Emergency management worries adversaries could deepfake the emergency manager during a crisis. How should this appear in AI threat work?

Emergency management must map AI-enabled deepfake impersonation of the emergency manager into the civic threat register and plan detection and response cues. Deepfakes are AI-facilitated social engineering that can inject false directives during crises, undermining public trust and operational coordination. Registering the threat works because preparedness depends on named scenarios, verification protocols (out-of-band confirmation, passphrase/code words, multi-channel checks), and staff training—not after-the-fact surprise.

Mapping AI-enabled deepfake impersonation into the civic threat register for email gateway filtering updates fails because it reduces a civic AI-enabled impersonation threat to an email security problem, missing the broader need for verification protocols, out-of-band confirmation, and public-facing crisis coordination. Mapping AI-enabled deepfake impersonation in the civic threat register as hallucination for accuracy review fails because a deliberate adversarial deepfake is a security threat, not a model training error, and treating it as an accuracy issue skips the detection and response cues the crisis demands. Mapping AI-enabled deepfake impersonation into the civic threat register for sentiment trend reporting reviews fails conceptually: sentiment reporting is passive observation, not a viable crisis response, and it leaves the organization without detection cues, verification procedures, or a plan to act when a fake directive goes out.

Exam caveat: deepfake risk includes audio and video, and internal coordination channels can be targeted as well as public broadcasts. Operational check: add deepfake impersonation to the threat register with owners, publish verification procedures for high-impact directives, run a tabletop injecting a fake executive message, and measure whether staff use the out-of-band check before acting.