#FactCheck: AI-manipulated image falsely shows Indian High Commission official at PoK-related protest in UK

Introduction
‍

How Generative Artificial Intelligence, or GenAI, is changing the employee workday is no longer limited to writing emails or debugging code, but now also includes analysing contracts, generating reports, and much more. The use of AI tools in everyday work has become commonplace, but the speed at which companies have adopted these technologies has created a new kind of risk. Unlike threats that come from an outside attacker, Shadow AI is created inside an organisation by a legitimate employee who uses unapproved AI tools to make their work more efficient and productive. In many cases, the employee is unaware of the potential security, data privacy, and compliance risks involved in using such tools to perform their job duties.
‍

What Is Shadow AI?

‍

Shadow AI is when individuals use AI tools at work that aren’t provided by the company, like tools or other software programs, without the knowledge or permission of the employer. Examples of shadow AI include:

‍

1. Using personal ChatGPT or other chatbot accounts to complete tasks at the office
2. Uploading business-related documents to online AI technologies for analysis or summarisation.
3. Copying proprietary source code into an online AI model for debugging
4. Installing browser extensions and add-ons that are not approved by IT or Security personnel.

‍

How Shadow AI Is Harmful

‍

1. Uncontrolled Data Exposure

When employees access or input information into their user-created AI, it becomes outside the controls of the company, such as both employee personal information and any third-party personal information, private company information (such as source code or contracts), and company internal strategies. After a user enters data into their user-created AIs, the company loses all ability to monitor how that data is stored, processed, or maintained. A data leak situation exists without a malicious cyberattack. The biggest risk of a data leak is not maliciousness but rather the loss of control and governance over sensitive data.

‍

2. Regulatory and Legal Non-Compliance

Data protection laws like GDPR, India’s Digital Personal Data Protection (DPDP) Act, HIPAA, and other relevant sectoral laws require businesses to process data in accordance with the law, to minimise the amount of data they use, and to be accountable for their actions. Shadow AI often results in the unlawful use of personal data due to a lack of a legal basis for the processing, unauthorised cross-border data transfers, and not having appropriate contractual protections in place with their AI service providers. Regulators do not see the convenience of employees as an excuse for not complying with the law, and therefore, the organisation is ultimately responsible for any violations that occur.

‍

3. Loss of Intellectual Property

Employees frequently use AI tools to speed up tasks involving proprietary information—debugging code, reviewing contracts, or summarising internal research. When done using unapproved AI platforms, this can expose trade secrets and intellectual property, eroding competitive advantage and creating long-term business risk.

‍

Real-Life Example: Samsung’s ChatGPT Data Leak

‍

In 2023, a case study exemplifying the Shadow AI risk occurred when Samsung Electronics placed a temporary ban on employee access to ChatGPT and other AI tools after reports from engineers revealed they were using ChatGPT to create debugging processes for internal source code and to summarise meeting notes. Consequently, confidential source code related to semiconductors was inadvertently uploaded onto a public AI platform. While there were no known incursions into the company’s system due to this incident, Samsung faced a significant challenge: once sensitive information is input into a public AI tool, it exists on external servers that are outside of the company’s purview or control.

As a result of this incident, Samsung restricted employee use of ChatGPT on corporate devices, issued a series of internal communications prohibiting the sharing of corporate data with public AI tools, and increased the urgency of their discussions regarding the adoption of secure, enterprise-level AI (artificial intelligence) solutions.

‍

What Organisations Are Doing Today

‍

Many organisations respond to Shadow AI risk by:

‍

1. Blocking access at the network level
2. Circulating warning emails or policies

‍

While these actions may reduce immediate exposure, they fail to address the root cause: employees still need AI to perform their jobs efficiently. As a result, bans often push AI usage underground, increasing Shadow AI rather than eliminating it.

‍

Why Blocking AI Does Not Work—Governance Does

‍

History has demonstrated that prohibition does not work - we see this when trying to block access to cloud storage, instant messaging and collaboration tools. Employees are forced to use personal devices and/or accounts when their employers block AI, which means employers do not have real-time visibility into how their employees are using these technologies, and creates friction with the security and compliance team as they try to enforce the types of tools their employees can use. Prohibiting AI adoption will not stop it from being adopted; it will just create a challenge for employers regarding how safe and responsible it is. The challenge for effective organisations is therefore to shift from denial and develop governance-first AI strategies aimed at controlling data usage, protection and security, rather than merely restricting access to a list of specific tools.

‍

Shadow AI: A Silent Legal Liability Under the GDPR

‍

Shadow AI isn't a problem for the Information Technology Department; it is a failure of Governance, Compliance and Law. By using AI tools that have not been approved as a result, the organisation processes personal data without a lawful basis (Article 6 of the General Data Protection Regulation (GDPR)), repurposes data for use beyond its original intent and in breach of the Purpose Limitation (Article 5(1)(b)), and routinely exceeds necessity and in breach of Data Minimisation (Article 5(1)(c)). The outcome of these actions is the use of tools that involve International Data Transfers Without Authorisation and are therefore in breach of Chapter V, and violate Article 32 because there are no enforceable safeguards in place. Most significantly, the failure to demonstrate Oversight, Logging and Control under Articles 5(2) and 24 constitutes a failure in Accountability. Therefore, from a Regulatory perspective, Shadow AI is not accidental and is not defensible.

The Right Solution: Secure and Governed AI Adoption

‍

1. Provide Approved AI Tools

‍

Employers have an obligation to supply business-approved AI technology for helping workers to be productive while maintaining maximum protections, like storing data separately and not using employees' data for training a model; defining how long data is kept, and the rules around deleting that data. When employees are provided with verified and secure AI options that align with their work processes, they will rely significantly less on Shadow AI.

‍

2. Enforce Zero-Trust Data Access

‍

The governance of AI systems must follow the principles of "zero trust," granting access to data only through the principle of "least privilege," which means that data access will only be allowed by the system user, and providing continuous verification of user-identity and context; this supports and helps establish context-aware controls to monitor and track all user activities, which will be especially important as agent-like AI systems become increasingly autonomous and are capable of operating at machine-speed where even small errors in configuration, will result in rapid and large expose to data.

‍

3. Apply DLP and Audit Logging

‍

It is important to have robust data loss prevention measures in place to protect sensitive data that is sent outside an organisation. The first end user or machine that accesses the data should be detailed in a comprehensive audit log that indicates when and how the data is accessed. In combination with other controls, these measures create accountability, comply with regulations, and assist with appropriately detecting and responding to incidents.

‍

4. Maintain Visibility Across AI, Cloud, and SaaS

‍

Security teams need unified visibility across AI tools, personal cloud applications, and SaaS platforms. Risks move across systems, and controls must follow the data wherever it flows.

Conclusion

‍

This new threat exposes an organisation to the risk of data loss through leaks, regulatory fines, liability for the loss of intellectual property, and reputational damage, all of which can occur without any intent to cause harm. The way forward is not to block AI, but to adopt a clear framework built on governance, visibility, and secure enablement. This approach allows organisations to use AI with confidence, while ensuring trust, accountability, and effective oversight to protect data and support AI in reaching its full transformative potential. AI use is encouraged, but it must be done responsibly, ethically, and securely.

‍

References 

‍

1. https://bronson.ai/resources/shadow-ai/
2. https://www.varonis.com/blog/shadow-ai
3. https://www.waymakeros.com/learn/gdpr-hipaa-shadow-ai-compliance-nightmare
4. https://www.forbes.com/sites/siladityaray/2023/05/02/samsung-bans-chatgpt-and-other-chatbots-for-employees-after-sensitive-code-leak/
5. https://www.usatoday.com/story/special/contributor-content/2025/05/23/shadow-ai-the-hidden-risk-in-todays-workplace/83822081007

‍

Introduction

Election misinformation poses a major threat to democratic processes all over the world. The rampant spread of misleading information intentionally (disinformation) and unintentionally (misinformation) during the election cycle can not only create grounds for voter confusion with ramifications on election results but also incite harassment, bullying, and even physical violence. The attack on the United States Capitol Building in Washington D.C., in 2021, is a classic example of this phenomenon, where the spread of dis/misinformation snowballed into riots. 

Election Dis/Misinformation 

Election dis/misinformation is false or misleading information that affects/influences public understanding of voting, candidates, and election integrity. The internet, particularly social media, is the foremost source of false information during elections. It hosts fabricated news articles, posts or messages containing incorrectly-captioned pictures and videos, fabricated websites, synthetic media and memes, and distorted truths or lies. In a recent example during the 2024 US elections, fake videos using the Federal Bureau of Investigation’s (FBI) insignia alleging voter fraud in collusion with a political party and claiming the threat of terrorist attacks were circulated. According to polling data collected by Brookings, false claims influenced how voters saw candidates and shaped opinions on major issues like the economy, immigration, and crime. It also impacted how they viewed the news media’s coverage of the candidates’ campaign. The shaping of public perceptions can thus, directly influence election outcomes. It can increase polarisation, affect the quality of democratic discourse, and cause disenfranchisement. From a broader perspective, pervasive and persistent misinformation during the electoral process also has the potential to erode public trust in democratic government institutions and destabilise social order in the long run.  

Challenges In Combating Dis/Misinformation

‍

1. Platform Limitations:  Current content moderation practices by social media companies struggle to identify and flag misinformation effectively. To address this, further adjustments are needed, including platform design improvements, algorithm changes, enhanced content moderation, and stronger regulations.

2. Speed and Spread: Due to increasingly powerful algorithms, the speed and scale at which misinformation can spread is unprecedented. In contrast, content moderation and fact-checking are reactive and are more time-consuming. Further, incendiary material, which is often the subject of fake news, tends to command higher emotional engagement and thus, spreads faster (virality). 

3. Geopolitical influences: Foreign actors seeking to benefit from the erosion of public trust in the USA present a challenge to the country's governance, administration and security machinery. In 2018, the federal jury indicted 11 Russian military officials for alleged computer hacking to gain access to files during the 2016 elections.  Similarly, Russian involvement in the 2024 federal elections has been alleged by high-ranking officials such as White House national security spokesman John Kirby, and Attorney General Merrick Garland. 

4. Lack of Targeted Plan to Combat Election Dis/Misinformation:  In the USA,  dis/misinformation is indirectly addressed through laws on commercial advertising, fraud, defamation, etc. At the state level, some laws such as Bills AB 730, AB 2655, AB 2839, and AB 2355 in California target election dis/misinformation. The federal and state governments criminalize false claims about election procedures, but the Constitution mandates  “breathing space” for protection from false statements within election speech. This makes it difficult for the government to regulate election-related falsities.

‍

‍

CyberPeace Recommendations

1. Strengthening Election Cybersecurity Infrastructure: To build public trust in the electoral process and its institutions, security measures such as updated data protection protocols, publicized audits of election results, encryption of voter data, etc. can be taken. In 2022, the federal legislative body of the USA  passed the Electoral Count Reform and Presidential Transition Improvement Act (ECRA), pushing reforms allowing only a state’s governor or designated executive official to submit official election results, preventing state legislatures from altering elector appointment rules after Election Day and making it more difficult for federal legislators to overturn election results. More investments can be made in training, scenario planning, and fact-checking for more robust mitigation of election-related malpractices online. 
2. Regulating Transparency on Social Media Platforms: Measures such as transparent labeling of election-related content and clear disclosure of political advertising to increase accountability can make it easier for voters to identify potential misinformation. This type of transparency is a necessary first step in the regulation of content on social media and is useful in providing disclosures, public reporting, and access to data for researchers. Regulatory support is also required in cases where popular platforms actively promote election misinformation.
3. Increasing focus on ‘Prebunking’ and Debunking Information: Rather than addressing misinformation after it spreads, ‘prebunking’ should serve as the primary defence to strengthen public resilience ahead of time. On the other hand, misinformation needs to be debunked repeatedly through trusted channels. Psychological inoculation techniques against dis/misinformation can be scaled to reach millions on social media through short videos or messages.
4. Focused Interventions On Contentious Themes By Social Media Platforms: As platforms prioritize user growth, the burden of verifying the accuracy of posts largely rests with users. To shoulder the responsibility of tackling false information, social media platforms can outline critical themes with large-scale impact such as anti-vax content, and either censor, ban, or tweak the recommendations algorithm to reduce exposure and weaken online echo chambers. 
5. Addressing Dis/Information through a Socio-Psychological Lens: Dis/misinformation and its impact on domains like health, education, economy, politics, etc. need to be understood through a psychological and sociological lens, apart from the technological one. A holistic understanding of the propagation of false information should inform digital literacy training in schools and public awareness campaigns to empower citizens to evaluate online information critically. 

‍

Conclusion

According to the World Economic Forum’s Global Risks Report 2024, the link between misleading or false information and societal unrest will be a focal point during elections in several major economies over the next two years. Democracies must employ a mixed approach of immediate tactical solutions, such as large-scale fact-checking and content labelling, and long-term evidence-backed countermeasures, such as digital literacy, to curb the spread and impact of dis/misinformation.

‍

Sources

•  https://www.cbsnews.com/news/2024-election-misinformation-fbi-fake-videos/ 
•  https://www.brookings.edu/articles/how-disinformation-defined-the-2024-election-narrative/ 
•  https://www.fbi.gov/wanted/cyber/russian-interference-in-2016-u-s-elections
• https://indianexpress.com/article/world/misinformation-spreads-fear-distrust-ahead-us-election-9652111/ 
•  https://academic.oup.com/ajcl/article/70/Supplement_1/i278/6597032#377629256 
• https://www.brennancenter.org/our-work/policy-solutions/how-states-can-prevent-election-subversion-2024-and-beyond 
•  https://www.bbc.com/news/articles/cx2dpj485nno 
• https://msutoday.msu.edu/news/2022/how-misinformation-and-disinformation-influence-elections 
• https://misinforeview.hks.harvard.edu/article/a-survey-of-expert-views-on-misinformation-definitions-determinants-solutions-and-future-of-the-field/ 
• https://reutersinstitute.politics.ox.ac.uk/sites/default/files/2023-06/Digital_News_Report_2023.pdf 
• https://www.weforum.org/stories/2024/03/disinformation-trust-ecosystem-experts-curb-it/ 
• https://www.apa.org/topics/journalism-facts/misinformation-recommendations 
• https://mythvsreality.eci.gov.in/ 
• https://www.brookings.edu/articles/transparency-is-essential-for-effective-social-media-regulation/ 
• https://www.brookings.edu/articles/how-should-social-media-platforms-combat-misinformation-and-hate-speech/ 

‍

Introduction

Imagine spending two years , 730 days of early mornings, missed social events, and relentless mock tests  preparing for a single examination. Now imagine that on the morning of that exam, your phone buzzes with a forwarded video claiming the question paper has already leaked. Your heart sinks. You do not know whether to trust it or ignore it. You have about forty minutes before you must enter the hall. This was the reality for a section of the 22 lakh students who sat for the NEET UG 2026 re-examination on June 21, 2026, when a fabricated video alleging a paper leak on Telegram began circulating across WhatsApp groups and X within hours of the exam commencing. The National Testing Agency (NTA) swiftly and categorically denied the claims, activated the Indian Cyber Crime Coordination Centre (I4C), and appealed to the public not to amplify unverified content. The examination concluded without incident. But the episode laid bare a challenge that no security perimeter or surveillance camera can fully address: the weaponisation of misinformation against India's high-stakes examination ecosystem.

‍

The Anatomy of Examination Misinformation

‍

Why Examinations Are a Prime Target

India's national examinations are uniquely fertile ground for misinformation. With over 22 lakh candidates registered for NEET UG 2026 alone, the audience is vast, anxious, and hungry for any update  verified or otherwise. Research by MIT has found that false stories spread six times faster than accurate ones on social media, and are seventy percent more likely to be reshared. In India, where over 535 million people use WhatsApp and studies show that most users tend to trust messages forwarded by family and friends, the conditions for viral misinformation are near-ideal. According to a 2020 Microsoft survey, 52 percent of Indian respondents encountered misinformation at least once a day, the highest rate globally.

What makes examination-related misinformation especially dangerous is its timing. Fabricated content is almost always released on examination day itself, the precise moment when candidates are most emotionally vulnerable, official channels are stretched thin, and the window for effective rebuttal is narrowest. The NEET UG 2026 fake video, circulated on Telegram and amplified across closed WhatsApp groups, fits this pattern precisely. It was engineered not to inform, but to destabilise.

‍

A History That Sharpens the Anxiety

This misinformation did not emerge in a vacuum. The shadow of the 2024 NEET UG controversy  in which the Supreme Court of India confirmed that at least 155 students had directly benefited from a genuine paper leak, and which triggered nationwide protests, CBI investigations, and a parliamentary uproar — still looms large. Students and parents conditioned by that experience are primed to believe the worst, even when claims are entirely false. In 2026, that residual anxiety became the very vulnerability that bad actors sought to exploit. The government's response which included temporarily restricting access to Telegram in the lead-up to the re-examination  underscored just how seriously the threat of examination misinformation is now being taken at the highest levels.

‍

The NTA's Response: Why It Matters

‍

1. Speed and Transparency as Governance Tools: In crisis communication, the first credible voice usually wins. The NTA's near-immediate public denial posted on official social media handles and amplified by the Press Information Bureau's PIB Fact Check unit was a meaningful departure from the delayed, defensive responses that characterised earlier examination controversies. By directly labelling the video "FAKE" in capital letters, describing its creation as "a serious offence," and simultaneously appealing to students to rely only on official sources at neet.nta.nic.in, the NTA left little room for the false narrative to consolidate. NTA Director General Abhishek Singh went further, publicly stating that the agency was "100 per cent confident" in the integrity of the process and that no complaints of a genuine paper leak had been received. This matters beyond crisis management. Public trust in examination systems is not rebuilt through official statements alone , it is rebuilt through the consistent, transparent exercise of institutional authority. A swift, fact-based rebuttal, deployed before rumour hardens into public belief, is as much a governance act as it is a communications strategy.

‍

2. Cybercrime Coordination as a Structural Shift: Perhaps the most significant development in the NTA's response was its coordination with I4C and law enforcement agencies to trace the origin of the fabricated video. This signals a structural evolution: examination misinformation is no longer being treated as an administrative inconvenience but as cybercrime with legal consequences under the Information Technology Act, 2000. The announcement that legal action would follow also carries a deterrent message to potential future actors — that the machinery of cybercrime enforcement will be activated, and that fabricating content to mislead examination candidates is a prosecutable offence.

‍

The Human and Institutional Cost

The costs of examination misinformation are neither abstract nor trivial. Mental health experts have warned that controversies surrounding national-level examinations can have serious long-term psychological consequences for aspirants. Dr. Mustafa Nadeem Kirmani of Amity University has noted that such crises increase the risk of students taking "extreme steps like suicide attempts, anger toward the system, and hopelessness," and can, in the long run, lead to clinical depression. In the wake of the 2026 paper leak controversy, multiple reports of student deaths by suicide were linked to the compounded pressures of exam cancellation and uncertainty a grim reminder of the real human stakes behind governance failures in this domain. For institutions, every viral misinformation episode generates an avoidable administrative crisis. Helplines are overwhelmed, examination centre staff face panicked queries, and senior officials are pulled into damage control rather than exam administration. The credibility of clarifications issued under pressure is itself questioned by a public already primed for suspicion. This administrative burden, multiplied across 5,440 examination centres in India and 14 abroad, represents a significant and entirely unnecessary cost.

‍

Building a Resilient Ecosystem: What Needs to Change

‍

1. Proactive Communication and Platform Coordination: Institutional credibility is built before a crisis, not during one. Examination bodies must invest in sustained pre-examination communication that educates candidates and parents about the existence of misinformation campaigns and tells them exactly where to look for verified updates. This means highly visible, verified social media presences with large followings, real-time update protocols, and formal escalation channels with platforms like WhatsApp, Telegram, X, and YouTube to enable rapid takedown of false examination-related content. The IT Amendment Rules of 2023, which require significant social media intermediaries to act on government-flagged content, provide a legal basis for such coordination  but the operational infrastructure to activate it at speed must be built in advance, not improvised on the day.

‍

2. Fact-Checking Partnerships and Digital Literacy: Independent organisations such as BOOM Live, Alt News, and Vishvas News have proven their capacity to rapidly debunk examination misinformation. Formalising their role through a structured public-private partnership  where examination authorities share real-time verified information with empanelled fact-checkers  could close the window during which false content circulates unchallenged. Equally critical is investment in digital media literacy among students and parents. A 2018 survey found that nearly 45 percent of Indian respondents were unaware of any fact-checking organisations. Addressing this gap through school curricula, coaching networks, and the Ministry of Education's DIKSHA platform  is a preventive investment far less costly than repeated crisis management.

‍

Conclusion

‍

The NTA's handling of the NEET UG 2026 fake video was, by recent standards, exemplary. It was fast, transparent, authoritative, and backed by the activation of cybercrime enforcement. But a single well-managed episode does not constitute a resilient system. India runs some of the world's largest entrance examinations, and the stakes medical seats, livelihoods, and the aspirations of crores of young people are too high for crisis response alone to suffice. Combating examination misinformation requires permanent structural investment: dedicated rapid-response cells within examination bodies, formalised fact-checking pipelines, proactive platform coordination, and a sustained public education effort around digital verification. Protecting the integrity of India's examination ecosystem is not merely an administrative responsibility. It is a commitment to the millions of students who give everything they have to compete fairly and who deserve a system that protects them not only from cheating, but from the fear of it.

‍

References

‍

1. https://timesofindia.indiatimes.com/articleshow/131900261.cms
2. https://www.india.com/education/neet-ug-2026-re-exam-paper-leak-claim-goes-viral-nta-says-video-is-fake-and-false-fabricated-examination-conducted-successfully-8453620/
3. https://www.republicworld.com/education/neet-ug-re-exam-nta-says-paper-leak-video-fake-test-conducted-successfully-2026-06-22-129346
4. https://thefederal.com/category/education/neet-re-exam-paper-leak-admission-system-crisis-247410
5. https://www.outlookindia.com/healthcare-spotlight/beyond-the-paper-leak-emotional-trauma-among-neet-aspirants-raises-concern
6. https://en.wikipedia.org/wiki/2024_NEET_controversy
7. https://kaval.chat/blog/misinformation-scam-statistics-india-2026/
8. https://www.ijert.org/the-virality-gap-political-misinformation-and-the-information-crisis-in-india-s-digital-democracy-ijertv15is050041
9. https://www.science.org/doi/10.1126/science.aap9559 https://www.microsoft.com/en-us/digital-skills/digital-civility
10. https://www.meity.gov.in/content/information-technology-intermediary-guidelines-and-digital-media-ethics-code-amendment
11. https://www.indiacode.nic.in/handle/123456789/1999 
12. https://pib.gov.in/PressReleasePage.aspx 
13. https://www.careerindia.com/news/addressing-the-mental-health-crisis-sparked-by-net-and-neet-paper-leaked-in-india-041963.html
14. https://thediplomat.com/2025/03/indias-growing-misinformation-crisis-a-threat-to-democracy/

‍