West Virginia sues Apple, saying iCloud distributed ‘child porn’

By Nate Raymond and Stephen Nellis

Feb 19 (Reuters) – West Virginia’s attorney general sued Apple on Thursday, accusing the iPhone maker of allowing its iCloud service to become what the company’s own internal communications called the “greatest platform for distributing child porn.”

Attorney General JB McCuskey, a Republican, accused Apple of prioritizing user privacy over child safety. His office called the case the first of its kind by a government agency over the distribution of child sexual abuse material on Apple’s data storage platform.

“These images are a permanent record of a child’s trauma, and that child is revictimized every time the material is shared or viewed,” McCuskey said in the statement.

Apple in a statement said it has implemented features that prevent children from uploading or receiving nude images and was “innovating every day to combat ever-evolving threats and maintain the safest, most trusted platform for kids.”

“All of our industry-leading parental controls and features, like Communication Safety — which automatically intervenes on kids’ devices when nudity is detected in Messages, shared Photos, AirDrop and even live FaceTime calls — are designed with the safety, security, and privacy of our users at their core,” Apple said.

Apple on Thursday said it plans to roll out a feature in the coming weeks that allows users in the U.S. to flag inappropriate content such as nudity directly to Apple via a “Report to Apple” feature. This is already available in Australia and the United Kingdom. Apple said the expansion was previously planned and not in response to West Virginia’s lawsuit.

The U.S. has seen a growing national reckoning over how smartphones and social media harm children. So far, the wave of litigation and public pressure has mostly targeted companies like Meta, Snap, and Google’s YouTube, with Apple largely insulated from scrutiny.

END-TO-END ENCRYPTION

West Virginia’s lawsuit focuses on Apple’s move toward end-to-end encryption, putting digital files outside the reach of both Apple and law enforcement officials. The state alleges Apple’s use of such technology has allowed child abuse material to proliferate on its platform.

For decades, technology and privacy advocates have sparred over end-to-end encryption. Advocates call this vital to ensuring privacy and preventing widespread digital eavesdropping. Governments insist it hinders criminal investigations.

Apple has considered scanning images but abandoned the approach after concerns about user privacy and safety, including worries that it could be exploited by governments looking for other material for censorship or arrest, Reuters has reported.

McCuskey’s office cited a text message conversation between two employees in which Apple’s then anti-fraud chief said that because of Apple’s privacy priorities, it was “the greatest platform for distributing child porn.”

The lawsuit in Mason County Circuit Court seeks statutory and punitive damages and requests that a judge force Apple to implement safer product designs including effective measures to detect abusive material.

Alphabet’s Google, Microsoft and other platform providers check uploaded photos or emailed attachments against a database of identifiers of known child sex abuse material provided by the National Center for Missing and Exploited Children and other clearinghouses.

Until 2022, Apple took a different approach. It did not scan all files uploaded to its iCloud storage offerings, and the data was not end-to-end encrypted, meaning law enforcement officials could access it with a warrant.

Reuters in 2020 reported that Apple planned end-to-end encryption for iCloud, which would have put data into a form unusable by law enforcement officials. It abandoned the plan after the FBI complained it would harm investigations.

NEURALHASH

In August 2021, Apple announced NeuralHash, which it designed to balance the detection of child abuse material with privacy by scanning images on users’ devices before upload.

Security researchers criticized the system, worrying it could yield false reports of abuse material. This sparked a backlash from privacy advocates who claimed it could be expanded to permit government surveillance.

A month later, Apple delayed introduction of NeuralHash, then canceled it in December 2022, the state said in its lawsuit. That same month, Apple launched an option for end-to-end encryption for iCloud data called Advanced Data Protection.

“This is a clear attempt to put pressure on Apple not just to disable Advanced Data Protection but to mandate that Apple search the private files of every iCloud user,” said Thorin Klosowski, a security and privacy activist at the Electronic Frontier Foundation.

West Virginia argues that Apple’s design choices have allowed illegal content to persist and evade law enforcement, causing widespread harm to West Virginia’s public health and child‑protection systems.

“Apple refuses to implement industry-standard tools that would stop the spread of these illegal images, making them an extreme outlier among major tech companies who routinely remove and report this horrific content,” Sarah Gardner, CEO of Heat Initiative, a nonprofit group that has criticized Apple and other tech firms over their role in child abuse material, said in a statement. 

While Apple did not go through with the effort to scan images being uploaded to iCloud, it did implement a feature called Communication Safety that blurs nudity and other sensitive content being sent to or from a child’s device.

(Reporting by Nate Raymond in Boston and Stephen Nellis in San Francisco; Editing by Alexia Garamfalvi, Christopher Cushing, Franklin Paul, David Gregorio and Diane Craft)