DIFFERENT STRATEGIES TO safeguard AGAINST DEEPFAKES

Concurrently with the legal framework, public and private organisations get organised to put forward solutions allowing to detect and prevent the malicious spread of deepfakes. We can distinguish four strategies to safeguard against deepfakes.

1/ Detecting the imperfections

Detecting the deepfakes by their imperfections is one of the main existing methods. Some irregularities remain in the generated contents, such as the lack of blinks and of synchronisation between the lips and the voice, distortions of the face and accessories (arms of the glasses), or the inaccuracy of the context (weather, location).

The deepfakes are however built to learn from their mistakes and generate a content that is increasingly alike the original, making the imperfections less perceptible. The tools using this deepfake detection strategy can be effective but require a constant improvement to detect ever more subtle anomalies.

We can cite in this category Assembler, a tool intended for journalists developed by Jigsaw (branch of Alphabet, parent company of Google). It enables to verify the authenticity of contents through their analysis via five detectors, amongst which the detection of anomalies of patterns and colours, of copied and pasted areas, and of known characteristics of deepfakes algorithms.

2/ Screening and comparative analysis

Comparing the contents with a database of authentic content or by looking for similar content on search engines to see whether they have been manipulated (for instance, by finding the same video with a different face) is another strategy allowing to pre-empt deepfakes.

In 2020, the AI Foundation should make available a plugin, Reality Defender, to integrate to web browsers and over time to social networks. It will allow the detection of manipulations of contents, targeting first the politicians. Users will be led to adjust the sensitivity of this tool, according to the manipulations they will want to detect or not, not to be notified for every manipulation of content, notably for the most ordinary manipulations (photo retouch on a web page done on Photoshop for example).

3/ Watermarking

A third method consists in marking the contents with a watermark, or digital tattoo, to facilitate the authentication process by filling in their source and following the manipulations undertaken on these contents.

A team from the New York University works on a research project to create a camera embedding a watermarking technology meant to mark the photographed contents, in order not only to authenticate the original photography, but also to mark and follow all the manipulations carried out on it throughout its lifecycle.

4/ Involving the human factor

Involving the users in the detection process allows both mitigating deepfakes’ impacts by making them realise that the alteration of the acceded contents is possible, and to reduce deepfakes’ occurrence by allowing them to report the ones they suspect.

The plugin Reality Defender already mentioned will give users the possibility to report the contents they judge as fake so as to inform the other users – which once added to the analysis realised by the tool, will be able to see if the contents have been reported by other users, offering a second level of indication.

Some initiatives carried by cooperation of cross-sector actors combine these four strategies for a maximal efficiency against deepfakes. Some are already used or tested by journalists. It is the case of InVID, initiative developed within the scope of the European Union Horizon 2020 program of financing of research and innovation, used by the French press agency (AFP).

Solutions and strategies are therefore emerging, the market is developing, and new innovative solutions should appear very shortly with the results of the Deepfake Detection Challenge. This contest anti-deepfake was launched by Facebook upon the approach of the American presidential election, and more than 2,600 teams signed up. Results the 22^nd of April!

Below a table presenting examples of initiatives combining different strategies to safeguard against deepfakes.

Different means to protect one’s activity

The risk deepfakes present for businesses is genuine, and a few actions can be taken to protect one’s activity and mitigate its impacts from now on.

• Estimating the exposure: The use cases of deepfakes and the worst-case scenario of their use must be determined on the perimeters of the company, taking the fraud and undermining risks into consideration, and identifying the appropriate security strategies.

• Raising awareness: The collaborators must be made aware of the detection of deepfakes (to avoid the cases of fraud) but also of the limitation of shared contents on social media that can be reused to create deepfakes (to avoid the undermining). Just like anti-phishing campaigns, this awareness campaign focuses both on the detection of technical faults (form) of the deepfakes (although they will be led to disappear with the improvement of techniques), but mostly on the detection of the suspicious nature of information (content), encouraging the audience’s suspicion, cross checking of information and notification of the suspicions to the appropriate teams (what to do if I see a suspect video of my head of communications on the social networks during the weekend? What to do if I receive a vocal message of my chief asking me to execute a punctual operation that is slightly out of my perimeter?).

• Adapting the verification processes: The existing anti-fraud plans can be redesigned to be applied to deepfakes. For instance, for a Fake President fraud via deepfakes, one of the recommendations is to suggest to the interlocutor to hang up and call him back (if possible on a known number, and after an internal check). For the most sensitive fraud scenarios, these reaction processes must be finely defined, and the concerned collaborators regularly trained to the reflexes to adopt. Tools such as the ones defined earlier can also be used to verify all or any part of the media used by the collaborators.

• Protect the contents: The contents representing collaborators shared internally or externally by the company can be controlled to avoid them being reused to generate deepfakes. Businesses can limit the diversity (angle of the people and types of media) of the data potentially usable by malicious actors, and play on the digital quality (definition) of the shared contents. In fact, the more the malicious actors benefit from diverse and good quality contents representing the collaborators, the more it facilitates their reuse to generate deepfakes. Moreover, businesses can limit their means of communication to an official channel, verified social networks and their official websites – which creates contents’ consumer habits for the audience, that will be suspicious of all diffusion out of these habits.

• Anticipate the crises: The communications requirements in the case of a proven incident linked to deepfakes must be anticipated, and the management of the deepfake case must include the “generic” communications scenarios addressed in the crisis communication plans.

Cet article Deep dive into deepfake – How to face increasingly believable fake news? (2/2) est apparu en premier sur RiskInsight.

The recent events linked to the COVID-19 outbreak have proven the necessity of acceding to reliable and true news for all the society. More than the epidemic, we have witnessed an « infodemic », rapid spread of false or misleading information on the social networks, raising the question of the trust given to the platforms relaying the news and of the authenticity of the information they pass on.

The use of deepfakes is a topical phenomenon affecting firstly the general public. It is inherently linked to the importance gained by the social and online media in our daily life.

In September 2019, we counted near 15,000 deepfake videos online, twice more than in December 2018. If 96% of these videos were pornographic deepfakes posted on specialised websites, the extent of the affected topics has however increased to reach all the famous social networks (YouTube, Vimeo, Dailymotion).  Amongst the deepfakes posted on YouTube, 20% already represented politicians, business owners and journalists[1]. Their disinformation power on the general public allows them to influence major political and societal events from the moment they star famous personalities.

Deepfakes keep getting better, while the tools to generate them become more accessible (such as Lyrebird, for the audio deepfakes, Zao, for face-swapping, and the most recent one, Avatarify, integrated to Zoom and Skype, for the video). Their harmful power weighs more and more not only on public actors and organisations, but also on private ones, and must be taken into account in every business sector.

A RISK WORTH CONSIDERING FOR BUSINESSES

Deepfakes can also be used against businesses. They offer a new playground for malicious actors, particularly through two means of action:

• The improvement of Fake president frauds, whose impacts and probability are increased by deepfakes. The fraud becomes more credible thanks to photos, videos and audios copying the person who is impersonated. The targeted collaborators therefore consider these contents as an authentication in itself of the interlocutor, and the chances of successful attacks are increased – which is an incentive to ask for larger sums. Besides, the tools to generate deepfakes being accessible to the large public, the use of these frauds by malicious people increases.
• The undermining of the business through relayed false information can strongly damage its image, leading to a certain number of consequences, notably financial and legal. We can wonder what would be the impacts of an ExCom member’s video speech sharing fake results or strategic orientations on the price of his firm’s share or on the trust of its prospects; or those of the disclosure of a product anomaly on the direct order intake. Moreover, denying the rumours is harder when deepfakes are used. Today, many businesses still feel afar from the subject: How many have already wondered what would the impacts of a deepfake be on their activities?

A legal framework IN PROGRESS

The states start putting together an answer to the deepfake concern and legislating to regulate their diffusion. Some countries such as China criminalise the diffusion of deepfakes without notifying the audience about it (since the 1^st of January 2020). In the United States, the treatment of the deepfakes’ question is speeding up as the presidential election of November 2020 approaches, and it is dealt with both at the federal level (bills prohibiting the diffusion of deepfakes in California, Virginia and Texas) and at the national one (the DEEPFAKE Accountability Act[2]  is being discussed by the Congress to “combat the spread of disinformation through restrictions on deep-fake video alteration technology”). In France, the question of deepfakes is included in the law of the 22^nd of December 2019, related to the fight against the manipulation of information – and is therefore not dealt with specifically.

These legal frameworks remain dawning and heterogeneous, and only represent one part of the answer to provide to this technology. More than condemning their malicious use, the issue is mostly to be able to detect and avoid them.

In this first part, we have given an overview of the risks presented by deepfakes for the businesses. In the second part of the article, we will focus on the technical and organisational means available today to safeguard oneself.

[1] Study published by Deeptrace in September 2019.

[2] Defending Each and Every Person from False Appearances by Keeping Exploitation Subject to Accountability Act.

Cet article Deep dive into deepfake – How to face increasingly believable fake news? (1/2) est apparu en premier sur RiskInsight.

Addressing the need to know and the need for reassurance

Supported by the increased number of incidents and attacks on information systems, the cybercrisis has moved into the public realm. The democratisation of its vocabulary is a clear indicator of the place that this subject takes up in the media. Data leakage, ransomware, hacktivist, DDoS, phishing, whistle-blower, these terms have left the server rooms and specialist blogs to make their way into national newspaper columns and most people’s vocabulary. The cybercrisis is no longer a mere quality incident discreetly handled in-house but has become an event that arouses the interest of a broad audience. This interest transforms the cybercrisis into a communicational crisis. However, while this theme’s new popularity is logically transposing into an increase in coverage, other elements justify a significant increase in solicitations, whether internal or external to the organisation in crisis.

When the cybercrisis results in data leakage, for example, it is not only the subject of the crisis that is newsworthy, but its very object. In fact, when the data leaks or is stolen, its nature arouses curiosity, whether it is personal data, a State secret or simply a private conversation. This mechanic logically generates for many audiences both the need to know the unknown, and to make sure that they are not the victim. These two primary needs of curiosity and reassurance are the essential drivers of media coverage and more generally encourage the information consumer, the stakeholder, the client to fill that need and seek to obtain this information. The same logic assumes that the source of this information, in this case the legitimate data holder, addresses these requests and communicates on the incident.

Whether it’s strategic events such as presidential elections or everyday private conversations on digital media that are compromised, the crisis’ media effect is magnified by the extraordinary nature of the event. This is the result of both its supposed impossibility and the confidence that the public entrusts it. The sudden rupture of the trust placed in these “institutions” of major importance, erected in good stead in a 2.0 version of Maslow’s pyramid, then generates itself the interest and the need to know, translated into an explosion of the number of requests for information to the organisation in crisis.

Figure 1: Maslow Pyramid Example

Communication war between the attacker and the communicator

Cybercrisis communication is thus a specific exercise given the subject it deals with, but also by the nature of the actors present. In fact, when immeasurable sums of money are stolen without warning or institutions fall under “citizens” hacktivist attacks, opinion tends to sympathise towards the attacker perceived as a modern hero, a romantic pirate or a anonymous vigilante.

This public figure, aware of its image and the codes of the communication world, will of course be able to play this environment. Thus, the very methods of the attackers reinforce the central place of communication in the management of cybercrises. Attacks on political, ideological and militant grounds are no longer confined to the compromise of a system but send a message whose publicity must be maximised.

This obvious appropriation of the activists’ specific methods is illustrated in several ways: prior warning of a DDoS, defacing a website, publication over time of proofs of a theft on social networks, dissemination of information such as exchanges of compromising private mail conversations, etc. If the attackers have learned to maximize the reputational impact of their attacks, they also use this lever to disrupt their target’s crisis management and make a noise that will buy them time once their attack is discovered. While one of crisis management’s key success factors of is regaining control of this rhythm and the publication of new elements, the cybercrisis inevitably leaves this power to a malicious third party.

This third party can also, if the compromise goes deeply, alter the company’s means of communication. While it tries to respond to the need to express itself urgently and widely, this can severely hinder the fluidity of its communication. Without email, how to spread a message to employees? Without social networks, how to be close to the community and answer their questions?

Restoring the trust relationship through communication

Fascinated by the attackers and the magnitude of the attacks, the general public is nonetheless intransigent at a time when trust and data are the very value of a company. Intrinsically, preserving the first assumes the protection of the second. When the organisation fails to achieve this goal, crisis communication is the only one able to restore this relationship of trust on which depends the future of the relation with customers and partners, who will or will not continue to entrust their data or the management of their tools, as well as their services to an organisation.

This trust requirement also brings about, when it’s is broken, the search for whom to point the blame. Although the reality of the facts is much more complex, the general public will easily assume that information system attacks are made possible by exploiting a vulnerability and therefore a fault.

A data leak is thus not only perceived as an attack perpetuated by a malicious third party, but also as negligence in the defences of the company victim to the theft. The latter is automatically designated as responsible and its reputation is logically impacted. Even as the attackers have become professional, the attacks complexify and the absence of vulnerabilities is a myth, cyber-attacks are now a subject of crisis management and communication in their own right. Because of its potential impact on the general public’s daily life and therefore its newsworthy nature, it forces the victim, considered to be co-responsible for its loss, to express itself.

Try to Keep It Simple for Better Crisis Communication

Beyond defining a clear, shared and timely strategy, managing a cybercrisis with its particular rhythm and the obstacles caused by the attackers must be accompanied by a special communication which implies a final effort: keeping it simple.

Confronted by a cybercrisis, like any type of crisis, communicating implies being able to translate the events and corrective actions into clear impacts and to address them in a coherent manner. Of course, the complexity of the terms and the mechanics of a cybercrisis makes this exercise tricky and is another particularity to take into account.

In this context, through their ability to translate the technical cause into business consequences and more generally into layman’s terms, the CISO and their team’s role is central. During business as usual as well as in times of crisis, the CISO’s mission is the responsibility for translating the facts and technical components not only into business impacts but also into understandable and convincing impacts for diverse non-expert audiences. They may also have to conceive or even bear responsibility for elements of crisis communication language in the same way that a human resources representative is exposed during a social crisis.

Without presupposing their exposure on a major TV channel’s news programme, information security experts’ words will be expected on social networks, on professional networks, in the specialized press or in-house. In crisis communication, everyone is responsible for everything and everyone has to be prepared for it.

Thus, the subject of cyber carries a media power of its own; the immediate consequence of which is the considerable increase in expectations and requests to be informed from different divisions of an organisation as well as from the public. If the impending occurrence of an information security incident involves a specific defence and continuity of operations planning, it also requires anticipation of these requests and an active preparation for this overall communication effort.

Cet article Cybercrisis, a fully-fledged media topic est apparu en premier sur RiskInsight.