This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
An AI-generated deepfake pornographic video of a Bhutanese woman living in New Zealand was created and uploaded to the internet, causing her severe psychological distress before being removed.
A pornographic video with the face of a Bhutanese woman living in New Zealand superimposed using AI was reportedly posted online without her consent. She described embarrassment and psychological distress. After contacting police in Bhutan and New Zealand, she said she used StopNCII.org, a service for limiting nonconsensual intimate-image sharing, and could no longer find the video online.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Also classified as
The AI was used to generate and upload explicit pornographic content onto the internet, exposing the victim and online users to toxic and non-consensual sexual content.
The incident involved the creation of humiliating sexual imagery (a deepfake pornographic video) targeting a specific victim, which fits the definition of targeted manipulation and humiliation under 4.3.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The harm was caused by a human actor who intentionally used a deployed AI deepfake tool to generate and distribute non-consensual pornographic content of the victim.
Added categories peak at 2: Minor (Psychological Harm, Direct)
An AI-generated deepfake pornographic video targeted a Bhutanese citizen living in New Zealand, causing severe personal distress. The incident represents a minor national security concern focused on individual human rights and privacy violations, highlighting the cross-border enforcement challenges of established consumer-grade deepfake technology rather than systemic threats to state sovereignty or infrastructure.
The report describes deepfake technology as being used to place a photo over pornographic material. This represents a deterministic function operating on direct input without autonomous planning or context retention, characteristic of a Tool.
Risk Level 3. Limited Risk: The report describes the use of AI to generate deepfakes, which falls under the transparency obligations of Limited Risk systems.
The report explicitly states that an AI-generated deepfake video was created by placing a photo of the woman over pornographic material.
The report clearly outlines the incident, the technology used (AI deepfake), the impact on the victim, and the actions taken. There is little ambiguity regarding the nature of the AI's involvement or the resulting harm.
None
Technology
AI Deepfake Generation Tools
AI tools used to overlay victim's face onto pornographic video.
Lack of Platform Detection
Internet platforms failed to automatically detect and block deepfake content.
Data Inputs
Unprotected Personal Photos
Victim's photo was harvested from social media to train/generate deepfake.
Human Factors
Malicious Intent of Perpetrator
An individual chose to generate and upload non-consensual explicit content.
Victim Hesitancy to Report
Embarrassment and social stigma delayed the victim from seeking help.
Low Public AI Literacy
General lack of public awareness regarding deepfakes and digital safety.
Process and Methods
Unclear Reporting Channels
Victim struggled to find the right agency to address the deepfake issue.
Inadequate Police Response
Royal Bhutan Police lacked tools to help directly, referring to NZ police.
Lack of Proactive Monitoring
BtCIRT focuses on hacking rather than actively monitoring content cases.
Management
Lack of Centralized Coordination
No single agency coordinates responses to cross-border AI cybercrimes.
No Dedicated Deepfake Tracking
Police do not maintain separate records specifically for deepfake incidents.
Regulatory Environment
Jurisdictional Gaps
Cross-border challenges between Bhutan and New Zealand complicated enforcement.
No Specific Deepfake Laws
Bhutanese law lacks specific categories for tracking deepfake crimes.
Narrow Agency Mandates
BICMA handles only non-criminal content, leaving deepfakes to police.
