CERT-In issues high-severity advisory about deepfakes

There is a high risk of “exploitation” which can lead to misinformation, fraud and reputational damage, the advisory said.

The Indian Computer Emergency Response Team (Cert-In) issued a high-severity advisory about the use of deepfakes to scam people on November 27.

The agency said that deepfakes pose “significant risks to the users.

 The agency said that deepfakes, which use artificial intelligence (AI) “to create highly realistic and convincing fake videos, images, and audio” pose “significant risks, including the potential for disinformation, fraud, and social engineering attacks."

READ | In a first, CERT-In can now give expert opinion on evidence from drones, CCTVs

It advised organisations to use encrypted and secure communication channels for sensitive discussions to prevent interception and manipulation.

There is a high risk of “exploitation” which can lead to misinformation, fraud and reputational damage, the advisory said. 

The agency said that deepfakes can be used to commit financial fraud, spread disinformation, do social engineering, and generate non-consensual explicit content.

When it comes to disinformation, Cert-In warned that deepfakes can be used to spread “false information or manipulate public opinion by creating fake videos of public figures or events” which “can have serious implications for politics, journalism, and public trust”.

The advisory was released a week after the Bharatiya Janata Party posted four fake audio clips targeting NCP (SP)’s Supriya Sule on the eve of the Maharashtra assembly elections.

Cert-In advised people to be careful about the amount of personal data they share online, especially high-resolution photos and videos that be “exploited” to create deepfakes.

The agency also advised people to enable strong privacy settings, verify sources of information, and look for distinctive signs of digital manipulation (lip-sync issues, awkward head and body movements, robotic and mechanical voices, distorted or misaligned visuals, etc.).

On May 22, Rajesh Kumar, CEO of the Indian Cyber Crime Coordination Centre (I4C), explained that to commit financial crimes (such as “digital arrests”), criminals rely on social engineering for which they depend both on breached personal data as well as the wealth of personal data and details of relationships that people make publicly available on social media platforms.

For organisations, Cert-In said that they should watermark their media to deter deepfake creators, implement verification protocols for all digital communications (multi-factor authentication, callbacks for sensitive transactions), use advanced detection tools, and monitor social media and public channels for potential deepfake content targeting the organisation amongst other measures.

Cert-In also advised organisations to conduct regular security audits to identify vulnerabilities that could be exploited by such technologies, and to ensure that the entity’s legal and compliance frameworks “are capable of effectively addressing deepfake threats”.