A Cop Made 3,000 Deepfake Porn Images. A Bandwidth Spike Caught Him — No Investigator Did.

A Pennsylvania State Police corporal — someone who swore an oath, carried a badge, and had privileged access to law enforcement systems — quietly generated thousands of deepfake pornographic images while investigators noticed something as mundane as unusual network bandwidth usage. That's what finally triggered scrutiny. Not a proactive forensics sweep. Not a digital evidence protocol. An IT anomaly. Let that sink in.

According to the Philadelphia Inquirer, Corporal Stephen Kamnik pleaded guilty to producing approximately 3,000 deepfake pornographic images and separately viewing child pornography. The case is disturbing on its face. But the deeper problem it exposes is structural, not individual: law enforcement agencies across the country still don't have a unified framework for treating deepfake sexual abuse as the category of violent crime it plainly is.

The Classification Gap Is Costing Victims

Here's the uncomfortable math. Research into the deepfake content ecosystem shows that roughly 98% of deepfake videos circulating online are non-consensual pornography — and nearly all of it targets women. Ninety-eight percent. That is not a niche edge case. That is the defining use case of the technology at this moment in its history.

And yet, when you look at how most departments actually resource their digital crimes units, deepfake abuse typically ends up in a "cyber crimes miscellaneous" tier — somewhere below fraud, somewhere above whatever the sergeant filed under "weird internet stuff." The problem isn't that investigators don't care. Many do, deeply. The problem is that classification determines resources, and right now, deepfake abuse isn't classified in a way that commands the budget, staffing, or investigative priority it demands.

Contrast that with how child sexual abuse material (CSAM) investigations work. Those cases have dedicated federal coordination structures, mandatory reporting pipelines, and multi-agency protocols. According to Our Rescue, cyber tips related to CSAM cases have tripled nationwide since 2020 — creating evidence backlogs that are already overwhelming existing forensics capacity. Now layer on a 6,345% increase in AI-generated CSAM reports in just the first half of 2025, and you have a system that was already struggling to breathe getting shoved underwater. This article is part of a series — start with Deepfake Laws Biometric Standards Gap Investigators.

Deepfake abuse doesn't get those same mechanisms. It gets patchwork state laws and a lot of well-meaning legislative press releases.

Laws Are Not Enforcement

To be fair, the legislative response has been faster than anyone predicted. When the federal TAKE IT DOWN Act passed, only 20 states had explicit deepfake laws on the books, according to Red Tape Reduction's state-by-state legal analysis — and those that did had wildly inconsistent crime classifications and penalties. Some treated it as a misdemeanor. Some had no criminal penalty at all, only civil remedies. A few got it right.

The counterargument you'll hear is that the pace of legislation — federal action, laws in 48 states, international statutes emerging — proves the system is working. Respectfully: no, it doesn't. Legislation without enforcement capacity is a performance. It's a ribbon-cutting ceremony for a building that hasn't been constructed yet.

"Barriers to access to justice are exacerbated by weak legal frameworks, limited capacity of law enforcement officers, and gender bias in legal protection." — UN Women, on structural failures in deepfake abuse enforcement

That's not a fringe activist position. That's the United Nations documenting exactly what investigators on the ground already know: the law says one thing, the operational reality says another. A statute criminalizing deepfake porn doesn't mean much if the detective assigned to the case has never conducted a deepfake forensic examination, doesn't have validated tools for provenance analysis, and is already carrying 60 other open cases.

Pennsylvania is a useful case study here — and not just because of Kamnik. In 2024, a separate incident involving nearly 50 girls at a Lancaster private school triggered a wave of proposed state legislation. The response focused on requiring schools and mandated reporters to flag AI-generated explicit images of minors. Worthwhile? Absolutely. Sufficient? Not even close. Mandated reporting is an input mechanism. It generates more tips. Tips require investigators. Investigators require training, tools, and time. None of that gets conjured by adding one more obligation to a school counselor's job description. Previously in this series: The Cop Who Made 3 000 Deepfakes Exposed A Bigger Problem Th.

The Forensics Infrastructure Problem Nobody Wants to Talk About

Here's where this gets technically specific — and where the Kamnik case reveals something beyond the individual crime. A state trooper with privileged system access, presumably some familiarity with how investigations work, and a motive to stay hidden still got caught. How? Bandwidth anomalies. Not because anyone was running proactive searches for deepfake generation activity. Not because there was a protocol that flagged unusual AI tool usage on government infrastructure. A routine IT flag.

Now ask yourself: what happens when the perpetrator isn't using a government network? What happens when they're smarter about covering their tracks? A Department of Justice report on digital forensics gaps documents the problem with unusual clarity: there are few standard protocols for forensic examinations in sexual exploitation cases, meaning evidence from disparate sources often can't be effectively connected. Without adequate computer forensic expertise embedded in these investigations, law enforcement misses the thread that ties individual incidents into a pattern — and patterns are how you catch perpetrators before the victim count reaches 3,000 images.

Detection technology, for what it's worth, is not the bottleneck. Tools for identifying AI-generated imagery, analyzing facial synthesis artifacts, and tracing content provenance exist today. At CaraComp, the infrastructure for verifying whether a face in an image is authentic or synthetically generated is a core forensics capability — not a futuristic aspiration. The technology is ready. The investigative frameworks to deploy it systematically are not.

Reclassify or Keep Reacting — Pick One

The argument for reclassifying deepfake sexual abuse as a digital forensics priority — not a novelty, not a "cyber misc" ticket — isn't political. It's operational. Investigators who work traditional sex crimes have victim advocacy pipelines, evidence preservation standards, and prosecution coordination built into the workflow. Those structures exist because decades of hard experience showed that without them, cases collapse and perpetrators walk.

Deepfake abuse is sexual exploitation. The fact that the weapon is software instead of hands doesn't change the harm to the victim, the psychological documentation of which is extensive and severe. Philadelphia Inquirer coverage of Pennsylvania's school-based incidents illustrates how the harm cascades through communities — victims withdraw from school, from social life, from any digital presence — while the perpetrator faces, at worst, a misdemeanor charge in a jurisdiction that hasn't caught up with federal law. Up next: The Cop Who Made 3 000 Deepfakes Exposed A Bigger Problem Th.

The investigative call here isn't complicated. It requires three things that agencies already know how to do in other contexts: dedicated classification, dedicated resources, and dedicated training. What it requires that nobody wants to commit to is the will to say, out loud, that AI-generated non-consensual pornography is a sex crime — full stop — and that the person who made it should be investigated with the same urgency as someone who committed physical sexual assault.

Stephen Kamnik allegedly created roughly 3,000 images. He worked in law enforcement. He knew exactly what a forensic investigation looked like — and he calculated, correctly for a very long time, that nobody was running one on him. That calculation will keep being made, by far more sophisticated actors, until agencies stop treating deepfake abuse like an awkward footnote to the digital age and start treating it like the sex crime it is.

If you were rewriting your jurisdiction's digital evidence playbook today, would you classify non-consensual deepfakes alongside traditional sex crimes — and what would you actually need to investigate them at scale? Because "we need better laws" is no longer an acceptable answer. The laws are there. The question now is whether the agencies enforcing them are.