Graduated response policies (e.g., three-strikes laws) are often adopted to deter repeated criminal activity. In 2009 France passed the Hadopi three-strikes law targeting digital piracy. We model the individual intertemporal decision to engage in illegal activity before and after receiving each strike and, contingent on this decision, the level of illegal content acquisition (piracy) within each stage. We find that monitoring efforts typically believed to deter criminal activity can have unintended results. For example, an increase in the probability of detection can increase piracy. An increase in the punishment is the only policy that unambiguously deters illegal activity.