On August 31, 2014, the Internet nearly exploded.  A website called 4chan.org uploaded nude images of over 100 women, including many well-known celebrities.  Though this was not the first incident of private celebrity photos (or videos) being made public on the Internet, it was the largest leak of its kind to happen all at once.  The intimate photos posted on 4chan were taken from each celebrity’s personal iCloud account.  A few days after the leak, Apple confirmed that individual iCloud accounts were hacked in a “targeted attack” where hackers used “brute force” to gain access to individual usernames and passwords.  Since the initial leak, several more rounds of stolen private celebrity photos have been released by 4chan.org.

Additionally, less than six weeks after the initial 4chan celebrity photo leak, a website called viralpop.com posted a database of at least 100,000 Snapchat photos which were intercepted by hackers and then later downloaded onto 4chan’s website.  Snapchat is an app where users send photos or video clips to their friends which self-destruct within 10 seconds of receipt.  Once the database was posted on viralpop, users of 4chan downloaded the files and created a searchable database where people can find photos by searching for Snapchat usernames.  Aside from the obvious privacy concerns of users who believed that their photos were deleted, the Snapchat leak is perhaps even more disturbing than the celebrity photo leak because many of the nude photos released are of underage boys and girls (half of Snapchat’s users are between the ages of 13 and 17).  It is not clear whether Snapchat will be sued over this incident, though Snapchat maintains that the leak originated from third party apps which Snapchat’s Terms of Use expressly prohibits.

In the weeks following the celebrity nude photo leak, a heated discourse emerged from online and traditional media outlets and from the celebrities themselves via social media.  While most people agree that it was a criminal breach of privacy when someone hacked into the iCloud accounts of celebrities and publicly exposed their private pictures, some also believe that the victims of the breach should take responsibility for their part in the incident.  These critics believe that the celebrities should have taken better care to secure the photos or not taken nude photos in the first place, because they knew that being famous would make them a target for this type of attack.  Most of the celebrities involved in this breach were women, which has led some critics to suggest that this violation of privacy is yet another example of female oppression in our male dominated society.  This sensationalized exploitation reminds women that they have no right to privacy in the age of the Internet when it comes to their own bodies.  Actress Jennifer Lawrence, a victim of multiple rounds of the 4chan photo leaks, said in a recent interview that the leaks amounted to a sex crime and accused people who viewed the photos of perpetuating a sexual offense.  It is important to note that less than a handful of male celebrities have had private photos stolen from their iCloud accounts and released as part of this celebrity photo leak.  Also, though not surprisingly, the public indignation about the incident is primarily centered on the victims we recognize.  Very little of the discourse even refers to the hundreds of photos of not-famous women which were also released in these leaks.

We have also learned from this massive breach that there is little legal recourse for victims of hacking.  After the photo release, celebrity victims turned to lawyers and copyright infringement law to resolve their problem.  Martin Singer represents a group of unnamed celebrities whose photos were released on 4chan.  Singer sent a letter (and released it to the press) threatening to sue Google for over 100 million dollars for not acting quickly enough to remove links to the photos from its search lists.  Singer’s letter cites the Digital Millennium Copyright Act of 1998 which provides a safe harbor from liability to internet service providers who do not have actual knowledge that its users are posting “infringing” materials.  In the letter, Singer maintains that Google has had actual knowledge of the infringement by its users because Singer himself sent Google “dozens of notices” since the initial photo leak demanding that Google remove the content.  Google has since responded that it removed thousands of photos within hours of each request and closed hundreds of user accounts.

It may seem odd that Google is the target of this lawsuit because Google is primarily a search engine; Singer’s letter does not accuse Google of hacking into the iCloud accounts or posting the leaked photos online for all to see.  But, aside from having deep pockets, there is another reason that Singer could be targeting Google: the real photo hacker(s) are unknown and may never be discovered.  Other hacking incidents over the past couple of years highlight the near impossibility of prosecuting these types of criminals.  Numerous times, anonymous yet extremely sophisticated hackers have stolen sensitive customer information from large retailers and even banks, without any legal repercussions.

Although there are a host of laws in place that criminalize hacking, because of the nature of the crime and the nature of the Internet itself, hackers are rarely punished.  Most attempts to curb photo leaking on the Internet do little to protect victims.  Recently, California enacted laws that criminalize “revenge porn,” similar to laws already in place in 12 other states.  Both SB 1255 and AB 2643 were signed by Governor Brown on September 30, 2014.  Largely, these laws aim to prevent jilted former lovers (or anyone else who might have nude photos of someone) from posting private photos online to publicly humiliate the victim.  SB1255 states that a person who intentionally distributes naked photos or videos of a person engaging in a sex act “knowing that the depicted person does not consent, is guilty of disorderly conduct.”  AB2643, alternatively, gives victims of revenge porn the right to file a civil action against the perpetrator who distributed the material without the victim’s consent, provided that the victim suffered severe emotional distress.  Although these laws are a significant step in the right direction toward protecting individual privacy, the circumstances under which these laws apply are very narrow, and thus not very effective.  The laws only apply to the person who makes the recording, not third party distributors who publish the photos for all to see.  Also, if the victim took the recording or photo of him or herself, these laws do not apply.  Neither the victims of the leaked celebrity photos nor the victims of the stolen Snapchat photos will benefit from these laws.  The frustrating reality is that there is little to no legal recourse for many victims of these types of privacy breaches.  It is unclear how the law will develop to provide greater individual privacy protections around the Internet in the future, but as it stands now, it is doubtful that any law could fully protect privacy on the web.  For now, it seems the only way to protect your privacy is to rely on yourself.

Maintaining complete privacy over material stored or sent online is undoubtedly impossible to achieve, but for those who enjoy the convenience of technological innovations, there are a few simple steps one can take to help increase the protection of their privacy.  First, if you choose to use cloud storage systems to store personal photos or information, be sure to take advantage of the highest security system that that provider allows.  Since the celebrity photo leak, Apple and other companies have written about how to do this.  The most important take-away for protecting any online account is to have effective password protection; passwords that are difficult to crack, using different passwords for different accounts, and changing passwords regularly.  Second, if you are using internet capable devices to take private photos, be sure to disable any feature that automatically uploads photos to a cloud storage system or social network application.  In other words, store private photos locally on devices or external hard drives that only you can access.  Third, do not send private photos to third parties via electronic device unless you are absolutely sure that you can both trust that person (today and in the future) not to share the photo and trust that the person’s devices and online accounts are also secure.  The bottom line is that it only takes a few taps on a smartphone to make something very private turn into something very public, and once something is online, it is out of your hands forever.  With so few effective legal protections in place, it is up to each individual to vigilantly take precautions to protect private material.