The press called it the “Gone Girl” kidnapping. But the bizarre story of a former Marine and Harvard-trained lawyer who allegedly masterminded the abduction of a California woman is notable for more than the twists and misdirections that made it fodder for CNN. It’s a rare kidnapping-for-ransom scheme that availed itself fully of the riches of the Internet age, providing a glimpse of a future where brutal, physical crime and its digital analog merge into one.

FBI court filings unsealed last week showed how Denise Huskins’ kidnappers used anonymous remailers, image sharing sites, Tor, and other people’s Wi-Fi to communicate with the police and the media, scrupulously scrubbing meta data from photos before sending. They tried to use computer spyware and a DropCam to monitor the aftermath of the abduction and had a Parrot radio-controlled drone standing by to pick up the ransom by remote control.

All the high-tech theatrics may be part of why the police concluded that the whole thing was a hoax, until the FBI linked the abduction to a former attorney who once made the Journal of the American Bar Association‘s list of “techiest lawyers” for his computer skills.

“Usually the people plotting hard core crimes [and] the people tinkering in their garages with Arduino boards … usually these are not the same people,” the kidnapper himself wrote, in an anonymized email to the press. “In this case they are.”

Home Invasion

The drama began last March on Mare Island, the site of a dilapidated, long-decommissioned Navy base partly given over to suburban development. Located about an hour north of San Francisco, in the city of Vallejo, Mare Island is a study in contrasts, where vast tracts of bombed-out warehouses and rusting steel abut idyllic tree-lined streets of Colonial-style single-family homes.

It was in one of those homes where, on March 23 at about 3 in the morning, 30-year-old Aaron Quinn and his girlfriend Denise Huskins, 29, were jarred awake by a flashlight aimed at their eyes and the electrical, popping sound of a stun gun. A masked intruder was in the bedroom with them, armed with what looked like a handgun with a laser site. He ordered them to lie face down on the bed and then secured them with zip ties and placed swim goggles over their eyes, the lenses taped over to turn them into blindfolds.

The intruder took Quinn’s and Huskins’ blood pressure and placed headphones over their ears to play soothing music with a pre-recorded voiceover advising them to remain calm and to comply with all instructions. If they didn’t cooperate, the voice said, their faces would be cut.

It turned out the intruder already knew a lot about Quinn: his name, where he grew up, where he banked. Now, in a bizarre amalgam of physical robbery and identity theft, he demanded Quinn’s checking account and credit card numbers, his Wi-Fi password, and the passwords for his laptop and his email accounts. When the interrogation concluded, Quinn was drugged and left tied up in the kitchen beneath the watchful eye of a web cam the intruder had taped to the ceiling.

When Quinn awoke 12 hours later, the intruder was gone, and so was Denise Huskins. Sitting in Quinn’s inbox was a message from the kidnapper, sent from Quinn’s own account, ordering him to take $8,500 from his checking account and await instructions on delivering the ransom. Quinn was reminded not to call the police and that the kidnappers were watching his every move.

Skeptical Police

Quinn called the police anyway, and a massive search engulfed Mare Island. Fearing the worst, the police deployed divers and sonar boats to scour the surrounding waterways. The kidnapers never followed up on the relatively paltry ransom demand, but while Quinn’s cell phone was locked up as evidence, it missed two phone calls that later traced back to an anonymous burner phone. And on March 24, a San Francisco Chronicle reporter received a “proof of life” email from the kidnappers, with an audio file attached. “My name is Denise Huskins,” said a woman’s voice. “I’m kidnapped, otherwise fine.”

Then, with no ransom paid, Huskins suddenly turned up alive 48 hours after the abduction, 400 miles south, at a family member’s house near Los Angeles. She told local police that the kidnappers had driven her there and released her. She later said she had been sexually assaulted during the abduction.

The Vallejo Police Department, though, formed its own theory about the strange events, and when Huskins was slow to submit to further questioning, the cops went public with it. They accused her and Quinn of making the whole thing up. “Today, there is no evidence to support the claims that this was a stranger abduction or an abduction at all,” the police said in a news release. “Given the facts that have been presented thus far, this event appears to be an orchestrated event and not a kidnapping.”

That’s when the media turned on Huskins and Quinn. “Is Huskins a real life ‘Gone Girl’, like the movie, who fakes her own kidnap for her own motives?” asked CNN personality Nancy Grace.

Remorseful Criminal

For a kidnapper in a nationally watched case, the police conclusion would seem to be a godsend. But instead of vanishing into the shadows, the perpetrators used Internet anonymity tools to send a series of emails to the press and the police protesting Huskins’ innocence, and expressing remorse over the crime, according to the FBI.

“We are three acquaintances, two of us college graduates, who followed a path we did not think would lead to such horrific crime,” the author wrote in the longest of the emails, sent to San Francisco Chronicle reporter Henry Lee on March 28. “We began as occasional car thieves, progressed to an organized auto theft operation, diversified into burglary, and eventually settled on kidnapping-for-ransom as a means of making enough money to retire from criminality.”

The email is a fantastically detailed account of how three men supposedly turned from legitimate employment into a life of crime, starting off as auto thieves, boosting luxury cars from upscale Bay Area neighborhoods, sometimes using RFID sniffers to wirelessly clone the keys.

They adopted Mare Island as a base of operations, using the abandoned buildings at the southern end of the peninsula to store and process the cars they stole. “We had IP video surveillance, game cameras, a full electronic perimeter, you name it,” the email bragged. “Even a drone. A multi-thousand dollar custom drone, not a kid’s toy. We got good at using it on the island (if you can fly a drone in that wind, you can fly it anywhere), and there was some industrial manufacturing activity in the eastern portion of the island at night that masked the drone’s sound.”

The email goes on in this vein for thousands of words, describing the criminals’ migration through successively darker and more serious crimes, ending with the kidnapping-for-ransom of Denise Huskins as a “trial run” for abductions of future wealthier victims. The email claimed the kidnappers wore wet suits to avoid leaving DNA evidence, and that eventually they planned to accept ransom in the form of diamonds, picking them up via one of their drones.

As corroborating evidence, the kidnapper sent a photo of the room where Huskins had been held and pictures of some of the gear used in the crime.

Like the original proof-of-life message, efforts to trace the new emails were in vain. The author boasted that he was using Tor as well as other anonymizing precautions that would withstand even an “Egotistical Giraffe exploit,” a reference to an NSA de-anonymizing technique that surfaced in the Edward Snowden leaks. He sent the messages through the Singapore-based anonymous remailer anonymousemail.com, and shared the photos—stripped of metadata—through the anonymous image sharing site Anony.ws.

The FBI Steps in

Evidently unconvinced, the Vallejo police still insisted the crime was a put-on, but the FBI was also on the case. And, it turned out, despite his sophistication, the kidnapper had left a digital trail.

The kidnapper had slipped by using a disposable Tracfone to call Quinn after the abduction. The FBI reached out to Tracfone, which was able to tell the agents that the phone was purchased from a Target store in Pleasant Hill on March 2 at 5:39 pm. Target provided the bureau with a surveillance-cam photo of the buyer: a white male with dark hair and medium build. AT&T turned over records showing the phone had been used within 650 feet of a cell site in South Lake Tahoe.

But the real break in the case came when the kidnapper evidently struck again.

On June 5, a second home invasion unfolded in Dublin, California, just east of San Francisco. Once again, a man and a woman were targeted. They fought back and drove the masked assailant away, and in his rush to escape he left behind a different cell phone that was registered to an address in nearby Orangeville, California. The police arrested the owner, Matthew Muller, a 38-year-old recently disbarred lawyer.

Muller, a Harvard law school graduate and former Marine, had been a practicing immigration lawyer in San Francisco. In his most high profile case, in 2012, he fought the deportation of an abused woman to El Salvador, spearheading an online petition that garnered over 100,000 signatures. That year, the Journal of the American Bar Association named Muller one of the nation’s “techiest lawyers.”

“Matt is a geek, but he’s also doing some interesting things with technology,” the Journal wrote, quoting Muller’s wife. “He has a mobile practice suitcase with a computer, printer, scanner, and projector, all battery-powered so he can give a presentation anywhere, screen clients, fill out and print forms.”

The FBI searched Muller’s home as well as a home in Tahoe where he’d been staying and a stolen Mustang he was driving, turning up evidence strongly tying him to the Mare Island kidnapping, including a pair of swim goggles with tape over the lenses and an empty DropCam box. In a storage locker Muller rented, the FBI found a $40 UDI R/C mini quadcopter and a Parrot AR drone.

Last week the FBI unsealed a criminal complaint formally charging Muller with Huskins’ abduction, finally vindicating Quinn and Huskins.

“Extreme Paranoia and Psychosis”

Muller’s lawyer didn’t return phone calls for this story, but in other statements to the media he has claimed that Muller suffers from a severe form of bi-polar disorder. In a jailhouse interview with local TV news station KPIX last week, Muller stopped short of admitting guilt but described a worsening mental health situation. “I suffer from extreme paranoia and psychosis,” he told the station. “It can blur the lines between reality and fantasy in my mind.”

It’s unclear how much of the elaborate backstory in last March’s anonymous emails is reality, and how much is fantasy. The FBI affidavit notes that many of the incidents of burglary, theft, and vandalism described in the messages align with actual incidents reported to the police. But the bureau also notes that the same incidents were described in postings to the Mare Island section of the community news site NextDoor. It’s possible that the author of the email assembled his story Usual Suspects-style from NextDoor bulletin board postings.

At least one aspect of the car-thieves-turned-kidnappers narrative is already falling apart. Police in Palo Alto, California, say that Muller was a suspect in a September 2009 home invasion with similarities to the subsequent Mare Island and Dublin crimes. If true, it means the supposed kidnapping business started long before the email acknowledges. Police at the time did not have enough evidence to make an arrest.

Perhaps the biggest unanswered question is whether Muller’s accomplices, mentioned at such length in the anonymous emails, really exist. In the Dublin attack, Muller is believed to have acted alone. But in the Mare Island kidnapping, both Quinn and Huskins told the police they heard multiple kidnappers talking among themselves. And in the 2009 case, the victim counted two perpetrators. “The victim reported to us that she had seen only one suspect, but she believed that she had heard a voice of a second male suspect,” says Lt. Zach Perron, a spokesman for the Palo Alto Police Department.

So far only Muller’s arrest has been announced. The FBI won’t say whether they’re looking for anyone else or if Muller is cooperating with the government against former associates. “This is a continuing investigation,” FBI spokeswoman Gina Swankie says. “The only reason the case was unsealed and made public was to further the identification of other victims who may have experienced a similar crime.”