Open Letter to Pause AI – Michaël Lakhal, OneSpan

This is texturing TV. Hey everyone, welcome back to Tech strong TV. I have what?

I hope it's going to be a great discussion for us to for you guys to listen to right now. Let me introduce you to Michael and excuse my terrible French. Mikal Miguel where you pronounce it correctly for our audience.

Hi everyone. Thank you Allen. So, my name is Miguel Laken.

I'm director of product management for one span. Thank you, Mica. Why don't you we start off with a little bit of your own personal story your own background and a little bit about one span.

Yeah, thank you. So my personal history. I started working in financial services in Banks many banks in here in Europe and specifically in France and he decided to move to the safer security to provide this solution.

So we started with the digital signature or signature what we call Electronic signature and then now I mean, I'm moving to more security authentication identification this kind of Technology. Excellent and then one span if you can give us a little background, so one spot is it's an 20 years old. Company and what you are doing today is really I mean we are managing transaction and we secure this transaction based on five main pillars.

We can address, you know, when it comes to on a transaction you need to deal with the known or unknown and user so we have the ability right now on board someone identification. That's the first pillar or we can put authenticate an existing clients. And then we have a signature solution.

We have also interactions solution like a secure Zoom video conference that we can secure to have like interaction with something like a virtual Branch for when it comes to Banks for instance and we have the last pillar which is storing them formation because as soon as you perform a transaction and you completed transaction you need to be able to store the artifact. I mean what we call the audit Trail to prove this transaction if in case of dispute the dispute could happen like one year or 10 years after the transaction happened. Absolutely, and for people who want to get more information about one span, let us just get that out of the way what the website for one span.

com. It's an American company now, but we are operating globally we are operating with the top 100 Banks and financial services in the world, but not only we operating in general in all the higher regulated industry to manage transaction. com, you can find a lot of material use cases and so on.

That's and doing solution to secure transaction as I said. actually now that we've got the way make a highlight. Let us turn to what we want to discuss.

Today and that is this whole AI generator of AI chat GPT Etc. It seems you know in a season full of Doom and Gloom in the tech industry right Banks failing and and valuations down and people losing their jobs the bright spot more than a bright spot. It's a gleaming bright spot like red red hot is this whole area of AI is if AI all of a sudden burst on the scene yesterday and we haven't been working on it for the last 30 or 40 or more years, but nevertheless is having its moment.

And whether it is the the dawn of a new day. Or just the continued evolution of what's going on. It certainly is captured the world's attention.

You can't walk more than three feet without, you know running into something about AI a two weeks ago now, maybe three weeks ago by the time this plays 100 leading lights in the tech world something like that put out an open letter. asking for a moratorium or a pause on continued development around these, you know. Generative AI giant AI experiments judging PT Etc.

And it's not just chat GPT. We should be clear Google has barred and probably there's a lot there's a lot more out there as well. We not probably we know.

I'm interested. What's your take on this? So I think I'm in this letter is a good initiative.

But no, I mean we need to face the reality of things. I mean the reality is I don't think we can stop the train here. I mean, this is first of all, I mean this AI or Chad GPT is not new.

I mean AI exist we at once when we use AI for multiple things like Risk based potentiation based on behavioral to make some analysis on the way you behave when you transact with your bank or any organization My point here is it's not a new technology. It's just the fact that charge GPT opened this technology to everyone. So everyone can use it including potentially the hackers and that's the risk.

Absolutely. And you know to me it's a question of you. You can't stuff a genie back in the bottle, right?

It's kind of out there and people are going to use it. When I when I look at this letter though, I did this two sort of. Distinctions like I would ask your opinion on one is okay.

We can't put the genie back in the bottle. But if we don't continue developing it and it stays sort of Frozen where it is now. Is it still a risk and it's not even possible quite frankly right that people are just not going to develop from where we are now.

What what is the risk is what what's the existing risk and then secondly, assuming we can't do that. And we continue to develop what are the you know, let's strip away the foot the fear uncertainty and doubt and get down to the real risk. What are the risk?

I mean, it seems to be at this point to be primarily cyber security related though. I think they're a much greater potential risk with continued development. But that might be Pie in the Sky fairy tale stuff as well.

So who knows Michele? It's what's your take? So let's let's the big four point.

Oh when it comes to risk associated to judge gdpg. I see four major risk right. Now.

The first one is chargedy can help for us to create more believable native sounding fishing campaign. If you think about it, including of course emails charger dialogues that tricks or course user into giving their authentication credential that's one risky identified. no suppose just to illustrate that suppose a human require an an hour one hour compose a personalized fishing email.

To try to fish your your your your bank account Island for instance with Char GPT. This can be automated and therefore go much faster than it is today. So that's one of the risky danceified Now by saying that I want to say also something else.

It's check GPT right now with the knowledge and the level of changing tea has today. We can compare it to a mediocre hacker because it's based on existing technology existing for that attack. We know we can I mean most of the organization already have the tools to prevent that But what about the future the future if if we cannot find the latest book or you you will never have a sophisticated attack with chargbt?

But the fact that this AI May in the future have access to more recent data. Maybe could be more able to create more sophisticated at attacks and could be more. Complicated to prevent.

So that's one of the risky identified which is the fishing attack or the risk is malicious code because charge GPT can create and generate malicious code so it can help. You know, anyone can become a hacker you and me we can become a hacker with by using charge GPT doesn't mean that are we going to be a good hackers most probably not but you can just give us like more power to automate number of attacks and having like a systemic attacks on one organization. We can Target for instance.

Other attacks, I mean could happen like a GP can be used to create fake online personal like Deep Creek. Well, I mentioned Francis the unknown user identification when you need to identify someone a pure Prospect someone you never had any information about you can fake his face. You can fake a passport.

You can fake a driving license. You can fake any type of document to proof of address with charge GPT. Again, this is not a new fraud.

It's just the fact that this technology can automate something number of Task which used to be manual task for hackers and where I mean we can detect that it was done like in African. Rich and China, whatever. I mean the origin of the attack.

But the thing is with this automated powerful tool make it more efficient. That's that's really one of the the risk. We we see right now with this technology.

I agree. You know. So there's two kinds of people in the world in our what my world here are tax drug TV, right?

There's our audience who are tech people. Right and they look at things like Chachi PT and generate of AI and AI in general and you're right many of people in our audience have been using Solutions or developing solutions that have mlai type of capabilities for a long time. Not new.

It's gotten better, you know as we continue to develop but they look at the chat GPT kind of generate AI stuff and say wow. count it right quality code Can it? kind of perform better data analysis for observability cybersecurity Stuff like that and then the dark side.

Can it right malware can it help evade? You know, so in other words very technical applications of the technology. Then there's another kind of person in the world.

I was at a family gathering a last week and this whole thing came up and I opened up my my iPad. And I I gave a quick demonstration that I demonstration. I asked it to write.

Report on something in the style of like that guy and a poem. And for non-technical people McHale they look at this. And they're like, they think it's sentient.

They they think there's you know, there's real Consciousness in there. and To them. It's like cyber security is the tip of the iceberg.

It's the how is it going to it'll wreak havoc on social media with fake news, you know all the way from there all the way up to like Skynet, you know doomsday type of scenarios. This open-led Applause. Is the name that our Tech audience or is it aimed that that General audience?

I would say that the general audience of course because right now me the dick are very aware of the limitation these tools. I mean any developer, okay? And it developer who is interested in following the news right now try, you know to use Changi PT to generate code and make his own analysis and all of them can tell you that right now.

I mean the quality of the code whatever is or program or for malware because as a security company we tested as well. Is not like efficient. It's like mediocre code.

No, I mean did you as I said, I mean you can use it on a two-mitted way which could help I mean to meet a certain number of tasks, but never replace a human it never replace a brain of a human with a clear analysis today tomorrow. No one knows right now I mean could be but again, this is a technology for like your analogy with the social media. Social media could be a very good thing.

It depends on how are you following? So with charge GPT the way you are feeding the technology the AI and the type of information they can access to it. I mean will make a big difference.

So that's why for me. I mean, there is the generic AI like Chang GPT, which is a scanning the web and and you have also the private AI right now who can really help and this what we are using right now for facial condition for instance or document verification on what we call name matching or anti-money laundering which is used in different industry. But this is private technology that fully controlled with some secret with algorithm and so on that I mean for me another level and this one, I mean cannot bypass the other if you see my world So I see sure.

So again, we really need to differentiate. I mean like the general audience and to your point with some specialist audience because AI can create fraud as I said, but AI can prevent the food as well. Yes.

so Let's assume for the for a moment, though. Look, we're kidding ourselves No One's Gonna pause the continued development of this as cyber security and a good chunk of our audience or cybersecurity professionals here at Cyber Security Professionals. What would be your advice?

What should we do? I think of course we need to follow and we need to keep an eye on this technology, but we need to continue as I said, I mean developing our own technology because If you want to prevent this kind of attacks the best way to prevent it is first of all to educate people about that, but also make sure that there are different organization could be targeted by this technology for Cyber attack. Are well geared to prevent that so it's time for right now to give you some concrete example one comes to authentication you need to identify.

Your Island I need your attention to identify you as a island. So what we used to do right now and Depends from a country to another one we can ask you, you know to send one time password by SMS. This is I mean what most of the technology are doing or most of the organization are doing is it secure absolutely not it's not so I mean because SMS you have swim swapping and so on.

We are you have different things but for the same use cases if I ask you Alan. To authenticate and I have a solution like Risk based authentication based on AI machine learning and I can follow the way the device you're using how you use it. How you type your password how I can ask you for fish or condition if needed depending on the risk of the transaction and so on.

This is I mean where AI can my point is helping to prevent that? And having this kind of solution already can prevent any type of fishing attack malware attack or these kind of things. It has to be automated based on personal Behavior personal data, we can store as a security company and we can recognize that you are we are sure that you always interacting with us and if needed we can add another layer of security if we detect any suspicious activity from you like you don't you don't use the device you use to to connect with you have maybe you have a new phone.

Maybe you have a new laptop. So we need to detect that if that's the case you need to we need to identify this laptop. We need to identify with your locate you today in Florida and next week in Amsterdam for instance.

So that's I mean the kind of information we can cross but that just a couple of example we can collect like 200 point of information based on a simple authentication or identification and this is where I mean this organization need to accelerate the digital transformation because if you think about it when internet started it was based on trust. And now we are losing this trust. So we need to come back to this trust and this is I mean what one span and all the cyber security company are trying to do right now is to protect this organization to bring back the trust in the equation.

And that's gonna happen with that's gonna accelerate. Right now I consider what still in what will in the web put at all but when it comes to web Suite or for DOT or with a metabares or whatever it is gonna be or decentralized information. The idea here is really to bring back the trust into the equation into the retraction between end user and an organization or two end user who interacting together.

So that's where I mean, I think I mean this. New technology need to be used to bring back the trust and make sure that everyone can trust the online banking. The online Health Care is Doctor connecting to any organization with a high level of trust high level of security.

excellent McHale Mikhail and when we started I said this goes really fast we're way over 15 minutes, but I enjoyed the conversation and I I would love to bring back the trust as you said right as I said, this is oh, this is the reason why we can't have nice things on the Internet is this lack of trust lack of security. I look forward to continuing our conversations at some point though. Whether when next time I'm in France, or maybe if you guys if one span out of one Spence gonna be at the RSA conference in a couple of weeks, we'll be we'll be live streaming there all week.

But let's do that and thank you for coming on Tech strong TV today. Thank you very much. Thank you everyone for your time.

All right, Mikayla director of product management at once man. We're gonna take a break here on Tech strung TV. We'll be right back.