#FactCheck - Old Video of Yogi Adityanath Edited to Push ‘Next PM 2029’ Claim

Executive Summary

‍
Nepal witnessed severe devastation after floods struck the country on August 26, 2026. Amid this, a video showing a bridge being swept away by floodwaters is being widely shared on social media. Some users are sharing the video claiming that it shows scenes of destruction caused by the floods in Nepal.A research done by the Research Wing of the CyberPeace found that the video being shared with the claim of flood devastation in Nepal is AI-generated. However, it is true that the floods in Nepal have claimed hundreds of lives.

‍

Claim

‍

A user on X shared the video with the caption: “Scenes of devastation in Nepal after the disaster.”

https://www.instagram.com/reels/Dch-EmYNUwz/ 

https://perma.cc/5VY5-ZFCN?type=standard 

Fact Check

‍

We closely examined the video showing the bridge being swept away. A person can be seen standing on top of a truck, which appears unnatural in such a situation. Moreover, even as the bridge collapses, the people on it do not appear to fall directly into the water. These observations led us to suspect that the video was likely AI-generated.

‍

‍

We scanned the viral video using the AI detection tool ‘WasItAI’, which identified it as 99 percent AI-generated.

‍

‍

Meanwhile, another AI detection tool, Sightengine, also identified the video as 99 percent AI-generated.

‍

‍

Conclusion:

‍

A video being shared with the claim that it shows devastation caused by floods in Nepal is actually from the shooting of an Indonesian TV serial, while another viral video is AI-generated.

‍

Introduction

For years, when Meta's automated systems flagged suspected child sexual abuse material on Facebook or Instagram involving an Indian child, that information did not go straight to an Indian police station. It went first to a private, US based nonprofit, the National Center for Missing & Exploited Children (NCMEC), which would then decide how and when to route the relevant details back to law enforcement in the country where the crime actually happened. That indirect chain has now been shortened. In mid September 2026, senior Indian government officials confirmed that Meta had agreed, for the first time among major social media platforms operating in India, to report child sexual abuse cases and details of repeat offenders directly to the cybercrime division of the Indian Cyber Crime Coordination Centre, commonly known as I4C, under the Ministry of Home Affairs. Google followed within days with a similar commitment of its own.

How the reporting actually worked before this

Under US federal law, Meta and every other American headquartered platform is legally obligated to report CSAM instances to NCMEC, facing criminal liability, financial penalties, and the loss of legal safe harbour protections if they fail to do so. NCMEC would then coordinate with law enforcement agencies in the relevant country. In India's case, that meant a 2019 memorandum of understanding between NCMEC and the National Crime Records Bureau, through which more than 69 lakh CyberTipline reports had reportedly been shared with Indian states and union territories by early 2024. The structural problem was not the volume of reports; it was the layer of institutional distance built into every single one of them. As one government official put it plainly, an Indian law enforcement agency was, in effect, made to wait on a private American nonprofit for information about a crime committed on Indian soil against an Indian child, and NCMEC itself has little to no operational presence in India to manage that handoff quickly.

That distance had real, documented costs. Officials directly linked slow data sharing to delayed CSAM investigations, describing situations where exploitation was actively ongoing while Indian agencies remained one step removed from the account level details, IP addresses, and identifying information that could have accelerated a rescue or an arrest.

What actually changed, and why now

This shift did not emerge from a routine policy review. It followed sustained government pressure through 2026, including a formal inquiry launched by the National Commission for Protection of Child Rights into Meta India's child safety policies, multiple summons issued to Meta India head, and a July 2026 controversy in which Meta was found to have run paid Instagram advertisements allegedly directing users toward Telegram channels distributing CSAM. 

Union Minister Ashwini Vaishnaw directly raised the direct reporting demand with Meta's Chief of Global Affairs, Joel Kaplan, during a visit to New Delhi in August 2026, and separately questioned whether Meta could still claim to be a "simple intermediary" given that it profits from advertisement placement and exercises systems level control over ad distribution. Under the new arrangement, account level details, including names, associated email addresses, and IP addresses, will now flow directly to I4C, which officials say should meaningfully compress the time between detection and actionable law enforcement response.

Why this is a welcome step, but not a solved problem

There is genuine reason to treat this as meaningful progress. For years, reporting routed through NCMEC meant Indian agencies were effectively once removed from data concerning crimes committed on Indian soil, against Indian children. Direct reporting to I4C shortens that distance and gives investigators quicker access to information that matters most in time sensitive cases, where every day of delay can mean continued access, continued distribution, or a victim who remains unidentified.

That said, this should not be described as a finished problem, and its real value will depend on at least three things.

The first is the depth of data actually shared. Account level details, a name, an email address, an IP address, are a starting point for an investigation, not an end point. Whether the new arrangement includes the kind of contextual detail investigators actually need to build a prosecutable case, rather than simply a faster version of the same limited data packet previously routed through NCMEC, remains to be seen in practice rather than in the announcement itself.

The second is institutional capacity on the receiving end. I4C and state cyber cells will now be positioned to receive a higher volume of reports arriving faster than before, but a faster pipeline only produces better outcomes if the infrastructure receiving it can actually convert that inflow into timely, actionable results on the ground. India's cyber cells have historically been understaffed and unevenly resourced across states, with some districts operating with only a handful of trained personnel handling cybercrime alongside a broad range of other digital offences. A genuinely improved reporting channel could, in that context, simply shift the bottleneck downstream from Washington to a district cyber cell rather than eliminate it, unless the surge in report volume is matched by a corresponding investment in trained staff, forensic capacity, and case management systems capable of prioritising the most time sensitive reports first.

The third is consistency across the industry. Meta and Google have now committed to this model, but whether it extends reliably across every major platform operating in India, rather than remaining an arrangement secured through targeted pressure on one or two companies at a time, will determine whether this becomes a systemic fix or a set of isolated exceptions.

The quieter tension nobody has fully resolved

There is also a more technical reality worth naming honestly. As platforms adopt end to end encryption more broadly, extending it across messaging services and, in some cases, considering it for other content types, the pool of CSAM content that can actually be automatically detected narrows, even as the reporting pipeline for whatever is detected improves. WhatsApp itself has argued in Indian courts, including in its ongoing challenge to the IT Rules' traceability requirements, that end to end encryption and message traceability are close to mutually exclusive, a position echoed by cryptography experts including Signal's Moxie Marlinspike, who has stated plainly that identifying a message's originator at the very least undermines, and likely breaks, the purpose of end to end encryption altogether. Faster reporting channels do not, by themselves, compensate for reduced visibility into content that a platform's own encryption prevents it from scanning in the first place. That tension, between strengthening user privacy through encryption and strengthening child safety through detection, sits underneath this entire announcement and deserves sustained attention from technologists, platforms, and child safety practitioners alike, rather than being treated as resolved simply because reporting speed has improved.

India's National Human Rights Commission has already flagged this directly in its own advisory, recommending that platforms using end to end encryption be required to devise additional protocols or technology specifically to monitor CSAM circulation, an unresolved and technically difficult ask that sits alongside, rather than instead of, the reporting improvements announced this month.

What this actually represents

The most accurate way to characterise this development is as a meaningful first step in platform accountability toward children in India, not a finish line. Meta agreeing to report directly, rather than through a private American intermediary, closes a real structural gap that officials say genuinely delayed investigations. But the task now shifts to India itself: building the institutional capacity at I4C and in state cyber cells to make full use of what is finally being offered, extending the same commitment across the rest of the industry rather than platform by platform, and confronting the encryption question honestly rather than treating faster reporting as a substitute for solving it.

A judicial note worth remembering

It is worth noting that Indian courts pushed for this same sensitivity well before it became routine practice. The Supreme Court, in Just Rights for Children Alliance v. S. Harish, 2024, directed that the term "child pornography" be replaced with "child sexual abuse and exploitation material" across legal and public usage, holding that the word "pornography" wrongly implies consent and normalises what is, in fact, a recorded act of abuse. That judicial insistence on precise language is a useful reminder that reporting frameworks like this one will ultimately be judged not just on speed, but on whether they treat the material, and the children in it, with the gravity courts have already demanded.

References

1. https://www.business-standard.com/industry/news/meta-agrees-to-share-csam-details-with-indian-law-enforcement-agencies-125091500052_1.html
2. https://www.business-standard.com/technology/tech-news/google-india-to-share-csam-case-details-with-govt-cybercrime-division-126092101062_1.html
3. https://www.storyboard18.com/advertising/ncpcr-summons-meta-india-md-again-over-child-abuse-ads-ws-l-110781.htm
4. https://www.superprep.io/current-affairs/meta-report-csam-directly-to-indias-cybercrime-portal
5. https://theprint.in/india/specialised-central-police-unit-use-of-technology-to-proactively-detect-csam-nhrc-advisory/1822223/
6. https://www.livelaw.in/news-updates/whatsapp-delhi-high-court-traceability-end-to-end-encryption-privacy-risk-174743
7. https://www.forbesindia.com/article/take-one-big-story-of-the-day/traceability-and-endtoend-encryption-cannot-coexist-on-digital-messaging-platforms-experts/66969/1

‍

Introduction

In an alarming event, one of India’s premier healthcare institutes, AIIMS Delhi, has fallen victim to a malicious cyberattack for the second time in the year. The Incident serves as a clear-cut reminder of the escalating threat landscape faced by the healthcare organisation in this digital age. In the attack, which unfolded with grave implications, the attackers not only explored the vulnerabilities present in the healthcare sector, but this also raised the concern about the security of patient data and the uninterrupted delivery of critical healthcare services. In this blog post, we will explore the incident, what happened, and what safety measures can be taken.

Backdrop

The cyber-security systems deployed in AIIMS, New Delhi, recently detected a malware attack. The nature and scope of the attack were both sophisticated and targeted. This second hack acts as a wake-up call for healthcare organisations nationwide. As the healthcare business increasingly depends on digital technology to improve patient care and operational efficiency, cybersecurity must be prioritised to protect sensitive data. To minimise cyber-attack dangers, healthcare organisations must invest in robust defences such as multi-factor authentication, network security, frequent system upgrades, and employee training.

The attempt was successfully prevented, and the deployed cyber-security systems neutralised the threat. The e-Hospital services remain to be fully secure and are functioning normally.

Impact on AIIMS

Healthcare services have been under hackers’ radar worldwide, and the healthcare sector has been impacted badly. The attack on AIIMS Delhi’s effects has been both immediate and far-reaching. The organisation, which is recognised for delivering excellent healthcare services and performing breakthrough medical research, faced significant interruptions in its everyday operations. Patient care and treatment processes were considerably impeded, resulting in delays, cancellations, and the inability to access essential medical documents. The stolen data raises serious concerns about patient privacy and confidentiality, raising doubts about the institution’s capacity to protect sensitive information. Furthermore, the financial ramifications of the assault, such as the cost of recovery, deploying more robust cybersecurity measures, and potential legal penalties and forensic analyses, contribute to the scale of the effect. The event has also generated public concerns about the institution’s ability to preserve personal information, undermining confidence and degrading AIIMS Delhi’s image.

Impact on Patients: The attacks not only impact the institutes but also have serious implications for the patients and here are some key highlights:

Healthcare Service Disruption: The hack has affected the seamless delivery of healthcare services at AIIMS Delhi. Appointments, surgeries, and other medical treatments may be delayed, cancelled, or rescheduled. This disturbance can result in longer wait times, longer treatment periods, and potential problems from delayed or interrupted therapy.

Patient Privacy and Confidentiality are jeopardised because of the breach of sensitive patient data. Medical data, test findings, and treatment plans may have been compromised. This breach may diminish patient faith in the institution’s capacity to safeguard their personal information, discouraging them from seeking care or submitting sensitive information in the future.

As a result of the cyberattack, patients may endure mental anguish and worry. Fear of possible exploitation of personal health information, confusion about the scope of the breach, and concerns about the security of their healthcare data can all have a negative impact on their mental health. This stress might aggravate pre-existing medical issues and impede total recovery.

Trust at stake: A data breach may harm patients’ faith and confidence in AIIMS Delhi and the healthcare system. Patients rely on healthcare facilities to keep their information secure and confidential while providing safe, high-quality care. A hack can doubt the institution’s ability to safeguard patient data, affecting patients’ overall faith in the organisation and potentially leading to patients seeking care elsewhere.

Cybersecurity Measures

To avoid future hacks and protect patient data, AIIMS Delhi must prioritize enhancing its cybersecurity procedures. The institution can strengthen its resistance to changing threats by establishing strong security practices. The following steps can be considered.

Using Multi-factor Authentication: By forcing users to submit several forms of identity to access systems and data, multi-factor authentication offers an extra layer of protection. AIIMS Delhi may considerably lower the danger of unauthorised access by applying this precaution, even in the case of leaked passwords or credentials. Biometrics and one-time passwords, for example, should be integrated into the institution’s authentication systems.

Improving Network Security and Firewalls: AIIMS Delhi should improve network security by implementing strong firewalls, intrusion detection and prevention systems, and network segmentation. These techniques serve to construct barriers between internal systems and external threats, reducing attackers’ lateral movement within the network. Regular network traffic monitoring and analysis can assist in recognising and mitigating any security breaches.

Risk Assessment: Regular penetration testing and vulnerability assessments are required to uncover possible flaws and vulnerabilities in AIIMS Delhi’s systems and infrastructure. Security professionals can detect vulnerabilities and offer remedial solutions by carrying out controlled simulated assaults. This proactive strategy assists in identifying and addressing any security flaws before attackers exploit them.

Educating and training Healthcare Professionals: Education and training have a crucial role in enhancing cybersecurity practices in healthcare facilities. Healthcare workers, including physicians, nurses, administrators, and support staff, must be well-informed about the importance of cybersecurity and trained in risk-mitigation best practices. This will empower healthcare professionals to actively contribute to protecting the patient’s data and maintaining the trust and confidence of patients.

Learnings from Incidents

AIIMS Delhi should embrace cyber-attacks as learning opportunities to strengthen its security posture. Following each event, a detailed post-incident study should be performed to identify areas for improvement, update security policies and procedures, and improve employee training programs. This iterative strategy contributes to the institution’s overall resilience and preparation for future cyber-attacks. AIIMS Delhi can effectively respond to cyber incidents, minimise the impact on operations, and protect patient data by establishing an effective incident response and recovery plan, implementing data backup and recovery mechanisms, conducting forensic analysis, and promoting open communication. Proactive measures, constant review, and regular revisions to incident response plans are critical for staying ahead of developing cyber threats and ensuring the institution’s resilience in the face of potential future assaults.

Conclusion

To summarise, developing robust healthcare systems in the digital era is a key challenge that healthcare organisations must prioritise. Healthcare organisations can secure patient data, assure the continuation of key services, and maintain patients’ trust and confidence by adopting comprehensive cybersecurity measures, building incident response plans, training healthcare personnel, and cultivating a security culture. Adopting a proactive and holistic strategy for cybersecurity is critical to developing a healthcare system capable of withstanding and successfully responding to digital-age problems.