A recent video of what appeared to be Tom Cruise appeared on TikTok and immediately made headlines—not because of who the video starred, but rather because of who it did not star. The video portrayed an actor who, with the help of machine-learning, appeared and sounded strikingly similar to Tom Cruise. Daniel Victor, Your Loved Ones, and Eerie Tom Cruise Videos, Reanimate Unease with Deepfakes, New York Times (March 18, 2021).
The Tom Cruise video is what is known as a "deepfake," a term coined by a Reddit user to describe increasingly realistic video imitations that are made using machine learning algorithms and available media. Aja Romano, Jordan Peele's Simulated Obama PSA Is a Double-Edged Warning Against Fake News, Vox (April 18, 2018); see also Peter Brown, Three Cheerleaders Victimized by Deepfake Videos, N.Y.L.J. (March 22, 2021). Though deepfakes are not new, their realism is improving exponentially. With improved realism comes the inability of viewers to distinguish fact from fiction. As the line between reality and fiction grows blurrier by the day, it is only a matter of time before viewers act on information provided through a deepfake to their detriment. And, where corporations are involved—even if they were the subject of the misinformation—viewers may look to the corporation to make them whole for any financial injuries. Thus, for corporations seeking to reduce cyber risk and protect their bottom line, the question of whether insurance will respond to such fact patterns is not something that should be deferred to the future. The artificial synthesis of video has the potential to wreak great havoc on individuals, business, and society. Businesses need to be prepared for this disruption and consider whether insurance assets will respond.
Risk of Deepfakes: From Pornography to Politics to the Boardroom
Deepfakes gained notoriety in the same space that many new technologies have—pornography. Rob Toews, Deepfakes Are Going To Wreak Havoc on Society. We Are Not Prepared, Forbes (May 25, 2020). Deepfakes then moved from pornography to politics. For example, in 2019, a 2016 sketch of Jimmy Fallon portraying then-candidate Donald Trump pretending to brag about a recent primary win to Barack Obama, played by actor Dion Flynn, was manipulated with machine-learning to appear as though it depicted the real Donald Trump and Barack Obama. Simon Parkin, The rise of the deepfake and the threat to democracy, The Guardian (June 2, 2019). Also in 2019, a digitally altered video of Nancy Pelosi appearing to slur drunkenly through a speech was widely shared on social media. Id. Though the video was quickly debunked as a fake, former President Trump posted the clip of his political rival on Twitter with the caption: "PELOSI STAMMERS THROUGH NEWS CONFERENCE." Id.
Deepfakes have spread to the business world as well. In one well-known example that may be a harbinger of things to come, cyber criminals impersonated a business executive's voice using AI software and demanded a fraudulent transfer of $243,000. Social Engineering: Blurring reality and fake: A guide for the insurance professional, CyberCube (last visited April 7, 2021). Deepfake videos have also been used to make public statements on behalf of notable executives, such as when a deepfake of Mark Zuckerberg showed him purportedly admitting that Facebook's true goal was to manipulate and exploit users. Toews, supra. Now that deepfakes can be created with much more ease than in the past (and will only be easier and cheaper to make as technology improves), almost anyone—from rival companies to disgruntled employees—can wreak havoc with a few clicks. Thus, it is only a matter of time until we see deepfakes of executives making statements that negatively affect a company's stock price and deepfakes being used to infiltrate a company's network to steal money or intellectual property.
Deepfakes in the Insurance Context
Insurance coverage for deepfakes is in its nascent stages. According to a 2020 report prepared by Marsh, deepfakes "are outpacing the law" and insurers are assessing the potential risks of the new threats to businesses posed by deepfakes. Digital Deception: Is Your Business Ready for "Deepfakes"?, Marsh (last visited April 13, 2021).
The business risks posed by deepfakes span reputational damage, lost revenues, business interruption, extra expenses, and drops in share prices. For example, cybercriminals can infiltrate a company's network to conduct reconnaissance and then leverage that information with a voice deepfake of an executive to fraudulently authorize a large transfer of money from the company to the criminals' accounts. From an insurance standpoint, this type of loss may be covered by a number of insurance policies including cyber or crime, depending on the policy language.
Similar to the Mark Zuckerberg deepfake, hackers, competitors, or other bad actors will be able to publish convincing deepfakes of corporate executives making statements or engaging in activities that are potentially injurious to the company's reputation and may cause a decline in revenues, share prices, or both. The technology already exists to broadcast a deepfake of Elon Musk stating that he has surreptitiously programmed the cameras in Tesla's cars to record images and send the images to the U.S. government, when, in fact, the opposite is true. Michelle Toh, Elon Musk responds to spying concerns in China: Trust us, we're just like TikTok, CNN Business (March 22, 2021). Such a statement would undoubtedly damage Tesla's reputation and Tesla's share price and could conceivably lead to a shareholder derivative lawsuit and other types of lawsuits. In this instance, various insurance coverages, including cyber, D&O, and E&O could provide be responsive to such losses and liability. Further, crisis management, a coverage provided in some policies, could also assist in containing the reputational fallout from such an event.
A key issue with insurance coverage for deepfakes will be the trigger of coverage. See Bethan Moorcraft, Cyber risk: What are deepfakes?, Ins. Bus. Am. (March 23, 2020). Of course, the unprecedented and evolving nature of deepfakes complicates hypothetical coverage queries, as the unique facts and policy language will undoubtedly vary for every loss scenario. Nevertheless, one thing is certain: Any company may be a target of deepfakes and the financial impact could be significant. As such, it is critically important to consider how insurance assets might be brought to bear in the event of losses and liabilities resulting from a deepfake.
Implications of 'G&G Oil'
Recently, the Indiana Supreme Court weighed in on a crime policy's coverage of a ransomware attack and bitcoin ransom payment. G&G Oil of Ind. v. Continental W. Ins. Co., 2021 WL 1034982 (Sup. Ct. Ind. 2021). There, the Indiana Supreme Court held that an Indiana trial court improperly granted an insurer's motion for summary judgment because fact issues existed as to whether the cyber criminals' intrusion into the insured's computer system were obtained by trickery, whether the loss was direct, and other issues about the application of the policy language to the facts. Id. While G&G Oil did not deal with deepfakes, it does illustrate that insurance coverage for emerging cyber threats and losses may be found beyond the bounds of a standalone cyber policy. Accordingly, insureds will want to consider all potential coverages in assessing the role that insurance might play in mitigating losses and liabilities arising from deepfakes.
Conclusion
In a Forbes magazine article on deepfakes, the author posited that: "Today we stand at an inflection point. In the months and years ahead, deepfakes threaten to grow from an Internet oddity to a widely destructive political and social force. Society needs to act now to prepare itself." Toews, supra.
As is the case with all technology-related risks, the best protection is an up-to-date security system that includes regular training to educate employees about cutting-edge schemes. However, as deepfake technology progresses, even the most security-conscious employee may fall prey to the deepfakes. Moreover, even with the best internal training measures, those external to a company—customers, vendors, and the general public—remain vulnerable to deepfakes.
Consequently, business executives, risk managers, in-house counsel, and the insurance industry must anticipate that losses and liabilities arising from deepfakes will increase in the coming years. It is prudent to be prepared to mitigate and respond to these new risks with preventative measures and insurance assets.
Peter A. Halprin is a partner, Jacquelyn M. Mohr is a senior managing associate, and Nicolas A. Pappas is an associate at Pasich LLP.