Content Provenance in the Age of AI

Hey everyone. Welcome back here to Techstrong TV. I was telling my next guest, I don't get a chance to talk to him as much as we used to, and I was kind of upset.

We always have great conversations on good topics. We got another good one for you today, too. But let me introduce you to my friend Mike Nelson.

Mike is the VP and field CTO at DigiCert. And of course, if you don't know DigiCert, they're probably one of the leading providers in the field of digital identity certificates, PKI, stuff like this. Mike, welcome back to Techstrong TV.

It's been too long, my friend. Alan, so good to see you, man. I always love our conversations.

Absolutely. Me too. I look forward to them.

" We're going to jump into what our topic of discussion is. But Mike, I wanted to give-- Maybe people haven't had the chance to meet you on here before. I gave them your title, but there's so much more to Mike Nelson than that title.

Give people a sense, Mike, of who you are and what you do. I'm a friend of Alan, which- That's all you need to know ... a great credential.

But yeah, I've been at DigiCert almost 11 years. I'm the current field CTO, which means I spend a lot of time with our customers, big customers, understanding their needs, the challenges, how we can better meet, help them with the digital identity and digital trust challenges that they have today. I travel the world speaking at different cybersecurity events.

And yeah, the world continues to evolve in this digital, the need for strong digital identity. With AI taking over everything and digital content becoming so important in today's world and the need for trust on that, it's a great place. And DigiCert continues to grow and to innovate and to do the right things, and we're having a lot of fun.

It is. I would imagine on your side of the fence, it's got to be a lot of fun because there's so many cutting-edge things. I recently saw Anthropic made an announcement that they're going to somehow digitally watermark text written with Claude because the EU- Yeah ...

passed this law now that you got to designate AI-generated content. Yep. Which I get why they're doing it, Mike, but you can't take a hammer when you need a scalpel.

And just because I have a discussion with AI and it helps me formulate ideas, or it gives me a draft that I then edit off of, or it edits a draft that I give it, doesn't mean the AI wrote it necessarily. Yeah. If my name's on it and I'm taking responsibility for it, it's mine.

Yeah. And then the whole idea of how they're doing these watermarks, that's something right up DigiCert's alley. Because what's to stop me from cutting and pasting words or taking- Mm-hmm ...

a picture of the words and then doing OCR and writing it anyway. Right? If I want to get around it that way.

It just doesn't seem well thought out. Yeah. It's interesting, and I know that it's not what we're here to talk about, but it's certainly a topic that's so interesting.

And I think that any time good technology shows up, we rush to adopt it. Yeah. We saw that with IoT.

We're seeing that with AI. And the problem is when you adopt it rapidly, the thing that's missing is governance- Yeah ... and trust, and how do you ensure that the ways you're using it can be trusted, can be validated, that it has identity and authenticity?

Because businesses, people are using AI to make critical decisions. And when you're doing that, having chain of trust and knowing where information and decisions are coming from is important. And so I think it's great to see those types of governance approaches coming, and I think we certainly need more in the AI space.

I think we'll see a lot of development in that space in the next year. Mike, one of the first things they taught us in law school is never ask a question you don't know the answer to. And so there is a connection between the Anthropic text and your answer to it and where I want to go next, which is it all revolves around IP.

It all revolves around, call it chain of custody. It revolves around with AI in the picture, when does something become not trusted? When does something become less authentic?

Mm-hmm. How can we believe you wrote it, I wrote it, this film is right, that film is right? It's all part of trust.

Yeah. And really, DigiCert at the end of the day is a trust company, right? Yep.

You're there to give us trust in whatever, in identity, in program. I remember when you and I used to talk about the industry consortiums of being able to share data in a trustful way. This topic reared its head in a courtroom in Utah, down your way recently.

Yeah. In the Charlie Kirk case. Yep.

The man accused of shooting Charlie Kirk, Tyler Robinson's trial, there was supposedly preliminary-- there was video evidence. I'm not going to get into what the evidence was- Yeah ... and what it showed or didn't show, it's gruesome and there's everything else.

But there was video that was offered in the testimony, and then an objection came that that video had been digitally altered. Mm-hmm. Was it by AI?

I don't know. And that's not the important part right now. Yeah.

But the video had been edited. Now, another thing they teach you in law school, fruit of the poisonous tree. If something goes out of the chain of custody and you can't verify that it was handled properly all that time, it's not admissible, right?

Yeah. Or it's suspect to say the least. J.

Simpson trial, the DNA was suspect. Yeah. The blood samples were suspect because of chain of custody.

But that wasn't digital. This is digital. Mm-hmm.

Theoretically, we should have a better handle on digital. What's your take on this? Yeah, you nailed it.

It's like, look, in the court room, we've always had chain of custody for physical objects and things like that. Like what happened to them? Whose hands did they pass through?

Who touched it? What happened to it? But now in this digital age, we need the same kind of transparency with digital footage.

And that's really what the judge in Utah was asking about that. The state, they didn't do anything malicious. They had zoomed in on some images, they had put some red circles, and done some other modifications.

Nothing that tampered with the evidence, and they still had the original content, but the judge saw that the video had been modified. And what I find really interesting is that he raised the question to say: How do I know where this video came from? It looks like it's been modified.

" And that's really the message I think that, as I think about this, editing is not bad. Even taking AI content and making modifications and presenting it. I've used AI a lot to enhance the work that I do.

I think all of us are today. Mm-hmm. But what is important is transparency and chain of custody, chain of trust.

So with a video or with an image, where was the video originated? And then from that point, what modifications have been made? And just having transparency with that.

So you can know, like the state could show, we zoomed here, we put a red circle here, we put a green line here, and that was done by this human, this individual who works for the State Department. That type of transparency and chain of trust allows a judge or a medical doctor or whoever's looking at images or videos or a consumer to say, "Okay, I'm looking at this. " And to establish trust, that is the kind of transparency and chain of providence that we need.

Agreed. And again, tying it into the EU Act that was text. What's the answer here with something like digital footage, video?

Yeah. Is it watermarking? Yeah.

Is it like a Word doc where I could go track changes- Yeah. Good question ... and see that?

How do we do this? Yeah. So we all know that images have metadata, right?

Mm-hmm. And metadata can be used to tell you time of capture, location of capture. But the problem is, I just went out on a fishing trip in Arkansas, and I was trying to get the best shot of the fish that I caught.

And I was editing images, and I could've enhanced that to a point where it was interesting because with every change that I made, I kept looking at the metadata to see if it would change. And it still showed the origination. It said it was taken at this point, on this date, at this location.

So it still showed that it was original content because I was cropping and zooming and doing stuff like that. So metadata isn't the answer because you can work around it way too easily. There's a new standard that's emerging called C2PA.

It stands for the Coalition of Content, Provenance and Authenticity. I think I got that right, C2PA. For consumers, it's known as content credentials.

That's how the market is going to recognize it. But C2PA is the standard. And what C2PA does is there's really three components.

When a video or image is captured, it digitally signs it. So there's technology on cameras, and most like Sony and Nikon and all the big manufacturers are incorporating this technology so that when images and videos are captured, they're digitally signed So you know when it's done and it's cryptographically validated that the origination happened at that point on this camera. The second thing it does is chain of custody.

So then it shows what changes have been made. And this is where Adobe has a photo editor. Adobe's adopting C2PA into all of their editing technology, so when any edits are made, they're then signed again.

So then you have a chain of custody. You know where it was originated, you know when it was modified, you can see who it was modified by, what changes were made. " And that really is a full-stack solution that allows you to have integrity with digital content.

And so I really think that C2PA is going to be the standard that brings that level of accountability, transparency, and integrity with digital media. I agree. It has the potential to do it.

I want to make clear though, Mike, this isn't just for lawsuits, though. No. Right?

I think most people agree we have a social media problem in the world today, especially in this country. And in the age of AI and deep fakes and all this stuff, we desperately need authenticity in our social media because there are just flat-out fakes right from the get-go. Totally.

They make a fake from the- Yep ... but more often than not, there's actually somewhere in there a kernel of an actual thing that then was dressed up from there. And having the ability to say, "Hey, this has been modified.

" I think in a world where everyone points fingers and yells, "Fake news," it wouldn't be a bad thing to be able to really show what's not fake. Yeah. And what's real.

Totally. And to be able to do it quickly. Yes.

And that's where C2PA, I believe they have, I don't believe, I know that they have, there's a watermark that comes along with it. So you can click on that watermark, and then you can go into the details if you want to verify what changes. It allows consumers to do that.

And that level of transparency is what's needed. In fact, it's funny, this week I was on LinkedIn, and I saw a couple images that had the C2PA mark on it. Did you?

I clicked on it. Yeah. So it's starting to show up in mainstream.

I'm going to start looking at it. Yeah. Mike, what's the consortium or group behind C2PA like?

You mentioned the name of what it stands for, but obviously I'm thinking DigiCert is involved. Who else? DigiCert's involved.

Yeah. There's a large group, a large contingent that has participated in developing the standard. Broad coalition.

Yeah. It's a broad coalition. It's one of those consortiums that you and I have talked about in the past where they saw and recognized the problem.

They came together. They said, "Let's build this," and they made it. It's known as C2PA, the Coalition for Content Provenance.

So that is the group, and all of the major camera manufacturers, editing technology are participating, trust companies like DigiCert. And the standard is really good because authenticity is captured and cryptographic evidence is captured at the time of capture, which is so important. Because oftentimes, if you're trying to build trust once an image has been out in the wild, or video or even a document, it's hard to establish trust once it's out in the wild because you don't know.

You have to capture it at the point of capture. You have to have integrity from the point of capture and that log of what's happened to it since then. And so I believe in a short period of time, this standard will become mainstream.

Consumers will begin looking for that stamp and be able to say, "All right, I know that this is not AI," or, "I know that it is AI, I know that it's been modified with AI," and have that kind of transparency of information so that we can better assess what we can trust and what we can't. Excellent. Mike, we only have a minute or two left, but I wanted to save a little time here to talk about September 17th.

DigiCert's holding its annual Quantum World Readiness Day. And for those who aren't familiar with what that is, how would you describe it? Yeah, look, the need to begin preparing for quantum cryptography and migrating to be ready for that is very important today.

Timelines are shrinking. We've seen what Microsoft and Google have done to move their timelines up because they believe the technology is coming more quickly. This day is all about education, awareness, talking about what's happening in the standards development bodies, talking about what's happening in the development of quantum computers, talking about challenges of migrating to quantum cryptography, and things organizations can be doing to get ahead of that migration challenge.

It's a great day of thought leadership. We bring some of the world's best, most knowledgeable experts on the topic, and we have some great discussions. So we'd invite any of your audience to come join us, and I know you guys are participating in it with us.

Yes, we are, and of course, some follow-ups from Quantum World Readiness Day as well we'll be announcing shortly. But for now, anyone who's interested, and everyone should be interested because this is going to affect you, you can get more information, registration, agenda, so forth. com.

And I believe you can get to the information page for the- Yep ... event on the 17th. Yep.

All right. Hey, Mike, I appreciate you hanging in here. I know we went a little over time, but as usual, I learned something.

The new consortium, we brought it home to real-world topics that are affecting and happening right now in our neighborhoods. So thank you for coming on as always. Don't be a stranger.

Come back soon. All right, my friend. Thanks for having me.

Always fun to chat with you. Absolutely. Mike Nelson, VP Field CTO at DigiCert, here on Techstrong TV talking about C2PA.

Check that out. We're going to take a break on Techstrong. We'll be back in a minute.