As artificial intelligence (AI) tools make it easier to create convincing fake videos, cloned voices, and manipulated images, distinguishing genuine content from fabricated material is becoming increasingly difficult. Deepfakes are being used for impersonation, fraud, extortion, and reputational harm, posing fresh challenges for law enforcement agencies as well as ordinary users of social media.
Investigating such content involves more than simply looking for visual glitches. Police must examine how a file was created or modified, trace how it circulated, and establish whether other evidence supports the content. The task becomes more complicated when images and videos are compressed, forwarded or screen-recorded, stripping away information that could help establish their origin.
In an interview with Tehelka, Gaurav Tyagi, Deputy Commissioner of Police, Intelligence Fusion and Strategic Operations (IFSO), Special Cell, Delhi Police, explains how investigators identify deepfakes, the challenges they face in dealing with rapidly evolving AI technology, and the precautions people can take before believing or sharing suspicious content.
‘Deepfake investigation is no longer limited to identifying visual inconsistencies’
Q: How has the rise of generative AI changed the nature of deepfake-related crimes, and what new challenges does it pose for investigators?
Gaurav Tyagi: Generative AI has made creating realistic fake content easier, faster, and more accessible. Earlier, creating manipulated videos or images required specialized skills, time, and resources. Today, AI tools have significantly lowered these barriers, allowing a wider range of people to produce convincing synthetic content.
Such content can be misused for impersonation, financial fraud, extortion, the creation of non-consensual imagery and damage to a person’s reputation. The challenge for investigators is no longer limited to identifying whether a video or image has been manipulated. They must also establish how the content was created or altered, how it was circulated, who was involved, and the context in which it was used.
Q: What techniques do investigators use to distinguish an AI-generated or manipulated video from an authentic one?
Gaurav Tyagi: Investigators use a combination of technical examination and conventional investigative methods. They may examine a digital file for metadata, compression patterns, encoding inconsistencies, and other technical indicators. In videos, investigators may conduct frame-by-frame analysis and look for inconsistencies in lighting, shadows, blinking, lip-syncing, or the boundaries of manipulated areas.
Investigators can also examine audio for unusual spectral patterns, inconsistencies in background noise, breathing, and other characteristics that may indicate synthetic or altered speech. However, no single indicator is conclusive. Investigators must assess the available technical evidence alongside the content’s source and the circumstances of its emergence.
The process may also involve tracing the original source, conducting reverse image or video searches, and corroborating the material with CCTV footage, call records, eyewitness accounts, or other independent evidence. When needed, forensic laboratories, including the National Cyber Forensic Laboratory, can examine digital evidence.
Q: How difficult is it to authenticate a video or image after it has been forwarded several times on social media or messaging platforms?
Gaurav Tyagi: Forwarding, compression, and screen-recording can significantly alter a digital file. These processes may remove metadata or introduce technical artefacts, making it more difficult to determine the origin of the content and identify signs of manipulation.
That is why investigators try to obtain the earliest available version of a file, preferably the original, and preserve it for forensic examination. The authenticity of a piece of content cannot always be established by examining a forwarded copy alone. Cooperation from digital platforms can also help trace the content’s circulation and obtain relevant information.
Q: What happens when genuine videos or recordings are dismissed as deepfakes? How serious is the threat of people using AI as an excuse to deny authentic evidence?
Gaurav Tyagi: This is a serious concern. When genuine digital evidence is dismissed as fabricated, it can undermine trust in digital material and make it more difficult to establish facts. This phenomenon is often referred to as the “liar’s dividend”, where the possibility of manipulated content is used to cast doubt on authentic material.
It can affect public trust in journalism, the justice system and law enforcement. For investigators, it reinforces the need to authenticate digital evidence through established forensic procedures and corroborate it with independent sources rather than relying on claims about whether a particular video or recording is genuine.
Q: Are existing laws and investigative mechanisms adequate to deal with the growing use of deepfakes? What are the major challenges for law enforcement?
Gaurav Tyagi: One of the key challenges is the pace at which AI technology is evolving. Investigators need ongoing training, updated forensic tools, and the technical capacity to examine increasingly sophisticated manipulated content. The legal process and investigative capabilities must keep pace with these developments.
Another challenge is that digital content can be created, hosted, and circulated across different countries. Obtaining information from platforms operating outside India may involve complex procedures and delays, including through mutual legal assistance mechanisms.
Existing laws, including the Information Technology Act, 2000, and the Bharatiya Nyaya Sanhita, 2023, contain provisions that may apply to offences involving the misuse of digital content. However, a more clearly defined framework dealing with synthetic media, labelling, platform accountability and timelines for responding to harmful content could strengthen the response. Continuous investment in cyber forensics, specialised training and coordination with platforms is also important.
Q: How important is the preservation and authentication of digital evidence in deepfake investigations, particularly when cases may go to court?
Gaurav Tyagi: Digital evidence must be handled carefully to ensure its authenticity and integrity. Investigators need to establish a file’s provenance, preserve the original material wherever possible, and maintain a proper chain of custody. Hash values can help show that a file has not been altered after collection.
Technical examination alone may not be sufficient. Investigators must also corroborate the evidence with other relevant material, and they may need cooperation from digital platforms and device manufacturers to establish the source and movement of content. Proper preservation, documentation, and authentication are essential to ensure that digital evidence can be reliably assessed during legal proceedings.
Q: What precautions should ordinary users take to avoid being misled by deepfakes or becoming unwitting distributors of fabricated content?
Gaurav Tyagi: The most important precaution is to pause before forwarding content, particularly when it is designed to provoke a strong emotional reaction or create a sense of urgency. People should check whether the information is being reported by credible news organisations and whether the account or source sharing it is authentic.
Users can also conduct reverse image or video searches to see whether the material has appeared earlier or in a different context. They should check the original source, date, and location; look for independent reporting; and watch for signs such as unnatural lip-syncing, unusual speech patterns, cropping, or missing context. It is also useful to look for an earlier or longer version of the same recording before drawing conclusions.
Verify unusual or urgent requests for money or sensitive information independently, preferably by contacting the person through a known phone number rather than replying to the message received. People should be cautious about extraordinary claims and avoid treating a video, image or audio clip as authentic simply because it appears convincing.
If someone encounters suspected online fraud, impersonation, or fabricated content used to commit a crime, they can report it through the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the cybercrime helpline 1930.
The central message is that visual or audio clues alone cannot establish whether content is genuine. Verification requires checking the source, context, and available evidence—and resisting the impulse to share material before you confirm its authenticity.
