Walter Haydock: Welcome to the Deploy Security Podcast, where we go deep on the cybersecurity, privacy, and compliance implications of using artificial intelligence. I'm your host, Walter Haydock, the founder of Stack Aware, and I'm joined, as always, by Steve DeFor. Steve, good to see you again.
Stephen Dufour: You too, sir.
Walter Haydock: So we've got a couple different topics to cover today. We've got some legislative updates. We've got some interesting hallucinations from AI. We've got some you know, model releases upcoming from some of the hyperscalers. So with that, I'll turn it back to you, Steve, so we can get right into it.
Stephen Dufour: All right, here we go. So the first thing we're gonna talk about, let me share my screen. no. And w we've seen similar stories as this one where somebody releases some sort of chatbot for their business, whether it be informational or to actually to to help the end user achieve a specific goal or gather more information or whatever it happens to be. you would think that some of these companies would learn lessons from the other companies that have done this. I think there was a a car vendor. chatbot incident that happened where somebody was basically mess messaging back and forth with a chatbot and the chatbot ended up selling it to this person for something like a dollar or something like that. And then it got held up in court. Another one is the Southwest chatbot where it ended up giving my wife a cookie recipe or so or some something like that. and so we have a similar
Walter Haydock: Mm-hmm.
Stephen Dufour: story here from TripAdvisor where the AI assistant who's supposed to be helping the end user plan out their trip, giving them bad advice, right? And so it it's it's such a similar story. I'm I'm really surprised and maybe you differ in this opinion. I'm really surprised this is still occurring so often where these chatbots just go rogue and end up doing something that they're not supposed to do. In this case, this AI chatbot, like its sole function is to help somebody plan a trip. Not necessarily a bat trip, right? So that that's that's what this chatbot ends up doing. It it uses the information and doesn't volunteer the rest of it. It's basically trying to make an over overly negative hotel or venue or trip into a more positive experience. Like some of the examples given here were A a particular resort in another country was facing sexual harassment claims by its guests and neglected to actually tell tell the end user that. Other ones, as shown in this particular photo, where the just the conditions of the room itself were awful and nobody would want to stay there. So so in the end, we're back to where we started. Don't use the AI chatbot. Go and use actual user reviews, right? Like sort that by the lowest rating and just read, right? because in the end you're the one making the decision and you're the one that's gonna have to deal with the negative outcome, if any.
Walter Haydock: Yep. Always need to apply that human oversight to AI use. And sometimes AI isn't the right tool for the job. Sometimes a simple review of the star ratings will will do.
Stephen Dufour: And and I get I get where they're where they're coming from, when they want to help their end users, you know, plan a trip, use the service, make it easier. And in the end, I don't like mission failed.
Walter Haydock: Yep. Sometimes there's just pure failure and hopefully we learn from it and move on. Cool. Speaking of moving on, should we jump into the next topic? Yeah, so big news out of Illinois. They I will share my screen. they
Stephen Dufour: Go for it.
Walter Haydock: just passed a new law called SB315, which is the Artificial Intelligence Safety Measures Act. It has some interesting requirements around building in a a frontier framework for hyperscalers, mainly those over $500 million in annual revenue. So open AI, anthropic, those types of firms will be Caught up in this requirement, but a key new development is that it mandates an independent third party audit for these frontier frameworks. And I actually did some some digging into it and the bill's requirements. And and the bill is is interesting because it it it actually makes it kind of tough to do the third party audit, the independent third party audit, and You know, of course, this this podcast is sponsored by Stack Aware, so you're gonna get a little bit of a little bit of Stack Aware advertising in here, but essentially it requires an independent third-party audit of the Frontier model, but at the same time, it requires that third party to render advice and recommendations on how to improve the frontier framework. So under Rubrics like ISO 402001 or High Trust AI security, the assessor or the auditor is not allowed to give consulting recommendations on how to implement the framework. They basically just go in and say, Are you meeting the standard? Are you not meeting the standard? So I think that creates an interesting dynamic for companies that are seeking to meet the requirements of this new bill. I I will say that Stack Aware has helpfully Put together a a new guide on how hyperscalers can meet the ISO or the 315 requirements and ISO 40201. So bottom line, I think doing an internal audit using ISO 40201 and SP315 together is the way to achieve the requirements of the bill. And I I think that the the traditional audit firms might actually be hesitant to to get involved in this because they might contaminate the the management system with their with their consulting advice and then they couldn't then audit it afterwards. So I think that's that's interesting. we're seeing all sorts of these requirements popping up all over the place. We've seen California with the Transparency and Frontier Artificial Intelligence Act. We've seen New York with the RAISE Act. So we're seeing the states building their own AI governance frameworks for the frontier models and then also for kind of smaller players that are deploying AI systems Colorado with their revised SB 189. So a lot of stuff in flight. And you know, staying on top of all these requirements is certainly challenging. But, you know, if you need help, talk to Stack Aware.
Stephen Dufour: Yeah, that's it's very interesting. All the states releasing their own and there's really no federal government guidance. Like it's really good potentially for business from an overall standpoint, but like you said, keeping track of all the state requirements can be pretty tedious. That first point you made where it had a requirement for an external assessment. did it give in Any guidance on what qualifies what or sorry, let me rephrase that. Did it give any guidance on the qualifications of the external assessor? Like could it be my neighbor who's a firefighter? You know what I mean?
Walter Haydock: That's that's a good good question. So actually what I'll do, I'll just I'll just pull up the full text of the bill and we can we can talk through it because it it basically just says the qualifications are they need to be qualified. yeah. Yeah, okay. Here here we go. Yeah. I'll I'll pull this up in a second. Yeah. They must be qualified by being qualified. All right, can you see my screen here? Yeah, so basically it says the third party shall conduct audits consistent with general accepted standards and then shall possess demonstrated competence to perform the audit, including experience employing or contracting with the individuals who possess possess technical experience in the safety of frontier models. So you you shall be competent by being competent. Probably because
Stephen Dufour: Yeah, that's
Walter Haydock: I don't think the Illinois legislature knows what an audit of a frontier AI framework would look like.
Stephen Dufour: Right. And I don't like the word best practice in there. Like so like I learned this a couple of years ago, like during one of my educational ventures. There's common practice, then there's the application of the common practice within the context of your company, right? Where it becomes your best practice, right? Because like imagine if we all had seven factor authentication and cat cards and like all this stuff, like we wouldn't be able to get any work done, kind of like the federal government. But yeah, exp expertise in the safety of frontier models. That's like first thing that popped into my head was were these job requirements where like the new technology has only been out for two years, but they require seven years of it type of thing. It's like they're exactly like yeah, this very it's very interesting. I did
Walter Haydock: Yeah. Seven years of clawed code experience.
Stephen Dufour: Did this say when it actually goes live?
Walter Haydock: So the audit this bill goes into force January first, twenty twenty seven. And then starting January first, twenty twenty eight is when you need to start doing these audits.
Stephen Dufour: So there's plenty of time to become an expert. This is this is the notice to everybody in what what'd you say, Illinois?
Walter Haydock: Yeah, or or well, I mean, anywhere really, because you don't need it doesn't say you have to be in Illinois. You could you could doesn't even say you need to be in the United States. You could be you could be anywhere.
Stephen Dufour: shit, it's that broad. man, this is awful. Like I said, plenty of time to become an expert in all all the things.
Walter Haydock: Yeah, I mean, don't compete with Stackware 'cause we will will crush you. But aside from that, you know. Go for it.
Stephen Dufour: Okay.
Walter Haydock: So cool. Should we move on?
Stephen Dufour: Yeah, let's move on to LinkedIn. It's my favorite social media platform. It's actually my only social media platform. Does LinkedIn count as social media? Okay. It's us being s social, I guess. All right, so the next thing to talk about, and I am gonna completely butcher this individual's name. feel free to connect correct me. Yoon Ashley? I don't know.
Walter Haydock: Yeah. I don't know.
Stephen Dufour: It's fine. So this individual is the chair, Department of Medicine for Stanford University, as well as the founding director for Center for Inherited Cardiovascular Disease at Stanford Health. That is their credentials. He posted on LinkedIn two days ago about a study that he and a group of scientists did. I think it was back in two thousand nine, whenever they started. And then the actual published study came out in 2011. What it boils down to is they did genomic discovery and analysis. And it took them nine months to complete the study with 30 people and staff, like 30 scientists, right? So again, it took them nine months. They replicated the same study using Claude in 30 minutes. This is this is I'm not saying that. Everybody out there in the scientific community should should do this, but this is a really good approach where a group of experts went out and did a thing using their expertise and then attempted to perform the same study using artificial intelligence, right? And that would be the ideal situation. That way you can weigh the two separate outcomes. And also you could potentially use Claude to look at your previous study and see if you missed anything, make it better. doing an analysis to make sure that nothing was missed, whatever it happens to be. So I I tend to tell a lot of negative stories where somebody failed. So I was really excited to see this one out there where we have a really good justification from a business sense for using artificial intelligence. So nine months versus 30 minutes, and I think somewhere yeah at the bottom I says Prompt was 180 words, 400,000 tokens were used, and it cost about five dollars. Again, the practice people using artificial intelligence probably want to pick up on is the human review of an expert on the output and the final results of whatever it is you're using artificial intelligence for. Because in this case, this particular individual. Let's just say Dr. Ashley, right? Because I'll butcher his first name again. did the analysis on his own genome and replicated it, right? In your particular, and this is for listeners out there, in your particular business case, it might not be appropriate to perform a parallel study or parallel business case using artificial intelligence without Making sure your terms and conditions, your NDAs, your BAs, whatever they happen to be, are appropriate and aligned to the expectations of your clients, especially if you're the custodian of some particular data set. we were talking about this earlier. If it's your own data, go for it. It's the United States. You have that freedom to make that choice and you use your data as you please. Just know that the ramifications of using something like Claude, you might be giving up. your privacy and security for the sake of an experiment. But I think this is a really good example of what we're gonna see in the future where we have these business cases, whether they be scientific in nature or not, and we're gonna have outcomes that justify the cost. And like we as a species might benefit from it, right? So I'm not sure if if the listeners or you are familiar like Mars Corporation, like the Candy Bar Corporation, their supply chain in manufacturing candy has a lot to do with crop resilience to pests and insects or even weather and climate right so Mars and other companies are very very invested in genome sequencing and other things like that basically supply chain security right so they will invest a ton of money and a ton of effort to do those particular studies where we all benefit right like the candy corporations of course but at the same time just in general food just look at the peanut right the peanut is of course like in peanut butter and all kinds of candies but in general just food. So I think if companies take this approach, specifically the companies that that have a vested interest in the food and supply chain, as well as just like the food we consume at consume at home, we'll just be better off as human beings.
Walter Haydock: Awesome. Awesome. Yeah, I think there's huge potential for using AI for healthcare purposes, is obviously both you and I are are quite familiar with from our work. And I think on the genomic side, it's great to see that there's a lot of labor and cost savings from from this approach. I will say that interestingly enough, the hyperscalers OpenAI and Anthropic, I think last month put out a letter talking about the risk of genomic bioweapons being created using AI. And that's kind of the flip side of this picture. I'm I'm a little bit of a tinfoil hat when it comes to my my genome in that, you know, I I'm the most breached man in America, I think. You know, my fingerprints were stolen in the OPM hack. So they're sitting in a Chinese intelligence service database right now. But, you know, the one thing that I think I've kept from from getting stolen so far is my genome. And I I'm going to try very hard to keep that private. And I wouldn't probably wouldn't dump that into a commercial version of of of Claude, which I'm assuming this is, the, you know, with with kind of the consumer, with the consumer terms without, you know, any any obligation to confidentiality and you know, I don't know what the data retention terms are. So, you know, do your do your risk reward analysis, look at the terms and conditions, evaluate. what what the risks are. Maybe he's like, hey, my genomes everywhere. I mean, I it looks like he even posted like what is he he had an illness, a genetic disease. you know, more power to you if you want to be that transparent. That's that's that's all well and good. I think we're gonna see, you know, in in the United States with with healthcare, we have kind of the worst system possible in that we have we have all the the negatives of a heavily regulated
Stephen Dufour: Yeah.
Walter Haydock: system. So, you know, there are lots of rules that kind of impede innovation. And then at at the same time, we also have the kind of the the cutthroat profit motive. So combining the two, you have really expensive healthcare that isn't super good in in my opinion. And I think I think that you can substantiate that through through the data. And over time I think, I think frankly, like the insurance offerings, the health insurance offerings are just going to collapse because people can't afford them. And then the people that are on them are the ones who need the health care the most. The healthy people aren't aren't getting health insurance. And you know, the whole point of Obamacare and things like that was to balance the risk, to share the risk. And you know, since there's no penalty, there's no financial penalty for not having health insurance, A lot of people aren't going to. And then there are all sorts of alternative offerings. You know, there's like Medishare, which is a faith-based crowdfunding platform. There's there are kind of non non-religious ones as well out there that are not health insurance, and they do things like they exclude people over a certain BMI, which you can't do with with health insurance. And I think the those types of platforms are going to be enabled by AI to be very discerning in terms of who they let in and and they're outside the existing insurance frameworks and and regulations. And you know, you can say, hey, you know, you you won't have you know, catastrophic cap, you won't have all this type of stuff if you go with one of those options. But if you're talk, if you're talking to somebody who just simply can't afford that type of insurance, they're gonna say, you know, okay, that's fine. I'm just gonna go with with the option that I can't afford. you know, it'll help me with some of the smaller bills. And I think we're gonna see AI, you know, for lack of a better term, profiling and underwriting kind of enter the market that way rather than through the traditional insurance providers. And I I think those companies are are frankly gonna need to find a new business model because their product is just not very good. So I think AI will help, but it will also hurt some people because you know, genetic diseases. Pre existing conditions, you know, those can be those can be excluded from these non-insurance products that a lot of people are gonna start relying on.
Stephen Dufour: Yeah, 100% agree. And that's I think where the human discernment portion of it comes in. Because to your point, let's say I upload my entire genome to something and it gets leaked or whatever. It's just out there on the internet. Public S3 bucket, everybody has access to it. And my insurer, my insurer downloads it, does an analysis, and I might have a genetic pre display. disposition to a terminal illness or something like that and deny me care. But I would want a human to review that because just because you have a pr genetic predisposition to something doesn't mean it's gonna occur. Right? Like right, right. Right. It it just like it it completely baffles me. Like the the term profile is very scary to me. I should say like
Walter Haydock: Well, that's actually illegal right now, what you just described. That is illegal currently, yeah. Yeah. Mm-hmm.
Stephen Dufour: creating profiles
Walter Haydock: Yeah.
Stephen Dufour: of individuals and groups of people. very scary stuff.
Walter Haydock: Yeah, I'm not sure what the right answer is. I mean, I I always you know, something that I say that sometimes people look at me a little cockeyed when I say it, but it's like anytime that you start to regulate insurance, you're you're basically kind of defeating the purpose of it because insurance is a predictive activity. It's you're saying, you know, over this period of time, this number of people are gonna have this type of condition or this they're gonna suffer this type of loss. And then when the government comes in and starts saying, Whoa, hold hold on, you can you can only incorporate, you know, these certain factors, you can't incorporate these other factors. Like, for example, with with healthcare, you can only incorporate age, zip code, and tobacco status, and I and perhaps gender. I'm not sure if if that's correct, but you can't incorporate, you know, cardiovascular exercise, you can't incorporate sleep, you can't incorporate all this stuff that's like incredibly predictive of of health. You can incorporate diet into your underwriting by by law. And the government's like, well, you you should you should predict. You should make these predictions, but but we're gonna tie one hand behind your back about how you make them. On the other hand, you know, I understand people don't want information to be to be used against them. you know, especially if there's nothing they can do about it. It's one thing, frankly, you know, if it's if it's like how much you're exercising because everyone can do something, you know, you can even if you're you're disabled, you can you can you can do something, you know. you can do you can do more than nothing. And yeah, I I get that people don't want their information used against them. But at the same time, like if you're gonna limit how you can make predictions using artificial intelligence or otherwise, then just understand that the outcomes are not going to be as good. And I think I think we've kind of drifted one in one direct too far in one direction in the United States.
Stephen Dufour: Yeah, and for for those watching that don't understand what we're talking about, look at your vehicle insurance, right? So you may never get into a wreck and obey every speed limit. And you stop at all the stop signs, never get a ticket, never get in trouble, but you find your insurance continuously going up. You'll you'll see whenever you get vehicle insurance. We'll grab your gender. Your name, driver's license number, so they can see how many speeding tickets you have. And they create a profile on you based on who you are, not necessarily like like all all the variations of who you are, like weight and things like that, just things applicable to driving, including your zip code. And then sometimes you'll have these insurers who will ask how how far do you do you have to commute on a daily basis to and from work and things like things like that. Create this profile that are that ends up getting compared to other profiles, so on and so forth, to figure out your rate. So you may never get into a car wreck or have any type of like negative vehicle outcome or anything like that. You're paying for the rest that do within your your particular profile. So that's really what we're talking about. yeah. But like you said, pros and cons for both in this case. But yeah, I I think you're a hundred percent right. Don't leak your own genome out on the internet. Only bad can come out come from it potentially. So
Walter Haydock: I mean, you know, hey, if i free country, if you if you decide the the reward is worth the risk, then then by all means do it. But that's just my personal threat model at this point, having been so thoroughly breached at this point in my life. Cool. You wanna move on?
Stephen Dufour: Yeah, what's the next one?
Walter Haydock: Yeah, so next one is the release of GPT five point six that is going to be coming out tomorrow. And it also it's the GPT is gonna release the Seoul, Terra, and Luna models for for five point six, which apparently they underwent some government testing. There was There's a select group of organizations whose participation has been shared with the government, and there will be broad access coming out. We don't believe this type of government access should become the long-term default, OpenI And I think this is very interesting considering it comes on the heels of the export restrictions that were levied against Anthropic for Fable V and Mythos V, which basically forced them to shut down access globally. And also the the White House. made some comments about how there would be an FDA for AI from the director of the National Economic Council. But then many people in the administration came back and said, no, there's there's gonna be no FDA for AI. but looks like there is some sort of, you know, pre pre-release testing going on. And and and there was a post facto government order, you know, demanding that Anthropic take down access for some of its models. And you know, there are costs associated with that. So, you know, may maybe maybe we are kind of drifting towards something of a of a of an FDA for AI in in in all but name. And you know, that's kind of the worst approach because when you have this shadow regulatory system where it's kind of like, you know, you do something and then you get punished after the fact because you did something that you didn't know you weren't supposed to do. that that kind of chills innovation. So I think we should I think we should revisit this and say, you know, are are we creating an FDA for AI? and if so, let's let's do it. But if not, let's let's not. And then I, you know, I there's another article that I'll share that yeah, the outgoing the outgoing AI advisor for the Trump administration, Sri Ram Krishnan, he said, you know, There will there White House won't create an FDA for AI, but you know, I'm I'm I'm I'm seeing seeing something different. So I would say to the administration, let's let's get our story straight here and decide whether the government is gonna get involved in AI regulation and to what extent. And if so, then let's have a national framework, let's have a let's have a bill that goes through Congress that gets negotiated, that preempts the state laws. But the current approach is is not super desirable. So I'll stop there.
Stephen Dufour: Yeah, and the the situation that you described creates a lot of un uncertainty, right? So like any th anything you want to enforce needs to be written down and approved, right? So like at the organizational level, we're talking about like policies, right? These are the positive good behaviors you want at your company, right? Like the company shall right do all of the all of these things. If you don't have that written down at your company and have appropriate training. Nobody really knows what to do until they mess up and it's after the fact, right? So, like this parallels exactly what you said and it creates a lot of uncertainty on a on a path forward. and so like according to the articles and like what you've read, this really seems like even the government doesn't know what to do whenever a particular thing can be used for both positive and negative outcomes, right? Like, We can use this thing, right? Like to help drive business and like find genomic like like data analysis. We can save months of time, like and do all these things. And at the same time, to your point earlier, it can be weaponized in in the same industry or different industries or whatever it happens to be. It can take this good thing and turn it bad. So w my question to you is what do we do? Like let's say hypothetically that Your company has frontier models that are more than capable. like it's it really seems like an overreach for the federal government to force any company to pull something, right? Because if you think about it, everything is dual use, right? So, like a vehicle, like a knife, a gun, whatever it happens to be. and they're looking for some kind of regulation to I guess prevent access. but also maybe limit the actions based on potentially a user profile or some something like that. what are your thoughts on that?
Walter Haydock: Yeah, I mean, I agree everything everything can be dual use. I think the anthropic situation is is pretty interesting because in my opinion anthropic wanted a regulatory regime in place that would essentially create an oligopoly where open AI, Anthropic, you know, maybe Google and And Microsoft and Amazon were kind of allowed to have these super powerful AI models that could yeah, tech giants that could deploy advanced cyber capabilities, things like that, and basically create this mass of regulation that would prevent any sort of upstart from breaking through because they would need to meet all these regulatory requirements and
Stephen Dufour: Tech giants.
Walter Haydock: I think a lot of the frankly fear mongering from especially from Anthropic, but also from OpenAI was was a result of that. And the blowback that occurred as a result of this commerce department order on export export control, you know, it potentially kind of gave them a little bit of a a a black eye and kind of reminded them of of potentially the fact that it's a double edged sword if you are going out and and kind of making these pronouncements, then you know, maybe people will start listening to you actually and and and doing things about it. You know, if you say that this that mythos is is a reckoning for cybersecurity and it's so dangerous, then you know maybe the government's gonna say, okay, we'll we'll believe you on that and we're gonna ban, you know, any non-US citizens from using this using this tool. So I think I think the hyperscalers should be careful in what they wish for. And you know, and and trying to build those those regulatory moats because they can get they can get caught up in them, certainly, as we've seen. And again, it just goes back to we need a national framework for AI governance, and the president should submit a bill to Congress and get it through the process and pass it into law, and then we can all say, This is what we've agreed on, this is what we're gonna do. It's all very piecemeal at this point.
Stephen Dufour: Yeah. making it up as you go along and some of it like I think it was the Colorado bill. they found it was unenforceable, like nobody actually knew how to do it. So they went back to the drawing board. yeah, it's very interesting that the anthropic and then I think I think first it was anthropic, then it was open AI talking about their their models that have a reckoning for cybersecurity. This answers the question of what happens when your marketing goes like goes too far, right? Like there's difference between the fear-based portion of it, right? Like grant sure, grounded in reality. And at the same time, what the really, really good example of what happens when somebody actually believes you. Right. And I was excited whenever that those announcements came. I was like, you know, we can make our products better. We can secure this on behalf of our customers who trust us to do the appropriate thing. And at the same time, think about the future of sub subscription models. So like I remember before any subscriptions, you had to pay $700 to Adobe for Photoshop on disk, right? But it was one and done and it was yours, right? Now we have subscription models where pretty much everything on the planet is now subscription based, which is both good and bad, right? So instead of having the upfront costs, you get to pay monthly from it for it. So whenever you have these models that you end up depending on, whether it be for a particular workflow operationally or revenue generating or even cybersecurity related, which we might fall into the operational category, when you become dependent, and that's why I call these things dependencies, dependence on a particular third party to provide something of value. That way you yourself can create value. they're g you're basically at the will and mercy of them right so just like netflix did and just like youtube did they have a particular price point they want you to become dependent on their particular systems then they're gonna up the cost of it because somebody's gotta pay for all these things that's one of the reasons why they're building all the data centers right everybody is using these they're becoming dependent on it and they see the opportunity there Not like some conspiracy theorist. It just happens, right? Like we're at we're at a particular price point here. In the future, it's gonna be larger, more expensive, and you're gonna be forced to pay for it.
Walter Haydock: True. So we move on.
Stephen Dufour: Yeah, let's move on to some Chinese robots. Alright, let's see where we go. I think it's this one. I mean if you yeah, it's that one. All right. So I saw this in one of my news feeds. Or maybe Crystal sent it over. Very exciting stuff as far as robotics go. So Chinese company UB Tech has the U One series robot that they released. I wanna say like maybe close to close to two two weeks ago. At a robotics conference, and they were one of the prisoners. Why this is important is because they have, I want to say, three or four tiers of robots. All of them have embedded large language models within them. So the first tier looks very odd. No arms or legs, it's just this torso and this head is conversational. And so what they displayed was this particular robot. It's placed at a desk at the entrance of a of a business. That way somebody walking in can ask questions of it, check in for an appointment, find directions to a particular office, whatever it happens to be. Lowest price point. Highest price point is a role robot with arms, legs, torso, head, large, again, large language model embedded. And the demonstration that they showed for I guess the dexterity of the robot. was a real human being dancing with the robot. And it was pretty impressive. And one of the reasons why they're doing this research, so there's a combination of things, right? Business efficiency would be one of the reasons, but on the on the more human side, there's a problem within China of the aging population. And so what that means is there's a lot of older people alone and isolated. And so if you're alone and isolated, And you're getting up there in age, there's a lot of mental health problems that happen. So this is one of their solutions to giving, I guess, those isolated and or older companionship. And so you can basically purchase a companionship robot to have conversations with and get that particular inner interaction for the sake of mental health. On the other hand, this opens up so much risk as as far as the future holds. So, for example, we've already seen the large language models going rogue, giving giving pad advice, collecting information without our consent. and I understand that China's a little a little bit different as as far as the way the country is run and operated. It's just very concerning when you have potentially somebody of the older generation that doesn't necessarily understand technology talking to this robot because it has voice capabilities and language capabilities and understanding that it might be inappropriate not to volunteer information to this pi particular entity. So I have four links to put it put in the chat. again, great opportunity here to help humanity, but at the same time much larger privacy implications there. but again, I am hopeful for the future with things like this. I'll I'll put all four of these links, including a couple of YouTube videos in the in the chat. yeah, here here's the image of the armless and legless torso.
Walter Haydock: That's a little freaky.
Stephen Dufour: Yeah, it is. but this this thing I I'm not sure if you if you use any any of the voice chats in in AI or anything like that. I do. sometimes like when I'm driving and I want to know know about a particular topic. It's like, hey, tell me all all about this news article or tell me about the US men's soccer team or whatever whatever it happens to be, right? That way can still still be hand hands-free. I'm really curious about what China is gonna do as far as like the security and privacy of these things, because some of them are very coordinated and could potentially help you around the house, right? Then also some of them can be trained on what you do and how you do it. So, for example, if I'm an older fellow and I have problems. grasping a glass or something to that effect because of of hand issue due to age or injury or whatever it happens to be. I can show it multiple times how to do it, how I want it arranged, so on and so forth. And then it just does it. Right. So then it's going to have act potentially access to your home, access to we hey, we saw these this with all the agentic stuff, right? So I spin up the MCP server and I've got agents like doing all this stuff. It has access to my credit card information, personal information, whatever it happens to be. What could it not do with all of this information? And then combine that with the age and that really understanding really what's going on and what the capability of these things quite concerning. So, like, do you do you have any knowledge of how China is? regulating artificial intelligence or anything like that? Sorry to put you on the spot. That wasn't rehearsed. It's on the spot question for Walter Haydock.
Walter Haydock: China has passed a range of laws with respect to AI and data privacy and you know, to what extent they are for show and what extent they are actually being honored, I think is an interesting question, as well. So, you know, frankly that's not something I I I can't drill deeply into it, but you know, definitely certainly fodder for our future podcast, I think. Would be would be worthwhile.
Stephen Dufour: Yeah, that'll be good. Yeah, because one of the companies I previously worked for had a actually multiple ones, had multiple data centers over in China and they're they're at the mercy of whoever ran the data center in this case. Chinese government enforced a particular restriction on Chinese consumer data and it could not leave the country, so and you had to rent a space within the Chinese data center. And then you weren't allowed to even view some of the stuff. We we had to use remote desktop to even view some of that data for analysis purposes and and things like that. And even then it was only like a handful of companies where it wasn't Microsoft Windows remote desktop, it was some other third third party that was on a very short of approved list and things like that. I imagine th it's gonna be something like that, but again, we we can go in the deep dive.
Walter Haydock: Mm. Mm.
Stephen Dufour: On a on a later later episode there.
Walter Haydock: Sounds good, man. Well, with that, I think we can wrap up for the day. I appreciate you jumping on as always and talking through the latest and greatest in AI and governance, risk, compliance, cybersecurity, and privacy. So this has been the Deploy Security Podcast. Thank you very much for tuning in, and we'll see you next time.
Stephen Dufour: Thanks. Bye.
Stephen Dufour: You too, sir.
Walter Haydock: So we've got a couple different topics to cover today. We've got some legislative updates. We've got some interesting hallucinations from AI. We've got some you know, model releases upcoming from some of the hyperscalers. So with that, I'll turn it back to you, Steve, so we can get right into it.
Stephen Dufour: All right, here we go. So the first thing we're gonna talk about, let me share my screen. no. And w we've seen similar stories as this one where somebody releases some sort of chatbot for their business, whether it be informational or to actually to to help the end user achieve a specific goal or gather more information or whatever it happens to be. you would think that some of these companies would learn lessons from the other companies that have done this. I think there was a a car vendor. chatbot incident that happened where somebody was basically mess messaging back and forth with a chatbot and the chatbot ended up selling it to this person for something like a dollar or something like that. And then it got held up in court. Another one is the Southwest chatbot where it ended up giving my wife a cookie recipe or so or some something like that. and so we have a similar
Walter Haydock: Mm-hmm.
Stephen Dufour: story here from TripAdvisor where the AI assistant who's supposed to be helping the end user plan out their trip, giving them bad advice, right? And so it it's it's such a similar story. I'm I'm really surprised and maybe you differ in this opinion. I'm really surprised this is still occurring so often where these chatbots just go rogue and end up doing something that they're not supposed to do. In this case, this AI chatbot, like its sole function is to help somebody plan a trip. Not necessarily a bat trip, right? So that that's that's what this chatbot ends up doing. It it uses the information and doesn't volunteer the rest of it. It's basically trying to make an over overly negative hotel or venue or trip into a more positive experience. Like some of the examples given here were A a particular resort in another country was facing sexual harassment claims by its guests and neglected to actually tell tell the end user that. Other ones, as shown in this particular photo, where the just the conditions of the room itself were awful and nobody would want to stay there. So so in the end, we're back to where we started. Don't use the AI chatbot. Go and use actual user reviews, right? Like sort that by the lowest rating and just read, right? because in the end you're the one making the decision and you're the one that's gonna have to deal with the negative outcome, if any.
Walter Haydock: Yep. Always need to apply that human oversight to AI use. And sometimes AI isn't the right tool for the job. Sometimes a simple review of the star ratings will will do.
Stephen Dufour: And and I get I get where they're where they're coming from, when they want to help their end users, you know, plan a trip, use the service, make it easier. And in the end, I don't like mission failed.
Walter Haydock: Yep. Sometimes there's just pure failure and hopefully we learn from it and move on. Cool. Speaking of moving on, should we jump into the next topic? Yeah, so big news out of Illinois. They I will share my screen. they
Stephen Dufour: Go for it.
Walter Haydock: just passed a new law called SB315, which is the Artificial Intelligence Safety Measures Act. It has some interesting requirements around building in a a frontier framework for hyperscalers, mainly those over $500 million in annual revenue. So open AI, anthropic, those types of firms will be Caught up in this requirement, but a key new development is that it mandates an independent third party audit for these frontier frameworks. And I actually did some some digging into it and the bill's requirements. And and the bill is is interesting because it it it actually makes it kind of tough to do the third party audit, the independent third party audit, and You know, of course, this this podcast is sponsored by Stack Aware, so you're gonna get a little bit of a little bit of Stack Aware advertising in here, but essentially it requires an independent third-party audit of the Frontier model, but at the same time, it requires that third party to render advice and recommendations on how to improve the frontier framework. So under Rubrics like ISO 402001 or High Trust AI security, the assessor or the auditor is not allowed to give consulting recommendations on how to implement the framework. They basically just go in and say, Are you meeting the standard? Are you not meeting the standard? So I think that creates an interesting dynamic for companies that are seeking to meet the requirements of this new bill. I I will say that Stack Aware has helpfully Put together a a new guide on how hyperscalers can meet the ISO or the 315 requirements and ISO 40201. So bottom line, I think doing an internal audit using ISO 40201 and SP315 together is the way to achieve the requirements of the bill. And I I think that the the traditional audit firms might actually be hesitant to to get involved in this because they might contaminate the the management system with their with their consulting advice and then they couldn't then audit it afterwards. So I think that's that's interesting. we're seeing all sorts of these requirements popping up all over the place. We've seen California with the Transparency and Frontier Artificial Intelligence Act. We've seen New York with the RAISE Act. So we're seeing the states building their own AI governance frameworks for the frontier models and then also for kind of smaller players that are deploying AI systems Colorado with their revised SB 189. So a lot of stuff in flight. And you know, staying on top of all these requirements is certainly challenging. But, you know, if you need help, talk to Stack Aware.
Stephen Dufour: Yeah, that's it's very interesting. All the states releasing their own and there's really no federal government guidance. Like it's really good potentially for business from an overall standpoint, but like you said, keeping track of all the state requirements can be pretty tedious. That first point you made where it had a requirement for an external assessment. did it give in Any guidance on what qualifies what or sorry, let me rephrase that. Did it give any guidance on the qualifications of the external assessor? Like could it be my neighbor who's a firefighter? You know what I mean?
Walter Haydock: That's that's a good good question. So actually what I'll do, I'll just I'll just pull up the full text of the bill and we can we can talk through it because it it basically just says the qualifications are they need to be qualified. yeah. Yeah, okay. Here here we go. Yeah. I'll I'll pull this up in a second. Yeah. They must be qualified by being qualified. All right, can you see my screen here? Yeah, so basically it says the third party shall conduct audits consistent with general accepted standards and then shall possess demonstrated competence to perform the audit, including experience employing or contracting with the individuals who possess possess technical experience in the safety of frontier models. So you you shall be competent by being competent. Probably because
Stephen Dufour: Yeah, that's
Walter Haydock: I don't think the Illinois legislature knows what an audit of a frontier AI framework would look like.
Stephen Dufour: Right. And I don't like the word best practice in there. Like so like I learned this a couple of years ago, like during one of my educational ventures. There's common practice, then there's the application of the common practice within the context of your company, right? Where it becomes your best practice, right? Because like imagine if we all had seven factor authentication and cat cards and like all this stuff, like we wouldn't be able to get any work done, kind of like the federal government. But yeah, exp expertise in the safety of frontier models. That's like first thing that popped into my head was were these job requirements where like the new technology has only been out for two years, but they require seven years of it type of thing. It's like they're exactly like yeah, this very it's very interesting. I did
Walter Haydock: Yeah. Seven years of clawed code experience.
Stephen Dufour: Did this say when it actually goes live?
Walter Haydock: So the audit this bill goes into force January first, twenty twenty seven. And then starting January first, twenty twenty eight is when you need to start doing these audits.
Stephen Dufour: So there's plenty of time to become an expert. This is this is the notice to everybody in what what'd you say, Illinois?
Walter Haydock: Yeah, or or well, I mean, anywhere really, because you don't need it doesn't say you have to be in Illinois. You could you could doesn't even say you need to be in the United States. You could be you could be anywhere.
Stephen Dufour: shit, it's that broad. man, this is awful. Like I said, plenty of time to become an expert in all all the things.
Walter Haydock: Yeah, I mean, don't compete with Stackware 'cause we will will crush you. But aside from that, you know. Go for it.
Stephen Dufour: Okay.
Walter Haydock: So cool. Should we move on?
Stephen Dufour: Yeah, let's move on to LinkedIn. It's my favorite social media platform. It's actually my only social media platform. Does LinkedIn count as social media? Okay. It's us being s social, I guess. All right, so the next thing to talk about, and I am gonna completely butcher this individual's name. feel free to connect correct me. Yoon Ashley? I don't know.
Walter Haydock: Yeah. I don't know.
Stephen Dufour: It's fine. So this individual is the chair, Department of Medicine for Stanford University, as well as the founding director for Center for Inherited Cardiovascular Disease at Stanford Health. That is their credentials. He posted on LinkedIn two days ago about a study that he and a group of scientists did. I think it was back in two thousand nine, whenever they started. And then the actual published study came out in 2011. What it boils down to is they did genomic discovery and analysis. And it took them nine months to complete the study with 30 people and staff, like 30 scientists, right? So again, it took them nine months. They replicated the same study using Claude in 30 minutes. This is this is I'm not saying that. Everybody out there in the scientific community should should do this, but this is a really good approach where a group of experts went out and did a thing using their expertise and then attempted to perform the same study using artificial intelligence, right? And that would be the ideal situation. That way you can weigh the two separate outcomes. And also you could potentially use Claude to look at your previous study and see if you missed anything, make it better. doing an analysis to make sure that nothing was missed, whatever it happens to be. So I I tend to tell a lot of negative stories where somebody failed. So I was really excited to see this one out there where we have a really good justification from a business sense for using artificial intelligence. So nine months versus 30 minutes, and I think somewhere yeah at the bottom I says Prompt was 180 words, 400,000 tokens were used, and it cost about five dollars. Again, the practice people using artificial intelligence probably want to pick up on is the human review of an expert on the output and the final results of whatever it is you're using artificial intelligence for. Because in this case, this particular individual. Let's just say Dr. Ashley, right? Because I'll butcher his first name again. did the analysis on his own genome and replicated it, right? In your particular, and this is for listeners out there, in your particular business case, it might not be appropriate to perform a parallel study or parallel business case using artificial intelligence without Making sure your terms and conditions, your NDAs, your BAs, whatever they happen to be, are appropriate and aligned to the expectations of your clients, especially if you're the custodian of some particular data set. we were talking about this earlier. If it's your own data, go for it. It's the United States. You have that freedom to make that choice and you use your data as you please. Just know that the ramifications of using something like Claude, you might be giving up. your privacy and security for the sake of an experiment. But I think this is a really good example of what we're gonna see in the future where we have these business cases, whether they be scientific in nature or not, and we're gonna have outcomes that justify the cost. And like we as a species might benefit from it, right? So I'm not sure if if the listeners or you are familiar like Mars Corporation, like the Candy Bar Corporation, their supply chain in manufacturing candy has a lot to do with crop resilience to pests and insects or even weather and climate right so Mars and other companies are very very invested in genome sequencing and other things like that basically supply chain security right so they will invest a ton of money and a ton of effort to do those particular studies where we all benefit right like the candy corporations of course but at the same time just in general food just look at the peanut right the peanut is of course like in peanut butter and all kinds of candies but in general just food. So I think if companies take this approach, specifically the companies that that have a vested interest in the food and supply chain, as well as just like the food we consume at consume at home, we'll just be better off as human beings.
Walter Haydock: Awesome. Awesome. Yeah, I think there's huge potential for using AI for healthcare purposes, is obviously both you and I are are quite familiar with from our work. And I think on the genomic side, it's great to see that there's a lot of labor and cost savings from from this approach. I will say that interestingly enough, the hyperscalers OpenAI and Anthropic, I think last month put out a letter talking about the risk of genomic bioweapons being created using AI. And that's kind of the flip side of this picture. I'm I'm a little bit of a tinfoil hat when it comes to my my genome in that, you know, I I'm the most breached man in America, I think. You know, my fingerprints were stolen in the OPM hack. So they're sitting in a Chinese intelligence service database right now. But, you know, the one thing that I think I've kept from from getting stolen so far is my genome. And I I'm going to try very hard to keep that private. And I wouldn't probably wouldn't dump that into a commercial version of of of Claude, which I'm assuming this is, the, you know, with with kind of the consumer, with the consumer terms without, you know, any any obligation to confidentiality and you know, I don't know what the data retention terms are. So, you know, do your do your risk reward analysis, look at the terms and conditions, evaluate. what what the risks are. Maybe he's like, hey, my genomes everywhere. I mean, I it looks like he even posted like what is he he had an illness, a genetic disease. you know, more power to you if you want to be that transparent. That's that's that's all well and good. I think we're gonna see, you know, in in the United States with with healthcare, we have kind of the worst system possible in that we have we have all the the negatives of a heavily regulated
Stephen Dufour: Yeah.
Walter Haydock: system. So, you know, there are lots of rules that kind of impede innovation. And then at at the same time, we also have the kind of the the cutthroat profit motive. So combining the two, you have really expensive healthcare that isn't super good in in my opinion. And I think I think that you can substantiate that through through the data. And over time I think, I think frankly, like the insurance offerings, the health insurance offerings are just going to collapse because people can't afford them. And then the people that are on them are the ones who need the health care the most. The healthy people aren't aren't getting health insurance. And you know, the whole point of Obamacare and things like that was to balance the risk, to share the risk. And you know, since there's no penalty, there's no financial penalty for not having health insurance, A lot of people aren't going to. And then there are all sorts of alternative offerings. You know, there's like Medishare, which is a faith-based crowdfunding platform. There's there are kind of non non-religious ones as well out there that are not health insurance, and they do things like they exclude people over a certain BMI, which you can't do with with health insurance. And I think the those types of platforms are going to be enabled by AI to be very discerning in terms of who they let in and and they're outside the existing insurance frameworks and and regulations. And you know, you can say, hey, you know, you you won't have you know, catastrophic cap, you won't have all this type of stuff if you go with one of those options. But if you're talk, if you're talking to somebody who just simply can't afford that type of insurance, they're gonna say, you know, okay, that's fine. I'm just gonna go with with the option that I can't afford. you know, it'll help me with some of the smaller bills. And I think we're gonna see AI, you know, for lack of a better term, profiling and underwriting kind of enter the market that way rather than through the traditional insurance providers. And I I think those companies are are frankly gonna need to find a new business model because their product is just not very good. So I think AI will help, but it will also hurt some people because you know, genetic diseases. Pre existing conditions, you know, those can be those can be excluded from these non-insurance products that a lot of people are gonna start relying on.
Stephen Dufour: Yeah, 100% agree. And that's I think where the human discernment portion of it comes in. Because to your point, let's say I upload my entire genome to something and it gets leaked or whatever. It's just out there on the internet. Public S3 bucket, everybody has access to it. And my insurer, my insurer downloads it, does an analysis, and I might have a genetic pre display. disposition to a terminal illness or something like that and deny me care. But I would want a human to review that because just because you have a pr genetic predisposition to something doesn't mean it's gonna occur. Right? Like right, right. Right. It it just like it it completely baffles me. Like the the term profile is very scary to me. I should say like
Walter Haydock: Well, that's actually illegal right now, what you just described. That is illegal currently, yeah. Yeah. Mm-hmm.
Stephen Dufour: creating profiles
Walter Haydock: Yeah.
Stephen Dufour: of individuals and groups of people. very scary stuff.
Walter Haydock: Yeah, I'm not sure what the right answer is. I mean, I I always you know, something that I say that sometimes people look at me a little cockeyed when I say it, but it's like anytime that you start to regulate insurance, you're you're basically kind of defeating the purpose of it because insurance is a predictive activity. It's you're saying, you know, over this period of time, this number of people are gonna have this type of condition or this they're gonna suffer this type of loss. And then when the government comes in and starts saying, Whoa, hold hold on, you can you can only incorporate, you know, these certain factors, you can't incorporate these other factors. Like, for example, with with healthcare, you can only incorporate age, zip code, and tobacco status, and I and perhaps gender. I'm not sure if if that's correct, but you can't incorporate, you know, cardiovascular exercise, you can't incorporate sleep, you can't incorporate all this stuff that's like incredibly predictive of of health. You can incorporate diet into your underwriting by by law. And the government's like, well, you you should you should predict. You should make these predictions, but but we're gonna tie one hand behind your back about how you make them. On the other hand, you know, I understand people don't want information to be to be used against them. you know, especially if there's nothing they can do about it. It's one thing, frankly, you know, if it's if it's like how much you're exercising because everyone can do something, you know, you can even if you're you're disabled, you can you can you can do something, you know. you can do you can do more than nothing. And yeah, I I get that people don't want their information used against them. But at the same time, like if you're gonna limit how you can make predictions using artificial intelligence or otherwise, then just understand that the outcomes are not going to be as good. And I think I think we've kind of drifted one in one direct too far in one direction in the United States.
Stephen Dufour: Yeah, and for for those watching that don't understand what we're talking about, look at your vehicle insurance, right? So you may never get into a wreck and obey every speed limit. And you stop at all the stop signs, never get a ticket, never get in trouble, but you find your insurance continuously going up. You'll you'll see whenever you get vehicle insurance. We'll grab your gender. Your name, driver's license number, so they can see how many speeding tickets you have. And they create a profile on you based on who you are, not necessarily like like all all the variations of who you are, like weight and things like that, just things applicable to driving, including your zip code. And then sometimes you'll have these insurers who will ask how how far do you do you have to commute on a daily basis to and from work and things like things like that. Create this profile that are that ends up getting compared to other profiles, so on and so forth, to figure out your rate. So you may never get into a car wreck or have any type of like negative vehicle outcome or anything like that. You're paying for the rest that do within your your particular profile. So that's really what we're talking about. yeah. But like you said, pros and cons for both in this case. But yeah, I I think you're a hundred percent right. Don't leak your own genome out on the internet. Only bad can come out come from it potentially. So
Walter Haydock: I mean, you know, hey, if i free country, if you if you decide the the reward is worth the risk, then then by all means do it. But that's just my personal threat model at this point, having been so thoroughly breached at this point in my life. Cool. You wanna move on?
Stephen Dufour: Yeah, what's the next one?
Walter Haydock: Yeah, so next one is the release of GPT five point six that is going to be coming out tomorrow. And it also it's the GPT is gonna release the Seoul, Terra, and Luna models for for five point six, which apparently they underwent some government testing. There was There's a select group of organizations whose participation has been shared with the government, and there will be broad access coming out. We don't believe this type of government access should become the long-term default, OpenI And I think this is very interesting considering it comes on the heels of the export restrictions that were levied against Anthropic for Fable V and Mythos V, which basically forced them to shut down access globally. And also the the White House. made some comments about how there would be an FDA for AI from the director of the National Economic Council. But then many people in the administration came back and said, no, there's there's gonna be no FDA for AI. but looks like there is some sort of, you know, pre pre-release testing going on. And and and there was a post facto government order, you know, demanding that Anthropic take down access for some of its models. And you know, there are costs associated with that. So, you know, may maybe maybe we are kind of drifting towards something of a of a of an FDA for AI in in in all but name. And you know, that's kind of the worst approach because when you have this shadow regulatory system where it's kind of like, you know, you do something and then you get punished after the fact because you did something that you didn't know you weren't supposed to do. that that kind of chills innovation. So I think we should I think we should revisit this and say, you know, are are we creating an FDA for AI? and if so, let's let's do it. But if not, let's let's not. And then I, you know, I there's another article that I'll share that yeah, the outgoing the outgoing AI advisor for the Trump administration, Sri Ram Krishnan, he said, you know, There will there White House won't create an FDA for AI, but you know, I'm I'm I'm I'm seeing seeing something different. So I would say to the administration, let's let's get our story straight here and decide whether the government is gonna get involved in AI regulation and to what extent. And if so, then let's have a national framework, let's have a let's have a bill that goes through Congress that gets negotiated, that preempts the state laws. But the current approach is is not super desirable. So I'll stop there.
Stephen Dufour: Yeah, and the the situation that you described creates a lot of un uncertainty, right? So like any th anything you want to enforce needs to be written down and approved, right? So like at the organizational level, we're talking about like policies, right? These are the positive good behaviors you want at your company, right? Like the company shall right do all of the all of these things. If you don't have that written down at your company and have appropriate training. Nobody really knows what to do until they mess up and it's after the fact, right? So, like this parallels exactly what you said and it creates a lot of uncertainty on a on a path forward. and so like according to the articles and like what you've read, this really seems like even the government doesn't know what to do whenever a particular thing can be used for both positive and negative outcomes, right? Like, We can use this thing, right? Like to help drive business and like find genomic like like data analysis. We can save months of time, like and do all these things. And at the same time, to your point earlier, it can be weaponized in in the same industry or different industries or whatever it happens to be. It can take this good thing and turn it bad. So w my question to you is what do we do? Like let's say hypothetically that Your company has frontier models that are more than capable. like it's it really seems like an overreach for the federal government to force any company to pull something, right? Because if you think about it, everything is dual use, right? So, like a vehicle, like a knife, a gun, whatever it happens to be. and they're looking for some kind of regulation to I guess prevent access. but also maybe limit the actions based on potentially a user profile or some something like that. what are your thoughts on that?
Walter Haydock: Yeah, I mean, I agree everything everything can be dual use. I think the anthropic situation is is pretty interesting because in my opinion anthropic wanted a regulatory regime in place that would essentially create an oligopoly where open AI, Anthropic, you know, maybe Google and And Microsoft and Amazon were kind of allowed to have these super powerful AI models that could yeah, tech giants that could deploy advanced cyber capabilities, things like that, and basically create this mass of regulation that would prevent any sort of upstart from breaking through because they would need to meet all these regulatory requirements and
Stephen Dufour: Tech giants.
Walter Haydock: I think a lot of the frankly fear mongering from especially from Anthropic, but also from OpenAI was was a result of that. And the blowback that occurred as a result of this commerce department order on export export control, you know, it potentially kind of gave them a little bit of a a a black eye and kind of reminded them of of potentially the fact that it's a double edged sword if you are going out and and kind of making these pronouncements, then you know, maybe people will start listening to you actually and and and doing things about it. You know, if you say that this that mythos is is a reckoning for cybersecurity and it's so dangerous, then you know maybe the government's gonna say, okay, we'll we'll believe you on that and we're gonna ban, you know, any non-US citizens from using this using this tool. So I think I think the hyperscalers should be careful in what they wish for. And you know, and and trying to build those those regulatory moats because they can get they can get caught up in them, certainly, as we've seen. And again, it just goes back to we need a national framework for AI governance, and the president should submit a bill to Congress and get it through the process and pass it into law, and then we can all say, This is what we've agreed on, this is what we're gonna do. It's all very piecemeal at this point.
Stephen Dufour: Yeah. making it up as you go along and some of it like I think it was the Colorado bill. they found it was unenforceable, like nobody actually knew how to do it. So they went back to the drawing board. yeah, it's very interesting that the anthropic and then I think I think first it was anthropic, then it was open AI talking about their their models that have a reckoning for cybersecurity. This answers the question of what happens when your marketing goes like goes too far, right? Like there's difference between the fear-based portion of it, right? Like grant sure, grounded in reality. And at the same time, what the really, really good example of what happens when somebody actually believes you. Right. And I was excited whenever that those announcements came. I was like, you know, we can make our products better. We can secure this on behalf of our customers who trust us to do the appropriate thing. And at the same time, think about the future of sub subscription models. So like I remember before any subscriptions, you had to pay $700 to Adobe for Photoshop on disk, right? But it was one and done and it was yours, right? Now we have subscription models where pretty much everything on the planet is now subscription based, which is both good and bad, right? So instead of having the upfront costs, you get to pay monthly from it for it. So whenever you have these models that you end up depending on, whether it be for a particular workflow operationally or revenue generating or even cybersecurity related, which we might fall into the operational category, when you become dependent, and that's why I call these things dependencies, dependence on a particular third party to provide something of value. That way you yourself can create value. they're g you're basically at the will and mercy of them right so just like netflix did and just like youtube did they have a particular price point they want you to become dependent on their particular systems then they're gonna up the cost of it because somebody's gotta pay for all these things that's one of the reasons why they're building all the data centers right everybody is using these they're becoming dependent on it and they see the opportunity there Not like some conspiracy theorist. It just happens, right? Like we're at we're at a particular price point here. In the future, it's gonna be larger, more expensive, and you're gonna be forced to pay for it.
Walter Haydock: True. So we move on.
Stephen Dufour: Yeah, let's move on to some Chinese robots. Alright, let's see where we go. I think it's this one. I mean if you yeah, it's that one. All right. So I saw this in one of my news feeds. Or maybe Crystal sent it over. Very exciting stuff as far as robotics go. So Chinese company UB Tech has the U One series robot that they released. I wanna say like maybe close to close to two two weeks ago. At a robotics conference, and they were one of the prisoners. Why this is important is because they have, I want to say, three or four tiers of robots. All of them have embedded large language models within them. So the first tier looks very odd. No arms or legs, it's just this torso and this head is conversational. And so what they displayed was this particular robot. It's placed at a desk at the entrance of a of a business. That way somebody walking in can ask questions of it, check in for an appointment, find directions to a particular office, whatever it happens to be. Lowest price point. Highest price point is a role robot with arms, legs, torso, head, large, again, large language model embedded. And the demonstration that they showed for I guess the dexterity of the robot. was a real human being dancing with the robot. And it was pretty impressive. And one of the reasons why they're doing this research, so there's a combination of things, right? Business efficiency would be one of the reasons, but on the on the more human side, there's a problem within China of the aging population. And so what that means is there's a lot of older people alone and isolated. And so if you're alone and isolated, And you're getting up there in age, there's a lot of mental health problems that happen. So this is one of their solutions to giving, I guess, those isolated and or older companionship. And so you can basically purchase a companionship robot to have conversations with and get that particular inner interaction for the sake of mental health. On the other hand, this opens up so much risk as as far as the future holds. So, for example, we've already seen the large language models going rogue, giving giving pad advice, collecting information without our consent. and I understand that China's a little a little bit different as as far as the way the country is run and operated. It's just very concerning when you have potentially somebody of the older generation that doesn't necessarily understand technology talking to this robot because it has voice capabilities and language capabilities and understanding that it might be inappropriate not to volunteer information to this pi particular entity. So I have four links to put it put in the chat. again, great opportunity here to help humanity, but at the same time much larger privacy implications there. but again, I am hopeful for the future with things like this. I'll I'll put all four of these links, including a couple of YouTube videos in the in the chat. yeah, here here's the image of the armless and legless torso.
Walter Haydock: That's a little freaky.
Stephen Dufour: Yeah, it is. but this this thing I I'm not sure if you if you use any any of the voice chats in in AI or anything like that. I do. sometimes like when I'm driving and I want to know know about a particular topic. It's like, hey, tell me all all about this news article or tell me about the US men's soccer team or whatever whatever it happens to be, right? That way can still still be hand hands-free. I'm really curious about what China is gonna do as far as like the security and privacy of these things, because some of them are very coordinated and could potentially help you around the house, right? Then also some of them can be trained on what you do and how you do it. So, for example, if I'm an older fellow and I have problems. grasping a glass or something to that effect because of of hand issue due to age or injury or whatever it happens to be. I can show it multiple times how to do it, how I want it arranged, so on and so forth. And then it just does it. Right. So then it's going to have act potentially access to your home, access to we hey, we saw these this with all the agentic stuff, right? So I spin up the MCP server and I've got agents like doing all this stuff. It has access to my credit card information, personal information, whatever it happens to be. What could it not do with all of this information? And then combine that with the age and that really understanding really what's going on and what the capability of these things quite concerning. So, like, do you do you have any knowledge of how China is? regulating artificial intelligence or anything like that? Sorry to put you on the spot. That wasn't rehearsed. It's on the spot question for Walter Haydock.
Walter Haydock: China has passed a range of laws with respect to AI and data privacy and you know, to what extent they are for show and what extent they are actually being honored, I think is an interesting question, as well. So, you know, frankly that's not something I I I can't drill deeply into it, but you know, definitely certainly fodder for our future podcast, I think. Would be would be worthwhile.
Stephen Dufour: Yeah, that'll be good. Yeah, because one of the companies I previously worked for had a actually multiple ones, had multiple data centers over in China and they're they're at the mercy of whoever ran the data center in this case. Chinese government enforced a particular restriction on Chinese consumer data and it could not leave the country, so and you had to rent a space within the Chinese data center. And then you weren't allowed to even view some of the stuff. We we had to use remote desktop to even view some of that data for analysis purposes and and things like that. And even then it was only like a handful of companies where it wasn't Microsoft Windows remote desktop, it was some other third third party that was on a very short of approved list and things like that. I imagine th it's gonna be something like that, but again, we we can go in the deep dive.
Walter Haydock: Mm. Mm.
Stephen Dufour: On a on a later later episode there.
Walter Haydock: Sounds good, man. Well, with that, I think we can wrap up for the day. I appreciate you jumping on as always and talking through the latest and greatest in AI and governance, risk, compliance, cybersecurity, and privacy. So this has been the Deploy Security Podcast. Thank you very much for tuning in, and we'll see you next time.
Stephen Dufour: Thanks. Bye.
