#FactCheck: Old Ukraine Blast Video Falsely Shared as Iran Strike on Israeli Nuclear Site

Introduction

‍

In January 2026, the Basic Act on the Development of Artificial Intelligence and the Establishment of a Foundation for Trustworthiness came into effect in South Korea, establishing one of the first national AI laws in the world. The bill, enacted by the National Assembly of Korea in December 2024 and implemented from January 22, 2026, aims to strike a balance between the rapid advancement of technology and clear safeguards against risks, as well as transparency, accountability, and responsible AI use. It puts Seoul and the European Union on the frontline of developing legal systems for artificial intelligence and indicates a long-term goal of becoming an AI power on the global stage.

‍

What the AI Basic Act Covers

‍

The AI Basic Act consists of 19 separate AI bills that are merged into a single piece of legislation that covers the lifecycle of AI, including research and development, deployment, and utilisation. It is very wide in its coverage: it refers to any AI system that influences the Korean market or users inside the country, irrespective of the country in which it is created. The law does not apply to national defence and security applications.

The law defines key concepts like artificial intelligence, generative AI, and high-impact AI and establishes the principles of ethical AI, safety, user rights, industry support, and national policy coordination. It also offers a legal foundation for the activities of the government to promote AI innovation without jeopardising the common good.

Fundamentally, the AI Basic Act is designed to establish a culture of trust between businesses and the government/citizens. It does not prohibit AI technologies and does not excessively limit innovation. Instead, it creates the framework of responsible development and economic growth.

‍

Guardrails for Safety and Accountability

‍

One of the defining features of the AI Basic Act is its risk-based approach. Rather than considering all AI systems as similar, it makes a distinction between ordinary and high-impact AI systems, the ones applied in sectors where the wrong or unsafe decision can have a major impact on the safety, rights, or critical infrastructure of the population. Some of them can be seen in healthcare, transportation, financial services, education, and public services.

The high-impact AI operators must integrate risk management plans, human controls, and surveillance systems. In critical decision-making situations, human control should be available at all times; that is, machines can help but not override human control where human safety or other human rights are involved.

The law enables the regulators to perform on-site checks, demand documentation, and conduct compliance investigations. Fines for breaches may go up to 30 million Korean won (approximately 21,000 US dollars). It has a one-year period of transition that is based on guidance but not enforcement, thus allowing companies time to implement compliance measures before imposing fines.

These requirements contribute to enhancing accountability by defining who is accountable for the safety outcomes. The law in South Korea is placed in the ecosystem, as opposed to the methods in which industry self-governance alone is utilised. 

‍

Transparency and Labelling Requirements

‍

The AI Basic Act is based on transparency. The legislation ensures that users are notified before an AI system is operating, particularly with the generation of AI outputs that could be confused with human-created material. As an example, AI-generated text, images, video, or audio that may be difficult to distinguish between reality and fake must have obvious labels or watermarks to allow users to understand the source of the content.

The necessity to label is meant to fight misinformation, misleading activities, and unintended influence on the perception of the people. It is based on international anxiety regarding AI-generated content, such as deepfakes, manipulated media, and misleading online advertisements that have already been addressed separately in policy by South Korea, as well as discussions of data governance.

The transparency is also applied to the process of decision-making in AI systems. Developers and operators should be able to give explicit information about the way in which high-impact systems make their conclusions so that those who are victims of automated decisions can seek meaningful explanations. Although specific explainability criteria are in the process of being developed, the law grounds the principle that AI cannot act behind the scenes in situations where crucial decisions are being made.

‍

Data Privacy and User Protection

‍

The AI governance practice in South Korea is complementary to its current data protection laws, the Personal Information Protection Act (PIPA), which is broadly regarded as equivalent to major international data protection regulations like the GDPR in regard to personal data laws. The AI Basic Act provides an explanation as to how the data can be gathered, processed, and utilised within AI systems with regard to privacy rights, particularly in areas of high impact.

The law does not supersede the personal data protection policies, but it sets certain conditions on how AI developers must address the data to be utilised in training, testing, and running AIs. Operators will be required to document their data workflows and demonstrate how they guard the privacy of their users, including by transparency and consent mechanisms where necessary. This can assist in ensuring that the information that is utilised in AI functions is regulated by definite norms, and it is more difficult to avoid privacy requirements in the name of innovation.

‍

Accountability and Governance Infrastructure

‍

The AI Basic Act establishes a national policy framework of AI governance. The National Artificial Intelligence Strategy Committee, chaired by the President, is at the top and proposes the overall AI policy and aligns it with national objectives. The organisations that would support this are the specialised organisations that deal with safety, risk assessment, and research and the policy centre that would analyse the effects of AI on society and assist in its adoption by the industry.

This institutional structure facilitates strategic guidance as well as operational control. It is through incorporating AI governance in the administration of the people, but not into the market forces, that South Korea wishes to have the ethical and societal concerns become part of the sectors and agencies.

‍

Promoting Innovation and Industrial Support

‍

Although the AI Basic Act does not disregard regulation, it is not a law of restrictions. It also offers legal justification for research and development, human capital, and the growth of the AI industry, with special consideration for startups and small and medium-sized businesses. The legislation promotes AI clusters, long-term funding programmes, and policies to bring foreign talent to the Korean AI ecosystem.

This bidimensional approach of compliance and support is indicative of the broader desire of Korea to become one of the leading AI powers in the world, along with the US and China. The government has pointed out that it will encourage trust by having clear and predictable rules that will attract investment and maintain innovation and not stifle it.

‍

What This Means Globally

‍

The AI Basic Act of South Korea is not only interesting in its contents but also in its timing. It is also among the first thorough AI legislations to come into force in the world, and it beats the gradual regulatory implementations in other parts of the globe, like the European Union. Its system incorporates a principle-based framework, transparency requirements, accountability regulations, and industrial support, which reflects a contrasting model to either pure prescriptive risk regulation or lax self-regulation models elsewhere.

Other critics, such as industry groups and civil society organisations, have suggested that some of the protections may be more explicit, in particular to those who are harmed by AI systems, or to establish high-impact categories. Nonetheless, the framework sets a benchmark upon which most nations will pay close attention when they establish their own AI regimes.

‍

Conclusion

‍

The AI Basic Act puts South Korea at the forefront of national AI regulation, including very well-developed guardrails that enforce transparency, ethical control, accountability, and data protection in addition to fostering innovation. It recognises that AI could lead to economic and social advantages, yet also actual risks, particularly when systems are opaque, autonomous, or widely implemented. South Korea has gone holistically in responsible AI governance by integrating human oversight, labelling requirements, risk management planning, and governance infrastructure into law to be emulated by other countries in the years to come.

Sources

‍

• https://www.theguardian.com/world/2026/jan/29/south-korea-world-first-ai-regulation-laws 
• https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/10/artificial-intelligence-and-the-labour-market-in-korea_af668423/68ab1a5a-en.pdf 
• https://asianintelligence.ai/south-korea 
• https://aibasicact.kr/ 
• https://aibusinessweekly.net/p/south-korea-ai-basic-act-takes-effect-jan22-2026 
• https://asiadaily.org/news/12112/ 

‍

Introduction

India's National Commission for Protection of Child Rights (NCPCR) is set to approach the Ministry of Electronics and Information Technology (MeitY) to recommend mandating a KYC-based system for verifying children's age under the Digital Personal Data Protection (DPDP) Act. The decision to approach or send recommendations to MeitY was taken by NCPCR in a closed-door meeting held on August 13 with social media entities. In the meeting, NCPCR emphasised proposing a KYC-based age verification mechanism. In this background, Section 9 of the Digital Personal Data Protection Act, 2023 defines a child as someone below the age of 18, and Section 9 mandates that such children have to be verified and parental consent will be required before processing their personal data.

Requirement of Verifiable Consent Under Section 9 of DPDP Act

Regarding the processing of children's personal data, Section 9 of the DPDP Act, 2023, provides that for children below 18 years of age, consent from parents/legal guardians is required. The Data Fiduciary shall, before processing any personal data of a child or a person with a disability who has a lawful guardian, obtain verifiable consent from the parent or lawful guardian. Additionally, behavioural monitoring or targeted advertising directed at children is prohibited. 

Ongoing debate on Method to obtain Verifiable Consent

Section 9 of the DPDP Act gives parents or lawful guardians more control over their children's data and privacy, and it empowers them to make decisions about how to manage their children's online activities/permissions. However, obtaining such verifiable consent from the parent or legal guardian presents a quandary. It was expected that the upcoming 'DPDP rules,' which have yet to be notified by the Central Government, would shed light on the procedure of obtaining such verifiable consent from a parent or lawful guardian.

However, In the meeting held on 18th July 2024, between MeitY and social media companies to discuss the upcoming Digital Personal Data Protection Rules (DPDP Rules), MeitY stated that it may not intend to prescribe a ‘specific mechanism’ for Data Fiduciaries to verify parental consent for minors using digital services. MeitY instead emphasised obligations put forth on the data fiduciary under section 8(4) of the DPDP Act to implement “appropriate technical and organisational measures” to ensure effective observance of the provisions contained under this act. 

In a recent update, MeitY held a review meeting on DPDP rules, where they focused on a method for determining children's ages. It was reported that the ministry is making a few more revisions before releasing the guidelines for public input.

CyberPeace Policy Outlook

CyberPeace in its policy recommendations paper published last month, (available here) also advised obtaining verifiable parental consent through methods such as Government Issued ID, integration of parental consent at ‘entry points’ like app stores,  obtaining consent through consent forms, or drawing attention from foreign laws such as California Privacy Law, COPPA, and developing child-friendly SIMs for enhanced child privacy.

CyberPeace in its policy paper also emphasised that when deciding the method to obtain verifiable consent, the respective platforms need to be aligned with the fact that verifiable age verification must be done without compromising user privacy. Balancing user privacy is a question of both technological capabilities and ethical considerations. 

DPDP Act is a brand new framework for protecting digital personal data and also puts forth certain obligations on Data Fiduciaries and provides certain rights to Data Principal. With upcoming ‘DPDP Rules’ which are expected to be notified soon, will define the detailed procedure for the implementation of the provisions of the Act. MeitY is refining the DPDP rules before they come out for public consultation. The approach of NCPCR is aimed at ensuring child safety in this digital era. We hope that MeitY comes up with a sound mechanism for obtaining verifiable consent from parents/lawful guardians after taking due consideration to recommendations put forth by various stakeholders, expert organisations and concerned authorities such as NCPCR. 

References

1. https://www.moneycontrol.com/technology/dpdp-rules-ncpcr-to-recommend-meity-to-bring-in-kyc-based-age-verification-for-children-article-12801563.html
2. https://pune.news/government/ncpcr-pushes-for-kyc-based-age-verification-in-digital-data-protection-a-new-era-for-child-safety-215989/#:~:text=During%20this%20meeting%2C%20NCPCR%20issued,consent%20before%20processing%20their%20data
3. https://www.hindustantimes.com/india-news/ncpcr-likely-to-seek-clause-for-parents-consent-under-data-protection-rules-101724180521788.html
4. https://www.drishtiias.com/daily-updates/daily-news-analysis/dpdp-act-2023-and-the-isssue-of-parental-consent

‍

Introduction
‍

In April 2026, Anthropic revealed Claude Mythos, an artificial intelligence application capable of finding security flaws in computer networks more effectively than human beings. The corporation claimed to have found hundreds of thousands of substantially serious vulnerabilities in established desktop operating systems and web-based browsers that have not been used for at least 20 years. This news has greatly alarmed those responsible for leading financial organisations, banks, and governments throughout the world. Nevertheless, this news demonstrates a much larger problem: we do not have enough cybersecurity professionals trained to do this kind of work. At the current estimate, there are 4.8 million cyber security professionals short of what is needed globally. There is a need to develop different kinds of workforce training programs to help prepare these professionals as we continue to see the emergence of new AI technologies.

‍

What Is Claude Mythos ?
‍

Anthropic created Claude Mythos as part of its Claude AI system, competing against ChatGPT and Google Gemini. In April 2026, expert testing revealed Mythos excelled at identifying problems in legacy code and suggested exploitation methods. It found a vulnerability that had existed for 27 years. Because of these advanced capabilities, Anthropic restricted access through “Project Glasswing,” giving it only to 12 major tech companies and 40 organizations managing critical software. Canadian Finance Minister François-Philippe Champagne called it an “unknown unknown.” Andrew Bailey of the Bank of England said regulators needed to examine what Mythos could mean for financial attacks. The European Union raised concerns. India’s Finance Minister Nirmala Sitharaman warned at SEBI’s Foundation Day on April 25, 2026, that cybersecurity is the single most pressing challenge facing markets today. She stated a single successful cyberattack on a major exchange or large broker could disrupt markets nationally and shake public confidence for years. Sitharaman emphasized that AI tools make attacks faster, more adaptive, and autonomous, capable of discovering system vulnerabilities and manipulating code.

‍

The Real Problem: Discovery Versus Fixing
‍

Mythos highlights a fundamental mismatch in cybersecurity. Finding a vulnerability does not guarantee it will be fixed. Organizations face challenges patching systems. Many use obsolete technology, and updates can break dependent components. Organizations in developing nations often lack financial resources for repairs or downtime. Critical systems like hospitals, banks, and power grids cannot go offline. Before Mythos, human hackers found vulnerabilities slowly. Now AI tools find weaknesses faster than they can be fixed, creating a dangerous gap. Ciaran Martin, former head of the UK’s National Cyber Security Centre, explained that Mythos is “a really good hacker” against unprotected systems. Organizations following basic security practices—regular updates, strong passwords, network protection, trained staff can likely defend against it. The UK AI Safety Institute concluded Mythos poses the biggest threat to poorly defended systems, noting: “We cannot say for sure whether Mythos Preview would be able to attack well-defended systems.”

‍

The Workforce Challenge
‍

The Mythos announcement exposes the real problem: we lack enough trained cybersecurity workers. There is a global shortage of 4.8 million workers against a current workforce of 5.5 million. In AI security specifically, 34 percent of needed skills are missing. But the harder problem is that AI is changing needed skills. Entry-level jobs monitoring security alerts are being automated. These were traditional career starting points. Young people learned basic skills and moved to advanced roles. Now these positions disappear while new AI security jobs emerge for which nobody has training. Organizations cannot hire fast enough for new AI roles because few people have these skills. This leads to a vicious cycle. With fewer entry-level positions available, there will be fewer young adults entering the job market which results in even fewer workers with this skill set; thus, the shortage of qualified applicants increases; this thereby increases organizations’ vulnerability. Without action taken immediately, this issue will continue to worsen 

‍

Way Forward
‍

1. Clarify What Skills We Need

Governments and industry must work together to define what cybersecurity workers need in an AI world. Currently, aspiring professionals study networking, software, and vulnerability finding, but AI security training barely exists. Governments should work with universities and companies to clarify needed skills: understanding what AI tools can and cannot do in security, finding and fixing AI system problems.

2. Support Workers Who Lose Jobs To Automation

Workers who find themselves losing their jobs due to automation will require government support. All too often without an alternative, these skilled and trained workers will leave their profession forever. The government will need to provide funding for training of displaced employees, support for those changing careers to become cyber security professionals.

3. Create Clear Rules For AI Security Tools

When companies create powerful security tools, governments must understand their capabilities and risks. Companies should be required to thoroughly test tools before release, clearly explain what tools can do and their limitations, and explain safety and misuse prevention plans. Governments should monitor actual tool usage, not simply trust voluntary compliance.

4. Focus On Basic Security First

Most attacks do not need advanced AI tools. They succeed because organizations have not implemented basic security. Some never update software, train employees, use strong passwords, protect data properly, or test defenses. Governments should require organizations, especially those managing critical systems, to implement these basics.

‍

Conclusion
‍

Claude Mythos matters not because it is a weapon of destruction, but because it forces hard questions: Do we have enough skilled workers? Are our systems well-protected? The answer is no. We face a shortage of 4.8 million cybersecurity workers and lack AI security training. Yet this is also an opportunity. Governments can invest in training, strengthen defenses, and create clear rules for AI security tools. Governments, organizations and educational institutions must collaborate to create viable Cybersecurity career pathways. We can act through either creating panic or creating a trained and prepared workforce to meet today’s challenges. The time is now.

‍

References 
‍

1. https://www.bbc.com/news/articles/crk1py1jgzko
2. https://red.anthropic.com/2026/mythos-preview/ 
3. https://www.anthropic.com/project/glasswing 
4. https://www.aisi.gov.uk/blog/our-evaluation-of-claude-mythos-previews-cyber-capabilities 
5. https://www.bsg.ox.ac.uk/people/ciaran-martin 
6. https://www.isc2.org/Insights/2024/10/Cybersecurity-Workforce-INSIGHTS-October-2024 
7. https://decrypt.co/364141/anthropic-claude-mythos-serious-threat-overhyped-ai-security-institute 
8. https://www.businesstoday.in/latest/economy/story/fm-nirmala-sitharaman-wants-sebi-regulated-entities-to-remain-exceptionally-vigilant-heres-why-527437-2026-04-25 
9. https://www.theweek.in/news/biz-tech/2026/04/25/sebi-38th-anniversary-cybersecurity-concerns.html 

‍