*Names have been changed to protect identities.

On a late night in March 2013, Lila* fell asleep on a hotel bed, over the covers, with her clothes still on, while her then-partner, Morgan Marquis-Boire was engrossed in a conversation with one of their friends. They were in Toronto for Cyber Dialogue, a conference organized in part by Citizen Lab, an interdisciplinary group run out of the Munk School of Global Affairs at the University of Toronto that studies the internet and its impact on human rights.

Marquis-Boire was already a rising star in the privacy and digital rights world — a computer security hotshot working to protect vulnerable activists and whistleblowers against oppressive governments. After the summer of 2013, he would become closely identified with whistleblowers like Edward Snowden and the journalists who helped publish the Snowden documents, and he would eventually go to work for The Intercept as a technologist. In 2014, Wired would publish a glowing profile that called him “the ex-Google hacker taking on the world’s spy agencies.” Google’s director of information security Heather Adkins described him as “in the top one percent of technical capability” of people she had hired. Ron Deibert, the director of Citizen Lab, praised him as "extraordinarily talented," and added, “but what I very much appreciate about him is his passion for human rights.”

Marquis-Boire and the mutual friend were engaged in a high-level technical discussion, despite the fact that all three had been drinking heavily that night. Marquis-Boire had taken some pills — benzos, Lila thought, or common prescription tranquilizers. She didn’t take any. Several hours later, Lila became conscious of Marquis-Boire shaking her awake. Their friend had left. At first she thought Marquis-Boire was just rousing her so she could change her clothes and get into bed. But she tells The Verge that she was quickly disabused of the notion.

Marquis-Boire was still intoxicated, but enough hours had passed that Lila was stone-cold sober. According to Lila, as he began to initiate sex, she protested. She said stop. She said no. She even said their safe word.

At this point she’s told the story enough times that she can repeat it with a kind of brittle cheer, but her voice still quickens with anger when she gets to the end. “He ignored all of that,” she says, “while he fucked me in the ass.”

It was only much later that Lila would hear that this wasn’t the first time Marquis-Boire had forced himself on someone, or the first time he had anal sex with a woman without her consent. According to sources, he had been assaulting women for over a decade.

Marquis-Boire was supposed to be one of the good guys

The Verge has corroborated six separate allegations of physical and sexual assault by Morgan Marquis-Boire, with four self-identified victims located in Marquis-Boire’s home country of New Zealand. We also spoke to others in New Zealand, including former friends of Morgan Marquis-Boire, who say that this pattern of behavior was well-known in their community.

This couldn’t be more different from how he was perceived by the wider public. Marquis-Boire was a prolific speaker at security and human rights conferences, including the Aspen Ideas Festival in 2016. He sometimes used his considerable public platform to talk about the larger social problem of violence against women, and even stated that it motivated his recent work at Citizen Lab researching “stalkerware” or “spouseware” — spyware deployed against abused partners by their abusers. (In April 2017, he told Motherboard that he thought spouseware should receive more attention because it was common and widespread, and "the victims are everyday people.") Many of his best friends were women. He made casual, light-hearted jokes about misandry on Twitter.

In short, Marquis-Boire was supposed to be one of the good guys.

That was the Morgan Marquis-Boire that Dana* knew. Dana, a close friend of both Marquis-Boire and Lila, ran in the same San Francisco social circles. She was never in a relationship with Marquis-Boire, but they were very good friends, and his emotional support had become “a precious lifeline” to Dana. When Chloe Ann-King, a woman in Auckland, New Zealand, reached out to Dana via Facebook Messenger in September 2014 to warn her about Marquis-Boire, the ensuing conversation made her head spin. Ann-King alleged that Marquis-Boire had physically and sexually abused close friends of hers, including coercing anal sex from a woman too intoxicated to consent.

Dana knew that Morgan had substance abuse problems and that he was a “shitty boyfriend,” but struggled to accept the idea that he could be a serial rapist. But she believed the account, as difficult as that was. She just didn’t know what to do. “I wanted to believe that whatever fucked up shit he’d done in his early twenties was long over,” said Dana. “I fucking vouched for the guy. Pretty dumb, huh?” But it was Dana who would eventually become the bridge between New Zealand and the United States, bringing Morgan Marquis-Boire’s world crashing down around him.

Lila compartmentalized the assault, and she and Marquis-Boire continued dating for a year and a half. In 2015, after the relationship had ended, Lila told Dana for the first time about what had happened in the Toronto hotel room. In response, Dana recounted in broad strokes what Ann-King had told her via Facebook Messenger, but it was somewhat vague. “She gave no indication to me that she had been told Morgan had raped a bunch of women,” said Lila. In 2017, Dana showed Lila screencaps of her conversation with Ann-King and it was then that Lila learned that Ann-King had accused Marquis-Boire of anally penetrating other women without their consent. In interviews with The Verge, Dana expressed remorse that she hadn’t shown Lila the chat logs sooner.

“The only thing I have ever wanted is for Morgan to stop hurting women.”

Suddenly, Lila no longer saw what happened in Toronto as a singular, isolated incident on a drunken night, but one more data point in a decades-long pattern of sexual assault stretching from New Zealand to North America.

“The only thing I have ever wanted is for Morgan to stop hurting women,” Lila told me — a sentiment echoed by multiple women interviewed by The Verge.

The Verge spoke to several women in New Zealand who were only teenagers when they knew Marquis-Boire, and have corroborated several incidents of sexual and physical assault, including multiple accounts of forced anal sex. In 2008, Marquis-Boire left Auckland for a Google job in Zurich, Switzerland, and then later relocated to San Francisco. The women he left behind in New Zealand helplessly watched his star rise for well over a decade, unmarred by even a whisper of the wreckage he had left behind in his home country. Some of the victims buried their memories and tried to put the past behind them. Others, like Chloe Ann-King, tried to reach out to Marquis-Boire’s new friends and make this local open secret known abroad. But no one believed the women trying to blow the whistle on the man who protected whistleblowers.

Lila’s story closely echoed the stories The Verge uncovered in New Zealand. But Lila was different from these women: she, like her alleged rapist, was a hacker and a respected expert in the same field. Although Marquis-Boire’s reputation may have insulated him from accusations by other women, what Lila had to say about what happened in Toronto in 2013 would be believed.

Throughout The Verge’s investigation, sources expressed fear that Marquis-Boire, a lauded security expert, could hack them in retaliation. Corroborating electronic messages that could be used as evidence of his assault, one woman said, could not be found because he had been too careful with his operational security. One alleged victim told us that he had apologized to her, but had done it — either coincidentally or on purpose — through an ephemeral messaging app, one of the very technologies he had advocated for as an activist.

No one believed the women trying to blow the whistle on the man who protected whistleblowers

Lila, on the other hand, managed to out-maneuver him. She made him communicate with her in written electronic mediums, and when he was evasive, demanded that he describe his own behavior clearly and specifically. In the end, she was able to provide The Verge with both a chat log and a PGP signed and encrypted email from Morgan Marquis-Boire. In the email, he apologizes at great length for a terrible but unspecified wrong. And in the chat log, he explicitly confesses to raping and beating her in the hotel room in Toronto, and also confesses to raping multiple women in New Zealand and Australia.

“He had to have known what I was doing,” said Lila, sounding almost disgusted. Now that she had his confession in hand, she could go public if he did not take steps to stop harming women.

In early July, Lila laid down an ultimatum, one that included the requirement that he enter a rehab program and get clean. But after further conversations with Marquis-Boire, she came to the conclusion that the scope of the assaults was far beyond anything she had imagined.

Although Lila had explicitly asked him how many women he had raped, in all of their conversations, he never gave her a precise tally. “I have drunkenly sexually assaulted or raped women - the exact number of which I am currently determining,” he admits in the chat log. In the PGP-encrypted email, he never uses the word “rape,” but in referring to an “inventory of my sins,” he writes, “I don’t have a number for you yet, but it’s going to be worse than anything anyone has documented.”

“I have drunkenly sexually assaulted or raped women — the exact number of which I am currently determining.”

Lila did not want to go public with her allegations, and was anxious to preserve her privacy. (She still expresses concern that if her identity becomes widely known, the rape will draw unwanted attention.) She told him to write a Facebook post announcing that he was going to get sober, and then made him rewrite it when it wasn’t specific enough. On July 12th, Marquis-Boire posted on Facebook that his interest in alcohol had “reduced significantly,” only implying indirectly that he has quit drinking.

The Facebook post racked up over 500 likes and numerous encouraging comments, including one from Judith*, an activist who was close with both Marquis-Boire and Lila. When Lila saw the comment, she reached out to Judith via encrypted text message, explaining that there was more to the Facebook post than met the eye, and disclosing to her, for the first time, that she had been raped by Marquis-Boire.

Suddenly, Judith remembered a drunken night in 2014, when she and Marquis-Boire had gone home together. She’d drunk a little more than she should have, but she had gone home with Marquis-Boire and cuddled platonically with him a “million times” before, and felt perfectly safe. At his place, he began to snort something, and he offered her some. It wasn’t something she had done before, but she’d had “a particularly bad week” and snorted it, too. He initiated sexual contact, and she consented, but then the drugs and alcohol made her black out.

When she got up in the morning, she found an anal toy in the bathroom sink. “It’s not something I would have ever consented to,” said Judith. But on the other hand, she had consented to doing a drug she’d never done before, right? And Marquis-Boire had been extremely intoxicated as well. It was just bad sex, she had thought at the time, not an assault.

But after Lila described her assault and told her about similar incidents in New Zealand, Judith began to see that night as part of a much larger and more terrifying pattern.

Judith began to see that night as part of a much larger and more terrifying pattern

As the apparent enormity of his hidden abuse continued to sink in, Lila changed tactics. In late July, Lila told Marquis-Boire that she was going to petition to have him removed from his advisory positions at the Electronic Frontier Foundation and the Freedom of the Press Foundation. But he begged her for the chance to withdraw from Citizen Lab on his own, and to confess to the director Ron Deibert in his own words. She consented to this.

Marquis-Boire resigned from Citizen Lab in September, according to the organization. But when Lila followed up with Citizen Lab, she discovered that he had not in fact confessed to being a rapist. Deibert, Lila said, was furious when he heard the full story. He took further steps to make sure Citizen Lab was no longer working with Marquis-Boire in any capacity, either “formally or informally.”

Lila stayed quiet about what was happening, and asked the organizations she contacted to also stay quiet out of respect for her privacy. Marquis-Boire withdrew from upcoming speaking engagements. For conferences that did not publicly confirm that he had withdrawn, Lila asked her friends to call the organizers to request he be dropped. She told The Verge that she saw this as necessary to preventing future rapes. By September, she had effectively forced him out of his own sphere of influence.

In the meantime, he lashed out at both Lila and Dana for being unfair to him. In mid-August he called Dana, a call she described as “one of the most terrifying things that’s happened to me in a while.” He not only threatened suicide but also intimated that everything that was happening to him was Dana’s fault, while Dana sobbed and hyperventilated in fear. He also made vague threats towards Chloe Ann-King.

“I hadn’t told him Chloe was my contact,” said Dana.

Unlike other recent high-profile sexual assault allegations, where public disclosure has caused professional consequences, Marquis-Boire’s career was dead before news of his assaults was publicly reported.

Word of Marquis-Boire’s behavior began to circulate in the digital rights community, and soon, news of his fall from grace began to reach New Zealand. Chloe Ann-King began to watch for indications that he had been removed from the high-profile institutions he was affiliated with. On October 12th, Chloe Ann-King tweeted to thank The Intercept for removing Morgan Marquis-Boire from their staff page, saying, “he raped two women I know.” In subsequent tweets, she mentioned that within the insular goth community of Auckland, New Zealand, he was known as “goth Morgan the rapist.”

First Look Media, The Intercept’s parent company, said it never received any reports of sexual misconduct by Marquis-Boire, either internally or, as was the case at Citizen Lab and other organizations, from an external source like Lila. First Look Media said that Marquis-Boire had actually left his position in September, but the update to the website had been slow in coming. But Ann-King’s public denunciation set off a chain effect anyways, when numerous reporters, including reporters at The Verge, contacted both her and the organizations that Marquis-Boire had been involved with.

On October 13th, Citizen Lab released a statement explaining that they had definitively cut ties with Marquis-Boire after hearing from Lila — who is not identified in the statement, but has identified herself to The Verge — that she had been raped.

“I have expressed a desire to try to atone for my actions and I have started trying, starting with figure exactly everything that I need to atone for,” Marquis-Boire told Lila in the chat log from early July. He said he had various thoughts in “early stages,” that would involve flying back to New Zealand, to speak with people face-to-face.

“You will also have to go to Australia,” Lila replied.

“Makes sense,” he said. “I thought I would start with the greatest concentration.”

“Before I went to anyone else, I wanted to give him the opportunity to stop.”

The Verge attempted to reach Morgan Marquis-Boire, but he did not reply to our requests for comment. As far as we are aware, he has not made any plans to return to New Zealand. In October, an ex-girlfriend in contact with him told us that he was thinking of going to the UK to get away from the “stress” of the situation.

Lila never planned on going public with her story. But his reluctance to take further concrete steps to make things right, despite the contrition he expressed, has forced her to take more drastic action, she says.

“I emphasized how important it was for him to stop doing damage,” she said to The Verge. “Before I went to anyone else, I wanted to give him the opportunity to stop. He spent a lot of time talking to me about how he wanted to get better, how he wanted to change, but he also tried to weasel out of any responsibility for what he did to other women. In the end he was not ready to face what he had done. And in the end, that is why I am doing this.”

Additional reporting by Russell Brandom and Laura Hudson.