Chapter VII –Security Control and Management of Deepfake Prevention |
| Article 39 | (Definition of deepfake)
Forms of technologies of computer-generated imagery or other technologies that allow production or dissemination of video recording, motion graphics, audio recording, electronic images, photographs and any verbal words or behaviors showing the behaviors of a real person that have not occurred.
|
|
| Article 40 | (Control and management of identity verification of telephone trading)
- When providing telephone trading services, an organization shall establish the identify verification procedure (e.g. voice password) to prevent unauthorized uses of the services by a person other than the account owner.
- When a client is giving the authorization via voice services, the relevant telecommunication service provider should be asked to display the caller’s number so as to record the incoming telephone number.
|
|
| Article 41 | (Control and management of identity verification for video call)
- When verifying identity for a video call, an organization shall implement the one-time password (OTP), make a telephone call by its representative, or verify the identity of the person making the video call against his/her photo ID as part of the enhanced verification.
- When using the video services, an organization shall validate the authenticity of a real environment where the video call is taking place (e.g.random questions and answers) to prevent uses of prerecorded video via technologies.
- An organization shall keep the video recording or photograph for subsequentverifications.
|
|
| Article 42 | (Control and management of deepfake prevention)
An organization shall conduct regular information security trainings every year and the trainings should cover topics such as awareness of deepfake and how to prevent deepfake.
|
|