2023-10-25 DeepfakesIDV DG Meeting Notes

Alastair Treharne

Beruku Identity Limited

Andrew Hughes

Ping

 Present

Ashok Singal

Demystify Biometrics

Chris LaBarbera

Verizon

Denny Prvu

RBC Royal Bank of Canada

Iain Corby

SafetyTech Limited

 Present

Jay Meier

FaceTec, Inc.

 Present

Jim Pasquale

ChasmCrossing Solutions

Present 

Jordan Burris

Socure

Julian White

Beruku

Justin Byrd

N/A

Maxine Most

Acuity Market Intelligence

 Present

Mike Magrath

Easy Dynamics

 Present

Peter Davis

Airside Mobile, Inc

 Present

Pieter Van Iperen

Clear Secure

Heather Vescent

n/a

Present

James Monaghan

n/a

Present

Uttam Reddi

n/a

Present

Highlights of leadership planning meeting

Andrew

• For each content area leader - have other DG participants ‘sign up’

• Each content area to decide how to approach collecting a knowledge base and writing a draft for “baseline” content

  • NB: Knowledge base must form the basis for cited references!

• Max offers to coach content area leaders in approaches and ideas

• Need a more solid description of what problem we are trying to solve

  • Pitch towards purchasers of IDPV, evaluators of IDPV, business operators of IDPV

  • “We will provide information and understanding that empowers ‘buyers’ to identify what problems they can solve with IDPV, how to choose between systems/features, what outcomes they can expect, data protection risks of biometric data (and the threshold-based nature of biometric data), and how to approach integration into existing operations.”

Discuss first rough drafts of “explainer text”

Andrew

• Andrew showed the first cut draft text for “IDPV System” and explained that this is a trial balloon to test whether the group feels that this level of description is valuable to advance our mission or whether a different level for the baseline is needed

  • Generally positive reactions in the group

• There is an underlying assumption that the target audience is from the “identity” community - this might be improved by considering target audiences from the “IT security” community as well - they may not be aware of IDPV

  • e.g. use the visuals and structures that the target community normally uses to express this material (e.g. attach chains, value chains)

• The main idea behind the “core concepts and description” material is to establish a core set of plainly-worded facts about the topic area.

  • Written in neutral language and mostly jargon-free

  • “Descriptions” and “explanations” not “activities” or “definitions”

  • When the group wants to generate material for a particular target, we should be able to take these core facts, go deeper, tailor language, combine with other core facts into content that is very consumable by the target audience

  • Rationale, “who cares”, and other context can be added at audience targeting time - the core material is not intended to be published directly - it should always be tailored.

Shift to discussion about segmentation and audiences

• Think of what pre-conceived assumptions we bring

Topic area assignments (https://kantara.atlassian.net/wiki/spaces/DGDF/pages/261914626 for full list):

1. Jay to start writing conceptual descriptions of the core concepts
2. Andrew to take IDPV (what it it, how it works today, current attack/threat vectors, current countermeasures, how does widely-adopted AI accelerate current attacks or create new attacks)
3. James M to take AI topic area
4. Heather - Hacker motivations (social engineering), payloads, simulated humans, synthetic identity

Discussion about a better way to organize topic areas - matrix approach:

• Topic areas should be centred on how each relates to IDPV Systems

• “XXX in the context of Identity Proofing and Verification Systems”

Examples:

• Audio as a mechanism used by IDPV systems - it is a core topic

• Data verification as a mechanism used by IDPV systems - it is a core topic

• Biometric matching as a mechanism used by IDPV systems - it is a core topic

• Biometric liveness detection as a mechanism used by IDPV systems - it is a core topic

• “AI” in the context of the other topic areas - it is a cross-cutting concern

• “Prevention” in the context of countermeasures for other topic areas - it is a cross cutting concern

Then for each topic area, the leader will work towards a foundational descriptive set of facts that cover:

• What is the topic?

• How is it done today?

• How is it vulnerable to attacks and threats today?

• What defences or countermeasures exist today?

• How does “AI” accelerate attacks, introduce new attacks, and improve or degrade the IDPV topic area?