They were already targeted. The phish click gave the powers that be their IP. Search through the ISP or the VPN provider who's the client and their address. Make up a false report, give a heads up to the police officer to rough up the target.

Literally don't click strange links through text or email. Source is a friend who did some shit in Afghanistan.

"click here to sign a petition for wrongthink"