THE POLICY LAB-38
JANUARY 30, 2024

By J B Mohapatra

WHILE 'deepfake' principally builds on a mix of existing technologies - machine learning, the generative adversarial network (GAN), facial recognition and tracking, voice cloning and speech synthesis, deep learning, natural language processing, augmented reality (AR) making possible the face swaps, lip syncing, audio deepfakes reach the intended audience and achieve the intended end-goal, it is equally a fact that development of deepfake detection algorithms, a machine enabled analysis of suspicious content and fact-checking and finding a technology fix to arrest the spread and pernicious use of deepfake would be a long and difficult task owing to the evolving nature of the technology.

Equally challenging is the inadequacy of existing laws across all jurisdictions to handle deepfake misuse and available legal tools to counter misuse. Generally, laws across all jurisdictions focus disproportionately on extent of harm caused (for example, reputational damage, financial loss, or unintended access), and make two elements (a) intent of the alleged perpetrator and (b) harm caused to the intended victim as the lynchpins for any prosecutorial actions, but have no specific law to apply in liable cases.

In the US, specific defamation and privacy laws administered for each of the American States generally cover libel and slander and address questions on intrusions on privacy or dissemination of offensive falsehoods or public disclosure of private facts. Federal False Claims Act, 1863 at times is brought to play, if the intended target of deepfake is the government. Another federal Act- Computer Fraud and Abuse Act, 1986 (CFAA) - similarly subserves to promote privacy and cyber security by upholding through statute the legal right of individuals, network owners and operators to confidentiality, integrity and availability of information stored in their systems. The aspects of likelihood and extent of harm associated with damage or unauthorised access to the computer system on national security, critical infrastructure, public health and safety, market integrity, international relations and even individual private parties and the community are salient parts of CFAA legislation, which at times is pressed into service in cases involving deepfake.

In Singapore, deepfake is legally tackled through administrative of certain provisions of many enactments : (a) section 377 BC (distribution of voyeuristic image or recording), section 377 BD (possession of or gaining access to voyeuristic or intimate image or recording), section 377 BE (distributing or threatening to distribute intimate image or recording) of Penal Code, 1871 (b) section 3 (intentionally causing harassment, alarm or distress), section 4 (harassment, alarm or distress) and section 7 (unlawful stalking) of Protection from Harassment Act, 2014 and (c) section 29 and 30 (making, possessing, exhibiting, distributing an obscene film) of Films Act, 1981.

In Germany, enactment of the Network Information Act, 2017 was intended to improve enforcement of laws in social networks obligating them to remove content that is patently illegal within 24 hours or within 7 days if the illegality is not obvious on its face. Apart from that, the element of privacy is a constitutional right under the German constitution , and any invasion of privacy either in press or on the internet intending to damage a reputation is primarily a violation of law, which are addressed under injunctive reliefs as provided in German civil law, or claim of damages for pain and suffering, and in some instances of insult, slander or criminal defamation under section 185 of the German Criminal Code.

In India, section 66A of the Information Technology Act, 2000 (IT Act), which reads as follows, without characterising the manipulated media as 'deepfake', in some manner attempts to encapsulate the salient elements constituting deepfake and lays down the attendant penal consequences:

“66A. Punishment for sending offensive messages through communication service, etc.–Any person who sends, by means of a computer resource or a communication device,–

(a) any information that is grossly offensive or has menacing character; or

(b) any information which he knows to be false, but for the purpose of causing annoyance, inconvenience, danger, obstruction, insult, injury, criminal intimidation, enmity, hatred or ill will, persistently by making use of such computer resource or a communication device;

(c) any electronic mail or electronic mail message for the purpose of causing annoyance or inconvenience or to deceive or to mislead the addressee or recipient about the origin of such messages,

shall be punishable with imprisonment for a term which may extend to three years and with fine.

Explanation.–For the purposes of this section, terms ?electronic mail? and ?electronic mail message? means a message or information created or transmitted or received on a computer, computer system, computer resource or communication device including attachments in text, image, audio, video and any other electronic record, which may be transmitted with the message. ”

Section 66C of the IT Act, quoted below, makes the manipulation aspects of an electronic communication through dishonest and fraudulent means as a criminal offence:

“66C. Punishment for identity theft.–Whoever, fraudulently or dishonestly make use of the electronic signature, password or any other unique identification feature of any other person, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine which may extend to rupees one lakh .”

Section 66E of the IT Act, which in many ways answers to the possible legal remedy to the current spate of deepfakes (electronic manipulation of private images and private parts) lays down punishment for violation of privacy of an 'individual through publishing or transmitting the image of private area of such a person without his or her consent'. Sections 66D of the IT Act provides punishment for any one who by means of any communication device or computer resource resorts to cheating by impersonation. Sections 67,67A and 67B of the IT Act prescribe punishment for publishing or transmitting obscene or lascivious material intended to deprave and corrupt, or for transmitting materials containing sexually explicit acts or of children depicted in sexually explicit acts in electronic forms.

Social media intermediaries who otherwise are protected from any liability for any third party information, data or communication link made available or hosted by him under section 79 of the IT Act under the law would be denuded of that immunity unless under sub-section 2(c) of section 79, 'the intermediary observes the due diligence while discharging his duties under this Act and also observes such other guidelines as the central government may prescribe in this behalf.' Rule 3(1) and (2) of the Information Technology (Intermediary Guidelines and Media Ethics Code) Rule, 2021(Intermediary Guidelines) lay down the duties of the social media intermediaries on child harm, deceptive and misleading information which is patently false and untrue, or information which misleads about the origin of the message, attempts at impersonation etc. Under Rule 7 of the Intermediary Guidelines, failure to observe the rules automatically triggers denial of immunity under section 79(1) of the IT Act as also invocation of the IPC.

Section 465 (forgery), 469 (forgery causing reputational harm), 499 (defamation), 503 (criminal defamation), 509 (word, gesture or act intended to insult the modesty of a woman) of the IPC are more likely provisions to be pressed in personal matters involving deepfake, whereas in more egregious attempts at promoting enmity among groups through creation and propagation of deepfakes, deepfakes created ostensibly to cause nuisance on grounds of religion or race, or language or at harming national integration, recourse to section 153Aand 153B does remain an option.

Designing a comprehensive legal framework through existing array of applicable laws instead of promulgating a new law to counter deepfakes by - (a) by rendering a legal definition of 'deepfake' and carefully differentiating that term from traditional editing (b) by addressing both 'intent' and 'harm' and shifting the burden of proof on perpetrators in more egregious of deepfake (c) filling the legal gaps in existing legislation both in IPC and the IT Act on fraud, defamation, criminal defamation and forgery to explicitly include deepfake and (d) laying down precise and clearer guidelines for social media intermediaries- appears a more pragmatic and nuanced approach than devising a new law, the latter being susceptible to new, unintended and vexatious interpretations and unequal application. In as much as the same deepfake technology enables interactive learning, effective language learning, acts as a tool for effective education and training, and is indispensable in creative industries, the versatility of the technology at least deserves to be preserved and developed, when one takes up developing alongside an effective legislation to counter its more malicious and pernicious application.