Inside The Internet's Secret Marketplace For Hacked Photos Of Naked Celebrities

Some dealers say the celebrity photo trading industry died on the afternoon of Labor Day 2014. An anonymous pornography collector, "OriginalGuy," did the unthinkable and set about uploading his entire collection of stolen photographs to notorious porn forum AnonIB - hundreds of images of 101 different actresses and singers. When users discovered what was happening, they swarmed the site. Eventually he was unable to load the forum to post any more images, so he took to 4chan, the anarchic discussion forum read by thousands.

That's when people really started to notice what was going on.

Hours after OriginalGuy shared hundreds of stolen photographs of female celebrities, the media began to realize what had happened. At first, they weren't sure how to report on the incident. Gossip blogger Perez Hilton re-uploaded stolen naked photographs to his site, and was forced to issue an apology hours later due to widespread outrage. TMZ, the celebrity news site famed for breaking stories of hacking and sex scandals, took hours to publish anything on the leaked images. It looked like this was a world-first: Hackers had infiltrated Apple's iCloud service and made away with a seemingly endless trove of stolen photographs. But for those in the know, this wasn't new. Rather, it signaled the death of a thriving underground industry that had existed online for years.

This is the story of that death, and the way it led within days to a reconstitution of the marketplace in a new home, where it thrives today.

/stol/, short for "Stolen"

Pornography forum AnonIB was started in May 2006, formed as an offshoot site of notorious anonymous message board 4chan. The site was controversial from its very inception. AnonIB has struggled to prevent its users from posting child porn on the site, which includes the subforums "Teens (18+)" and "Drunk/Passed Out." One board in proved particularly popular: /stol/, short for "Stolen" and "Obtained Pictures." For years, /stol/ served as a kind of advertising system, almost like a Craigslist for hackers.

Here's the kind of ad users see on AnonIB. This French hacker advertises his services as a "ripper" who can steal naked photographs from iCloud accounts:

But after OriginalGuy posted his trove of photos online, AnonIB was immediately taken down. For two weeks, the site claimed to be undergoing "scheduled maintenance." The truth was that the site's anonymous operator was scrubbing the site of any incriminating evidence that linked the porn forum to the iCloud hacks.

When AnonIB came back online, every post in the /stol/ forum had been deleted. Thousands of stolen photographs and hundreds of ads for iCloud hackers had been removed. The internet's celebrity photo trading ring gradually realised that its central hub had been compromised.

Nonetheless, some dedicated users returned, asking for help in stealing photographs of women. They were cautioned from posting on the site, warned that journalists were monitoring AnonIB for information about how iCloud accounts were illegally accessed.

The mass leak of celebrity photos (dubbed "The Fappening" by fans amazed at the scale of the collection) forced would-be photo leakers to take to private forums and chatrooms. They communicate using a network of monikers, encrypted emailed addresses, and Google-hosted Blogger pages.

Google's servers host a thriving market in hacked pictures

One of the new hubs for stolen photographs of celebrities is a blog known as "Abi Wins." It's public and available for anyone to view. Abi Wins is also hosted on Google's Blogspot servers, which is unfortunate for the company which so keenly defended itself against an accusing letter from top Hollywood lawyer Marty Singer.

In his note to Google founders Larry Page and Sergey Brin, as well as chairman Eric Schmidt, Singer accused Google of failing to remove photographs from its Blogger service. Google responded to the letter, defending its moderation procedures, remarking:

We've removed tens of thousands of pictures -- within hours of the requests being made -- and we have closed hundreds of accounts. The Internet is used for many good things. Stealing people's private photos is not one of them.

The Abi Wins blog is used to index stolen photographs of celebrities obtained by accessing iCloud accounts. Users then discuss the latest leaked images using Chatango, a chatroom tool created by programmers from MIT, Caltech, and Berkeley. Business Insider contacted Chatango to inform it that stolen images were being shared using its forums. We also reached out to Google about Blogspot, and will update this post when we hear back.

But the Abi Wins blog is just the public gateway to the internet's celebrity photo trading ring, which lives on despite the increased press attention that occurred following the Labor Day leak.

The new home for stolen pictures

The celebrity photo fans who used to gather on AnonIB have a new home on the internet: Volafile. German startup Volafile offers "realtime filesharing" for large groups of people, along with a chat facility to discuss the files posted. The site allows the creation of anonymous accounts, and offers fast upload speeds. For iCloud hackers with collections of celebrity photos to offload, Volafile is a dream come true. New celebrity photo leaks are now emerging almost exclusively through Volafile.

When a photo collector is about to leak new stolen photographs, they post excited messages, creating hype for whatever is about to appear online.

The left of this screenshot shows the chatroom discussion of leaked images, and the list on the right shows files uploaded to the room. A user named "realpsamathe" is excitedly announcing a new celebrity leak, posting "HERE WE GO." in the chat:

"realpsamathe" uploaded a large video file named "THE ONE YOU'VE BEEN WAITING FOR." The file was a video sent by actress Abigail Spencer, known for her roles in Cowboys & Aliens and the TV show Suits, to her boyfriend, actor Josh Pence, who starred in The Dark Knight and The Social Network.

Chatroom users rushed to thank realpsamathe for posting the stolen video.

As users downloaded and viewed the stolen video, which had just been shared online for the first time, they offered to send Bitcoin donations to realpsamathe. He declined, saying "I don't want donations." He instructed users to "go donate somewhere meaningful" and shared a link to a UNICEF donation page to help fight Ebola in Africa.

The trade in photos of under-age celebrities

Users constantly request photographs of 18-year-old Olympic gymnast McKayla Maroney and actress Bella Thorne, who is aged just 17. Naked photographs of both women are alleged to have leaked online as part of the iCloud leak, and the photographs were taken while both were underage. That hasn't stopped celebrity photo fans requesting that others post the child pornography online. Every request results in a debate over the ethic of child pornography.

New photographs and videos of female celebrities are still being posted online on a daily basis. "OriginalGuy," the person who first leaked the images, seems to have gone silent, but other established photo traders have realized that the industry is all but dead and are offloading their collection for Bitcoin (and the adoration of their peers) using chatrooms like Volafile.

When Business Insider contacted Volafile founder Nils Kuhnhenn, the chatrooms were deleted, along with the content hosted on Volafile and the backup chatrooms reserved for "emergency use." Kuhnhenn informed Business Insider that he deletes rooms that breach the site's terms of use as he finds them.

Yet another massive cache of celebrity photos is poised to leak

But there's an even more secretive side to the online photo trading industry. Private dealers still operate, using encrypted email accounts and fake names to avoid detection. After observing the conversations in the main Volafile chatroom, Business Insider learned that a dealer named "Sets Ahoy" has a substantial collection of unreleased images, potentially equal in size to the "OriginalGuy" collection that was posted online on Labor Day. (A "set" is a collection of images, usually around a dozen.)

Using cached versions of deleted messages on the anonymous note site Pastebin, Business Insider was able to contact Sets Ahoy through his encrypted email address. Posing as a potential buyer, Business Insider messaged the photo dealer. We didn't specify what we were looking to buy, just that we had heard he was reliable. Sets Ahoy replied within hours, telling us "You came to the right guy." He sent over his catalogue of stolen celebrity photographs and videos without any prompting. Here it is in full:

Continuing to pose as an interested buyer, we expressed interest in the photographs of British model Daisy Lowe. No stolen photographs of Lowe have leaked online. If Sets Ahoy were to possess them, then it might prove there may be thousands of stolen photographs yet to be released.

Minutes after we expressed our interest in the Daisy Lowe photographs, Sets Ahoy replied with a price.

For around $350 (roughly 1 bitcoin), Sets Ahoy was selling a collection of stolen naked celebrity photographs. To prove that he was in possession of the photographs, Sets Ahoy sent a Dropbox link to a sample photograph from the Daisy Lowe set. The photograph shows Lowe in a hotel bathroom with an unnamed male. Their genitals are obscured by black bars, and Sets Ahoy's email address is watermarked over the image. Sample photographs are intentionally censored by traders to reduce their value and prevent other dealers selling the same collections. Minutes after Sets Ahoy uploaded the sample to Dropbox, he deleted it to avoid detection from Dropbox's illegal content filters. Business Insider contacted Dropbox for comment on this story, and will update this post when we hear back from them.

Sets Ahoy sent Business Insider a Bitcoin payment address, which could be used to send him the one bitcoin he requested in payment for the stolen photographs. The address was newly created, showing no previous transactions. It's likely that it would have been deleted immediately after payment was processed, which makes sure that Sets Ahoy remains anonymous. Business Insider did not purchase any photographs, and the sample image was deleted as soon as it was received. We contacted Daisy Lowe's representatives prior to publication to inform them that their client was a target of iCloud hackers, and that stolen photographs of her were circulating online.

Hundreds or thousands of photos have been stolen

The collection of photographs that OriginalGuy posted online on Labor Day is by no means the full extent of the stolen material that photo traders possess. Dealers like Sets Ahoy have hundreds, possibly thousands, of photographs and videos of female actresses that they are seeking to offload. Some traders realized that OriginalGuy's leak changed the underground industry forever, and so they have taken to leaking the images online for free, as realpsamathe has been doing on Volafile.

It's difficult for Hollywood lawyers like Marty Singer to clamp down on the spread of stolen photographs online. For every blog shut down, and every chatroom deleted, the community of people hungry for more content moves on to another site. It's difficult to see where the community will move next, although the trend is to adopt more private networks.

There has been talk of a "deepweb" marketplace for stolen celebrity photographs, accessible only through the Tor web browser. Tor is constructed so that no search engine would be able to index that auction site, and nobody would be able to discover it without knowing the unique series of letters and numbers that form the URL. Until the dealers flock to the deepweb, however, the signs of the internet's underground photo trading ring remain: Cached pages, notes, emails and forums linger online for lawyers, journalists, curious internet users, and potential buyers to discover.