 at the time I was reading this."

It must be him, she thought — he's the only one who had access to the pictures. And then she saw something that threw her off: The very bottom picture was a selfie she had snapped just a year or so prior. She had been working out and taking self portraits every week to track the progress. One morning, when she was stepping out of the shower, she took a photo of herself on her iPhone. She didn't send it to anyone; it was just a picture, taken in the moment, which she intended to keep for herself. So how did it get on this website?

"I knew it couldn't have been him then — he didn't have access to that last photo. It was eight years after we broke up, and I didn't send it to anyone."

Toups emailed the website and explained that she wanted the photos down. After a few days, the site sent her a message back with a link asking for her credit card information for payment — extortion for removing the photos. She considered giving in for a second, if only out of desperation, but realized it wasn't a guarantee the pictures wouldn't just reappear a few days later. A site that posts naked photos without permission and asks for personal banking information, after all, doesn't exactly scream "trustworthy."

The next week, the harassment began.

"It wasn't bad at first. Just people — a lot of random people — sending me messages on Facebook or tweeting at me, saying they wanted to meet up and 'have a good time,'" she says. "Then there were people who would approach me in public" — like the man in the grocery store — "and laugh about seeing my pictures up online. It was so humiliating."

Then it turned aggressive.

"One of the tweets at me said something like, 'I get the feeling you like to sleep around, don't be surprised if you get raped one day.' It pissed me off more than it terrified me, but I still couldn't help feeling unsafe."

Toups decided to hire an investigator. After a month of searching, she found one who was able to get the pictures down from the site almost immediately. The next week, though, the pictures reappeared — along with a nasty email message, presumably from the site's owner.

"It just said, 'Tell your investigators they can't touch me. Your photos are staying up.' And that's when our investigator told me to find an attorney."

By that point, Toups had connected with the dozen or so other women in her area who'd had their photos posted to the site. She found an attorney willing to represent all of them. They built their own website, ArmyOfShe.com, to serve as a database of resources, attorneys, investigators and victims in the Texas area who were willing to tell their stories.

The group launched a class-action lawsuit against Texxxan.com and its hosting site, GoDaddy. Less than a month later, GoDaddy shut the site down, citing copyright infringement and, Toups says, underage submissions.

Since launching ArmyOfShe, Toups has partnered with six attorneys from across the U.S. — from Texas to New York to California — as well as a handful of advocates and victims. Their new goal, now that Texxxan.com is finished, is to work with Texas legislators to criminalize the posting of nonconsensual pornographic images.

She still isn't sure just how her photos were acquired, but she's comfortable ruling out her ex-boyfriend. "The investigators talked to him, and they cleared him as a suspect pretty early on," she says.

And half the victims she's spoken with had their photos hacked, too, she says. "We discovered that hacking is pretty common — photos that are uploaded on Photobucket or via email."

For Toups' phone picture, it was her cloud that was compromised. She says, "It just goes to show, I think, that there really isn't privacy anymore."

Hacking attacks are sporadic and almost always unexpected. When it comes to cloud storage, it can be as simple as one "bad apple" in the server's bunch. MIT news explains it:

Imagine there are 100 computers attached to a cloud server. Each computer may be running normal programs such as word processors, data analysis tools or almost anything else common to office tasks. But one computer could be simply executing programs that allows it to spy on the other 99. Each time one of the 99 target computers does something, it gives the rogue system more of a chance to capture personal data. It's like a fly on the wall of the cloud ... You may simply not know who your neighbors are in the cloud, and they could be up to no good.

So far, two states have passed bills banning revenge porn. In 2004, New Jersey was the first to pass an invasion-of-privacy law aimed at the publishing of nonconsensual, intimate photos (.PDF). Earlier this month, California lawmakers signed a similar bill.

But there are large differences between the two. New Jersey's punishes the publisher of the photos, regardless who took the image. California's new bill, which makes the act a misdemeanor punishable with up to six months in jail and $1,000 in fines, only applies if the individual who distributes the pictures is also the photographer.

That means, in cases where the victim takes a photo but someone else distributes it, the California law won’t apply.

Based on data from EndRevenePorn.org. The organization is working with the light blue states to draft anti-revenge porn bills.

Oscar Michelen, a New York-based attorney who's partnered with ArmyOfShe, says one of his latest cases in New York would play out very differently in California and New Jersey, given their different laws.

"In this case, my client — a woman — was cheating on her husband. He was backing up her phone and discovered that she had been sending explicit photos to another man," he tells me. "The husband was mortified, of course, and he threatened to post the pictures.

"Now in New Jersey, the law would cover him. He'd be found guilty if he were to post the photos, even though he's not the person who took them. In California, however, he'd be all right because he's not the owner of the pictures. That is the biggest difference between them."

Michelen says he's approached the majority of his cases in New York through intellectual property laws on copyright, like the DMCA. Most revenge porn sites host advertisements to turn profits — so if a site is using a picture the victim took him or herself, then, it's a basic matter of proving commercial use of someone else's image.

Image: Flickr, Phil Cooper

Other states have considered passing bills as well. Just last week, New York Assemblymen Edward Braunstein, Democrat, and State Senator Joseph Griffo, Republican, announced legislation that would make any revenge porn that's published a Class A misdemeanor. It would also include photos taken by the victims.

Florida lawmakers raised a similar measure earlier this year, but it never made it through the state's legislature.

Holly Jacobs, a Florida resident and founder of the Cyber Civil Rights Initiative, is perhaps one of the best- and earliest-known revenge porn victims. Since 2012, she's been collecting signatures through EndRevengePorn.org in an attempt to criminalize the behavior.

Last week, Florida law enforcement officials dropped the criminal case she had against her ex-boyfriend, who she claimed posted explicit photos and videos of Jacobs in 2008.

"They told me they were able to link [his] IP address to the posting, but weren't able to prove he was the one who was sitting behind the computer and posting my photos. That would have required a search warrant and the charges against him to be felony — but instead, they were misdemeanor," she says. "In my opinion, this is just evidentiary of law enforcement trivializing these situations."

And that's where one of the biggest arguments falls into place: Should these cases be tried at the civil or criminal level? The American legal system is defined by the two (very different) types of cases.

Criminal cases are considered offenses against the state; consequently, then, they're prosecuted at the state level. Punishment for criminal cases can often include jail time, whereas civil cases usually only involve fines. The defining factor between the two is the standard of proof. In criminal cases, guilt must be proven “beyond a reasonable doubt;" in civil cases, the standard of proof is much lower, and is typically based on whether it seems "more likely than not" that a certain offense occurred.

In Jacobs' case, and in a state where there's no criminal ban on revenge porn, the court wasn't able to prove — doubtlessly — that her ex-boyfriend was indeed the one posting the photos. But she's staying persistent.

"Criminally speaking, he's off the hook, at least for right now. I'm still using the civil statutes to sue him," she says. "But I believe these are criminal cases beyond a reasonable doubt."

Others, however, aren't so sure criminalization is the best plan of action. Scott Greenfield, a criminal defense attorney and owner of the blog Simple Justice, argues that criminalizing revenge porn is borderline unconstitutional. It's too vague of a concept, he says, and will eventually cause more harm than good.

"We're shooting flies with shotguns. In order to stop a hated specific conduct, we're creating new crimes that cover a variety of other conducts that are both constitutional and not meant to be in the ambit of prohibition," he tells me. "These laws are not well written."

Image: Flickr, Austin_photoguy50

Greenfield agrees that revenge porn is extremely harmful — the only problem is that these laws ignore the free speech rights of the First Amendment, and have the potential to implement life-changing punishments on people who may or may not have just made a mistake in a heated moment. The best law to fight revenge porn needs to be broad enough to protect victims but narrow enough to protect free speech. What's being debated in New York and what's in place in California, he says, is just too broad.

"What if the person who posted a [revenge porn] picture did so in a fit of rage — if, say, they had just found out their girlfriend or boyfriend was cheating on them?" he asks.

"By charging them at the criminal level, that comes with the potential of going to prison. It means that, when they're applying for jobs in the future, they might be listed as a sexual predator. It affects getting student loans, filling out housing permits — these are very serious consequences.

"Just as we forgive someone who might have been foolish enough to send out a naked photo of his or herself, why are we willing to destroy the lives of someone who acted, in a moment of panic, equally as foolish? These laws drop bombs on people they target while forgetting the other side of the equation."

In Nederland, Toups continues her walk through the grocery store, trying to forget the man's comment. She knows it will happen again, in the gas station or the post office, but she's learned to deal with it — at least for the time being.

And while the debate continues over what further revenge porn laws, if any, will be implemented, Toups says remaining vocal is key.

"If this has happened to you, just yesterday or five years ago, don't be afraid to speak out," she says. "It's a new issue that a lot of people aren't aware of yet, but that's why we're doing what we're doing."

Jacobs agrees: "There are plenty of resources out there. It can seem like frustratingly slow progress, but it is progress — and we can't ignore that."

Thumbnail Image: Flickr, Austin_photoguy50