Gold Coast Man Reportedly Ordered to Pay $343,500 After Posting Purported Deepfake Pornographic Images of Australian Public Figures

In a first-of-its-kind case under Australia's Online Safety Act, the Federal Court ordered Anthony Rotondo to pay $343,500 plus costs for creating and sharing non-consensual deepfake pornographic images of prominent Australian women on MrDeepFakes.com. After reportedly receiving a removal notice in 2023, Rotondo defied authorities, emailed the images to dozens of recipients, and was later found in contempt. The images were reportedly taken down after he provided account access to investigators.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The perpetrator used AI deepfake tools to create non-consensual sexually explicit and humiliating imagery targeting specific prominent women, students, and teachers.

Additional risk subdomains

• 1.2 Exposure to toxic content: The distribution of explicit deepfake pornographic images to 50 email addresses and online platforms exposed recipients to toxic and abusive content.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by a human user intentionally using deepfake generation tools post-deployment to create and distribute non-consensual explicit images.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes the creation of AI-generated content such as deepfakes, which falls under Risk Level 3 (Limited Risk) due to transparency obligations.

AI system and alleged parties

• AI system: None named
• AI purpose: Deepfake Image Generation; Image Generation
• Behaviour type: Tool
• Alleged developer: Unknown deepfake technology developers
• Alleged deployer: MrDeepFakes.com, Anthony Rotondo
• Alleged harmed parties: Women, Prominent Australian women, General public of Australia, General public, Epistemic integrity

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Minor, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Substantial, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Minor, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Substantial, indirect Substantial

Financial

Reported: The report describes a court-ordered penalty of $343,500 plus costs imposed on the perpetrator.

Directly caused: The perpetrator suffered a direct financial penalty of $343,500 plus court costs.

Inferred additional harm: The victims may have incurred legal costs or loss of income due to reputational damage, though this is not quantified.

Malicious content

Reported: The report explicitly describes the creation and distribution of non-consensual pornographic deepfake images.

Directly caused: Non-consensual pornographic deepfake images of prominent Australian women, students, and teachers were created and posted on MrDeepFakes.com and emailed to 50 addresses.

Inferred additional harm: Additional toxic content may have been generated or propagated by other users downloading and resharing these deepfakes before the site was shut down.

Civil rights

Reported: The report explicitly describes violations of human and civil rights through image-based abuse and breaches of the Online Safety Act.

Directly caused: The victims' rights to privacy, dignity, and safety from online abuse were violated by the non-consensual creation of explicit imagery.

Privacy

Reported: The report explicitly describes privacy violations through the non-consensual creation and sharing of explicit images.

Directly caused: The personal likenesses of prominent women, students, and teachers were violated through non-consensual explicit deepfakes.

Psychological

Reported: The report explicitly describes psychological and emotional distress caused to the victims of the deepfake image-based abuse.

Directly caused: The targeted prominent women, students, and teachers experienced psychological and emotional distress due to the non-consensual creation and sharing of explicit deepfakes.

Inferred additional harm: It is highly likely that the victims suffered long-term psychological trauma, anxiety, and reputational distress, though the exact number of affected individuals is not fully quantified.

Child sexual exploitation and abuse

Reported: The report explicitly describes a CSEA-related incident involving deepfake images of school students and a warning to a UK company.

Directly caused: Deepfake images of students and teachers were sent to a Brisbane school, potentially exploiting minors.

Indirectly caused: A UK-based technology company was issued a formal warning for enabling the creation of child sexual exploitation material.

Inferred additional harm: It is likely that minors at the Brisbane school suffered sexual exploitation and abuse via these deepfakes, though the exact number of children affected is not specified.

People affected

• Occurrences reported: 2
• People reportedly harmed: 15
• People reportedly exposed: 65

Potential causes

Technology

• Deepfake Generation Tools: AI tools enabled the creation of realistic non-consensual explicit images.

Data Inputs

• Victim Source Images: Existing images of prominent women were used to generate the deepfakes.

Human Factors

• Defiance of Authority: The perpetrator ignored eSafety notices and sent images to 50 addresses.
• Malicious Intent: The perpetrator deliberately sought to harass and cause distress to victims.

Process and Methods

• Ineffective Content Containment: Processes failed to prevent the perpetrator from emailing copies of images.

Regulatory Environment

• Jurisdictional Gaps: Perpetrator claimed immunity due to residing outside Australia.

Information quality

• Classification confidence: High
• Reason for confidence: The report provides clear details about the legal actions, the perpetrator's actions, and the nature of the deepfakes. The roles of the eSafety Commissioner and the Federal Court are well-documented.
• Ambiguities identified: The specific AI tools used to generate the deepfakes are not named, and the exact number of victims is not specified.
• Alternative interpretations: None. The incident is clearly a case of non-consensual deepfake creation and distribution.

An Australian court fined an individual $343,500 for creating and distributing non-consensual explicit deepfakes of prominent women, students, and teachers. The incident highlights the growing threat of AI-enabled image abuse to societal stability and individual human rights, while demonstrating increasing regulatory and legal enforcement capabilities against such offenses.

• Overall national security impact: Substantial
• Scope: Single nation
• Primary target: Australia
• Other affected: United Kingdom
• Alleged perpetrator: Antonio Rotondo

Threat characteristics

• Imminence: Long-term. The perpetrator has been apprehended and fined, making this an ongoing strategic and regulatory concern rather than an active, immediate crisis.
• Autonomy: Human-controlled. The AI system was used strictly as a tool by a human actor to generate synthetic images, with no autonomous decision-making.
• Novelty: Established threat. Non-consensual deepfake pornography and image-based abuse are well-established threats, though the scale of the fine represents a significant legal precedent.

Impact by dimension

• Physical security: Negligible. No physical systems, infrastructure, or human safety threats were reported in connection with this incident.
• Information security: Minor. Involves targeted deepfake creation of prominent women and distribution to media outlets, but lacks the scale or backing of a state-sponsored disinformation campaign.
• Sovereignty: Negligible. No core government operations, electoral systems, or sovereign decision-making processes were compromised, despite initial disregard for regulatory authority.
• Economic security: Negligible. No strategic technology theft, financial system manipulation, or critical supply chain vulnerabilities were identified.
• Societal stability: Substantial. Significant violation of privacy and human rights through non-consensual pornographic deepfakes targeting prominent women, teachers, and school students, causing severe emotional distress.