Twelve Years After the iCloud Leak, the Law Finally Treats a Fake Like the Real Thing
After the 2014 theft of nude photos of famous women, it took more than two years to sentence the first hacker named in this story. In June, federal agents took down two deepfake sites in a single day.
At the end of August 2014, nude photos of dozens of famous women began appearing on the message board 4chan. The person posting them claimed to hold images of more than 100 celebrities, among them Rihanna, Hope Solo and Kate Upton, ABC reported on September 3. Jennifer Lawrence's representatives called it "a flagrant violation of privacy" and said the authorities would prosecute anyone who posted the stolen photos.
That autumn Lawrence refused to let the story be filed under gossip. "It's my body, and it should be my choice," she told Vanity Fair, as WTVR reported, calling what happened a crime rather than a scandal. "The law needs to be changed, and we need to change."
At the time, much of the internet treated the leak as entertainment. The law treated it as a hacking case.
A hacking case, not a privacy case
The prosecutions that followed were built on computer-crime statutes, not on the harm of publication. Several men were eventually convicted of breaking into accounts, the cases stretching out over years after the leak.
The best documented of them shows the gap. Ryan Collins, from Lancaster, Pennsylvania, was sentenced to 18 months, in federal prison in October 2016 for a felony violation of the Computer Fraud and Abuse Act, after running a phishing scheme that gave him access to more than 100 Apple and Google email accounts. The Justice Department's own release was careful to add that investigators had found no evidence linking him to the actual leaks, or showing that he shared what he took.
In other words, the crime that could be proven was getting into the accounts. Spreading the pictures, the part that did the damage, was much harder to reach.
Twelve years later
Fast-forward to this summer. On June 11, 2026, the Justice Department and Homeland Security Investigations seized two domains, CFAKE.com and SOCFAKE.com, that had been publishing hundreds of thousands of deepfake pornographic images and videos of women without their consent, the U.S. Attorney's Office in New Jersey announced.
None of those images were stolen. They were fabricated. Under federal law, that no longer mattered.
The legal basis was the TAKE IT DOWN Act, enacted in May 2025, which makes it a federal crime to publish digital forgeries depicting an identifiable adult in a sexually explicit way without consent. A federal judge found probable cause that the sites were violating it. "For the victims whose images were distributed without their consent, the harm is not virtual," said Robert Frazer, the U.S. Attorney for New Jersey, whose office announced the seizure. "It is deeply personal and often enduring." The case crossed three countries: Italian police flagged the site, U.S. investigators built the evidence, and French authorities acted on it under the Budapest Convention on Cybercrime.
The comparison with 2014 is stark. Then, prosecutors had to prove a break-in to get a conviction. Now, publishing a convincing fake is the offence in itself.
What changed in between
Three things moved over those twelve years.
The first is technology. In 2014 a nude image of a celebrity had to exist before it could leak. Today anyone with consumer software can make one that never existed, which is why the law had to stop asking where an image came from and start asking whether the person agreed to it.
The second is the law's focus. The 2014 cases were about stolen passwords. The 2026 case is about publication without consent, which is where the harm actually sits.
The third is who controls the image. Since 2014, publishing intimate photos has stopped being something that only happens to people. It has become something people can choose to do, on their own pages, at their own prices, with the ability to stop.
That shift turns a question about leaks into a question about where consent is built into the format. On subscription platforms it is the starting point: the person in the picture is also the person who posted it. For anyone who wants that kind of photography from people who chose to publish it, a ranking of the most popular creators on OnlyFans is a more honest place to start than a search for a famous name.
Worth saying out loud: a ranking measures attention, not ethics. It cannot inspect every image a creator posts, it cannot police copies that end up elsewhere, and it is not a substitute for the takedown rules the law now requires platforms to follow.
The lesson of the leak
The women of 2014 had to watch their photos circulate while the legal system searched for a statute that fit. Lawrence's team promised to prosecute anyone who posted her images, and she said the law had to change, but the tools to do that cleanly did not yet exist.
The CFAKE seizure shows how far things have moved since. A judge did not ask whether the women depicted were famous, or whether the pictures were real. The only question was whether they had agreed.
That is the change twelve years produced. Not better security, and not fewer fakes, but a different question at the centre of the case.
The image no longer belongs to whoever can make it. It belongs to the person in it.
This entry was posted 2026-Oct-15
