Purported Deepfake Allegedly Misattributes Claims to Former Student in Attack on Vice-Presidential Candidate Tim Walz

A purported viral deepfake accused Democratic vice-presidential nominee Tim Walz of misconduct by using the stolen identity of former student Matthew Metro. Circulated on X and other platforms, the video reportedly reached millions before being flagged for manipulation. U.S. intelligence later revealed it and three other similar events were part of the Russian disinformation campaign Storm-1516, whose aim is to disrupt the 2024 elections.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.1 Disinformation, surveillance, and influence at scale

The incident involves a coordinated, state-aligned foreign influence campaign using fabricated media to manipulate public opinion and political processes at scale.

Additional risk subdomains

• 4.3 Fraud, scams, and targeted manipulation: The perpetrators stole and exploited the real-world identity of Matthew Metro, impersonating him to bring false accusations against a public figure.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was driven by human actors (Russian state-backed trolls) who intentionally created and spread manipulated media to interfere in the U.S. election.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes the use of AI to generate deepfakes and manipulated media, which falls under Risk Level 3 due to transparency obligations for AI-generated content.

AI system and alleged parties

• AI system: None named
• AI purpose: Deepfake Video Generation; Voice Generation
• Behaviour type: Tool
• Alleged developer: Unknown deepfake technology developers
• Alleged deployer: Anonymous X user
• Alleged harmed parties: Tim Walz, Matthew Metro

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Minor, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Substantial, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: The report explicitly describes the creation and spread of toxic, fabricated allegations of sexual abuse.

Directly caused: The Russian-aligned network Storm-1516 created and spread a fabricated video containing salacious and toxic allegations of sexual abuse against Tim Walz, which gained over 5 million views on X.

Democracy

Reported: The report explicitly describes foreign interference efforts aimed at undermining democratic processes and eroding trust in elections.

Directly caused: Russian influence operations targeted the 2024 U.S. presidential election by fabricating and amplifying content to divide the electorate and reduce confidence in democratic systems.

Privacy

Reported: The report explicitly describes privacy violations resulting from identity theft.

Directly caused: Matthew Metro's public identity, including his name, high school history, and yearbook photo, was stolen and used in the fabricated video without his consent.

Psychological

Reported: The report explicitly describes psychological distress experienced by Matthew Metro due to his identity being stolen and associated with false sexual assault allegations.

Directly caused: Matthew Metro reported feeling irate, angry, and distressed, describing the incident as 'an invasion of my privacy and my personal life' that would forever associate his name with the false allegations online.

Inferred additional harm: It is highly likely that Tim Walz and his family experienced significant emotional distress and reputational anxiety due to the rapid, viral spread of these salacious allegations.

Epistemic

Reported: The report explicitly describes epistemic harm through the creation and viral spread of fabricated videos and emails.

Directly caused: The incident involved the creation of a fabricated video and fake emails alleging sexual assault, which misled millions of social media users before being debunked.

Inferred additional harm: The widespread dissemination of such realistic fakes contributes to a general erosion of trust in digital media and shared reality.

People affected

• Occurrences reported: 1
• People reportedly harmed: 2
• People reportedly exposed: 5000000

Potential causes

Management

• Reduced Moderation Investment: Social media firms cut funding for trust and safety operations.
• Prioritization of Viral Engagement: Platform algorithms prioritized sensational, highly engaging content.
• Inadequate Risk Assessments: Platforms failed to prevent foreign state-sponsored influence campaigns.

Technology

• AI Deepfake Video Generation: Russian actors used AI to create a fake video smearing Tim Walz.
• Audio Manipulation Tools: AI tools transformed voice pitch and tone to mimic a real student.
• AI-Generated Fake News Sites: Networks used AI to auto-generate articles on spoofed news outlets.

Data Inputs

• Open-Source Identity Harvesting: Public profiles were scraped to steal Matthew Metro's biographical data.
• Inconsistent Metadata in Emails: Manipulated email screenshots contained formatting and timestamp errors.
• Fake Media Verification Inputs: Forged documents like certificates and visas were used as source inputs.

Human Factors

• Influencer Amplification: Right-wing influencers shared the video without verifying its authenticity.
• Voter Susceptibility to Disinfo: Electorate polarization made users eager to believe damaging rumors.
• Identity Theft Exploitation: The victim's real-life details were exploited to build false credibility.

Process and Methods

• Inadequate Content Moderation: Social media platforms failed to quickly remove or flag the fake video.
• Narrative Laundering Campaigns: Storm-1516 systematically laundered false claims through fake whistleblowers.
• Delayed Platform Response Times: Slow response let the video gain over five million views in 24 hours.

Regulatory Environment

• Lack of Deepfake Regulations: Absence of strong federal AI laws allowed unchecked deepfake distribution.
• Platform Immunity Protections: Constitutional free speech and legal protections shield host platforms.
• Jurisdictional Enforcement Limits: US authorities could not easily prosecute actors residing in Moscow.

Information quality

• Classification confidence: High
• Reason for confidence: There is high consensus among U.S. intelligence, Microsoft, independent researchers, and journalists that the video was a fabricated smear campaign orchestrated by the Russian group Storm-1516. While there is some technical debate among experts on whether the video is a generative AI deepfake or a cheapfake impersonation with audio manipulation, the overall context of the disinformation campaign and its impact are well-documented.
• Ambiguities identified: There is some technical ambiguity among forensic experts regarding whether the video was a true generative AI deepfake or a 'cheap fake' involving a real actor with compressed video and manipulated audio.
• Alternative interpretations: Some might interpret the video as a simple human impersonation (cheap fake) rather than an AI safety incident, though multiple sources and detectors flagged AI involvement in the audio or video generation.

A Russian-aligned propaganda network (Storm-1516) conducted a coordinated disinformation campaign targeting the 2024 US presidential election by distributing a fabricated video smearing vice-presidential nominee Tim Walz. The incident represents a notable foreign influence operation using AI-manipulated media to undermine democratic processes and target political leadership.

• Overall national security impact: Substantial
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Storm-1516 (Russian-aligned propaganda network)

Threat characteristics

• Imminence: Near-term. The campaign targeted an active election cycle, requiring rapid response and monitoring by intelligence and security agencies.
• Autonomy: Human-controlled. AI tools were used as passive instruments by human operators to generate and edit deceptive media, acting strictly on direct inputs.
• Novelty: Established threat. The use of fabricated media and deepfakes for foreign political disinformation campaigns is an established threat vector.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or kinetic targets were affected or threatened in this incident.
• Information security: Substantial. Coordinated Russian state-sponsored information operation using fabricated media to smear a US vice-presidential candidate, confirmed by US intelligence agencies.
• Sovereignty: Substantial. Foreign election interference campaign targeting the 2024 US presidential election, aimed at manipulating public opinion and undermining democratic processes.
• Economic security: Negligible. No direct threat to economic stability, financial systems, or strategic technological assets identified.
• Societal stability: Minor. Caused direct psychological distress and privacy violation to a private citizen whose identity was stolen, and threatened public trust in digital media.