The New Frontier of Character Assassination: Legal Responses to AI Deepfakes in Australia

The emergence of generative artificial intelligence has fundamentally altered the risk profile for Australian corporations and their leadership teams. Digital forgeries, commonly known as deepfakes, allow malicious actors to create convincing video, audio, and image content that depicts executives engaging in illegal acts or making disparaging comments about shareholders. These synthetic attacks often result in immediate share price volatility and a loss of market confidence. When a company faces false allegations, the business legal response must be immediate, precise, and thorough.

According to Australian corporate law, the path to redress is not always found in the Defamation Act 2005. Most corporations with more than ten employees are barred from suing for defamation under Section 9 of the Act. This statutory restriction forces large-scale entities to rely on alternative causes of action. These include injurious falsehood, misleading or deceptive conduct under the Australian Consumer Law, and the tort of interference with contractual relations. Success in these matters requires a deep understanding of the intersection between emerging technology and established common law principles.

The Statutory Barrier to Corporate Defamation

Australian law distinguishes between the reputation of an individual and the commercial standing of a large corporation. Section 9 of the Defamation Act 2005 (NSW) and its interstate equivalents prevent corporations that are not “excluded corporations” from initiating defamation proceedings. An excluded corporation is defined as one that is not a public body and has fewer than ten employees, provided it is not associated with another corporation, or is not formed for financial gain. This means most ASX-listed entities and large private firms cannot claim general damages for loss of reputation through traditional defamation channels.

Executives targeted by deepfakes in their personal capacity retain the right to sue for defamation. However, when the attack is directed at the corporate entity through synthetic media depicting “company policy” or “internal fraud”, the business must look toward Australian business reputation protection law to find a viable remedy. The focus shifts from wounded feelings to provable financial loss.

Legal precedent establishes that the limitation on corporate defamation does not leave a company without a defence. It simply changes the evidentiary burden. Where a plaintiff in a defamation case does not need to prove the statement was false (the burden of proof for “truth” rests on the defendant), a company suing for injurious falsehood must prove the synthetic content is both false and motivated by malice.

Injurious Falsehood and the Requirement of Malice

Injurious falsehood is the primary common law tool for companies facing AI-generated character assassination. Unlike defamation, which protects reputation, injurious falsehood protects the economic interests of the business. To succeed in a false allegations business legal response involving deepfakes, the plaintiff must satisfy three strict elements:

• Falsity: The plaintiff must prove that the synthetic media conveys a false message. With deepfakes, this involves technical forensic evidence to demonstrate the content was AI-generated.
• Malice: The plaintiff must show the defendant published the deepfake with the intent to cause harm or with a reckless indifference to the truth.
• Actual Damage: The plaintiff must prove “special damage” in the form of actual pecuniary loss. This might include a drop in share price, loss of specific contracts, or a measurable decline in custom.

The case of Kaplan v Go Daddy Group [2021] NSWSC 1111 illustrates the challenges of identifying anonymous online actors. In the context of AI, the difficulty is compounded. Malicious actors often use offshore servers and encrypted services to distribute synthetic media. Experienced litigators use Norwich Pharmacal orders to compel internet service providers and social media platforms to disclose the identity of the uploaders. This is a necessary step before any meaningful recovery of damages can occur.

Misleading or Deceptive Conduct under the Australian Consumer Law

Section 18 of the Australian Consumer Law (ACL), found in Schedule 2 of the Competition and Consumer Act 2010, provides a powerful alternative to defamation. It states that a person must not, in trade or commerce, engage in conduct that is misleading or deceptive or is likely to mislead or deceive. For a business, this is often a more accessible remedy than injurious falsehood because it does not require proof of malice.

If a competitor or a short-seller uses a deepfake to spread false information about a company’s financial health, they are likely acting “in trade or commerce”. The High Court in Concrete Constructions (NSW) Pty Ltd v Nelson (1990) 169 CLR 594 established that “conduct in trade or commerce” refers to conduct that bears a trading or commercial character. Spreading synthetic media to manipulate a market or gain a competitive advantage fits this description.

The ACCC provides clear documentation on false or misleading claims, which serves as a baseline for what constitutes a breach of the ACL. When deepfakes are used to replicate an executive’s voice to authorise fraudulent transactions or to devalue a competitor’s brand, the ACL allows for injunctions and damages. This is particularly useful because the court can order the immediate removal of the content, preventing further damage to the company’s market position.

Establishing Platform Liability in the Age of AI

A major hurdle in addressing deepfakes is the role of the platform. Whether it is X (formerly Twitter), YouTube, or a niche forum, synthetic media spreads rapidly. The High Court of Australia has recently clarified the responsibilities of digital platforms in Google LLC v Defteros [2022] HCA 27. The court found that Google was not the publisher of defamatory material merely by providing a search result link to a third-party website. However, this protection is not absolute.

The High Court in Defteros explicitly rejected notice-based liability, holding that notification of the existence of material was not relevant to the question of whether a platform had published it. For a business, the legal strategy involves issuing a formal “Conciliation Notice” or a take-down demand that provides evidence of the synthetic nature of the media. Even if the platform’s liability is not automatically triggered by notice, these steps are essential for establishing a record of the harm and pursuing subsequent legal remedies.

The psychological impact of false accusations on the individuals depicted in deepfakes cannot be ignored, even in a corporate context. While the company pursues economic loss, the individual executive may pursue a parallel defamation claim. This dual-track litigation strategy ensures that both the commercial and personal aspects of the character assassination are addressed.

The Role of Forensic Evidence and the Evidence Act

Proving that a video is a deepfake requires more than just a visual inspection. In a court of law, the Evidence Act 1995 (Cth) governs how technical data is presented. Expert witnesses in the field of digital forensics are needed to analyse metadata, identify “artifacts” in the video (such as unnatural blinking patterns or mismatched skin tones), and explain the underlying neural network used to create the forgery.

Australian courts are increasingly sophisticated in handling digital evidence. In Trkulja v Google LLC (2018) 263 CLR 149, the High Court demonstrated a willingness to engage with the complexities of algorithmic outputs. In a deepfake case, the plaintiff must be prepared to provide a “clean” version of the original media (if it was a manipulated real video) or provide expert testimony that the media has no basis in reality. This technical verification is the foundation of any successful injunction application.

Proactive Protection and Financial Security

Reputational attacks are often linked to broader financial disputes or hostile takeovers. In the same way that businesses must protect private lenders through rigorous security registrations and due diligence, they must protect their digital identity through proactive monitoring. Character assassination is rarely an isolated event. It is usually a component of a larger strategy to destabilise a company’s leadership or financial standing.

Corporate entities should consider the following steps in their legal response plan:

1. Digital Asset Registry: Maintain a secure database of all official corporate communications and executive appearances. This provides a baseline to prove forgeries.
2. Immediate Injunctions: If a deepfake is detected, seek an urgent interlocutory injunction. The court’s primary concern at this stage is the “balance of convenience”. If the media is clearly synthetic, the court is likely to order its removal until a full trial can be held.
3. Market Disclosures: For ASX-listed companies, the continuous disclosure obligations under the Corporations Act 2001 (Cth) may require a formal statement to the market. This must be handled carefully to avoid amplifying the false allegations while still satisfying regulatory requirements.

Managing the Tort of Interference with Economic Relations

When an AI deepfake is used to drive away customers or break a supply chain, the tort of interference with economic relations (also known as causing loss by unlawful means) becomes relevant. This tort is distinct from injurious falsehood because it focuses on the “unlawful means” used to interfere with a third party’s actions. In this context, the creation of a deepfake may involve breaches of copyright law or the Criminal Code Act 1995 (Cth) regarding identity theft or fraud.

The High Court has maintained a narrow view of this tort, but it remains a viable path for companies that can prove a defendant used synthetic media to coerce a third party into ending a contract. The complexity lies in proving that the deepfake was the “instrument” of the interference. This requires a clear chain of causation between the publication of the synthetic media and the termination of a business relationship.

Privacy and Data Protection Laws

The Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) offer another layer of protection, particularly for executives whose biometric data (their face and voice) is used without consent. While the Privacy Act primarily regulates “APP entities”, the unauthorised use of an individual’s image to create a deepfake can lead to significant regulatory scrutiny and potential civil penalties for the entities involved in the data breach that provided the source material.

The recent focus on “doxing” and the misuse of personal information in the Australian legal environment suggests that courts will take an increasingly dim view of synthetic media used for harassment. While the company focuses on the commercial fallout, the misuse of personal data provides a secondary lever to force the removal of content and the identification of the perpetrators.

Effective legal management of AI-driven character assassination requires a transition away from the “wait and see” approach. The speed at which synthetic media moves means that a delay of even twenty-four hours can result in irreversible damage to a company’s valuation. By using the full range of commercial torts and statutory protections, Australian businesses can mount a strong defence against those who seek to use technology as a weapon of deception. The law is evolving, but the core principles of commercial integrity and the protection of economic interests remain the bedrock of the Australian legal system.

About Adam ZuchowskiAdam Zuchowski is a litigation partner at Sutton Laurence King. He advises individuals and businesses on construction disputes, contractual matters, defamation, insolvency and debt recovery. Adam takes a calm, practical approach to dispute resolution.