Google put a generative AI feature inside Google Earth: type a prompt, get an image, overlay it on the satellite map. It lasted exactly one day. Twenty-four hours was all the internet needed to produce a plane crashing into a New York skyscraper, an exploded nuclear plant in Iran and aerial bombardments over Moscow, all packaged in the most trusted visual format on the planet: the satellite image, the one the public treats as objective by definition.
The backlash was immediate, and it wasn't theoretical. Henk van Ess, a journalist who specializes in AI and verification techniques, demonstrated within hours how the tool could be weaponized for political disinformation, generating fake satellite imagery of migrants at the border between the United States and Mexico. Hours. Not a state-sponsored lab, not a sophisticated adversary with a budget: a browser and a prompt.
Google's defense deserves a close reading, because it is a small masterpiece of corporate reasoning. The generated images, the company explained, did not appear in the main Google Earth interface, and they carried identifiers marking their artificial origin. Both things may well be true, and both are beside the point. Nobody spreads disinformation through the main interface of Google Earth. They take a screenshot, crop it, and post it on social media, and nothing in that chain guarantees the identifier travels with the image; the context certainly doesn't. A safeguard that depends on the image never leaving the product is not a safeguard; it is an alibi.
And the problem has never been the legitimate users, who no doubt exist. The problem is that a tool released to everyone is, by construction, released to the worst person who will ever touch it. If your risk assessment stops at the intended user, you haven't done a risk assessment; you've written a marketing persona.
And now Google is "working on implementing more rigorous safety measures". Translation: the rigor arrives after the fire. This is the part that should worry anyone who works in security or governance. Pre-launch risk evaluation is not bureaucratic friction, it is the actual job, and when one of the largest technology companies in the world ships a tool whose most obvious abuse goes viral within hours, whatever evaluation preceded the launch plainly wasn't up to the product it was supposed to protect. The message the episode sends to the entire industry is that shipping first and apologizing later is an acceptable operating model. It isn't. The cost of that model is paid by everyone downstream.
There is a deeper casualty here, too. Satellite imagery has become one of the last load-bearing instruments of verification: journalists use it to document conflicts, open-source intelligence analysts use it to check claims, humanitarian organizations use it to assess damage. Making the falsification of that format a consumer feature saws off the branch that verification itself is sitting on. Every fake satellite image that circulates doesn't just spread one lie; it devalues every authentic satellite image that comes after it. The liar's dividend compounds daily.
One day. That's how long it took the public internet to demonstrate what a risk assessment should have established on paper. The assessment is cheaper. It always is.
Raffaele Di Marzio
All my "insane" books on cybersecurity and governance are here 👇 https://cyberium.limited/bookshelf.html