LOS ANGELES: A Los Angeles County man broke into thousands of Apple iCloud accounts and collected more than 620,000 private photos and videos in a plot to steal and share images of nude young women, US federal authorities say.

Hao Kuo Chi, 40, of La Puente, has agreed to plead guilty to four felonies, including conspiracy to gain unauthorised access to a computer, court records show.

Chi, who goes by David, admitted that he impersonated Apple customer support staff in emails that tricked unsuspecting victims into providing him with their Apple IDs and passwords, according to court records.

He gained unauthorised access to photos and videos of at least 306 victims across the US, most of them young women, he acknowledged in his plea agreement with federal prosecutors in Tampa, Florida.

Chi said he hacked into the accounts of about 200 of the victims at the request of people he met online. Using the moniker “icloudripper4you”, Chi marketed himself as capable of breaking into iCloud accounts to steal photos and videos, he admitted in court papers.

Chi acknowledged in court papers that he and his unnamed co-conspirators used a foreign encrypted email service to communicate with each other anonymously. When they came across nude photos and videos stored in victims’ iCloud accounts, they called them “wins”, which they collected and shared with one another.

“I don’t even know who was involved,” Chi said Thursday in a brief phone conversation.

He expressed fear that public exposure of his crimes would “ruin my whole life”.

“I’m remorseful for what I did, but I have a family,” he said.

Chi’s agreement to plead guilty comes as Apple is facing criticism from privacy advocates over its plan to scan iPhone photos that customers store on iCloud to flag images of child sexual abuse for potential reporting to law enforcement. The advocates say it risks opening a new avenue for government surveillance of iPhone users worldwide.

In Chi’s case, the stolen images were kept secure on Apple’s servers, but he managed to get victims to give him the iCloud passwords he needed to download their data.

In court papers, the FBI identified two Gmail addresses that Chi used to lure victims into changing their iCloud sign-on information: “applebackupicloud” and “backupagenticloud”. The FBI said it found more than 500,000 emails in the two accounts, including about 4,700 with iCloud user IDs and passwords that were sent to Chi.

Chi’s conspirators would request that he hack a certain iCloud account, and he would respond with a Dropbox link, according to a court statement by FBI agent Anthony Bossone, who works on cybercrime cases.

Chi’s Dropbox account contained about 620,000 photos and 9,000 videos organised in part on whether the content contained a “win” of nude images, Bossone wrote.

The scam started to unravel In March 2018.

A California company that specialises in removing celebrity photos from the Internet notified an unnamed public figure in Tampa, Florida, that nude photos of the person had been posted on pornographic websites, according to Bossone. The victim had stored the nude photos on an iPhone and backed them up to iCloud.

Investigators soon discovered that a login to the victim’s iCloud account had come from an Internet address at Chi’s house in La Puente, Bossone said. The FBI got a search warrant and raided the house May 19. By then, agents had already gathered a clear picture of Chi’s online life from a vast trove of records that they obtained from Dropbox, Google, Apple, Facebook and Charter Communications.

On Aug 5, Chi agreed to plead guilty to one count of conspiracy and three counts of gaining unauthorised access to a protected computer. He faces up to five years in prison for each of the four crimes.

Spokespersons for the FBI and US attorney’s office in Tampa declined to comment.

 - TNS