West Virginia attorney general sues Apple over encryption, child pornography News
Y Chen, CC BY-SA 4.0, via Wikimedia Commons
West Virginia attorney general sues Apple over encryption, child pornography

West Virginia Attorney General John McCuskey filed suit against Apple on Thursday, arguing that the company turned a blind eye to iCloud encryption methods that facilitate mass transmission of child pornography.

The suit focuses on Apple iCloud and its use of end-to-end encryption, which makes digital files inaccessible to law enforcement. iCloud, which backs up and shares data across multiple accounts automatically, is used on all Apple devices, including iPhones.

The complaint quoted Apple’s head of fraud in 2020 saying iCould was “the greatest platform for distributing child porn” and that the company “chose not to know” about child pornography transmissions on Apple’s systems. McCuskey added:

Behind every sexually explicit image or video is a child’s rape, molestation, or sexual abuse. CSAM is a permanent record of that child’s trauma, forcing upon children a lifetime of re-victimization knowing that documentation of their sexual abuse can be available for others to access forever.

Under 18 USC § 2258a, all electronic communication and remote computing service providers must report Child Sex Abuse Material (CSAM) to the National Center for Missing and Exploited Children (NCMEC).

McCuskey also claimed Apple has fallen short of its reporting obligations. In 2023, Apple made 267 reports of CSAM to the NCMEC, compared to 1.47 million reports from Google and 30.6 million reports from Meta.

The suit alleged that Apple knew iCloud was unsafe but continued to sell it without safeguards prior to August 2021. That year Apple developed a feature called NeuralHash, which would have screened images and automatically sent possible CSAM to the NCMEC.

However, opponents argued that the feature could harm user privacy and expand government surveillance. Apple delayed the introduction of NeuralHash, then scrapped the feature in favor of end-to-end encryption in December 2022. While Apple calls this form of encryption “Advanced Data Protection,” the suit alleges that Apple implemented end-to-end encryption primarily to protect its brand and market share.

Apple responded to the suit, saying:

All of our industry-leading parental controls and features, like Communication Safety—which automatically intervenes on kids’ devices when nudity is detected in Messages, shared Photos, AirDrop and even live FaceTime calls—are designed with the safety, security, and privacy of our users at their core.

McCuskey accused Apple of strict liability for a design defect, negligence, creating a public nuisance, and violations of the West Virginia Consumer Credit and Protection Act. He has requested injunctive relief, including an order for Apple to take reasonable measures to remove the public nuisance.