22 Students at Richmond-Burton Community High School in Illinois Targeted by Deepfake Nudes

22 students at Richmond-Burton Community High School in Illinois were targeted in the creation of deepfake nudes. One of the students, Stevie Hyder, was targeted by classmates who used deepfake technology to alter her April 2023 prom picture into nude pictures, which were then circulated on social media. Two unnamed minors were arrested in late April 2024.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involved the targeted creation of humiliating and sexualised deepfake imagery of specific victims (classmates and teachers) for personal harassment and humiliation.

Additional risk subdomains

• 1.2 Exposure to toxic content: The generated deepfakes constituted child sexual abuse material (CSAM) that was actively distributed to and viewed by minors within the school community.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The harm was caused by the intentional actions of human users (minors) who utilized a post-deployment AI tool to generate and distribute non-consensual explicit images of their classmates.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The AI system was used to generate deepfakes, which are subject to specific transparency obligations under the EU AI Act to ensure users are aware the content is AI-generated.

AI system and alleged parties

• AI system: unspecified AI tools
• AI purpose: Deepfake Image Generation; Image Retouching
• Behaviour type: Tool
• Alleged developer: Unknown deepfake technology developers
• Alleged deployer: Unnamed deepfake creators
• Alleged harmed parties: Stevie Hyder, Richmond-Burton Community High School

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Minor, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Minor, indirect Minor
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Substantial, indirect Negligible

Malicious content

Reported: Yes, the report explicitly describes the creation and distribution of toxic and malicious content.

Directly caused: Classmates used AI tools to generate at least 33 non-consensual nude images of students and teachers, which were circulated among the student body.

Inferred additional harm: It is likely that these images remain in circulation on private devices or online platforms, posing ongoing risks of exposure.

Civil rights

Reported: Yes, the report describes violations of personal dignity and rights of minors.

Directly caused: The non-consensual sexualisation of minors violates their fundamental rights to personal dignity, privacy, and protection from sexual exploitation.

Inferred additional harm: The incident represents a broader threat to the civil rights of young women who are disproportionately targeted by image-based sexual abuse.

Privacy

Reported: Yes, the report explicitly describes privacy violations.

Directly caused: Classmates took personal photos of students from Instagram and Snapchat without consent to generate sexually explicit deepfakes.

Inferred additional harm: The ease of accessing and manipulating personal social media photos represents an ongoing threat to the privacy of all students at the school.

Psychological

Reported: Yes, the report explicitly describes psychological distress and emotional harm to the victims.

Directly caused: Victims experienced severe distress, with one sophomore reporting feeling extremely violated, nauseous, and crying after seeing the altered photo of herself.

Indirectly caused: The parents of the victims experienced heartbreak and distress over the violation of their children's privacy and dignity.

Inferred additional harm: It is highly likely that all 33 victims experienced varying degrees of anxiety, humiliation, and trauma due to the non-consensual distribution of sexualised images of themselves.

Epistemic

Reported: Yes, the report describes concerns about the fake images being perceived as real.

Directly caused: Victims expressed concern that future employers or college admissions officers might see the fake nude photos and believe they are real, potentially ruining future opportunities.

Child sexual exploitation and abuse

Reported: Yes, the report explicitly describes a CSEA incident involving the creation and distribution of child pornography.

Directly caused: Two minors were arrested and charged with multiple counts of possession and distribution of child pornography (child sexual abuse material) for creating and sharing AI-generated nude images of their underage classmates.

People affected

• Occurrences reported: 1
• People reportedly harmed: 33
• People reportedly exposed: 33

Potential causes

Management

• Inadequate School IT Filters: School systems failed to prevent the creation and distribution on computers.
• Lack of Proactive AI Education: Schools lacked programs to educate students on the ethics and dangers of AI.

Technology

• Easy Access to Undress Apps: AI apps allow rapid generation of nonconsensual nude images from normal photos.
• Advanced Generative AI Tools: Highly realistic image manipulation tools are easily operated by minors.
• Lack of Technical Safeguards: AI tools lack built-in blocks to prevent generating explicit minor content.

Data Inputs

• Public Social Media Photos: Victims' public Instagram and Snapchat photos were harvested for AI training.
• AI Training on Image Datasets: Models trained on massive image datasets can easily reconstruct realistic bodies.

Human Factors

• Malicious Intent by Minors: Students intentionally used AI tools to harass and violate classmates.
• Low Awareness of Deepfake Risks: Victims and parents were unaware that online photos could be manipulated.
• Low Barrier to Tool Operation: Extremely simple user interfaces allow anyone to create deepfakes quickly.

Process and Methods

• Unregulated App Distribution: Proponents distribute 'undressing' apps cheaply and quickly online.
• Facile Content Distribution: Altered images were easily circulated via school computers and messaging.

Regulatory Environment

• Absence of Federal AI Laws: Lack of clear federal legislation like the Defiance Act to deter creators.
• Unclear Local Legal Frameworks: Police and prosecutors struggled initially to classify AI-generated minor nudes.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide consistent, detailed accounts of the incident, including direct quotes from a victim and her mother, statements from school officials, and confirmation of legal charges from the state's attorney's office.
• Ambiguities identified: The specific AI applications used are not named, and the exact number of victims varies slightly between reports (e.g., 'at least 22' vs 'around 30 girls').

Minors at an Illinois high school used AI tools to generate and distribute non-consensual explicit images of classmates and teachers. While causing severe psychological harm and leading to local arrests, the incident remains a localized criminal issue with negligible direct national security implications.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Minors (classmates of the victims)

Threat characteristics

• Imminence: Long-term. Represents an ongoing societal and regulatory challenge rather than an active national security crisis requiring immediate response.
• Autonomy: Human-controlled. The AI system was used strictly as a tool, operating entirely based on direct human inputs and commands.
• Novelty: Established threat. The use of AI 'undressing' applications to generate non-consensual explicit imagery is an established threat with prior documented cases.

Impact by dimension

• Physical security: Negligible. No physical systems, kinetic assets, or critical infrastructure were affected or targeted in this incident.
• Information security: Negligible. No state-sponsored information warfare, intelligence compromise, or classified data theft occurred.
• Sovereignty: Negligible. Core government functions, state authority, and electoral systems were not impacted by this localized school incident.
• Economic security: Negligible. No impact on strategic industries, financial systems, or national technological competitive advantage.
• Societal stability: Minor. The incident caused severe localized harm to the privacy and dignity of 33 victims. While constituting a serious local crime involving CSAM, it does not threaten national-scale societal stability.