A municipal legal brief warns security teams about using deepfake likenesses of residents during internal demos. What constraint should the purple team apply?
Select an answer to reveal the explanation.
Short Explanation
Security theater does not get a free pass to fake your neighbors' faces. Policy, consent, and minimization still apply inside the building. Use approved actors or synthetic stand-ins, not random resident likenesses.
Full Explanation
A municipal legal brief warning security teams about deepfake likenesses of residents during internal demos requires purple teams to follow policy and consent rules: do not publish or demo uncontrolled deepfakes of residents even for security awareness. Civic ethics, privacy expectations, and often local policy or law constrain use of resident biometric and likeness data. Approved actors, consented volunteers, or clearly synthetic stand-ins are appropriate substitutes. Security training goals do not create a free pass to fabricate neighbors' faces or voices.
Allowing any security demo to deepfake residents merely because the file stays on a USB stick still violates consent and policy constraints and risks leakage. Treating resident likenesses as public domain for all city cybersecurity exercises is incorrect and unsafe. Restricting consent requirements to video only while leaving audio clones unrestricted ignores that voice is also a likeness and identity attribute subject to the same civic constraints.
Exam caveat: ethical-use questions prioritize consent, minimization, and policy over convenience or 'it's just training' rationales.
Operational check for municipal purple teams: obtain legal and privacy review for awareness media; use synthetic or consented stand-ins; watermark training content; prohibit uncontrolled resident deepfakes on portable media; and document ROE so awareness production never becomes an unauthorized likeness factory.