What Deepfakes Reveal About Brand Trust & Reputation ft. Josh McKenty, CEO of PolyGuard

speaker-0: Welcome to Control All PR, a podcast hosted by Eric Grau and Amber Krasinski, where PR, marketing, cybersecurity, and tech finally sit at the same table because most problems happen somewhere in the gaps between them. If you're looking for expert advice on how to handle AI and real conversations about its potential, consider this your hard reset.
speaker-1: So our first guest today is Josh McKentee, who is the CEO of PolyGuard. He's really passionate about transforming science into software to grapple with, you know, something that Eric and I have been chatting for a while about. Deep fakes, which frankly, scare the mages out of me. As they Josh's work as they should, right? So yeah, so Josh's work has been recognized by the UN, NASA, and a bunch of Fortune 500 companies. He really knows his stuff, and that's why we brought him in to have this conversation. And a couple fun facts, because I found these things fascinating. He led the development of the US government's first cloud computing platform at NASA, and then also worked on the UN-backed global earthquake risk calculation model. That's incredible, Josh. Thank you so much for coming onto the show. I just, ⁓ my gosh.
speaker-0: Really glad to be here. ⁓ And yeah, that was a while ago, but very fun projects.
speaker-2: to those. And like I mentioned before, we cannot leave out OpenStack, co-founder of OpenStack.
speaker-0: Yeah, people have heard of that one. And I was sort of, I was saying before the camera was rolling, you know, if you work in open source, you just hope that your project lives long enough to be hated, right? Because all open source projects end up hated sooner or later. then definitely OpenStack has been around for long enough to have gone through the hype cycle. People thought it would cure cancer and end poverty. And then they thought it was the worst thing ever. And now it's sort of. found its slow climb towards relevance. But I think actually the global earthquake model went through a similar life cycle, but ⁓ less in the public eye. There's some very important people who care a lot about forecasting earthquakes, but it's less pop than cloud computing.
speaker-2: Until it becomes a global issue, right? And then all of sudden everyone's looking for the keys or the answer that doesn't exist, but yet Josh will go, I have an answer.
speaker-0: The fun thing about disasters, no one cares about disaster until the day they care about the disaster. Which is way too late.
speaker-2: And even then, you don't have to.
speaker-1: That opening sound bite by the way, I loved that. That was a great one.
speaker-2: Remember that Netflix movie? What was it? Don't Look Up or something like that? Where like the world is literally gonna fall apart and everyone's just too busy, you know, YouTubing it or, you know, talking about it, but they're not really doing anything about it.
speaker-1: I would say. So yeah, so going back a little bit, because I know we've been talking about earthquakes and I do love that. You are the co-founder or the CEO of PolyGuard AI. And from my understanding, you're really looking at some enterprise grade defenses to kind of help with AI fraud. But dialing it way, way back, a lot of folks that are going to be listening to this podcast, they've They've seen the AI hype, they've heard about it, and they've gone to conferences. But for the non-techie people out there, what is a deep fake and how has that definition changed over time?
speaker-0: Yeah, great question. The term's not very old. ⁓ So for those of us like myself who are very old, the first public idea that looks anything like a deep fake was in the early 80s. It was a movie and then a TV show called Max Headroom. And the idea was, hey, here's a computer-generated news reporter that you can't tell isn't human. So you see him on the internet or in this case on television, because this is sort of technically the internet existed, but nobody had the internet in 83, 84. I saw that movie in 83 when it came out and I was a child and I was terrified. I was already interested in and using computers. And the idea that computers could be used to generate fake video was just astonishing to me. was like, this is sooner or later going to be the biggest problem we're ever dealing with. And people are like, what are you even talking about? That's not a problem. Like we can totally tell it's fake. You just watch the TV show and you're like, that's not a real person. Um, and so that was too early, obviously. then into the 2000s, we kind of had the Photoshop era where everyone took Photoshop and edited photos so that they didn't look like what they originally looked like. We had, nobody remembers now, but we had a lot of backlash around what is this doing to the idea of photographs as being evidence? How are we gonna be able to tell if it's actually something that really happened or not? And what does it mean for a journalist to say that they have fact checked something just by virtue of it having been a photo? And so that was kind of looming, but again, by the time people were really freaking out about Photoshop, video had become the sort of authoritative source of evidence, folks were like, no, it's fine. We'll always need the video to prove the photo's real in the same way that we used to use the photo to prove that the transcript was real or the event had happened. ⁓ And then fast forward to mid 2010s, I started blogging again about this problem in I think 2017, 2014, 2015. There were some TV shows that came out, the idea that the government would be editing video to make it tell a story that was fake, substituting pre-recorded video for supposedly real-time footage. ⁓ And this was a pretty scary idea. And I started talking about it again, but then 2017, someone coined the phrase deepfakes. And this was initially related to porn, but it was the idea that people were using deep learning which was the kind of AI we were all talking about at the time, to ⁓ generate photos that you couldn't tell weren't real. A little bit like Photoshop, really. And what's really different from Photoshop, for those of you who have used Photoshop, Photoshop's a very powerful tool. You need skills. know, getting a good result out of Photoshop takes work, takes expertise. ⁓ You can take a four year bachelor's degree in essentially using Photoshop. Using a fake. Or yeah, using a deep fake does not take skill. It takes a text prompt. It takes a ⁓ make Amber blonde text prompt. Make Amber fat and old, whatever, you know?
speaker-2: Yeah.
speaker-0: And so why does this matter? It matters because something that in theory can be done doesn't really turn into a problem until it's easy to do and it's easy for anyone to do. And then, then it becomes not just a problem, but the problem. And we've seen that over the last few years. We've gone from kind of defakes as a theoretical problem to defakes as a $40 billion a year industry. to, you know, this week we had bipartisan legislation tabled in Congress to raise the penalties for frauds that are perpetrated using AI of any kind, really targeting the deep fakes of ⁓ government officials. ⁓
speaker-2: had that mid-year, we had on the audio part, the fake with audio, which we can talk about that as well, voice clumps.
speaker-0: We had that. Yes, but we had it during the election campaign. We've had it. A number of different members of not just the US government, but other governments internationally. And we've had some very high profile failures to to recognize that those things were happening. You know, very sensitive data been handed over to. We don't really know who.
speaker-1: So quick question though, because there's a lot of jargon and terminology. I love my techies, favorite people. However, the amount of jargon that we have is just, it's a lot. So what is the difference between a deep fake and an AI clone?
speaker-0: Great question.
speaker-1: Or is it just semantics? That's the other thing.
speaker-0: Semantically, the implied difference is an AI clone has consent and a deepfake may or may not have consent. Deepfake is just about the technology and it's increasingly inaccurate because people aren't really using deep learning to make most deepfakes now. They're actually using GANs. ⁓ But yeah, an AI clone, especially the way Sora is using it or the way some of the big foundation models are using it implies that
speaker-2: Okay.
speaker-0: You have given consent for other people to use your likeness or you're using AI to manipulate your own likeness. And there are CEOs taking earnings calls using AI so that they can simultaneously answer questions in 50 languages. And their mouth looks like it's in sync with languages they don't know.
speaker-2: We use HeyGen and 11 labs we use. I want to go back to quick to GANs for anyone who doesn't know, I'm assuming you mean generative adversarial network, right? Yes. Perfect.
speaker-0: Yes. ⁓ Yes.
speaker-1: Okay, explain like I'm a 13 year old. What does that mean?
speaker-0: Okay, so, and this is gonna get at the heart of why detection is the wrong approach, by the way. You can never fight deep fakes with detection. here's the magic of AI is that AI is never one thing. It's often two things or three things or four things. And one of the most powerful forms of AI today is what's called a generative adversarial network. And what it says is this, you get two AIs and one draws a picture of a duck.
speaker-1: this.
speaker-0: And the other one criticizes it and says, that doesn't look like a duck. The tail feathers are too short. The beaks, the wrong color. And the first AI goes, okay, I've made the beak more yellow and I made the tail feathers long. And the second AI goes, yeah, but now it's too skinny and the background doesn't make any sense. It's in an airport and not in a pond. And you go back and forth until this AI goes, looks like a duck to me. think we're good. So what you have is a deep fake generating AI. And a deep fake detecting AI, anytime you build a deep fake detecting AI, you are making that system stronger and better at making AI generated deep fakes that the detector cannot find. Because you're giving the hackers a new component to make more powerful deep breaks with. So, N is any AI system that has those two components, one that builds a thing and one that tests the thing to force it to get better iteratively.
speaker-2: game. Wow. That's terrifying. I was just gonna say, I'm trying to think of a nice way to say it, but it's terrifying, that's all. And it's just getting more difficult and complex and, you know, similar to the virus industry, how, you know, the viruses are getting better, but then the means of tools to monitor for those viruses and try to detect new viruses that are emerging, know, those tools need to step up the game. So is that kind of like where we are here too, where the deepfakes are coming out, so now we gotta work on the backend and see, how do we, you know, well, detect, you didn't say detect, you said that.
speaker-0: You cannot win this section. is basically one winning strategy. This is a bit like war games. The only strategy is not to play, right? The only strategy in media. What we're talking about is synthetic media, right? And meaning it's generated as opposed to authentic media. Authentic media has provenance. Provenance says there was a real thing that happened and I pointed a camera at it.
speaker-2: There you go.
speaker-0: And I have some way of proving that those two things were true, that a real thing happened and that I had a camera. And a camera meaning a piece of equipment that captured a recording, not that synthesized a recording. Now that's actually really hard to do because almost every camera we use today has AI baked into it, including your phone, including your Canon, including like, you know, whatever BBC is now using. But we hope... that those cameras are using AI just to tweak with the lighting or improve the focus or play with the depth of field and not add or swap out different people and different soundtracks.
speaker-2: Yeah, exactly.
speaker-0: Yes. So, so what do you need to do to prove provenance? You need to prove that the camera was there at a very specific time and that it was made up of hardware that was known to be a certain kind of hardware. And so we use basically cryptography to Sign the individual frames as they come through the camera and say, here's this piece of hardware attached to the camera hardware that can say, yes, this is what was in front of the glass. It hasn't been changed yet. And it was exactly this time and place, which means time and place. Now you're into GPS, which means you do this into your smartphone and now you have a way of saying, okay, this is what happened. So that was where we started to build PolyGuard. That's not what we do today. and I'll get to that. There is an entire ecosystem around that effort. It's called the C2PA. The ⁓ acronyms are hard.
speaker-1: I was gonna say you said that and I thought C3PO immediately.
speaker-0: Content, ⁓ something and Providence authenticity. It's basically, it's organized by Adobe and Microsoft and a bunch of other software companies to say, we need a way to prove that things that were recorded are real and that the edits that have been made to them since were all legitimate edits. And here's the history of the edits. Who cropped the photo, who recolored it, who shifted the perspective, who published it. So you can now see photos and videos on LinkedIn that might have the C2PA logo appearing on them. That means they have that provenance stamp. And there are hardware companies like TruePic that produce these chips embedded in the cameras that allow you to sign the video stream itself, the individual frames.
speaker-2: And that's going further than just meta-tagging from like, you know, a Canon or an iPhone or an Android might have. This is actually something where it's more tamper-proof, ⁓ open standard for making sure it's more secure.
speaker-0: Metadata can always be removed and added. Exactly. Anything you can do. It's like a watermark. If I can put a watermark on, I can take a watermark.
speaker-2: So yeah, and I know there's many discussions by some of the AI companies and they're talking about how they can embed things into files to make sure we know it's the real deal. And that's great. If we ever get there with one standard that everyone agrees on, that'd be wonderful. And this is great because it's actually some of the questions I wanted to know about like exactly how does Polycard actually detect them deep fakes in real time?
speaker-0: Yeah, we do not detect so I every time you say that we're just like that's not what we do and no one can do that Well, there's a lot of people pretending ⁓ And even if what they have today sort of works some of the time it definitely won't work tomorrow And so getting used to relying on detection is garbage. Please don't do that It's the same as telling people to learn how to spot deep fakes Even if you can spot something that ⁓ well, they've got a lot of extra fingers. No, they don't
speaker-2: That was more.
speaker-0: None of them have extra fingers. None of them have lighting mistakes. None of them have metallic voices. None of that stuff lasted for more than 60 days because you can put it into a GAN and you can get rid of it.
speaker-1: So when it's robot versus robot situation happening. So then what the hell do we do, Josh? How do we figure out if it's deep bake or not?
speaker-0: And actually, when we started, I'm going to tell a tiny sidebar story. When we started Polyguard, I was really excited about solving this problem for real, right? So what's the solution that works forever, no matter what, for any level of security? And the answer is, provenance on the camera isn't even enough. You need provenance in the world. And so we came up with this scheme where you shine lasers in front of the camera onto what you're recording and you embed timestamps. onto the lasers so that they're captured into each frame of video. And I got a patent on that and then realized that really I can get everyone in the world to buy laser hardware that goes on every camera. Maybe to.
speaker-2: never know. You line up with a big company and all of sudden it could be Sony that has a chipset that's on an enclave and it's gonna be on all the cameras and now you got a licensing deal.
speaker-0: Yes. But what we realized pretty quickly is for most uses of video, there's a lot of video that matters for evidence or that matters for media. And there's this middle bucket of the problem that's just, sexual exploitation, right? And, and, and particularly that is where the early deep fakes were being used to cause a lot of harm, a lot of blackmail, triggering a lot of death by suicide. And. That is a gnarly problem that there are thankfully a lot of great folks focused on just that. ⁓ And that is one of those places where detection does help. Because if you can detect things that look like sexually explicit intimate imagery, then you can immediately answer the question of, there consent attached to this? And if not, it kind of doesn't matter whether it's fake, you know? So, but we stayed away from that problem. What we focused on was real-time communications, voice and video, like what we're doing right now. And so we built a prototype. went out and said, Hey, we have all this tech around being able to tell you if what you see right now is really what's in front of the other camera. nobody cares. What they care about is, is that actually Amber on the other end of this call? I don't care whether Amber's making herself look like a giraffe or not. You know the thing where the lawyer got into the call?
speaker-1: Exactly. I loved it. The second you said that I was like, yep, the guy with the cat was like
speaker-0: We got the cat filter. Filters are cool, yo. And we were flagging all these filters. like, hey, by the way, that's AI. And I was like, yeah, I don't care. Tell me if it's Amber or not. That's the risk. And we realized most of the fraud that's happening, almost all of the fraud that's happening around deepfakes is not because of deepfakes. It's impersonation fraud. It's because I'm pretending to be someone I'm not. And I'm using the deepfake to perpetrate that. I'm using the deepfake to add credibility to my assertion that I'm Keanu Reeves. If I look like Keanu Reeves and I sound like Keanu Reeves, you're much more likely to believe I'm Keanu Reeves. In fact, you can't help but believe that I'm Keanu Reeves because your brain is wired to trust what you see.
speaker-1: Exactly. So let's dig into that a little bit further, Josh. So in that case, I'm going put on my media literacy teacher hat. It's the hat I love wearing all the time. It just pops right on. Is it irresponsible for brands to use AI-generated spokespeople if the public can't tell the difference? And where is that ethical line between those things? You know what mean? Just to your point right there.
speaker-0: That's a great question. There are three separate questions, so let me tease them apart. One is this question of, it okay to license the likeness of an actor and not pay them to do the acting? If I can license digital Robert Downey Jr. and never pay him again, I just paid my license fee to use his face and his voice and his mannerisms and I'm gonna go make 50 other Marvel films, is that... Is that how we think about human work? And that question, by the way, is being asked of all AI systems today. Is it fair for me to take your output as an author and use it to train a model that can produce a book just like you, where you don't get paid? There are lawsuits happening today around this question of, it copyright violation or not? So that's a separate question. I don't want to answer that question because I don't think... ⁓
speaker-1: It's a rabbit hole of a question and we get into, yeah.
speaker-0: Society doesn't know what our answer is because we don't actually know what work means. We don't know what work means. We keep certain kinds of work in certain buckets. And we're like, well, if you're an artist, then it's art and that's one thing. And if you're a craftsman, it's craft and that's a different thing. And if you're a worker and someone else owns the copyright, then that's a different thing entirely. And these are value judgments that we have baked into law, but the laws are outdated and the value judgments are outdated. So let's set that aside. The second question then becomes, you, are you deceiving the public? Do they have a right to know a, whether it's synthetic and B, whether you're using synthetic content to perpetrate a lie. And so we have a simple framework for this, which is so far in most jurisdictions, not the US, but in most jurisdictions, you have a legal right to your likeness. So if someone generates Tom Hanks selling denture cream, which they did do, and Tom Hanks wasn't involved, that's illegal. You're robbing from Tom Hanks. You're stealing his credibility without compensating him for it. And you're probably using that to sell a subpar product because otherwise you would just contract Tom Hanks to endorse your denture cream rather than steal his likeness. So. The theft of endorsement is this clearer bucket of like, yeah, probably bad, generally bad. ⁓ And then this third bucket is if Tom Hanks did say it was okay, and he is getting compensated, but he doesn't want to be bothered, or he doesn't need dentures. And so it's a weird endorsement because he's like pretending to have dentures, but doesn't have them. Or it's a synthetic person who has never existed, but is being used to generate an entire brand, generate an influencer account, generate 100,000 influencer accounts. So now you end up with this, again, this weird line between is it art and craft and parody and satire or is it information warfare? If I personally do it and I make one influencer account, I did this when I first got on Blue Sky, I started sharing my Blue Sky account with... a meme generator, because I wanted to try using generative AI in the early days. And I was like, make me an image every day by taking the word of the day from Merriam-Webster and then using it to generate moody film noir style images with bad poetry generated by the AI over top of it. I don't like that's my blue sky account now is like weird meme generation of these of these moody images.
speaker-2: And that's one popular.
speaker-0: It was not popular, people did not understand it. It was a little bit-
speaker-2: ⁓ There was a lot of meme generators out there like everybody everyone had our website meme generator that were charging money for it now touch if you can do it for free, but you know ⁓
speaker-0: There's a very famous poet on Instagram who has made a lot of money selling merch and books and hoodies and whatever else to a particularly vulnerable tweener audience, you know, 12 to 20 year old girls primarily. I happen to know the person behind that account. I'm not going to out them. They are not a girl. They are nowhere close to that demographic. They are a very savvy commercial person, but they were early to the idea and they hand bombed a lot of the stuff early on. I'm like, I'll just write it. And I know what people want to hear and therefore it looks very appropriate to the audience. ⁓ the, is that illegal? No. Is it kind of tasteless? Yes. So I have a aesthetic judgment. Gross. But I don't have a legal judgment and I don't even really have a moral judgment. It's caveat emptor. ⁓ So then this last question of like, what about the synthetic CEO? What about this CEO who's generating content to make themselves look smarter? And so media literacy would say, hey, if I rehearse 50 times and shoot the demo video 50 times and speed it up a little bit so I sound a little smarter and I take out the ums and ahs and I crop it in this that way and the other, all of that is allowed. If I overdub it, as long as people sort of know, that's allowed. We've done that for foreign films for decades. And we put the other voice in the credits, right? The acting was me and the voice is Eric and people think that's fair. Where it is considered unfair is when we are ⁓ deceiving the audience.
speaker-2: Millie Vanille.
speaker-0: Huh? moment in time because since then people are like, ⁓ yeah, lip syncing to your own song is totally fun. Everyone does it. We all get that.
speaker-1: Unless your name is Ashley Simpson and you are on SNL with a throat situation in 2006. Bring it back.
speaker-0: or even EJ on Jimmy Fallon. Yes, you know, yes. I do half tuned down one half step down, but actually saying live. And I think she's a goddess like that entire performance blows my mind. But there was a lot of hate for people saying, how dare you sing it in a different key than what it was in the movie?
speaker-2: But is that more of a societal question? Is that more of like an issue we're having, you know, just everyone having a voice or 15 seconds of fame kind of like everybody has it now on the internet. You can go viral on one comment and you're all over the place. And I always say it's like, think it's pontificating about something they have really no control around. But, you know, also it's just something they want to be able to say out there so they'll have their opinion on it. And I think we're brutal.
speaker-0: How postmodern are you? Answer. you want, think we live in an era where we have become preoccupied by authority over the gaze, right? We have this idea of the language of the male gaze and a lot of negative connotation of like, how do men look at others? Is that gendered or not? Is how someone is presented their business or everyone else's business. Does it create a conversation with society or not? And
speaker-2: Really? Come on!
speaker-0: That was a very small debate in society up until we had social media and then it became a large and central debate in society of how are we all being perceived? How is it acceptable to present ourselves in order to then secure attention and then mock those who give us the attention? And so this idea that we want to exert control over how people see us by controlling how they see us and not how we present. We wanna present however we want, but demand that we be seen a certain way. This dialectic is where Deepfakes fits. It's like, oh well, filters. Can you use filters in social media? Sure. You call your friends? Sure. You put it on a dating profile? Yes, if you're under 25, no, if you're older than 25. Above 25, it's a taboo. How dare you make yourself look like what you're not gonna look like when I meet you in person? And how would you expect me to know that?
speaker-1: Yeah.
speaker-0: So this is the gaze and the responsibility inside the gaze from a postmodern standpoint is that's the conversation we're having writ large, which then becomes this last piece of deep fakes. People want to be lied to. They want to be lied to because they want reinforcement of the worldview they already hold. And you look at American politics.
speaker-2: success.
speaker-1: That's bars right there, Josh. That is really solid stuff. People, can you repeat that? cause.
speaker-0: People want to be lied to because they want reassurance that what they already believe is true, especially when they're worried that it's not.
speaker-1: into this ⁓ my god
speaker-0: or fringe your viewpoint, the more willing you are to ignore the problems with the provenance of the evidence that you're citing. At this point, you have to be really, really fucking fringe to think the world is flat. Just take it that as an example. I'm Your rating is I just messed up your rating, but you can keep PG-3.
speaker-2: There are some people out there. No, it's okay. No, no, no, we're okay with F-bombs, we're okay with speaking our minds here. Yeah, panty shirts, punk t-shirts.
speaker-1: band t-shirts
speaker-0: I should have asked first. So, so if you believe the world is flat, despite thousands of years of evidence to the contrary, and you're going to collect evidence online of the world being flat, you have to be willing to accept an incredibly low bar for that evidence. It has to be forged. And on some level you either have to know it's forged Or you are deliberately engaging in this postmodern argument of claiming something you know to be false as a way of trolling those who will argue with you. And I think heard a politician.
speaker-2: think I heard a politician once say that the perception is more important than actuality in the law. It's the perception of what might be.
speaker-0: Yes. Arguing that you are an elite for disagreeing with their belief about whether the world is flat or not. So they turn it into an ad hominem attack as opposed to a debate about substance. ⁓ there's a lot of anti-science sentiment that requires ironically, citation of false science to defend false science, right? Which, which is into the space into which Deepfakes fall. So then we get into when nation states do it. So we have people doing it and we're like, well, if you do it with your own image, it's kind of fine. If you do it with your girlfriend's image, you're definitely being a dick. ⁓ We get into celebrities and who's getting paid and that's kind of a commercial transaction. We get into like Iran spreading deepfakes about the conflict with Israel at a certain period in time and Israel doing the same thing and saying, well, if you're both using synthetic media to... promote a narrative about what's happening, neither of which narrative is actually factually complete. They're both biased narratives. They're both cherry picking facts. ⁓ But there definitely people will say, well, that one was much less true than this one in this particular moment in time. And this one is coupled with demanding that the social media platforms to press other accounts. So you're like, hey, we're promoting a false narrative and we're suppressing the true narrative. Well, now you get your fingers on the scales. That's definitely not section 230. You know, I was quoted in the press a bunch when this was happening around why is this bad? Why is it dangerous? What do we do about it? Is it actually illegal? Would it be illegal if it was happening where we live? And if you look at the legislation, not just that's been passed, but that's been tabled around deep lakes. No one wants to be illegal because every nation state wants the right to use misinformation and disinformation against hostile foreign governments and their own populists when they believe it is appropriate. So they can't make it illegal, which means they then can't really make it illegal in general, which is why we have deepfakes for intimate imagery. Definitely bad. Great. Covered that base. fraud that uses AI generally bad, but no mention of deep fakes in the bill. Even though the reason for the bill was a deep fakes problem.
speaker-2: Now, are you speaking about the AI Fraud Deterrence Act or is it another bill? So for the audience to know, that's a 2023 bill,
speaker-0: Tuesday. No, no, new one thing on Tuesday is a new bipartisan bill tabled by Ted Liu and some Republican member.
speaker-2: Yeah, Kevin Kiley. But that was it. So I thought when I looked it up on the Congress's site, the original was from 2023. Unless they co-sponsored another one. ⁓ So bringing to that though, and I think this is really important because AI in many ways for the last few years, but especially this year, it just seems like it's the wild west. It's everywhere. And the lines between the parody, the creative expression and the harmful fakes.
speaker-0: Thank you. new one.
speaker-2: They're getting very blurry. So we see the early attempts like some of these bills that I guess got modified or updated ⁓ last week. But what other regulations are that you've seen that are coming down? And also, more importantly, like how do we hold global countries to adhere to this? Because it doesn't help us if we're the only ones doing it and everyone else is doing whatever they want.
speaker-0: say the quiet part out loud, the only people who need to be regulated in this space are the social media platforms relying on Section 230. That's it. Deepfakes, as a weapon of information warfare and as a tool for commercial fraud by hijacking celebrity images and mostly in the weaponization of intimate imagery, those all play out on social media platforms. They're either private group chat in WhatsApp or they're public on X and threads and Facebook and et cetera. ⁓ So the number of entities that need to be regulated is very small, but they are all incredibly effective lobbyists. They are also international, right? So even if we add in the rest of the Baidus and the WeChat and the other international players, We're talking 25 companies globally that are relevant here. ⁓
speaker-1: But they're the ones that are creating the most amount of harm. So from like a, from a marketer standpoint, you know, you're trying to do the best you can with either your clients or the brand you're working with. What the hell do you do in this situation,
speaker-2: Seriously.
speaker-0: I wrote a policy proposal. don't know how to promote policy. I'm not a lobbyist and I've never been really involved in politics. So was like, I know how to solve this, but I don't know how to get anyone to agree that we should attack it this way. And the mechanism is really simple. In most cases online, if you say, Hey, that's bad. Take it down. The onus is on you to first off, get a hold of the social media company, which they do not make easy to do for an ordinary consumer. And second,
speaker-1: N-
speaker-0: prove that you have rights over the content, which you don't. So all of the take down today is built around DMCA, the digital millennium copyright app. And it's intended to say, I am a copyright holder. That is a violation of my copyright. Take it down because it's doing me economic harm. If we set up the same structures for folks to say, I own the likeness of my image. This is an unauthorized clone of my image. Take it down. And the response was to immediately take it down and then to have a dialogue with the folks who put it up to say, Hey, you have the right to claim that this, have a legitimate use of this image. And if you want to prove that or prove that it is satirical or authentic, then go ahead and do that as well. But if it's satirical and AI generated, it still needs to be labeled. So the issues here just come down to the section 230 protections of folks saying, Hey, can, as long as we don't police it at all. We don't have to police it at all. That's what section 230 says. It says, I'm just the network and I have no control over what people put on their social media pages and I don't exert any control. And so it's not my fault what's on there. As soon as they exert any control, they become responsible for all of it. So they don't want to, they have to have a regulatory umbrella that protects them to say, we took it down because someone said it was theirs. And then this restitution process was opened up. All of what happens after that, there are existing legal systems for. We don't have to invent anything. You can just go argue it out and say, it's real and here's how I'm proving it's real. Or I had a right to film this because it was in a public place and here's when and how I filmed it and so I'm putting it up. Or ⁓ it's satire and here's the way in which it is satirical. And by the way, we have to do that with copyright violation all the time of argue whether or not something is satire. I'm not saying that's a great model, but is a thousand times better than no model, which is what we have now.
speaker-2: Yeah. No, please go ahead. Finish.
speaker-0: It only relies on regulating the platforms themselves where the publishing occurs. We don't have to have an argument about the tools. We don't have to have an argument about fair use of those tools to produce original creative work. We don't have to ban open AI or any of these kinds of extremist approaches. And we already have a definition of deep fake that went into the take down act that we can now use. So there's already that hard problems already been solved.
speaker-2: So you think if platforms were actually like social media platforms, if they were financially liable for harmful deepfake content, you think that would drive better behavior by everyone in general?
speaker-0: ⁓ a hundred percent. I don't even think they need to be financially liable. I think they just need to be liable for responding to a takedown notice in the same way that they're liable for responding to a takedown notice under the DMC or a cop. Yeah.
speaker-2: That's good. Do you think...and I mean, to some degree, I agree, it definitely would make things better. But as we all know, the internet loves the underground internet. it would push things down to the underground, but with that matter, at a much smaller scale, would...
speaker-0: So then, okay, and I don't want to totally geek out because this is a PR podcast.
speaker-2: Oh, no, no, no, no, no, no, no, no, no, no, no, no, no, no, no, expert.
speaker-1: That just
speaker-0: Okay. I'm a cyber. So everywhere. I'm a little nervous about describing this because there's a good reason why we backed away from it, which is basically once you explain to policy makers that we could in real time enforce censorship of all content on the internet in the entire world, they're going to want to do it. Yep. And then they're going to want to do it for a bunch of other reasons having nothing to do with. abusive deep fake revenge porn. ⁓
speaker-2: and freedom of speech.
speaker-0: There is a pretty straightforward way to implement real time filtering of media content being photos and videos, videos being frames of photos, sequence of photos, on substantially everything in the world. You could probably get it done in under three months and it would take 20 people. So, ⁓
speaker-2: and AI.
speaker-0: No. Doesn't need any of that.
speaker-2: No code or help or anything
speaker-0: You don't even want any AI involved, yeah.
speaker-2: But how do you handle like, so this happened to me actually, I was hiring somebody and I guess it was over the summer maybe, I was doing a lot of remote interviews and someone had come and I'm bringing him down the list of things and listen, if someone's got a weird face, I'm not gonna say, your face is weird, it's inappropriate and just not nice. But I just started noticing some weird things with this face going on. And I remember seeing a YouTube video or an Instagram about somebody being in the same situation and asking the guy to put his hand in front of his face just to see, he wouldn't do it. He would not do it. He was using some sort of you know, effect on a Zoom call or whatever it be. I'm like, and forget like the news, that's already a big problem. But then how do we do a video? Like right now you're Joshua, how do I not know it's your assistant or someone else, you know?
speaker-0: That is what we built. ⁓
speaker-1: gonna say that's PolyGuard does.
speaker-2: Which is why I wanted to give you a segue to talk a little bit about Polyvite.
speaker-0: What we do is we have an app, a mobile phone app that allows you to verify your identity with your phone. And we use a phone to do that because both Apple and Google have strong hardware at a station, which means we have a set of API calls we can make to be damn sure that it's really your phone and that the camera is really the camera in your phone. And we use 3D data, depth data from the camera to be sure that it's not a paper mask or a photo being held over the camera. And then we have fancy ways of scanning your passport with NFC. And we do all this in a very privacy preserving way. So all your personal data stays on the phone. And then you have to use that app to join the Zoom or Teams call.
speaker-2: So it's a plug-in to like Zoom or?
speaker-0: We have a plugin for Zoom and a plugin for Teams. You're like, Hey, I got a Teams call, but it's not a regular Teams link. You got to use this PolyGuard link, which means you got to do this identity verification. And then you get into the meeting and then you just relax. Cause you're like, Hey, Eric's in that meeting. And the PolyGuard sidebar says it's really Eric. And by the way, there's a little photo of what the Eric in front of the phone looked like five seconds ago. And so if you don't look like the photo in the sidebar, somebody else just rolled in to view after I logged in. Right. That's called a proxy candidate. People do that for tech screens now. They're like, I'm just gonna have someone who sort of looks like me sit in and do the hard part of the interview so I can get the job. You can pay people to do this for you. They advertise on LinkedIn. And true, it's not just the proxy candidate. Proxy candidate would be fine because what happens if you hire an idiot who can't do their job, right? Well, you paid them for six weeks before you figure this out and then you fire them and you're sad and they got paid and it cost you some money.
speaker-2: Wow.
speaker-0: And that's sort of it. One in 300 candidates for a remote tech job are now in North Korean spy. And when you pay for it, free and spy, they stole all your data. They probably infect your core systems, ransomware. So you are out the money. You're out the data breach costs, which means you have to disclose to every customer you have. You may lose the entire corpus of data. And then OFAC sues you and finds you for funding a nuclear program of a hostile foreign. So that's the real reason we exist is because there are. so many companies that have accidentally hired North Koreans over the last two years. Like start with Google at 50 on payroll at one point.
speaker-2: The FBI put out a ⁓ cybersecurity ⁓ report on it early this year.
speaker-0: done three years in a row, they've had reports on what's called the DPRK IT worker scheme and the escalations and the number of people they've caught and arrested and the laptop farms and the number of companies impacted. yeah, it's madness. But also what a great way to make money out of some basic comments.
speaker-2: So basically Polyguard is positioning itself as the first enterprise-grade defense built from the ground up. for not detection, but AI fraud era.
speaker-0: The AI era, there's, there's two big trends that are happening right now. Right? One is we're all living online and I know everyone's like, well, what about RTO and what about post COVID this and post COVID that I was like, if you draw and I'm old and I was using computers in 1983. And so was on the internet when it was dial up modems and BBSs. And then I was like, I worked on the Netscape browser and, and then I worked on cloud. And so the, the, the curve of like how much of our life exists on online. over the last three decades, four decades is always up and to the right. And it's not going down. So more and more and more of our important interactions, banking, dating, family, work is online, at least in part, at least a video call, at least a phone call, at least a transaction, log into a web portal and do something. So that's one trend. And the other trend is crime has been democratized. It's not only democratized, but it's now got a whole ecosystem. So the people who are running these scams are no longer hackers because you can buy a scamming in a box SaaS solution. And then you go and buy data lists of breached identities off of the dark web and you plug item B into item A and you add your own advertising dollars and you make money. So the people running the toll booth scam where you get a text message saying that you owe a toll fee and you log in and Venmo somebody 200 bucks. They're not hackers. They're just business people in another jurisdiction. They're just people willing to do crime. It's not even con artists. It's not even somebody who could do it well in person. The skill set now to be an international online criminal is one skill that you have a broken moral compass and you're willing to do it. That's it. You don't even have to speak English. You don't have to any tech skills. You just have to be willing to be a dick. I've actually met some people who were press ganged into fraud camps internationally. And they're like, I didn't really want to, but they
speaker-2: efficiency.
speaker-0: First I took the job because I needed the money and didn't know what the work was and then when I figured out what the work was they had already taken away my passport. Wow. And it took me three years to get out because I had to escape. Wow. That's an act.
speaker-1: That's that's real life.
speaker-0: Yes, and use
speaker-2: There's YouTube video of a guy that was studying scammers on the internet a couple years ago. And he tracked down this company in India that actually, it's a legit office. They go in, nine to five, they check in, they got a clock. And they were showing exactly how this went on. Instead of like all logging into Remote Interim Machine to help you, they were all trying to call you and scam you into thinking that the link that you somehow got. ⁓ my Kindle's broken. ⁓ call this number. And then they call before you know it. They're on your computer. They got your credit cards. They go into terminal. They start listing, you know, all the processes just to confuse you. like, ⁓ my, all these things that are going. In the meantime, there's all these things that are on the background. This researcher actually was, he was like a white hat, you know, hacker. And he actually hacked them in reverse and got access to their IP cameras. And then he started calling and saying, ⁓ so, okay, so Martin, you're wearing a white. polo with the black jeans right now. And the guy's like, he's like freaking out, you know? But the point is that they're just like Josh said, it's a real business. And they're being investigated. The owners are like billionaires on this stuff. And every person was, even though they were a tech, they were considered a salesperson and they would get like 1 % of whatever they brought in. That is just insane.
speaker-0: What are the nice ones? The scary ones are over the border in Myanmar and their compounds with barbed wire and people are like, hey, if you miss your quota, we beat you. You can't leave. you're paid nothing. Most of them were scammed into the job. They were bused in from a job they thought they were getting in Thailand. I mean, anyway, it's just, there are hundreds of thousands of people.
speaker-2: Wow.
speaker-0: involved in these scams now. So the democratization of crime was on the one hand and the move to life online on the other hand, the thesis is really simple. It's like, hey, being able to prove who you are online is important. And we're going to support doing that. And over time, we'll bring that to bear on everything that matters. So we're starting with these, you know, job interviews, because if you screw that up, it's really expensive for you. And there's a lot of those that happen every day. And then we look at what about dating? Is it nice to know the person you're going to go have dinner with before maybe they root for you and maybe they kill you? ⁓ I have daughters, right? I worry a little bit about this.
speaker-1: I mean, I'm a woman and I have dealt with some very not great situations in my life. So yes, it would be really nice to know that safety is paramount and being able to protect yourself and especially, you know, thinking about it from, you know, not even just that standpoint, but just in general. mean, this is such critical. Yeah, keep going.
speaker-0: Last mile delivery on Facebook marketplace if I'm gonna go pick up something or they're gonna come to my house I want to who they are. I at least want to know they're not lying about who they are
speaker-1: That part right there. my dad's a mechanic and we, I Craigslist is like a whole, eBay is a whole, and this has been a topic of conversation since I was like, I mean, I'm little short human, Josh, just to like five feet tall on a good day. But like since I was little, this has been a topic. Like, okay, you're gonna go meet the guy, you know, 30 miles away. Is it actually a guy 30 miles away? Are you gonna be good? Like, is everything? The amount of trust and the lack of trust that we now have because we are socialized to be online first is something that needs to really be rectified. think PolyGuard is helping with that from the sound of it.
speaker-0: And we're trying to not make the world worse in the process, right? We're not doing surveillance where we're not collecting everyone's personal data and we're not sharing more than you need. So if you need to prove who you are, great, you've proven your full name. You didn't have to give up your driver's license number. You didn't have to give up your address. If you're proving your age, you don't have to give up your birth date. If you're proving your location, we're proving the state and country. We're not giving out your street address or your lab. Right? So, and we don't collect any of that. That's a transaction between you and your counterparty, whether that's Eric in a video call or your bank doing a banking transaction or that mechanic, right? ⁓ Who's coming by your house to pick up your old rusted out Volvo.
speaker-1: ⁓
speaker-2: ⁓ like a Volvo.
speaker-0: We are not.
speaker-1: Can't do it.
speaker-2: It's funny because I mean, we live in a small town near New York City on the Jersey side and many of the neighbors here that we talk to, they all do the Facebook marketplace, but my wife refuses. She's like, I don't know who's coming to my porch or my house. Like, I just don't want to do that. I'd rather mail it to them. Like, yeah.
speaker-0: Most people I know do it only when they're moving out. They're like, this address doesn't matter anyway, it's burned. I'll be gone in a week, so.
speaker-1: valid. So then, so thinking through this and just kind of, you know, so we got, we got this one and then we got our uh-oh scenario where you have two minutes Josh to give us a rundown of what you need to do. So last question. So what are some actual tips? Like given all this talk about deep fakes and everything. What can people do to assess and mitigate and reduce that sort of vulnerability? know, PolyGuard is definitely a really solid tool and has a lot of great strategies around it, but what else can be done?
speaker-0: ⁓ Great question. People is hard. So let's make it through buckets. Bucket one, people like us. So we are adults in the workforce who live online and we're digitally savvy. Bucket two, children. What you do for kids is a different thing. And bucket three, the elderly. So what do you do? What do you tell your parents to do? Parents are harder and here's why. So first tip, stop to answering the phone. You want to set your phone to only ring when it's someone in your contact list. We can do that. Kids can do that. Our parents can't because they get calls from the pharmacy, they get calls from the doctor, they get calls from strangers who are still legitimate. And I didn't really realize this. was like, nobody legitimate calls me, except I do also own a retail store. And so all sorts of random people call me suppliers and the bankers were suppliers. ⁓ So I have to answer my phone all the time. which means I don't answer my phone by saying, hey, it's Josh. I answer my phone in a weird accent and I go, wait, wait, because I just don't want people randomly recording my voice saying my name over and over again. And I five scam calls a day, at least that are just dead air that I know is just dead air recording my voice. That's tip one. ⁓ Tip two, this one's hard. It's so hard to get people to do this, but it's actually, so there's all this advice around having a code word with your family and et cetera. The most scary fraud happening these days is virtual kidnapping, right? So they steal the voice of your loved one and then they call you pretending to be your loved one saying, I've been kidnapped, they're gonna kill me if not for, and then the attackers take the phone away. You have to be in the habit of hanging up on your loved one if they ever call from a strange number. You get a call from a loved one calling from a strange number, as soon as they start talking, hang up on them. Because if it's them, they'll call back, or you can call them back, and you should immediately call them back on the number you know they have. If they've actually lost their phone, they're not gonna answer, and then you're gonna get a call back, and you're like, ⁓ maybe you have really been kidnapped, great. If you wait until after the kidnappers say we're going to kill them, you can't hang up. Emotionally, you can't do it. And they like, if you hang up, I'll kill them. You're not going to hang up now. If you hang up before they make any demands, they're going to call you back because they haven't had a chance to tell you that they want shit from you yet. train yourself to hang up on your loved ones and immediately dial them on another number. As soon as they're acting weird, it's really counterintuitive. All the code word stuff doesn't work because the most reasonable thing for them to say is I don't remember the code word. Which is true. Nobody remembers their code words. My kids and I had code words for pickups in grade school. Not once did any of us ever remembered it when it mattered.
speaker-2: You know, I think...
speaker-0: God, yeah, there's a code word. And or you have to say the code word every single call, which means everyone's going to hear you saying it. And then what the hell's the good with the code word? so. And the last one, that's tip two, hang up on your loved ones. Tip three, so dumb, so important to factor off. Everything, especially your email where it is the most annoying and the most important.
speaker-2: Turn it off of this. Well, not just email. How many clients I have that for the longest time at their bank accounts, they wouldn't set it up. Now you have to. But that was a tough thing to convince people. I like my password. It's password 123. ⁓
speaker-0: Yeah, I like your email. Maybe I'd like I like your money. I'd like it in my wallet. You have yours. Is it money? Let's yours. Yeah, but email is the most important counterintuitively because that's where you reset everything else. So if you do, if an attacker convinces the bank that they're you and that they've forgotten their password and they need a reset or they've lost their phone and they need a reset, the resets going to involve the email account. If they pop your email account first,
speaker-2: happened to ⁓
speaker-0: Everything they need to know to attack your bank is in your email.
speaker-2: is hearing them. So man in middle, we get that a lot. They start writing rules, they get in, start, they just monitor people's emails accounts. You know, I've had clients where they've gotten into the personal Gmail to get into their business because Joe was forwarding things or CCing or whatever. And then they didn't realize that there was a strange phone on their approved phone list for the authentication on Google. $100,000 later. Yeah.
speaker-0: I'm the worst on that because I have so many pieces of hardware. literally, I have like four phones and seven laptops right now. So anytime I look at my device list, I'm like, I'm pretty sure those are all legit, but yeah.
speaker-2: Yeah, I mean, especially if you're in the IT world in any capacity, then yes, that's typical. Lots of laptops, lots of hardware, lots of phones. I'm a little OCD, so I have everything texting me all the time, and I'm dead on, it drives my wife crazy. I have messages popping up on my phones all day long about anything, any transactions, any logins, because I see it from my clients, the world they live in, and the world of hurt they live in for a... a long period of time after that. So I'd rather inconvenience myself now until things get better with regulations or whatever, technology catches up, but at least it's something. Those are really, really good tips.
speaker-0: Tip four is the same thing I said at the beginning, right? Like, let go of the idea that you can spot fakes or that detection will ever save you. And just accept the fact that there is no way for you to know if video is real or not, if a photo is real or not, no matter what it looks like, it could be a fake. And just live in this sort of like post trust world.
speaker-2: So Polyguard is really for businesses, personal, how do you guys price it out?
speaker-0: Today is for businesses. We have some ideas to make it useful for persons. So if you think that, hey, I want to this for Facebook marketplace, I'm going to add that for free basically on the consumer side. But today, if you download PolyGuard, it's because you're working with someone who's got PolyGuard on the enterprise side. ⁓ But businesses of any size, right? If you're large enough to use Zoom, you're large enough to need PolyGuard.
speaker-2: been there. Listen, I think I already want to start looking at it because being in a lot of communications. For the audience out there, you have a link or anything that we should be sending to a special one? Maybe you'll offer like a little discount or something for them? I haven't thought of that.
speaker-0: about that we should probably yeah we let yeah start with all the girls up AI and and just mention that Emperor and Eric sent you we'll sort you out
speaker-1: affiliate marketing. There we go, look at that. All right, now time for me to put on my shitty PR person hat. So this is the uh-oh scenario. I love crisis comms, Josh. Obviously that's kind of the nice middle ground between what Eric Fokes is on with cybersecurity and IT and the PR and marketing side. just, Olivia Pope.
speaker-0: .
speaker-2: ⁓ We can have a whole segment on Olivia. ⁓
speaker-1: ⁓ we are going to, we have.
speaker-0: Amber, you heard me here first. Amber is Joe Biden's secret girlfriend.
speaker-1: No, that was Amy Poehler on Parks and Rec. Without I get it right. No. So this actually did happen. I was reading about it in Wired. So there's a, have you heard about the Door Dash Girl situation on TikTok?
speaker-2: That's ⁓ you gotta clean that up.
speaker-1: Yeah, so it's a it's a whole thing that happened. But basically a woman, you know, lied about being assaulted and it went viral on TikTok. You know, she got arrested a whole nine yards. But this journalist wakes up one morning and she's got flurry of messages from people basically saying, ⁓ my God, you're backing that woman up. What is that video? What did you do? So if a deep fake hits a reputable journalist, what should they do? in that first 60 seconds or 60 minutes in particular. What should a journalist do if they have a deep fake? Okay. You have a minute and a half to two minutes to go.
speaker-0: Grab your time machine and go back in time one month ahead of time and set up C2PA for your personal account so that you have a track record of saying, if it's ever a crisis, this is what you can look for in my video. All of my personal channel posts are C2PA authenticated and here's the account they come from. And then you have the backbone to jump online and say, hey, that's not me. I'm working to have it taken down. You can expect that there will be further communication from me at this well-known domain name where you have always been able to find me. That better be your company domain name. It's great if it's BBC. It's great if you can get someone like BBC Verify to back you up. So some public fact-checking team. And then you're referencing their authority to say, as you can see, BBC Verify has already debunked that. You could use Snopes as well if folks are still fans of Snopes. Warren Buffett went through this recently. because there were deep fakes of Warren Buffett out there promoting all sorts of stuff. And he's like, I don't make promotions of stock picks. That's not a thing I do. And you should look for publications from me only on BerkshireHathaway.com. establishing the like, this is how I sign my content ahead of time is a thing journalists should be doing today. I really do wish it was easier to do that by the way, to sign your videos. There are some C2PA tools for newsrooms that I would expect journalists can use and ⁓ make sure you're getting that content as far and wide as possible, the rebuttal. And then you have to go to the platforms. You have to go to the platforms where the content is up and say, this isn't me. You need to take it down. It's causing harm. Here's my assertions to that effect. ⁓ I did once upon a time ⁓ strike the ire of the far right and got death threats on Twitter back in the days when it was Twitter. And so I have been able to work with a social media platform in crisis and go, hey, scary stuff happening right now, what do we do? And they're like, here's a whole bunch of more tools we give you in this moment where you can control what's happening on your social media account a little bit more. So I know those things are available. They're generally defided right now, but lean on who you can. And if you need help, getting ⁓ Section 230 type companies to pay attention, call the FBI, call your representative, call the law enforcement. ⁓ This is a crime in most jurisdictions, impersonation of you for commercial purposes or to harm you directly. ⁓ are crimes, it's not satire. So yeah, go to the cops.
speaker-2: I mean, the good thing is this software like PolyGuard, you now is a lot easier than, let's say, like PGP years ago. We couldn't convince anybody to install PGP to encrypt your emails. We still can't, really.
speaker-0: Yeah. Did you see Moxie's talk at Black Hat last year? I think it was last year. He had a brilliant and so Moxie Mullins-Pike is the founder of Signal, right? And he had this brilliant talk where he touched on PGP and why it never caught on. was like the perfect thing that no one was ever going to use because the world that exists is not the world that security people want.
speaker-1: I don't even know what it is.
speaker-0: who have exist. And so they build products for the way they want the world to work instead of the way the world does work. And I'm just hyper aware of that. I learned a bunch of these hard lessons early in my career working on Netscape and working on, it was actually pop-up blocking and anti-spam, anti-malware, anti-phishing blocking in the Netscape browser that sort of taught me that if the user has to do anything, you lose.
speaker-2: You lose. Yeah. ⁓
speaker-0: Not only because they won't, they won't remember, they also won't understand. And when you try and explain it to them, they're going to understand it wrong. And then they're going to do something weird. That's even worse. We saw this with password managers, right? I didn't even make password managers. One of the tips because we have decades, decades now knowing that this is the right way to protect your online life and that it is usually free and often built into the browser and people still don't use them because it requires them to do a thing. And doing nothing is easier. So the way PolyGuard works is if you don't use PolyGuard, you can't get it in the meeting, which means if someone's in the meeting, you can trust them. And that's it. You don't have to do anything. You join the meeting and then you trust the other people who are there. The same logic applies to how do I install it? Well, you try and join a PolyGuard protected meeting and then it takes you to the right app store. And then how do I know I can trust it? Well, because it's in the app store we did all these weird certification things with sock2 and and all this complying
speaker-2: asked so you're sock to and have a complaint
speaker-0: We are not yet HIPAA compliant. We don't want your health data. I never want your health data. So we don't have to be HIPAA compliant. have.
speaker-2: You don't have to be HIPAA compliant, you can be marketing-wise HIPAA certified. So they won't... And I deal with a of medical companies. They won't even look at you as an option if you don't say somewhere in your website it's got HIPAA compliance. So you could at least prove that you adhere to compliance because you don't have the data to begin with. So you are already proving that you have compliance.
speaker-0: We have medical companies that use PolyGuard because we've been able to explain, hey, we never have the PHI, we're not handling it. And even if we were touching it, we are definitely following all of the rules you would follow. Data at rest, data in motion, good key rotation, least privilege everywhere. Yeah, ⁓ we've had some lovely conversations with law firms who recommend PolyGuard to their clients ⁓ because they're like, You got busted once and we got you out of it. If you hire another North Korean, there's nothing we can do. You're in a lot of trouble. So please do something better than just hope it doesn't happen again.
speaker-2: Yeah, you're done. Great, this was really awesome, Joshua. mean, seriously. You made it seem easy, this is good. And this is all new, like Amber had said, we're getting a few in here and we're very happy that we have you as one of the initial episodes, so thank you again. We have one thing that we want to start, we like to end each interview now with a handoff. So one guest leaves a question that becomes the first question for the next conversation on the next guest. I like that.
speaker-0: It's fun.
speaker-2: You won't know who the next guest is. All I can tell you is our next guest works in AI-driven video, digital personas, talk about AI clones and such. ⁓ What's a question you'd love to send that person forward?
speaker-0: dummy. If they accept that the industry of folks generating synthetic content have a responsibility to limit the harms, what's the ideal way they would wanna see that responsibility manifest? Is it industry membership? Is it a common library? Is it a standard they implement? Is it a?
speaker-2: to...
speaker-0: ⁓ Disclosure, you know, like what's the equivalent of generally accepted accounting principles for AIC?
speaker-2: I like that one. That's a good one.
speaker-1: That's wicked good. ⁓ sure. that.
speaker-0: Thanks for listening to the Control Alt PR podcast. Subscribe so you don't miss what's next. You can find us on Spotify, Apple podcasts, YouTube, and ControlAltPR.com. For more hot takes and resources, check out our LinkedIn and Instagram. See you next time.