Shame, Spinach, and the Human Side of Cybercrime - Simplifying Cyber with Becky Holmes

Thanks for tuning in to Simply Solving Cyber. I'm Aaron Pritz.

And I'm Cody Rivers.

And today we're excited to be here with Becky Holmes, a British author who found, you know, her start in romance scams during the pandemic and lockdown. And I'm not going to say anything more about that because I don't want to steal her thunder and the story and we'll want to start that. But that led to her first book, Uh, Keanu Reeves Is Not in Love with You, and we'll talk about her upcoming book as well. And I even hear there might be a third one on the horizon. So, Becky, great, great to have you on the show. Thanks for, uh, joining us this morning or afternoon.

Thank you for inviting me.

Awesome. Well, let's get right into it. Um, should I address you as Death to Spinach or Becky? Uh, let's, let's, let's use that to unpack your start into this topic.

Let's go with Becky, any mention of spinach is vetoed.

We'll just wait for it. There might be a surprise later in the show, but I'm not going to haunt your dreams yet.

Please don't. Enough things haunt my dreams as it is.

Awesome. Well, tell our listeners how your story and this topic began and how did it all begin for you?

So this all started for me in the most random way. So I didn't go out to start looking at fraud. I didn't really have any particular interest in fraud. The only thing I knew about romance fraud was what I used to see on the TV and in the paper, which was usually, 'Oh, look at this woman, look what's happened, isn't she silly?' But during lockdown, I was obviously horribly bored and joined Twitter, which wasn't the cesspool pit that it is now. I have to say, it was actually okay back then in 2020. Um, and within a few days of joining, my inbox was flooded with these really young, handsome men, um, who all looked quite similar. They were all in sort of army uniforms or pilots' uniforms or something, and they were all, within about a day, desperately in love with me.

I was kind of their ideal woman.

Um, now you see, you laugh, That's rude.

We're inadvertently victim shaming, and I think we go into that topic. Um, so Cody, stifle it.

Mine's just, I love like the, the, the so quickly you said the pile of the uniform, you had the, they had the persona down right away.

Oh yeah, and it was, you know, one thing I always say is if one Young, young handsome soldier had messaged me, I could well have started talking back and this would be a very, very different show. But the fact that there were so many was like an immediate red flag because I am exactly the sort of person that would become involved in a romance fraud because I talk to anybody and I have this kind of inbuilt need to help people. So I would be exactly the the sort of person that would send money.

Now let's clarify, Becky, that was back then before all the, all the scammers pounce on you from this show. You are now a refined machine of anti-romance scam shrapnel, correct?

Um, let's say yes. Do you know what though? I'm going to say yes because I've got a partner. I still think if I was single, like nobody is immune to this.

That's fair.

Um, and also, as soon as you start thinking, oh, that could never get me, no, I don't know, like your guard goes down a little bit. And you know, they're very clever. So never say never. I, I need to stay with my partner forever just so, so you don't get scammed.

If they're listening, no pressure, no pressure.

Um, so anyway, I, I had all of these messages and To start with, I was just blocking them, deleting them, and then as boredom set in more and more, and I was staying with my mum at the time in my sort of childhood bedroom, and I just thought, right, that's it, I need a hobby. So I started messaging back, and it became obvious really quickly that they were pretty much sticking to a script. So I thought, hmm, I wonder what I can get away with, and started saying the most ridiculous things, just to see what they would do. And as it turns out, nothing, because they just keep asking you for money. And it was really making me laugh. So I put these things up on Twitter. And lots and lots of people got involved. And, you know, we were all kind of having a lot of fun with it. But to sort of make it more serious, an unintended consequence of this was that victims of romance fraud actually started getting in touch with me and telling me their stories. And it became fascinating to me. Like, you know, these people that I was speaking to, they were intelligent, articulate, you know, good jobs, good social lives. And I thought, wow, this is a really misunderstood crime. So I started looking into it, and when I started looking into it, I then couldn't stop.

Yeah, no, that's fair. And I like your point about it doesn't have to be— I mean, we've all got— I think everyone here has a story of one of our grandparents or parents that fell for something. And usually when I'm talking to a group and I do the show of hands of who here has had a— in their immediate family or friend circle, um, a victim of the scam, and it's usually like 80 to 90%, which is scary. But it's not just the aging, decaying grandmother or grandfather that is losing their mental function or unfortunately dealing with Alzheimer's or something. They're still a top target. But I think what you discovered and what we know within the industry is it could be anybody at any level of any mental capacity.

Absolutely. And, you know, you're— my experience echoes yours. So if I speak to, say, like a taxi driver or I don't know, somebody in a waiting room and you kind of get chatting and I talk about what I do, they're like, 'Oh God.' So either I've had a taxi driver say to me, 'Oh, don't even speak to me about that because I sent somebody a grand.' But people, other people have said, 'Oh no, yeah, my uncle was involved in one of those.' It is astonishing how many people know somebody that's been involved in romance fraud, and yet we still have this real kind of stereotype about the person. You know, it's, it's so interesting.

Becky, I think you make a great point. There's, it's kind of like there's like, there's like a stigma that comes with it. And so there's like an embarrassment or like a shaming and we see it on like the corporate side with romance scams is kind of that social engineering tactic. But if I fell for a phish or something here, there's a lot of times fear of a punishment. So kind of, kind of talk about how like that shame tool for attackers is a hurdle for kind of like cultures and how I kind of want to hear your spin on that because I think we see that a lot of it. So I kind of want to hear your take on, you know, removing that stigma.

Yeah, I wish I could wave a magic wand and that be done right now because I think we'd be a lot further forward than where we are. So in the UK and I happen to know in the US, the victim shaming, the victim blaming when it comes to romance fraud is off the scale. So you still hear 'Well, that was stupid. She or he must be gullible. They must be naive. What's wrong with them? They're clearly mentally ill. As if that person would fancy you.' You know, all this sort of stuff. And because the media go out with this image as well, people, you know, and the headlines, you know, 'Middle-aged woman falls for Keanu Reeves,' you know, whatever it might be. People then don't want to report it. They don't even want to tell their friends and family, let alone go to the police or their bank or whatever. So we never get a full picture of this crime even because of this victim shaming. There's all sorts of things we can do in terms of language to sort of stop that, but ultimately, I don't know, I've been thinking about this for years. And there seems— part of me thinks that we just want to feel superior to other people. And therefore, when you read something about somebody that's done something, the only way you can feel better about yourself is to write something awful on the internet. And that, that is what frustrates me more than anything, because the people that I've interviewed and the people that friends and colleagues of mine have spoken to, they aren't stupid. You know, something was going on in their life at a particular time which meant that they went down a road where they wish they wouldn't have done.

Yeah.

And because of the victim blaming and the victim shaming, they'll, they'll rarely get over it. Um, it frustrates me more than anything. And you know, that is the same across any culture, any country, sexuality, age, whatever it might be, the shame is the same.

Yeah, I've heard— Sorry, Cody. I have a really interesting corporate story on the victim shaming. And it was actually— it's a positive story because it was an executive who had a mindset. And this was when I was on the corporate side. This was the head of HR at a very large company. And in one of the executive cybersecurity program meetings, we were looking at the email phishing statistics and the numbers were higher within, you know, a specific function. He was like, "Who are these people? Should we just get rid of them? Like, what, what, how are they so stupid?" So that was his opening stance. And then a month later or sometime after that, we did an executive, with the CEO's permission, an executive lead team spearfish, which he fell for. And luckily the humility, like he processed that and he realized, and he got up on stage at his next HR town hall and told his story of like, this was my position. I was wondering who these stupid people were. And then I realized they weren't stupid people and I was one of them. And when he did that on stage to his town hall and used humility, not shame, the numbers in the next test of the employees went down drastically, more than any other area. So I think to your point on if we can reverse— if we had a magic wand, if you could switch shame into empathy and give people the support and the safe space to raise their hand and say, well, I think I did something not good, I need help, that would be a better place than where we're at across both families and corporate today.

I would love to hear more stories like that. Of actually somebody getting up, you know, on stage in front of his employees and saying, okay, I made a mistake here, and if it can happen to me, then just let's all watch out. I would love to hear more of that.

Agree, we need them.

Yeah, Becky, and what I was trying to talk about earlier is, so a lot of times when we build these human risk management programs for large companies and awareness, the challenge we have is the focus isn't IT and cyber, it's going to be your non-technical function parts of the company because They live and breathe it, they know it. It's how do I engage marketing, finance, operations, HR? And so I kind of want to think like, as a non-technical person, what do you think the cyber industry gets wrong about how we talk to normal people or non-cyber IT people?

Point one, I would say, is, God, it can be boring. So, you know, if I'll count myself as a normal person. So I read a lot of academic stuff and stuff that comes out from tech people. And, you know, that's part of my job is to read things and turn it into kind of everyday language. And sometimes I have to have a break before I've got to about the third paragraph because I think, what is this? Nobody understands this. You know, the amount of acronyms, initialisms, just all these things that regular people do not understand. And if they don't understand it, they're going to switch off. It's boring. Let's make things more interesting for normal people.

Are we techsplaining and burying the lead, Becky?

Sorry, say again?

Are we techsplaining to people and burying the lead? You see what I did there? I took mansplaining and made it techsplaining. And burying the lead, I learned from our marketing person. Where, you know, you take the main points and you put it way down in the details of the article, and then it's like, don't even know what they're talking about. That's marketing speak. I blame Tom Whitton.

We all do it.

Yeah.

So, yeah, we all talk in our own particular language, and then we expect other people to understand it. You know, I do it all the time when I'm talking to friends about publishing and and stuff, and they say, well, I don't even know what that means. Um, but I think something— I was looking at something earlier today, um, by a British company. I won't say who. And they'd said, well, what do you think to this? And I said, who have you tested this on? And they said, oh, you know, people within the company, and we've got in, um, you know, like a focus group and stuff. And I said, okay, who's in the focus group? 'Oh, you know, sort of people in the same industry.' And I said, 'Just get some normal people in.' You know, you're— there's no point testing stuff on the people who already know how to use it. And I think that is something that really frustrates me in this world. You know, we all go to conferences and pat each other on the back about our latest bit of tech and our latest bit of marketing and stuff. But there's no point doing that if nobody outside the industry knows or cares.

Great point.

I also, I think that's 100% right. I think also what we see sometimes is awareness and training is down the list of priority. There's a big focus on my technical controls and tools to put in place. And I think what we try to bring back is that like these controls fail when a user is emotionally compromised. You know, if it's an MFA and to your point, so now we've got the tools circumvented, they can be compromised because you've emotionally compromised a person. They're too scared or shamed to say they've been compromised and talk about it. So now you've got a kind of a vulnerability. So I think that is a challenge. I kind of like love to hear your point of like, if you're kind of like CISO or cyber and you're in charge of the program, what are you saying or doing to say, hey, this is— how do you push that importance up the ladder when it's— then they say, well, we've got tools for that?

I think, I mean, unfortunately, when you're talking to people at the top, of it's got to be based around the bottom line, hasn't it? Um, you know, and sort of saying, look, you're going to lose money if you stop— if you keep doing what you're doing.

Yeah.

Um, but, but your point about, um, you know, when people are in that state, we, we call it the hot state, and you're right, that's when people are at their weakest. That's what social engineering is all about, you know, getting people in that, in that moment when they're not going to follow the rules and they're not going to kind of do what what they're supposed to do and they're not going to follow systems and all that kind of thing. And I think people at the top, to answer your question, this is— it's going to sound a bit hippie, but I think they need to be put in front of people who use their products and who are on the receiving end, you know, the very kind of lowest people on the rung, if you like, people like me. Who will say, 'Look, I don't understand, and therefore I've taken my business elsewhere,' or, 'I don't understand, and therefore I've stopped paying for your subscription,' whatever it might be. Because fraudsters are getting cleverer, and, you know, they work on this social engineering, they work on putting us into these kind of visceral states of panic. And that's never going to stop. So people need to be looking at the human side of things more than the tech. You know, you can have all the tech in the world, but if it's not reaching people in the right way, if it's not going to help people overcome what is a very visceral reaction, then it is pointless.

Yeah. So one more question, and I think we're going to have some fun in becoming Becky Holmes. From a deepfake standpoint, but—

ebullient-batik.

Um, in your journey with Death to Spinach and the Twitter fame and kind of progressing into writing, uh, when did you transition from your own entertainment and entertaining the audience to understanding, wow, I've seen so many replies back and this is real and I want to become an educator, not just a humorist. And then How did you balance that shift between humor and serious in both your writing as well as your talks?

It started when people started getting into touch with me that had been genuine victims. That's when I started to think, okay, this isn't just about me having a laugh at my, you know, one end of my phone. But I've always been a really big believer in finding humor in everything. Well, as many things as you can. And in terms of finding the balance, for me, it was all around making fun of the scammer, never of the victim.

Right. Yeah.

And I think that was a very important line to tread because romance fraud, fraud of any sort, is not funny, but you can find humour in some of the things that these fraudsters say. And, you know, when I've spoken to victims of fraud, even they themselves have found humour in some of the situations, looking back on it, of course. In the moment, it's not funny. So it has been a journey, and in actual fact, to answer your question around when I wanted to be an educator, that didn't really factor in my thoughts for a long time. When I started writing the first book, the Keanu book, I was writing it as a project because I was interested, and it wasn't until I started going on and on and on that I thought, wow, actually there's a lot of people don't know a lot of things, and it just I guess sort of morphed from there. People were inviting me to speak and, you know, sort of saying, oh, I didn't know that, that's really interesting. And of course that gives you the impetus to then go off and research more.

Yeah.

So I don't think I could ever describe myself as an educator. That's probably too grand a title. Um, maybe someone who just helps people understand some of the nuances, but it's a very gradual process. And every day I'm still educating myself because let's face it, you know, I can't educate myself quicker than they're changing their tactics. It's, you know, it's frightening. So it's been gradual and great.

I do, I do want to hear— you said you got some, some great things. What's like the most, if you can share, what's the most ridiculous, like, opening line that you received? That comes to mind?

That's easy. That was a Keanu Reeves fraudster. Now, with celebrity scams, they often don't start out so blatant because of course you'd be thinking, this is Keanu Reeves, why does he need something from me? But this one decided that he couldn't possibly waste any time. Hi, it's Keanu Reeves. I'm editing a new film at the moment. I need a $200 iTunes 'Voucher.' That was it, straight off.

Was that a video? Was that an audio file? What, what did that come through?

That was just a message into my DMs on Twitter.

Got it.

Yeah, yeah. So I clicked on the profile, which I always do, and he had 3 followers, um, and his account had been made that month, and I think it was only about the 4th of the month as it was, uh, I I was confused by that one because I thought, I don't know how successful you're going to be. I don't know if he was having an off day or whether he was a learner, but it was a rough start for him.

Yeah, man, I think about my days when I was younger and it was the Nigerian prince who was trying to give me his entire fortune. So that was what I resonate with in my early—

Are you still waiting for that, Cody?

The other day on Instagram though, the algorithm got me because I saw there was like a, something like, it was like a heist. They saw like some apartment in Nigeria or something was found with like millions of dollars in it. And the comment was so great because I love comments on the social webs. And it was like, this man tried to unload this money for all these years and no one ever said yes.

Well played. Well played. Well, speaking of playing, it's time to play a game, Becky. So, and I know that you've played along with us. You've not opened a few video files that we sent to you.

I'm desperate to.

I know, like creating so much FOMO before the show. So a little bit of setup and then we'll go right into it and we're going to like gauge your reaction real time. You had asked a couple of things when we first met. One, how is the technology evolving and, you know, with AI and some of the video AI and really quite honestly, some of the AI products that are challenging Hollywood, or at least going to be relevant in Hollywood and other film studios in how they get some of the things done that took them years or months before. So we played with those technologies. We did a little bit of research on you based upon what's publicly available on the internet. Because you're an author, you have lots of back of the book. Here's all about Becky. So you're—

At least it was only what's publicly available.

That's true. Yeah, that's true. Um, and you know, in a couple more conversations, if Cody and I came to, to, to, to the UK and took you out to dinner, we'd get the rest of the story. But we went with what we had available and we created 3 scenarios. Some of them might be fear-based scenarios and some of them may be your most, um, desired dream come true. So with that, uh, Bronwyn from our show has put together, uh, 3, 3 videos. One, they're labeled 1, 2, and 3. So why don't you open video 1 first? This is great.

Mom, please do what they tell you. They are not messing around. Please help me.

Now, now, we, we could have— we actually have your voice. We didn't put the time in. We'll maybe fix this for what we replay it. We can use your actual voice from public recordings and overdub it. But this was 5 seconds of AI prompting in a higher-end paid tool using a single photo of you, the one that you had posted on LinkedIn.

5 seconds.

5 seconds. Yeah, 5 seconds of effort. It took maybe a minute and a half to process, but then it's ready to roll.

Okay.

Video 2. Actually, can you describe for the audio listeners what just happened?

I feel slightly shocked. Um, so, uh, I opened the video and it was me, um, tied to a post.

Um, now, and you didn't get that from my private collection, so that was not there.

That was up there. So, Tyler, that's me tied to a post, um, asking, uh, sending a video to my mum asking for help. And I'm, I'm sitting— there's I still have it now on my screen. It's, it's really weird. That's really weird to see.

Yeah. Yeah. And, and they can get even more sophisticated. They're using multiple photos. This was just done with one photo and the technology that it's unfortunately is very mainstream. So there's a lot of good things and cool things you can do. You know, if you're a Star Wars fan, remember Mark Hamill or Luke Skywalker and the younger version of himself that no longer exists, that's using a variation of this technology. So there's cool things that you can do from an entertainment standpoint. But obviously, like thinking of this in, you know, as a criminal, how could we very quickly with, you know, a single image of someone and if you want to spend a little effort, their actual voice, if you can get a recording of 3 seconds of them online, that's enough to be 85% accurate in the voice accent, intonation, all of that stuff.

That's just—

Unfortunate, exciting, shocking, sad, all of them, all of the emotions.

Yeah, all of the emotions. And it's just weird when you look at videos of yourself or photos of yourself, you've seen them before, haven't you? You recognize the situation, but that's—

Yeah, that's so weird. Fabricated reality is, I think, the new term that they're using for that.

It's what, sorry?

Fabricated reality or synthetic reality are the two phrases. Yeah.

I'll tell you what though, I've noticed, um, no one's going to believe that's me because I always have my nails done.

Nice. Well, now that I know that, if I just change the prompt to say freshly done nails.

Yeah, yeah, that will be it.

That's the only change. Exactly. All right, video 2. Let's see what the next scenario unfolds. It'll get funnier and better from here, I think.

Okay, video 2. Right, I need to download that. Okay.

What has happened, Becky, for our listeners?

Okay, so for the listeners, my Twitter handle is @DeathToSatan. Spinach because I'm horrified by the stuff. So I've just opened a video of me sitting amongst fresh spinach, canned spinach— why anybody would want that, I don't know— and frozen. And the still that I've got it stopped on at the moment is exactly what my face would be like.

Your reaction?

Wow.

AI gauged that. I think I prompted that, you know, you had a hatred of spinach and would be shocked to be in the room. So I think it nailed it. How long did that take to do? Again, less than a minute to think of the idea and a couple of minutes for the AI to create the output.

I need to have a word with AI because I've got some frown lines between my eyebrows.

Can you fix that up? We can. We can. Any improvements we can make. But, you know—

No, it's far too realistic. I was hoping that at least they would have, you know, blurred that out.

Yeah.

Yeah.

All right. On to video 3. And this one's going to be the happiest moment of your life. But I didn't know when I did this one that you now have a partner. So hopefully he's okay with this fantasy.

Right. I'm intrigued. Oh, it's called Becky Marries. Right, let's see. Oh my God.

Who is that, Becky?

That's Greg Davies, the love of my life.

Yeah, that was—

For a minute then, because I am— for anyone listening, there's a British comedian called Greg Davies. Who I find hysterical, and I'm completely obsessed with him. I think he's the most perfect human in the world. No one can understand that, but I really do. And this is me getting married to him on a beach. And just for a minute, when I watched that, all my worries disappeared.

See, we like to start with shock and then end with a happy ending. So we, we, Bronwyn timed those videos and phased them exactly right to start you with the not, not good emotions and then resolve in the ultimate dreams come true.

I'm a little bit worried I'm gonna have to delete that last one because I might— it'll be the sort of thing where I just play it over and over again, start believing that we are married, and then, you know, go into a whole sort of a whole different reality.

So the, the, the uniform men didn't get you, but this Greg Davis little beach marriage It was Greg.

Absolutely. Do you know, um, so celebrity fraudsters, one of their tactics is that they offer you a meet and greet package and you have to pay their management this fee to meet them. And I've often thought to myself, I don't know why anybody hasn't tried the Greg Davies one on me. Why has nobody set up a Greg Davies account and tried to, to say, you know, £1,500 and I'll come and take you for dinner, I'd be all over it.

That's true.

Hopefully anyone that's listening, that's not an invitation to do it.

Exactly.

Exactly.

All right, well, the, the, the last and final example really comes back to your question when we had our first conversation on is real-time deepfake possible, or are we only dealing with videos that are done kind of in the moment? So the challenge and I only used publicly available tools that similar— some criminals did. I used minimal effort and I used a single photo. So if we did more time on this for a more sophisticated live deepfake, we would, you know, find a video of you for 3+ minutes. We'd train a model, we'd spend a little bit more time and effort, we'd get the audio, we would do all that. So it is most compelling possible. But what we're going to show today includes the single photo of you posted on LinkedIn using a Mac application that's very, very available to anyone. And then lastly, a $20 wig from Amazon because my hair, my forehead is very not Becky. And if we got one of the ladies from the office, they'd have an easier chance of becoming you. But this is a tall order to say, take this. 6 foot 5 inch. I don't know how many centimeters that is. I know you're in the metric-imperial system difference, but I got the— I mean, you could broadcast a cinema movie on this forehead. So what I'm working with, I either need a hat, I need a wig, or I need somebody that looks like me to pull it off because the live deepfake is going to focus in this area here. So I know you changed your hairstyle slightly since we first met, but But this is Amazon Becky's hair. And I'm actually going to ping my EA to come in here and help us get this on. Ready?

Oh, costume change. It's like being at a Mariah Carey gig.

Exactly. And I'm not— I don't have the tech team and the wardrobe to do quite the quick change of maybe a Taylor Swift. But we're going to get this on. You might see Christie coming in here. We've got a brush. So we're gonna first get this mounted up and then we're gonna see what we can do. Here comes Christy. Welcome to the show, Christy Hoover. Hello.

Hi.

All right, so we're gonna go with the brush.

I'm always a mess.

We're gonna get this on, fix me up, make me beautiful.

All right, now we're talking.

Oh my goodness, I didn't realize it was gonna be this kind of show.

All right, we got it pulled back.

How do you feel?

I feel beautiful. Thank you, Christy. All right. So now we have Becky. We're going to reduce my forehead a little bit more because that's going to be the impediment. And I'm going to get it back out of my face so you can fully see the face. All right. Now we've got to find— I'm going to go off camera here. Hello, family.

Oh, Becky. Well, hello. Welcome to Reveal Risk.

Oh, other Becky, what have you done to your hair?

Other Becky, what? I don't have the voice changer on, so I'm going to practice me from off the mic there. That was bad, a bad British accent and a bad female accent. But yes, so, you know, this is one photo and a simple AI deepfake model, which is basically taking the stitch of your face and embedding it onto my face. And you can see, you know, some of the things like, you'll see glitches if I put my hand in front of the face.

Oh, yeah, yeah.

Or as I'm turning to the side, you can see the face start to come unstitched there. So those are some of the things that, while it's getting better and better, and I've seen some of the, you know, more sophisticated models, if we were really trying to target, you know, you or someone that knows you, that you can turn a good almost 90 degrees before you get to the point where it's going to distort.

This is freaking me out.

Can you imagine Mrs. Doubtfire in today's technology? What it would do?

Probably cut production time by 1/100th or 1,000%.

Robin Williams with a deepfake would be untouchable.

I just, I honestly can't, I don't know how I feel. I don't know how I feel about this. I'm obviously sort of, oh, stop smiling at me.

And so back to my earlier point, a lot of the things when you look at like training and things, you know, how do I combat against this? Because technical controls don't exist. It's part of it. It's just like you can even do it. It's just that, you know, it won't be perfect. It could be grainy. But how many times are you on Teams calls right now or Google calls and it's like the voice chops out or the video is kind of choppy? So you could easily make excuse or common reason for why it's not perfect. But you've got a very believable example.

Please buy my book.

Send gift cards.

Send your gift cards, $25. I just need them.

Oh, I can't stop looking at it. It's like I knew that you— I knew you were gonna do this, but I didn't expect to sort of feel like I do now, which is just— it's giving me the ick.

Oh man. Well, and I mean, not in this case here, but oftentimes you've got deepfakes that will fake someone for authority or to do, you know, insert financial scam. Another one that was in the news, this is years ago, was last year, was a principal, I think it was in Maryland, got deepfaked saying some pretty bad like political and racial things on YouTube. And as Mark Twain always says, "A lie can circle the globe twice before the truth can lace up its shoes." And so it was out, all the things were said, the deepfake, and so it was— and then later on it was proven to be a deepfake and wasn't really him. But at that point now the damage is done. And so you've got the issue of reputational damage. There was no financial scheme that was executed, but similar ways.

So I know there was a thing when, um, shortly after Russia invaded Ukraine, there was something, uh, a fake of President Zelensky came out and said, "Lay down your arms," and was kind of— was trying to tell the Ukrainian forces to, um, to surrender. I can't stop looking at you, Aaron.

I'm gonna pop back in as Aaron so we can, uh, please do.

Yeah, I didn't like that.

All right, I'm back in, uh, in— I wouldn't say better form, but not the big, big Aaron face trying to be Becky form.

That was so weird. So out of interest then, um, what could you— what can you do about, about hair? So obviously, they're not going to— fraudsters aren't going to always be using a wig, are they?

What can you do? A ball cap for less, less easy with women with longer hair. But if I had it pulled back, then I could maybe just get closer into my mic or in my camera and just kind of crop out the top. So there's a lot of ways. There's another example that we're doing in a healthcare speaking engagement this afternoon where that gentleman has, he's kind of completely bald on top, hair on sides, and I'm just getting close to the camera, getting the forehead up enough, and then it basically fills out the rest of his head pretty close to what it looks like. But you just, you either need to play with your camera or use a prop or, you know, there's a lot of the early deepfakes, you know, were just really cheap wigs. Cody did one of me live on stage and we had the— the men's wigs are really tough for $20, but we got a $20 one and it was like this Scooby-Doo Shaggy, like, brown fro. But it was enough that on, on stage, it's like, you know, it looked good enough to probably fool my grandmother or my mom. Definitely my mom. So it's— you just, you don't need to have perfect. You need to have close enough.

And, uh, presumably the tech is coming whereby you won't need a wig at all.

Correct. Yeah. Currently in post-production, you can do a full character swap and film a video of someone and completely replace them with the AI representation of the person that you're trying to target or replicate if it's a Hollywood-type thing. So that's possible now. We actually did another demonstration of that with one of our directors on our team and swapping it for a guy that I'm co-presenting with this afternoon. But that right now, the speed of the technology, that still takes a couple minutes to process, but that will catch up. Similar to the deepfake thing that we just did 5 years ago, you'd be dealing with a couple, 3 seconds of latency and lag, and it wouldn't be as close to real time as it is. The speed of processing the advancement of the technology and the AI is only getting better. So I expect, and this is the really hard part with like why there's no ubiquitous detection solutions out there that would live in your Teams environments, in your Zoom. There's some offerings. We're tracking them. We're, you know, investing in them where we think they have promise. But the sad reality is the technology of the threat actors is probably outpacing the detection capabilities. We will bet on tools, but we will not relent on giving education and business process changes to put checks and balances in place to prevent the bad things from happening. Because I think we can't fully bet on technology to keep pace here and just make this problem go away. I don't see it happening in the near future.

And what about putting voiceover? So using my voice as part of the reading? In real time. Is that doable?

That's doable now. And actually, the voice deepfake is even simpler than the video deepfake. What we would typically do, and Cody and I have demonstrated this live, actually at an ISACA chapter meeting here in town, but you have a second, you know, have a microphone, you run that through another laptop and have it all pre-programmed to be your voice or whoever you're trying to target. And then it would come out. There's a little bit of lag on that, but it would come out of the speaker similar to the video. So, you know, getting this all woven together, you can do a video and voice all at once. There's going to be lip sync issues of timing. That'll get better over time. But how different is that than a Zoom meeting where you have a bad connection and it's, you know, your voice is not matching the video? So you can just say, hey, my 'Connection is not great. I've been glitching all day.' And then no one's going to think twice about it.

And also, in the case of these, you know, these sort of fearmongering ones to parents, if you're saying that you're abroad, for example, like you're on holiday and someone snatched your phone, then there could well be a delay or, you know, a lag. Yeah.

Well, hopefully, Becky, this has been fun. Probably a little scary. I know we prepped you of what we're doing, but to your point, we didn't show you most of the stuff until this very episode. What parting thoughts do you have both for the lay audience and the cybersecurity community audience on, you know, what you want to leave them with or what we want to focus on getting better as a world together?

Well, that's quite a question. I'm still full of deepfake images of myself at I don't know, to process that away from my screen. Um, I think for me it's still about considering the human beings at the end. Yeah, like I said before, we are so clever. Human beings are so clever, and especially you guys over in cyber and tech and stuff, your brains are enormous. But not every body's is. So, you know, people like me who don't understand that world, you need to be talking to people like me and testing things on people like me and people like my mum. Um, because I'll repeat it again, there is no point having all the tech in the world if people don't know about it, how to use it, they're frightened of it, they don't understand it. Think about who it is that you're trying to help at the end.

The human experience. We all need to get better at that in life and in our corporate worlds. And I think definitely in cyber. Becky, thanks for joining the show. Really appreciate the discussion and look forward to future collaborations.

This is awesome.

It's been quite the journey this last hour. Thank you.

Becky, thank you so much for being a good teammate. We appreciate it. This is awesome.