Authored By: Rituraj Kanwar Chundawat
NIMS University, NIMS School of Law
I. Introduction
In November 2023, a deepfake video of Indian actress Rashmika Mandanna went viral, when she was morphed with another woman. This incident was picked up by various media outlets and led to a call by the Minister of State for Electronics and Information Technology for immediate legislation in the matter.[1] In a very short period, MeitY issued a guideline to online platforms to remove such content within 36 hours.[2] But, even as the matter received a huge public backlash and the government’s response was immediate, nothing was done by law. The perpetrator was found and arrested, but nothing further has happened, and the victim hasn’t received justice or remedy for the damage done. This incident highlighted an unexplored gap in the current laws in India where the deliberate creation and sharing of fake digital identity is not addressed and there are no laws to address the rise of deepfakes. Deepfake is a technology based on artificial intelligence, specifically generative adversarial network (GAN), which is able to create convincingly real audio and visual media. This technology can be used to make up entirely new speech and actions that the person did not in fact say or perform.[3]
It is expanding quickly: According to one external research group in 2019, there were more than 14,000 of these videos available online, and 96% of them were of women that were sexually exposed without their consent.[4] This technology can cause some serious harms: sexual exploitation by morphing someone’s face on some sexually explicit content making it look realistic to cause them psychological distress and public shunning is one of the results which will ensue from such action, reputational harm by making an audio or video of someone doing or saying something they did not in reality to cause harm to their reputation, electoral interference by creating fake videos or audios of the candidates and circulating them right before or several hours before the polling to cause confusion among masses by disseminating the false information and eventually leading to a shift in the public opinion because of the false information, and financial fraud by using this technology to clone someone’s voice to demand financial payments from the other.[5]
This article firstly examines the existing framework of various provisions in the Bhartiya Nyaya Sanhita 2023, the Information Technology Act 2000 and guidelines under the Information Technology Act 2000, and how it fails to account for the specific harm caused by deepfakes, which can be remedied through a dedicated criminal law that is more consistent, fair and meaningful. Then this article looks at how the UK and US have responded to this new form of crime and eventually we discuss how India can respond to this situation through legislation.
II. Currently prevailing Legal Structure
A. The Information Technology Act, 2000
In India the cyber crime is governed by Information Technology Act, 2000 (IT Act). While some provisions have been invoked in actions taken by some individuals in connection with threats online, deepfakes have not been prosecuted under any of the relevant provisions. The use of the electronic signature, password or any other feature of identification of another person in a fraudulent or dishonest manner is prohibited pursuant to section 66C.[6] Section 66E makes punishable the capturing, publishing or transmitting images of the private areas of any person.[7] The possession, publication or transmission of sexually explicit material in electronic form is criminalized in Section 67A, and publishing or transmitting obscene material is prohibited by Section 67.[8]
These are some of the provisions that are relevant, but don’t really quite fit the harm that deepfakes can cause. Section 66C does not deal with making a person’s identity, but with using authentication information without the consent. Secondly, the ban on the taking of “private pictures” in section 66E cannot extend to pictures that have been made and not taken. The concern regarding obscenity only comes up in relation to “publication to third parties” in section 67 and 67A, and the subjective definition of obscenity in either of those sections does not shed any clarity on how obscenity is defined for algorithmically generated content.
B. Bhartiya Nyaya Sanhita, 2023
There are more avenues under the Bhartiya Nyaya Sanhita, 2023 (BNS). Criminal defamation is defined in section 356 of the Act as making or publishing any imputation that harms a person’s reputation.[9] It is basically a video of a public figure saying something that they never actually said. In other words, a deepfake video of a public figure saying something that they never actually said would be an act of criminal defamation. Voyeurism is defined and prohibited in Section 77, and has to do with publication of images of a woman engaging in a private act.[10]
This clause has been Applicable in cases of nonconsensual intimate image abuse, prosecutors have claimed it should be extended to artificial intimate images. The language of the section, however, refers to a private image (both recorded and watched), and was not meant to cover artificially created images, thus, using the section for deepfakes is a legal question to be debated.[11]
C. Intermediary Liability Framework
The Information Technology (Intermediaries Guidelines and Digital Media Ethics Code), 2021 has made it mandatory for media companies providing social media services to take some action to remove content that falls under the category of deepfake harm. Appropriate actions must be taken to avoid hosting content that impersonates another individual (Rule 3(1)(b)).[12] Significant social media intermediaries are now required to use automated tools to identify and take down unwanted, nonconsensual intimate images as per Rule 4(2).[13] Although the rules provide a method for managing the deletion of such content, they are not intended to criminalize the creation and sharing by an individual of a deepfake. The distinction between regulating platforms and prosecuting individuals is crucial: While it is possible to take down a deepfake after it’s been published, the harm done cannot be undone, and the harms can continue to be done.
III. Key gaps in the existing framework
A. The lack of an offence-specific punishment.
Most importantly, the current law does not have an offence-specific penalty for creating, possessing or disseminating deepfakes. The statutory provisions mentioned in Section II require the use of words which were obviously intended for another set of facts. This results in a few issues. Firstly, it causes uncertainty in the law which has an impact on deterrence and prosecution of such crimes. When a deepfake is discovered by an investigator or prosecutor, he or she has to assemble the case from parts of the law that are not directly applicable. Simultaneously, a defendant can make out a case for the inapplicability of the language of a provision to their actions. Moreover, there is no explicit offence, so someone’s degree of fault (whether they created the deep fake, shared it or it became viral) is not considered when sentencing.
B. The Consent and Intent Problem
Many of these provisions require a particular mental state, like the requirement of dishonest intent in section 66C or the intent to harm reputation in section 499 of the IPC, now mapped onto section 356 of BNS.[14] This puts a specific evidentiary burden on the party, and in many deep-fake cases, this will be hard to prove. The goal in making a deepfake could even have been comedic or artistic creation. However, in the absence of statutory definitions that differentiate between nonconsensual intimate deepfakes (those that should be subject to strict liability) and other kinds of synthetic media, the courts are left without any guidance. An added challenge for victims is establishing his or her case beyond a reasonable doubt in a process that can be technically difficult.
C. Information Sharing and Technology Innovation
The creation and dissemination of deepfakes often takes place across jurisdictions, in several stages spanning actors, servers and platforms. In India, if the commission of the offence involves a computer, computer system or computer network but the computer resource is in a different country, Indian courts have a bar on jurisdiction and enforcement of orders.[15] This is compounded by a lack of international sharing agreements on deepfakes crimes. In fact, in the current system, if a non-national perpetrates an offence outside of the country, the victim of the offence has no means of redress.
D. The Gender Dimension
It is crucial to recognise deepfake harm is a gendered crime. Non-consensual deepfakes have been proven to be a targeting weapon for women.[16] Nonconsensual creation of intimate imagery is currently not covered by definition of sexual offence in the IPC (section 354C), and thus is not treated as a sexual offence with the same level of severity as other sexual offences such as nonconsensual sexual touching under section 77 of the BNS 2023.
This generates a normative paradox: an actual intimate image that is taken and shared without the owner’s consent is a serious crime, but a synthetic intimate image is not taken without the owner’s consent, but is created without the consent of those appearing in the image. Unless these two harms are treated with the same treatment and in the same light, a similar structure will not capture the same level of dignity and autonomy concerns.[17]
IV. Comparative Perspectives
A. The United Kingdom
A new law for the United Kingdom about non-consensual intimate deepfakes has just been enacted. It is an offence to upload, share, publish or otherwise make available, without the consent of the individual depicted in the image, a private intimate image, including a digitally altered or created image (online safety act 2023).[18] Further, the underlying principles for responding to intimate image abuse have been enhanced in the Criminal Justice Act (Northern Ireland) 2013 and in the Law Commission’s recommendations for reform.[19] The U.K. approach is interesting because (1) non-consensual intimate deepfakes are considered a sexual offence – it is their use rather than pornography that is the issue – and (2) there are no limits on what can be considered a harm for non-consensual intimate deepfakes – it is about using a person’s likeness without consent, not about the pornographic nature of the content itself.
B. The United States
There is lively debate at the U.S. federal and state levels. The DEEPFAKES Accountability Act bill was introduced in Congress in 2019, which would mandate that any synthetic media be labelled and would provide penalties for the creation of deepfakes for the purpose of harming or defrauding.[20] California, Texas, Virginia, and other states have enacted their own laws regarding deepfakes that interfere with elections and non-consensual distribution of intimate deepfakes.
As the U.S. scenario shows, deepfakes can cause different degrees of harm depending on the type of deepfake generated. The state of California’s stance of imposing civil and criminal liability for non-consensual intimate deepfakes and election targeting deepfakes appears to be a more effective strategy to address the issues.[21]
The comparison highlights two points that should be kept in mind for the legal reform in India. First, there needs to be precision – broad statements about ‘online harms’ are not enough to tackle all of the problems posed by deep fakes. Second, punishment should be commensurate with the harm that the non-consensual deepfakes cause: non-consensual deepfakes are a form of sexual harm, and there must be a scheme of strong criminal penalties. Other types of noxious computer-generated media may warrant lesser punishment.
V. Recommendations for Reform.
It is recommended that India establish a standalone Deepfake Regulation Act which implements multi-tiered regulation to recognise the whole range of crimes relating to Deep fake based on the harm caused, so that the culpability is proportionate to the harm caused. The following recommendations set out the basic outline of what this legislation should entail:
-
The Act should first and foremost have a clear definition of ‘deepfake’ that includes entities created or modified through AI and machine learning technology that seem to represent at least one identifiable person engaged in actions they did not perform. The current Laws do not specifically define deepfake as an offence and hence, it is difficult to criminalise it. The definition should be technologically neutral – in order to allow for new developments in the field – and it should include fully changed content as well as partially altered content which will eventually widen its scope of application for any unique future incidents.
-
Just like some of the other Offences in BNS, there should be a criminal class of aggravated deepfake offences defined in the Act and penalties should be severe as deepfake has wide scope- from creating an unharmful comedic video to creating sexually explicit content morphing someone’s face into it. Deepfake can be used in a wide spectrum of situations and hence, it calls for the requirement of aggravated deepfake offences. Intimate deep faked content should be regarded as aggravated offence and should be penalized by imprisonment of at least three years and not more than seven years and fine. This would be in keeping with similar punishments in the BNS and would be commensurate(Proportionate) to the level of harm inflicted. The offence should be cognizable and non-bailable and arrest can be made as necessary.
-
There should also be tougher penalties and quicker time limits for electoral related offences, false statements about a candidate and false statements by electoral officers in relation to their job: ascribed to them by deep fake can shift the public opinions wrongfully by disseminating false information.
-
For cases where a deepfake causes reputational harm outside of private and electoral contexts—for instance, a video depicting a business executive embezzling funds or selling information related to trade secrets etc. —there is a need for a criminal offense similar to defamation under BNS but with a higher maximum punishment for offences involving a deep fake, reflecting the potential for serious reputational harm in the online context and the irreparable nature of that harm.
-
There should be a mandatory disclosure requirement: Any synthetic content based on a real person should be accompanied with a machine-readable disclosure of such content to the extent it is synthetic. Where the content does not appear to be harmful, the failure to label has criminal consequences. This is a significant requirement both as a preventative measure, creating a traceable system for synthetic media and supporting platforms and regulators to detect non-consensual media before it causes harm.
-
To make the Act more effective more demanding intermediary obligations could be added, calling on intermediaries to do more to identify deepfakes. A system should be in place for active identification of non-consensual intimate deepfakes and alerting the police to the existence of such a deepfake. This moves towards a proactive rather than reactive regulatory environment and the issuing of criminal investigations based on the victim’s complaint.
VI. Conclusion
The article throws light on how Indian criminal law is inadequate to tackle the issue of deep fake technology in the current scenario, the Rashmika Mandanna case is the prime example of which. In this case the lack of specific offence for appropriating someone’s identity trait through deepfake has been observed and since there’s no direct law relevant to the offences relating to deepfake, there is no remedy, damages or punishment that can be prescribed in the light of this new type of crime. At best the IT Act, and parts of the BNS that predated generative AI, open a limited window of opportunity for prosecution, at worst the legislation is very murky in terms of the law. As can be seen from the approaches of the U.K. and U.S. there is scope for creating specifically targeted legislation which can mitigate the harm that can be done with a deep fake.
The Article has called for a standalone Deepfake Regulation Act in India which must establish a tiered punishment framework for non-consensual intimate deepfakes, equate electoral deepfakery with sexual offences, impose stricter penalties and time limits to prosecute such cases and mandates disclosure of synthetic media. It would not stifle legitimate use of technology for art or political commentary – appropriate defences could be articulated – but it would make it more difficult to exploit this technology to victimize people, especially women, whose dignity and safety is at stake. Rashmika Mandanna wasn’t the first. She was but a warning shot. Is it that Indian lawmakers will be the next ones to get the sack?
Reference(S):
Cases
Shreya Singhal v Union of India AIR 2015 SC 1523 (Supreme Court of India).
Puttaswamy v Union of India (2017) 10 SCC 1 (Supreme Court of India).
Legislation
Information Technology Act 2000 (India).
Indian Penal Code 1860 (India).
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (India).
Online Safety Act 2023 (UK).
DEEPFAKES Accountability Act, HR 4355, 116th Congress (2019) (US).
Secondary Sources
Henry Ajder and others, ‘The State of Deepfakes: Landscape, Threats, and Impact’ (Deeptrace, 2019).
Nina Brown, ‘Deepfakes and the Weaponization of Disinformation’ (2020) 23 Virginia Journal of Law and Technology 1.
Danielle Keats Citron and Robert Chesney, ‘Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security’ (2019) 107 California Law Review 1753.
Law Commission, ‘Intimate Image Abuse: A Final Report’ (Law Com No 407, 2022).
Arun Mohan, Justice, Courts and Delays (Universal Law Publishing 2009).
Shalu Nigam, ‘The Law on Rape in India: A Critical Appraisal’ (2016) 1 Indian Law Review 45.
Ministry of Electronics and Information Technology, ‘Advisory on Deepfakes’ (Government of India, November 2023).
‘Rashmika Mandanna Deepfake: Minister Rajeev Chandrasekhar Calls for Stricter Rules’ The Hindu (New Delhi, 7 November 2023).
[1] See ‘Rashmika Mandanna Deepfake: Minister Rajeev Chandrasekhar Calls for Stricter Rules’ The Hindu (New Delhi, 7 November 2023).
[2] Ministry of Electronics and Information Technology, ‘Advisory on Deepfakes’ (Government of India, November 2023).
[3] Danielle Keats Citron and Robert Chesney, ‘Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security’ (2019) 107 California Law Review 1753, 1757.
[4] Henry Ajder and others, ‘The State of Deepfakes: Landscape, Threats, and Impact’ (Deeptrace, 2019) 7
[5] Nina Brown, ‘Deepfakes and the Weaponization of Disinformation’ (2020) 23 Virginia Journal of Law and Technology 1, 5.
[6] Information Technology Act 2000 (India), s 66C.
[7] Information Technology Act 2000 (India), s 66E.
[8] Information Technology Act 2000 (India), s 67 and s 67A.
[9] Bharatiya Nyaya Sanhita 2023 (India), s 356 (Defamation)
[10] Bharatiya Nyaya Sanhita 2023 (India), s 77 (Voyeurism)
[11] Protection of Women from Domestic Violence Act 2005 (India); see also Shalu Nigam, ‘The Law on Rape in India: A Critical Appraisal’ (2016) 1 Indian Law Review 45.
[12] Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (India), r 3(1)(b).
[13] Ibid, r 4(2).
[14] Citron and Chesney (n 1) 1788.
[15] Arun Mohan, Justice, Courts and Delays (Universal Law Publishing 2009) 112
[16] Ibid 3.
[17] Puttaswamy v Union of India (2017) 10 SCC 1 (Supreme Court of India).
[18] Online Safety Act 2023 (UK), s 35
[19] Criminal Justice Act (Northern Ireland) 2013 (UK), s 51; see also Law Commission, ‘Intimate Image Abuse: A Final Report’ (Law Com No 407, 2022).
[20] DEEPFAKES Accountability Act, HR 4355, 116th Congress (2019).
[21] Brown (n 4) 18.
