#FactCheck: AI-generated image falsely linked to Japan mall blast after 7.1-magnitude earthquake
Executive Summary
An image is being widely circulated on social media with the claim that it shows the destruction caused by an explosion at a mall in Japan following a 7.1-magnitude earthquake in July 2026. The viral image shows a shopping complex in a severely damaged condition, allegedly after the incident. CyberPeace Research Wing’s research found that the viral image does not show damage caused by an explosion or earthquake at any mall in Japan. The visuals in the image do not match authentic photographs of the affected shopping complex. The research further revealed that the viral image was created using Artificial Intelligence (AI).
Claim
A social media post claims that the AEON Mall in Japan exploded after the Kumamoto earthquake and a gas leak was suspected. The post, published in Burmese language on Facebook on July 29, 2026, shared an image claiming to show the aftermath of the incident at the mall.
FactCheck
To verify the authenticity of the viral claim, we conducted a Google search using relevant keywords. During the search, we found a report published by France24, which stated that the Kumamoto disaster management office released updated figures following the earthquake. According to the report, seven bodies were recovered from the debris, steel and wires of the Aeon shopping mall after a suspected gas blast. The report further stated that eight people were confirmed dead at the Nippon Paper Industries factory in Yatsushiro city, where part of a red-and-white smokestack collapsed. Following the 7.1-magnitude earthquake, five others were reported to be in critical condition, while around 9,500 residents were staying in evacuation centres in Kyushu, southwestern Japan.
http://france24.com/en/live-news/20260730-up-to-23-feared-dead-in-japan-quake
However, the viral image showed several visual inconsistencies and was flagged as AI-generated.
To further examine the authenticity of the image, we scanned it using the AI detection tool Hive Moderation. The results indicated that the image had an 84 percent probability of being AI-generated.
We also analysed the image using Human Meter, where the results showed a 75 percent probability that the image was AI-generated.
In the final stage of the research, we scanned the image using another AI detection tool, AI Image Detector. The tool indicated that the image had a 95 percent probability of being AI-generated.
Conclusion:
The research established that the viral image is not an authentic photograph of the damage caused by the Kumamoto earthquake or any explosion at an Aeon Mall in Japan. The image contains multiple inconsistencies and was found to be AI-generated. Therefore, the claim linking the image to the Japan earthquake incident is false.
Related Blogs
On 12 August 2026, President Donald Trump signed a National Security Presidential Memorandum titled Expanding Capabilities to Combat Transnational Cyber Enabled Crime. Stripped of its bureaucratic packaging, the document does something American law has resisted for three decades: it lets private companies, under close federal supervision, break into the systems of foreign criminal networks and, in some cases, disrupt or damage them.
That is a genuinely large policy shift, even if the memorandum itself is careful, almost defensive, about how it frames the shift. Understanding why requires separating what the text actually authorizes from the "hack back" headline that has attached itself to the story within days of signing.
The problem the memo says it is solving
The White House frames this as a response to scale, not ideology. Americans reported losing more than 20.8 billion dollars to cyber enabled crime in 2025, a sharp jump from the roughly 12.5 billion dollar figure cited when the administration's earlier March 2026 executive order on cybercrime, fraud, and predatory schemes was signed. Ransomware, phishing, financial fraud, sextortion, and impersonation scams sit at the center of that number, and the administration's own supporting material points to a grim detail buried in the numbers: one in seven young people who experienced sextortion as a minor reported harming themselves as a result.
Those crimes, the memorandum argues, are increasingly the work of organized, transnational groups operating from jurisdictions the FBI simply cannot reach. Domestic law enforcement, built for domestic crime, is structurally mismatched to a threat that lives across borders and inside encrypted infrastructure. The administration's answer is to formally recruit the resource it says is best positioned to close that gap: the American cybersecurity industry itself, which the memo describes as "the most innovative and technologically advanced in the world."
What the Program actually authorizes
The memorandum directs the National Coordination Center, a body first stood up under a 2025 executive order, to build a formal Program through which vetted Participating Companies can conduct two categories of activity against foreign Cyber Enabled Transnational Criminal Organizations, defined in the text as CE TCOs.
Cyber Surveillance Operations cover unauthorized access to a target's systems for the primary purpose of collecting information or intelligence, undertaken with the intent to remain undetected. Cyber Effects Operations go further: manipulating, disrupting, denying, degrading, or destroying information systems, the infrastructure those systems control, or the data resident on them.
Crucially, CE TCOs are defined narrowly. A foreign group only counts if it targets the US government, US persons, or US interests, and it must not be an institutional arm of a foreign state or wholly directed by one. The memo builds in a presumption of innocence at the state level too: a group is assumed not to be state controlled unless clear intelligence establishes otherwise. That distinction matters enormously, because it is the line meant to separate this Program from anything resembling private warfare against a nation state.
No operation happens unilaterally. Every proposed action must be approved in writing by two Program Executive Directors, one designated by the Attorney General and one by the Secretary of Homeland Security, coordinating with each other before signing off. Participating Companies must pass what the memo calls rigorous vetting, sign contractual agreements with DOJ or DHS, and in many cases post a bond or escrow of at least one million dollars, forfeited if they breach their agreement. Within 60 days of the memo's signing, the Program Executive Directors must publish detailed operating procedures covering everything from target adjudication to what happens if an operation accidentally hits a US person's system, in which case the company must stop, run minimization procedures, and immediately notify the Center.
There is also a hard ceiling built into the design. Operations expected to cause loss of life, serious injury, or conduct that would rise to the level of a use of force or armed attack under international law, termed Critical Outcomes in the text, cannot be approved by the Program Executive Directors at all. That ceiling is the memo's clearest attempt to keep this inside the bounds of law enforcement rather than sliding into something closer to conflict.
Multiple law firms tracking the rollout, including Wiley, have been explicit on one point worth repeating because so much coverage has blurred it: this is not a green light for companies to hack back on their own initiative. Every operation remains, on paper, an act of the federal government, merely executed through a contracted private hand.
Why experts are not popping champagne
Legal caution has not stopped a wave of professional anxiety. Cyber policy veterans interviewed by outlets like CyberScoop describe the memo as a genuine philosophical break in how Washington thinks about offense in cyberspace, and the debate that followed split fairly evenly between cautious optimism and open alarm.
The core worry, echoed across nearly every serious critique, is attribution. Cyber operations are hard to trace precisely because criminals exploit shared infrastructure, proxies, and compromised third party systems to hide, and that same fog does not lift just because a government contract sits behind the operator. A former senior CISA official, Michael Garcia, put the risk plainly: pressure to attribute quickly could push companies toward lower certainty judgments about who they are actually striking, with a realistic chance of hitting the wrong server, or worse, infrastructure tied to a foreign government rather than a criminal gang. A former Cyber Command official was blunter still, describing parts of the memo on social media as a structure that could reward companies for manufacturing billable threats rather than resolving them efficiently.
Paul Rosenzweig, a former DHS policy official, raised a separate and arguably more durable problem: jurisdiction. Whatever this memo authorizes under American law, the systems being accessed usually sit inside someone else's sovereign territory, governed by that country's own criminal statutes. Washington cannot legislate away a foreign hacking law simply by calling the American company that broke it a Participating Company.
None of this makes the memo indefensible. Supporters point out, correctly, that the private sector already does enormous amounts of active defense and threat disruption work informally, through botnet takedown litigation and coordinated infrastructure seizures, and that formalizing federal oversight over that activity is arguably safer than the current improvisation. The honest position, and probably the fair one, is that the memo trades one set of risks for another, and which set turns out worse will depend entirely on the operating procedures due inside sixty days, procedures the public has not yet seen.
CyberPeace Insights: what this means beyond America's borders
A significant share of the CE-TCO activity this memo is built to target, the ransomware crews, romance investment fraud operations, and sextortion rings running out of Southeast Asia, does not victimize Americans in isolation. The scam compounds clustered along the Myanmar, Cambodia, and Laos borders, repeatedly raided over the past two years, have held thousands of trafficked workers of dozens of nationalities, Indians consistently among the largest groups rescued, alongside Chinese, Filipino, and Malaysian nationals. India has run its own repatriation efforts out of Mae Sot in Thailand, bringing citizens home several hundred at a time, and has built its own institutional response to this threat through the Indian Cyber Crime Coordination Centre, which coordinates cybercrime enforcement across states and increasingly across borders.
That shared exposure gives India and the United States real common ground here. The criminal infrastructure this American Program is designed to disrupt is, in significant part, the same infrastructure that has trafficked and defrauded Indian citizens, which gives New Delhi genuine reason to watch this experiment closely and constructively. At the same time, the Program's underlying model, private companies conducting cross-border operations under one nation's legal authorization, is a genuinely new template in international cyber governance, and how it performs over its first year will likely shape how other major digital economies, India included, think about calibrating their own frameworks for public-private cooperation against transnational cybercrime. India and other nations should closely watch whether this becomes a template worth adapting or a cautionary tale worth avoiding.
It is pertinent to note that Justice and Homeland Security departments have 60 days to write detailed operating procedures covering everything from a target-vetting rubric to a classified operational workflow and 180 days to deliver the first status report to the White House.
References
- The White House. "Expanding Capabilities to Combat Transnational Cyber Enabled Crime." 12 August 2026. https://www.whitehouse.gov/presidential-actions/2026/08/expanding-capabilities-to-combat-transnational-cyber-enabled-crime/
- Wiley Rein LLP. "Navigating the New Presidential Memorandum on Transnational Cyber Enabled Crime." August 2026. https://www.wiley.law/alert-Navigating-the-New-Presidential-Memorandum-on-Transnational-Cyber-Enabled-Crime
- SecureWorld. "Trump Memo Lets Private Firms Hack Back at Cybercriminals." August 2026. https://www.secureworld.io/industry-news/trump-authorizes-private-firms-offensive-cyber-operations
- CyberScoop. "A bold new strategy or a dangerous precedent? Experts are divided on Trump's memo." August 2026. https://cyberscoop.com/private-sector-hacking-presidential-memo-cybersecurity/
- CyberScoop. "Trump turns to private sector in offensive hacking operations memo." August 2026. https://cyberscoop.com/trump-memo-private-sector-offensive-hacking/
- CNN Politics. "Cyber privateers: Trump issues order allowing US companies to hack overseas groups under certain conditions." August 2026. https://www.cnn.com/2026/08/13/politics/cyber-privateers-trump-order-overseas-groups-hacking
- NPR. "Trump administration wants to allow companies to hack foreign cybercriminals." August 2026. https://www.npr.org/2026/08/15/nx-s1-5930311/trump-companies-hack-foreign-cybercriminals
- The Next Web. "President Donald Trump signs memo letting US agencies hack transnational crime groups abroad." August 2026. https://thenextweb.com/news/trump-cyber-memo-transnational-crime
- Machine News. "Security firms hit back at Trump's call to hack back against international crime gangs." August 2026. https://www.machine.news/security-firms-hit-back-at-trumps-call-to-hack-back-against-international-crime-gangs/
- Lawfare. "Trump Admin Cyber Strategy Centers Private Sector in Offensive Cyber Operations." March 2026. https://www.lawfaremedia.org/article/trump-admin-cyber-strategy-centers-private-sector-in-offensive-cyber-operations
- Lawfare. "Partners or Provocateurs? Private Sector Involvement in Offensive Cyber Operations." July 2025. https://www.lawfaremedia.org/article/partners-or-provocateurs--private-sector-involvement-in-offensive-cyber-operations
- Global Indian Network. "Pig Butchering Scams in India: The Dark Intersection of Social Media, AI, and Emotional Manipulation." January 2026. https://globalindiannetwork.com/pig-butchering-scams-in-india/
- The Tribune. "India brings home scammed 549 nationals from Myanmar in 2 days." 2025. https://www.tribuneindia.com/news/india/india-brings-home-scammed-549-nationals-from-myanmar-in-2-days
- Malay Mail. "India to repatriate 500 nationals fleeing Myanmar's cyber scam hub, says Thai PM." October 2025. https://www.malaymail.com/amp/news/world/2025/10/29/india-to-repatriate-500-nationals-fleeing-myanmars-cyber-scam-hub-says-thai-pm/196399
- NBC News. "260 foreigners rescued from virtual slavery in Myanmar's online scam centers are being repatriated." 2025. https://www.nbcnews.com/news/world/260-foreigners-rescued-virtual-slavery-myanmars-online-scam-centers-ar-rcna192180
- CyberPeace Foundation. "About Us." https://cyberpeace.org/about-us
Contributors
- Maj. Vineet Kumar, Founder & Global President, CyberPeace
- Mr. Neeraj Soni, Senior Research Analyst, Policy & Advocacy, CyberPeace
List of Abbreviations
- CE‑TCO — Cyber Enabled Transnational Criminal Organization
- DOJ — Department of Justice
- DHS — Department of Homeland Security
- FBI — Federal Bureau of Investigation
- CISA — Cybersecurity and Infrastructure Security Agency
- I4C — Indian Cyber Crime Coordination Centre
- US — United States
- IT — Information Technology
Introduction
Cyberwarfare has evolved into one of the most decisive instruments of statecraft and conflict. The increasing digitisation of critical infrastructure like power grids, water systems, transportation systems, healthcare networks, and energy sources has made these systems new targets in the war of algorithms. Military logic is evolving to paralyse the nation’s critical infrastructure to keep its resources engaged in repairing them and thereby break the nation’s ability to deter and counter attacks, all without firing a single bullet.
From Ransomware to an Invisible Sabotage: The changing nature of warfare
The operational technology (OT) landscape has become the epicentre of cyber operations, all around the world. Once, which was insulated, related to industrial systems that controlled turbines, pipelines, or dams, they now stand connected to the Internet through supervisory control and data acquisition (SCADA) and the Internet of Things. These connections have also become gateways for attackers, besides enhancing the efficiency of the infrastructural lifelines of the nation.
Groups like Volt Typhoon, Sandworm, Laurionite, and Cyberavengers have transformed the art of digital infiltration into a strategic shift. Volt Typhoon, which is linked to China, has used “living-off-the-land” techniques to exploit the legitimate administrative tools to remain invisible while scanning the critical infrastructures in the US. Sandworm, which is aligned with Russia’s GRU (Glavnoye Razvedyvatelnoye Upravlenie) or Main Intelligence Directorate (in English), has demonstrated the power of cyber sabotage in real time, as its attacks on Ukraine’s power grids in 2015 and 2021 had left millions in darkness, coinciding with kinetic missile strikes. Meanwhile, the Iranian-affiliated Cyberavengers group, which has weaponised the AI-assisted malware, such as IOCONTROL, that are capable of hijacking water and energy control systems. Each of these systems used in these operations reflects a shift from direct espionage activities to a state of strategic paralysis.
In comparison to the traditional cybercrime activities that are aimed at stealing data and extortion of money, these campaigns repeatedly target the physical systems, which consist of the machinery that sustains civilian life and military preparedness.
The Military Logic behind Cyber Targeting: A Web of Vulnerabilities
A critical infrastructure is a complex ecosystem that covers power generation, transportation, communication, and manufacturing are all interconnected, which means a single compromised node can cascade into a national paralysis. For instance, a breach in the systems of the dam can flood an entire city, a grid shutdown can halt water supply to hospitals, and even affect air traffic. The 2015 Black Energy Malware attack in Ukraine has proved this possibility when three utilities were hacked, plunging thousands of homes into darkness. The Iranian hackers once again gained access to the Bowman Avenue Dam of New York and controlled its floodgates, which gave a chilling demonstration of the destructive reality of digital manipulation.
The systems remain vulnerable mainly for 3 reasons such as-
- Legacy Architectures: Many of these industrial systems were designed decades ago with no built-in cybersecurity mechanisms.
- Slow Patching and Segmentation Gaps: All updates and segmentation between IT and TO networks often lag, providing open entry points for attackers.
- Converging with IoT: The integration of smart sensors and cloud-based management tools has expanded the attack surface exponentially.
This interconnected fragility has turned our critical infrastructures into both a weapon and a target or a tool for coercion in modern hybrid warfare. Between 2023 and 2024, over 420 cyberattacks were witnessed in several critical global infrastructures, which averaged to 13 attacks per second, according to a news report. These were not just random acts of digital vandalism; they were deliberate and coordinated operational attempts by state-led actors from China, Russia, and Iran.
Developing a new Resilience as the new tool of Deterrence
Cyber deterrence no longer rests on the fear of retaliation, it relies on the need for resilience. Nations that can absorb attacks, maintain continuity, and recover rapidly would be the true superpowers of this digital age. Segmentation, real-time threat detection, and AI-assisted recovery models are vital pillars of this model of resilience. The logic of modern cyberwarfare is clear, which means that the more a nation digitizes, the more it will need to defend itself.
However, as the line between war and peace blurs, safeguarding critical infrastructure is no longer just an IT priority; rather, it is a national security doctrine. In this silent theatre of cyberwarfare, survival will depend not only on firepower, but on firewalls.
References
- https://rmcglobal.com/critical-infrastructure-under-siege-the-top-ot-threats-of-2025/
- https://ccdcoe.org/uploads/2018/10/Geers2009_The-Cyber-Threat-to-National-Critical-Infrastructures.pdf
- https://www.researchgate.net/publication/335752979_Cybersecurity_of_Critical_Infrastructure
- https://arxiv.org/html/2510.04118v1
- https://www.anapaya.net/blog/top-5-critical-infrastructure-cyberattacks
.webp)
Introduction
Meta Platforms is experiencing a long-term surge of lawsuits that not only question particular practices, but also the very design and governance of its platforms, across the United States and beyond. This range of privacy breaches to youth mental health damages and antitrust issues are all indicative of a new era of judicial, regulatory, and civil society scrutiny of the duties of big tech firms. The main question is no longer whether harmful content is placed on platforms, but to what extent they are actively creating harm-producing environments.
From Content to Conduct: A Turning Point in Legal Strategy
Over the years, Meta and other sites have depended on legal safeguards like the US Communications Decency Act, Section 230, which protects companies against liability due to user-created content. New ways of testing that protection are now being tried.
Recent incidents have shifted off the blame of particular content and has placed the emphasis on the design of the platform. Courts are becoming more receptive to consider whether the characteristics of infinite scroll, algorithmic amplification, and engagement-based ranking systems are contributing to quantifiable harm.
In March 2026, a California jury declared that Meta and Google were negligent in creating platforms that led to youth addiction and mental health problems. The jury decided that Meta and Google were to pay off a joint sum of 6 million dollars in damages, with 70 percent of the sum being charged on Meta. It is a bellwether case, which means that it is related to about 2,000 other pending cases by parents and school districts. This change is important as it avoids legal barriers. When the liability is linked to the design decisions instead of user-created content, accountability begins to shift.
The Youth Harm Cases: A Big Tobacco Moment
Social media are becoming the subject of increased scrutiny by courts and regulators as products that have quantifiable psychological impacts. The most impactful group of lawsuits against Meta is, perhaps, the one concerning youth mental health.
A day prior to the California verdict, a New Mexico jury ordered Meta to pay $375 million in damages due to failure to safeguard young users against child predators on Instagram and Facebook, and found that the company had lied to consumers about the safety of its products and violated state consumer protection laws.
Similar arguments have been presented in other lawsuits filed by attorneys general in over 30 states, and the cases reflect previous regulatory turning points in other industries such as tobacco. The question that courts are not merely asking is whether there is harm or not. They are questioning whether businesses were aware of creating systems that capitalize on behavioral weaknesses. It has been reported in internal documents and accounts of former employees that Meta made a profit by intentionally turning its platforms into addictions to children, with algorithmic functions tailored to drive users into engagement loops, maximising time on platform to the detriment of wellbeing.
Meta has refuted these characterisations, claiming that teen mental health is multifaceted and cannot be blamed on an individual app. The companies have indicated that they will appeal the verdicts.
Privacy and Data Misuse: An Ongoing Fault Line
Platform design is not the only issue that Meta faces in legal matters. Cases centered on privacy have been a recurrent problem in the last ten years, and previous cases have claimed that Facebook monitored users even after they have logged out, scanned personal messages, and utilized personal data in a manner that was beyond user expectations. In more recent times, in April 2026, a class action suit was filed claiming that WhatsApp messages were accessed by Meta employees and third-party contractors, despite the long-standing end-to-end encryption guarantees of the platform.
These instances indicate a structural problem that is consistent. Consent mechanisms and privacy policies tend to be out of date with the reality of data use, and the gap between legal compliance and what users actually know or expect.
Antitrust: A Win, But Not a Clean One
One of the legal fronts was Meta all the way. In November 2025, a judge in the US District Court, James Boasberg, declared that Meta was not a social networking monopoly, finding that the FTC did not demonstrate that the acquisitions of Instagram and WhatsApp by the company were against the antitrust law. The decision has since been appealed by the FTC, which continues to argue that "Meta broke our antitrust laws by acquiring Instagram and WhatsApp, and that American consumers have been harmed by it.
The case also demonstrates a significant drawback of the antitrust law as a form of regulation of tech companies. By the time the trial occurred five years after the lawsuit was initiated, the social media market had evolved such that Tik Tok was a major competitor, undermining the market definition claims of the FTC. The structural issue of whether a few platforms are too powerful in the communication of the masses is not answered, although the legal claim in this instance might have been unsuccessful.
Policy Takeaways: What This Means Going Forward
The accumulating number of lawsuits against Meta provides a number of valuable lessons to policymakers.
- Platform design has become a regulatory topic. Laws should go beyond content regulation and deal with the construction of systems. Engagement maximising features can also increase harm, and this trade-off must be governed explicitly.
- Transparency should be mandatory and not discretionary. Privacy policies and disclosures on platforms are usually too complicated or ambiguous. Regulators might be required to make more transparent and standardised disclosures regarding the use of data and the operation of recommendation systems.
- Section 230 safeguards are under reinterpretation. Courts are becoming open to restrict immunity in cases where the harm is associated with the conduct of the platform and not the content of the user. This would redefine the law of all digital platforms, and not only Meta.
- Cross-border coordination is needed. Meta is an international company, yet the regulatory reaction is still divided. This will require more coordination among jurisdictions to guarantee uniform enforcement and to eliminate regulatory arbitrage.
Conclusion
The lawsuits of Meta are not single cases. They are a more general reconsideration of the regulation of digital platforms and the accountability of those responsible when design decisions have harm at scale. In the wider context of the technology ecosystem, the implications are structural. Courts are starting to question not only what is hosted on them, but how they work and why they are constructed in the manner they are.
The age of minimal responsibility is being supplanted by a more challenging requirement: that platforms should foresee, quantify, and alleviate the harms they produce. The result of these cases will not only decide the future of Meta in terms of legal matters. They will influence the regulations of the digital economy in the years to come.
References
- https://www.npr.org/2026/03/25/nx-s1-5746125/meta-youtube-social-media-trial-verdict
- https://www.pbs.org/newshour/show/jury-finds-meta-and-youtube-liable-in-landmark-youth-addiction-case
- https://www.cbsnews.com/news/meta-ftc-whatsapp-instagram/
- https://www.cnbc.com/2026/01/20/ftc-appeals-metaruling-antitrust-instagram-whatsapp.html
- https://www.bbc.com/news/articles/czjw0zgz9zyo
