FBI agent explains how easy it is to ID people posting AI porn without consent

This Ars Technica report focuses on early enforcement cases following the rollout of the U.S. Take It Down Act (TIDA), explaining that when the FBI tracks down publishers of non-consensual AI pornography, it can often complete identity matching through fairly straightforward digital footprints. The report notes that the FBI arrested two men last week; investigators began their pursuit after clicking into tags such as #AI and #Deepfakes on porn sites, or video titles like "AI_tits" and "Ass_AI." Among them, 20-year-old Arturo Hernandez is accused of publishing 113 albums containing AI-generated sexualized images and videos of about 50 women, with total views approaching 1 million; the victims included politicians, actors, and musicians, as well as women he knew from his Texas high school and Instagram friends. The FBI says the clues leading to Hernandez included geolocation data, a reposting account linked to a PayPal account, overlap between login IPs and Apple iCloud records, and the specific original photos used to generate the AI pornography that had been saved in his own Instagram account. The other man, 51-year-old Cornelius "Neil" Shannon, is accused of publishing about 360 AI-generated albums involving roughly 90 women, with more than 2 million views; the FBI believes he was even easier to connect to, because the account on the porn site involved appeared to use a real photo of him as its avatar and could be matched against motor vehicle department records and surveillance footage. If proven to have violated TIDA, the two could face a maximum of two years in prison. The latter part of the article also mentions that the FTC issued warnings to 12 nudify-tool vendors, requiring platforms to provide a process by which victims can request the removal of non-consensual intimate imagery within 48 hours, or potentially face civil penalties of up to $53,088 per violation. The FTC has also reminded large platforms such as Amazon, Alphabet, Apple, Meta, Microsoft, Reddit, TikTok, and X to attend to compliance. However, the report notes that TIDA still has limitations: it cannot prevent content from being published in the first place, in practice it leaves the burden of monitoring and reporting on victims, and there are concerns that the removal process could be abused.