INTRODUCTION
With the advent of technology, Artificial Intelligence ("AI") coupled with advanced tools, such as, Machine Learning ("ML") and Generative AI have played a vital role in the development of the menace known as 'Deepfake'. Deepfake technology allows users to use the image / likeness, audio recordings, videos of a person to then create a synthetic or doctored image / audio clip / video clip from that material.
Video content, which is created with the use of deepfake technology, often appears realistic, and can go unnoticed as being a deepfake. Advanced tools are required to detect and flag deepfakes, unintentionally creating a vicious cycle where both detection technology and deepfake technology are constantly one-upping each other in the manner of advancement.
Various tools, ranging from sophisticated to amateur level of variance, are available and accessible to the public at large to enable the creation of deepfakes. It is completely dependent on the intent and end goal of the user of deepfake technology, whether the same will be used for good or evil, as is the case with any technology available today.
DEEPFAKES AND AI MORE A CURSE THAN BOON:
Advent of any new technology though is developed with good intent for the betterment of the society and to serve mankind, however, is often put to bad uses as well. With time, many new technologies are developed, and they are not free from the risk of being misused. The state has a duty not only to support and promote generation of new technologies but also to legally regulate them in order to avoid their misuse.
The wonderful technology of AI and its subsets are unfortunately put to many misuses which are of grave concern to the society, and aghast, there are no laws to regulate it. Prominent misuses and consequent risks posed by AI / Deepfake are several. This article addresses- 'Digital Arrest', 'Breach of Personality Rights', 'Spread of Misinformation', 'Obscenity', 'Violation of Right to Privacy'.
- Digital Arrest
'Digital Arrest' is the act of digitally arresting a person, where the person is placed in the confinement of their own home, while requiring the person to keep the camera and microphone of their mobile or computer device turned on, the scammer (using deepfake technology throughout) then makes the target comply with their demands.
Deepfakes are being used by scammers to impersonate high ranking officials from police, excise, customs, intelligence or enforcement department, wherein the target is falsely accused of a crime, or money laundering and then placed under digital arrest by the scammer.
As per I4C (Indian Cyber Crime Coordination Centre) statistics, there has been a loss of ₹ 120 crores during January to April 2024 owing to digital arrest scams done by scammers operating outside India.
It is pertinent to note that there is no concept of digital arrest under law, anywhere in the world. Arrest requires the physical presence of the official making the arrest coupled with adherence to strict protocols mandated by law.
- Breach of Personality Rights
AI and ML technology is often misused for generating / creating content using copyright / trademark material without obtaining the necessary permissions from the owner of such intellectual property. Regulation of deepfake in this regard is essential to protect the Intellectual Property Rights (IPR).
Recently, hon'ble Delhi High Court has acknowledged and protected the personality rights of famous Bollywood actor Anil Kapoor vide its order dated 20.09.2023, wherein it directed the DoT / MeitY to issue blocking orders for taking down all the links containing obscene deepfake content of the actor. The court also issued orders preventing unauthorised commercial use of his likeness and expressions, that were being breached in the form of merchandise and GIFs depicting his face and popular expressions from the actor's movies.
- Spread of Misinformation & Disinformation
Deepfakes also enable the creator to assume the persona of any well reputed and prominent personality by duping their voice and video content. Using this method, the creator can easily spread misinformation, which may become viral on the social media platforms and messaging applications. Prevention of disinformation spread can be prevented with detection and taking down of AI generated deepfake content containing such misinformation.
- Tool for Targeted Obscenity
Deepfake technology magnifies the impact of sexually motivated attacks targeted towards women and children through the creation of obscene deepfake content. It is important to highlight the significance of the prevalence of such content through a report published in September 2019 by Dutch cybersecurity startup Deeptrace, wherein it was estimated that 96 percent of deepfakes published online were pornographic.
- Violation of Right to Privacy
The use of any person's image, voice or video content without their consent for deepfake creation is a violation of their right to privacy, as guaranteed under Article 21 of the Constitution of India (as held under KS Puttaswamy v. Union of India, 2017). Easy access to personal information and audio-visual data of individuals on the internet makes deepfake creation easier, subsequently encroaching on their right to privacy in the process.
EXISTING LEGAL FRAMEWORK IN INDIA
Currently there is no legal framework for regulating AI technology and deepfakes in India. The legal framework required to regulate such technology is not able to keep up the pace at which such technologies are developing. In some jurisdictions across the globe, the legal framework to regulate, combat and punish is at a nascent stage and in others it is not even conceived.
Each jurisdiction is faced with an immediate requirement to enact and adopt laws pertaining to AI and deepfakes sooner than later, as the problem of deepfakes knows no boundary and spreads across the globe quicker than any virus.
Even with the absence of specific legislative instruments dealing with AI and deepfakes in India, the legal system and government has taken a note of the increasing complaints. As pertinent in various recent judgements and orders passed by the courts throughout India, relief has been provided to the victims, as provided under the respective areas of law.
While there are no specific laws governing and regulating the realm of AI, deepfakes and related technologies, the culprits / fraudsters are booked and punished under Information Technology Act, 2000, Indian Penal Code 1860 and Copyright Act 1957.
- Punitive Provisions Under Existing Statutes
Section 51 (when copyright infringed) of the Copyright Act, 1957, provides for penalties in cases of copyright infringement. Victim can take recourse of Section 51 whenever the deepfake involves infringement of copyrighted content.
In case of impersonation and fraud / cheating, Section 419 (punishment for cheating by personation) and Section 420 (cheating and dishonestly inducing the delivery of property) of the Indian Penal Code, 1860 are invoked.
Section 66D (punishment for cheating by personation by using computer resource) and Section 66E (punishment for violation of privacy) of the Information Technology Act, 2000 ("IT Act"), are usually invoked in cases concerning deepfakes.
- Responsibility & Obligation of Intermediaries
Intermediaries (as defined under Section 2(w) of the IT Act) are prohibited to host any morphed content impersonating other person and are required to immediately takedown any such content when informed by the person concerned, as provided under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Failure on the part of intermediaries to remove such data removes the safe harbour provision / exemption from liability of intermediary for any third-party information, data or communication link hosted or made available by them, as provided under Section 71 of the IT Act.
- Blocking Orders
For preventing any further damage through the spread and subsistence of such deepfakes, the hon'ble courts have at occasions directed the relevant government agency / authority such as the DoT or MeitY to issue blocking orders, as provided under Section 69A of the IT Act read with the Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009.
GLOBAL TAKE ON REGULATION OF AI AND RELATED TECHNOLOGY
- Legal development in U.S.A.
The state of Virgina in July 2019 updated its existing revenge porn law, under which creating or sharing deepfakes of someone without their permission will classify as a misdemeanour resulting in up to 12 months in jail along with a fine of $ 2500.
In the U.S.A. the Deepfakes Accountability Act (H.R.5586) was introduced in Congress for the first time in 2019, and then later re-proposed in September 2023. Presently there is no law in the USA at the federal level addressing and regulating deepfakes, however, in October 2023, in the state of New York, Senate Bill S1042A was signed by Governor Hochul, which makes the dissemination of deepfakes of person without their consent illegal, and if found guilty, a fine of $1000 along with a year in jail could be imposed on the perpetrators.
Similarly, the state of California passed the Defending Democracy Act, 2024, which imposes removal obligations on large online platforms prior to 120 days leading up to an election along with certain disclosure requirements extending beyond that period, however, the act will come into effect from January 1, 2025.
- Legal Development in European Union
In the EU, the Digital Services Act became applicable from 17th February 2024 on the online platforms and search engines, who's services are classified as Very Large Online Platforms and Very Large Online Search Engines. This act regulates online intermediaries and platforms to prevent illegal and harmful activities online and the spread of disinformation, significant fines shall be imposed on such intermediaries and platform for non-compliance of the rules provided under this act.
Parallelly, the AI Act was also adopted in the EU on 1st August 2024, making it the first ever global framework on the regulation and use of AI technology. This act regulates the providers of AI systems and entities using AI in a professional context, classification is based on the risk of causing harm posed by the non-exempt AI applications, particularly, unacceptable risks (which are banned), high-risk (compliance requirement with security, transparency and quality obligations, and conformity assessments), limited-risk (only transparency obligations), minimal-risk (not regulated). Even though this act covers all types of AI across various sectors, exceptions for AI systems used for military, national security, research and non-professional purposes are provided therein.
COMBATTING DEEPFAKES
Enactment of a specific law regulating misuse of deepfake will take time and that in any case cannot be the only solution. A multi-dimensional approach needs to be implemented and explored to deal with abuse of deepfake technology.
- Through Flagging & Detection
Development of technology that can efficiently detect and flag deepfake content, is the necessary first step towards combatting deepfakes. Blanket approach of banning deepfakes and culling such a developing technology will prevent its full potential from being harnessed.
- Through Policy Mandates
Meta (formerly known as Facebook) through its frequent policy updates, is regulating AI generated content on its social media platforms, by allowing its users to self-declare such content as being AI generated. In cases where such declaration is not provided, Meta is utilising AI and deepfake detection technology to flag any such doctored content throughout its platforms.
- Immediate Removal of Content
Once any infringing deepfake has been uploaded on the internet, it is imperative that it is taken down as soon as possible without wasting any further time. Under the IT Act and the rules framed thereunder, a responsibility has been placed on intermediaries to takedown any infringing content upon the receipt of complaint from the aggrieved party, and any failure in doing so strips away the 'safe harbour protection' granted to them.
- Public Awareness Campaigns
Increasing digital literacy and spreading awareness regarding developments in the field of AI and deepfakes is an efficient root level approach to reach population in remote areas with internet access, as they are more likely and prone to believe information from deepfake content without verifying or cross-checking the same from other sources.
A STITCH IN TIME SAVES NINE
Lack of legal framework to regulate AI and deepfakes is no-doubt expose the society to dire consequences of it being misused. Any delay in enactment of regulations would only act as an encouragement to scammers and loss to innocent victims. A smart legal framework needs to be devised in a way that prohibition and penalties for misuse should go hand in hand with regulations promoting the useful development of this new technology to keep pace with the world.
Even though there can be no blanket one size fits all approach towards the regulation of AI and deepfake technology, inspiration from jurisdictions with strong information technology legal framework, such as the European Union and the United States of America can be taken to inculcate a comprehensive regulatory legal framework in accordance with Indian context.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
