[00:00:00] Kacper Piwowar: An AI image and the accuracy rate amongst the group that was studied was twenty-four point five percent that could spot something that was fake. Now, that’s pretty bad.
[00:00:23] AJ Nash: Hello, and welcome to another episode of Needlestack. I’m AJ Nash, one of your co-hosts. I’m sure you, if you’ve been tuning into the show before, you probably know me. I’ve got about 20 years, 19 years in the intelligence community, counter-terrorism, counter-insurgency, accounting, trafficking in persons, chasing war criminals.
[00:00:37] AJ Nash: Been in the private sector about a decade building intel and intel-driven security programs. I’m really excited to be back here with Needlestack. And today, I got a new co-host I wanna introduce everybody to, Kacper Piwowar. Kacper, you wanna talk to people about who you are and how excited you are to be here and what we’re gonna do today?
[00:00:54] Kacper Piwowar: Yeah, of course. so my name is Kacper Piwowar. I work for Authentic8. I’m the senior product marketing manager. Before that time, I worked for different companies, Microsoft and a few companies in the MSP space. So I’ve been involved in the tech industry for many, many years.
[00:01:11] Kacper Piwowar: Traveled the world. tech aficionado. I love to delve into different technologies, discuss different topics, and I like tennis. So yeah
[00:01:22] AJ Nash: And he likes tennis, so I don’t know if that’ll get in this show, but maybe along the way we’ll talk about it. I forgot to even mention, I was in such a hurry to get on the show and get excited, title with Authentic8. I’m a, digital intelligence advocate for Authentic8,
[00:01:32] AJ Nash: But what’s more important is what we’re gonna talk about today. So we got a very exciting topic. So today we’re gonna talk about all things synthetic media. All right? Most people call that like deepfakes, right? And we’re gonna talk about how big the problem has become, especially with AI, and how much that’s advanced, deepfake technologies, what we can do to protect ourselves and, what the concerns are about losing our own digital self really.
[00:01:50] AJ Nash: Kacper, let’s just jump right into it, man.
[00:01:52] Kacper Piwowar: Yeah.
[00:01:53] AJ Nash: Let’s talk a bit first about what are we talking about? How big is this problem? What have you seen? What do you know about this in terms of social media, for instance, or direct interactions even?
[00:02:01] AJ Nash: How big is the problem?
[00:02:02] Kacper Piwowar: Yeah. So I think it’s big, and I think it’s a lot larger than many people think. You know, we hear about it a lot. You hear about fake profiles, AI-generated images, videos, but ultimately it’s something that you’ll only grasp when you go deeper down the rabbit hole, right? Like when you start to actually look at the numbers.
[00:02:26] Kacper Piwowar: I actually covered this in a webinar I did recently, and I found it pretty fascinating. A couple of stats that stuck out for me at least is, across Meta, most of us know Meta, right? Let’s just say Facebook, Instagram, et cetera.
[00:02:40] Kacper Piwowar: Yeah, so tens of millions of fake profiles across their platform alone, and we’re talking, you know, 100 million plus.
[00:02:48] Kacper Piwowar: Which is, I guess, like if you take it with a grain of salt, if they’re like, you know, 1.2 billion accounts, I mean, I still wouldn’t say it’s like it’s not a drop in the bucket, right? I still think it’s quite significant. and then you have the other platforms, right? So we didn’t even get into like LinkedIn and whatnot.
[00:03:07] Kacper Piwowar: But it’s a huge, huge problem. And I think that at least, you know, the kind of realization that I’ve come to is that with AI specifically, you know, it’s dramatically reduced the cost of impersonation, right? Whereas before you had to spend all this time creating profiles, you had to get all this information, you had to find the person’s photo, et cetera.
[00:03:30] Kacper Piwowar: Like it took some effort, but that effort’s cut down to like 10% now, right? And, there’s obviously various malignant reasons why this is happening. but in my opinion, like the criminals and the people who use it, you know, they’re not looking to just hack your bank account anymore, right? And what I mean by that is why would I hack somebody’s bank account when I can literally pretend to be somebody else and they’ll give me the credentials, they’ll give me the money, right?
[00:04:00] Kacper Piwowar: It’s like just having them open the door and you just go through it. So yeah, it’s a big issue and I think that, AJ, it comes down to the fact that it’s a lot of awareness and a lot of education that needs to occur. And I think we’re somewhat educated, but I think where we’re deriving those educational pieces oftentimes is like mainstream media.
[00:04:19] Kacper Piwowar: Like I don’t think we’re self-educating on this. and also like how do you mitigate it happening too, right? So yeah, to answer your question, I mean, it’s a big thing. I’ve personally never been a victim of it, but I have met people who’ve been a victim of it and man, it’s hugely detrimental.
[00:04:39] Kacper Piwowar: I’m sure you probably know, but this is just… this is the problem now of 2026 and going forward.
[00:04:46] AJ Nash: Yeah, I agree. I mean, as far as the size, I saw a story yesterday or the day before, more than half of the internet’s traffic now is fake, right? bots, artificial, right? So the bot traffic I think was at 53% now as opposed to genuine human traffic.
[00:04:59] AJ Nash: So the internet as a whole now has shifted beyond 50%
[00:05:03] Kacper Piwowar: Yeah.
[00:05:03] AJ Nash: And you get into social media platforms and yeah, it’s a rather significant number. I think 20 to 30% of social media interactions I’ve read were bot related.
[00:05:12] AJ Nash: Now that doesn’t get all the way into the synthetic media and the deep fake point, a lot of them are coming from those sites, right? And the technologies are so good, and cheap and people play with these things obviously ’cause it’s fun too. “Hey, I’m gonna do a quick face swap and look, you know, this is now I’m Tom Cruise,” or, you know, that’s a very popular one out there.
[00:05:27] AJ Nash: Pick a famous person, right?
[00:05:29] Kacper Piwowar: Yeah.
[00:05:30] AJ Nash: Fun to play with, but they’re also very inexpensive, and easy to get ahold of, and it’s easy to manipulate now. and so many people live very public lives now. You know, even, average person on the street, you know, social media, it makes you a public figure to an extent, not legally speaking, but there’s a lot out there.
[00:05:48] AJ Nash: So it’s not hard to gather the content needed to create a really strong, deep fake, a strong impersonation of somebody. If you’ve got video out there, if you decided to throw stuff on Instagram or, you know, wherever people are putting video, you know, TikTok, whatever somebody can consume that, and once they have that, they can easily use that to feed into a really inexpensive, if not free system and develop a very quick, deep fake, right?
[00:06:11] AJ Nash: And so your voice, your image, and then just change the words obviously to whatever they want it to say, and now they’ve got the ability to impersonate you. And as you said, you know, why would I bother to hack into systems or hack into bank accounts, something like that if I can impersonate? And when you think about it from a social media standpoint, you know, why would I not use this if I’m an adversary impersonate you and then take advantage of all the connections you have, information you might be able to get ahold of, right? It’s very powerful, very easy to do, making phone calls on people’s behalf, pretending to be somebody.
[00:06:39] Kacper Piwowar: Yeah.
[00:06:40] AJ Nash: All the way down the path of fraud. Somebody impersonates somebody’s child, for instance, claims to be in trouble and needs help and needs money wired very quickly.
[00:06:47] AJ Nash: You can use this to target public officials, target, wealthy people. I was actually, with my permission- impersonated, at a conference, here, in the Twin Cities and, BSides, Twin Cities, one of the presenters wanted to do this, and I said, “Yeah, sure, go ahead.”
[00:07:00] AJ Nash: And so they, without taking anything from me personally, just was available publicly, put whole presentation, and I sat in the back row as they presented to a group, and had a full conversation with, you know, a digital version of me that wasn’t me, that supposedly was trapped in a stairwell and needed help, and it was a way to get around security and get somebody to let them into a door they shouldn’t have been allowed into.
[00:07:19] AJ Nash: And the whole thing happened while I sat in the room, and it was very convincing, and it was very inexpensive to do. And so you start realizing it exists, and we’ve helped make this happen, right? As people, as members of the digital world, being out on social media and getting all of our stuff out there, we’ve made this much easier for people, because you can capture our image and you can capture our voice and you can put it in there.
[00:07:40] AJ Nash: We’ve made this a problem. and so at this point, yeah, it’s significant. You know, I know a lot of people think, “Well, I’m not important. Nobody’s gonna impersonate me.” and that may be true for a lot of us, but a lot of us don’t realize how important we are either. Maybe you’re the person who has the access to the payroll files, or you’re the
[00:07:56] Kacper Piwowar: You have a very specific role or something, right?
[00:07:58] AJ Nash: I mean, I’ve heard people say, “Well, I’m in marketing. Nobody cares.” I’m like, they might care. You have access to the company roadmap. That could be very, very valuable to a competing company.” or somebody says, “I’m just in HR.” I’m like, you have access to a lot of files.
[00:08:08] AJ Nash: You may choose not to access them, but you have access to a lot of things that could be very valuable to other people.” So, I think those who think, “Well, I’m not gonna be a target,” probably underestimate their own value. It’s ironic, I think we live in a society where we both have people who very much overvalue how important they are to the world, and at the same time very much undervalue how important they are to the world, depending on the context.
[00:08:26] Kacper Piwowar: And the inflection point of that, AJ, what’s inhibited this to happen at the rate that it’s happened at is when this technology became available, the base of information, i.e. all the photos and whatnot that are already out there, was abundant, right? If we think about when Facebook was king and all the other social medias were, in their infancy.
[00:08:49] Kacper Piwowar: Everyone uploaded albums of themselves, their friends, their family. So what’s kind of accelerated this is then you have the advent of AI that comes in, in recent years, and it has this dramatic base of information that already exists on the net. It doesn’t even need to go out and find you and take a picture of you.
[00:09:12] Kacper Piwowar: It’s already existent, and so it just feeds off of that base, and it goes back to that old adage, right? You put on the internet, I mean, it’s there forever.
[00:09:22] Kacper Piwowar: That’s kind of the assumption that you make. so I think that that’s like accelerating it. but it’s also, you know, when we flip it and we look at, well, what does this result in, right?
[00:09:33] Kacper Piwowar: Like somebody pretends to be me on LinkedIn, or somebody sends an email on my behalf and they use some sort of a phishing email. All of us kind of see it as statistics, right? Because, you know, they’ll say half a million accounts here, one million accounts here have been compromised, and these people’s identities have been taken.
[00:09:50] Kacper Piwowar: When you drive it down to the loss, what I mean by the loss is the net-net of everything that occurred to that individual, is you have the time it takes to recover the actual accounts, the credit reports that you probably have to go in and check now to see if anything has occurred.
[00:10:11] Kacper Piwowar: The banks that you have to contact now, that you have to phone up and say, “This isn’t mine,” like, “Can we reverse this?” Or you have to challenge it. The passwords you now have to change, remember, and then you think about social media. It’s not enough to just say, “Well, this is me, and these ten other accounts are not me.”
[00:10:32] Kacper Piwowar: There’s a burden of proof that falls on the user to show that it is you, because who knows, maybe it’s just another impersonator, right? while you look at the financial loss, it might be like a few hundred bucks or maybe even a little bit more than that. The recovery in hours is tremendous. And I think that is in and of itself or should be a deterrent to many people to say, “Do I have the right personal security posture?” you can’t really fight necessarily these technologies that are coming out, especially when they’re used for these malicious purposes. But what you can do is say, like, “Are my own security operations like, you know, half decent to prevent this or not?”
[00:11:14] AJ Nash: Yeah. And I mean, it’s, again, as we talked about the scale, you know, it’s recent reporting the global impact of deepfakes, you know, $2.19 billion last year. Deloitte’s saying it’s gonna be $40 billion, by 20-2027. but you’re talking about from a personal standpoint, which is also really important on how that’s gonna affect us personally.
[00:11:30] AJ Nash: And then what are you gonna do about it, right? So I think, you know, it’s interesting as we talk about where this all started, right? AI has consumed the internet essentially, right? And so, you know, I think we’ve all talked about for decades at this point, you know, don’t put too many things on the internet, but people have, and that’s just how it’s going, right?
[00:11:46] AJ Nash: It’s interesting to me, I have one child, my kid’s 17 now, and I was the outlier. I’ve never had a Facebook account. I was at NSA. I was in the agency. I wasn’t a social media person. And so when my kid was born, of course, my family wanted to see pictures, everybody does.
[00:11:57] AJ Nash: But I didn’t do Facebook. I actually set up like a personal server and made people log into it and come see stuff, which seems ridiculous, but now seems like a smart move, ’cause none of my kid’s baby pictures are on the internet. but nobody did that, right? That wasn’t a common thing. Most people just, you know, throw it on the internet and put it out there and a lot of people didn’t bother with the security protocols.
[00:12:12] AJ Nash: I constantly tell my family, “Hey, you should lock some of this stuff down so the world can’t see everything about your life.” but that horse is out of the barn for a lot of people. So if you can’t fix that, then it’s like, well, what do you do now? How do you protect yourself now from these kind of threats?
[00:12:25] AJ Nash: When it comes to dealing with banking or industry it’s gonna be very difficult. It’s gonna come down to probably detection on their end. There are a lot of companies that do really good work in this space. I’m not gonna start naming companies. We’re not advertising for folks.
[00:12:37] AJ Nash: Anybody can Google quickly, you know, deepfake detection. a lot of companies in this space. This is a growing industry. and I think most financial companies and most large enterprises probably should end up contracting with some of these folks ’cause they’re gonna have some requirements.
[00:12:49] AJ Nash: If the bank sends money someplace it shouldn’t go, and they say it’s ’cause the user told me to, and the user can prove they didn’t, the bank’s gonna have to come up with that money again. So that’s their liability, their risk, their problem. But in our personal lives, you know, there are some simple things.
[00:13:04] AJ Nash: I will tell you for my family personally, we have a code word. Some people in my family are very technical and some are not. Actually, most are not. And so I had to explain this whole concept of, hey, you might get a phone call. It might sound like one of us. We might sound like we’re distraught.
[00:13:16] AJ Nash: We might sound like we’re in danger. We need money. We need help. Whatever it might be.
[00:13:20] Kacper Piwowar: Yeah.
[00:13:20] AJ Nash: We have a code word, and if you don’t have the code word, that’s the end of that discussion. And, you have to obviously work to make sure people understand that because this happens relatively often now, and it gets more and more convincing.
[00:13:32] AJ Nash: Now, we’re not particularly fancy important people necessarily, but it doesn’t take much. Everybody who’s ever seen a phishing email should assume that they’re gonna be part of this attack structure at some point as well. It can be done en masse. It’ll be set up with automation.
[00:13:46] AJ Nash: they’ll have their AI bots out there hitting all the same things. So every breach that’s had a bunch of phone numbers to it, that’s now their list, and these things will go out and just be kicked out, these fake phone calls. You can also do it with video. There was a story last year, I guess, where there was a Zoom call where somebody on the call was called in.
[00:14:02] AJ Nash: It was the CEO and a whole bunch of important people, and they ended up transferring tens of millions of dollars as they came out of that phone call ’cause they were told to do so. And it turns out everybody on the call except for the target was fake. It was completely false generated information. So we have to double-check who’s inviting us to a call.
[00:14:17] AJ Nash: If it’s unusual and out of the ordinary, maybe we, out of band, make a call to that person separately to say, “Hey, did you schedule this meeting?” but again, with the family piece, having a password, no matter how convincing somebody is, how desperate they are, what they need, if they don’t know the password, they’re not real.
[00:14:31] AJ Nash: That’s some simple things we’re gonna all probably have to do, frankly, to combat this because this is a growing technology and a growing threat. I’ve had some calls. I haven’t had anybody try to impersonate a friend or family yet, but I’ve certainly had some deep fake calls and texts come through at this point.
[00:14:46] AJ Nash: I think we’re gonna see a lot more of this and the video calling is just gonna get worse as well. So, you know, people believe what they see and hear generally.
[00:14:52] Kacper Piwowar: Yeah. And it’s kind of ironic because if you look at it, like over the past thirty years or so, the internet taught us that, you know, when you look at digital evidence, you can trust it to a degree.
[00:15:05] Kacper Piwowar: Now the thinking is, with AI especially, that in the next decade, it’s all gonna force us to question.
[00:15:12] Kacper Piwowar: So there’s a bit of a reversal in terms of how you think about your interactions online and whether or not you’re dealing with something authentic or something not. And to your point earlier, there’s a lot of companies that are developing these technologies, anti-AI technologies to help detect.
[00:15:32] Kacper Piwowar: It’s almost like this cat and mouse game. And what I’ve found with the technologies that I’ve run into is oftentimes they’re very useful as signals, but they’re not reliable enough to be treated as proof,
[00:15:45] Kacper Piwowar: Just because of the different margins of error that they carry. And when you get into things like deepfakes, you get into other different types of media that are being created and tweaked, and you have videos, and you have audio, you have writing, right?
[00:16:02] Kacper Piwowar: And I think that with, video especially and images, there’s still some catch-up that’s being done with AI where, at least some of the technologies have a pretty decent hit rate in terms of identifying what’s created and what’s not. But I was actually reading recently and doing a bit of research around the anti-AI technologies for writing. So,paragraphs or, let’s say essays, and there is no tool that can reliably determine whether a piece of text is written by AI or a person.
[00:16:40] AJ Nash: Despite all the tools out there that they…
[00:16:42] Kacper Piwowar: And it’s crazy in a sense of, okay, so that medium of writing emails, doing tones, and making sure that you sound like the person it’s coming from is nearly identical now.
[00:16:56] Kacper Piwowar: And, you know, it’s only a matter of time until it catches up with the other mediums.
[00:17:02] Kacper Piwowar: I think that the cat and mouse game will work for some time, but ultimately, my theory here is we’re gonna get to a place where the cat and mouse is too resource exhaustive, right?
[00:17:19] Kacper Piwowar: Companies are spending way too much time and money trying to catch what’s fake and what’s not. So where I think we’re gonna get to is we’re gonna see a shift of perspective of identifying what’s authentic, not identifying what’s fake.
[00:17:35] AJ Nash: Sure.
[00:17:36] Kacper Piwowar: So this is kind of an interesting different way of thinking of things, and the reason I think it’s a mindset change is because it goes back to, let’s say, counterfeit money, right?
[00:17:48] Kacper Piwowar: So banks, initially when they started, they tried to identify fake bills. That became very resource intensive. Lots of technologies had to be employed, and you had to go through everything to just identify the fakes. Whereas today, what happens is they embed security features into bills to identify that it’s genuine.
[00:18:08] Kacper Piwowar: So what does that ultimately kinda translate to? It’s like the future is not gonna be so much about detecting every deepfake. It’s gonna be about proving what’s authentic
[00:18:19] AJ Nash: Yeah. I mean, that’s a really good point. Uh, and your, your comparison to money, is thought-provoking, Instead of trying to figure out all the flaws, every country in the world, as far as I know at this point, has got something built into their money complicated as you go along, for the US it was complicated, artistic patterns essentially. They were very reliant on the type of paper we used and now since then it’s got much more technical and there’s metallic threads and a lot of things that are built into these pieces of currency.
[00:18:42] AJ Nash: I don’t think I’ve heard anybody compare that to where we’re gonna go in terms of deepfakes to say, “Hey, instead of worrying about what’s fake,” which is wide and various and has a lot of variables, are the indicators of what is real?” Now, what that means, though, is that we’re gonna have to, much like with money, we’re gonna have to create something for that.
[00:18:58] AJ Nash: We’re gonna have to embed something in the technology that isn’t easily identifiable and isn’t easily replicable, which I guess will be some of the challenge. Almost everything in technology it seems like somebody can replicate. But that’s an interesting concept, right? It won’t be as simple as a watermark.
[00:19:12] AJ Nash: I think people will be able to figure that out, right? It’s gonna have to be some more technical code built in, to original recordings, for instance, whether it’s…
[00:19:19] Kacper Piwowar: Yeah, yeah.
[00:19:19] AJ Nash: Audio will be more difficult, I suspect, though, because I don’t know how you’re gonna be able to identify it, I guess, unless you’re gonna be able to run it through a system that measures it. But your concept I think is really interesting, even if the technology isn’t there yet. I haven’t seen this applied yet, but I think the concept makes a lot of sense of just let’s run something through and have it be validated and maybe the validation is, something like blockchain where, all audio ends up running through something, where there’s a validation or something to that ex-extent, right?
[00:19:42] Kacper Piwowar: Yeah, it could be the device or it could be a level of encryption on each file, depending on who records it with what software, right? I don’t know the answer, but I do know that for as long as we continue to chase what the threat actors are putting out there, especially as we start to scale and we see that scale happen enormously, exponentially, not just, doubling or tripling, like we’re talking 100X.
[00:20:10] Kacper Piwowar: there needs to be something developed that figures out if this selfie was taken by this person.
[00:20:16] AJ Nash: Yeah.
[00:20:17] Kacper Piwowar: What that is, I, I don’t know.
[00:20:19] AJ Nash: Oh, I think you’re right, and I think it’ll be a mixture depending on what the medium is. So like I said, for video and pi- and images, I think things can be embedded. For audio, you know, it may be something different. I know right now, you know, challenging it, it works really well.
[00:20:29] AJ Nash: Again, you know, if somebody is purported to be somebody else, they’re impersonating somebody, you can challenge them. Like, what is a thing that that person, only that person would know about you? Or only, you know, what did we just talk about yesterday? What did we have for lunch yesterday? It can be very simple things, right?
[00:20:43] AJ Nash: that does tend to throw off, any sort of fraudster, but it will also with the AI, right? AI has its own flaws, its own inabilities. In some cases you can challenge the AI and it’ll reveal itself because it isn’t taught not to, and you can, challenge it on its own instructions, and it will suddenly reveal that it’s AI because the person using this didn’t take the time to figure out that you should also instruct it not to reveal itself to anybody.
[00:21:02] AJ Nash: but that also forces a lot more knowledge, right? A lot more training. As you said, a lot of people’s knowledge in this area really comes down to whatever they’re seeing, mainstream media, whatever’s in the news. Most people are not highly, highly technical, busy lives already.
[00:21:13] AJ Nash: And we’re gonna have to help educate people again that this is a real threat, which means there’s a long tail to that, unfortunately. highly
[00:21:19] AJ Nash: People will figure it out faster than the rest ’cause they’re plugged into this, but it’s a long tail to get.
[00:21:23] AJ Nash: You know, my grandmother is gonna have a very hard time understanding that if I call and I sound panicked, it might not be me, right? and that’s a challenge that we’re gonna have a hard time getting through, I think.
[00:21:32] Kacper Piwowar: So you bring up an excellent point, and this is kind of another thing that I’ve discussed with colleagues around this topic, which is, the concept of data accessibility. There is a lot of information out there that can assist people with situations like this and with understanding these different concepts.
[00:21:53] Kacper Piwowar: But the accessibility component is, I believe, equally important. You just brought up the example of your grandma, right? is she gonna know what portals to go to? How is this information disseminated to individuals that are not tech-savvy, right? Are you gonna print a whole bunch of flyers?
[00:22:11] Kacper Piwowar: You’re gonna hold a town hall? Like, while these concepts sound utterly ridiculous to some people who are very deep into this stuff, it is very practical in a sense of getting the information to the different audiences out there. And I use a common example of this, right? Let’s say there’s a lake, I go to get fresh water, and you need fresh water.
[00:22:35] Kacper Piwowar: Okay, so every day I drive to the lake, I get my fresh water, I come back, and I decide, okay, fair enough, you have to know about this too. I give you a map and I say, “Here’s the lake.” And you say, “Great.” That lake is ten kilometers away. You don’t have a car. I haven’t given you the ability to access it e-efficiently.
[00:22:56] Kacper Piwowar: I’ve told you that it exists, but I haven’t given you the accessibility component of it. So I think that having the data out there of how to mitigate these things is like one part of the puzzle, but then having the accessibility component is equally important. Now, whether we’re doing a good job of that or not, why does it keeps going on, right? That’s why people keep falling for these things. I think it’s a combination of ignorance and a combination of excessiveness.
[00:23:24] AJ Nash: Yeah. No, I think that accessibility is a really interesting point. Like, just, just the knowledge doesn’t do you any good, right? The knowledge that that lake with fresh water exists won’t help if I can’t get there. The knowledge that there’s answers to these questions doesn’t matter if people don’t know how to get to them, how to access them.
[00:23:36] AJ Nash: And you have to meet people where they are. You know, and that’s different places, right? Yeah, sure. If we put all the best answers to these highly technical problems and these upcoming threats into, Reddit. I love Reddit, by the way. But if you put it there, Reddit’s got a great audience.
[00:23:49] AJ Nash: It also is a small segment of society. Reddit and Discord and Twitter and, wherever we might put some of these places, Signal groups and Telegram, these are still small segments. And most of those people, or at least a lot of them, are overlaps.
[00:24:02] AJ Nash: Same kind of people that hang out in one of these orgs hangs out in another one, right? But how do we handle getting this information to the people who are not highly technical, but will run into this, right? and that may be even beyond this discussion, frankly, even beyond the deepfake discussion, maybe that’s something we should be looking at, industry-wide for a lot of our education is are we meeting people where they are?
[00:24:21] AJ Nash: because the less technical people are more vulnerable. We should stop trying to get them the answers in technical ways, right? Should we have better partnerships with organizations that are tied to seniors who are some of the most victimized people, right?
[00:24:32] AJ Nash: should we be working more with AARP or with the Social Security Administration, for instance. people that have a demographic that we know is highly susceptible. I’m sure there’s other demographics people could pick.
[00:24:42] AJ Nash: it’s an interesting idea and maybe something that as an industry we should look at. Certainly for this deep fake threat, it’s something to consider because if we don’t meet people where they are, the fact that technology will advance and we will learn how to combat some of this won’t do any good if we don’t get it to people that are the most likely to be victims.
[00:24:55] AJ Nash: I don’t know that we’re doing a very good job of that. I think the statistics would tell us we’re not because of cybersecurity threats, cyber risks, cyber attacks, all of this has gone up year after year after year. We get more attacks, we get more compromises, we get more cost. That tells us, that’s the metric that says we’re not doing a good enough job.
[00:25:11] AJ Nash: Yes, adversaries are getting better and maybe they’re more aggressive, but we’re not doing enough, and some of it’s corporate, but a lot of it’s in the personal world. And so maybe we do need to do a better job of meeting people where they are. And deep fake might be the one that pushes us over the edge because it’s gonna be so hard otherwise.
[00:25:25] AJ Nash: How do you convince somebody that the voice that they’ve known their whole life or the face they’ve seen their whole life isn’t real when that person is begging for help, is desperate for a credit card number? How are you gonna convince them to say no to that loved one? And that’s gonna take more personal involvement probably in how we teach and train people than just sending out an email, or having a new news article or posting a new study or something like that.
[00:25:48] AJ Nash: It’s probably gonna take more personal involvement. Now, speaking of personal involvement and how people are dealing with this, I know you and I had talked, earlier this week about, some of the backlash against technology that we’re seeing as a result of where AI is going as a whole, right?
[00:26:00] AJ Nash: Deep fake is part of this, but, I think you’d called it a reverse digital evolution, which I think is actually really, really cool. Can you talk a little bit more about that?
[00:26:06] Kacper Piwowar: Yeah. So it’s a bit of an interesting movement that we’re seeing, especially with the younger generations like Gen Z where there’s often this kind of preconception that they’re super into technology. They’re one of the most technology-focused generations, and they are, respectfully so.
[00:26:24] Kacper Piwowar: They’ve grown up with it. but where there’s been pushback is, technology that carries a large inherent risk. And I think that there’s pushback on those specific technologies. Like young people, I’m being very generalistic here. They’re not rejecting technology, they’re rejecting performative technology, right?
[00:26:46] Kacper Piwowar: And the future may be less about broadcasting to thousands of strangers, which is kind of what we did, right? We didn’t care if we had an open Facebook profile, like that was actually beneficial. Everybody can see it. Everybody knows me, right? So the future may be less about that and more about connecting with people that they actually trust.
[00:27:10] Kacper Piwowar: So you still use the platforms, but you use them in a private sense. And I think you’ve kind of seen that with, let’s say, like Instagram, some of the newer platforms where, you know, profiles are hidden, profiles are protected. They might still have a lot of followers. They’re still posting like no tomorrow, but they’re doing it with a select group. So I think, you know, and then you know, the next kind of level of thinking that comes is like, well, how was that thinking derived? And I think it’s a byproduct of them growing up during a time where you saw a lot of like digital volatility, where they heard about the deepfakes, they heard about, you know, the digital type scandals, the hacking, the credential leaks, the, you know, credit card infos being, here and there.
[00:28:01] Kacper Piwowar: And I think they’ve been exposed much more to the risk of it, that they don’t shy away from it, but they use it in a very selective manner. and that’s an interesting kind of thought process because I won’t lie, I was a little bit naive, especially when I see kids these days, like head down, always posting, TikTok this, TikTok that.
[00:28:22] Kacper Piwowar: But the secondary thought that should come to mind is like, who’s viewing this, right? And what audiences have they enabled to view their content? And I think that’s an important distinction
[00:28:37] AJ Nash: I think that’s interesting, that you mention that, and maybe there’s a schism almost, as to what is considered important or not important to protect, right? I’ve done some research on this in the past. I wrote a paper on it a long time ago about the generational shift in security practices, and security awareness and privacy.
[00:28:52] AJ Nash: And that Gen Z, the zoomers, are far less concerned about this, or have been at least, than previous generations. Like, just a couple generations ago, if you get into, boomers and Gen X, or young Gen X at least, or old Gen X now, but when they were young, this is a group that didn’t want their phone number in the phone book.
[00:29:09] AJ Nash: These are people that used to pay extra money to keep their phone number out of the phone book ’cause they didn’t want anybody to know who they are or where they lived right? and so that Gen X is actually statistically the best cybersecurity generation, because we grew up with enough technology but also enough fear and awareness of threats.
[00:29:24] AJ Nash: Whereas Gen Z is statistically like the worst at this point. 52% of millennials and Gen Z have had their passwords stolen, but only 37% of Gen X and 12% of baby boomers.
[00:29:33] AJ Nash: Boomers probably can’t remember their passwords, so it doesn’t really count. But, if you’re a baby boomer out there, don’t be mad at me. It’s just a joke. Anyway, there’s lots of stats that say Gen Z, the zoomers, it’s the apathetic generation when it comes to security, and cybersecurity, that everything’s been compromised, everything’s been stolen, and they don’t seem to care as much.
[00:29:49] AJ Nash: But what you’re saying is, there may be a shift, at least in terms of the more personal things, right? Not your email address or whatever. There’s stats in here that said like 70-some odd percent of zoomers will use a corporate email to do social media, which is insane, right? To me as a Gen X-er, I would never even consider it.
[00:30:05] AJ Nash: But at the same time, is that what I’m hearing from you? Is that, no, when it comes to the more personal things, they’re starting to lock these things down? ‘Cause I’ve always thought of Gen Z, frankly, as this super public, you know, “I wanna get rich and famous,” being an influencer generation.
[00:30:16] AJ Nash: “I’m willing to take the risks ’cause maybe I don’t even understand the risks or I just don’t care,” of all these things getting out there. Is there a difference that I’m missing in all of this? Is that what you’re telling me?
[00:30:24] Kacper Piwowar: Yeah, I would say when you talk about security operations and security procedures, in terms of passwords and privacy, I feel that you’re 100% right. The emphasis isn’t so much on that component, whereas they just wanna get on the platform, enable it, they click through any box that needs to be accepted.
[00:30:46] Kacper Piwowar: I think where the care comes into is the utilization of the platform and then who specifically can view it, right? I think there’s more emphasis there. I also think it’s a lack of understanding of how much data is actually being collected on these platforms, right? I think it’s kinda like, well, I click through it in order to use X software, I’m gonna accept everything that has a red star beside it,
[00:31:11] Kacper Piwowar: Otherwise, I can’t use it and join my friends. But once I’m on that platform, now I do, “Well, who do I really want to see this?” And I think there’s a degree of selectivity there. But really, these personal linkages have a lot of strong linkage to the area that we work in, right?
[00:31:28] Kacper Piwowar: Because of my conversations with different types of investigators in different areas, right? Searching for people of interest or searching for events, this is 100% relevant because this information and the ability to tweak information, photos, audio, everything, oftentimes might be treated as authentic, therefore included in some legitimate investigations.
[00:31:56] Kacper Piwowar: And people might get in trouble for things maybe that are not tied to them.
[00:32:03] Kacper Piwowar: And I think there needs to be an education piece in our industry too, around, you know, what tools can you use to effectively not fall into that trap. Now, no tool is perfect, but taking the internet at face value, I think that’s a much higher risk than educating yourself.
[00:32:22] AJ Nash: Yeah. No, I think you’re exactly right. and I think we’re seeing more work in that area, thankfully. I think people take it seriously and are committed to getting smarter about this, at least if they know there’s something they need to be smarter about, which tends to be the big challenge again is the awareness piece and giving people access and availability, as you said.
[00:32:38] AJ Nash: By the way, just as a side note, I’m not gonna keep kicking stats at people, but I thought it was funny. SailPoint actually had done a piece that said that 94% of boomers are confident or very confident in their ability to detect a phishing message at work. A lot of them are wrong.
[00:32:49] Kacper Piwowar: Yeah.
[00:32:50] AJ Nash: That’s a wild number, 94%.
[00:32:52] Kacper Piwowar: You know, I can…
[00:32:52] Kacper Piwowar: I actually have a stat for you.
[00:32:54] AJ Nash: Oh, what do you got?
[00:32:55] Kacper Piwowar: I actually just read this recently, of the ability for people to detect a fake image that was, you know, doctored, created by AI. I shouldn’t say doctored ’cause people throw filters and stuff on things all the time.
[00:33:07] Kacper Piwowar: But an AI image and the accuracy rate amongst the group that was studied was twenty-four point five percent that could spot something that was fake. Now, that’s pretty bad. It means that a lot of us are not naturally trained to look for things that maybe some of these more sophisticated programs are, but that also shows that, it kinda comes back to the education piece, is you might be aware of it, but if you don’t take some time to understand it, to train on it, like it’s quite easy to fall victim to this, right? and the data speaks it, It’s not something that’s hypothetical.
[00:33:48] Kacper Piwowar: Like people aren’t… maybe a few years ago, people were saying, “AI this, AI that. It’s gonna have all these negative effects and whatnot, and no one’s gonna control their digital life.” Sure. There was no data to substantiate it really at the time. Now there is, and we’re starting to see some of those kinda negative prophecies somewhat come to life.
[00:34:09] Kacper Piwowar: Now mind you, it’s not all bad, obviously. we could make an entire podcast on the benefits of AI, and I’m sure it’d be just as enriching to everybody. But, I think that some of those negative prophecies are coming true for better or for worse, but it’s not the be-all end-all.
[00:34:24] Kacper Piwowar: There’s ways to mitigate these things. There’s ways to train yourself. There’s ways to, get people around you aware, right? that needs to be a conscious effort. So
[00:34:35] AJ Nash: Well, it has to be something you want to do, not just, have the ability to do or are educated on. I think we’re also working into a space right now where a lot of people are happy to believe what they wanna believe, right? And if they get something that’s convincing, then they just wanna “Well, no, I got this video and it proves it.”
[00:34:50] AJ Nash: And they don’t really want to dig in and find out where, what was the source of that video and, and was it valid. Now that’s influence campaigns and things like that that we’re seeing, which are really popular, and do really well, unfortunately. You know, and, and we’re seeing more of that, and you go, “Listen, I don’t think everybody is ignorant about everything in this,” whatever this topic might be you’re, you’re reading about.
[00:35:07] AJ Nash: I think there’re some people who are just happy to take something and call it evidence because they wanna believe what they wanna believe, and, and it’s easy to take this and say this proves their point. You know, inherently humans are lazy, so if we find something that helps us, we’ll, we’ll accept it.
[00:35:19] AJ Nash: That’s a concern as well, people have to be willing to believe things that are uncomfortable instead of comfortably believing things that are easy to come across. Otherwise, we continue to be very susceptible to influence. but something else you had mentioned I wanna stick back to really quickly was on the open source piece, right?
[00:35:33] AJ Nash: and what all this is doing to open source research. So, you know, I think on the one hand, yes, everybody being open to the world and providing so much has been, you know, it’s a boon. You know, if I wanna do background investigations, you know, it’s amazing. I demonstrate this stuff to people, and it always shocks them at just how much of their life is available on the internet, even if you feel like you’re not, living a super…
[00:35:50] Kacper Piwowar: Oh, yeah. Your data lives in some, nook and cranny on some random site that you’ve probably never been to
[00:35:55] AJ Nash: Exactly. And so it’s easy to get a hold of a lot of people, but with deepfakes being plugged into some of this, you have to, as a researcher, as an analyst, you have to be able to understand and identify some of this too. Or you do make the mistake of putting something into… You know, what if I’m doing a background investigation for somebody for a job?
[00:36:11] AJ Nash: that’s important to the company. It’s also important to that individual. If I find content that is deepfake content that I can’t tell is unreal, you know, is false, and that content puts somebody in a really terrible light, and I include that in the dossier, and that person doesn’t get hired for a job, which by the way, they may or may not know why they didn’t get hired.
[00:36:27] AJ Nash: They may have to ask for the content that was used in their background investigation. That’s another impact. So it is incumbent upon researchers who are coming across all this content on people in highly important positions to also be able to understand what’s real and what’s fake. If I report to somebody, I have to know that what I’m giving them is as real as possible, as accurate and complete as possible, ’cause it affects the company, it affects this person.
[00:36:49] AJ Nash: It could be the same in reverse. Maybe this person created a bunch of false content that makes it appear that they’ve got credentials they don’t have. And so you’ve got to add that to the mix of people who are out doing all sorts of research and investigation. It’s gonna be the same in academic work.
[00:37:01] AJ Nash: It’s gonna be the same in law. We’re seeing that now. We’ve had lawyers that have submitted briefs that were built off of AI, and it turns out the content was false. so it is gonna track into all of our different areas of life, bit by bit to say, “Hey, I gotta know how I can identify things that are real and not real.
[00:37:16] AJ Nash: I also have to protect people from thinking things about me that aren’t true, that are unreal, but I have to be able to do it for others.” In the OSINT space, it’s a really important piece because our job is to find a lot of stuff and to make sense of it, which means you have to know what’s real and what isn’t, and combine all that together.
[00:37:28] AJ Nash: And you may have to write a report that even says, “Here’s a bunch of stuff that you’re gonna find on the internet about this person that’s not real, and this is why I think it’s not real. I’ve run it through these systems and I’ve done this, validation. You know, don’t worry about hiring this person because of this horrible stuff that’s out there that’s not real.
[00:37:40] AJ Nash: But you should know this exists ’cause you may have to have a PR campaign or whatever to combat this if somebody else says it is real.” it’s a much more complicated subset of all this that we’re seeing of these impacts of deepfakes out there.
[00:37:51] Kacper Piwowar: Yeah. And it’s kinda like, it almost gets to a damned if you do, damned if you don’t, where you could have the scenario you just mentioned, but if you decide to abstain from any sort of social media altogether, it’s inconspicuous, right? Like, why doesn’t this person have a LinkedIn? Why doesn’t this person have a Facebook profile,
[00:38:13] Kacper Piwowar: So it’s like walking this thin line, of making sure that you’re digitally relevant, digitally accurate, but not, you know, being taken advantage of and losing your digital self
[00:38:26] AJ Nash: Yeah, that’s a good point. I often encourage, I’ve done executive protection work in the past, and one of the first things you look at and say, “Listen, if you don’t own your space in LinkedIn, in Twitter,” and pick a social platform. If you don’t own your space, somebody will. You know, ’cause I’ve had executives say, “Well, no, I don’t have any of those accounts.
[00:38:41] AJ Nash: I don’t want to be compromised. I don’t want to be impersonated.” You know, it’s easy now to say, “I’m not on that platform, so everybody knows if something comes from that platform, it’s not me.” And so that’s good for people that are close to you, but somebody will own your space, and you can’t tell everybody in the world that isn’t you, and they will impersonate you effectively.
[00:38:57] AJ Nash: They will gain a lot of fraudulent advantages as a result. And eventually, it does come back usually on the person who’s been victimized ’cause somebody ends up blaming that person because that profile represents them and that person was fooled, and they think you did it.
[00:39:07] AJ Nash: So you have to own your own space. Whether you like it or not, we have to be on all these platforms. And then the question is, how do you balance what’s on there? active enough that you exist, not so, transparent that you give away too much. which might get back to the point you had said earlier about we’re gonna have to build better technologies that have things embedded in our video, in our pictures, in all of our content so that people know what’s real and what isn’t, because we can’t just shy away from this.
[00:39:30] AJ Nash: Like social media’s not going away. The internet’s not going away. You know, as you said, if I’m talking to somebody or I’m interviewing somebody or whatever it might be, and they don’t have a LinkedIn profile, I have a lot of questions. Now, sometimes there’s good answers. I’ve worked in the classified space.
[00:39:41] AJ Nash: Like I said, I’ve never had a Facebook account, and for a long time, that was something people questioned. So sometimes there are answers. But generally speaking, yeah, as you’re moving very quickly, if somebody doesn’t have these places set up, they don’t have presence in these platforms, you start wondering, “Well, is this person real?”
[00:39:54] AJ Nash: I mean, that also makes somebody seem artificial. So yeah, damned if you do, damned if you don’t might be true, sad as that sounds. But I think we have to do a better job, as you said, on building some more technologies to help people know what’s real because this problem’s not going away, and we can’t just hide from it.
[00:40:08] AJ Nash: We all have to live in these spaces to be relevant in our careers and in the world, I guess. which means we’re gonna have to do a better job of that because, as you said, 24% of people basically can identify this stuff on their own. and that’s a really bad number. So, you know, three out of four people are gonna be fooled by deepfakes is not a good stat.
[00:40:25] Kacper Piwowar: I mean, unfortunately, it’s a newer threat, right? So it’s gonna take some time to catch up. but yeah, I think, there’s a lot of good that’s gonna come from the tech itself. But you know, what we covered here, I think is something that, maybe some people are aware of from a very high level, but maybe don’t understand the seriousness of the problems.
[00:40:43] Kacper Piwowar: And hopefully, you know, with enough education, with enough discussion, with enough tech to also back that up, we’ll be able to get to a place where we find that happy medium
[00:40:52] AJ Nash: All right, listen, we gotta wrap up. I know people have a lot of things going on in their day, and we appreciate they’ve taken some time with us, so we don’t wanna keep too much of it. Anything you wanna leave the audience with? Any last things you wanna drop, whether it’s about this or about you joining NeedleStack or?
[00:41:03] Kacper Piwowar: Join us next week. We’re gonna cover a super cool amount of topics. We’re gonna have guests on this. I’m super excited to be on this with you, AJ. your experience, your tenure. yeah, there’s a lot to talk about, and this space doesn’t stop, so…
[00:41:18] AJ Nash: So for everybody out there, first of all, Kacper, I’m super excited to have you join the show. it’s gonna be great to co-host with you, like different perspectives, different backgrounds. It’s always really fun. You’ve got some really cool ideas and some really cool stories to tell, and I’m really looking forward to working together.
[00:41:31] AJ Nash: And for everybody else, just so you know, yes, we are gonna have guests. It’s not just gonna be me and Kacper. So we’ll have guests again.
[00:41:36] Kacper Piwowar: Although it could be if, if that’s, that’s what the people want, I give people what the people want.
[00:41:41] AJ Nash: Yeah, we’ll get the feedback. We’ll certainly have a mix.
[00:41:43] AJ Nash: Sometimes it’ll just be us, but we do plan on having guests. As usual, we’re gonna go back every couple of weeks, so fortnightly we’ll be coming out, with new shows. So I hope people will continue to tune in. Listen, if you like the show, please let us know. send us feedback.
[00:41:54] AJ Nash: If you don’t like the show, please let us know and send us feedback. Just don’t tell anybody else. but please do, reach out, let us know where we are. You can catch us on all the streaming platforms. You can catch us if you go to the company website, Authentic8, Authentic8.com, slash Needlestack.
[00:42:08] AJ Nash: We’re also available on social media, whether it’s LinkedIn, or Twitter. But you can find us if you’re looking for us. So please, tell people that you like the show and help us get more likes and follows so we can keep doing great things.
[00:42:18] AJ Nash: And again, we do care about your feedback. Kacper’s gonna read every one of your emails, free to send all of them.
[00:42:23] Kacper Piwowar: I’ll find you if I need to.
[00:42:24] AJ Nash: All right. So listen, we’re gonna wrap it up for this week. Again, thanks everybody for tuning in. I appreciate it. I hope this makes you a little safer and happier in your day and look forward to doing this again, in a couple weeks. With that, I’m gonna go ahead and sign us off. This has been another episode of Needlestack.
