Over the course of the weekend, news began to surface that up to 200,000 images and 10,000 videos from the service Snapchat had been leaked online.
The news falls on the heels of a celebrity nude photo leak, one that impacted dozens of female celebrities, and involved hackers targeting and gaining access to their cloud storage accounts, including Apple’s iCloud.
However, while the comparisons are understandable, the Snapchat leak is a very different story, including technical, ethical and legal differences. While both involve the leaking of nude photos/videos and raise many of the same questions, the two stories and their implications are very different.
So, to help the discussion about the recent leak and what it likely means for the Internet, we are going to step back, take a look at what happened, what it means and what we can likely expect in the future.
Because, while (up to) 200,000 images is a large amount, it represents only a tiny fraction of the estimated amount of images shared on Snapchat. This means that this leak will likely be neither the last nor the biggest such leak.
In short, this won’t be the last time we go down this path and have this conversation…
Understanding Snapchat and It’s Leak
Snapchat, for those who do not know, is a social networking service that enables users to send messages, photos and videos with increased privacy. The idea is simple: One user sends a “snap”, which can be an image or video, with or without text, and sends it to one or multiple people. That snap is given a time limit after which it is deleted from the recipient’s device and Snapchat’s servers.
Snapchat also takes other precautions such as alerting users when a recipient screenshots an image (one way to save an image more permanently) and allowing users to draw on images, thus covering up any personal information.
But while Snapchat’s security is higher than that of email or text messaging, both of which send content “in the clear” and can be trivially saved and forwarded to others, it was far from perfect. As I noted last year, there were (and are) several ways others could permanently save Snapchat images without tripping the program’s alarm.
But one way that I didn’t discuss was the presence of third-party apps and services. Both the iOS and Google Play store had apps that would connect to your Snapchat account, but not play by Snapchat’s rules. They would allow you to save images and videos permanently.
These apps and services were (and are) in violation of Snapchat’s terms of service. Snapchat made constant efforts to shut these apps and services down, including having them removed from the relevant app stores and shuttering their domains.
One site, however, managed to stay open for quite a while. Snapsaved.com ran a web-based service for saving Snapchat images. Users would log in using their Snapchat account information and Snapsaved.com would allow them to hold onto any images or videos they received.
But the site did more than just allow users to download images, the images were also saved on Snapsave.com’s server, which the company has admitted was hacked and that many of the images were downloaded.
The site, according to their press release, was most popular in Sweden, Norway and the United States, meaning most of the victims of the leak are likely from those three countries.
The leak had been warned at the end of last week in various posts on 4Chan (the same site that served as home to the original leak). However, at the time, many felt that the threats were likely a hoax, an effort to garter attention from the earlier celebrity nude photo leak. This viewpoint was furthered on the 11th when the person claiming credit for the leak claimed that he had changed his mind about the leak and wouldn’t be posting the images.
However, over the weekend, it became very clear that the leak was anything but a hoax, with 10s of thousands of images leaking online and being made available in torrent files. The exact amount of content is up for debate. Though originally the leak was supposed to involve some 200,000 files, most media reports of the available content place the number underneath 100,000.
Snapsave.com, for it’s part, has shut down and said that, as soon as it learned of the leak, tried to scrub its database and its servers of user content. However, that effort came too late for tens of thousands of people who have had their person, supposedly private, Snapchat images/videos leaked online.
A Very Personal Violation
Snapchat, due to it’s private, temporary nature, has a reputation for being a sexting app or a way to send nude/sexual images to others. However, that’s largely been known to be untrue for years and even the alleged leaker admits that it isn’t the case.
According to the Pastebin document, “The majority of these images are of normal every day activities; walking to school, showing off your new haircut or cooking a meal.” Forum posts about the link seem to confirm that the majority of the images and videos are not sexual in nature, but are mundane snapshots of people’s everyday lives.
But whether they are nude photos or mundane shots of someone walking down the street, they are private photos, meant to be shared only with trusted people and never meant to be seen by the larger Web. Yet, there they are, in a Torrent file on various sites, ready for download and viewing by anyone.
Still, the bulk of the attention will be focused on the nude images that the collection does contain. Not only do those images/videos represent a serious invasion of privacy for the people in them, but since many feature underage participants, they raise serious questions about child pornography.
But with the focus on the nude images comes another comparison, to the earlier celebrity nude photo hack. Unfortunately, that comparison falls short in many key ways, including what can be done to prevent future leaks.
Two Very Different Leaks
The nude celebrity leak, by all accounts, was not a massive breach of security at a service. A group of attackers, based on so-called “deep web” forums, targeted and broke into the cloud accounts of celebrities and downloaded their private photos.
This hack, however, was indiscriminate and not targeted at all. The attackers found a security hole in the Snapsaved.com site and simply downloaded all of the content. There was no care as to whose images they were or what the images were of, the goal was simply to get as many images and videos as possible.
The first key difference is in terms of what users can do to prevent such an intrusion. After the first leak, there was a great deal of talk about using better security questions, two factor authentication and so forth. However, with this most recent leak, those steps would not have helped. Even if the senders had perfect security on their end, people they sent the images to not only betrayed their trust and used a service to save the images, but used an insecure service to do it.
In short, those who had their images and videos leaked can do nothing to improve their security as the security issue was completely out of their hands. Beyond avoiding Snapchat, there isn’t much that they can do to ensure there isn’t a repeat.
Another difference is simple geography. The latest leak involves people from many more countries and legal jurisdictions. With greater efforts to crack down on revenge porn abroad, including a recent push in the UK, it’s likely that we’ll see very different legal challenges to this leak than the first.
This is furthered by what is widely considered to be the presence of child pornography in the leak. Though it was revealed one of the celebrities involved in the original leak was underage, her images were removed from the collection, which was still widely shared without her images. That will be almost impossible to do with this collection, both due to the size of the collection, the relatively anonymous nature of the people featured and the sheer level of disorganization.
Child pornography will likely remain in the collection for some time, raising serious legal questions both for those who share it and for those who are featured in it.
In the end though, the biggest difference may be more human. Where interest in the original leak was high, this one seems to have attracted significantly less attention. Whether it’s the much larger file size, the limited amount of sexual content, the presence of likely child pornography or the lack of big celebrity names to generate interest, this leak, while still popular, isn’t achieving the same levels as the first.
However, that still means tens of thousands of people working to download the file as I write this. Further, since most of those victimized in this leak are not wealthy nor powerful, there’s likely no lawyers to help secure as many takedowns as possible or pressure police to take action.
In short, while the victims of this leak will see fewer views and less distribution, justice is even less likely for the victims of this leak than the first one.
When the first leak happened, many asked aloud how the Internet would respond it if were their son or daughter that had their nude photos leaked.
This time around, it very well could be.
The people involved in this leak are not celebrities. They are every day people, many of them teens, who had their private content shared on the Internet simply because it could be.
When the original leaker was making the case for his decision not to go through with the leak, he said the following:
“Consider for a moment the images of 200,000 people being leaked at once. Do you think that’s a good thing for the Internet? Do you think that will keep our Internet free? …. If this content is posted/leaked it will just be playing into the hands of the individuals who wish to actively monitor all Internet activity.”
Now that it seems others have followed through for him. Not only have tens of thousands of people had their privacy directly violated, but all Snapchat users have been hit with the awareness that it could have been them.
This leak is going to change the conversation about privacy online. But the question is whether we will blame the victims, saying that they shouldn’t have sent the photos, even via a private means, if they didn’t want them splattered across the Web, or will we have a deeper conversation about our sense of privacy online and how some, through a sense of entitlement only they can explain, feel they have the right to intrude upon it simply because they can.
We failed to confront those issues with the first leak but now that it’s our sons and daughters at risk, maybe we can have a real conversation about these issues.
Regardless, one thing is for certain. The conversation about privacy online is different today than it was last week and it won’t be changed back. The quicker we realize that, the quicker we can move on and have the dialog we really need.