Deepfakes in Business: How Can You Protect Your Reputation?
Having a response plan is keyBy Amy White | Reviewed by Canaan Suitt, J.D. | Last updated on August 23, 2023 Featuring practical insights from contributing attorney Jennifer Beckage
Use these links to jump to different sections:
- What Can Deepfakes Be Used For?
- Are Deepfakes Easy to Create?
- How Do You Protect Yourself Against the Threat of Deepfake Attacks?
- How Do You Detect Deepfakes?
- Have an Incident Response Plan in Place
- Find an Experienced Attorney
If any of the 1.4 million fans of @deeptomcruise on TikTok or other social media don’t read the fine print, they may walk away from a video of Tom Cruise rhapsodizing over a strawberry Blow Pop and think it’s legit. (It’s not).
The popular account exists solely to share deepfakes of the actor—fake videos named for the deep-learning artificial intelligence that helps users create them.
While @deeptomcruise may be silly fun, the FBI predicts that this same kind of deepfake technology will increasingly be levied in an effort to harm.
What Can Deepfakes Be Used For?
“There are fake videos that do funny things, like the old JibJab ones,” says tech lawyer Jennifer Beckage with Beckage Law Firm in Buffalo.
“But we’ve also got bad actors using this kind of artificial intelligence to put people’s faces on pornographic images or to take legitimate videos but tweak the messaging slightly to cause an uproar or political upheaval—or even to impersonate the voice of a CEO. Obviously, in the wrong hands, this AI can cause significant and serious threats to the public, to individuals, to overall safety, not to mention ignite political tensions.”
And, she notes, a deepfake can make for easy DIY.
Are Deepfakes Easy to Create?
“There are a few ways that you can create one,” she says.
“Basically, you can take a target video and essentially swap a photo in. It’s easy, and there are apps to help anyone do that. But higher caliber ones are created with an algorithm that will quickly help identify all of the characteristics of the underlying target and the characteristics of the new face you want to impose, so that it can line up in such a way that it looks seamless.”
How Do You Protect Yourself Against the Threat of Deepfake Attacks?
So how can you prevent yourself or your small business from becoming a victim? Beckage says it starts with education.
“The first step is educating the board and executive teams that these things can be out there, and be used to cause harm or embarrassment,” she says. “It’s not unusual for an executive to have something like this happen to try to smear or tarnish their reputation.”
She also notes there are tools available to help monitor the use of deepfakes, like Microsoft Video Authenticator, for example, which analyzes photos and videos and gives users a confidence score regarding the validity of the sample.
Use Critical Thinking
And then there’s common sense. “We all should be looking more critically at certain things in certain circumstances,” she says. “For example, if an employee receives a video from the president of their company directing them to wire money, ask, ‘Would the president usually send me a video?’”
How Do You Detect Deepfakes?
Beckage notes that the FBI, in its recent warning about the rise of deepfakes, offered clues to help consumers detect deepfake videos and other disinformation and misinformation.
“The agency suggests looking between the eyes—does it seem like there’s too much space? Also, does there seem to be an issue with lip and mouth synchronization?” Further guidance includes looking for strange movement in relation to the head and torso.
Have an Incident Response Plan in Place
“But there’s nothing more important than having an incident-response plan,” Beckage says.
“If you have a business continuity plan that walks an organization through a fire or a flood, you should have a plan in place that addresses the unique circumstances of a data security or cyberattack incident. What we often see is that deepfakes are usually part of something else—they tend to arise in the context of a data breach.”
Identify Risk Factors
First, identifying risk factors will help influence your plan. Ask, ‘Who might launch a digital smear campaign?’ “Consider your competitors and if you have disgruntled employees or unhappy former partners,” she says. “There’s also foreign state actors: Does your organization run that risk? Going through a regular risk assessment is critical.”
Outline Critical Roles
Next, outline roles. “You’ll want to organize a public-relations, technical, and legal response,” Beckage says. “And you’re going to need a point person’s number on speed dial to launch the response plan. Having a trusted advisor on hand, coupled with your incident response plan or business-continuity plan, will help guide you through.”
Find an Experienced Attorney
While Beckage is not unaware of the harm posed by this kind of artificial intelligence, she also sees opportunity.
“The concept of impersonation is not new; there’s just a new technology to do it,” she says. “But it doesn’t mean the technology is bad across the board. This AI actually has a lot of potential for good, and I think those should be things we’re talking about as well.”
If you have questions or concerns about your business’s vulnerabilities to cybercrime or reputational damage arising from malicious deepfakes, a technology transaction/cybersecurity lawyer can help. For more information on this area of law, see our overview of technology transactions law and related content on cybersecurity, data privacy, and ransomware attacks.
Additional Technology Transactions articles
- What is Technology Transactions Law?
- Defending Your Business Against Ransomware: Strategies to Minimize Risk
- New Tech, Old Law: How Legal Expertise Helps Technology Transactions Succeed
- How Tech Transaction Lawyers Help Clients Comply with Data Privacy Laws
- Protecting Your Intellectual Property in a Technology Transaction Agreement
- How Has Work-From-Home Emboldened Hackers and Phishers?
- Defending Against Ransomware: How Lawyers Help Fight Cyber Threats
- Can You File an Insurance Claim for a Data Security Breach?
- How Much Cybersecurity Does My Business Need?
- Does My Business Need Cyber Insurance?
- Legal Steps to Take When Your Company is Hacked
- How Should Technology Platforms Be Categorized?
- What New Legal Issues Are Media Companies Facing?
- Is a Contract with a Computer Program Enforceable?
- Can I Sue for a Data Security Breach?
- The Fear of Data Theft: How Lawyers Navigate Cybersecurity Challenges
- Is Technology Outpacing the Law?
Find top lawyers with confidence
The Super Lawyers patented selection process is peer influenced and research driven, selecting the top 5% of attorneys to the Super Lawyers lists each year. We know lawyers and make it easy to connect with them.Find a lawyer near you