Deepfake: Unveiling a New Frontier in Cybercrime

Authored By: Ho Eng Yee

Taylor’s University

Abstract:

Deepfake technology is rapidly evolving, blending realistic audio and visual manipulations that make it increasingly difficult to distinguish between genuine and fabricated content. This advancement sparks significant concerns over privacy, misinformation, and cybersecurity, as deepfakes can be weaponized to distort truth and destabilize trust in digital media. Recent studies underline the pressing need for enhanced detection tools, stronger public awareness, and robust ethical guidelines in AI development to mitigate the potential harms of such technology. Hence, this article aims to pinpoint the legal protections for deepfake technology victims.

Introduction

Alan Turing’s 1950 introduction of the Turing Test marked the emergence of machine intelligence shortly after digital computers were developed.¹ In the wake of relentless technological progress, artificial intelligence was formally established as a field aimed at enabling machines to understand language, reason, and learn autonomously. Additionally, deepfake technology is a form of artificial intelligence.

Definition and Mechanics of Deepfake Technology

Deepfakes, merging the concepts of “deep learning” and “fake,” are deceptively realistic video and audio files which are crafted to convincingly depict real individuals engaging in actions or making statements that never took place.² Deepfakes are generated by neural networks that process vast datasets to accurately replicate a person’s facial expressions, gestures, vocal characteristics, and nuances in speech.³Put simply, deepfake employs facial mapping technology and AI to replace one person’s face in a video with that of another.

Deepfake technology gained prominence in 2017 when Reddit users began creating synthetic celebrity pornography videos using AI. Despite Reddit’s ban on such content, the prevalence of deepfake surged, with the number of online deepfake videos increasing by approximately 550% from 2019 to 2024, reaching a total of 95,820 videos.⁴The accessibility of deepfake creation has been facilitated by various software applications, including DeepFaceLab, FaceApp, and Wombo. Additionally, social media platforms like Snapchat and TikTok have integrated AI-driven features that utilize deepfake technology, such as Snapchat’s Cameos and TikTok’s AI-generated content labels.⁵

Possible Threats of Deepfake Technology

Deepfake technology offers beneficial applications across various sectors, including film, education, digital communications, gaming, social media, healthcare, material science, fashion, and e-commerce. However, deepfake poses a serious risk to society, politics, and business by burdening journalists with the challenge of distinguishing real content from manipulated media, endangering national security through the spread of propaganda and election interference, undermining public trust in official information, and creating cybersecurity vulnerabilities for both individuals and organizations.⁶

The journalism industry is likely to confront a significant crisis of public trust as a result of deepfake. This technology enables the creation of highly realistic fake news videos, threatening the credibility of both journalists and media organizations. During the 2019 India-Pakistan conflict, Reuters identified about 30 fake videos, many of which were old clips reposted with misleading captions, such as outdated jet footage claimed to show recent threats. Some even altered political press conferences to suggest false narratives.⁷

Besides, the impact of deepfake on the general election also cannot be ignored. Deepfake has profoundly influenced U.S. general elections by enabling the creation and dissemination of disinformation. Foreign adversaries can easily harness AI to craft misleading materials such as manipulated videos and fabricated audio to aim at swaying public opinion and undermining electoral integrity.⁸Examples such as the fabricated video of Barack Obama in 2018 and the manipulated videos of Joe Biden during the 2020 US election, as highlighted by Vaccari et al., emphasize the harmful consequences of such deceptive deepfake techniques.⁹ Deepfake can be exploited for various malicious purposes, including fabricating orders from military leaders, creating confusion among the public and armed forces, and falsely legitimizing wars and uprisings.¹⁰ These tactics may potentially disrupt communications and influence perceptions of the community thus trigger international conflicts.

Furthermore, non-consensual face-swapping using deepfake often portrays victims negatively, infringing upon their privacy and consent. A 2019 study revealed that approximately 96% of deepfake videos online were non-consensual pornography, predominantly affecting women.¹¹The widespread distribution of such content can cause severe harm to victims’ reputations, mental health, and personal autonomy. Although deepfake pornography doesn’t show the victim’s real body, overlaying their face onto explicit content can cause considerable harm because these images often look convincing, which can lead to public identification and harm the person’s reputation.¹² These all can amount to cybercrime which is a serious issue that is arising nowadays. Not only defamation and misleading victims, deepfake also caused financial fraud and identity theft.

The Legal Framework of Deepfake Technology Abuse in Malaysia

Although Malaysia has no specific laws regulating deepfake technology currently, Amirudin said action against deepfake content can be taken under the Communications and Multimedia Act 1998 (“CMA”)¹³ , specifically Section 211.¹⁴ He mentioned that in 2024, Datuk Seri Ramli Mohamed Yoosuf, the director of Bukit Aman Commercial Crime Investigation

Department, disclosed that 454 cases of fraud involving deepfake technology were reported, resulting in total losses of RM2.272 million.¹⁵

In Malaysia, the Communications and Multimedia Act 1998 (“CMA”)¹⁶ is the only legislation that could potentially address the issue of deepfakes. Section 211(1)¹⁷ provides that no content applications service provider, or other person using a content applications service, shall provide content which is indecent, obscene, false, menacing, or offensive in character with intent to annoy, abuse, threaten or harass any person. Other than that, anyone who violates subsection (1) shall be guilty of an offence and, upon conviction, may face a fine of up to fifty thousand ringgit, imprisonment for up to one year, or both. Additionally, the individual may incur a further fine of one thousand ringgit for each day or part of a day that the offence continues after the conviction. These were provided under section 211(2)¹⁸ of the CMA.

This provision is sufficiently broad to address many forms of deepfake misuse, such as non-consensual pornography under indecency laws and impersonation through false information. In Public Prosecutor v Zulkifli bin Ariffin¹⁹, defendant was charged with fines and imprisonment for improper use of network facilities for knowingly creating and initiating indecent communication with the intention of annoying another individual under section 233(3)²⁰ of CMA.

Other than that, the Anti-Fake News Act 2018²¹, introduced by the government under Najib Razak in April 2018, defines an offense for anyone who maliciously creates, offers, publishes, prints, distributes, circulates, or disseminates fake news or publications containing fake news. Upon conviction, the offender can face a fine of up to five hundred thousand ringgit, imprisonment for up to six years, or both. If the offense continues after conviction, an additional fine of up to three thousand ringgit may be imposed for each day it persists. The first person convicted under this act is a Danish.²² He uploaded a video on YouTube accusing the police of taking 50 minutes to respond to distress calls following the shooting of a Palestinian lecturer on 21 April. On the fact, the police only took eight minutes to respond to the calls. The judge imposed a fine of 10,000 ringgit on him, but he chose to serve a month in jail instead, as he was unable to pay the fine.

A victim of a defamatory deepfake image or video can take legal action against the creator under tort law for the harm caused. In Ling Wah Press (M) SDN BHD & Ors v Tan Sri Dato Vincent Tan Chee Yioun²³, the court held that in defamation cases, the defendant deliberately publishes a harmful false statement with the intent to cause humiliation, distress, and harm to the plaintiff’s reputation. The damages awarded to the plaintiff in such cases serve to restore the plaintiff’s reputation in the public eye and provide compensation for the harm suffered. In Mkini Dotcom SDN BHD & Ors v Raub Australian Gold Mining SDN BHD²⁴, the court found that the appellants could not rely on the defence of responsible journalism because they uploaded two videos of the respondent without verifying the truth and accuracy and intended to injure its reputation, trade and business.

Apart from that, the perpetrator is also able to access the victim’s data then commit fraud. For instance, in March of 2025, police have identified five deepfake videos related to investment scams and have been widely circulated on social media since last year.²⁵These videos feature manipulated footage of politicians and prominent corporate figures, including U.S. President Donald Trump and Prime Minister Datuk Seri Anwar Ibrahim. Others portrayed include Petronas senior executives, Tesla CEO Elon Musk, and Seputeh MP Teresa Kok. The deepfakes falsely depict these individuals promoting investment schemes allegedly endorsed by the Malaysian government that promise unrealistically high returns of up to 100 times the original investment. Nonetheless, incidents like these are likely to increase with the advancement of the times. Otherwise, scammers created a fake WhatsApp video call impersonating Malaysia’s top singer, Datuk Seri Siti Nurhaliza, promoting fraudulent investment schemes. The deepfake was so convincing that fans believed she endorsed the scam. Similarly, celebrity chef Datuk Fazley Yaakob was impersonated in a TikTok scam where fraudsters used AI-generated audio and video to falsely claim his factory was flooded, tricking followers into sending money.²⁶These scams exploit public trust in celebrities, leading to significant financial losses and eroding confidence in online content. The scammers also violated section 416²⁷ and 419²⁸ of the Penal Code which mentionted that Criminalizes impersonation to commit fraud, punishable by up to 7 years’ imprisonment.

However, cases involving deepfakes in Malaysia are still relatively limited, with only a few reported incidents so far. The legal framework is still developing, and enforcement remains a challenge due to the novelty of the technology.

Recommendations and Solutions

While Article 10(1)(a) of the Federal Constitution²⁹ guarantees the right to freedom of speech and expression, this right is subject to limitations under Article 10(2)(a)³⁰. Parliament plays a crucial role in delineating the boundaries of unlawful deepfakes and enforcing prohibitions to safeguard individual privacy and reputation, aligning with Articles 5(1)³¹ and 10(2)(a)³².

To address the legal gaps concerning deepfakes in Malaysia, it is imperative to enact specific legislation that criminalizes the creation and dissemination of deepfakes without the consent of the individuals depicted. Proposed amendments to the Communications and Multimedia Act (CMA)³³ aim to enhance penalties for misuse of network facilities or services, with fines of up to RM500,000 and imprisonment for up to two years. Sanctions should be tiered to correspond with the severity of harm caused by the deepfake. Civil remedies should include mandatory injunctive relief to halt further dissemination and mitigate damage. Liability should extend to creators aware of the unlawful nature of their deepfake, especially those containing obscene content or lacking consent.

Moreover, establishing clear policies and guidelines for service providers and social media companies is essential. The European Digital Services Act’s³⁴ provisions on internal complaint-handling systems, misuse prevention, and risk assessment can serve as valuable references. Incorporating such measures into the CMA would impose a duty of care on service providers, holding them accountable for breaches.

Recognizing the rapid advancement of deepfake and voice cloning technologies, Malaysia’s existing privacy laws require strengthening. The Personal Data Protection (Amendment) Act 2024³⁵, effective from April 2025, introduces significant changes, including mandatory appointment of Data Protection Officers, mandatory data breach notifications, and rights to data portability. However, these amendments may not fully address the challenges posed by deepfake. Therefore, enacting a dedicated Act to protect personal data against misuse by private entities is recommended. This Act should broadly define “personal data” to encompass facial recognition and voice data, explicitly prohibit and criminalize unauthorized training or processing of such data, and impose stringent penalties for violations.

Conclusion

Deepfake—AI-generated manipulations of audio and visual content have emerged as a significant cybercrime threat in Malaysia, impacting individuals and institutions alike. The nation’s legal framework currently lacks specific legislation addressing deepfakes, leading to challenges in effectively combating their misuse. To address these challenges, experts advocate for comprehensive legislation that criminalizes the creation and dissemination of deepfakes without consent, imposes liability on technology companies hosting such content, and regulates AI technology. citeturn0search1 Additionally, the Securities Commission Malaysia has warned the public about investment scams utilizing deepfakes to impersonate prominent figures and reputable companies, emphasizing the need for vigilance and verification of investment offers.³⁶ To mitigate the risks associated with deepfake, individuals are advised to verify the authenticity of received content, stay informed about the characteristics of deepfake, utilize detection tools, and report suspicious content to relevant authorities. By combining robust legal measures with proactive public engagement, Malaysia can better navigate the challenges posed by deepfake, safeguarding the digital landscape for all.

Reference

Cases

Ling Wah Press (M) SDN BHD & Ors v Tan Sri Dato Vincent Tan Chee Yioun [2000] 4 MLJ 77.

Mkini Dotcom Sdn Bhd & Ors v Raub Australian Gold Mining Sdn Bhd [2021] 5 MLJ 79. Public Prosecutor v Zulkifli bin Ariffin [2022] MLJU 2623

Constitution

Fed. Const. (Malay.) art. 5(1).

Fed. Const. (Malay.) art. 10(1)(a).

Fed. Const. (Malay.) art. 10(2)(a).

Legialations (Malaysia)

Anti-Fake News Act 2018 (Act 803) (Malay.) [repealed].

Communications and Multimedia Act 1998 (Act 588) (Malay.).

Communications and Multimedia Act 1998 (Act 588) § 211(1) (Malay.). Communications and Multimedia Act 1998 (Act 588) § 211(2) (Malay.). Communications and Multimedia Act 1998 (Act 588) § 233(3) (Malay.). Penal Code (Act 574) § 416 (rev. ed. 2023) (Malay.).

Penal Code (Act 574) § 419 (rev. ed. 2023) (Malay.). Personal Data Protection (Amendment) Act 2024 (Malay.).

Legislatios (EU)

Digital Services Act, Regulation (EU) 2022/2065, 2022 O.J. (L 277) 1 (EU).

Circulars, Directions and Guidelines

Gráinne Ryan, Cyberflashing and Deepfake Pornography, Paper No. 01/22, N. Ir. Assemb. (2022),

http://www.niassembly.gov.uk/globalassets/documents/raise/publications/2017-2022/2022/jus tice/0122.pdf.

Lawrence Livermore National Laboratory, The Birth of Artificial Intelligence (AI) Research, LLNL (Mar. 14, 2024, 10:00 AM),

https://st.llnl.gov/news/look-back/birth-artificial-intelligence-ai-research.

Sec. Comm’n Malay., SC Warns Public on Deepfake Investment Scams Impersonating

Prominent Personalities and Using Names of Reputable Companies (Media Release, July 22, 2024),

https://www.sc.com.my/resources/media/media-release/sc-warns-public-on-deepfake-investm ent-scams-impersonating-prominent-personalities-and-using-names-of-reputable-companies.

Books

Dave Johnson, What Is a Deepfake? Everything You Need to Know About the AI-Powered Fake Media, BUS. INSIDER (2021).

Journal Articles

Mahashreshty Vishweshwar & Shalini, Implications of Deepfake Technology on Individual Privacy and Security (2023) (Culminating Projects in Information Assurance, Paper No.

142), https://repository.stcloudstate.edu/msia_etds/142

Robert Chesney & Danielle Citron, Deepfakes and International Conflict, BROOKINGS (May 23, 2019), https://www.brookings.edu/articles/deepfakes-and-international-conflict/.

Newspaper Article

AP, I never said that! High-tech deception of ‘deepfake’ videos, CBS NEWS (July 2, 2018, 9:05 AM EDT),

https://www.cbsnews.com/news/i-never-said-that-high-tech-deception-of-deepfake-videos/.

Can You Distinguish Between Reality and Deepfake?, ASTRO AWANI, https://international.astroawani.com/malaysia-news/can-you-distinguish-between-reality-and- deepfake-509400.

Donie O’Sullivan, Deepfake Videos Are Getting Real and That’s a Problem for 2020, CNN (June 12, 2019, 5:00 PM),

https://edition.cnn.com/2019/06/12/tech/deepfake-2020-detection/index.html.

Hannah Ellis-Petersen, First Person Convicted Under Malaysia’s Fake News Law, THE GUARDIAN (Apr. 30, 2018, 2:15 AM),

https://www.theguardian.com/world/2018/apr/30/first-person-convicted-under-malaysias-fake

-news-law.

Police Detect Five Deepfake Videos Linked to Investment Scam, DAILY EXPRESS (Malay.), https://www.dailyexpress.com.my/news/254004/police-detect-five-deepfake-videos-linked-to -investment-scam/.

Sean Lyngaas, US Intel Says AI Is Boosting, but Not Revolutionizing, Foreign Efforts to Influence the 2024 Elections, CNN (Sept. 23, 2024),

https://edition.cnn.com/2024/09/23/politics/us-intel-ai-boosting-foreign-election-interference.

Women Face New Sexual Harassment with Deepfake Pornography, PBS NEWSHOUR,

https://www.pbs.org/newshour/show/women-face-new-sexual-harassment-with-deepfake-por nography.

Internet Sources

Bilal Alpaslan, Social Media Worry About Deepfake But Can’t Do Without It, DEEPWARE.AI (Jan. 13, 2020),

https://deepware.ai/social-media-worry-about-deepfake-but-cant-do-without-it/.

How Deepfakes Fuel Investment Scams in Malaysia, CYBERSECURITY ASIA, https://cybersecurityasia.net/how-deepfakes-fuel-investment-scams-malaysia/.

Lucinda Southern, How Reuters Is Training Reporters to Spot ‘Deepfakes’, DIGIDAY (Mar. 26, 2019),

https://digiday.com/future-of-tv/reuters-created-a-deepfake-video-to-train-its-journalists-agai nst-fake-news/.

Maeve Donegan, Demand for Deepfake Pornography Is Exploding. We Aren’t Ready for This Assault on Consent, THE GUARDIAN (Mar. 13, 2023),

https://www.theguardian.com/commentisfree/2023/mar/13/deepfake-pornographyexplosion.

¹Lawrence Livermore National Laboratory, The Birth of Artificial Intelligence (AI) Research, LLNL (Mar. 14, 2024, 10:00 AM), https://st.llnl.gov/news/look-back/birth-aartificial-intelligence-ai-research.

² Donie O’Sullivan, Deepfake Videos Are Getting Real and That’s a Problem for 2020, CNN (June 12, 2019, 5:00 PM), https://edition.cnn.com/2019/06/12/tech/deepfake-2020-detection/index.html.

³AP, I never said that! High-tech deception of ‘deepfake’ videos, CBS NEWS (July 2, 2018, 9:05 AM EDT), https://www.cbsnews.com/news/i-never-said-that-high-tech-deception-of-deepfake-videos/.

⁴ Maeve Donegan, Demand for Deepfake Pornography Is Exploding. We Aren’t Ready for This Assault on Consent, THE GUARDIAN (Mar. 13, 2023),

https://www.theguardian.com/commentisfree/2023/mar/13/deepfake-pornographyexplosion.

⁵ Bilal Alpaslan, Social Media Worry About Deepfake But Can’t Do Without It, DEEPWARE.AI (Jan. 13, 2020), https://deepware.ai/social-media-worry-about-deepfake-but-cant-do-without-it/.

⁶ Mahashreshty Vishweshwar & Shalini, Implications of Deepfake Technology on Individual Privacy and Security (2023) (Culminating Projects in Information Assurance, Paper No. 142), https://repository.stcloudstate.edu/msia_etds/142.

⁷ Lucinda Southern, How Reuters Is Training Reporters to Spot ‘Deepfakes’, DIGIDAY (Mar. 26, 2019), https://digiday.com/future-of-tv/reuters-created-a-deepfake-video-to-train-its-journalists-against-fake-news/

⁸ Sean Lyngaas, US Intel Says AI Is Boosting, but Not Revolutionizing, Foreign Efforts to Influence the 2024 Elections, CNN (Sept. 23, 2024),

https://edition.cnn.com/2024/09/23/politics/us-intel-ai-boosting-foreign-election-interference.

⁹ Dave Johnson, What Is a Deepfake? Everything You Need to Know About the AI-Powered Fake Media, BUS. INSIDER (2021).

¹⁰ Robert Chesney & Danielle Citron, Deepfakes and International Conflict, BROOKINGS (May 23, 2019), https://www.brookings.edu/articles/deepfakes-and-international-conflict/.

¹¹ Women Face New Sexual Harassment with Deepfake Pornography, PBS NEWSHOUR, https://www.pbs.org/newshour/show/women-face-new-sexual-harassment-with-deepfake-pornography. ¹² Gráinne Ryan, Cyberflashing and Deepfake Pornography, Paper No. 01/22, N. Ir. Assemb. (2022),

http://www.niassembly.gov.uk/globalassets/documents/raise/publications/2017-2022/2022/justice/0122.pdf.

¹³ Communications and Multimedia Act 1998 (Act 588) (Malay.).

¹⁴ Communications and Multimedia Act 1998 (Act 588) § 211 (Malay.).

¹⁵ Can You Distinguish Between Reality and Deepfake?, ASTRO AWANI, https://international.astroawani.com/malaysia-news/can-you-distinguish-between-reality-and-deepfake-509400.

¹⁶ Communications and Multimedia Act 1998 (Act 588) (Malay.).

¹⁷ Communications and Multimedia Act 1998 (Act 588) § 211(1) (Malay.).

¹⁸ Communications and Multimedia Act 1998 (Act 588) § 211(2) (Malay.).

¹⁹ Public Prosecutor v Zulkifli bin Ariffin [2022] MLJU 2623

²⁰ Communications and Multimedia Act 1998 (Act 588) § 233(3) (Malay.).

²¹ Anti-Fake News Act 2018 (Act 803) (Malay.) [repealed].

²² Hannah Ellis-Petersen, First Person Convicted Under Malaysia’s Fake News Law, THE GUARDIAN (Apr. 30, 2018, 2:15 AM),

https://www.theguardian.com/world/2018/apr/30/first-person-convicted-under-malaysias-fake-news-law.