The boxes were piled six or seven high, and there were so many stacks on the shelves it was hard to take them in all at once. The other aisles of the Virginia Beach Police Department’s evidence storage unit were filled with guns and knives, hard drives and cash piles — objects that had been used to do terrible things to people. But these boxes — rape kits — contained what was left on a person’s body when something terrible had already been done. “Each one is a victim,” said Lt. Patrick Harris. “Each one has a name and a story behind it.”

The stories went like this: A woman said she was sexually assaulted. She was told that, to prove it, she would need to go to a room where she would be examined from the hairs on her head to the skin beneath her toenails. She was swabbed, plucked, prodded and photographed. When it was over, every bit of what had been taken off her body was slid into small bags, placed in one of these boxes and taped shut. Most likely, the woman assumed that her kit, full of potential DNA evidence, would be sent to a laboratory to be tested.

In the case of these kits, they were not. Today, the Justice Department recommends that all rape kits associated with a reported crime be submitted for DNA analysis. But up until just last year, there were no national requirements or guidelines on what to do with them. Most states had no laws dictating which kits should be tested, meaning every police department could have its own rules about what evidence to test, keep or throw away. Some even let individual detectives make those calls. What happened to a woman’s rape kit could depend not only on what state she was in, but which side of a county line she was on, or even who was on duty when she asked for help.

The results of this haphazard system have been well documented. In New York City, an estimated 17,000 kits went untested. In Houston, there were 6,000. In Detroit, Los Angeles and Memphis, there were more than 11,000 each. Over the past two decades, the “rape kit backlog” has been in the news so many times that now, slowly, the problem is being fixed across the country. Under pressure from activists and legislators, states and cities big and small are counting their kits and sending them to be tested. And then, they are beginning to quietly struggle with a far more complicated challenge: What happens once the kits come back?

That was what Harris, head of violent crimes investigations in Virginia Beach, had been trying to figure out. On the shelf in front of us were 344 kits that had been returned from the lab in 2017. Some were nearly two decades old. 344 names, 344 stories. For months, Harris and his colleagues had been debating a question: Should every victim whose name was on this shelf be notified that their kit had finally been tested? Or would reminding someone of their rape — out of the blue, years later, with no promise of a solution — cause them unnecessary harm?

The experiences of other cities offered no obvious answer. “I didn’t see them wrestle with any issue as deeply, with as much worry and compassion, as this one,” says Rebecca Campbell, a researcher who spent three years observing the handling of Detroit’s untested kits. “This one brought them to their knees.” In Detroit, it was ultimately decided that, at least at first, victims would be notified only if their kits resulted in a “hit,” meaning the DNA found in the box matched a person in the Combined DNA Index System, a national database of offenders better known as CODIS.

Houston tried a different model. A hotline was set up and publicized, so that any victim who wanted information about their old kit could ask for it. Then, police and prosecutors combed through the CODIS hits and decided which cases actually had a chance of moving forward in the criminal justice system. Victims were notified only if their cases seemed “actionable.” “What’s at stake is the well-being and mental health of sexual assault victims,” says Noël Busch-Armendariz, a researcher who was involved in Houston’s process. “You never know where people are in their lives and what support systems they have or don’t have ready for them.”

In Louisville, however, all victims were notified that their old kits were tested — even if not a speck of another person’s DNA was found in the box. Lt. David Allen of the Louisville Police sees it this way: “It’s their information. It belonged to them to start with, and we owe it to them to follow up.”

Even the organization of a famous television actor had tried to figure out what to do. The Joyful Heart Foundation — created by Mariska Hargitay, star of “Law & Order: Special Victims Unit” — had been instrumental in pressuring states to count their untested kits, and in 2016, the nonprofit released a 159-page report on victim notification. The consensus? “There was no agreement,” says researcher Courtney Ahrens. It wasn’t that the advocates she interviewed disagreed with police, or police disagreed with mental health professionals. There were disagreements within all of the groups she studied, even the victims themselves. Some said, “That’s my body in that kit.” They wanted to be notified by a knock at their front door, no matter what the results. Others were horrified at that idea. What if, they asked, the perpetrator of the assault was living in the same house?

In Virginia, this dilemma would ultimately pit police, prosecutors, advocates and lawmakers against one another, making the situation far more complicated than they ever intended. Everyone wanted to do the right thing for victims; there was just no way to know what that was.

The case of Virginia’s rape kits

In 2014, the Virginia legislature called for a count of untested rape kits. There were, it turned out, 2,902 kits in the state that had never gone to a lab. The oldest was from 1985.

The state’s attorney general, Democrat Mark R. Herring, had chaired a task force focused on sexual assault on college campuses; now, he wanted to take on the state’s rape kit backlog. As the legislature passed a bill ensuring all future kits would be tested within 60 days, Herring secured $3.4 million in grants to pay for the testing of the older kits at a private lab. Then his office drafted another piece of legislation that would require law enforcement agencies to notify victims that their kits had been tested. The bill’s chief patron was state Sen. Barbara A. Favola (D-Arlington). It passed both houses without a single dissenting vote and was signed into law by then-Gov. Terry McAuliffe in March 2017.

The choice of words in the law (and the ones left out) set the course for everything that happened next: “In the case of a physical evidence recovery kit that was received by a law-enforcement agency prior to July 1, 2016, and that has subsequently been submitted for analysis” — meaning, the rape kits that were previously untested — “the victim, a parent or guardian of a minor victim, or the next of kin of a deceased victim shall be notified by the law-enforcement agency of the completion of the analysis and shall, upon request, receive information from the law-enforcement agency regarding the results of any analysis.” The law, it appeared, mandated that all victims be contacted.

With more than 300 untested kits in its possession, Virginia Beach had the most of any jurisdiction in the state. It was the first to send its kits to the lab, the first to get them back, and the first to have to follow the new victim notification law.

Lt. Harris heard about the law from the department’s deputy chief, Bill Dean. They played out the scenario: “Do we call up a victim and say, ‘Remember that rape from 20 years ago?’ ” Harris asked. “ ‘Well, we’ve got the DNA test back, but we still can’t do anything with it.’ ”

It wasn’t that he didn’t want to do anything with it — if more than 300 kits meant detectives could go out and catch more than 300 rapists, he would be thrilled to do just that. But Harris knew this initiative likely wouldn’t lead to 300 or 100 or even 10 convictions. Unlike how things work on TV, DNA evidence is rarely the magic ingredient in putting someone behind bars. For the majority of victims, he suspected, their cases still couldn’t be proved before a judge or jury.

As the testing results came back from Bode Cellmark Forensics over the course of 2017, Harris and a prosecutor combed through each case file associated with the kits, searching the previous detectives’ notes to try to find something they could use. So far, of the 344 kits sent to the lab (all of which belonged to women), only 49 resulted in a “hit” — a match in the national CODIS database that would tell Harris whose DNA was found on the woman’s body. There was only one case of those 49 where the victim hadn’t already named that person as the perpetrator.

The plan

In 2016, when they’d first begun preparing for the return of the kits, the Virginia Beach Police Department had gathered its most experienced SVU officers, victim advocates from the community and representatives from the city prosecutors’ office to devise a plan. They decided to follow in the footsteps of Houston, which notified only those victims whose cases police and prosecutors agreed were “actionable,” meaning the investigation could be reopened. They planned to set up a hotline that any victim could call to get information about their kit.

Then the victim notification law passed, and they weren’t sure if their plan would still work. So in the spring of 2017, they regathered the team and set up a meeting with representatives from the state attorney general’s office, where the law had been drafted. The word most people used to describe that meeting to me was “heated.” The Virginia Beach team came away discouraged. As sure as they were that it was not the right thing to do, it appeared they would be violating the law if they did not contact all 344 victims.

Virginia Beach’s chief prosecutor, Colin Stolle, conducted an independent review of the law and came to the same conclusion: All victims had to be contacted. And because the law said “shall be notified,” setting up a hotline didn’t count. “ ‘Shall’ means something very different than ‘may,’ ” Stolle told me. “It is an affirmative requirement that the police department take action.”

And so the question became how to take that action. In September, the team gathered again to discuss their options. They worried about notifying victims with a phone call, given what happened when Meister left that voice mail with the woman who had remarried. They considered having detectives and advocates make the notifications in person, but that, too, seemed problematic. “I’ve stated this a number of times. I don’t think having a police car show up in front of a victim’s house is the way to go,” argued Kristen Pine, the chief programs officer at the area’s YWCA, which offers every person who receives a rape kit examination an advocate to go through it beside them. In all the years that she had worked with victims of sex crimes, she had seen how devastating reminders of the assault could be. Some women she’d counseled still called her every year on the anniversary of their rape.

“A letter is the most passive,” Pine told the group. The other advocates in the room agreed. A letter could be sent via certified mail, so the woman whose name was on the envelope would be the only one who could sign for it. They could make it vague — avoiding words like “rape” or “SVU,” in case another person saw it — but include the date the crime was reported, so the victim would know what it was about.

“So,” Harris asked the group, “is everybody in agreement that a letter, in some form, is the best option?” Around the table, everyone on the team nodded. The meeting ended, and Pine headed back to the YWCA, thinking about what it might be like for the victims she has known to receive that letter. “How does the saying go?” she asked me. “The road to hell is paved with good intentions, right?”

A misunderstanding

“In my bill, only those who have a DNA hit are notified,” Sen. Favola said. The law, she said, required notification of victims only when a kit resulted in a match in CODIS, the national database. In Virginia Beach, that would mean only 49 people, instead of 344.

But Virginia Beach was soon going to notify all victims — not because they felt it was the right thing to do, but because representatives from Herring’s office had told them it was what the law required. “My understanding is that if there were no results, meaning there was no DNA, that they are not required to be notified,” Herring repeated. “But I will go back and double check.”

Later, Herring’s press representative Lara Sisselman wrote: “The Victim Notification Law requires law enforcement to notify a survivor when a tested kit yields a result that is a hit in CODIS.”

But this still put Herring’s interpretation of the law at odds with the police departments’ understanding.

One day in November, there were more than 300 letters to be sent on Harris’s desk, not 49. The department hadn’t heard anything from Herring’s office.

Compiling all the letters had taken Harris’s detectives weeks. So many of the victims had moved away, or had been in Virginia Beach only as tourists. Some had died, and so they had to search for a close family member to notify instead. Some had gone on to see their assailant arrested and found guilty, without the kit ever being tested. But because their kits were included in the 344, even they would be getting a letter now.

“On July 1 2017, the state of Virginia passed new legislation requiring municipalities to reach out to people who reported a crime in the past when an analysis of the evidence related to that report has been completed,” the letter said. “The Virginia Beach Police Department is contacting you because your previously reported crime with Offense Number [number here] falls into this category and we would like to provide you with your options to obtain more specific information regarding these developments.”

The consequences

The first call came on Nov. 9, three days after the letters had been sent. It rang in the office of Jennifer Messick, the police department’s victim advocate, who had been sitting at her computer, sipping iced tea. She picked up her phone without pausing to brace herself, the way she would come to do in the weeks ahead. “Virginia Beach Police Department, this is Jennifer. May I help you?” she answered. The woman on the phone, Messick later recalled, was crying. She had received a letter. She wanted to know what was going on. Her case was more than a dozen years old.

Messick explained slowly and calmly: the kit, the requirement that they notify her, the fact that this didn’t mean the status of her case had changed. “Why would you do this?” the woman asked, still crying. Messick wanted to explain that she hadn’t been the one to do this, but it hardly mattered. She asked if the woman would like to speak to a detective. She offered to connect her to counseling services. The woman declined and hung up the phone.

One call came from a woman who received a letter about an in-law of hers. Messick looked up the case number and realized this was one of the cases in which the victim had died. The detectives had found an address for someone they thought was the victim’s next of kin. It was not. Now this woman was asking what she was supposed to do with the information that, more than a decade before, a relative she hadn’t been very close to had reported a rape.

Another call went directly to Lt. Harris. When he picked up, the woman on the line was hyperventilating. “What does this mean?” she asked. “Is he getting out of jail?” Harris, confused, quickly pulled up her case file. The man who assaulted her had been arrested and was serving time. Harris tried to calm her, explaining that her kit was tested only because of a change in policy. This didn’t mean anyone was getting out of jail, he said. The man had years left on his sentence.

That evening, the woman called back, begging for confirmation that when the man was released, they would call and warn her. “Promise me,” she said.

Maybe he would call the attorney general, Harris said. Or maybe what was done was done. He had so little time to dwell on it all. There were 55 new sex-crimes cases in November, and 42 in December. A woman said she was abused by her youth pastor. A woman reported going to a bar, going home and waking up with a man on top of her she didn’t remember inviting in. There were more victims who, to prove what happened, would need to go to a room where they would be swabbed, plucked and prodded. More names, more stories. More evidence to be tested.

Rachael Denhollander won the SI ‘Inspiration of the Year’ award. Christine Blasey Ford presented it to her.

Read Ford’s message to the woman who filed a suit against Larry Nassar

He was accused of rape, but this former Baylor fraternity president accepted a plea deal. Now, he’ll serve no jail time.

The victim and her family called the deal ‘an absolute travesty’

Helping survivors of sexual violence is at the center of the 2018 Nobel Peace Prize

Nadia Murad and Denis Mukwege were awarded for their efforts to end sexual violence as a weapon of war