Summary Threat Type Vulnerabilities Surface Matrix Motivations Kill Chain Recommendations Appendix
Print Report

Robocall Deepfake Audio of U.S. President Joseph Biden

Submitted File

On January 22, 2024 prospective voters across New Hampshire were contacted telephonically by a fake Joe Biden robocall urging them not to vote in the state’s presidential primary. The deepfake caller stated: “It is New Hampshire Presidential preference primacy.  Republicans have been trying to push nonpartisan and democratic voters to participated in their primacy.  What a bunch of malarkey!  We know the value of voting democratic when our vote counts.  It’s important that you save your vote for the November election.  We’ll need your help in electing Democrats up and don the ticket voting.  This Tuesday only enables the Republicans in their quest to elect Donald Trump again.  Your vote makes a difference in November, not this Tuesday.  If you would like to be removed from future calls, please press two now.”

Threat Level

Low

Moderate

Elevated

High


Authenticity Spectrum

Real

Suspicious

Likely Fake

Fake



Deepfake Attack Profile

Credibility

High

The more synthetic media is perceived to be legitimate and authoritative, the content is more likely to be trusted, persuasive, and acted upon.

Interactivity

Low

Synthetic media can range from non-interactive, not ongoing, or not consistent (low) to interactive, ongoing, and consistent (high).

Familiarity

High

Synthetic media can range from very recognizable and familiar (high) or hardly (or not) recognizable and familiar (low).

Evocation

Moderate

Synthetic media can range from evoking a significant affective response (high) to barely or not at all eliciting an affective reaction.

Distribution

Broadcast

Synthetic media can range from broadcast to a wide human audience or technical security measures (high) to a narrow, specific human audience or tailored technical security measure (low).


Deepfake & Synthetic Media Analysis Framework (DSMAF) Assessment™. The media submitted for this Deepfake Threat Intelligence Report (DTIR) was assessed with the Psyber Labs Deepfake & Synthetic Media Analysis Framework (DSMAF)™, a set of psychological, sociological and affective influence factors and sub-facets, that when holistically applied, inform the motivations, intentions, and targeting process in synthetic media and deepfake propagation. The findings of each DSMAF factor is described in respective sections and graphically plotted on the Deepfake Risk Factor Radar. The combined DSMAF findings are given a Synthetic Media Threat Level (Low, Medium, Elevated, or High) for actionable awareness and risk mitigation.

Threat Type

Threat Type is the category of intended purpose and the risk proposed by the synthetic media or deepfake. Often, cyber deception efforts through deepfake content are multi-purpose, and a result, are categorized with multiple threat types.

Digital Impersonation for Disinformation

Deepfake technology intentionally using the likeness of famous and/or credible authorities in an effort to shape the behaviors, attitudes, beliefs and/or emotions of the target audience

Voice Heist

Voice Heists are a form of deepfake audio attack. In particular, it is the use of artificial intelligence to manipulate or create audio, cloning the voice(s) of legitimate individuals, often company executives. The voice clone is then used to trick companies, banks or other organizations to transfer funds to accounts controlled by the deepfake attacker.

Propaganda

Information, especially of a biased, misleading or non-rational nature, used to promote a political cause or point of view

Political Instigator

The media is intended to serve as a catalyst for political argument, discord and divisiveness.

Fabricated Content

Content created to serve an information or psychological operation purpose.

Influence Operation

Influence operations, also known as information operations or psychological operations, are strategic approaches used to shape the perceptions, decisions, and behaviors of target audiences to achieve specific objectives.

Deception

Intentional strategy and tactics meant to mislead, misdirect and manipulate the perceptions of a target audience through simulation (showing the false) and/or dissimulation (hiding the real)

Common Cognitive Vulnerabilities & Exposures™ (CCVE)

Common Cognitive Vulnerabilities & Exploits (CCVEs) are perceptual distortions, cognitive biases, heuristics misapplied, or any mental process that exposes a person to a potential manipulation by an adversary.

Confirmation Bias

Category: Cognitive Processing

The tendency to seek information that confirms or supports a predetermined position or conclusion.

Authority

Category: Social Norm Vulnerabilities

Tendency to comply with authority figures (usually legal or expert authorities). Exploitable by assuming the persona or impersonating an authority figure. 

Unity

Category: Social Norm Vulnerabilities

Perceived shared identity based on similarity in a trait, affiliation, or belief. This can be a powerful influence tactic as people tend to be more open to persuasion by someone they identify with.

Suggestibility

Category: Other Psychological Vulnerabilities

Technique that attempts to implant a false memory in the target through suggestion. 

Disgruntlement

Category: Other Psychological Vulnerabilities

A feeling of dissatisfaction with one’s situation or circumstances. May be leveraged by an attacker by offering a path toward resolving the source disgruntlement as a means of manipulating the target.

Emotional Load

Category: Other Psychological Vulnerabilities

Affective responses--emotions, moods and feelings--effect cognition and perception. Media that intentionally causes a high degree of emotional load can significantly image how target audience member perceives and thinks about the subject of the media.


Deepfake Attack Surface & Vectors

As part of the DSMAF criteria, Deepfake Attack Surface & Vectors assesses the intended target; the manner of control, or how the synthetic media is being presented to the target; and medium, or the type of synthetic media being presented to the intended target.


Intended Target

Both humans and automation may be targeted by synthetic media attacks. This criteria references whether the target of the attack was human or automation. The highlighted icon represents the intended target of this submitted media.


Human

Technical

Hybrid

Unknown



Control

A measure of if the attack was constructed by a human or by artificial intelligence. The highlighted icon represents the method of control of this submitted media.


Human

Automation

Hybrid

Unknown



Medium

The medium is the format of the content submitted. Highlighted items represent all of the various formats contained in the submitted content.


Text

Image

Video

Audio

Synthetic Media Exploitation Matrix

The Synthetic Media Exploitation Matrix Is a visual representation of the combined levels of attacker sophistication and maliciousness.

  • Sophistication is a judgment of the level of demonstrated technological prowess and capability involved in the attack.
  • Maliciousness is a conclusion regarding the degree to which the attack was deliberately intended to cause harm.

Sophistication

High

Technical complexity of the atttack.

Sophistication
Maliciousness

Chart Not Available on Printed Version

Maliciousness

High

How damaging the attack was intended to be.



Motivations

Motivations are the underlying activators, purposes or sustained reasons for why the deepfake threat actor sought to create and take the necessary steps to produce and disseminate synthetic media or deepfake content.

This robocall voice deepfake campaign sought to influence voters and interfere with the New Hampshire Presidential primary election. Further, it sought to foment divide between Republicans and Democrats by using evocative "us vs. them" language. Through this language is a request by a perceived authority figure to comply with his described desired action.

Psychological Pressure

Psychological Pressure is the stress felt from perceived serious demands imposed on one person by another individual, group, or environment.

Divisiveness

Create group, organization or societal division

Ideology (Cause)

Use of deepfake and synthetic media to promote a particular political, scientific, social or other cause

Political Tumult

The creator and/or disseminator of the media seeks to create political discord, argumentation and divisiveness.

The Deepfake Kill Chain™

The Deepfake Kill Chain™ describes the various, distinct, sequential stages of deepfake media creation and dissemination. Understanding these stages, and the adversary’s efficacy in the respective stages not only reveals the adversary’s modus operandi and decision-making process, but when contrasted with the Deepfake & Synthetic Media Analysis Framework™, identifies and elucidates methods of preventing and defending against the adversary’s deepfake attacks.

Motivation

Motivation is the underlying activator, purpose or sustained reasons for why the deepfake threat actor wants to create nefarious synthetic media.

This robocall voice deepfake campaign sought to influence voters and interfere with the New Hampshire Presidential primary election. Further, it sought to foment divide between Republicans and Democrats by using evocative "us vs. them" language. Through this language is a request by a perceived authority figure to comply with his described desired action.

Targeting

Targeting is the threat actor’s intentional selection of a target audience, or the group or individual whom he is interested in impacting with his deepfake campaign.

The deepfake campaign was designed to target audiences that include the voters in New Hampshire along with U.S. citizens who are eligible to vote in the 2024 Presidential election.

Research and Reconnaissance

Research & Reconnaissance occurs when the threat actor is effortfully gathering information about the target audience, the optimal channels to conduct their campaign on, the relevant narratives for the attack, and type of content that will have the desired impact on the target audience.

Voice exemplars of President Biden's were collected to train AI models/deepfake tools to create the voice deepfake used in the robocall campaign.

Preparation and Planning

Preparation & Planning are the steps and processes that the threat actor takes to acquire the tools and content needed to create the deepfake media for their campaign and their deliberation for the execution of the campaign.

Voice exemplars of President Biden's were prepared and submitted to train AI models/deepfake tools to create the voice deepfake used in the robocall campaign.

Production

Production is the threat actor’s use of tools and content for the creation and development of deepfake media for their attack campaign.

Voice exemplars of President Biden's were prepared and submitted to train AI models/deepfake tools to create the voice deepfake used in the robocall

Narrative Testing

Narrative Testing. A narrative is a story, or an account of related events or experiences. A good narrative will have story coherence, such that both the story being told and its relationship to the real world are cohesive and clear. In deepfake campaigns, threat actors consider and evaluate the possible narratives—particularly in relation to events and context—to support the campaign in an effort to maximize the believability and efficacy of the attack.

The narrative designed in the campaign was to influence voter design making and shape their behavior.

Deployment

Deployment is the threat actor’s intentional transmission of deepfake content to the target audience through selected online channels.

Telephonic deployment via robocall

Amplification

Amplification is the threat actor’s intentional efforts to maximize the visibility, virality and target audience exposure to their deepfake content.

No case specific insights generated.

Post-Campaign

Post-Campaign is the period after the target audience has received and been exposed to the deepfake content.

Robocall technique is an automated mass-calling technique meant to contact a pool of target audience members



Cognitive Security Recommendations

This section identifies the steps and measures to prevent and defend against the synthetic media/deepfake content assessed in this DTIR. For a more detailed recommendation, training or consultation, connect with Psyber Labs.


Robocall deepfake campaigns are a challenging form of deception because there are few ways to gain full validation or veracity of the call. In these circumstances, Psyber Labs recommends to consider historical context, particularly if the caller has a history of making such calls, or whether such a call is anomalous.

Appendix

DTIR™ Version: 1.0

Submission Date (UTC): April 01, 2024 09:46

Assessment Date (UTC): April 02, 2024 00:04

SHA256 Hash: 79db7b11bd9a77f6867e2e6e125024f8ac88ddc97fc40e3bfc295bcec808c74b

Source: https://apnews.com/article/new-hampshire-primary-biden-ai-deepfake-robocall-f3469ceb6dd613079092287994663db5

Source: https://www.wired.com/story/biden-robocall-deepfake-danger/

Source: https://www.bloomberg.com/news/newsletters/2024-02-07/how-investigators-solved-the-biden-deepfake-robocall-mystery

Source: https://www.nbcnews.com/politics/2024-election/fake-joe-biden-robocall-tells-new-hampshire-democrats-not-vote-tuesday-rcna134984