AI Was Reportedly Used to Create a Nonconsensual Pornographic Video Depicting a Bhutanese Woman in New Zealand

A pornographic video with the face of a Bhutanese woman living in New Zealand superimposed using AI was reportedly posted online without her consent. She described embarrassment and psychological distress. After contacting police in Bhutan and New Zealand, she said she used StopNCII.org, a service for limiting nonconsensual intimate-image sharing, and could no longer find the video online.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involved the creation of humiliating sexual imagery (a deepfake pornographic video) targeting a specific victim, which fits the definition of targeted manipulation and humiliation under 4.3.

Additional risk subdomains

• 1.2 Exposure to toxic content: The AI was used to generate and upload explicit pornographic content onto the internet, exposing the victim and online users to toxic and non-consensual sexual content.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The harm was caused by a human actor who intentionally used a deployed AI deepfake tool to generate and distribute non-consensual pornographic content of the victim.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Risk Level 3. Limited Risk: The report describes the use of AI to generate deepfakes, which falls under the transparency obligations of Limited Risk systems.

AI system and alleged parties

• AI system: None named
• AI purpose: Deepfake Video Generation; Image Retouching
• Behaviour type: Tool
• Alleged developer: Synthetic media technology developers, Deepfake technology developers
• Alleged deployer: Synthetic media creators, Deepfake creators
• Alleged harmed parties: Women and girls, Women, Unnamed woman from Bhutan living in New Zealand, Privacy, People depicted in non-consensual intimate imagery

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Minor, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: The report explicitly describes toxic and malicious content created and spread directly by the incident.

Directly caused: An AI-generated deepfake video placing the victim's photo over pornographic material was created and uploaded to the internet.

Inferred additional harm: It is highly likely that multiple internet users were exposed to this explicit, non-consensual content before it was erased via stopncii.org.

Civil rights

Reported: The report explicitly describes violations of human and civil rights, specifically the victim's right to privacy and bodily autonomy through non-consensual sexual imagery.

Directly caused: The victim's image was used without consent to create pornographic material, violating her personal dignity and privacy rights.

Inferred additional harm: Other unnamed victims of deepfakes likely suffered similar violations of their civil rights and personal dignity.

Privacy

Reported: The report explicitly describes privacy violations caused directly by the incident.

Directly caused: A private photo of the Bhutanese woman was taken and used without her consent to generate a deepfake pornographic video, violating her personal privacy.

Psychological

Reported: The report explicitly describes psychological harm, noting that the deepfake video impacted the victim's mental health and caused her severe embarrassment.

Directly caused: The victim experienced mental health impacts and found the situation 'very embarrassing and hard' to open up about, affecting 1 person.

Inferred additional harm: It is likely that other victims of similar deepfakes (such as the 6 computer pornography cases mentioned) experienced similar psychological distress and trauma.

Epistemic

Reported: The report explicitly describes epistemic harm through the creation of a deepfake video designed to spread false information about the victim.

Directly caused: The AI-generated deepfake video falsely depicted the victim in pornographic material, creating a false representation of her actions.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 1

Potential causes

Management

• Lack of Centralized Coordination: No single agency coordinates responses to cross-border AI cybercrimes.
• No Dedicated Deepfake Tracking: Police do not maintain separate records specifically for deepfake incidents.

Technology

• AI Deepfake Generation Tools: AI tools used to overlay victim's face onto pornographic video.
• Lack of Platform Detection: Internet platforms failed to automatically detect and block deepfake content.

Data Inputs

• Unprotected Personal Photos: Victim's photo was harvested from social media to train/generate deepfake.

Human Factors

• Malicious Intent of Perpetrator: An individual chose to generate and upload non-consensual explicit content.
• Victim Hesitancy to Report: Embarrassment and social stigma delayed the victim from seeking help.
• Low Public AI Literacy: General lack of public awareness regarding deepfakes and digital safety.

Process and Methods

• Unclear Reporting Channels: Victim struggled to find the right agency to address the deepfake issue.
• Inadequate Police Response: Royal Bhutan Police lacked tools to help directly, referring to NZ police.
• Lack of Proactive Monitoring: BtCIRT focuses on hacking rather than actively monitoring content cases.

Regulatory Environment

• Jurisdictional Gaps: Cross-border challenges between Bhutan and New Zealand complicated enforcement.
• No Specific Deepfake Laws: Bhutanese law lacks specific categories for tracking deepfake crimes.
• Narrow Agency Mandates: BICMA handles only non-criminal content, leaving deepfakes to police.

Information quality

• Classification confidence: High
• Reason for confidence: The report clearly outlines the incident, the technology used (AI deepfake), the impact on the victim, and the actions taken. There is little ambiguity regarding the nature of the AI's involvement or the resulting harm.
• Ambiguities identified: The specific AI tool or platform used to generate the deepfake is not identified.

An AI-generated deepfake pornographic video targeted a Bhutanese citizen living in New Zealand, causing severe personal distress. The incident represents a minor national security concern focused on individual human rights and privacy violations, highlighting the cross-border enforcement challenges of established consumer-grade deepfake technology rather than systemic threats to state sovereignty or infrastructure.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: Bhutan
• Other affected: New Zealand
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The immediate threat to the victim was mitigated by content removal, leaving this as an ongoing societal capability concern rather than an active national crisis.
• Autonomy: Human-controlled. The AI tool was directly operated by a human perpetrator to generate the deepfake content with no autonomous decision-making by the system.
• Novelty: Established threat. Non-consensual deepfake pornography is an established threat type with numerous prior documented cases globally.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or kinetic threats were involved in this incident.
• Information security: Negligible. While involving a deepfake, this was a localized cyber-harassment case targeting an individual rather than a coordinated state-level information warfare or intelligence operation.
• Sovereignty: Negligible. The incident did not threaten state authority, elections, or core government functions, though it highlighted minor coordination challenges for Bhutanese cyber agencies.
• Economic security: Negligible. No strategic technologies, financial systems, supply chains, or national economic capabilities were compromised.
• Societal stability: Minor. The incident represents a direct violation of individual privacy and human rights through non-consensual deepfake pornography, but is limited in scale with minor national-level societal impact.