British engineering giant Arup revealed as $25M deepfake scam victim
cnn.com
cnn.com
Regardless of the sophistication of the deepfake, surely this rings huge alarm bells, right? I'm not even sure I'd be comfortable making secret transactions on instruction from my boss. Even if your boss is actually asking you to do this, how can you have the financial authority to transfer $25M and not the savvy to think that being asked to transfer huge amounts of money in secret isn't going to result in you getting thrown under the bus?
For example, that they've just closed a deal to buy a startup - a negotiation which was of course conducted in secrecy. It's a startup in another country, which is why we're all out of the office. Timezones are why you've received the request outside of normal working hours. And we've got to, um, close the deal so we can announce it outside of stock market opening hours, for both countries. To close the deal we've got to pay 10% of the 250M purchase price upfront. If you can't get this done within 2 hours the deal will fall through.
They could also sell it as payment for an e.g. consulting firm for the above secret deal...
Idk if most people would tell the difference
Authenticating transactions is going to be an increasing problem in the presence of deepfakes, though.
Found out, from some "unnamed source" that there will be a new bus stop and a new aldi store across the street from a building where some apartments are for sale? Don't mention it to anyone, secretly buy them, because their value will go up a lot, and do it discreetely, so other companies don't notice.
In my country that's how politicians and their friends get filthy rich. They know ahead of time where a new highway will be planned so they buy up all the rural land in that area for cheap so that the government will have to buy it from them at inflated prices to build the highway. Then, if a new government comes to power before the highway starts construction and realize they don't have any land where the highway will be built, they cancel the project and re-plan it on another route so that this time they can be the ones getting a cut. So this keeps getting repeated and the country ends up with no highways, but at least some people get obscenely rich.
Otherwise I agree, but in my country they do it differently,... government needs a building for X, someone close to someone in the government buys it for eg. 2mio eur, holds on it for a year or two, before a tender comes out (governments are slow), and 'coincidenetally' that building is the best match and the government buys it for eg. 7mio eur from that guy. (and then they split the difference).
The actual crime is using "Material Nonpublic Information" [1] and it does not matter how you obtained it. So, asking an employee what they're building and they ignore the confidentiality agreement to tell you - Nonpublic. Stalking surveyers from public land to find the lots they're commonly around - public.
[1]: https://www.investopedia.com/terms/m/materialinsiderinformat....
> it does not matter how you obtained it
Yes, it does. It's just that it's more nuanced than the naive interpretation would lead you to believe.
> asking an employee what they're building and they ignore the confidentiality agreement to tell you
In the parent's description of this, it is almost certainly the case that you would have no duty of trust or confidence to the person that told you. In that case, it would be fine for you to trade on it (well, assuming you weren't otherwise restricted from such trading).
You can learn more here: https://www.law.cornell.edu/cfr/text/17/240.10b5-1
> (b) Awareness of material nonpublic information. Subject to the affirmative defenses in paragraph (c) of this section, a purchase or sale of a security of an issuer is on the basis of material nonpublic information for purposes of Section 10(b) and Rule 10b-5 if the person making the purchase or sale was aware of the material nonpublic information when the person made the purchase or sale.
Not a single word describing "how". Its just did you have nonpublic information.
Maybe the law is too dense. Here's another analysis of the law for you to consider: https://federal-lawyer.com/the-ultimate-guide-to-the-federal...
From there:
"federal courts have interpreted Rule 10b-5 to allow for enforcement action when the following four elements are satisfied:
Breach of a fiduciary duty or violation of a relationship of “trust and confidence” in connection with the purchase or sale of a corporate security;
Use or possession of material nonpublic information in connection with the purchase or sale of a corporate security;
Knowing or reckless use of the material nonpublic information when purchasing or selling the corporate security at issue; and,
Reaping a personal benefit as a result of the purchase or sale."
And again, whether there's a duty of trust or confidence to the source of the information is a key factor in whether it can be traded on legally.
If you're at the airport near google HQ and you the CEO of a struggling AI startup arrive and hail a taxi to the google offices, and you think an acquisition might be on the cards? You're free to trade on that information, anyone in the airport could have recognised that guy.
Some complexity arises because insiders aren't allowed to tip you off. If you're golf buddies with the CEO of a struggling AI startup, and he tells you he made a business trip yesterday and Moffett Field is a great airport? If you figure an acquisition is on the cards and trade on that, it's insider trading.
The wild west ways of the banking sector is finally catching up to them.
If someone knew I was negotiating some business that day, phished an email with whatever account number he wanted and AI faked my voice, he'd get the money transfered.
So yeah... another thing to worry about.
Did the email come from within their own domain? Like a properly set-up domain isn't going to let you spoof their employees so your emails to the CEO will be authoritative since they came from the correct domain (assume your CEO checks its ycombinator.com and not ycombimator.com).
At 4k though I suspect it's not that worthy of a target when you can do the same effort to net 25 million. Although I'm a bit surprised there isn't some internal page to add/remove the hardware requests so that it can be easily accounted for by accounting.
[1] https://www.lebensmittelzeitung.net/handel/nachrichten/immob...
It doesn't seem so different to any mixed-use project where a developer might construct a tower that is partly residential, partly commercial. Pretty sure a lot of large companies purchase residential around any major new HQ they intend to open, too.
Its a company with revenues of a couple of billion and that probably sub contracts thousands of other companies on projects around the world. The finance department is probably sending similar payments regularly.
Most payments will be "secret" in that the amounts won't be made public to employees that don't need to know. The company maybe, for example, be repeating work that has been already been done in house so doesn't want it known inhouse what companies are being paid.
hell i do this if our tester hasn't managed to go over some aspect of our release. That way i get in writing from the product owner that he has OKd it, and if he sends me a teams message i ask him to email me confirmation.
https://thedailywtf.com/articles/special-delivery
It is written well enough that I could just about convince myself this actually happened!
Electronic engineers spent decades overcoming thermal noise floors so that humans could communicate over vast distances with small amounts of energy.
AI researchers, in a few short years, undid all that by making computer-generated chatter and images indistinguishable from messages sent by humans.
Until such a time as we live in a Bladerunner-like world of Replicants, being in-person will be the only reliable way to convey a message from human to human.
I'm long on travel and in-person meetings, short on VR and telecoms.
I am not in the finance department, but in software engineering and operations, two-party controls are everywhere. I can't check in code without reviews. I can't access production systems or make changes without approval from another team member. I would think that similar processes could be put into place for transferring tens of millions of dollars.
In other words, there are ways to deal with this that don't come down to "mistrust all technology and revert to face-to-face meetings and handing cash to each other".
Then I'd set up a short-notice multi-way meeting between the target, the CEO and the hacked account. The deepfake 'CEO' then turns up with no alarms raised, except one wrong name - easily dismissed as a glitch, or an assistant having booked the meeting.
I took the GP comment to mean truly in-person, like face-to-face across a table
That's a false dichotomy. "computer-generated chatter and images" ARE messages sent by humans. There are no cases of computers having agency known to me yet. The root of the problem is humans who lie and mislead. Now they merely have more avenues to do so. In the same vein, you could blame the electronic engineers for allowing people to lie quickly and over vast distances.
And that most people have no idea how to verify any ID, so they need a system that turns any given form of ID into a nice and simple "yes" or "no".
I'm not at all clear what kind of ID is going to be genuinely useful for video calls, given we should only be trusting existing contacts anyway? But those things are why "private key" isn't sufficient in isolation.
I mean - we have authentication for bank accounts, why wouldn't that be demanded for transactions like this? Without proper authentication of the authorities there's no way that a transaction like this should be put through.
And I have to mention, Tesla robots are way behind the competition, it's not even clear if their robot does anything really on its own, given how much they fake their videos of it with "creative" editing.
Just an inside job.
If a large company allows a single employee to transfer millions to a new bank account/vendor that has no history, on "their belief" the instruction came from an approved person (i.e. their boss, CFO etc) - that company has major governance issues that are not related to deepfake.
Imagine the more simple scenario - an employee transfers millions, knowingly fraudulantly, to some people they are working with. They then simply supply some "deep fake" pictures and a story how it was an accident - and boom; you walk away with millions.
Checks and balances exist for many reasons - deepfake doesnt overcome those by itself. This company is just missing basic steps that would have protected itself here.
edit: in fact- its even more obviously some inside job; put the deepfake aside for a moment. How was the meeting even booked? Their PR person said "none of our internal systems were compromised". So this meeting magically appeared in someone's calendar? Using their internal video system (Skype or Teams or whatever). And the criminals knew to target this person, with enough knowledge of random office people to deep fake them? Come on...
I hate discussing deepfakes. I'm one of the original patent holders of automated actor replacement technology. I developed it for personalized advertising, after having been an actor replacement specialist in a bunch of VFX film you probably saw.
I spent from 2002 to '08 creating a VFX pipeline, with global patent protections, and an ethical guidance that included public education on this fundamental new technology. Long story short, I needed financing, went to VCs and angels and they were perfectly winning to fund a porn company, but not what I'd planned: an ethical rollout of a sensitive and very powerful technology with many legs, few realize even today.
By '13 I was bankrupt, burned out, and one of my tech partners, a global leader in facial recognition hired me. That's a different story. Actor replacement technology is a fundamental capability with applications far more important than fraud and pornography. But our civilization is far far too immature to realize any of them.
Well, yes, that's kind of what the rest of us have come to expect from the industry. Ethical rollout is always going to take a back seat to raking in as much money as possible. I'm slightly surprised they were willing to touch porn though, not for "ethical" concerns but because it's treated as radioactive by payment services.
The UI really could stand to be more assertive about what they mean though.
The bank workers are normally quite understanding - except when it is someone from fraud detection (and yes these are legitimate calls) and they tend to get odly defensive that I wont hand out my personal information.
Ideally they screen-record (can you do that in Android/iPhone?), so at least if it's really scam, they can say "but I follow protocol, here's the evidence".
Btw we once had a similar scam attempt. "The CEO" emailed Finance in great urgency to transfer money. Good thing the CEO was sitting next to the Finance lady. I was sitting next to them watching the horror turned comedy.