Lower Saxony CDU Employee Allegedly Shared Sexualized Purported Deepfake of Colleague in Internal WhatsApp Group

A senior employee of the CDU parliamentary faction in Lower Saxony allegedly posted a purportedly AI-generated sexualized deepfake of a female colleague in an internal WhatsApp group. Prosecutors later said the video appeared to be an AI montage created by inserting a real image of the woman into a bikini-dance clip. The employee was reportedly later dismissed.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves the targeted creation of humiliating and sexualized synthetic imagery of a specific victim for personal harassment, which fits the boundary rule for targeted manipulation.

Additional risk subdomains

• 1.2 Exposure to toxic content: The creation and sharing of a sexualized deepfake video exposed coworkers in a group chat to toxic and inappropriate content.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by a human employee who intentionally used a deployed AI tool to create and distribute a sexualized deepfake of a colleague.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes the creation of a deepfake, which falls under Risk Level 3 due to transparency and disclosure obligations for AI-generated content.

AI system and alleged parties

• AI system: None named
• AI purpose: Deepfake Video Generation; Image Retouching
• Behaviour type: Tool
• Alleged developer: Unknown deepfake technology developers
• Alleged deployer: CDU Parliamentary Group in the Lower Saxony State Parliament, CDU-Fraktion im Niedersächsischen Landtag
• Alleged harmed parties: Women employees of the CDU Parliamentary Group in the Lower Saxony State Parliament, Women employees of CDU-Fraktion im Niedersächsischen Landtag, Women, Epistemic integrity

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Minor, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: The report explicitly describes the creation and sharing of a sexualized deepfake video.

Directly caused: An AI-generated video depicting a female colleague dancing in a bikini was shared in a private WhatsApp group.

Differential treatment

Reported: The report mentions a zero-tolerance policy for misogynistic thinking and behavior, indicating gender-based harassment.

Directly caused: The female employee was targeted with sexualized harassment, representing gender-based differential treatment in the workplace.

Privacy

Reported: The report describes the unauthorized use of a real photo of the victim to generate the deepfake.

Directly caused: A real photo of the female employee was used without her consent to generate a sexualized deepfake.

Psychological

Reported: The report describes the incident as shocking and causing consternation, implying distress for the victim.

Directly caused: The female colleague suffered distress and humiliation from being depicted in a sexualized deepfake shared among her coworkers.

Inferred additional harm: The victim likely suffered significant ongoing psychological distress, anxiety, and professional disruption due to the targeted sexual harassment.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 5

Potential causes

Management

• Lack of AI Risk Assessment: Management failed to assess risks associated with consumer AI tool access.
• Inadequate Prevention Training: No training was provided to staff regarding digital harassment and deepfakes.

Technology

• Accessible Deepfake Software: AI tools allow easy creation of realistic sexualized face-swaps.
• Realistic AI Synthesis: Advanced AI models seamlessly blend real photos into synthetic video.

Data Inputs

• Unauthorized Photo Use: A real photo of the victim was used without consent to feed the AI.

Human Factors

• Malicious Intent of Creator: Employee intentionally generated sexualized content to harass a colleague.
• Lack of Ethical Awareness: Users fail to realize the ethical and legal impact of generating deepfakes.

Process and Methods

• No Internal AI Policies: The organization lacked guidelines on acceptable use of AI technologies.
• Delayed Incident Detection: The deepfake was shared in private chats, delaying management awareness.

Regulatory Environment

• Inadequate Deepfake Laws: Current laws struggle to address non-consensual AI-generated sexual content.
• Complaint-Based Prosecution: Legal action requires a formal complaint, slowing down state prosecution.

Information quality

• Classification confidence: High
• Reason for confidence: The report provides clear, detailed information about the incident, including the actions taken by the political party and the statements from the public prosecutor. The facts regarding the creation and distribution of the deepfake are unambiguous.
• Ambiguities identified: The specific AI software used to create the deepfake is not identified.
• Alternative interpretations: None, the incident is clearly a case of targeted workplace harassment using generative AI.

A localized incident involving a German political faction employee who created and shared a non-consensual sexualized deepfake of a colleague. While a serious case of workplace harassment and violation of personal rights, it has negligible national security implications.

• Overall national security impact: Negligible
• Scope: Single nation
• Primary target: Germany
• Alleged perpetrator: CDU parliamentary faction employee

Threat characteristics

• Imminence: Long-term. The active workplace incident has been addressed via dismissal, representing a long-term societal trend rather than an active national security crisis.
• Autonomy: Human-controlled. The AI system acted as a tool directly controlled and operated by a human user to generate specific synthetic media.
• Novelty: Established threat. Non-consensual sexualized deepfakes are a well-documented and established abuse of generative AI technology.

Impact by dimension

• Physical security: Negligible. The incident is a localized workplace harassment case with no physical security or critical infrastructure implications.
• Information security: Negligible. The deepfake was shared in a private internal chat for personal harassment, not as a systematic external disinformation campaign or intelligence operation.
• Sovereignty: Negligible. Localized political party scandal that did not disrupt core government operations, electoral systems, or state authority.
• Economic security: Negligible. No impact on financial systems, strategic industries, or national technological competitive advantage.
• Societal stability: Negligible. While a serious violation of individual personal rights and workplace safety, the localized incident does not threaten broader societal stability.