Two 16-Year-Old Students in Athens, Greece Allegedly Generated Nonconsensual Deepfake Pornography of Their Classmates

In Athens, Greece, two 16-year-old students were arrested for allegedly generated nonconsensual deepfake pornography of their classmates. They reportedly used images taken from social media to create the explicit images, which they are then reported to have disseminated online to others. The parents of the students were reportedly also arrested for neglecting to supervise their behavior.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The suspects used AI tools to create humiliating sexual imagery of specific classmates for targeted harassment and humiliation.

Additional risk subdomains

• 1.2 Exposure to toxic content: The incident involved the creation and online distribution of sexually explicit synthetic imagery depicting minors.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by the intentional actions of two teenagers who used post-deployment AI tools to generate and distribute nonconsensual deepfake nude images of their classmates.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes the creation of 'AI-generated deepfake nude images', which falls under Risk Level 3 as it involves AI-generated content such as deepfakes.

AI system and alleged parties

• AI system: artificial intelligence tools
• AI purpose: Deepfake Image Generation; Image Retouching
• Behaviour type: Tool
• Alleged developer: Unknown deepfake technology developers
• Alleged deployer: Two unnamed 16-year-old students in Athens
• Alleged harmed parties: Students at a high school in Athens, Families of students at a high school in Athens

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Substantial, indirect Negligible

Malicious content

Reported: The report explicitly describes the creation and sharing of toxic content in the form of AI-generated deepfake nude images.

Directly caused: Two 16-year-old suspects used AI tools to alter photos of their classmates to make them appear naked or semi-naked and shared them online.

Inferred additional harm: The shared explicit images may have been further distributed or archived by other online users, expanding the reach of the toxic content.

Privacy

Reported: The report explicitly describes that the suspects downloaded photos of classmates from social networking platforms without their consent.

Directly caused: The suspects obtained photos of their classmates from social media without consent to generate deepfake nude images.

Inferred additional harm: The victims' privacy was severely violated by having their public likenesses harvested and transformed into nonconsensual sexual imagery.

Child sexual exploitation and abuse

Reported: The report describes the creation and sharing of AI-generated deepfake nude images of 'schoolchildren' who are classmates of the 16-year-old suspects, implying they are minors.

Directly caused: Two 16-year-olds created and shared semi-naked or naked deepfake images of their minor classmates.

Inferred additional harm: The generation of sexually explicit synthetic imagery of minors constitutes a form of child sexual exploitation and abuse, which likely caused severe long-term harm to the victims.

People affected

• Occurrences reported: 1
• People reportedly harmed: 2
• People reportedly exposed: 2

Potential causes

Technology

• Accessible Deepfake AI Tools: AI tools allowed easy alteration of photos to appear naked or semi-naked.

Data Inputs

• Unconsented Social Media Photos: Classmates' photos were downloaded from social media without their consent.

Human Factors

• Deliberate Misuse by Teenagers: Two 16-year-olds chose to create and share harmful deepfakes of classmates.
• Lack of Parental Supervision: Parents failed to adequately supervise the teenagers' online activities.

Process and Methods

• Easy Photo Downloading: Social media platforms allowed easy downloading of user photos by third parties.
• Lack of AI Generation Safeguards: AI tools did not block the creation of non-consensual explicit images.

Regulatory Environment

• Delayed Detection of Sharing: The sharing of deepfakes was only addressed after it became publicly known.

Information quality

• Classification confidence: High
• Reason for confidence: The report clearly outlines the nature of the incident, the actors involved (two 16-year-olds), the victims (classmates), the technology used (AI deepfake tools), and the legal consequences (arrests). There is little ambiguity regarding the sequence of events.
• Ambiguities identified: The specific AI tools or platforms used to generate the deepfakes are not identified.

Two teenagers in Greece used AI tools to generate and distribute nonconsensual deepfake nude images of their classmates. While the incident represents a serious violation of privacy and local law, it does not pose a threat to national security, critical infrastructure, or state sovereignty, and was resolved through standard law enforcement procedures.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Greece
• Alleged perpetrator: Two 16-year-old students

Threat characteristics

• Imminence: Long-term. The immediate local crisis is resolved with arrests, representing an ongoing societal trend rather than an active national security crisis.
• Autonomy: Human-controlled. The AI tools were directly operated by human users who selected the target images and initiated the generation process.
• Novelty: Established threat. The creation of nonconsensual deepfake imagery using publicly available AI tools is a well-documented and established threat vector.

Impact by dimension

• Physical security: Negligible. The incident did not involve any threats to physical systems, critical infrastructure, or kinetic operations.
• Information security: Negligible. No intelligence compromise, state-sponsored disinformation, or mass surveillance capabilities were involved in this localized incident.
• Sovereignty: Negligible. The incident had no impact on state authority, border control, or core government operations.
• Economic security: Negligible. No strategic technologies, financial systems, or national economic interests were targeted or compromised.
• Societal stability: Minor. The incident represents a severe privacy violation and harassment of minors, but its impact is localized and manageable within standard law enforcement procedures.