INTRODUCTION
Think about getting an urgent voice message from your aged parents requesting for financial aid following an accident – when in reality, they are safely sitting at home and never made any such request. Unfortunately, this is no figment of imagination because the very intimate human signals have been turned into weapons of mass destruction through artificial intelligence-based synthetic voice cloning technologies. With AI generating fake realities, the question of whether Indian law is equipped to tackle synthetic identity creation emerges.
Synthetic identity, on the other hand, involves the creation of an imaginary persona by combining factual and fake information. The difference between identity theft and synthetic identity fraud lies in the fact that while the former involves the outright use of another person’s identity, the latter involves constructing a new identity using bits and pieces of information. The problem here is that there may be no victim at all.
THE TECHNOLOGY: WHAT ARE WE DEALING WITH?
Three different types of technology lead to the creation of synthetic identity in modern times. First, voice cloning involves the use of a deep learning machine, fed audio samples, even as few as three seconds, which generates voices undistinguishable from the original voice. Second, AI-created humans (deepfake imagery and videos) involve the generation of fake faces or superimposition of faces of one person over another’s body. Third, synthetic digital persons involve scraping personal information and using AI-generated images and videos to make false identities, which are capable of passing through all security protocols, including KYC processes and building up a history.
The list of damages caused by the above-mentioned technologies is diverse. In terms of economic fraud through false identities, the global economy loses billions each year. In case of non-consensual deepfakes of intimate nature, there is damage to a person’s reputation. The use of cloned voices helps perpetrate fraud among the elderly people. False political identities distort democratic discussions and processes. In the case of all the above-mentioned crimes, the law takes a different approach, and herein lies the Indian dilemma.
WHAT THE EXISTING LAW COVERS — AND WHERE IT FAILS
However, the law presently deals with pieces of this issue in several dispersed provisions. Section 66C of the Information Technology Act, 2000[1] criminalizes identity theft – using someone else’s electronic signature, password, or unique identification feature. Section 66D[2] criminalizes cheating by personation by means of a computer resource. The Indian Penal Code, 1860 criminalizes cheating by personation under section 416 and fraud under section 420.[3]
On the other hand, the Digital Personal Data Protection Act, 2023 (DPDPA)[4] which is a civil code that runs parallel to the penal code, defines personal data in wide terms to include biometric and inferred data, and requires consent in processing such data. However, the DPDPA framework only penalizes financial penalties against data fiduciaries and not bad actors using AI as an instrumentality.
These loopholes are inherent in the system. First, the identity theft provisions in IT Act require evidence of use of existing electronic credential fraudulently; the upstream offence of fabrication of synthetic identities will fall outside the scope of Section 66C itself. A scammer who invents an artificial personality using AI and who has not appropriated anyone’s individual electronic credentials may thus escape legal consequences altogether. Secondly, personation under section 416 IPC requires impersonation of an identified person. Synthetic personalities who impersonate nobody will thus be out of bounds. Thirdly, voice cloning that amounts to cheating under section 420 IPC would be actionable; but voice cloning simply done with intent to harass or to cause damage which is non-financial is immune from prosecution under this provision. Lastly, while deepfakes are in part caught by provisions of copyright and moral rights of the performers, the 1957 Copyright Act[5] recognizes moral rights only of authors – not persons who have been impersonated through deepfake technology.
THE CONSTITUTIONAL DIMENSION: PRIVACY, DIGNITY, AND IDENTITY
It was in the landmark case of Justice K.S. Puttaswamy v Union of India[6] that informational privacy, meaning the right to control one’s personal data and biometric identity, was unanimously declared a fundamental right guaranteed by Article 21 of the Indian Constitution.[7] The creation of artificial identity by, for example, creating a clone voice or AI clone of someone else’s voice without their consent violates this right.
Dignity too is another crucial facet here. One’s voice, face, and personality cannot simply be regarded as data or information; they are part of what makes up a person’s existence. The artificial creation of such a clone without any consent violates the human dignity guaranteed by Articles 19 and 21 of the constitution.[8] Existing criminal laws, which are not equipped to deal with the age of artificial intelligence, do not suffice in achieving this objective.
COMPARATIVE FRAMEWORKS: WHAT CAN INDIA LEARN?
Other regions, however, seem to be proceeding more rapidly on this front. The EU’s Artificial Intelligence Act, 2024[9] bans real-time remote biometric identification and the use of manipulative AI tools, while also requiring disclosure of AI-generated material. In the U.S., the NO FAKES Act, 2023[10] seeks to create a federal law prohibiting the use of someone’s voice or likeness in AI-generated material without their consent.
The Indian Telecommunications Act of 2023[11] deals with specific forms of signal-level fraud such as SIM-based impersonation but doesn’t consider AI-based impersonations. This highlights the need for a horizontal framework dealing with financial fraud, privacy violations, and reputation damage at the same time.
TOWARDS A CRIMINALIZATION FRAMEWORK FOR INDIA
Four distinct considerations should at the very minimum inform the criminalization architecture for synthetic identity generation in India:
First, there needs to be a provision on the creation itself of the synthetic identity as a crime independent of the fraud and deception caused by it. Creation itself with an intention to deceive, defraud, and cause reputational damage would plug the loophole in the 66C IT Act.[12]
Second, there should be a criminal provision on the cloning of voiceprints and faces of individuals without their consent even when no financial fraud arises from it. Such non-consensual use is harmful in itself, independent of any downstream consequences.
Third, platform liability needs to be considered in this context. Intermediaries using AI-based tools that generate synthetic identities without proper controls and safeguards can incur liability under section 79 of the IT Act[13] and also criminal liability if the case warrants such action.
Fourth, an overlay of financial intelligence is a necessity in this context. It is well known that synthetic identities are often used for creating bank accounts, laundering money, and accessing financial services and credit facilities. Criminalizing synthetic identity generation should have a linkage with crimes under PMLA, 2002.[14]
CONCLUSION
Creating a synthetic identity occurs at the junction of technology, identity, dignity, and crime, yet there is no corresponding legislation in place to deal with this issue in India. There exists a haphazard array of provisions under the IT Act, IPC offenses related to cheating, and the penalties provided for breach of the DPDPA but they cover only the periphery of the issue, rather than its core. In an era where artificial intelligence created voices and identities are used extensively for harassment and deceit, it is necessary for India to enact a standalone legislative measure on the lines of the Constitutionally mandated rights to privacy and dignity.
The debate should not be whether India is capable of regulating this issue using its current legislation because, to some extent, it does; rather, the debate is whether India should enact laws that address the issue comprehensively and proactively. Clearly, the answer is yes.
Author(s) Name: Priyanka Ratha (Vikash Law School, Bargarh)
References:
[1] Information Technology Act 2000, s 66C
[2] Ibid s 66D
[3] Indian Penal Code 1860, ss 416, 420
[4] Digital Personal Data Protection Act 2023
[5] Copyright Act 1957
[6] Justice K S Puttaswamy (Retd) and Anr v Union of India and Ors (2017) 10 SCC 1
[7] Constitution of India 1950, art 21
[8] Ibid arts 19 and 21
[9] EU Artificial Intelligence Act 2024
[10] NO FAKES Act 2023 (US)
[11] Telecommunications Act 2023
[12] Information Technology Act 2000, s 66C
[13] Ibid s 79
[14] Prevention of Money Laundering Act 2002