#FactCheck-Viral Image of ‘New Iranian Banknote’ Featuring Khamenei Is Misleading; Likely AI-Generated

Introduction

Cybersecurity threats have been globally prevalent for quite some time now. All nations, organisations and individuals stand at risk from new and emerging potential cybersecurity threats, putting finances, privacy, data, identities and sometimes human lives at stake. The latest Data Breach Report by IBM revealed that nearly a staggering 83% of organisations experienced more than one data breach instance during 2022. As per the 2022 Data Breach Investigations Report by Verizon, the total number of global ransomware attacks surged by 13%, indicating a concerning rise equal to the last five years combined. The statistics clearly showcase how the future is filled with potential threats as we advance further into the digital age.  

Who is Okta?  

Okta is a secure identity cloud that links all your apps, logins and devices into a unified digital fabric. Okta has been in existence since 2009 and is based out of San Francisco, USA and has been one of the leading service providers in the States. The advent of the company led to early success based on the high-quality services and products introduced by them in the market. Although Okta is not as well-known as the big techs, it plays a vital role in big organisations' cybersecurity systems. More than 18,000 users of the identity management company's products rely on it to give them a single login for the several platforms that a particular business uses. For instance, Zoom leverages Okta to provide "seamless" access to its Google Workspace, ServiceNow, VMware, and Workday systems with only one login, thus showing how Okta is fundamental in providing services to ease the human effort on various platforms. In the digital age, such organisations are instrumental in leading the pathway to innovation and entrepreneurship. 

The Okta Breach

The last Friday, 20 October, Okta reported a hack of its support system, leading to chaos and havoc within the organisation. The result of the hack can be seen in the market in the form of the massive losses incurred by Okta in the stock exchange. 

Since the attack, the company's market value has dropped by more than $2 billion. The well-known incident is the most recent in a long line of events connected to Okta or its products, which also includes a wave of casino invasions that caused days-long disruptions to hotel rooms in Las Vegas, casino giants Caesars and MGM were both affected by hacks as reported earlier this year. Both of those attacks, targeting MGM and Caesars’ Okta installations, used a sophisticated social engineering attack that went through IT help desks.

What can be done to prevent this? 

Cybersecurity attacks on organisations have become a very common occurrence ever since the pandemic and are rampant all across the globe. Major big techs have been successful in setting up SoPs, safeguards and precautionary measures to protect their companies and their digital assets and interests. However, the Medium, Mico and small business owners are the most vulnerable to such unknown high-intensity attacks. The governments of various nations have established Computer Emergency Response Teams to monitor and investigate such massive-scale cyberattacks both on organisations and individuals. The issue of cybersecurity can be better addressed by inculcating the following aspects into our daily digital routines: 

• Team Upskilling: Organisations need to be critical in creating upskilling avenues for employees pertaining to cybersecurity and threats. These campaigns should be run periodically, focusing on both the individual and organisational impact of any threat.  
• Reporting Mechanism for Employees and Customers: Business owners and organisations need to deploy robust, sustainable and efficient reporting mechanisms for both employees well as customers. The mechanism will be fundamental in pinpointing the potential grey areas and threats in the cyber security mechanism as well. A dedicated reporting mechanism is now a mandate by a lot of governments around the world as it showcases transparency and natural justice in terms of legal remedies.  
• Preventive, Precautionary and Recovery Policies: Organisations need to create and deploy respective preventive, precautionary and recovery policies in regard to different forms of cyber attacks and threats. This will be helpful in a better understanding of threats and faster response in cases of emergencies and attacks. These policies should be updated regularly, keeping in mind the emerging technologies. Efficient deployment of the policies can be done by conducting mock drills and threat assessment activities.  
• Global Dialogue Forums: It is pertinent for organisations and the industry to create a community of cyber security enthusiasts from different and diverse backgrounds to address the growing issues of cyberspace; this can be done by conducting and creating global dialogue forums, which will act as the beacon of sharing best practices, advisories, threat assessment reports, potential threats and attacks thus establishing better inter-agency and inter-organisation communication and coordination.  
• Data Anonymisation and Encryption: Organisations should have data management/processing policies in place for transparency and should always store data in an encrypted and anonymous manner, thus creating a blanket of safety in case of any data breach.
• Critical infrastructure: The industry leaders should push the limits of innovation by setting up state-of-the-art critical cyber infrastructure to create employment, innovation, and entrepreneurship spirit among the youth, thus creating a whole new generation of cyber-ready professionals and dedicated netizens. Critical infrastructures are essential in creating a safe, secure, resilient and secured digital ecosystem. 
• Cysec Audits & Sandboxing: All organisations should establish periodic routines of Cybersecurity audits, both by internal and external entities, to find any issue/grey area in the security systems. This will create a more robust and adaptive cybersecurity mechanism for the organisation and its employees. All tech developing and testing companies need to conduct proper sandboxing exercises for all or any new tech/software creation to identify its shortcomings and flaws. 

‍Conclusion 

In view of the rising cybersecurity attacks on organisations, especially small and medium companies, a lot has been done, and a lot more needs to be done to establish an aspect of safety and security for companies, employees and customers. The impact of the Okta breach very clearly show how cyber attacks can cause massive repercussion for any organisation in the form of monetary loss, loss of business, damage to reputation and a lot of other factors. One should take such instances as examples and learnings for ourselves and prepare our organisation to combat similar types of threats, ultimately working towards preventing these types of threats and eradicating the influence of bad actors from our digital ecosystem altogether. 

‍

References: 

• https://hbr.org/2023/05/the-devastating-business-impacts-of-a-cyber-breach#:~:text=In%202022%2C%20the%20global%20average,legal%20fees%2C%20and%20audit%20fees.
• https://www.okta.com/intro-to-okta/#:~:text=Okta%20is%20a%20secure%20identity,use%20to%20work%2C%20instantly%20available.
• https://www.cyberpeace.org/resources/blogs/mgm-resorts-shuts-down-it-systems-after-cyberattack

‍

‍

Introduction

‍

‍"Artificial Intelligence may be the new charlatan in town"

‍

There is something almost wonderfully Indian about our current relationship with artificial intelligence. We are simultaneously afraid of it, fascinated by it, regulating it, funding it, using it and occasionally asking it to write the regulation meant to control it. In contrast, artificial intelligence seems to have figured out the oldest trick in the book: create an issue and then figure out how to solve it. Both the deepfake and the deepfake detector can be produced by it. It has the ability to  both generate and detect false information. It can both authenticate and mimic your voice. It can create a fake image and determine if it is fake. The machine ,in other words, is increasingly becoming both the burglar and the security system. We now refer to this as innovation.  Perhaps nothing better captures this peculiar moment than India’s most recent regulatory actions. The government has strengthened regulations pertaining to synthetic content such as requiring labelling and expediting the removal of illegal AI-generated information. After a legitimate government or court order, platforms are expected to take action within three hours, significantly reducing the removal window for some content. It took years for the internet to become ubiquitous. There are  now three hours for the law to become transitory. This is the first great paradox of AI governance. Technology operates at the speed of creation. Law operates at the speed of procedure. The citizen is seated between the two. 

‍

The Age of the Digital Double

‍

Indian courts are already dealing with this issue in more tangible ways. Cricket player Yuvraj Singh recently received relief from the Delhi High Court in a personality-rights case involving deepfakes created by AI and unlawful use of his identity. Courts have intervened against AI-generated and modified content in similar cases involving other public individuals. As a result, the law faces an odd dilemma: What exactly belongs to a person?  In the past, humans used comparatively stable identifiers to understand identity, such as a name, portrait, signature, or voice. That simplicity has been disrupted by AI. You can now detach your face from your body. You may separate your throat from your voice. It is possible to distinguish between your emotions and your expressions. It is possible to fabricate your political beliefs without engaging in politics. The legitimacy of a person's existence is being requested to be protected by the law, not just their property which is a far more difficult issue.

‍

When Artificial Intelligence Enters the Courtroom

‍

The irony becomes richer when AI enters the courtroom itself. Courts are creating guidelines for the use of  AI in the courtroom, just as they are being challenged to decide what happens when AI creates reality outside of it. Human primacy, accountability, transparency, data protection and judicial independence are highlighted in the Supreme Court’s proposed rules on the use of AI in courts. After all, there is one situation in which the justification that “the AI said so” should never be accepted. A hallucinated judgment is more than just a mistake in technology. It may turn into a mistake of authority in a legal system. A precedent can be confidently created by a machine. It can be cited with confidence by a lawyer and maybe then brought before a court for consideration.  All of a sudden, we have created a flawless little bureaucratic ecology where everyone has been duped despite no one's intention to do so. It's not inevitable that machines will turn malevolent, but rather that people will grow unduly reliant on machines that seem authoritative.

‍

The Great AI Contradiction

‍

We asked, "What can AI do?" for years.What can AI do for us, we then enquired? We are starting to wonder what AI might do to humans. The following query ought to be more challenging: When it does, who is at fault? Because AI systems don't cleanly fit into the legal frames we inherited, that question becomes very challenging. Developers, model providers, data providers, deployers, platforms, and end users are among them. There may occasionally be a middleman. There is a victim occasionally. Surprisingly, there can occasionally be multiple roles at once. This point is made in a recent working paper on AI and consumer rights in India: while current consumer protection laws may apply to AI harms, the conventional division of accountability among manufacturers, sellers, and service providers becomes challenging when AI systems involve a much more dispersed value chain.

‍

The Misunderstanding on AI’s Intelligence

‍

This is the point at which our sense for policy sometimes fails. We are concerned that AI will develop superintelligence. The more imminent threat can be much less dramatic. It is not necessary for AI to surpass human intelligence in order to wreak great harm. All it needs to do is become more convincing, quicker, and less expensive than human verification. Artificial general intelligence is not necessary for a fraudster to con an elderly person. A supercomputer is not necessary for a political manipulator to create a candidate's voice. A stalker can create an intimate deepfake without being conscious. A pupil can file a hallucinated case citation without the assistance of a robot attorney. Ordinary human wrongdoing magnified by incredible technical magnitude is what it is.

‍

The Real Test of AI Governance

‍

The number of standards we create, the number of committees we form, or the number of compliance boxes platforms check will not ultimately determine the success of AI regulation. Something considerably simpler will be used to measure it. Can the legal system advise a regular citizen where to go, what to do, and who will be held accountable when an AI system impersonates, defrauds, surveils, manipulates, or denies them a service?

The presence of accountability following failure, not the absence of failure.

Sometimes the most advanced piece of technology in the room is still an old-fashioned institution: a law that works, a regulator that responds, a court that understands the technology and a human being willing to take responsibility. Because if AI is going to be both the fire and the fire extinguisher, we should at least make sure that someone other than the machine owns the building.

‍

References

‍

• https://economictimes.indiatimes.com/news/india/government-tightens-deepfake-rules-mandates-ai-content-labels-and-three-hour-takedown-timeline/articleshow/133011656.cms?utm_source=chatgpt.com&from=mdr 
• https://theleaflet.in/law-and-technology/explained-the-supreme-court-of-indias-draft-regulations-for-use-of-artificial-intelligence-in-courts-2026 
• https://www.bananaip.com/intellepedia/yuvraj-singh-personality-rights-ai-deepfakes-delhi-high-court/

‍

The European Union (EU) has made trailblazing efforts regarding protection and privacy, coming up with the most comprehensive and detailed regulation called the GDPR (General Data Protection Regulation). As countries worldwide continue to grapple with setting their laws, the EU is already taking on issues with tech giants and focusing on the road ahead. Its contentious issues with Meta and the launch of Meta’s AI assistant in the EU are thus seen as a complex process, shaped by stringent data privacy regulations, ongoing debates over copyright, and ethical AI practices.​ This development is considered important as previously, the EU and Meta have had issues (including fines and and also received a pushback concerning its services), which broadly include data privacy regarding compliance with GDPR, antitrust law concerns- targeting ads, facebook marketplace activities and content moderation with respect to the spread of misinformation. 

Privacy and Data Protection Concerns

A significant part of operating Large Language Models (LLMs) is the need to train them with a repository of data/ plausible answers from which they can source. If it doesn’t find relevant information or the request is out of its scope, programmed to answer, it shall continue to follow orders, but with a reduction in the accuracy of its response. Meta's initial plans to train its AI models using publicly available content from adult users in the EU received a setback from privacy regulators. The Irish Data Protection Commission (DPC), acting as Meta's lead privacy regulator in Europe, raised the issue and requested a delay in the rollout to assess its compliance with GDPR. It has also raised similar concerns with Grok, the AI tool of X, to assess whether the EU users’  data was lawfully processed for training it. 

In response, Meta stalled the release of this feature for around a year and agreed to exclude private messages and data from users under the age of 18 and implemented an opt-out mechanism for users who do not wish their public data to be used for AI training. This approach aligns with GDPR requirements, which mandate a clear legal basis for processing personal data, such as obtaining explicit consent or demonstrating legitimate interest, along with the option of removal of consent at a later stage, as the user wishes. The version/service available at the moment is a text-based assistant which is not capable of things like image generation, but can provide services and assistance which include brainstorming, planning, and answering queries from web-based information. However, Meta has assured its users of expansion and exploration regarding the AI features in the near future as it continues to cooperate with the regulators.

Regulatory Environment and Strategic Decisions

The EU's regulatory landscape, characterised by the GDPR and the forthcoming AI Act, presents challenges for tech companies like Meta. Citing the "unpredictable nature" of EU regulations, Meta has decided not to release its multimodal Llama AI model—capable of processing text, images, audio, and video—in the EU. This decision underscores the tension between innovation and regulatory compliance, as companies navigate the complexities of deploying advanced AI technologies within strict legal frameworks. 

Implications and Future Outlook

Meta's experience highlights the broader challenges faced by AI developers operating in jurisdictions with robust data protection laws. The most critical issue that remains for now is to strike a balance  between  leveraging user data for AI advancement while respecting individual privacy rights.. As the EU continues to refine its regulatory approach to AI, companies need to adapt their strategies to ensure compliance while fostering innovation.​ Stringent measures and regular assessment also keep in check the accountability of big tech companies as they make for profit as well as for the public.

Reference:

• https://thehackernews.com/2025/04/meta-resumes-eu-ai-training-using.html
• https://www.thehindu.com/sci-tech/technology/meta-to-train-ai-models-on-european-users-public-data/article69451271.ece
• https://about.fb.com/news/2025/04/making-ai-work-harder-for-europeans/ 
• https://www.theregister.com/2025/04/15/meta_resume_ai_training_eu_user_posts/ 
• https://noyb.eu/en/twitters-ai-plans-hit-9-more-gdpr-complaints 

• https://www.businesstoday.in/technology/news/story/meta-ai-finally-comes-to-europe-after-a-year-long-delay-but-with-some-limitations-468809-2025-03-21
• https://www.bloomberg.com/news/articles/2025-02-13/meta-opens-facebook-marketplace-to-rivals-in-eu-antitrust-clash
• https://www.nytimes.com/2023/05/22/business/meta-facebook-eu-privacy-fine.html#:~:text=Many%20civil%20society%20groups%20and,million%20for%20a%20data%20leak.
• https://ec.europa.eu/commission/presscorner/detail/en/ip_24_5801
• https://www.thehindu.com/sci-tech/technology/european-union-accuses-facebook-owner-meta-of-breaking-digital-rules-with-paid-ad-free-option/article68358039.ece
• https://www.theregister.com/2025/04/14/ireland_investigation_into_x/ 
• https://www.theverge.com/2024/7/18/24201041/meta-multimodal-llama-ai-model-launch-eu-regulations?utm_source=chatgpt.com
• https://www.axios.com/2024/07/17/meta-future-multimodal-ai-models-eu?utm_source=chatgpt.com 

‍