Behind Every Serial Abuser, There Are Many Enablers

My name is Chelsea Komlo. I am a contributor to open source software and a core contributor to the Tor Project as of 2017. My work includes designing and implementing distributed systems, cryptographic protocols, and privacy enhancing technologies.

In December 2015, I met Jacob Appelbaum, a powerful and high-profile leader of the security and privacy community, at the 32nd Chaos Communication Congress (CCC). Jacob was a well-known figure at CCC and regularly gave talks and workshops; I was a first-time attendee. Less than a week later, Jacob raped me in his apartment. Two of Jacob’s friends witnessed the assault, one other participated.

In April 2016, I notified several individuals at the Tor Project about this sexual assault. In June 2016, I published a description of my assault under the pseudonym “River” on jacobappelbaum.net alongside others’ accounts of harassment and assault.

I was new to the security and privacy community, and while Jacob’s abusive behavior was an open secret for many, I was completely unaware. I trusted Jacob as he appeared to be a trusted leader in this space. I struggle to find words which can describe how it felt to learn that many people in the community had known about his abusive behavior.

I wrote the below public statement in September 2016. I did not publish this for a variety of reasons, including fear of retaliation. I also hoped the swift actions taken by many organizations would prevent future abuse.

I see now, two years later, there is still so much more to do.

I am publishing this statement below today because the same environment that allowed my rape to occur two years ago is still alive and flourishing. To this day, the CCC and other organizations are willing to shelter known abusers. This lack of change means others continue to be hurt, even though this harm is preventable.

The CCC leadership has enabled and protected sexual predators by turning a blind eye to past abuse as well as sidelining those who speak up. In doing so, the CCC is actively refusing to protect people in the community. I was deeply hurt by this two years ago- and others continue to be. This week alone, we have seen Thomas’s report of assault and the CCC’s complete refusal to take preventive and precautionary safety measures against further harm.

Systemic abuse does not happen in a vacuum; it is not just one bad individual. The enablers of sexual predators should also be held accountable- the people and organizations whose inaction, avoidance, and even support allows abusers to go unchecked and immune from accountability.

Abuse can be constructively addressed after it happens. The second person involved in my assault has apologized and gone through a community justice process. I forgave this person, and I firmly believe that individuals (and organizations) who have committed mistakes should be forgiven if they truly understand the harm done and genuinely work to make things right for the future.

Jacob’s actions have been the exact opposite. Over the months after I reported the rape, Jacob threatened me through a variety of channels. Multiple journalists sympathetic to Jacob reported stories and later produced an opera from his account of what happened. I was portrayed as a spineless young woman who “wanted what she got.” The truth is that I never wanted what happened and I clearly informed Jacob of my boundaries multiple times.

Even worse, Jacob’s supporters have failed to acknowledge his abuse and have done nothing to prevent future harm. The leadership at the CCC have pushed back against banning specific abusive behavior. Jacob continues to study as a Ph.D student with Daniel J. Bernstein and Tanja Lange, who have unquestioningly defended Jacob, providing a safe environment for him and (from what I am aware) relieving themselves of any responsibility to investigate his abusive behavior despite numerous public allegations.

These leaders in our community maintain the status quo because it suits them, using excuses ranging from a) “Guilt or innocence should be decided by a court of law,” to b) “We don’t have enough evidence to make a decision,” or even c) “Bad behavior should be solved through mediation, not confrontation.” However, inaction is what allowed my rape to occur, and inaction is what will lead to the abuse of others in the future.

Leaders of organizations enable predators when they fail to acknowledge and prevent known abusive behavior. If nothing changes in these organizations, what happened to me will happen to others.

It doesn’t have to be this way. Our community can be both highly productive and safe. However, organizations need to create effective structures to report and take action against abusive actors. Anything less should not be tolerated.


I wrote the below statement a year ago. It is unchanged with the exception of minor grammatical edits.


I am River from jacobappelbaum.net.

On the evening of January 1st, 2016, in Berlin Germany, Jacob Appelbaum raped me. While it is true that I was intoxicated, what happened to me was against my will and Jacob knew this. This assault involved another male individual. It was also witnessed by two male friends of Jacob’s. This sexual assault involved drugs, manipulation, and the violation of my trust, factors which are common in crimes such as this.

Jacob has used his position of trust and leadership within our community to further his own sexual interests. On numerous occasions over the three days that I spent with him, Jacob attempted to convince me to participate in sexual behaviors with his male friends. As a new person in the privacy community, I wanted to be known for my mind and technical ability, and I told Jacob this. When I told Jacob “no” on multiple occasions, he continued to push his sexual agenda despite my clear refusals. In one of our first encounters, Jacob told me that participating in a sex party would “build trust” and “bring us together”.

I thought Jacob was a friend and engaged in consensual sexual relations with him during those three days. It took me five months to process and understand that Jacob had violated my trust and my body. It is common for victims of rape to take months, if not years, to come to terms with this, particularly if the abuser is one in a position of trust to them.

The larger community needs to know that this has happened. I do not want this to happen to anyone else.

I have worked with legal counsel throughout this entire process. I have strongly considered the idea of seeking criminal charges in Germany against Jacob, but initiating lengthy legal proceedings in another country which I am neither a citizen nor a resident is a significant barrier for me. That said, I would gladly discuss this with any interested German authority and would be willing to testify in any court of law about this crime without hesitation. However, my personal motivation has always been to inform our community.

Many individuals have stepped forward with stories of abuse by Jacob, spanning a time period of nearly a decade. What is difficult to comprehend is that Jacob continued to maintain a powerful and influential position within our community despite having a reputation for professional and sexual abuse. Why concerns about Jacob were not heard nor acted upon sooner is a question for us all.

Once Jacob’s abuse was made public, many in the community responded by recognizing and rejecting his behavior. We should be proud of this. However, we are not immune to predatory individuals in the future. There is more work to do.

There is surely not one answer to solve the issue of abuse within our community. What is important is that we talk to each other about what has happened and what we need to do differently in the future. How can we be sure that we effectively detect and deal with bad actors in our community? What structures do we need in place so individuals feel safe to report abuse? How can we create a community where anyone can reach their full potential?

How could we have let this happen? What does it mean — for each of us — to ensure that it won’t happen again?