Ohio Man Pleaded Guilty after Prosecutors Alleged He Used AI to Create and Distribute Nonconsensual Intimate-Image Forgeries Including CSAM in Harassment Campaign

An Ohio man, James Strahler II, pleaded guilty in federal court after prosecutors alleged that, from late 2024 into mid-2025, he used AI tools to create and distribute nonconsensual intimate-image forgeries as part of a broader harassment campaign targeting at least six adult women. Authorities said the conduct also involved additional CSAM material. The Department of Justice said it believes this was the first U.S. conviction under the Take It Down Act.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The defendant used AI systems to create humiliating and sexual imagery of specific victims for targeted harassment and blackmail, which aligns with the targeted manipulation and exploitation of individuals under sub-domain 4.3.

Additional risk subdomains

• 1.2 Exposure to toxic content: The defendant generated and published child sexual abuse material (CSAM) and explicit pornographic videos, exposing co-workers and online users to highly toxic and illegal content.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The harm was caused by a human user who intentionally utilized deployed AI models to generate and distribute non-consensual intimate imagery and CSAM.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The AI systems were used to generate deepfakes and synthetic content, which falls under transparency obligations for AI-generated content. The report notes the defendant used AI to create pornographic videos depicting at least one adult victim and digital forgeries.

AI system and alleged parties

• AI system: unspecified AI platforms and AI web-based models
• AI purpose: Deepfake Video Generation; Deepfake Image Generation
• Behaviour type: Tool
• Alleged developer: Unknown image generator developers, Unknown generative AI developers, Unknown deepfake technology developers
• Alleged deployer: James Strahler II
• Alleged harmed parties: Women in Ohio, Women, minors, Epistemic integrity

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Substantial, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Minor, indirect Minor
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Substantial, indirect Negligible

Malicious content

Reported: The report explicitly describes toxic and malicious content created and spread directly by the incident.

Directly caused: The defendant created and distributed pornographic videos of an adult victim to her co-workers and posted over 700 images of morphed CSAM to a dedicated website.

Inferred additional harm: Thousands of internet users on the CSAM website were exposed to the generated toxic and illegal content.

Privacy

Reported: The report explicitly describes privacy violations caused directly by the incident.

Directly caused: The defendant violated the privacy of at least six adult women and multiple minor boys by using their faces and likenesses to generate explicit material without consent.

Psychological

Reported: The report explicitly describes psychological and mental-health harm to people caused directly by the incident.

Directly caused: At least six adult female victims and their families experienced severe distress, intimidation, and harassment from targeted explicit images and threats of violence.

Indirectly caused: The minor boys and their families likely suffered severe trauma and distress upon discovering their faces were morphed into CSAM.

Inferred additional harm: Widespread and long-lasting psychological trauma, anxiety, and PTSD for all direct victims and their immediate families.

Epistemic

Reported: The report explicitly describes epistemic harm caused directly by the incident through the creation of digital forgeries.

Directly caused: The defendant generated highly realistic but entirely fabricated pornographic videos depicting a victim engaged in sex acts with her father, and minor boys engaged in sex acts.

Child sexual exploitation and abuse

Reported: The report explicitly describes a CSEA incident involving AI-generated CSAM.

Directly caused: The defendant used AI to morph the faces of minor community boys onto adult or child bodies to create explicit videos, posting over 700 images to a CSAM website.

People affected

• Occurrences reported: 1
• People reportedly harmed: 8
• People reportedly exposed: 1000

Potential causes

Management

• Lack of Platform Safeguards: AI developers failed to restrict local deployment of unsafe model versions.

Technology

• Abundant AI Platforms: Strahler installed over 24 AI platforms and 100 models on his phone.
• Advanced Face Morphing: AI models allowed seamless morphing of minor faces onto adult bodies.

Data Inputs

• Unprotected Personal Photos: Real photos of local minors and victims were easily acquired as inputs.

Human Factors

• Malicious Intent to Harass: Perpetrator actively sought to blackmail, stalk, and intimidate victims.
• Demand for Obscene Material: Perpetrator's desire to create and host child sexual abuse material.

Process and Methods

• Unrestricted Model Access: Web-based AI models lacked guardrails preventing illicit image generation.
• Direct Distribution Channels: Use of texts, calls, and websites to circulate forged media.

Regulatory Environment

• Delayed Legislative Action: The 'Take It Down Act' was only recently enacted in 2025 to ban deepfakes.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide clear, detailed, and consistent factual accounts of the criminal case, the specific charges, the number of victims, and the nature of the AI-generated content. The legal proceedings and guilty plea confirm the facts of the incident.
• Ambiguities identified: The specific AI platforms and models used are not named, only referred to as more than 24 platforms and 100 web-based models.

An individual used consumer AI models to generate and distribute child sexual abuse material and non-consensual intimate imagery, resulting in the first conviction under the U.S. Take It Down Act. While a severe domestic cybercrime with significant psychological harm to victims, it presents negligible threat to core national security interests.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: James Strahler II

Threat characteristics

• Imminence: Long-term. The perpetrator has been arrested and pleaded guilty, neutralizing the immediate threat, though the underlying technology remains a long-term societal concern.
• Autonomy: Human-controlled. The AI systems were used strictly as tools, driven entirely by the manual inputs and malicious intent of the individual perpetrator.
• Novelty: Evolved capability. Marks the first conviction under the Take It Down Act, demonstrating how highly accessible consumer AI models have evolved to lower the barrier for generating harmful synthetic media.

Impact by dimension

• Physical security: Negligible. No physical infrastructure, kinetic targeting, or autonomous weapons were involved in this domestic cybercrime incident.
• Information security: Negligible. The incident involved targeted harassment of individuals and did not compromise intelligence operations or state-sponsored information security.
• Sovereignty: Negligible. No core government operations, electoral systems, or sovereign decision-making processes were disrupted or targeted.
• Economic security: Negligible. There was no compromise of strategic technologies, financial systems, or national economic security.
• Societal stability: Minor. The incident represents a severe violation of individual privacy and human rights through AI-generated CSAM and harassment, but impacts were localized and managed via standard law enforcement.