WEBVTT
00:00:04.000 -->
00:00:13.000Hi, this is Ryo Koyama. Welcome to another episode of Remotely Local. Mike Johnson and I are very, very excited to welcome Patrick Coughlin today, CEO of
00:00:13.000 -->
00:00:21.000Savi Security and also author of Dark Side of the Boom. And so, very excited to have you. Thank you, Patrick, for joining us today.
00:00:21.000 -->
00:00:24.000Super happy to be here. This is going to be fun.
00:00:24.000 -->
00:00:32.000So, let's first, for those that don't know, because Savi Security is brand new, why don't you give us a little backdrop about that, and then we'll dig into the whole space
00:00:32.000 -->
00:00:35.000about your book and why we are excited to talk to you.
00:00:35.000 -->
00:00:42.000Yeah, absolutely. I'll give you the quick background. So, I'm a cybersecurity guy by trade. I've been working in the industry for about
00:00:42.000 -->
00:00:50.00020 years, done work on the government side and on the enterprise side. I had a company called TruSTAR
00:00:50.000 -->
00:01:01.000that was a threat intelligence platform for large Fortune 500 companies. That was acquired by Splunk, and then Splunk, in a very Silicon Valley story, was acquired by Cisco.
00:01:01.000 -->
00:01:05.000There's an image of little fish getting eaten by bigger fish here.
00:01:05.000 -->
00:01:15.000But a couple years ago — and we can get into the story later — my mom was the target of a fake kidnapping scam that was powered by AI.
00:01:15.000 -->
00:01:23.000And that sent me down a rabbit hole of looking at the huge challenge that is facing consumers today coming from AI-
00:01:23.000 -->
00:01:34.000powered fraud. And the data is off the charts. Americans are losing close to $200 billion a year, and it's being driven largely by imposter scams.
00:01:34.000 -->
00:01:41.000And it's hitting all demographics. It's hitting senior citizens. It's hitting young people on gaming platforms and social media. It's
00:01:41.000 -->
00:01:50.000hitting the sandwich generation, our spouses, our partners, our parents, our kids. And so, you know, I recognized
00:01:50.000 -->
00:01:58.000that we need a whole new level of innovation to protect families from scams and fraud in this AI era. And so
00:01:58.000 -->
00:02:05.000I partnered with my brother, in the long list of questionable decisions. We're making this a real family affair.
00:02:05.000 -->
00:02:13.000My brother is an amazing product entrepreneur. He's been at places like Apple and Spotify. And so we
00:02:13.000 -->
00:02:22.000teamed up, my cybersecurity knowledge and his consumer product experience, and that's what started Savi about 10 months ago. We've got a
00:02:22.000 -->
00:02:27.000great team, and we're bringing products to consumers every day to help protect them.
00:02:27.000 -->
00:02:34.040Well, fantastic. Plus, at least this way, if your brother calls you and he's sitting next to you, then it's actually —
00:02:34.040 -->
00:02:35.000That's right. Exactly.
00:02:35.000 -->
00:02:43.000We sadly have some firsthand experience in the whole voice scamming kind of thing. So, Mike, why don't you tell our little story?
00:02:43.000 -->
00:02:52.000Yeah. So, we had a new employee, and we don't go in the office often, but once a week we go to our little
00:02:52.000 -->
00:03:00.000office in Petaluma. And, you know, I roll into the office and I go, "Where's Stuart? He's supposed to be
00:03:00.000 -->
00:03:09.000here." And he goes, "Whoa, Ryo called him up and put him on a task." And I go, "A task? I don't know
00:03:09.000 -->
00:03:17.000anything about it." So I started asking questions, and then Stuart calls and asks some weird question, and then we're
00:03:17.000 -->
00:03:24.000discussing what's going on, and I guess what had happened is he said he was doing a task for Ryo. Well,
00:03:24.000 -->
00:03:32.000someone with Ryo's voice, probably cloned off of one of the podcasts, called Stuart up and dropped
00:03:32.000 -->
00:03:39.000some stuff about people that might work for Remote.it, which is our company, and said that he
00:03:39.000 -->
00:03:48.000had an important task for him to do. And so we didn't really know what was going on, and then finally
00:03:48.000 -->
00:03:55.000he's texting one of the other employees about some stuff, and everything is not right. So we were all like, "Hey, let's figure out what's
00:03:55.000 -->
00:04:04.000going on." And so I actually texted Ryo. I go, "What do you have Stuart doing?" And he goes, "Nothing."
00:04:04.000 -->
00:04:04.231[laughter]
00:04:04.231 -->
00:04:13.000So I go, "Holy — it's a scam." And I'm like, call him up. I call him up. I'm like, ring him, ring him, ring him until he answers. I go, "Stuart, whatever you're doing, it's a scam."
00:04:13.000 -->
00:04:16.765Was he at a Bitcoin ATM or —
00:04:16.765 -->
00:04:21.000No, he had actually bought four Apple cards, man.
00:04:21.000 -->
00:04:27.933Of course. Totally a red flag, right? But it happens all the time.
00:04:27.933 -->
00:04:29.000Yeah. Yeah.
00:04:29.000 -->
00:04:37.000But we actually stopped him just in time, because the guy was pressuring him to scrape the numbers off and give him the PINs, right?
00:04:37.000 -->
00:04:38.000Wow.
00:04:38.000 -->
00:04:40.000So you stopped the scam.
00:04:40.000 -->
00:04:41.231We stopped the scam.
00:04:41.231 -->
00:04:48.000So that puts you in the minority, I would say. And you're talking about it, which is something people don't often do
00:04:48.000 -->
00:04:59.000either. I mean, 85% of victims don't ever even report or talk about or share with anybody what actually happened to them. But just think about how far we've come.
00:04:59.000 -->
00:05:05.000There was a moment, it doesn't feel like that long ago, when scams in the internet era were
00:05:05.000 -->
00:05:14.000like a random email from a Nigerian prince claiming to have some fortune that he was willing to share.
00:05:14.000 -->
00:05:18.000Wait, wait, that's not true. I just sent him some bank information.
00:05:18.000 -->
00:05:26.000Or there was phishing and business email compromise, and masquerading as the CEO on email, and
00:05:26.000 -->
00:05:33.000maybe trying to spoof an email address or make it look like somebody that you worked with. And now we're talking about a perfect clone of
00:05:33.000 -->
00:05:41.000your voice that rang the phone number of an employee and asked them to do something. I mean, that's a huge leap, and
00:05:41.000 -->
00:05:48.000I think it's indicative of where this threat is going, how far it's already come, and ultimately where it's going to take us.
00:05:48.000 -->
00:05:56.000So, Patrick, why don't we take a second here. Dark Side of the Boom, the book. You wrote that and it covers a lot of this. I think a lot of people would be very interested in understanding what that is,
00:05:56.000 -->
00:06:04.000because there's probably a lot of information. Like you said, we're not so brave as to sit there and face the embarrassment of telling people we
00:06:04.000 -->
00:06:14.214almost got scammed. But I think it's important for people to have that narrative. So why don't you talk a little bit about the book and what it covers, for people who might be interested in downloading a copy?
00:06:14.214 -->
00:06:15.000That's exactly it.
00:06:15.000 -->
00:06:22.000And so, after our mom got hit with this scam, I basically went down the rabbit hole and
00:06:22.000 -->
00:06:30.000I was kind of Beautiful Mind-ing my office, putting up: who are these groups, what are the tactics and techniques that
00:06:30.000 -->
00:06:38.000they're using? Trying to understand what had fundamentally changed in the underlying economy of these scams, that now all of a sudden little old Beth
00:06:38.000 -->
00:06:46.000Coughlin from Prairie Village, Kansas, would be a target of a sophisticated social engineering scam, the likes of
00:06:46.000 -->
00:06:55.000which I used to see pointed at juicy national security targets or big
00:06:55.000 -->
00:07:04.000Fortune 500 enterprises. But something had changed, that it was now being targeted at an everyday consumer. And
00:07:04.000 -->
00:07:15.000who else was being targeted by this? And how big was this problem? And what I found was exactly what the data bears out, which is digital fraud is now the fastest growing crime in this country.
00:07:15.000 -->
00:07:24.000It is the largest economic crime in this country. It is the most under-reported economic crime in this country. And it's being turbocharged by
00:07:24.000 -->
00:07:33.000artificial intelligence. And so, in a past life when I worked for the government, maybe this kind of research would have
00:07:33.000 -->
00:07:41.000culminated in some sort of briefing in a windowless conference room in DC, to people with the authority, hopefully, to act on it. But my
00:07:41.000 -->
00:07:50.000clearance expired more than a decade ago. So my choices were, what am I going to do with all this? And ultimately I started a company and figured I'd publish all this stuff in a book.
00:07:50.000 -->
00:07:58.000And I think it's an interesting way to come over the shoulder of these scams as they're happening and really
00:07:58.000 -->
00:08:04.000understand the tactics that are being used. So we try to bring readers into a series of different imposter scams,
00:08:04.000 -->
00:08:09.000the ones that are really wreaking havoc across consumers and families today.
00:08:09.000 -->
00:08:17.000And those are things like what you just experienced. We call those workplace imposter scams — somebody pretending to be your CEO or a
00:08:17.000 -->
00:08:24.000colleague or somebody from the finance department. But there are others, like the one we experienced in my family. We call those family
00:08:24.000 -->
00:08:32.000emergency scams. Somebody's been kidnapped. There's been an accident. You need to wire money. Somebody got arrested. There's all kinds
00:08:32.000 -->
00:08:40.000of versions of this. Government imposter scams are a big one. Oh, this is the IRS. Or you didn't show up for jury duty
00:08:40.000 -->
00:08:47.000and there's a huge fine. So there's a series of these imposter scams that are driving the majority of the growth
00:08:47.000 -->
00:08:55.000in digital fraud today. These imposter scams now make up over a third of all digital fraud in this country. And if
00:08:55.000 -->
00:09:01.000you think about why — well, what is AI really good at? I mean, the promise
00:09:01.000 -->
00:09:10.000of AI is that it can speak the language of humanity, right? It can talk like us. If you play with these tools, you can chat with
00:09:10.000 -->
00:09:18.000them and they seem to engage with us like a human. They can sound like us. They can create
00:09:18.000 -->
00:09:25.000visuals that are impossible for us to detect as real or not with the naked eye. And those are really
00:09:25.000 -->
00:09:33.000powerful tools for productivity for humans, but they are an industrial-grade weapon in the hands of somebody who
00:09:33.000 -->
00:09:40.000wants to deceive us, right? And so I was seeing all of this debate that is still going on, by the
00:09:40.000 -->
00:09:48.000way, this week: will AI save us or destroy us or disappoint us? And there's
00:09:48.000 -->
00:09:53.000all this sort of prophesying about the future and what it's going to look like.
00:09:53.000 -->
00:10:01.000And what I was seeing in the data and what I was experiencing is, well, hold on, there's something real that is happening right now that we don't have to
00:10:01.000 -->
00:10:09.000guess at, and it's visible in the data, and everybody has a story. I mean, you all have a story right here. I've got a
00:10:09.000 -->
00:10:17.000story about my mom. Everybody in this country now has a story, because tens of millions of Americans are impacted by this every year. And so I wanted to
00:10:17.000 -->
00:10:24.000write a book that demystified what is going on here, that helps everyday people understand what these
00:10:24.000 -->
00:10:33.000scams look like, and do it hopefully in an entertaining and engaging way that brings you into the narrative of the victims, and then also
00:10:33.000 -->
00:10:38.000looks at the real challenges, which is: how are these scams happening?
00:10:38.000 -->
00:10:46.000Who's behind them? Why is it so hard to stop them? And then not just be all pessimistic, but hopefully make some
00:10:46.000 -->
00:10:52.957recommendations about how we as a society can make some improvements to start to turn the tide against the scammers.
00:10:52.957 -->
00:10:54.000I think it's
00:10:54.000 -->
00:11:02.000very important that you touch on it. And it's interesting, because I was at a big open-source event recently and the discussion was about AI,
00:11:02.000 -->
00:11:10.000and one of the things I tried to point out — I was talking about general human intelligence — and I pointed out, I go,
00:11:10.000 -->
00:11:19.000well, throughout history almost all the great leaders have essentially been liars or manipulative. [laughter] And you emphasize that point,
00:11:19.000 -->
00:11:26.000because that is something that AI is good at. Mike and I were having a discussion not too long ago where we specifically talked about how social media is already
00:11:26.000 -->
00:11:35.000the best propaganda machine in history, and combined with AI, it's probably the best war machine in history. And to your point, it's a criminal activity.
00:11:35.000 -->
00:11:43.000Now, one of the things I think is interesting in your book is that you touch on the psychology of how these scams happen. But I'm
00:11:43.000 -->
00:11:50.000kind of curious, because you brought up something else: it's very, very under-reported. What do you think is the psychology about why it doesn't get
00:11:50.000 -->
00:11:59.000reported? For example, in the past, as an Asian living here, a lot of times Asians have been targeted in certain communities because they tend to
00:11:59.000 -->
00:12:05.000not report things to the police. So what do you think is behind the reason a lot of these crimes don't get reported?
00:12:05.000 -->
00:12:14.000It all comes down to shame. I'll give you an analogy. If your house gets broken into and
00:12:14.000 -->
00:12:21.000something's been stolen from your house, and the cops show up, and maybe your neighbors come out and
00:12:21.000 -->
00:12:26.000they say, "Oh my god, I'm so sorry that happened to you. How can we help?"
00:12:26.000 -->
00:12:36.000If you've been scammed, often what happens, unfortunately, is somebody says, "How the hell, Stuart, could you have fallen for that?" And
00:12:36.000 -->
00:12:45.000so there's this failure to give credit and blame to the
00:12:45.000 -->
00:12:54.000actual perpetrators of the crime. And we look at this particular type of crime as something that we did wrong. We
00:12:54.000 -->
00:13:03.000got conned. Man, I fell for that. We got duped. Instead of: they stole.
00:13:03.000 -->
00:13:15.000And so that shame that surrounds these incidents keeps people from talking about them. I mean, there's crazy data.
00:13:15.000 -->
00:13:22.000Something like half of people that have ever been scammed don't actually tell another living soul about it.
00:13:22.000 -->
00:13:30.000Wow. That's sad and horrifying. I always thought that one of the failures of social media is — we all grew up, maybe not you,
00:13:30.000 -->
00:13:32.857because I think you're younger than me —
00:13:32.857 -->
00:13:35.000I've got some gray there, man.
00:13:35.000 -->
00:13:41.000But we all know the Constitution because of Schoolhouse Rock, and we can all sing the Constitution. And I always felt like
00:13:41.000 -->
00:13:49.00015% of social media has to be public service announcements, and it's not. And I think this would be a wonderful thing, if every
00:13:49.000 -->
00:13:56.000fifth thing that I saw on TikTok was, this is the scam that's going around. It normalizes it and it
00:13:56.000 -->
00:14:03.000creates an awareness. I think that would be pretty critical. And so I'm a big believer that as this AI
00:14:03.000 -->
00:14:10.000boom is hitting, something bad is going to happen, and it's going to probably happen pretty soon. So, you're in an interesting
00:14:10.000 -->
00:14:19.000position where I think you have a front row seat. What do you think are the big things that could happen that could be somewhat catastrophic out there?
00:14:19.000 -->
00:14:27.000So, I'm not sure when this is coming out, but all the rage in the cybersecurity community right now is this bit of
00:14:27.000 -->
00:14:36.000a "me too" game going on across the foundation AI model companies saying, "Ooh, our AI model just went rogue
00:14:36.000 -->
00:14:45.000and attacked another company." And first it started with OpenAI saying it, then Anthropic the next week came out, "Oh, so did ours." And this week Meta came out and said, "Oh, ours did
00:14:45.000 -->
00:14:54.000too." So there's this concern around enterprise security and autonomous models that have
00:14:54.000 -->
00:15:03.000these incredible capabilities in coding assistance. But if you're really good at coding, you know what else you're really good at? Identifying vulnerabilities in
00:15:03.000 -->
00:15:12.000code. And so it's not a huge surprise that these models are incredibly efficient and effective at
00:15:12.000 -->
00:15:20.000identifying and exploiting vulnerabilities in code. And so I think we're worried about how these
00:15:20.000 -->
00:15:30.000models can autonomously seek out and create disruption across anything that runs on code. And I
00:15:30.000 -->
00:15:37.000think that's — by the way, that's most of our society, certainly all of our payment rails. Every company has software now, our data, everything
00:15:37.000 -->
00:15:45.000like that. And so I think that is a huge concern, that we'll have these autonomous cyber models that
00:15:45.000 -->
00:15:52.000don't even necessarily need to be in the hands of bad guys to do bad things. What I'm actually more concerned about
00:15:52.000 -->
00:16:01.000is the consumer fraud version of that. Because enterprises, government agencies, which
00:16:01.000 -->
00:16:09.000I've worked with for decades now, are used to playing this cat-and-mouse game with cyber attackers, right? You
00:16:09.000 -->
00:16:17.000know, they tool up, they create something, they exploit some vector, and then the enterprise responds to it, and you have this cat-and-mouse game, and there's
00:16:17.000 -->
00:16:25.000budgets, and there's tooling, and there's talent associated with that. And when I started my career,
00:16:25.000 -->
00:16:30.000companies like McAfee and Norton — these are great companies, but they were the icons of the early internet.
00:16:30.000 -->
00:16:39.000They were everywhere. They were like my AAA card that gave me confidence that I could go out on the information superhighway and explore, regardless of how good their products
00:16:39.000 -->
00:16:46.000were. They were there. I think what happened over the last 20 years is, as enterprise and government
00:16:46.000 -->
00:16:54.000started to digitally transform, the market for enterprise security took off — the Palo Alto Networks and the CrowdStrikes —
00:16:54.000 -->
00:17:02.000and so a lot of the investment and innovation and talent flowed to those problems, and it wasn't sexy to work in
00:17:02.000 -->
00:17:11.000consumer cybersecurity for most of my career, because that was like eat your cyber vegetables: have strong passwords, turn on multi-factor
00:17:11.000 -->
00:17:19.000authentication, like that stops everything. But what we're seeing now, and what's reflected in what you all experienced and what my mom
00:17:19.000 -->
00:17:25.000experienced and what tens of millions of people are experiencing, is there's a sophistication coming at consumers that is being
00:17:25.000 -->
00:17:32.000powered by AI that I think is going to facilitate the greatest transfer of wealth from this country to potentially
00:17:32.000 -->
00:17:39.000nefarious criminal organizations aligned with our national security enemies. And
00:17:39.000 -->
00:17:45.000that, I think, is what needs to be elevated in this conversation,
00:17:45.000 -->
00:17:53.000because that impacts everyday people and it impacts our perceptions of AI. Like, we in Silicon Valley
00:17:53.000 -->
00:18:01.000and Silicon Valley adjacent, we look at AI and we're obsessed with it and we are excited about it and we see the
00:18:01.000 -->
00:18:08.000potential and the opportunity. But if you go to where I'm from, in Kansas City, most people's experience with AI is in
00:18:08.000 -->
00:18:18.000the form of their phones blowing up with more scams now. And so if we want to get the country behind
00:18:18.000 -->
00:18:27.000this technology wave that we all believe is transformative and important, we've got to do a way better job of managing the
00:18:27.000 -->
00:18:35.000downside, or the dark side, and addressing it in real time rather than sitting in these ivory towers and
00:18:35.000 -->
00:18:37.667prophesying about what it might be in the future.
00:18:37.667 -->
00:18:43.000So this might be in your book, and it probably is. But we had to do a little
00:18:43.000 -->
00:18:51.000decompression after our incident and go over what's good and what's bad, right? So we came up with our little
00:18:51.000 -->
00:19:00.000company ISO prep and family ISO prep stuff, so we could have these passwords and how you do things and call-backs.
00:19:00.000 -->
00:19:06.000What should the regular consumer do? What can they do? I'm sure this is in your book, right?
00:19:06.000 -->
00:19:13.000It is. We talk about — but I would just say, I think you nailed it. One of the first things we do is
00:19:13.000 -->
00:19:20.000say, create a family password, just to get you talking about it, and then talk about scenarios
00:19:20.000 -->
00:19:28.000where you might use it. We talk about these new rituals that we need in the family, which maybe
00:19:28.000 -->
00:19:35.000it's me leading by example and telling my kids and my wife, look, I'm never going to give money to a random stranger
00:19:35.000 -->
00:19:43.000online. And I think that should be a family rule. If we haven't met them in person, we don't send money unless we talk about it. So a lot of this — and
00:19:43.000 -->
00:19:51.000Ryo, you brought this up — a lot of this is talking about these things in the open, making these kitchen table and living room issues
00:19:51.000 -->
00:19:58.000so that we feel comfortable that when something doesn't look right, we're willing to get a second opinion,
00:19:58.000 -->
00:20:07.000instead of retracting or feeling shameful that we don't know. So start by talking about it. I think
00:20:07.000 -->
00:20:15.000the second thing is there's a little more responsibility — and you hinted at this, Ryo, with TikTok. We need to demand a little bit more
00:20:15.000 -->
00:20:23.000responsibility from these platform players in terms of how they show up in our society. If you look at
00:20:23.000 -->
00:20:30.000Meta — and again, I'm just sharing facts — there was an incredible story that Reuters
00:20:30.000 -->
00:20:37.000broke last year around the amount of fraud that is trafficked through Meta's platform.
00:20:37.000 -->
00:20:46.000Oh, even just on the marketplace. I mean, without a doubt, that's — no, I'm just going to back up real quick, just so that everybody's clear, because you both talked about family passwords, but what you really
00:20:46.000 -->
00:20:53.000mean is a safe word. And so I want to make sure no one walks away and says we should all have the same password as a family. What you're saying is, if
00:20:53.000 -->
00:21:02.000I'm talking to some family member, I want to say something like, if I don't say "kangaroo" or something, then it's not me.
00:21:02.000 -->
00:21:10.000Yes. Yeah. And we say pick something that means something to you all as a family. It could be a color, it could be a
00:21:10.000 -->
00:21:19.000phrase, it could be a place you used to live. And encourage people to use it. I tell my mom, if she asks me for the
00:21:19.000 -->
00:21:28.000family password, or she hangs up on me because she's not sure it's me, we should celebrate that moment. We shouldn't be mad about that, which is kind of hard to do. But
00:21:28.000 -->
00:21:34.000as important — the safe word is a mechanism to begin
00:21:34.000 -->
00:21:42.000the conversation. It's as important as picking the right safe word, or whatever it is, is getting everybody together, because now you're talking
00:21:42.000 -->
00:21:46.000about why. And that's just as important as anything else.
00:21:46.000 -->
00:21:54.438No, no. I think that's such an important thing, because like you said, we have to normalize some of this stuff, but the most important thing is normalizing the conversation.
00:21:54.438 -->
00:21:55.000Yes. Yes.
00:21:55.000 -->
00:22:02.000And I think all crime is this way. It appeals to psychology. And so you have to overcome that psychology. And one
00:22:02.000 -->
00:22:09.636of the most powerful emotions is embarrassment, because it is the thing that's likely to let people get away with stuff.
00:22:09.636 -->
00:22:10.000It's
00:22:10.000 -->
00:22:17.000exactly it. And it isolates people, which is a scammer's dream, because then they're not communicating. And in fact, there's insane data about people who've
00:22:17.000 -->
00:22:24.000been scammed once who then get scammed again, because they are more likely to be isolated. But I will just do a
00:22:24.000 -->
00:22:32.000soft plug here. One of the reasons why we started Savi is because we saw this huge gap in the tool landscape
00:22:32.000 -->
00:22:41.000that was available to everyday consumers. So we created a free scam checker that requires no email signup. It's available at scamwise.com.
00:22:41.000 -->
00:22:50.000You could forward suspicious emails to it. You can ask it a question. You could send a screenshot of a text. You could take a picture of physical mail. We get a lot of somebody who gets a
00:22:50.000 -->
00:22:59.000Medicare bill who's like, wait a minute, I don't know if this is real or not. And it will give you a quick second opinion and recommend ways that you could verify it. So we're
00:22:59.000 -->
00:23:06.000creating some products and trying to use AI to help make it easier to talk
00:23:06.000 -->
00:23:14.000about these issues, to get second opinions, and ultimately, where we're going with Savi and with our mobile apps, to block these things
00:23:14.000 -->
00:23:16.130before they actually even get to you.
00:23:16.130 -->
00:23:21.000I have an interesting question for you, because I was thinking about who's going to cover
00:23:21.000 -->
00:23:30.000the cost of these expenses, because something's going to happen. Do you think it'll almost get to the point where it's a national disaster, where we have a
00:23:30.000 -->
00:23:37.000hurricane or something hits and a disaster relief fund comes in, but it could be at that scale? I mean, you're talking about something
00:23:37.000 -->
00:23:44.000that could be pretty broad-based, and it's not like it's going to be the credit card companies, which are really insurance companies. It's going to be
00:23:44.000 -->
00:23:48.000something broader than that. So what do you think is going to be the remedy?
00:23:48.000 -->
00:23:52.000Because clearly something bad could happen.
00:23:52.000 -->
00:24:00.000I think there's two options. I think the national disaster analogy is unfortunately a likely one, and often
00:24:00.000 -->
00:24:07.000in any country, and in this country, it takes something of that scale to mobilize public opinion and
00:24:07.000 -->
00:24:15.000legislative action around doing the right things. So I could see autonomous or rogue models
00:24:15.000 -->
00:24:22.000that create a massive fraud event across banks or wallets
00:24:22.000 -->
00:24:31.000and drain them, creating this huge issue of economic
00:24:31.000 -->
00:24:41.000loss that the government has to step in on, almost in a too-big-to-fail way, but at a very huge consumer distribution level.
00:24:41.000 -->
00:24:46.000But I could also see a slower burn. And I think this is what concerns me a little bit, and part of the point in
00:24:46.000 -->
00:24:54.000the book is, for a couple generations now, we kind of let
00:24:54.000 -->
00:25:01.000social media run with our kids, and here we are
00:25:01.000 -->
00:25:05.000now, and there's a series of lawsuits and action happening,
00:25:05.000 -->
00:25:13.000starting to come to terms with that, and there's all this news about the Meta lawsuits on social media with kids and
00:25:13.000 -->
00:25:21.000all that. My hope is that we don't burn a couple generations of
00:25:21.000 -->
00:25:29.000loss and pain when there are real things that we can actually start fixing incrementally now, without hamstringing
00:25:29.000 -->
00:25:36.000innovation. But we just need to focus on them and talk about them. And so that's what I think we're
00:25:36.000 -->
00:25:43.000on the path for right now: more of the social media outcome, where we spent 20 years growing gangbusters and there's this seedy
00:25:43.000 -->
00:25:52.000underbelly of byproduct and dark side that is creating real havoc, but we don't address it until
00:25:52.000 -->
00:25:56.000far later down the road, and until far too many people have already been impacted.
00:25:56.000 -->
00:26:04.000Do you think regulation is going to have to happen? For example, you talk about how many of the attacks come from foreign
00:26:04.000 -->
00:26:12.000agencies, foreign countries. Do you think a situation might arise where the United States effectively has the equivalent of the Great Firewall of China, where
00:26:12.000 -->
00:26:21.000it's like, okay, we're just not going to allow a lot of things to come in? Because one of the things that obviously allowed the internet to become so great is that it
00:26:21.000 -->
00:26:27.000was sort of untethered, but it sounds like untethered may be exactly the wrong recipe in this case.
00:26:27.000 -->
00:26:34.000Yeah. You know, the R word is a difficult one sometimes. I find it hard to
00:26:34.000 -->
00:26:43.000believe that if this is a technology as transformative as we all believe it is, then why wouldn't it require at
00:26:43.000 -->
00:26:51.000least incremental regulatory changes? And so my position is yes, but it doesn't necessarily mean that there
00:26:51.000 -->
00:26:59.000aren't nuanced ways to do that, or incremental ways that we can start doing that. And you're right about the international nature, and this is what concerns me a little bit. Like,
00:26:59.000 -->
00:27:06.000right now there are 1,500 bills moving through state legislatures to try to stop scams and fraud. The state
00:27:06.000 -->
00:27:15.000has no jurisdiction over how these things are executed. If you know anything about the global telecommunications infrastructure or VoIP providers and how these things
00:27:15.000 -->
00:27:23.000work, a state law doesn't matter. And in fact, it only creates a patchwork of regulation, and then makes it easier for scammers to
00:27:23.000 -->
00:27:30.000maneuver through them, because they're very good at that. So I do think we need national and international
00:27:30.000 -->
00:27:40.000cooperation on what is an international problem. But it could start with things like KYC, know your
00:27:40.000 -->
00:27:48.000customer, a little bit. It's harder for a consumer in this country to buy Sudafed — the real Sudafed, the good
00:27:48.000 -->
00:27:56.000stuff — than it is to have unlimited API access to a model that
00:27:56.000 -->
00:28:04.000its own creators claim is capable of creating anything from bioweapons to
00:28:04.000 -->
00:28:11.000all these terrifying things. So we can do better. We can start small. We
00:28:11.000 -->
00:28:17.000can collaborate internationally. And I think we just have to agree that this is a problem that matters first.
00:28:17.000 -->
00:28:28.000Yeah. I personally think the regulation or the laws, it's not going to work, because that's a global thing, right?
00:28:28.000 -->
00:28:39.000And you're basically handing the keys off to your competitors when you lock down your stuff. What I do like about what you're talking about is that it's education.
00:28:39.000 -->
00:28:46.765Everybody — the more you can talk about it, the more you can get the information out there, the more you can open up people's eyes to it, to me, is the solution.
00:28:46.765 -->
00:28:47.000Yeah.
00:28:47.000 -->
00:28:55.000Right. Because I don't want to regulate my industry or somebody else's industry and stifle it till we lose, right?
00:28:55.000 -->
00:28:58.000No. And that's competition.
00:28:58.000 -->
00:29:05.000So I agree with that, but — this will be fun, we can disagree a little bit, maybe that will help with viewer engagement, to be
00:29:05.000 -->
00:29:13.000controversial and polarizing. So I will agree with you in one breath and say, yes, education. If you think
00:29:13.000 -->
00:29:20.000about why that Nigerian prince scam really died, it's because it became a joke, a meme. It was like all
00:29:20.000 -->
00:29:29.000the late night comedians were using it, and everybody just got it, and that's why it stopped working. Yeah, Microsoft did some things on their email exchange that
00:29:29.000 -->
00:29:37.000helped, but the reality is everybody learned about it. I think the concern now is that this is evolving very quickly.
00:29:37.000 -->
00:29:45.000So education will be part of the solution, but it can't be the whole solution. I think there are other ways to approach regulation. So if we took an
00:29:45.000 -->
00:29:52.000innovation mindset: okay, well, the regulation could be, hey, social media, open your platforms up to allow
00:29:52.000 -->
00:30:00.000consumers to police the content better that their kids see. Or device makers,
00:30:00.000 -->
00:30:06.000make it easier for third party companies to filter out bad things. This
00:30:06.000 -->
00:30:15.000technology exists, but it struggles to innovate within the walled gardens, where the scammers currently have free
00:30:15.000 -->
00:30:23.000rein but security companies or others who may want to try to intercept it don't. And so regulation doesn't have to
00:30:23.000 -->
00:30:29.000be stop our AI, let other people's AI flourish. It could be a little bit
00:30:29.000 -->
00:30:36.000more nuanced, so that we find the right protective balance, so that at least we can play this cat-and-mouse game, which
00:30:36.000 -->
00:30:42.000right now I think we're the mouse, and I think we're getting our butts handed to us.
00:30:42.000 -->
00:30:50.000Well, I think you're right. That would actually be probably a very workable solution. I just worry about companies.
00:30:50.000 -->
00:30:56.000I don't want to say Facebook, but they're making so much money off the scammers too.
00:30:56.000 -->
00:31:03.000That's exactly right. And so you can't ask them. I have some of these conversations and people get angry. They're like, well,
00:31:03.000 -->
00:31:13.000Meta is making too much money off this fraud. And I'm like, well, give them a business reason not to. At the
00:31:13.000 -->
00:31:21.000end of the day, we've all been in business, they have a responsibility to their shareholders, and there is no moral responsibility to the shareholders. As
00:31:21.000 -->
00:31:29.000much as we all believe we would act differently and do these things, we have to create some business reasons that'll either allow innovative
00:31:29.000 -->
00:31:36.000solutions to help deliver protection, or make it more painful for them when they deliver crime. [laughter]
00:31:36.000 -->
00:31:37.500Those are the only two options.
00:31:37.500 -->
00:31:44.000Well, like I said, it's very interesting, because we have a whole discussion just about civil liberties and who you are and do you really have
00:31:44.000 -->
00:31:52.000to authenticate yourself. But at the same time, it may be fundamentally important to be able to do that, at a minimum, so that if someone calls you
00:31:52.000 -->
00:31:59.000in your family, you know it's them. All right. So, one of the things we love to close with is
00:31:59.000 -->
00:32:07.000your hot take. So what's the non-conventional thing that you think might be happening in this whole space that isn't conventional wisdom, that
00:32:07.000 -->
00:32:14.000people aren't thinking? How do you think the world might shake up in a different way than people are thinking right now?
00:32:14.000 -->
00:32:19.000I'll give you two answers to that. If you can't tell from some of my comments, I'm not really buying this
00:32:19.000 -->
00:32:31.000rogue AI model narrative that's coming out of the foundation labs today. I think it's an incredible —
00:32:31.000 -->
00:32:37.000I call it rogue stunting, where you frame the power of your
00:32:37.000 -->
00:32:44.000AI model to free itself from containment as a benchmark, that
00:32:44.000 -->
00:32:47.000like any other sort of F1 score, it should be part of the F1
00:32:47.000 -->
00:32:53.000score: did it get out? If you've ever been in a cybersecurity incident,
00:32:53.000 -->
00:33:00.000one of the last things you do is call up a reporter from The Information or
00:33:00.000 -->
00:33:06.000any media outlet and say, hey, I've got a story for you, our model got out, we had a huge cyber attack.
00:33:06.000 -->
00:33:09.000It doesn't really work like that. And so
00:33:09.000 -->
00:33:14.000I look at a lot of this as incredible marketing.
00:33:14.000 -->
00:33:21.000And it doesn't necessarily mean that it's nefarious, it doesn't mean that these models aren't powerful, but I think there's a little bit of
00:33:21.000 -->
00:33:26.000playing into a narrative that is dangerous.
00:33:26.000 -->
00:33:30.000I think playing into the narrative is dangerous because, again, it focuses the conversation
00:33:30.000 -->
00:33:34.000on a bad thing that for them is really a good thing,
00:33:34.000 -->
00:33:39.000but it kind of prevents the conversation about the actual bad things
00:33:39.000 -->
00:33:42.000from being elevated and talked about.
00:33:42.000 -->
00:33:46.000So that's my hot take. I would say
00:33:46.000 -->
00:33:50.000my future hot take is the world you all live in.
00:33:50.000 -->
00:33:55.000If you think about what's happening with robotics, what's happening on
00:33:55.000 -->
00:34:06.000shop floors of large manufacturers, if you look at the entire IoT space and where
00:34:06.000 -->
00:34:11.000that is going with the advancement in these technologies —
00:34:11.000 -->
00:34:17.000every big advancement of technology comes with risk. It happened with the internet,
00:34:17.000 -->
00:34:20.000new kinds of risk, like virtualization, the move to cloud. It
00:34:20.000 -->
00:34:25.000created all these new surface areas that need to be protected. Mobile, social media.
00:34:25.000 -->
00:34:31.000We just talked about these big things. I think we have just barely seen
00:34:31.000 -->
00:34:37.000what's going to be happening with AI plus robotics in our lives,
00:34:37.000 -->
00:34:41.000and what that does to the attack surface area
00:34:41.000 -->
00:34:44.000of enterprises, governments, and everyday people. And I'm
00:34:44.000 -->
00:34:48.000excited about that, not in a freaky way, but in a —
00:34:48.000 -->
00:34:53.000I think there's going to be a whole new wave of transformation and innovation that's required,
00:34:53.000 -->
00:34:56.000and I think that the world that you all work in is super important.
00:34:56.000 -->
00:35:00.000Well, no, I think both of those things make
00:35:00.000 -->
00:35:03.000a tremendous amount of sense. And I think the
00:35:03.000 -->
00:35:07.000difficult reality is that every time there's an evolution,
00:35:07.000 -->
00:35:10.000or really a reinvention like is happening today,
00:35:10.000 -->
00:35:12.000there are casualties.
00:35:12.000 -->
00:35:16.000Like you talked about in the early days of the internet, lots of casualties, there was a lot of identity
00:35:16.000 -->
00:35:20.000theft. I had identity theft multiple times. And we're facing a situation where we're definitely
00:35:20.000 -->
00:35:22.000going to run into that.
00:35:22.000 -->
00:35:26.000Well, I think this is fascinating. I think we could probably have this conversation
00:35:26.000 -->
00:35:30.000a lot, and we probably are going to have to have it a lot — although we'll have to create a safe
00:35:30.000 -->
00:35:34.000word, because I'm still not sure that I'm not actually talking to a digital
00:35:34.000 -->
00:35:37.000twin right now. But we'll have to figure that out. And
00:35:37.000 -->
00:35:40.000thank you so much for being on the episode. I'm pretty sure we're going to bug you to come on
00:35:40.000 -->
00:35:43.000again, because next time some sort of
00:35:43.000 -->
00:35:44.000hot button comes on. So
00:35:44.000 -->
00:35:46.000thanks a lot for being on the show.
00:35:46.000 -->
00:35:50.000Thank you so much for having me.
