Glasgow Man Allegedly Used AI Tool to Create and Share Non-Consensual Deepfake Nude Images of Former Classmate

In February 2024, a Glasgow man, Callum Brooks, reportedly used an AI-powered image-alteration tool to create deepfake nude images of a woman he knew from school by modifying her publicly posted social media photos. He allegedly sent the fabricated intimate images to two friends without her consent. The woman was reportedly embarrassed and distressed after learning of the images. Brooks pled guilty in Glasgow Sheriff Court and was fined £335.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The perpetrator used AI to create humiliating and sexual deepfake imagery targeting a specific victim for personal amusement or social demonstration.

Additional risk subdomains

• 1.2 Exposure to toxic content: The incident involved the generation and distribution of non-consensual sexually explicit content (pornography) to third parties.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The harm was caused by the intentional decision and action of a human user to create and distribute non-consensual deepfake images using a deployed AI tool.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system is used to generate AI-altered content (deepfakes), which is subject to specific transparency and disclosure obligations under the EU AI Act.

AI system and alleged parties

• AI system: None named
• AI purpose: Deepfake Image Generation; Image Retouching
• Behaviour type: Tool
• Alleged developer: Unknown image generator developer, Unknown deepfake technology developers
• Alleged deployer: Callum Brooks
• Alleged harmed parties: Former classmate of Callum Brooks, Epistemic integrity

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The report explicitly describes privacy violations, resulting in a conviction for disclosing an intimate photograph without consent.

Directly caused: The victim's privacy was violated when her public social media photos were used to generate and distribute intimate, non-consensual naked images.

Psychological

Reported: The report explicitly describes psychological harm, noting that the victim felt immediately embarrassed and humiliated upon discovering the images.

Directly caused: One individual (the victim) suffered immediate embarrassment and humiliation when shown the non-consensual deepfake naked images of herself.

Inferred additional harm: It is highly likely that the victim experienced ongoing psychological distress, anxiety, and a sense of violated trust due to her intimate likeness being shared among former classmates.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 1

Potential causes

Management

• Weak Developer Safety Controls: Software creators failed to implement guardrails against generating nudity.

Technology

• Highly Realistic AI Image Generation: The software created lifelike intimate images from fully clothed photos.
• Accessibility of Deepfake Tools: Novel AI tools were easily obtained and operated by an untrained individual.

Data Inputs

• Publicly Available Social Media Photos: The perpetrator easily obtained source images from the victim's Instagram.
• Unprotected Personal Likeness: No technical barriers prevented downloading and manipulating personal photos.

Human Factors

• Desire to Show Off Technology: The perpetrator wanted to demonstrate the novel software's capabilities.
• Disregard for Personal Consent: The images were altered and shared without the victim's knowledge or consent.
• Peer Request and Social Pettiness: One friend requested the images, motivating the perpetrator's actions.

Process and Methods

• Lack of Software Input Safeguards: The tool lacked mechanisms to block editing of non-consenting individuals.
• Unmonitored Private Sharing: Images were shared directly with friends via private channels without detection.

Regulatory Environment

• Lagging Deepfake Legislation: Specific laws criminalizing deepfake creation were not yet fully implemented.
• Inadequate Legal Deterrents: The perpetrator only faced a small fine, showing weak legal deterrence.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from multiple reputable news outlets provide consistent, detailed accounts of the court case, the perpetrator's actions, the victim's reaction, and the legal outcome. There are no conflicting details regarding the core events.
• Ambiguities identified: The specific name of the AI software application used is not identified in the reports.
• Alternative interpretations: None. The facts of the case and the guilty plea leave no room for alternative interpretations.

A localized criminal incident in Glasgow involving the creation and distribution of non-consensual deepfake nude images of a former classmate. While constituting a serious violation of individual privacy and dignity, the incident was handled through local law enforcement and has negligible national security implications.

• Overall national security impact: Negligible
• Scope: Single nation
• Primary target: United Kingdom
• Alleged perpetrator: Individual

Threat characteristics

• Imminence: Long-term. The specific incident is resolved legally, representing an ongoing societal capability concern rather than an active national security crisis.
• Autonomy: Human-controlled. The perpetrator manually selected, uploaded, and manipulated the images using the AI application, representing full human control.
• Novelty: Established threat. The creation of non-consensual deepfake pornography is an established threat with numerous prior documented cases globally.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or human safety were threatened or impacted by this local, individual-level incident.
• Information security: Negligible. No state-sponsored information warfare, intelligence compromise, or systemic disinformation campaign occurred; this was a localized personal dispute.
• Sovereignty: Negligible. The incident had no impact on state authority, electoral systems, or government decision-making processes.
• Economic security: Negligible. The incident did not target or impact strategic industries, financial systems, or national technological competitiveness.
• Societal stability: Negligible. While a serious violation of individual privacy and dignity occurred, it was a localized crime with negligible impact on large-scale societal stability or national civil liberties.