Dubai Open-Sourced a 91%-Accurate Deepfake Detector on 16 September — the 4 Identity Checks I Wish We Had Run Before a Fake Developer Reached Our Final Round

In the spring a backend candidate reached the final round of a loop we were running for a DIFC client. Three video interviews, a clean take-home, a LinkedIn profile with the right former employers. The client’s CTO asked him, on a whim, to hold his hand in front of his face while he talked. The picture broke in a way that nobody on the call could un-see. The person on the other end was real; the face was not his. We never learned who had actually written the take-home. On Tuesday, at Expo City, the Dubai Electronic Security Centre put a tool for exactly that problem into the public domain, and I want to explain why every hiring manager in the UAE should read the announcement as being about them.

What Happened on 16 September, in the Words of the People Who Reported It

The Gulf News headline was “Dubai launches SARAAB, open-source AI designed to detect deepfake videos”, published on 16 September 2026, the opening day of GISEC Global 2026 at the Dubai Exhibition Centre. The Dubai Electronic Security Centre (DESC) unveiled three initiatives: SARAAB, an AI model built entirely by an Emirati team to detect manipulated video and described as the first of its kind developed by a government entity in the Arab region; a Dubai Cyber Skills Framework, “a common reference for cybersecurity qualifications, certifications, training and career progression” aimed at professionals, employers, universities and training providers; and an ISR Auditor Certification Programme to train auditors to assess compliance with Dubai’s Information Security Regulation using consistent methods.

Khaleej Times added the numbers in “Dubai to launch region’s first AI model to detect deepfake videos”: a 91% accuracy rate, a launch by the end of 2026, and a release on Hugging Face so that anyone can read the source, test it and improve it. Hassan Majid Alkhazraji, Senior AI Executive at DESC, explained the design choice that matters most for interviews: “If it was a two-minute video, we would analyse it for the whole of two minutes.” The model reads the entire clip rather than sampling frames, and produces a heat map over the facial regions it believes were altered, which means a deepfake that only runs for the last thirty seconds of an otherwise genuine recording still gets flagged.

DESC’s chief executive, Yousuf Hamad Al Shaibani, framed the three launches as one programme: “Dubai continues to establish an advanced model for cybersecurity, built on anticipating change,” adding that the initiatives “reflect our ambition to develop solutions and expertise that originate in Dubai and create an impact beyond its borders.” GCC Business News carried the fuller write-up of all three initiatives.

Why This Is a Dubai Hiring Story, Not a Government IT Story

Gartner’s forecast, reported by HR Dive as “By 2028, 1 in 4 candidate profiles will be fake”, covers everything from AI-polished CVs to full identity substitution. The sharper figures are in Gartner’s own surveys: 39% of 3,290 candidates said they used AI during the application process, and in a second survey of 3,000 candidates in 2025, 6% admitted to interview fraud — posing as someone else or having someone else pose as them (Gartner press release, 31 July 2025).

The organised end of the problem has a UAE footnote. The US Department of Justice’s 2025 actions against North Korean remote IT worker schemes — 21 laptop farms searched across 14 states, operatives who had obtained jobs at more than 100 US companies — described facilitators in the United States, China, the United Arab Emirates and Taiwan (The Hacker News, July 2025). The playbook in those cases was not exotic: a stolen or borrowed identity, a laptop shipped to a proxy address, a real engineer behind a borrowed face on the video call, and a company that never asked the person to do anything that a face-swap could not survive.

Dubai is exposed for the same reason it is attractive. Most developer roles here are filled remotely at some stage of the loop; a large share of candidates are outside the country when they interview; and salaries in AED at a tax-free rate are a strong incentive to be the person on the other end of that call, whether or not you are. The background-check process most companies run happens after the offer, which is precisely too late to catch someone whose entire aim is to reach the offer.

The 4 Identity Checks I Now Run on Every Remote Developer Interview

None of these require SARAAB. When the model ships, it becomes a fifth, applied to recordings with consent. Until then, the loop below has caught two more substitutions in six months across our clients’ processes, both at check two.

Check 1 — Live liveness prompts, on every call, announced in advance

Tell candidates in the invitation that interviews include brief on-camera verification. Then, once per call, ask for something a face-swap handles badly: turn the head slowly past ninety degrees, pass a hand across the face, hold a printed page beside the head, stand up and sit down. Announcing it is the point — an honest candidate is unbothered, a substituted one often withdraws before the call. Keep it to twenty seconds and do it for everyone, so it is a procedure rather than an accusation.

Check 2 — Document-to-payroll matching before the technical round, not after the offer

Ask for the passport bio page and, where relevant, the Emirates ID or current visa before the first technical interview, and check three things against each other: the name and photograph on the document, the name on the bank account that will receive salary through WPS, and the name on the LinkedIn and GitHub accounts presented. Substitution schemes almost always break on the bank account, because the money has to reach the person who is actually working. Our reference-check process then runs against the employer names on the document, not the ones on the CV.

Check 3 — Cross-call consistency, deliberately engineered

Use two different interviewers on two different days, have each ask one detailed question about the same past project, and compare answers afterwards. Substitution rings frequently rotate the technical person, and the story drifts. Also ask about the physical room: what is behind the camera, what the weather is like, what time it is locally. Trivial to answer honestly, hard to fake at speed when the face and the voice belong to two different people.

Check 4 — A paid trial with a real commit history, on your repository

Replace the anonymous take-home with two to five paid days on a real ticket in your codebase, on a company-issued account, with commits signed and a fifteen-minute daily call. Substitution needs a consistent person on the keyboard for a week; face-swaps do not attend stand-ups well. This is also, not coincidentally, the best predictor of on-the-job performance we have, as we argued in how we structure technical interviews for remote developers.

What the Cyber Skills Framework Changes About Security Job Descriptions in Dubai

The quieter announcement will move more hires than SARAAB. Until Tuesday, a Dubai security job description was a list of vendor certifications chosen by whoever wrote the last one, and candidates were benchmarked against each other rather than against anything. A framework that maps qualifications, certifications and training to defined career stages, and that universities and training providers are being asked to align to, gives employers a shared scale for the first time. It will take DESC a while to publish the detail, but the direction is clear enough to act on now.

• Write the role against a level, not a certificate list. Describe the stage of the framework you are hiring for and the outcomes at that stage; let certifications be evidence rather than the requirement.
• Expect candidates to arrive with it. Within a year, Dubai-trained security engineers will describe themselves in the framework’s terms. Interviewers who cannot read that vocabulary will mis-level them.
• Use it for the ISR angle. Companies that supply Dubai government entities live under the Information Security Regulation; the new auditor certification means audits will get more consistent, and the people who can run them internally will be scarcer. Our post-GISEC cybersecurity hiring process and the UAE cybersecurity law guide cover the compliance side.

What the Dubai Market Looks Like When You Screen This Way

The objection we hear is that four checks will slow the loop and lose candidates. In our data it does the opposite. Announced liveness prompts cost twenty seconds a call. Document matching before the technical round removes the post-offer background-check delay, because most of it has already been done. Paid trials replace a take-home that candidates resented anyway and that told us less. Across the loops we run for security engineers and backend developers in Dubai, the median time from first call to offer has not moved, and the number of offers withdrawn after a background-check finding has fallen to zero in the last two quarters.

What to Do This Week If You Run Engineering in the UAE

1. Add one sentence to your interview invitation saying that calls include brief on-camera verification. Watch what happens to the no-show rate among candidates you were unsure about.
2. Move document collection before the technical round and have HR match passport, bank and GitHub names on a single sheet.
3. Read the Cyber Skills Framework when DESC publishes the detail and rewrite your next security job description against a level.
4. Register for SARAAB’s Hugging Face release if you have an AI engineer who can evaluate it on recordings you already have consent to keep, and decide your policy before the model arrives, not after.

If You Also Run Teams in Singapore

The Singapore problem is identical and the procedural fix is the same; only the document set changes (NRIC or FIN instead of Emirates ID, CPF and bank details instead of WPS). Our Singapore colleagues cover the pre-offer side in reference checks for Singapore developer hires and the loop design in how to structure a technical interview process in Singapore. If your engineering org spans both hubs, run the same four checks in both and keep the evidence in one place.

FAQ — SARAAB, Deepfake Candidates and Dubai Developer Hiring