WEBVTT 00:00:04.000 --> 00:00:13.000 Hi, this is Ryo Koyama. Welcome to another episode of Remotely Local. Mike Johnson and I are very, very excited to welcome Patrick Coughlin today, CEO of 00:00:13.000 --> 00:00:21.000 Savi Security and also author of Dark Side of the Boom. And so, very excited to have you. Thank you, Patrick, for joining us today. 00:00:21.000 --> 00:00:24.000 Super happy to be here. This is going to be fun. 00:00:24.000 --> 00:00:32.000 So, let's first, for those that don't know, because Savi Security is brand new, why don't you give us a little backdrop about that, and then we'll dig into the whole space 00:00:32.000 --> 00:00:35.000 about your book and why we are excited to talk to you. 00:00:35.000 --> 00:00:42.000 Yeah, absolutely. I'll give you the quick background. So, I'm a cybersecurity guy by trade. I've been working in the industry for about 00:00:42.000 --> 00:00:50.000 20 years, done work on the government side and on the enterprise side. I had a company called TruSTAR 00:00:50.000 --> 00:01:01.000 that was a threat intelligence platform for large Fortune 500 companies. That was acquired by Splunk, and then Splunk, in a very Silicon Valley story, was acquired by Cisco. 00:01:01.000 --> 00:01:05.000 There's an image of little fish getting eaten by bigger fish here. 00:01:05.000 --> 00:01:15.000 But a couple years ago — and we can get into the story later — my mom was the target of a fake kidnapping scam that was powered by AI. 00:01:15.000 --> 00:01:23.000 And that sent me down a rabbit hole of looking at the huge challenge that is facing consumers today coming from AI- 00:01:23.000 --> 00:01:34.000 powered fraud. And the data is off the charts. Americans are losing close to $200 billion a year, and it's being driven largely by imposter scams. 00:01:34.000 --> 00:01:41.000 And it's hitting all demographics. It's hitting senior citizens. It's hitting young people on gaming platforms and social media. It's 00:01:41.000 --> 00:01:50.000 hitting the sandwich generation, our spouses, our partners, our parents, our kids. And so, you know, I recognized 00:01:50.000 --> 00:01:58.000 that we need a whole new level of innovation to protect families from scams and fraud in this AI era. And so 00:01:58.000 --> 00:02:05.000 I partnered with my brother, in the long list of questionable decisions. We're making this a real family affair. 00:02:05.000 --> 00:02:13.000 My brother is an amazing product entrepreneur. He's been at places like Apple and Spotify. And so we 00:02:13.000 --> 00:02:22.000 teamed up, my cybersecurity knowledge and his consumer product experience, and that's what started Savi about 10 months ago. We've got a 00:02:22.000 --> 00:02:27.000 great team, and we're bringing products to consumers every day to help protect them. 00:02:27.000 --> 00:02:34.040 Well, fantastic. Plus, at least this way, if your brother calls you and he's sitting next to you, then it's actually — 00:02:34.040 --> 00:02:35.000 That's right. Exactly. 00:02:35.000 --> 00:02:43.000 We sadly have some firsthand experience in the whole voice scamming kind of thing. So, Mike, why don't you tell our little story? 00:02:43.000 --> 00:02:52.000 Yeah. So, we had a new employee, and we don't go in the office often, but once a week we go to our little 00:02:52.000 --> 00:03:00.000 office in Petaluma. And, you know, I roll into the office and I go, "Where's Stuart? He's supposed to be 00:03:00.000 --> 00:03:09.000 here." And he goes, "Whoa, Ryo called him up and put him on a task." And I go, "A task? I don't know 00:03:09.000 --> 00:03:17.000 anything about it." So I started asking questions, and then Stuart calls and asks some weird question, and then we're 00:03:17.000 --> 00:03:24.000 discussing what's going on, and I guess what had happened is he said he was doing a task for Ryo. Well, 00:03:24.000 --> 00:03:32.000 someone with Ryo's voice, probably cloned off of one of the podcasts, called Stuart up and dropped 00:03:32.000 --> 00:03:39.000 some stuff about people that might work for Remote.it, which is our company, and said that he 00:03:39.000 --> 00:03:48.000 had an important task for him to do. And so we didn't really know what was going on, and then finally 00:03:48.000 --> 00:03:55.000 he's texting one of the other employees about some stuff, and everything is not right. So we were all like, "Hey, let's figure out what's 00:03:55.000 --> 00:04:04.000 going on." And so I actually texted Ryo. I go, "What do you have Stuart doing?" And he goes, "Nothing." 00:04:04.000 --> 00:04:04.231 [laughter] 00:04:04.231 --> 00:04:13.000 So I go, "Holy — it's a scam." And I'm like, call him up. I call him up. I'm like, ring him, ring him, ring him until he answers. I go, "Stuart, whatever you're doing, it's a scam." 00:04:13.000 --> 00:04:16.765 Was he at a Bitcoin ATM or — 00:04:16.765 --> 00:04:21.000 No, he had actually bought four Apple cards, man. 00:04:21.000 --> 00:04:27.933 Of course. Totally a red flag, right? But it happens all the time. 00:04:27.933 --> 00:04:29.000 Yeah. Yeah. 00:04:29.000 --> 00:04:37.000 But we actually stopped him just in time, because the guy was pressuring him to scrape the numbers off and give him the PINs, right? 00:04:37.000 --> 00:04:38.000 Wow. 00:04:38.000 --> 00:04:40.000 So you stopped the scam. 00:04:40.000 --> 00:04:41.231 We stopped the scam. 00:04:41.231 --> 00:04:48.000 So that puts you in the minority, I would say. And you're talking about it, which is something people don't often do 00:04:48.000 --> 00:04:59.000 either. I mean, 85% of victims don't ever even report or talk about or share with anybody what actually happened to them. But just think about how far we've come. 00:04:59.000 --> 00:05:05.000 There was a moment, it doesn't feel like that long ago, when scams in the internet era were 00:05:05.000 --> 00:05:14.000 like a random email from a Nigerian prince claiming to have some fortune that he was willing to share. 00:05:14.000 --> 00:05:18.000 Wait, wait, that's not true. I just sent him some bank information. 00:05:18.000 --> 00:05:26.000 Or there was phishing and business email compromise, and masquerading as the CEO on email, and 00:05:26.000 --> 00:05:33.000 maybe trying to spoof an email address or make it look like somebody that you worked with. And now we're talking about a perfect clone of 00:05:33.000 --> 00:05:41.000 your voice that rang the phone number of an employee and asked them to do something. I mean, that's a huge leap, and 00:05:41.000 --> 00:05:48.000 I think it's indicative of where this threat is going, how far it's already come, and ultimately where it's going to take us. 00:05:48.000 --> 00:05:56.000 So, Patrick, why don't we take a second here. Dark Side of the Boom, the book. You wrote that and it covers a lot of this. I think a lot of people would be very interested in understanding what that is, 00:05:56.000 --> 00:06:04.000 because there's probably a lot of information. Like you said, we're not so brave as to sit there and face the embarrassment of telling people we 00:06:04.000 --> 00:06:14.214 almost got scammed. But I think it's important for people to have that narrative. So why don't you talk a little bit about the book and what it covers, for people who might be interested in downloading a copy? 00:06:14.214 --> 00:06:15.000 That's exactly it. 00:06:15.000 --> 00:06:22.000 And so, after our mom got hit with this scam, I basically went down the rabbit hole and 00:06:22.000 --> 00:06:30.000 I was kind of Beautiful Mind-ing my office, putting up: who are these groups, what are the tactics and techniques that 00:06:30.000 --> 00:06:38.000 they're using? Trying to understand what had fundamentally changed in the underlying economy of these scams, that now all of a sudden little old Beth 00:06:38.000 --> 00:06:46.000 Coughlin from Prairie Village, Kansas, would be a target of a sophisticated social engineering scam, the likes of 00:06:46.000 --> 00:06:55.000 which I used to see pointed at juicy national security targets or big 00:06:55.000 --> 00:07:04.000 Fortune 500 enterprises. But something had changed, that it was now being targeted at an everyday consumer. And 00:07:04.000 --> 00:07:15.000 who else was being targeted by this? And how big was this problem? And what I found was exactly what the data bears out, which is digital fraud is now the fastest growing crime in this country. 00:07:15.000 --> 00:07:24.000 It is the largest economic crime in this country. It is the most under-reported economic crime in this country. And it's being turbocharged by 00:07:24.000 --> 00:07:33.000 artificial intelligence. And so, in a past life when I worked for the government, maybe this kind of research would have 00:07:33.000 --> 00:07:41.000 culminated in some sort of briefing in a windowless conference room in DC, to people with the authority, hopefully, to act on it. But my 00:07:41.000 --> 00:07:50.000 clearance expired more than a decade ago. So my choices were, what am I going to do with all this? And ultimately I started a company and figured I'd publish all this stuff in a book. 00:07:50.000 --> 00:07:58.000 And I think it's an interesting way to come over the shoulder of these scams as they're happening and really 00:07:58.000 --> 00:08:04.000 understand the tactics that are being used. So we try to bring readers into a series of different imposter scams, 00:08:04.000 --> 00:08:09.000 the ones that are really wreaking havoc across consumers and families today. 00:08:09.000 --> 00:08:17.000 And those are things like what you just experienced. We call those workplace imposter scams — somebody pretending to be your CEO or a 00:08:17.000 --> 00:08:24.000 colleague or somebody from the finance department. But there are others, like the one we experienced in my family. We call those family 00:08:24.000 --> 00:08:32.000 emergency scams. Somebody's been kidnapped. There's been an accident. You need to wire money. Somebody got arrested. There's all kinds 00:08:32.000 --> 00:08:40.000 of versions of this. Government imposter scams are a big one. Oh, this is the IRS. Or you didn't show up for jury duty 00:08:40.000 --> 00:08:47.000 and there's a huge fine. So there's a series of these imposter scams that are driving the majority of the growth 00:08:47.000 --> 00:08:55.000 in digital fraud today. These imposter scams now make up over a third of all digital fraud in this country. And if 00:08:55.000 --> 00:09:01.000 you think about why — well, what is AI really good at? I mean, the promise 00:09:01.000 --> 00:09:10.000 of AI is that it can speak the language of humanity, right? It can talk like us. If you play with these tools, you can chat with 00:09:10.000 --> 00:09:18.000 them and they seem to engage with us like a human. They can sound like us. They can create 00:09:18.000 --> 00:09:25.000 visuals that are impossible for us to detect as real or not with the naked eye. And those are really 00:09:25.000 --> 00:09:33.000 powerful tools for productivity for humans, but they are an industrial-grade weapon in the hands of somebody who 00:09:33.000 --> 00:09:40.000 wants to deceive us, right? And so I was seeing all of this debate that is still going on, by the 00:09:40.000 --> 00:09:48.000 way, this week: will AI save us or destroy us or disappoint us? And there's 00:09:48.000 --> 00:09:53.000 all this sort of prophesying about the future and what it's going to look like. 00:09:53.000 --> 00:10:01.000 And what I was seeing in the data and what I was experiencing is, well, hold on, there's something real that is happening right now that we don't have to 00:10:01.000 --> 00:10:09.000 guess at, and it's visible in the data, and everybody has a story. I mean, you all have a story right here. I've got a 00:10:09.000 --> 00:10:17.000 story about my mom. Everybody in this country now has a story, because tens of millions of Americans are impacted by this every year. And so I wanted to 00:10:17.000 --> 00:10:24.000 write a book that demystified what is going on here, that helps everyday people understand what these 00:10:24.000 --> 00:10:33.000 scams look like, and do it hopefully in an entertaining and engaging way that brings you into the narrative of the victims, and then also 00:10:33.000 --> 00:10:38.000 looks at the real challenges, which is: how are these scams happening? 00:10:38.000 --> 00:10:46.000 Who's behind them? Why is it so hard to stop them? And then not just be all pessimistic, but hopefully make some 00:10:46.000 --> 00:10:52.957 recommendations about how we as a society can make some improvements to start to turn the tide against the scammers. 00:10:52.957 --> 00:10:54.000 I think it's 00:10:54.000 --> 00:11:02.000 very important that you touch on it. And it's interesting, because I was at a big open-source event recently and the discussion was about AI, 00:11:02.000 --> 00:11:10.000 and one of the things I tried to point out — I was talking about general human intelligence — and I pointed out, I go, 00:11:10.000 --> 00:11:19.000 well, throughout history almost all the great leaders have essentially been liars or manipulative. [laughter] And you emphasize that point, 00:11:19.000 --> 00:11:26.000 because that is something that AI is good at. Mike and I were having a discussion not too long ago where we specifically talked about how social media is already 00:11:26.000 --> 00:11:35.000 the best propaganda machine in history, and combined with AI, it's probably the best war machine in history. And to your point, it's a criminal activity. 00:11:35.000 --> 00:11:43.000 Now, one of the things I think is interesting in your book is that you touch on the psychology of how these scams happen. But I'm 00:11:43.000 --> 00:11:50.000 kind of curious, because you brought up something else: it's very, very under-reported. What do you think is the psychology about why it doesn't get 00:11:50.000 --> 00:11:59.000 reported? For example, in the past, as an Asian living here, a lot of times Asians have been targeted in certain communities because they tend to 00:11:59.000 --> 00:12:05.000 not report things to the police. So what do you think is behind the reason a lot of these crimes don't get reported? 00:12:05.000 --> 00:12:14.000 It all comes down to shame. I'll give you an analogy. If your house gets broken into and 00:12:14.000 --> 00:12:21.000 something's been stolen from your house, and the cops show up, and maybe your neighbors come out and 00:12:21.000 --> 00:12:26.000 they say, "Oh my god, I'm so sorry that happened to you. How can we help?" 00:12:26.000 --> 00:12:36.000 If you've been scammed, often what happens, unfortunately, is somebody says, "How the hell, Stuart, could you have fallen for that?" And 00:12:36.000 --> 00:12:45.000 so there's this failure to give credit and blame to the 00:12:45.000 --> 00:12:54.000 actual perpetrators of the crime. And we look at this particular type of crime as something that we did wrong. We 00:12:54.000 --> 00:13:03.000 got conned. Man, I fell for that. We got duped. Instead of: they stole. 00:13:03.000 --> 00:13:15.000 And so that shame that surrounds these incidents keeps people from talking about them. I mean, there's crazy data. 00:13:15.000 --> 00:13:22.000 Something like half of people that have ever been scammed don't actually tell another living soul about it. 00:13:22.000 --> 00:13:30.000 Wow. That's sad and horrifying. I always thought that one of the failures of social media is — we all grew up, maybe not you, 00:13:30.000 --> 00:13:32.857 because I think you're younger than me — 00:13:32.857 --> 00:13:35.000 I've got some gray there, man. 00:13:35.000 --> 00:13:41.000 But we all know the Constitution because of Schoolhouse Rock, and we can all sing the Constitution. And I always felt like 00:13:41.000 --> 00:13:49.000 15% of social media has to be public service announcements, and it's not. And I think this would be a wonderful thing, if every 00:13:49.000 --> 00:13:56.000 fifth thing that I saw on TikTok was, this is the scam that's going around. It normalizes it and it 00:13:56.000 --> 00:14:03.000 creates an awareness. I think that would be pretty critical. And so I'm a big believer that as this AI 00:14:03.000 --> 00:14:10.000 boom is hitting, something bad is going to happen, and it's going to probably happen pretty soon. So, you're in an interesting 00:14:10.000 --> 00:14:19.000 position where I think you have a front row seat. What do you think are the big things that could happen that could be somewhat catastrophic out there? 00:14:19.000 --> 00:14:27.000 So, I'm not sure when this is coming out, but all the rage in the cybersecurity community right now is this bit of 00:14:27.000 --> 00:14:36.000 a "me too" game going on across the foundation AI model companies saying, "Ooh, our AI model just went rogue 00:14:36.000 --> 00:14:45.000 and attacked another company." And first it started with OpenAI saying it, then Anthropic the next week came out, "Oh, so did ours." And this week Meta came out and said, "Oh, ours did 00:14:45.000 --> 00:14:54.000 too." So there's this concern around enterprise security and autonomous models that have 00:14:54.000 --> 00:15:03.000 these incredible capabilities in coding assistance. But if you're really good at coding, you know what else you're really good at? Identifying vulnerabilities in 00:15:03.000 --> 00:15:12.000 code. And so it's not a huge surprise that these models are incredibly efficient and effective at 00:15:12.000 --> 00:15:20.000 identifying and exploiting vulnerabilities in code. And so I think we're worried about how these 00:15:20.000 --> 00:15:30.000 models can autonomously seek out and create disruption across anything that runs on code. And I 00:15:30.000 --> 00:15:37.000 think that's — by the way, that's most of our society, certainly all of our payment rails. Every company has software now, our data, everything 00:15:37.000 --> 00:15:45.000 like that. And so I think that is a huge concern, that we'll have these autonomous cyber models that 00:15:45.000 --> 00:15:52.000 don't even necessarily need to be in the hands of bad guys to do bad things. What I'm actually more concerned about 00:15:52.000 --> 00:16:01.000 is the consumer fraud version of that. Because enterprises, government agencies, which 00:16:01.000 --> 00:16:09.000 I've worked with for decades now, are used to playing this cat-and-mouse game with cyber attackers, right? You 00:16:09.000 --> 00:16:17.000 know, they tool up, they create something, they exploit some vector, and then the enterprise responds to it, and you have this cat-and-mouse game, and there's 00:16:17.000 --> 00:16:25.000 budgets, and there's tooling, and there's talent associated with that. And when I started my career, 00:16:25.000 --> 00:16:30.000 companies like McAfee and Norton — these are great companies, but they were the icons of the early internet. 00:16:30.000 --> 00:16:39.000 They were everywhere. They were like my AAA card that gave me confidence that I could go out on the information superhighway and explore, regardless of how good their products 00:16:39.000 --> 00:16:46.000 were. They were there. I think what happened over the last 20 years is, as enterprise and government 00:16:46.000 --> 00:16:54.000 started to digitally transform, the market for enterprise security took off — the Palo Alto Networks and the CrowdStrikes — 00:16:54.000 --> 00:17:02.000 and so a lot of the investment and innovation and talent flowed to those problems, and it wasn't sexy to work in 00:17:02.000 --> 00:17:11.000 consumer cybersecurity for most of my career, because that was like eat your cyber vegetables: have strong passwords, turn on multi-factor 00:17:11.000 --> 00:17:19.000 authentication, like that stops everything. But what we're seeing now, and what's reflected in what you all experienced and what my mom 00:17:19.000 --> 00:17:25.000 experienced and what tens of millions of people are experiencing, is there's a sophistication coming at consumers that is being 00:17:25.000 --> 00:17:32.000 powered by AI that I think is going to facilitate the greatest transfer of wealth from this country to potentially 00:17:32.000 --> 00:17:39.000 nefarious criminal organizations aligned with our national security enemies. And 00:17:39.000 --> 00:17:45.000 that, I think, is what needs to be elevated in this conversation, 00:17:45.000 --> 00:17:53.000 because that impacts everyday people and it impacts our perceptions of AI. Like, we in Silicon Valley 00:17:53.000 --> 00:18:01.000 and Silicon Valley adjacent, we look at AI and we're obsessed with it and we are excited about it and we see the 00:18:01.000 --> 00:18:08.000 potential and the opportunity. But if you go to where I'm from, in Kansas City, most people's experience with AI is in 00:18:08.000 --> 00:18:18.000 the form of their phones blowing up with more scams now. And so if we want to get the country behind 00:18:18.000 --> 00:18:27.000 this technology wave that we all believe is transformative and important, we've got to do a way better job of managing the 00:18:27.000 --> 00:18:35.000 downside, or the dark side, and addressing it in real time rather than sitting in these ivory towers and 00:18:35.000 --> 00:18:37.667 prophesying about what it might be in the future. 00:18:37.667 --> 00:18:43.000 So this might be in your book, and it probably is. But we had to do a little 00:18:43.000 --> 00:18:51.000 decompression after our incident and go over what's good and what's bad, right? So we came up with our little 00:18:51.000 --> 00:19:00.000 company ISO prep and family ISO prep stuff, so we could have these passwords and how you do things and call-backs. 00:19:00.000 --> 00:19:06.000 What should the regular consumer do? What can they do? I'm sure this is in your book, right? 00:19:06.000 --> 00:19:13.000 It is. We talk about — but I would just say, I think you nailed it. One of the first things we do is 00:19:13.000 --> 00:19:20.000 say, create a family password, just to get you talking about it, and then talk about scenarios 00:19:20.000 --> 00:19:28.000 where you might use it. We talk about these new rituals that we need in the family, which maybe 00:19:28.000 --> 00:19:35.000 it's me leading by example and telling my kids and my wife, look, I'm never going to give money to a random stranger 00:19:35.000 --> 00:19:43.000 online. And I think that should be a family rule. If we haven't met them in person, we don't send money unless we talk about it. So a lot of this — and 00:19:43.000 --> 00:19:51.000 Ryo, you brought this up — a lot of this is talking about these things in the open, making these kitchen table and living room issues 00:19:51.000 --> 00:19:58.000 so that we feel comfortable that when something doesn't look right, we're willing to get a second opinion, 00:19:58.000 --> 00:20:07.000 instead of retracting or feeling shameful that we don't know. So start by talking about it. I think 00:20:07.000 --> 00:20:15.000 the second thing is there's a little more responsibility — and you hinted at this, Ryo, with TikTok. We need to demand a little bit more 00:20:15.000 --> 00:20:23.000 responsibility from these platform players in terms of how they show up in our society. If you look at 00:20:23.000 --> 00:20:30.000 Meta — and again, I'm just sharing facts — there was an incredible story that Reuters 00:20:30.000 --> 00:20:37.000 broke last year around the amount of fraud that is trafficked through Meta's platform. 00:20:37.000 --> 00:20:46.000 Oh, even just on the marketplace. I mean, without a doubt, that's — no, I'm just going to back up real quick, just so that everybody's clear, because you both talked about family passwords, but what you really 00:20:46.000 --> 00:20:53.000 mean is a safe word. And so I want to make sure no one walks away and says we should all have the same password as a family. What you're saying is, if 00:20:53.000 --> 00:21:02.000 I'm talking to some family member, I want to say something like, if I don't say "kangaroo" or something, then it's not me. 00:21:02.000 --> 00:21:10.000 Yes. Yeah. And we say pick something that means something to you all as a family. It could be a color, it could be a 00:21:10.000 --> 00:21:19.000 phrase, it could be a place you used to live. And encourage people to use it. I tell my mom, if she asks me for the 00:21:19.000 --> 00:21:28.000 family password, or she hangs up on me because she's not sure it's me, we should celebrate that moment. We shouldn't be mad about that, which is kind of hard to do. But 00:21:28.000 --> 00:21:34.000 as important — the safe word is a mechanism to begin 00:21:34.000 --> 00:21:42.000 the conversation. It's as important as picking the right safe word, or whatever it is, is getting everybody together, because now you're talking 00:21:42.000 --> 00:21:46.000 about why. And that's just as important as anything else. 00:21:46.000 --> 00:21:54.438 No, no. I think that's such an important thing, because like you said, we have to normalize some of this stuff, but the most important thing is normalizing the conversation. 00:21:54.438 --> 00:21:55.000 Yes. Yes. 00:21:55.000 --> 00:22:02.000 And I think all crime is this way. It appeals to psychology. And so you have to overcome that psychology. And one 00:22:02.000 --> 00:22:09.636 of the most powerful emotions is embarrassment, because it is the thing that's likely to let people get away with stuff. 00:22:09.636 --> 00:22:10.000 It's 00:22:10.000 --> 00:22:17.000 exactly it. And it isolates people, which is a scammer's dream, because then they're not communicating. And in fact, there's insane data about people who've 00:22:17.000 --> 00:22:24.000 been scammed once who then get scammed again, because they are more likely to be isolated. But I will just do a 00:22:24.000 --> 00:22:32.000 soft plug here. One of the reasons why we started Savi is because we saw this huge gap in the tool landscape 00:22:32.000 --> 00:22:41.000 that was available to everyday consumers. So we created a free scam checker that requires no email signup. It's available at scamwise.com. 00:22:41.000 --> 00:22:50.000 You could forward suspicious emails to it. You can ask it a question. You could send a screenshot of a text. You could take a picture of physical mail. We get a lot of somebody who gets a 00:22:50.000 --> 00:22:59.000 Medicare bill who's like, wait a minute, I don't know if this is real or not. And it will give you a quick second opinion and recommend ways that you could verify it. So we're 00:22:59.000 --> 00:23:06.000 creating some products and trying to use AI to help make it easier to talk 00:23:06.000 --> 00:23:14.000 about these issues, to get second opinions, and ultimately, where we're going with Savi and with our mobile apps, to block these things 00:23:14.000 --> 00:23:16.130 before they actually even get to you. 00:23:16.130 --> 00:23:21.000 I have an interesting question for you, because I was thinking about who's going to cover 00:23:21.000 --> 00:23:30.000 the cost of these expenses, because something's going to happen. Do you think it'll almost get to the point where it's a national disaster, where we have a 00:23:30.000 --> 00:23:37.000 hurricane or something hits and a disaster relief fund comes in, but it could be at that scale? I mean, you're talking about something 00:23:37.000 --> 00:23:44.000 that could be pretty broad-based, and it's not like it's going to be the credit card companies, which are really insurance companies. It's going to be 00:23:44.000 --> 00:23:48.000 something broader than that. So what do you think is going to be the remedy? 00:23:48.000 --> 00:23:52.000 Because clearly something bad could happen. 00:23:52.000 --> 00:24:00.000 I think there's two options. I think the national disaster analogy is unfortunately a likely one, and often 00:24:00.000 --> 00:24:07.000 in any country, and in this country, it takes something of that scale to mobilize public opinion and 00:24:07.000 --> 00:24:15.000 legislative action around doing the right things. So I could see autonomous or rogue models 00:24:15.000 --> 00:24:22.000 that create a massive fraud event across banks or wallets 00:24:22.000 --> 00:24:31.000 and drain them, creating this huge issue of economic 00:24:31.000 --> 00:24:41.000 loss that the government has to step in on, almost in a too-big-to-fail way, but at a very huge consumer distribution level. 00:24:41.000 --> 00:24:46.000 But I could also see a slower burn. And I think this is what concerns me a little bit, and part of the point in 00:24:46.000 --> 00:24:54.000 the book is, for a couple generations now, we kind of let 00:24:54.000 --> 00:25:01.000 social media run with our kids, and here we are 00:25:01.000 --> 00:25:05.000 now, and there's a series of lawsuits and action happening, 00:25:05.000 --> 00:25:13.000 starting to come to terms with that, and there's all this news about the Meta lawsuits on social media with kids and 00:25:13.000 --> 00:25:21.000 all that. My hope is that we don't burn a couple generations of 00:25:21.000 --> 00:25:29.000 loss and pain when there are real things that we can actually start fixing incrementally now, without hamstringing 00:25:29.000 --> 00:25:36.000 innovation. But we just need to focus on them and talk about them. And so that's what I think we're 00:25:36.000 --> 00:25:43.000 on the path for right now: more of the social media outcome, where we spent 20 years growing gangbusters and there's this seedy 00:25:43.000 --> 00:25:52.000 underbelly of byproduct and dark side that is creating real havoc, but we don't address it until 00:25:52.000 --> 00:25:56.000 far later down the road, and until far too many people have already been impacted. 00:25:56.000 --> 00:26:04.000 Do you think regulation is going to have to happen? For example, you talk about how many of the attacks come from foreign 00:26:04.000 --> 00:26:12.000 agencies, foreign countries. Do you think a situation might arise where the United States effectively has the equivalent of the Great Firewall of China, where 00:26:12.000 --> 00:26:21.000 it's like, okay, we're just not going to allow a lot of things to come in? Because one of the things that obviously allowed the internet to become so great is that it 00:26:21.000 --> 00:26:27.000 was sort of untethered, but it sounds like untethered may be exactly the wrong recipe in this case. 00:26:27.000 --> 00:26:34.000 Yeah. You know, the R word is a difficult one sometimes. I find it hard to 00:26:34.000 --> 00:26:43.000 believe that if this is a technology as transformative as we all believe it is, then why wouldn't it require at 00:26:43.000 --> 00:26:51.000 least incremental regulatory changes? And so my position is yes, but it doesn't necessarily mean that there 00:26:51.000 --> 00:26:59.000 aren't nuanced ways to do that, or incremental ways that we can start doing that. And you're right about the international nature, and this is what concerns me a little bit. Like, 00:26:59.000 --> 00:27:06.000 right now there are 1,500 bills moving through state legislatures to try to stop scams and fraud. The state 00:27:06.000 --> 00:27:15.000 has no jurisdiction over how these things are executed. If you know anything about the global telecommunications infrastructure or VoIP providers and how these things 00:27:15.000 --> 00:27:23.000 work, a state law doesn't matter. And in fact, it only creates a patchwork of regulation, and then makes it easier for scammers to 00:27:23.000 --> 00:27:30.000 maneuver through them, because they're very good at that. So I do think we need national and international 00:27:30.000 --> 00:27:40.000 cooperation on what is an international problem. But it could start with things like KYC, know your 00:27:40.000 --> 00:27:48.000 customer, a little bit. It's harder for a consumer in this country to buy Sudafed — the real Sudafed, the good 00:27:48.000 --> 00:27:56.000 stuff — than it is to have unlimited API access to a model that 00:27:56.000 --> 00:28:04.000 its own creators claim is capable of creating anything from bioweapons to 00:28:04.000 --> 00:28:11.000 all these terrifying things. So we can do better. We can start small. We 00:28:11.000 --> 00:28:17.000 can collaborate internationally. And I think we just have to agree that this is a problem that matters first. 00:28:17.000 --> 00:28:28.000 Yeah. I personally think the regulation or the laws, it's not going to work, because that's a global thing, right? 00:28:28.000 --> 00:28:39.000 And you're basically handing the keys off to your competitors when you lock down your stuff. What I do like about what you're talking about is that it's education. 00:28:39.000 --> 00:28:46.765 Everybody — the more you can talk about it, the more you can get the information out there, the more you can open up people's eyes to it, to me, is the solution. 00:28:46.765 --> 00:28:47.000 Yeah. 00:28:47.000 --> 00:28:55.000 Right. Because I don't want to regulate my industry or somebody else's industry and stifle it till we lose, right? 00:28:55.000 --> 00:28:58.000 No. And that's competition. 00:28:58.000 --> 00:29:05.000 So I agree with that, but — this will be fun, we can disagree a little bit, maybe that will help with viewer engagement, to be 00:29:05.000 --> 00:29:13.000 controversial and polarizing. So I will agree with you in one breath and say, yes, education. If you think 00:29:13.000 --> 00:29:20.000 about why that Nigerian prince scam really died, it's because it became a joke, a meme. It was like all 00:29:20.000 --> 00:29:29.000 the late night comedians were using it, and everybody just got it, and that's why it stopped working. Yeah, Microsoft did some things on their email exchange that 00:29:29.000 --> 00:29:37.000 helped, but the reality is everybody learned about it. I think the concern now is that this is evolving very quickly. 00:29:37.000 --> 00:29:45.000 So education will be part of the solution, but it can't be the whole solution. I think there are other ways to approach regulation. So if we took an 00:29:45.000 --> 00:29:52.000 innovation mindset: okay, well, the regulation could be, hey, social media, open your platforms up to allow 00:29:52.000 --> 00:30:00.000 consumers to police the content better that their kids see. Or device makers, 00:30:00.000 --> 00:30:06.000 make it easier for third party companies to filter out bad things. This 00:30:06.000 --> 00:30:15.000 technology exists, but it struggles to innovate within the walled gardens, where the scammers currently have free 00:30:15.000 --> 00:30:23.000 rein but security companies or others who may want to try to intercept it don't. And so regulation doesn't have to 00:30:23.000 --> 00:30:29.000 be stop our AI, let other people's AI flourish. It could be a little bit 00:30:29.000 --> 00:30:36.000 more nuanced, so that we find the right protective balance, so that at least we can play this cat-and-mouse game, which 00:30:36.000 --> 00:30:42.000 right now I think we're the mouse, and I think we're getting our butts handed to us. 00:30:42.000 --> 00:30:50.000 Well, I think you're right. That would actually be probably a very workable solution. I just worry about companies. 00:30:50.000 --> 00:30:56.000 I don't want to say Facebook, but they're making so much money off the scammers too. 00:30:56.000 --> 00:31:03.000 That's exactly right. And so you can't ask them. I have some of these conversations and people get angry. They're like, well, 00:31:03.000 --> 00:31:13.000 Meta is making too much money off this fraud. And I'm like, well, give them a business reason not to. At the 00:31:13.000 --> 00:31:21.000 end of the day, we've all been in business, they have a responsibility to their shareholders, and there is no moral responsibility to the shareholders. As 00:31:21.000 --> 00:31:29.000 much as we all believe we would act differently and do these things, we have to create some business reasons that'll either allow innovative 00:31:29.000 --> 00:31:36.000 solutions to help deliver protection, or make it more painful for them when they deliver crime. [laughter] 00:31:36.000 --> 00:31:37.500 Those are the only two options. 00:31:37.500 --> 00:31:44.000 Well, like I said, it's very interesting, because we have a whole discussion just about civil liberties and who you are and do you really have 00:31:44.000 --> 00:31:52.000 to authenticate yourself. But at the same time, it may be fundamentally important to be able to do that, at a minimum, so that if someone calls you 00:31:52.000 --> 00:31:59.000 in your family, you know it's them. All right. So, one of the things we love to close with is 00:31:59.000 --> 00:32:07.000 your hot take. So what's the non-conventional thing that you think might be happening in this whole space that isn't conventional wisdom, that 00:32:07.000 --> 00:32:14.000 people aren't thinking? How do you think the world might shake up in a different way than people are thinking right now? 00:32:14.000 --> 00:32:19.000 I'll give you two answers to that. If you can't tell from some of my comments, I'm not really buying this 00:32:19.000 --> 00:32:31.000 rogue AI model narrative that's coming out of the foundation labs today. I think it's an incredible — 00:32:31.000 --> 00:32:37.000 I call it rogue stunting, where you frame the power of your 00:32:37.000 --> 00:32:44.000 AI model to free itself from containment as a benchmark, that 00:32:44.000 --> 00:32:47.000 like any other sort of F1 score, it should be part of the F1 00:32:47.000 --> 00:32:53.000 score: did it get out? If you've ever been in a cybersecurity incident, 00:32:53.000 --> 00:33:00.000 one of the last things you do is call up a reporter from The Information or 00:33:00.000 --> 00:33:06.000 any media outlet and say, hey, I've got a story for you, our model got out, we had a huge cyber attack. 00:33:06.000 --> 00:33:09.000 It doesn't really work like that. And so 00:33:09.000 --> 00:33:14.000 I look at a lot of this as incredible marketing. 00:33:14.000 --> 00:33:21.000 And it doesn't necessarily mean that it's nefarious, it doesn't mean that these models aren't powerful, but I think there's a little bit of 00:33:21.000 --> 00:33:26.000 playing into a narrative that is dangerous. 00:33:26.000 --> 00:33:30.000 I think playing into the narrative is dangerous because, again, it focuses the conversation 00:33:30.000 --> 00:33:34.000 on a bad thing that for them is really a good thing, 00:33:34.000 --> 00:33:39.000 but it kind of prevents the conversation about the actual bad things 00:33:39.000 --> 00:33:42.000 from being elevated and talked about. 00:33:42.000 --> 00:33:46.000 So that's my hot take. I would say 00:33:46.000 --> 00:33:50.000 my future hot take is the world you all live in. 00:33:50.000 --> 00:33:55.000 If you think about what's happening with robotics, what's happening on 00:33:55.000 --> 00:34:06.000 shop floors of large manufacturers, if you look at the entire IoT space and where 00:34:06.000 --> 00:34:11.000 that is going with the advancement in these technologies — 00:34:11.000 --> 00:34:17.000 every big advancement of technology comes with risk. It happened with the internet, 00:34:17.000 --> 00:34:20.000 new kinds of risk, like virtualization, the move to cloud. It 00:34:20.000 --> 00:34:25.000 created all these new surface areas that need to be protected. Mobile, social media. 00:34:25.000 --> 00:34:31.000 We just talked about these big things. I think we have just barely seen 00:34:31.000 --> 00:34:37.000 what's going to be happening with AI plus robotics in our lives, 00:34:37.000 --> 00:34:41.000 and what that does to the attack surface area 00:34:41.000 --> 00:34:44.000 of enterprises, governments, and everyday people. And I'm 00:34:44.000 --> 00:34:48.000 excited about that, not in a freaky way, but in a — 00:34:48.000 --> 00:34:53.000 I think there's going to be a whole new wave of transformation and innovation that's required, 00:34:53.000 --> 00:34:56.000 and I think that the world that you all work in is super important. 00:34:56.000 --> 00:35:00.000 Well, no, I think both of those things make 00:35:00.000 --> 00:35:03.000 a tremendous amount of sense. And I think the 00:35:03.000 --> 00:35:07.000 difficult reality is that every time there's an evolution, 00:35:07.000 --> 00:35:10.000 or really a reinvention like is happening today, 00:35:10.000 --> 00:35:12.000 there are casualties. 00:35:12.000 --> 00:35:16.000 Like you talked about in the early days of the internet, lots of casualties, there was a lot of identity 00:35:16.000 --> 00:35:20.000 theft. I had identity theft multiple times. And we're facing a situation where we're definitely 00:35:20.000 --> 00:35:22.000 going to run into that. 00:35:22.000 --> 00:35:26.000 Well, I think this is fascinating. I think we could probably have this conversation 00:35:26.000 --> 00:35:30.000 a lot, and we probably are going to have to have it a lot — although we'll have to create a safe 00:35:30.000 --> 00:35:34.000 word, because I'm still not sure that I'm not actually talking to a digital 00:35:34.000 --> 00:35:37.000 twin right now. But we'll have to figure that out. And 00:35:37.000 --> 00:35:40.000 thank you so much for being on the episode. I'm pretty sure we're going to bug you to come on 00:35:40.000 --> 00:35:43.000 again, because next time some sort of 00:35:43.000 --> 00:35:44.000 hot button comes on. So 00:35:44.000 --> 00:35:46.000 thanks a lot for being on the show. 00:35:46.000 --> 00:35:50.000 Thank you so much for having me.