Maryam Al-Adeeb first came to know about the photos when she returned home from a business trip. “Mom,” her daughter said. “I want to show you something.”
The 14-year-old opened her phone to reveal a candid photo of herself. “It’s a shock when you see it,” said Adib, an ophthalmologist and mother of four daughters in the southern Spanish town of Almendralejo. “The photo is completely realistic … If I didn’t know my daughter’s body, I would think the photo was real.”
It was a deepfake, one of dozens of nude photos of schoolgirls in Almendralejo created by artificial intelligence (AI) that have been circulating in the city for weeks in a WhatsApp group set up by other schoolchildren. was
Some of the examples of girls being circulated were refusing to go to school, suffering from panic attacks, being blackmailed and being bullied in public. “My concern was that these images had reached porn sites that we don’t even know about today,” Adeeb told the Guardian from his clinic in the town.
State prosecutors are considering charges against some of the children,
who created images using an app downloaded from the Internet. But they failed to identify the people who developed the app, who prosecutors suspect are based somewhere in Eastern Europe.
The Spanish incident made global headlines last year and made Almendralejo, a small town of dimly lit Renaissance churches and plazas near the Portuguese border, the latest in a series of warning shots from the near future where AI tools can kill someone. Also allow. Create highly realistic images with just a few clicks.
But while the deepfakes of pop stars like Taylor Swift have garnered the most attention, they represent the tip of the iceberg of non-consensual images that are flooding the internet and that police are largely powerless to stop. .
As the author was learning about the pictures, thousands of miles away at Westfield High School in New Jersey, a strikingly similar case was going on: many girls were being photographed by students in their classes. Targeted for obvious deepfake photos. The New Jersey incident has sparked a civil lawsuit and helped fuel a bipartisan effort in the US Congress to ban the creation and dissemination of non-consensual deepfake images.
At the heart of both events in Spain and New Jersey was the same app, called ClothOff.
In the year since the app’s launch, the people running ClothOff have carefully guarded anonymity, digitally distorted their voices to answer media questions and, in one case, A.I. created a completely fake person who they claimed was their CEO.
But a six-month investigation, carried out for a new Guardian podcast series called Blackbox, may reveal the names of several people who have worked for ClothOff or who are linked to the app, according to our investigation.
Their trail leads to Belarus and Russia, but it passes through businesses registered in Europe and front companies based in the heart of London.
ClothOff, whose website receives more than four million visits a month, invites users to “take off anyone’s clothes using AI”. The app can be accessed via smartphone by clicking a button that verifies the user is over 18, and charges around £8.50 for 25 credits.
Credits are used to upload photos of any woman or girl and return the image stripped of clothing.
A brother and sister in Belarus
Screenshots seen by the Guardian show that a Telegram account in the name of Dasha Babicheva, whose social media accounts say she is in her mid-20s and lives in Minsk, the capital of Belarus, Conducted business on behalf of ClothOff, including negotiating applications to banks. Changes to the Website and Business Partnerships.
In one screenshot, an account named Babicheva tells a counterpart at another firm that if journalists have questions about Cloth Off, they can “contact us at this email,” providing the website’s press contact. can contact”.
An Instagram account in Babicheva’s name, which shared similar photos with a Telegram account in her name and listed the same phone number, was made private after the Guardian launched an inquiry. , and the phone number was deleted from the profile.
Babicheva did not respond to detailed questions.
30-year-old Alexander Babichau, identified on social media accounts as Dasha Babicheva’s brother, also appears to be closely related to Cloth Off.
In the recruitment advertisement, ClothOff directed applicants to the email address of the website AI-Imagecraft.
AI-Imagecraft’s domain name records indicate that the website owner’s name has been withheld at the owner’s request.
But AI-Imagecraft has a virtually identical duplicate website, A-Imagecraft, whose owner has not been hidden: it’s listed as Babichau. The Guardian was able to log into both A-Imagecraft and AI-Imagecraft using the same username and password, indicating that the two websites are linked.
There are further connections between Babichau and Clothoff. The Guardian has seen screenshots of a conversation between ClothOff staff and a potential business partner. ClothOff staff are identified only by their first names and one of them, identified by another staff member as “the founder”, had the Telegram display name “Al”.
The Guardian linked videos posted to Al’s Telegram account with publicly available footage posted to an account under the name of Alexandre Babichau. It showed that Al and Babichau both uploaded videos and photos from the same hotel rooms in Macau on January 24 and from the same hotel rooms in Hong Kong on January 26. Correlation suggests that both accounts belong either to people who traveled to the cities at the same time, or to the same person.
Reached by phone last week, Babichau denied any connection to the Deepfake app, claimed he did not have a sister named Dasha, and said a Telegram account in his name, which listed his phone number , not his. In response to further inquiries, he abruptly ended the phone call and did not respond to detailed questions via email.
Shortly after the conversation, the Guardian was blocked by a Telegram account it claimed was not his.
Mini Trail through London
The payments to ClothOff show the lengths app creators have gone to to hide their identities. The transaction led to the registration of a company called Texture Oasis in London, a firm that claims to sell products for use in architectural and industrial design projects.
But the company appears to be a fake business designed to hide payments to ClothOff.
Text on the firm’s website was copied from another, legitimate, business website, as was a list of staff members. When the Guardian contacted one of the people listed as an employee of Texture Oasis, he said he had never heard of the business. Our investigation found no other links between the named staff and ClothOff, adding to the suggestion that the list of staff was copied.
The Guardian also uncovered links between ClothOff and an online video game marketplace called GGSel, which its CEO described as a way for Russian gamers to circumvent Western sanctions.
Both websites briefly listed the same business address last year: GG Technology Ltd, a London-based company owned by a Ukrainian national named Yevhen Bondarenko. Both websites have since deleted any reference to the firm.
A LinkedIn account under Babichau’s name lists him as a GGSel employee.
Meanwhile, an account in the name of Alexander German, described as a web developer who LinkedIn says also works at GGSel, posted website code for ClothOff under his own name. Uploaded to a coding repository, on GitHub. This source code was deleted shortly after.
Reached via the phone number listed on his LinkedIn, the man, who identified himself as Alexander German, denied being a web developer or connected to ClothOff in any way.
Several LinkedIn accounts that listed their employment at GGSel on their profiles deleted any reference to the company or to them after the Guardian began inquiring about the links between GGSel and ClothOff. Remove surnames and photos.
In a statement, GGSel denied any involvement with ClothOff and said it had no connection to GG Technology Ltd., but could not clarify whether the company had posted this on its website last year. Why was it listed as the owner? He said that neither Babichow nor German had ever been employed and that he would contact LinkedIn to remove references to their names from their profiles.
Bondarenko deleted his social media accounts on Wednesday and the Guardian was unable to reach him for comment.
ClothOff, in response to questions, said it was not affiliated with GGSel or any of the names in the article. A spokesman claimed it was impossible to use its app to “process” images of under-18s but did not specify how or why the app would be used in Spain – nor How were the pictures of the children made? They speculated that the photos in New Jersey were created using a competing service.
On Thursday, access to the ClothOff website and app was blocked in the UK, but was still available elsewhere.
Research has shown increasing difficulty in distinguishing real people from fake identities that can be accompanied by high-quality photos, videos and even audio. The full story will be published in an episode of Black Box that will be released next Thursday.
-
Additional reporting by Matteo Faggoto, Phil McMahon, Oliver Laughland, Manisha Ganguly, Andrew Roth, Yanina Sorokina and Kateryna Malofieeva.