Latest / The Road to Accountable AI / Blake Hall: Safeguarding Identity in the AI Era

Transcript

Blake Hall: Safeguarding Identity in the AI Era · The Road to Accountable AI

• 0:00
  Blake, welcome.
• 0:01
  Thank you so much for joining me on the podcast.
• 0:03
  Thanks for having me, Kevin.
• 0:05
  Why don't we start by having you tell us what are some of the major areas of online fraud and identity theft that you're seeing out there today?
• 0:17
  Sure, so just for context, IDME provides a single sign-on.
• 0:21
  We protect 21 federal agencies, hundreds of private sector brands, including a lot of Fortune 500 companies, and have over 150 million users.
• 0:32
  So we see broad secular trends across the market.
• 0:35
  When AI first emerged in 2022 to 2023 with these large language models, the impact in terms of our network was pretty...
• 0:46
  Unbelievable.
• 0:46
  There were 190,000 wallets on our network, which are what we call our user accounts that were targeted for account takeover in the summer of 2022.
• 0:57
  The same 90 day period in 2023, 1.3 million.
• 1:03
  And you could see these tools on the dark web that were popping up, uh literally called fraud GPT and worm GPT.
• 1:10
  where uh we're not dealing with your grandpa's Nigerian prince email where the grammar's all wrong and everything.
• 1:18
  They can now scale, these threat actors can now scale social engineering attacks um at a level that I didn't think was possible beforehand and their batting average is going up
• 1:29
  too because the quality.
• 1:31
  of these attacks is so much better and is really bespoke to the victim that they're targeting, whether it's crypto or a real estate scam or romance or a job scam.
• 1:40
  So the FTC data reflects that and young people are actually more at risk of being scammed today than older people, which reverses maybe some longstanding sort of intuitive biases
• 1:52
  that folks might have.
• 1:55
  So you've been at this for a while, since 2010, I believe, at ID.me.
• 1:59
  You talked about the ways that the challenges go up with generative AI.
• 2:03
  What does it take to combat those threats?
• 2:06
  Sure.
• 2:06
  um Yeah, so text was just the beginning.
• 2:08
  We've now seen it move into uh video and voice and different forms of media.
• 2:14
  I think there's all sorts of discussions right now about Sora as a tool.
• 2:19
  Some folks are saying it just isn't safe because it can be weaponized to hurt people and to assume their identities.
• 2:26
  um But you're right.
• 2:28
  uh I've been at this for 15 years now.
• 2:30
  Love identity.
• 2:32
  RY um is keeping people safe.
• 2:36
  And if you're able to keep people safe and customers for that matter, too, you can start to bring programs online that would otherwise be offline.
• 2:44
  And when you do that, you include more people in the digital economy, you make their lives better.
• 2:48
  ah And that's a really meaningful mission for us here at IDME.
• 2:52
  And it is why we're focused on we're focused on.
• 2:56
  think there's a few different ways that you can prove your identity online.
• 3:02
  And there's a simple framework of knowledge based ways.
• 3:06
  biometric based ways and possession based ways.
• 3:10
  The knowledge uh based methods at this point are not super useful.
• 3:15
  There have been so many data breaches and now with AI and these bot networks that threat actors have, it is trivial for them to answer questions that are actually true about you.
• 3:27
  And so the battleground is really moving to possession based methods and biometric based methods where we stop.
• 3:35
  two North Korean threat actors a week now from getting hired at various companies and critical industries.
• 3:41
  And they're using very sophisticated deep fakes of government IDs.
• 3:46
  They're assuming their targets face and biometrics.
• 3:50
  So there's a class of technology known as presentation attack detection or liveness, both for documents and for humans that really gets at, I looking at authentic media or
• 4:05
  deep fake generated media and that class of technology has never been more important than right now because human beings with our sensors, we are outgunned.
• 4:15
  um And so it really is the bleeding edge of cat and mouse of deep fake technology versus technologies that can sense things that we weren't meant or designed to sense in order to
• 4:28
  uh see if something's uh legitimate or malicious.
• 4:32
  Can you sketch out a little bit more how it's possible to make that differentiation if you see an image that looks exactly like a real person?
• 4:39
  That's a great question.
• 4:40
  So it really will depend on the type of media that you're dealing with.
• 4:44
  if you were to take a face, for instance, your face is made out of material that refracts light differently than, let's say, an iPad that's showing a video of you that's playing,
• 4:56
  or a mask, or some of these synthetic disguises that we're able to see.
• 5:02
  So one technique might be for face, you generate a randomized color pattern in the way that
• 5:09
  the human face refracts light is different from these other types of materials.
• 5:14
  And the reason it's randomized is to prevent replay attacks.
• 5:16
  So they can't kind of see how you're going to generate and administer that test.
• 5:21
  For something like a government issued photo ID, there's different tests that get into materials analysis, stitching analysis.
• 5:28
  You're looking at, know, exif data on the photo, uh which gives the geolocation.
• 5:33
  So if a threat actor was sloppy and had altered the headshot image,
• 5:38
  and you see something like Lagos, Nigeria pop up where there should be no location data on that image other than what the user had submitted uh when they were capturing the
• 5:48
  artifact, then those are all examples of verification methods that the technology will um look for when they're trying to assess if um the evidence that's being presented is what
• 6:01
  you think it is or if it's synthetic.
• 6:05
  And how much of that do you as a company have to push the frontier on versus researchers developing these kinds of techniques and it's really a question of implementation.
• 6:17
  Yeah, so our stance, like what we're doing that is new is we're building a digital twin to a physical wallet.
• 6:24
  and when I look at the supply chain, I would be full of hubris if I were to believe that ID.me could be the best at presentation, attack detection, document verification, face
• 6:34
  recognition, you you name it.
• 6:36
  And so what we do is we use best of breed vendors.
• 6:41
  So a lot of what we do around biometrics, for example, are
• 6:45
  We look at the test results from the Department of Commerce and NIST, and we look at the test results from the Department of Homeland Security.
• 6:52
  And so lot of the component vendors that we're using um not only have like really dedicated research teams and these companies themselves are worth hundreds of millions to
• 7:01
  billions of dollars, but their efficacy and their impact in different demographic groups has also been tested and validated by the great computer scientists and civil servants
• 7:10
  that we have at DHS and at the Department of Commerce and NIST specifically.
• 7:14
  oh
• 7:15
  We're constantly looking for who's got the best component technology that ultimately um does what NIST is after for our world, which is proving that you're you.
• 7:26
  And that's prevent a remote and scalable attack on systems.
• 7:31
  Because the moment that you bring um a manual process online, the attack surface is now global.
• 7:38
  And you can have folks from Southeast Asia and West Africa and...
• 7:42
  Eastern Europe where lot of these transnational criminal groups are located that can reach out and touch you.
• 7:47
  So we are constantly um using best debris technology and looking as attacks iterate to try to make sure that we're keeping people and customers safe.
• 7:59
  Where are some of the areas that you're investing?
• 8:01
  Now you just raised a large funding round.
• 8:04
  What are you focused on going forward?
• 8:06
  Sure.
• 8:07
  So, you know, one of the biggest ones is glass half full and glass half empty.
• 8:12
  So it's this presentation attack detection technology that is really useful when it comes to understanding if someone is who they're claiming to be or not.
• 8:23
  There's a stat right now that it's something like 95 % of fraud in the industry comes from a device that's new to somebody's account.
• 8:33
  And so some of these signals that you can pick up can really help protect people from social engineering because, you know, while there's been a lot of attention, our space and
• 8:45
  like mobile drivers licenses, and I think Apple just announced, you can add, you know, any passport to your digital wallet.
• 8:51
  That's great.
• 8:52
  80 % of the fraud that we face right now that's targeted at the federal government, the United States is scams.
• 8:58
  social engineering.
• 9:00
  they're not actually technical attacks, they are human attacks.
• 9:04
  um so, you know, someone might be going through an unemployment agency, because they think they're getting hired um for a job, and that this attacker needs to go over to the state
• 9:15
  unemployment agency, that's what they're telling them to file their identity.
• 9:18
  So they coach them through this process.
• 9:21
  And so a lot of what we're doing on the machine learning models is figuring out, you know,
• 9:26
  If I've got like an iPhone over here and a Samsung Galaxy over here, that doesn't make a lot of sense because people don't generally use two different types of smartphone when
• 9:35
  they're going through this process.
• 9:38
  And that's a very simple example.
• 9:40
  We have so many signals that we're using to really understand if someone is being scammed or social engineered, even if it is themselves, in order to get access.
• 9:51
  And right now our help desk tickets and things um
• 9:55
  You know, it can take like 45 minutes to help these folks because there's often feelings of deep guilt and shame.
• 10:02
  So the more that we can automate this and detect scams upfront before there's any harm, that's really important.
• 10:09
  uh And while there's some important innovations going on in the world of like RUU, even if you've beaten the deep fakes, you still have to fight these scammers who are hacking uh
• 10:20
  humans as kind of the weakest link in the chain by manipulating them emotionally.
• 10:23
  uh
• 10:25
  The other side of maybe the more positive side is really thinking about how you can reinvent government service delivery and innovation um in a positive way.
• 10:37
  uh there's been a lot of talk about tokenization and what do tokens mean.
• 10:42
  uh And for AI specifically, a lot of conversation about prompt engineering.
• 10:47
  Now, I think if you called prompt engineering context engineering, it would make a lot more sense.
• 10:52
  So here's a concrete example.
• 10:54
  If you're a victim of a natural disaster in Florida and you've been displaced from your home by a hurricane, your family's in some gym somewhere, you got the family dog, you're
• 11:02
  lining up in front of trailers to prove who you are, you know, uh several hours per trailer, that's how it works.
• 11:09
  To the extent that we um understand that you're you, we uh buy your zip code, might know the median income of folks who live in that zip code.
• 11:21
  We also
• 11:22
  know all the organizations that are involved with disaster relief from FEMA to Department of Labor to HUD um to the various insurance companies that are involved.
• 11:33
  You don't have time in that situation to research all the different benefits and resources that are available to you.
• 11:39
  So if you can use tokenized identity to not only prove that Kevin is Kevin, but also may we have your permission to kind of surface all the different
• 11:50
  resources and programs that are relevant to you right now, ah that would be really amazing for people in terms of letting them know what's out there instead of researching
• 11:59
  government and then what they want to apply.
• 12:01
  If their identity, all they have to do is give consent.
• 12:04
  That's what we think the world should look like.
• 12:06
  And so we're very focused on that as a positive outcome, even as we're trying to hold off this like zombie horde on the.
• 12:14
  And just to remind you, tokenized identity essentially means that you can verify that this is a real person without giving out all their data to the third party.
• 12:22
  Yeah, the token could really be almost any facet of your identity that you might imagine, you know, so it could be like you might have an e commerce profile, which might be your
• 12:33
  email and your billing and shipping address.
• 12:35
  You have your legal profile, which is kind of your base profile as a citizen, which might be your name and your date of birth and your social and your, you your address.
• 12:44
  um You might have an automotive profile, housing profile.
• 12:49
  It could be any number of tokens and
• 12:52
  In our model, we don't sell data.
• 12:54
  We sell trust.
• 12:55
  If we create these tokens, then based on the use case of how that token is going to be used, we will apply privacy filters to make sure that you're not asked to overshare
• 13:04
  information.
• 13:05
  ah So if you think about like your driver's license is this piece of plastic with all these attributes and it doesn't change, like it's laminated.
• 13:14
  So you have to overexpose data in every use case.
• 13:18
  But the cool thing about digital credentials,
• 13:21
  is that if you're going into a bar, we really want to mask everything except for your face and the claim that you're over 21.
• 13:28
  If you're going over to the government to get benefits, though, and they need your social to match you in records and to look it up against Social Security, then that's going to be
• 13:37
  a much more expansive payload.
• 13:39
  um As long as those payloads are dictated by use case where there's a legitimate need to ask the person to share and then also things are hidden.
• 13:51
  by default when they're not relevant to the use case and the transaction, we think that's really neat.
• 13:57
  And it's kind of how banking and credit cards already work.
• 14:00
  You give your social to your bank, but the merchant just wants the thumbs up for credit or debit.
• 14:06
  So it's a very similar kind of model, if you will, that banking and the credit card networks have already pioneered.
• 14:12
  that put you as ID.me in a very powerful position in the middle and also position where you've got access to all of this data so everyone has to trust you.
• 14:21
  Yeah, no doubt.
• 14:22
  It's, you know, the heart of what we do is trust.
• 14:24
  And certainly there's a lot that goes along with it.
• 14:27
  That's why we partnered with the Department of Commerce and NIST upfront to make sure that the way we're architected and the way that we were applying this technology was in line
• 14:35
  with em a better world, you know, so to speak, because the way that I look at it.
• 14:40
  em
• 14:42
  The Chinese military breach Equifax database in 2017 with all the other data breaches, you could go on the dark web right now and all of your personal information is available to
• 14:50
  threat actors for less than the price of a Chipotle burrito.
• 14:54
  So that's gone.
• 14:56
  Then you look at the world in terms of consolidation, like faceless data brokers that folks have probably never heard of that are out there have also harvested all of your
• 15:06
  information and sell it in all these different ways.
• 15:09
  And then when you look about the service delivery,
• 15:11
  Every organization that you deal with, it's Conway's law on steroids.
• 15:16
  Conway's law is this sort of rule that you ship products based on your org chart and your bureaucracy instead of from the perspective of the humans that you're serving.
• 15:27
  And so everyone's like, you know, it's my login, it's my data.
• 15:31
  And ID.me's approach is different.
• 15:34
  When I looked at um how people use their wallets, maybe the economist in me, it's your wallet.
• 15:42
  It's your ID, it's your credentials.
• 15:44
  And so we said, given that everyone has your data and control of it, except for you, how about we create a network that's focused on Kevin and on everyone else where we will never
• 15:55
  sell data.
• 15:56
  What we do is sell trust after you give consent and that you are then empowered to have a login and a wallet in your credentials that move with you.
• 16:06
  And this is already happening in the Nordics with BankID in Estonia.
• 16:10
  with EID, our co-founder is Estonian.
• 16:12
  And so while there's tremendous responsibility that goes along with it, um the principles, the values, the behaviors that we do and don't engage in is very, very different from
• 16:23
  these data brokers and other companies that dominate the space right now.
• 16:27
  What are some of the other challenges about working with government agencies and public sector service delivery?
• 16:35
  Well, I mean, you know, it takes forever to be able to do business with them.
• 16:40
  And I feel like the more I learn about procurement in the public sector, the less I understand.
• 16:46
  So the running joke with the IRS was like, Hey, guys, I stopped measuring the sales cycle and in terms of weeks and months and instead by the number of children I fathered, which
• 16:54
  is three.
• 16:55
  But, the benefit is that in this market in particular,
• 17:02
  All of our trusted identity credentials come from the government, whether it's a passport, a driver's license, the military ID, a permanent resident card, all of the IDs that we use
• 17:12
  to prove that we're us, they come from the government.
• 17:15
  um you know, this initiative of digital identity, it has started underneath the Bush administration with e-authentication.
• 17:22
  was continued underneath President Obama.
• 17:25
  It was called the National Strategy for Trusted Identities in Cyberspace, NSTIC.
• 17:30
  And then now under the Trump administration too with OMB policy, it's, it's, if government can foster a secure and inclusive, um, model for identity, then that will also help with
• 17:42
  financial services, inclusion, and with healthcare inclusion.
• 17:45
  so even though it took forever, uh, to change and to help some of these agencies, the payoff is that if you can include more people in digital services and do that safely,
• 17:57
  you could fundamentally change quality of life and outcomes for the 45 million Americans who are unbanked and who are underbanked.
• 18:05
  And we really think that's a worthy mission, ah even though there's a lot of blood, sweat and tears and just frustration with dealing with the government.
• 18:14
  Do think we can overcome the fear in this country of uh government having too much surveillance power?
• 18:21
  Many other countries have a national ID and you describe why we can do it in a privacy protective way, but there still is that concern.
• 18:28
  ah I think the answer is maybe.
• 18:30
  ah TBD, the issue that I think um gets in our way is that people hear the same words, but their brains process it in different ways.
• 18:42
  And maybe it's the military officer and me, I think we need a very structured way to say, what problem are we trying to solve?
• 18:49
  And what's the correct architecture instead of trade-offs for that?
• 18:53
  So the way that we think about it at ID.me, that if we are going to overcome it,
• 18:57
  This is the only way where we explain uh how the technology and the architecture solves problems in people's lives.
• 19:05
  If the risk is financial, we think that you have to be server side to see transactions.
• 19:12
  And if you think about like, why does your bank see where you spend money?
• 19:16
  Why do the credit card networks have visibility into that as well?
• 19:19
  It's because we've decided that you're not gonna be on the hook if your credit card is compromised for 5,000 bucks that some threat actor took on a shopping spree.
• 19:28
  And so for that reason, the merchant who's defrauded the bank, who's on the hook for the funds too, and however they're gonna sort that out, they have visibility into what
• 19:37
  happened.
• 19:38
  so that they can make sure that there's some iteration and feedback to protect themselves from the financial losses that they're going to suffer on your behalf.
• 19:47
  If the risk, on the other hand, is moral and it's not financial, we think that needs to be client-side.
• 19:53
  So examples of moral risk would be like adult websites where you want to show that somebody is over 18 years old or kids in social media.
• 20:02
  we would never want a server-side architecture that associated someone's real-world identity with the types of pornography that they're looking at.
• 20:11
  And so I think um having clear architectures that are use case driven that say, look, if it's your 401k balance on the line, you're darn right, like we're going to be server-side.
• 20:23
  if
• 20:24
  You get scammed and you need help.
• 20:25
  We're going to be there to help you and we're going to be there to work with that, you know, 401k plan provider to make sure they understood, understand what happens to you.
• 20:32
  Cause so we can keep people safe.
• 20:33
  If you want to go look at adult websites in your own time, you know, this is the, what happens in Vegas stays in Vegas.
• 20:38
  Like we, we never want that to touch our logs.
• 20:40
  Here's how token on device architecture, you know, would work.
• 20:45
  I think maybe crypto is a little bit of a in-between space because I would never see the government or a bank saying client side only.
• 20:52
  There's no audit trail if I get to fraud.
• 20:55
  But in crypto where it's P2P, you could see two counterparties saying, look, we're fine with the risk.
• 21:00
  We know if something goes wrong, no one's there to help us.
• 21:03
  And as consenting adults, like we're just going to go for it here and let the chips fall where they may.
• 21:08
  I think, so I think by industry and also by use case, you really have to
• 21:12
  breakdown, like what problem are you solving?
• 21:15
  And then the Venn diagram of security, privacy, consumer protections, all these things that you want to try to balance for.
• 21:22
  You're not trying to do it as a one size fits all.
• 21:25
  You're doing it against this very specific grouping of problems that you're trying to solve.
• 21:32
  And back to AI, you talked about some of the technologies that are out there to deal with the deepfake challenges, but of course, AI keeps getting better.
• 21:43
  What gives you confidence that the good guys will be able to keep up with the bad guys?
• 21:49
  Yeah, well, I think um there's a few things.
• 21:53
  The first is some of these like presentation attack detection technologies, like the one for face in particular.
• 21:59
  We've actually never seen that defeated.
• 22:01
  And we have pretty strong feedback loops that if there is fraud or something happens to an organization.
• 22:06
  So in terms of preventing civil attacks right now, the good guys are on the right side of that particular technology.
• 22:13
  Doesn't mean that we'll be on the right side of it tomorrow.
• 22:16
  But so far, so good.
• 22:18
  um I think the other side that consumer-centric wallets bring to the table is you bring the user into the loop.
• 22:26
  So um again, if you think about the primitive identity networks where if a bank sees suspicious credit card activity, it can send you a text and say, hey, Kevin, is this
• 22:35
  authorized?
• 22:37
  I think digital wallets can also start to play that function.
• 22:40
  So if your identity is being asserted at a bank,
• 22:44
  at a government agency for benefits to apply for some program, if there is essentially some registry where you can say, notify me about that before you process it, that's really
• 22:56
  amazing.
• 22:57
  Right now it takes the IRS two years to investigate every single case of identity theft.
• 23:03
  And that process for victims is over 40 hours per investigation.
• 23:08
  So.
• 23:09
  The more that you have folks enrolled into a digital wallet, whether it's ours or one of our competitors, and there's a clearinghouse for notification that lets them say yes or
• 23:21
  no, that's to me is the only way that you solve for this over time, that you enroll folks, you get them into pass keys.
• 23:29
  Now we know with really strong security that this is Kevin.
• 23:34
  And if you have a consumer right to be notified of when your identity is being used in a regulated market like healthcare, government or finance, then you can crowdsource the
• 23:43
  fraud prevention.
• 23:44
  I think ultimately that's the only way to solve it and is a big part of why we're doing what we're doing.
• 23:52
  How do you use AI yourself?
• 23:55
  my goodness.
• 23:55
  Yeah.
• 23:56
  So there's, there's so many different ways um for the research functions that, chat GPT offers when you just want to like really understand something, um, and just have all the
• 24:07
  different sources laid out for you.
• 24:08
  It's an incredibly powerful feature.
• 24:12
  turning on deep research, walking away, grabbing a cup of coffee, coming back and you know, look, it'll still get some stuff wrong, but just having all the links and sources
• 24:20
  laid out where you can do your primary research right there.
• 24:24
  is an amazing thing.
• 24:25
  um When you start to go back and forth, whether it's like Claude code or also um OpenAI, I messed around with Brock a little bit for things like data schemas.
• 24:37
  So when we're actually modeling out like how do different objects connect, they are incredibly powerful for getting a head start.
• 24:44
  There's a lot of slop in there.
• 24:45
  um But it gets rid of a lot of the rote work of a first draft.
• 24:52
  And the experts who get in there can be like, wow, this is super useful.
• 24:55
  And this would have taken me a ton of time.
• 24:57
  It's like low value work that I can just move right through.
• 24:59
  And now just auditing it.
• 25:01
  And I think on the UI side, you've got tools like Replet and things like that that make iteration.
• 25:06
  Figma Make has become very popular in our company where you can do visual prototypes.
• 25:11
  And that's just going to speed up product development because you can get engineering involved on the same day.
• 25:18
  of a visual prototype instead of having to hand off uh these designs to designers and then they come back, there's some communication tax.
• 25:26
  If you just have a design system, you can have like a full stack product manager essentially who can go from idea to visual prototype to code very quickly.
• 25:36
  So uh Figma, Claude, uh Replet and ChatGPT are all mainstays and tools that I use.
• 25:46
  um You mentioned a couple times some regulatory activity or various governmental initiatives in the IDA area.
• 25:54
  What do you think we need or should have in terms of uh additional government activity?
• 26:02
  There's a, oh, I think the first thing is that government really has a responsibility when it comes to identity to help validate attributes.
• 26:13
  um So right now, when it comes to like name, of birth, social security number, this is social security's canonical identifier for all of us.
• 26:22
  It's very difficult um for
• 26:25
  uh entities that are involved with the government itself and you know in finance to even know if a name date of birth social is a valid combination and and for that reason that's
• 26:37
  why synthetic identity theft which is where bad guys make up fictitious name states and birth socials they literally created a multi-billion dollar economy for fraud where there
• 26:47
  honestly shouldn't be any if if we just had
• 26:52
  these data sources where regulated entities could query and get a thumbs up or a thumbs down as to whether or not that identity really exists in the real world.
• 27:02
  Data brokers end up.
• 27:04
  exploiting a lot of this stuff because what they'll do is they'll hoover up a lot of data from DMVs and they'll like resell it to the government itself.
• 27:10
  And so I think what you have in Australia, they have a document verification service where from your birth certificate to a driver's license, there's a government clearinghouse that
• 27:22
  you could just go and see if that unique document actually has been issued by the government in the world.
• 27:29
  And that does a tremendous amount to add trust.
• 27:33
  to the extent that we could create some of these, this isn't like a dossier in your activity.
• 27:39
  It's just like corroborating that a real world person with like this document number exists in the world to separate all the counterfeit IDs from those that are real.
• 27:50
  That type of service would be incredibly powerful and would literally take away, um, billions of dollars of fraud.
• 27:58
  And so.
• 27:59
  I'd love for us to start there.
• 28:01
  And then I'd love for us to also invest more in initiatives to get people um into credentials that are more secure.
• 28:10
  every Estonian, and granted it's only 1.3 million people, but every Estonian, they have a PKI credential that is a pass key.
• 28:17
  And their government ID also doubles as like an ATM debit card, as a transit card.
• 28:22
  There's a lot of consolidation in terms of form factors.
• 28:24
  um
• 28:26
  We're incredibly rich, even though there's like 350 million plus of us.
• 28:30
  There's no reason why we couldn't embed some of these RFID chips into drivers licenses the same way that the State Department has embedded some cryptographically signed chips into
• 28:41
  passports.
• 28:42
  So between sort of identifiers, if you will, like API that you could corroborate whether a person or a document was actually existed and issued by the government to initiatives just
• 28:55
  get
• 28:56
  more secure tokens to people for free that help them establish that they are who they're claiming to be when they go online.
• 29:04
  I think the ROI and those dollars spent would be just unbelievably high.
• 29:08
  And last thing, looking forward, companies are increasingly deploying agentic AI workflows.
• 29:14
  How do you see that interacting with this whole identity landscape?
• 29:19
  It's very exciting um because you got the LLMs, you got the agents.
• 29:24
  think the way that we think about LLMs are answer engines.
• 29:28
  So instead of search engines, like now you've got a query and the more identity tokens that you want to submit, you're going to get a personalized response.
• 29:36
  So for instance, if you're searching for like a particular type of drug at a pharmacy, if the identity token is your insurance and the copay and what that drug uh costs,
• 29:49
  um and also how much it costs at a particular pharmacy, you could have a different conversation with your medical provider.
• 29:56
  um Right now, a third of prescriptions are abandoned when people go to pick them up because they cost too much, they can't afford them.
• 30:03
  So that would be a very concrete example.
• 30:06
  When the agent goes to represent you, then you have to understand the workflows of various entities.
• 30:13
  I think...
• 30:14
  um When you think about tasks that are low hanging fruit, uh staying away from some of the complexity where if AI gets it wrong, we're all in trouble.
• 30:23
  But if you think about like low hanging fruit, like I just moved.
• 30:28
  I want to update my address and I would prefer not to go to like a hundred portals between my banks and my insurance and healthcare and just magazines and New York Times and
• 30:39
  government.
• 30:40
  just want like, I just want the agent to go do it for me.
• 30:43
  That's where ID.me could play a pretty amazing role where
• 30:48
  we can cryptographically sign that you're you and that identity token with, and then there's a consent trail.
• 30:55
  So if some sys admin goes, how do I know that Kevin authorized you to, you know, to update the address, they could look back and the AI agent would have this cryptographically
• 31:05
  signed credential that says, here's IDME, here's this department of commerce NIST, you know, IL2 level credential that the government itself accepts.
• 31:15
  And here's the consent trail that goes along with it.
• 31:18
  And so when you have the auditing underneath for trust, then uh man, ah you can really do some very powerful things without all the potential for harm that might be there if the
• 31:31
  agent's allowed to represent you without you in the loop.
• 31:34
  Thanks for joining me today.
• 31:36
  Thanks, Kevin.
• 31:37
  Appreciate you.