1
00:00:00,000 --> 00:00:16,840
Welcome back to Quietly Secure.

2
00:00:16,840 --> 00:00:22,080
Over the last few episodes we've talked about trust, we've talked about scams, deep

3
00:00:22,080 --> 00:00:27,920
fakes, artificial intelligence, the information we see every day.

4
00:00:27,920 --> 00:00:33,920
And most recently we've talked about something that sits underneath all those subjects,

5
00:00:33,920 --> 00:00:36,160
skepticism.

6
00:00:36,160 --> 00:00:43,480
That ability to stop for a moment and ask, how do I actually know this is real?

7
00:00:43,480 --> 00:00:46,880
But there's another question hiding behind that one.

8
00:00:46,880 --> 00:00:52,880
And it's a question we're going to have to think about more and more as technology develops.

9
00:00:52,880 --> 00:00:57,760
What is this real? But are you really you?

10
00:00:57,760 --> 00:01:03,720
Because in a world where artificial intelligence can reproduce someone's face, their voice,

11
00:01:03,720 --> 00:01:10,800
their writing style and increasingly their behaviour, proving who you are is becoming surprisingly

12
00:01:10,800 --> 00:01:13,000
complicated.

13
00:01:13,000 --> 00:01:16,480
Think about how we prove our identity today.

14
00:01:16,480 --> 00:01:22,800
If you walk into a bank, you might show a passport or a driving licence.

15
00:01:22,800 --> 00:01:28,360
If you apply for something important online, you might be asked for your data birth, your

16
00:01:28,360 --> 00:01:34,960
address, a photograph of identity documentation, perhaps even a selfie.

17
00:01:34,960 --> 00:01:38,640
And sometimes you're asked to do something a little strange.

18
00:01:38,640 --> 00:01:42,920
Turn your head, blink, smile, move closer to the camera.

19
00:01:42,920 --> 00:01:45,520
It can feel slightly ridiculous.

20
00:01:45,520 --> 00:01:47,440
But there's a reason for it.

21
00:01:47,440 --> 00:01:51,120
The system isn't simply asking, who are you?

22
00:01:51,120 --> 00:01:54,520
What's asking? Can you prove it?

23
00:01:54,520 --> 00:01:59,040
And those are two very different questions.

24
00:01:59,040 --> 00:02:01,160
Identity is simple, right?

25
00:02:01,160 --> 00:02:05,680
For most of human history, identity was relatively simple.

26
00:02:05,680 --> 00:02:10,920
People knew who you were because they knew you, your family knew you, your neighbours know

27
00:02:10,920 --> 00:02:16,800
you, the employer knows you, your local community knows you.

28
00:02:16,800 --> 00:02:23,680
Your identity was largely based on relationships, then technologists started changing that.

29
00:02:23,680 --> 00:02:32,000
We created usernames, passwords, email addresses, account numbers, pins, security questions.

30
00:02:32,000 --> 00:02:36,760
Suddenly, you can interact with someone without ever seeing them.

31
00:02:36,760 --> 00:02:41,920
You didn't necessarily need to know who they were, you just needed to know the right

32
00:02:41,920 --> 00:02:43,600
secret.

33
00:02:43,600 --> 00:02:48,840
If you knew the password, you were treated as the person who owned the account.

34
00:02:48,840 --> 00:02:56,560
And for a while, that worked reasonably well, until passwords started getting stolen.

35
00:02:56,560 --> 00:03:03,600
Then we began adding another layer, something you have, a phone, a security key, a smart

36
00:03:03,600 --> 00:03:10,480
card, perhaps an authentic header app, and something you are, your fingerprint, your face,

37
00:03:10,480 --> 00:03:12,000
your voice.

38
00:03:12,000 --> 00:03:15,040
These are all called biometrics.

39
00:03:15,040 --> 00:03:19,520
And they're fascinating because they feel much more personal.

40
00:03:19,520 --> 00:03:26,160
You can change your password, you can replace a bank card, you can reset a pin, but you can't

41
00:03:26,160 --> 00:03:32,680
exactly reset your face, you can't issue yourself a new set of fingerprints, and that's

42
00:03:32,680 --> 00:03:39,320
where biometrics become incredibly useful, and potentially worrying.

43
00:03:39,320 --> 00:03:42,400
Think about unlocking your phone with your face.

44
00:03:42,400 --> 00:03:48,160
It feels effortless, you look at the screen, the phone recognises you, and you're in.

45
00:03:48,160 --> 00:03:53,920
There's no password to remember, nothing to type, nothing to carry, it feels almost like

46
00:03:53,920 --> 00:03:55,400
magic.

47
00:03:55,400 --> 00:03:57,400
But what's actually happening?

48
00:03:57,400 --> 00:04:03,040
The system is making a judgement saying, "The person in front of me is sufficiently similar

49
00:04:03,040 --> 00:04:08,920
to the person I believe on this device, and that's an important distinction."

50
00:04:08,920 --> 00:04:13,320
Biometrics don't necessarily prove who you are.

51
00:04:13,320 --> 00:04:18,800
They provide evidence that you are probably the person you claim to be, and that distinction

52
00:04:18,800 --> 00:04:23,360
becomes much more important when the technology gets better.

53
00:04:23,360 --> 00:04:30,480
Because the better AI becomes at creating artificial faces and voices, the more difficult

54
00:04:30,480 --> 00:04:37,520
it may become to distinguish the real person from a convincing imitation.

55
00:04:37,520 --> 00:04:44,800
Imagine receiving a video call from your bank, you see someone who looks exactly like a member

56
00:04:44,800 --> 00:04:50,440
of the security team, you hear their voice, they know your name, they know roughly where

57
00:04:50,440 --> 00:04:56,720
you live, they know you've recently contacted the bank, and they tell you there's been suspicious

58
00:04:56,720 --> 00:05:03,000
activity on your account, everything looks right, everything sounds right, so you trust

59
00:05:03,000 --> 00:05:04,000
them.

60
00:05:04,000 --> 00:05:12,040
But that person you see isn't actually there, it's a generated face, the voice is artificial,

61
00:05:12,040 --> 00:05:16,320
and the information they've used about you was gathered somewhere else.

62
00:05:16,320 --> 00:05:21,920
Suddenly, the question isn't simply, "Can I recognise this person?"

63
00:05:21,920 --> 00:05:27,440
It's, "Can I prove that this person really is who they claim to be?"

64
00:05:27,440 --> 00:05:31,040
And that's a much harder problem.

65
00:05:31,040 --> 00:05:32,480
What do you need?

66
00:05:32,480 --> 00:05:37,560
This is where the idea of digital identity becomes increasingly important.

67
00:05:37,560 --> 00:05:44,560
A digital identity is essentially aware of representing who you are in the digital world.

68
00:05:44,560 --> 00:05:51,400
But that doesn't necessarily mean one enormous database containing everything about you.

69
00:05:51,400 --> 00:05:57,600
In fact, one of the interesting ideas behind modern digital identity systems is that you

70
00:05:57,600 --> 00:06:01,000
shouldn't have to reveal everything.

71
00:06:01,000 --> 00:06:03,680
Think about proving your age.

72
00:06:03,680 --> 00:06:08,760
If you're buying something online that requires you to be over 18, why should the company

73
00:06:08,760 --> 00:06:14,200
necessarily need to know your full name, your address, your data birth?

74
00:06:14,200 --> 00:06:19,360
Perhaps all they really need to know is, is this person over 18?

75
00:06:19,360 --> 00:06:20,360
Nothing more.

76
00:06:20,360 --> 00:06:24,280
That's a very different approach to identity.

77
00:06:24,280 --> 00:06:30,760
Instead of handing over all your information, you prove the specific fact that matters.

78
00:06:30,760 --> 00:06:37,000
And this idea is becoming increasingly important because information has value.

79
00:06:37,000 --> 00:06:43,840
And every time we hand more of it over, we create another opportunity for it to be stored,

80
00:06:43,840 --> 00:06:47,800
copied, leaked or misused.

81
00:06:47,800 --> 00:06:51,200
There is another problem, identity theft.

82
00:06:51,200 --> 00:06:58,240
Traditionally, stealing someone's identity meant obtaining their documents, the bank details,

83
00:06:58,240 --> 00:06:59,240
past words.

84
00:06:59,240 --> 00:07:03,720
But AI introduces another possibility.

85
00:07:03,720 --> 00:07:11,000
What if someone can imitate you, your face, your voice, your writing, your online behaviour?

86
00:07:11,000 --> 00:07:15,480
What if they can create a convincing digital version of you?

87
00:07:15,480 --> 00:07:20,520
They might not need to steal your identity in a traditional sense.

88
00:07:20,520 --> 00:07:26,800
They might simply manufacture evidence that appears to suggest, this is Jonathan, or whoever

89
00:07:26,800 --> 00:07:28,400
you happen to be.

90
00:07:28,400 --> 00:07:31,400
And that creates a strange situation.

91
00:07:31,400 --> 00:07:37,040
The technology that makes it easy for us to prove who we are can also make it easier for

92
00:07:37,040 --> 00:07:40,640
somebody else to pretend to be us.

93
00:07:40,640 --> 00:07:46,440
So perhaps the future of identity won't be about finding one perfect way of proving who

94
00:07:46,440 --> 00:07:48,040
you are.

95
00:07:48,040 --> 00:07:53,880
Perhaps it will be about combining several different pieces of evidence, something you know,

96
00:07:53,880 --> 00:08:00,720
something you have, something you are, and something about where you are and what you're

97
00:08:00,720 --> 00:08:01,720
doing.

98
00:08:01,720 --> 00:08:06,000
And perhaps even something about the device that you're using.

99
00:08:06,000 --> 00:08:12,920
Instead of asking one question, systems might ask many small questions and together those

100
00:08:12,920 --> 00:08:18,360
answers create confidence, not certainty, confidence.

101
00:08:18,360 --> 00:08:23,840
And that distinction matters because security rarely gives us absolute certainty.

102
00:08:23,840 --> 00:08:28,400
It gives us enough evidence to make a decision.

103
00:08:28,400 --> 00:08:32,800
But there is a darker side to all this.

104
00:08:32,800 --> 00:08:39,240
The more powerful our digital identity systems become, the more important the organisations

105
00:08:39,240 --> 00:08:41,520
control in them become.

106
00:08:41,520 --> 00:08:47,720
If one system can prove who you are, what happens if that system gets it wrong?

107
00:08:47,720 --> 00:08:51,560
What happens if your identity is incorrectly flagged?

108
00:08:51,560 --> 00:08:57,160
Or you lose access or the database is breached.

109
00:08:57,160 --> 00:09:04,840
And perhaps more importantly, who gets to decide what your identity actually means?

110
00:09:04,840 --> 00:09:11,680
These aren't purely technical questions, there's social questions, political questions,

111
00:09:11,680 --> 00:09:15,440
and ultimately, human questions.

112
00:09:15,440 --> 00:09:21,000
There's also a temptation to think that biometrics are automatically safer.

113
00:09:21,000 --> 00:09:24,600
After all, nobody can guess your fingerprint.

114
00:09:24,600 --> 00:09:27,440
Nobody can forget their own face.

115
00:09:27,440 --> 00:09:32,120
But there's a fundamental difference between a secret and a biometric.

116
00:09:32,120 --> 00:09:35,760
A password can be changed, a fingerprint can.

117
00:09:35,760 --> 00:09:39,840
A password can be revoked, your face can't.

118
00:09:39,840 --> 00:09:45,520
So perhaps we shouldn't think of biometrics as replacements for passwords.

119
00:09:45,520 --> 00:09:50,280
Perhaps we should think of them as another piece of evidence.

120
00:09:50,280 --> 00:09:54,920
Another way of increasing confidence that the person on the other side of the screen is

121
00:09:54,920 --> 00:09:58,440
really the person they're claiming to be.

122
00:09:58,440 --> 00:10:01,720
And that brings us back to where we started.

123
00:10:01,720 --> 00:10:02,720
Skepticism.

124
00:10:02,720 --> 00:10:08,120
We've spent a lot of time learning to question what we see online.

125
00:10:08,120 --> 00:10:09,840
Is this video real?

126
00:10:09,840 --> 00:10:11,960
Is this voice real?

127
00:10:11,960 --> 00:10:14,240
Is that message genuine?

128
00:10:14,240 --> 00:10:16,720
Is that website legitimate?

129
00:10:16,720 --> 00:10:22,240
But perhaps the next generation of digital skepticism will involve a different question.

130
00:10:22,240 --> 00:10:28,480
Not just can I trust what I'm seeing, but can I trust who I'm dealing with?

131
00:10:28,480 --> 00:10:33,040
And eventually, how do they know I'm really me?

132
00:10:33,040 --> 00:10:36,600
Because that's the strange future we're moving towards.

133
00:10:36,600 --> 00:10:41,520
A world where technology may know more about us than ever before.

134
00:10:41,520 --> 00:10:48,480
And simultaneously making it harder to know who is actually behind the screen.

135
00:10:48,480 --> 00:10:53,360
Perhaps the ultimate goal of digital identity shouldn't be to make us prove everything

136
00:10:53,360 --> 00:10:54,880
about ourselves.

137
00:10:54,880 --> 00:10:57,760
Perhaps it should be the opposite.

138
00:10:57,760 --> 00:11:01,320
To allow us to prove it just enough.

139
00:11:01,320 --> 00:11:03,480
Enough to show that we're old enough.

140
00:11:03,480 --> 00:11:05,560
Enough to show that we're authorised.

141
00:11:05,560 --> 00:11:09,560
I enough to show that we're the person who owns an account.

142
00:11:09,560 --> 00:11:13,440
Enough to show that transactions really come from us.

143
00:11:13,440 --> 00:11:16,800
Without handing over everything else.

144
00:11:16,800 --> 00:11:20,320
That could be a much more privacy-friendly future.

145
00:11:20,320 --> 00:11:23,120
But only if we build it carefully.

146
00:11:23,120 --> 00:11:26,080
Because identity is more than a login.

147
00:11:26,080 --> 00:11:28,120
It's more than a password.

148
00:11:28,120 --> 00:11:31,640
It's more than a photograph on a document.

149
00:11:31,640 --> 00:11:36,840
It's the digital representation of who the world believes you are.

150
00:11:36,840 --> 00:11:43,480
Once that representation becomes valuable, it becomes something worth protecting.

151
00:11:43,480 --> 00:11:49,160
So perhaps the future of digital identities isn't really about finding one perfect way

152
00:11:49,160 --> 00:11:50,920
to prove who we are.

153
00:11:50,920 --> 00:11:53,960
It might be about combining evidence.

154
00:11:53,960 --> 00:11:56,280
Something we know or something we have.

155
00:11:56,280 --> 00:11:57,280
Something we are.

156
00:11:57,280 --> 00:12:02,280
And perhaps something that technology can use to build confidence that the person on

157
00:12:02,280 --> 00:12:07,360
the other side of the screen is actually the person they're claiming to be.

158
00:12:07,360 --> 00:12:09,120
But we should remember something.

159
00:12:09,120 --> 00:12:14,600
There is a difference between proving who you are and giving someone everything they

160
00:12:14,600 --> 00:12:17,040
need to know about you.

161
00:12:17,040 --> 00:12:23,440
The more information we use to establish identity, the more valuable that information becomes.

162
00:12:23,440 --> 00:12:30,000
And the more important it becomes to ask who holds it, who can access it, and what happens

163
00:12:30,000 --> 00:12:32,240
when something goes wrong.

164
00:12:32,240 --> 00:12:34,560
Because a password can be changed.

165
00:12:34,560 --> 00:12:40,440
A bank card can be cancelled, but you can't simply replace your face or your fingerprint

166
00:12:40,440 --> 00:12:42,440
or your voice.

167
00:12:42,440 --> 00:12:48,320
And as artificial intelligence becomes better at reproducing all of these things, identity

168
00:12:48,320 --> 00:12:54,840
is going to become an increasingly important part of our digital security.

169
00:12:54,840 --> 00:12:59,720
Perhaps the question isn't, can technology prove who you are?

170
00:12:59,720 --> 00:13:04,840
Perhaps it's, what would you be willing to give up in order to prove it?

171
00:13:04,840 --> 00:13:12,080
Your password, your phone, fingerprint, face, voice, your identity documents?

172
00:13:12,080 --> 00:13:18,160
And if technology can eventually reproduce all of those things, what will we use to prove

173
00:13:18,160 --> 00:13:22,600
that the person behind the screen is actually you?

174
00:13:22,600 --> 00:13:26,400
That's a question we're going to be asking for a long time.

175
00:13:26,400 --> 00:13:29,680
But for now, there's another part of our life.

176
00:13:29,680 --> 00:13:33,720
Where technology is changing the meaning of identity.

177
00:13:33,720 --> 00:13:37,800
The place where many of us spend a huge part of our lives.

178
00:13:37,800 --> 00:13:38,800
Work.

179
00:13:38,800 --> 00:13:42,800
Artificial intelligence is already changing how we work.

180
00:13:42,800 --> 00:13:49,760
The jobs we do, the skills we need, the decisions made about us, and perhaps even what it means

181
00:13:49,760 --> 00:13:51,600
to have a career.

182
00:13:51,600 --> 00:13:58,360
So in the next episode of Quietly Secure, we're going to leave the question of who are you?

183
00:13:58,360 --> 00:14:01,200
And start asking another one.

184
00:14:01,200 --> 00:14:05,480
What happens to us when the way we work begins to change?

185
00:14:05,480 --> 00:14:11,520
And remember, just because something can prove who you are doesn't necessarily mean you

186
00:14:11,520 --> 00:14:18,320
should trust the system doing the proving, and sometimes the safest thing you can do is

187
00:14:18,320 --> 00:14:20,360
still the simplest.

188
00:14:20,360 --> 00:14:25,200
Stop, think, and ask, how do I know?

189
00:14:25,200 --> 00:14:31,920
Until next time, stay curious, stay calm, and as always, stay Quietly Secure.

190
00:14:32,760 --> 00:14:41,920
[MUSIC]

191
00:14:41,920 --> 00:14:51,920
[BLANK_AUDIO]