The Hunt for Mr. Deepfakes

Sarah was a student at the University of New Brunswick when she started recording YouTube videos in 2018. It seemed like a fun side hustle, particularly in a media environment that rewarded creators for maximum personal exposure: she posted about her interests, which included geeky fandom, online culture and TV shows. Her channel blew up after only a few uploads—one day, she logged on and saw that one of her videos had 10,000 views. 

At first, Sarah revelled in her new popularity. But soon she saw a darker side to online fame. It began with comments under her videos, lewd remarks about what she was wearing, or innuendo about what someone wanted to do to her. Then her pictures were posted on other sites and in chatrooms, where her body and appearance were discussed and dissected. She felt like her online identity was slipping from her control—her images repurposed as masturbatory fodder for faceless strangers.

In 2024, Sarah began receiving messages from followers, sending her links to online forums like Reddit and 4chan. When she opened them, she saw videos of herself, masturbating. She was horrified. It wasn’t really her; her head had been pasted atop another woman’s body. The videos looked off, the head and body not quite synced, but they were realistic enough to serve their purpose. The videos kept coming, including ones that showed her stripping and performing oral sex. 

All the videos she’d unwittingly starred in appeared to have originated on one website: MrDeepFakes.com. There were nearly 70,000 videos on the site, which had collectively been viewed more than two billion times by 650,000 users. Most clips depicted women in explicit, often violent scenarios. Some showed celebrities, athletes and influencers—Natalie Portman engaging in group sex, or a deranged stalker strangling Scarlett Johansson. There were also thousands of non-celebrities and minor internet personalities—including Sarah. It felt far more violating than a still photo of her head pasted on another person’s body. “Seeing yourself in motion, performing acts you would never consent to, is a very different feeling,” she says. She wondered who had seen the videos, and if she needed to explain to people she knew and loved that they weren’t really her. Instead, she just held her breath and hoped no one ever saw them. She wanted the videos removed, of course, but this was the internet. Who could she call? And under whose authority was this site, anyway? MrDeepFakes could have been based anywhere on Earth. 

In fact, he lived in Markham, Ontario, a suburban city north of Toronto. He was a thirtysomething pharmacist named David Do, with short black hair and a shy, self-effacing smile. The son of Vietnamese immigrants, he’d grown up in Kitchener and attended pharmacy school at the University of Waterloo before working at the Markham Stouffville Hospital. Acquaintances and friends found him to be quiet and nerdy, a nice guy. He liked video games and computers. The only slightly flashy thing about him was the stealth-grey Tesla Model 3 he drove.

Do’s innocuous nature made him a typical internet bogeyman: respectable everywhere but online, where he used easily accessible and increasingly capable tools to build MrDeepFakes into the world’s largest platform for non-consensual AI porn. It connected a massive community of mostly men with images of women whose faces had been used to create especially vile, violent pornography that, to a casual observer, was indistinguishable from real footage.

And yet what Do did is not a crime—at least, not in this country. The technology used to create these pictures and videos is still fairly new, after all. And, until the past year or two, even the best attempts looked janky. They were disconcerting, but clearly not real. But the tech has improved so much, so fast, that the era of glaringly obvious deepfakes is over. And demand is growing. The global market for deepfake tech was valued at US$9 billion last year. It’s expected to be worth more than US$50 billion by 2034. 

We’re moving toward a world where all forms of reality are increasingly difficult to discern, with massive consequences for all of us: non-consensual pornography, faked courtroom evidence, deepfake political propaganda and ultra-convincing fraud. Canada is unprepared for what that means—a reality where seeing is not believing.

The tech underpinning deepfakes was born in 2014, at a pub in Montreal called 3 Brasseurs. Ian Goodfellow, a 27-year-old American computer scientist working on a Ph.D. in machine learning at the University of Montreal, was drinking with friends and discussing how to make a computer generate photorealistic images. His compatriots thought that by training a computer to analyze the components of a photograph, they could teach a machine to make its own original images. That approach, however, would require massive computing power. Goodfellow had a simpler fix: a deep-learning system in which two neural networks compete against each other to generate an image, then compare those to existing examples. In essence, the networks would engage in friendly competition, one-upping one another’s efforts. This became known as a “generative adversarial network.”

Goodfellow went on to work at OpenAI, Google and Apple before moving to DeepMind, a San Francisco–based organization that builds AI systems. He also co-authored a 2016 book, Deep Learning, with the University of Montreal’s Yoshua Bengio, the Canadian computer scientist and AI pioneer who has become one of the world’s loudest cautionary voices about the risks of AI. But Goodfellow’s most famous innovation has left a sordid legacy.

Related: Mayor of The Manosphere

His technology was made widely available in the late 2010s through open-source programs on GitHub, an online platform for software developers. In short order, free tools like FaceApp, Face Swap and DeepFaceLab proliferated online, enabling users to create increasingly convincing images. Pornography rapidly became a primary use case. Early deepfake technology produced images and videos—pornographic and otherwise—that were glitchy, weird and clearly fake, full of figures with 11 fingers or three legs and glaringly mismatched backgrounds.

But the potential was immediately clear. In 2018, Jordan Peele released a video where he put his own words in Barack Obama’s mouth: “We’re entering an era in which our enemies can make it look like anyone is saying anything at any point in time, even if they would never say those things,” said the deepfaked Obama. “For instance, they could have me say things like, ‘President Trump is a total and complete dipshit.’ ”

It wasn’t quite convincing, but it was close enough that it rang alarm bells. “You thought fake news was bad? Deepfakes are where truth goes to die,” read one Guardian headline in 2018. Legislators around the world were slow to respond, failing to keep pace with a rapidly proliferating technology. As victims looked for support and accountability, they were routinely disappointed. Even when authorities wanted to help, there was often little they could do. 

In 2019, Virginia passed the first law in the U.S. against explicit, non-consensual deepfakes, making their distribution a misdemeanour. Texas followed, and more state regulations popped up. Federal governments in the U.K., South Korea, China, France, Denmark, Australia and, eventually, the U.S. also passed laws against explicit deepfakes. 

No legislation was proposed in Canada. It has long been illegal to disseminate explicit images without consent, but that law doesn’t apply to deepfakes, since they aren’t real. Other means of recourse were possible, hypothetically. Creators might plausibly be charged with harassment or defamation. But that would require finding out who was responsible for the images in the first place.

In 2018, David Do was a regular on a Reddit forum frequented by about 90,000 deepfake fans and creators. Soon, users on other sites were reposting the forum’s deepfakes. One now-defunct revenge-porn site even featured an index of deepfake victims by town or college, and some users traded spiteful images of their exes and friends. That year, just as the technology was picking up steam, Reddit faced escalating calls from victims to ban non-consensual pornography, and it shut down the forum. The deepfake enthusiasts who’d congregated there were scattered, adrift in search of a new online home. 

Do saw an opportunity. In February of 2018, he posted on BlackHatWorld, a digital-marketing forum that caters to users engaged in illegal or ethically dicey online enterprises. “Anyone active in the deepfakes community?” he wrote. In a series of posts, he said he was looking to build a new home for fake celebrity porn and he needed help cataloguing franken-images, including “inputting key information such as birthday, height, weight, etc.” and adding relevant tags. He took pains to hide his identity, using VPNs to mask his IP address, ensuring he could post whatever he wanted without fear of exposure.

When it went online later that year, MrDeepFakes had two constituent parts. The first was a platform for sharing deepfake images and videos. It included a “Top Rated Models” section with stills of women, typically actresses like Emma Watson and Sydney Sweeney. Clicking on those stills led users to hundreds of deepfaked images and videos. The second component was a forum where the site’s growing community discussed deepfakes. There, people could request custom videos from technically savvy creators, some recruited by Do. Despite a rule stating that only celebrities could be targeted, men often requested—and received—deepfakes of girlfriends or other women in their lives, sometimes depicted in humiliating acts. Many made plain their ambition to degrade a woman. “I want her done for two reasons,” read one post. “1. She’s hot. 2. She has a huge ego and maybe this will humble her.” 

Most deepfakes on the site were created using one of two free, open-source tools, Face Swap and DeepFaceLab, which went online in 2015 and 2018, respectively. Casual creators can use them to conjure rudimentary deepfakes, but putting together a convincing one is more complex than plugging a prompt into a generative AI tool. First, the tools require as many images of the subject—or victim—as possible, up to 15,000 for one person. The user must process the images, match lighting and skin tone and perform other technical feats. All of this requires hefty hardware and reams of computer memory. Despite huge traffic numbers, 95 per cent of the content on MrDeepFakes was uploaded by only 657 users, who were paid for their efforts.

The average cost was US$87.50 per video, though some users paid up to US$1,500. Members were encouraged to use aliases and cryptocurrency for transactions. Do offered a system of verification for trusted content creators, allowing them to bypass moderation. 

MrDeepFakes was a pioneer in the deepfake marketplace, but it was far from the only purveyor. The ecosystem grew to include apps, subscription services and platforms with names like Clothoff, Nudify, Undress and DrawNudes. Some deepfake creators took requests on Discord, a messaging platform. Others compiled deepfake libraries and charged members $5 to download clips. Ian Goodfellow’s technological innovation was used almost entirely for purposes of sleaze: a report from Sensity, which makes deepfake-detection software, found that 96 per cent of deepfakes were images or videos of non-consensual pornography, and 99 per cent depicted women.

Related: The Incel Terrorist

No one was safe. In 2022, a Northern Irish politician, Cara Hunter, was at her grandmother’s 90th birthday party when she received deepfaked images of herself fellating a stranger. An Australian woman learned that a close male friend had designed an entire webpage called “The Destruction of Hannah,” where people could vote on which acts of horrific abuse should be visited upon her deepfaked image.

Sophie Maddocks is the research and outreach director at the University of Pennsylvania’s Center for Media at Risk. She says that for some women targeted by online sexual abuse and harassment, the repercussions are profound and long-lasting: “We know that people experience depression, thoughts of suicide and sexual trauma.”

The truth is that there’s no way to protect yourself from this kind of assault. “If you want to get a job, you want to order a taxi, you want to do anything, you have to have an online identity,” says Maddocks. “It’s part of your citizenship, your ability to act in the world.”

Laurie Segall made her career as a technology correspondent with CNN, interviewing tech titans and hacker outlaws, exploring how big tech was reshaping the world. She left CNN in 2019 to start her own mostly self-funded venture, Mostly Human Media, so she could tell the tech stories important to her and, she believed, the world. The exploitation of women was one of them. She’d first reported a decade ago on revenge porn, where people post nude images and videos of their exes, usually women, without their consent. Deepfakes, depicting scenarios that never existed in the first place, seemed to be the next logical frontier. 

When Segall learned about MrDeepFakes, she was planning to start a family with her husband. She worried about how the increasingly dark corners of the internet might affect young people, and about the kind of world her kid would grow up in. “We’re training a generation of young men to believe that they can have what they want, with who they want, when they want it,” she told me. She announced in the winter of 2024 that it would be her mission—her “personal Roman Empire”—to unmask the man behind MrDeepFakes. 

In February of 2024, she launched her investigation, asking her social media audience for tips about his identity. It only took two months before she had a solid lead: a note in her TikTok inbox from someone named Jordy Urbanski. She wasn’t sure at first if it was legitimate—he only had 19 followers. But she soon learned that Urbanski, who’s Dutch, ran an organization called Sidenty that works to help clients protect their digital identities. It was part of a growing network of deepfake detection and removal services. Urbanski told Segall that he knew who MrDeepFakes was—and, more than that, he had an entire dossier on his life. He’d started his own investigation a month earlier, collaborating with Dutch journalists, after several Dutch celebrities and politicians appeared on MrDeepFakes, causing a national scandal in the Netherlands.

Urbanski had followed a trail of usernames and internet breadcrumbs to zoom in on David Do. He told Segall that Do had even responded to an email, sent by one of the journalists he’d been working with. In it, Do said he wasn’t the owner of MrDeepFakes; he claimed to have sold it. “I do not wish to be included in any of this,” he wrote. 

Urbanski wasn’t convinced. He had mapped Do’s entire online life: social media pictures of him at a pizza parlour in Chicago with his wife and on vacation in Vietnam, and comments about his car in vehicle forums. He also uncovered posts on message boards, in which Do solicited content creators for his growing deepfake website. 

Segall assembled a small team of producers and security researchers to chase down leads. They had Do’s digital footprint, but she wanted to know who he was in real life. Soon, she found a phone number that seemed to belong to him. When she called, it rang several times, but there was no answer. Within seconds, Segall got a call back from a blocked number. When she picked up, she heard nothing but silence.

In the spring of 2024, she flew from New York to Toronto with her team. They had pieced together parts of Do’s life from Urbanski’s files and from his social media. In one post, he cheerfully posed with his family around a Christmas tree; in another, he was praised by his hospital employer for the diligence and sensitivity he brought to his position. While in Toronto, Segall called Do’s workplace and asked for him. The person who answered told her that he wasn’t there, but he had just returned  from paternity leave. Segall’s stomach turned. To her, bringing a child into the world while actively working to make it a meaner, crueller place was reprehensible.

Segall was closing in on Do’s personal life. She emailed his wife but didn’t hear back. She did manage to connect with several friends. “All I can say is they are a nice couple,” one of them told Segall. “He’s a very kind person. I would never ever expect anything bad of him.” Segall also visited Do’s parents in Kitchener, Ontario, but they refused to talk.

Finally, Segall and a producer staked out Do’s hospital pharmacy. When they saw him walk toward the building, Segall pounced. “We have strong evidence that you’re behind MrDeepFakes,” she said, as Do’s pace quickened. Segall asked how a father could do what he’d done. He didn’t answer, escaping through the hospital’s automatic doors. For Segall, the experience was surprisingly chilling. “I’ve done all sorts of stuff in my career that my mother would be worried about, like investigating hacker communities, extremist groups, militias,” she says. “But I remember him looking at me with an expression like, ‘How dare you?’ ”

Not long after that brief confrontation, the MrDeepFakes website went dark—but it was up and running again only 12 hours later, with improved security. Do had closed off registration on the new site, preventing new members from joining and accessing content.

Segall returned to New York, where she learned she was pregnant. Last May, before she was able to publish any of her findings about Do, she was scooped. A coalition of Canadian, Dutch and Danish journalists from the CBC and investigative European news outlets Bellingcat, Tjekdet and Politiken had also been working for months to crack MrDeepFakes’ identity. They, too, had filmed themselves confronting him, though he’d refused to speak to them as well.

Soon after, MrDeepFakes was taken down, this time for good. Do’s employer, Oak Valley Health, released a statement saying that he was on leave and under investigation. When I reached out to the Ontario College of Pharmacists, they told me they were also investigating him. As of yet there is no note on his file suggesting that. His licence remains in good standing with the college.

Do’s whereabouts are unknown. It’s unclear if his family is with him, or if he’s employed. He has torched his online presence, walking away from years of accumulated digital identity and deleting his social media accounts. He has been quick to exercise for himself the control over his digital life that he denied so many others. 

If Do resurfaces, he may face personal and professional opprobrium. But, in Canada at least, he will not face legal consequences. What Do did may feel like a crime, but it isn’t. Many provinces—including British Columbia, Saskatchewan, New Brunswick and Prince Edward Island—have passed their own laws to make it easier for deepfake victims to pursue damages in civil courts and obtain takedown orders. But the creation and dissemination of deepfakes, at least those targeting adults, is not addressed by federal criminal law.

In Burlington, Ontario, for example, a man was charged recently for sending pictures of his wife to another man over Snapchat without her consent. Some images were real, and one was a fake nude with his wife’s head on someone else’s body. Justice Brian Puddington ruled that the act was “morally reprehensible and, frankly, obscene,” but that it didn’t violate the Criminal Code prohibition on sending non-consensual intimate images because the body in question wasn’t hers. 

Canada has lagged behind much of the world in addressing this. The U.K., Australia and South Korea recently criminalized non-consensual deepfakes, while the United States’ new legislation, the Take It Down Act, is working its way through congress. Politicians in Denmark and the Netherlands—which also have laws prohibiting non-consensual deepfakes—have suggested Canada ought to extradite Do, so he can answer for the attacks on women under their jurisdiction. But extradition requires the act in question to be illegal in both countries. Mark Carney vowed during his campaign to protect women by passing a law criminalizing non-consensual deepfakes, and his government recently introduced Bill C-16 to do so. But the law can’t be used to prosecute Do retroactively.

We now face a harrowing future: a world of deepfakes so convincing that there’s no way to easily distinguish what’s real and what isn’t. Every image, every video, could become suspect and disputable. The consequences are almost impossible to overstate, for politics, for law, for the way we understand the world around us.

Last year, for example, a fake viral video purported to show a CBS news anchor announcing an impending state of emergency in the U.S. This past winter, AI-generated videos of winter storms in Toronto, Calgary and Russia, among other locales, flooded social media platforms. The internet has rapidly been inundated with convincing fraudulent images of natural disasters, political figures and news events. 

The ramifications go beyond fake snowstorms. Days before the 2023 Slovakian election, audio surfaced of one of the candidates claiming to have rigged the election. It was a deepfake. And consider the widely seen videos of Alex Pretti and Renée Good, the Minnesotans killed by ICE agents earlier this year. Social media users shared images of Pretti’s death, enhanced and cleaned up by AI. It’s easy to imagine a scenario in which authorities or activists go further, altering video evidence further to suit their preferred narratives. In fact, this has already happened—in January, the Trump administration released a photograph of an arrested anti-ICE demonstrator that was doctored to make it appear as though she was crying.

Maura Grossman, a lawyer and professor in the school of computer science at the University of Waterloo, has been studying the impact of AI on the court system. Our looming inability to determine an objective shared reality keeps her up at night. There have already been at least two cases in Canada where defendants have challenged video evidence. One was in Ontario, in which a drunk driver collided with three other vehicles. He claimed in court that, when he was brought to jail after the incident, a police officer told him he would not be able to speak to his preferred lawyer, which would be a violation of his Charter rights. He said he became angry­—but video footage of his jail cell showed that he was calm. He claimed that the footage was a “CGI deepfake” (it was not). Another incident involved a man caught on a doorbell camera at his estranged partner’s home, dropping off a package, despite a court order prohibiting him from being within 100 metres of her home. He told the court, falsely, that the images from the doorbell camera had been changed to include him. 

Related: Can AI Save Us From Misinformation?

The allegations of alteration were, in both cases, untrue. But courts will eventually encounter faked images or audio so convincing that it’ll be impossible to tell the difference. Imagine a world in which one parent arrives in family court to challenge the other’s custody and presents into evidence a tape recording of the other parent abusively screaming at their child—the tape is a deepfake, but there is no way to prove it. How is a court supposed to adjudicate such a matter? 

Tech companies have begun rolling out verification tools, an attempt to address the harms their products have caused. Google introduced an “About this image” tool in 2023 with the aim of helping users discern fantasy and reality. But as the field for deepfakes becomes increasingly crowded and sophisticated, even specialized image forensic experts struggle to keep up with advancements. The authentication tools we have simply aren’t reliable enough, and the technology has become too accessible and easy to use to prevent a flood of new images.

Pornography is likely to remain the tech’s primary use. For a while, MrDeepFakes was a global hub for pornographic deepfakes. But already the audience is moving on. “I predict this will turn into an endless game of Whack-a-Mole,” wrote one Reddit user. “There is a demand that is not going away. The tech to satisfy it is increasingly accessible. Taking down one site is a temporary band-aid at best.”

When the mask finally came off, Sarah, the young YouTuber whose deepfakes had been splashed all over Do’s site, was struck by how ordinary he was. His generic suburban existence belied the reality of a man who stood behind the exploitation and humiliation of thousands of victims. Segall told me she was surprised but also relieved when someone else broke the story. She hoped the revelations might help drive conversations about consent and AI—for her, all of this seems like the beginning of a story, not the end. Do’s exposure has done little to dampen the appetite to embarrass and control women online. 

Segall already published a five-part series of her investigation, Searching for MrDeepFakes, on Mostly Human’s social media, and she plans to release more on her own podcast. But she says that her interest was never just about one man or one site, but about the thousands of men drawn to these platforms and activities. “It was about the army of MrDeepFakes.”

This story appears in the April 2026 issue of Maclean’s. You can buy the issue here, subscribe to the magazine here or send a gift subscription here.