How to succeed at social media in this age of outrage

Samuel Stroud, the British blogger behind GiraffeSocial has posted a column taking a closer look at how TikTok’s algorithm works — at least how he thinks it works. But that isn’t the point of the post for you, dear reader: he has some good advice on how to improve your own social media content, regardless of where it lands, and how it is constructed.

Before I get to his suggestions, I should first turn to why I used the word outrage in my hed. This is because a new Tulane University study shows that people are more likely to interact with online content that challenges their views, rather than agrees with them. In other words, they are driven by outrage. This is especially true when it comes to political engagement, which often stems from anger, and fuels a vicious cycle. I realize that this isn’t news to many of you. But do keep this in mind as you read through some of Stroud’s suggestions.

You might still be using Twitter, for all I know, and are about to witness yet another trolling of the service by turning all user blocks into mutes, which is Yet Another Reason I (continue to) steer clear of the thing. That, and its troller-in-chief. So now is a good time to review your social strategy and make sure all your content creators or social managers are up on the latest research.

Stroud points out several factors to keep track of:

  • Likes, shares and comments: the more engagement from others, the higher a post is promoted. And this also means you should respond to the comments too.
  • Watch time: Videos that are watched all the way through get boosted
  • New followers: posts that generates new followers signing up also get boosted
  • More meta is betta: Captions, keywords, hashtags, custom thumbnails — all of these help increase engagement, which means paying attention to these “housekeeping” matters almost as much as the actual content itself.
  • Your history matters: if you have had previous interactions with this creator, type of content, or other trackable habits

Now, most of this is common sense, and perhaps something you already knew if you have been using any social media platform anytime over the last couple of decades. But it still is nice to have it all packaged neatly in one place.

But here is the thing. The trick with social media success is being able to balance your verisimilitude with your outrage. It is a delicate balance, particularly if you are trying to promote your business and your brand. And if you are trying to communicate some solid info, and not just fuel the outrage fires, then what Stroud mentions should become second nature to your posting strategy.

Time to do an audio audit

I am not a tin-foil-hat kind of person. But last week, I replaced my voice mail greeting (made in my own voice) with a synthetic voice of an actor saying to leave a message. I will explain the reasoning behind this, and you can decide whether I should now accessorize my future outfits with the hat.

Last month, Techcrunch ran a story about the perils of audio deepfakes and mentions how the CEO of Wiz, an Israeli cybersecurity firm that I have both visited and covered in the past, had to deal with a deepfake phone call that was sent out to many of its employees. It sounded like the CEO’s voice on the call. Almost. And fortunately, enough people at Wiz were paying attention and realized it was a scam. The call was assembled from snippets of a recorded conference session. But even the most judicious audio editing still can’t be perfect, and people at Wiz caught the unnaturalness of the assemblage. The reason for the difference had nothing to do with AI, but everything to do with human nature. This is because his speaking voice is somewhat strained, because he is uncomfortable in front of an audience, and that isn’t his conversational voice.

But it is just a matter of time before the AI overlords figure this stuff out.

AI-based voice impersonations — or deepfakes or whatever you want to call them — have been around for some time. I have written about this technology for Avast’s blog in 2022 here. The piece mentioned impersonated phone calls from the mayor of Kyiv to several other European politicians. This deepfake timeline begins in 2017 but only goes up to the summer of 2021. Since then, there have been numerous advances in tech. For example, a team of Microsoft researchers have developed a text-to-speech program called VALL-E that can take a three-second audio sample of your voice and be used in an interactive conversation.

And another research report, written earlier this summer, “involves the automation of phone scams using LLM-powered voice-to-text and text-to-voice systems. Attackers can now craft sophisticated, personalized scams with minimal human oversight, posing an unprecedented challenge to traditional defenses.” One of the paper’s authors, Yisroel Mirsky, wrote that to me recently when I asked about the topic. He posits a “scam automation loop” where this is possible, and his paper shows several ways the guardrails of conversational AI can be easily circumvented, as shown here. I visited his Ben Gurion University lab in Israel back in 2022. There I got to witness a real-time deepfake audio generator. It needed just a sample of a few seconds of my voice, and then I was having a conversation with a synthetic replica of myself. Eerie and creepy, to be sure.

So now you see my paranoia about my voicemail greeting, which is a bit longer than a few seconds. It might be time to do an overall “audio audit” for lack of better words, as just another preventative step, especially for your corporate officers.

Still, you might argue that there is quite a lot of recorded audio of my voice that is available online, given that I am a professional speaker and podcaster. Anyone with even poor searching skills — let alone AI — can find copious samples where I drone on about something to do with technology for hours. So why get all hot and bothered about my voicemail greeting?

Mirsky said to me, “I don’t believe any vendors are leading the pack in terms of robust defenses against these kinds of LLM-driven threats. Many are still focusing on detecting deepfake or audio defects, which, in my opinion, is increasingly a losing battle as the generative AI models improve.” So maybe changing my voicemail greeting is like putting one’s finger in a very leaky dike. Or perhaps it is a reminder that we need alternative strategies (dare I say a better CAPTCHA? He has one such proposal in another paper here.) So maybe a change of headgear is called for after all.

Distinguishing between news and propaganda is getting harder to do

Social media personalization has turned the public sphere into an insane asylum, where every person can have their own reality. So says Maria Ressa recently, describing the results of a report from a group of data scientists about the US information ecosystem. The authors are from a group called The Nerve that she founded.

I wrote about Ressa when she won the Nobel Peace prize back in 2021, for her work running the Philippine online news site Rappler. She continues to innovate and afflict the comfortable, as the saying goes. She spoke earlier this month at an event at Columbia University where she covered the report’s findings. The irony of the location wasn’t lost on me: this is the same place where students camped out, driven by various misinformation campaigns.

One of the more interesting elements of the report is the crafting of a new seven layer model (no, not that OSI one). This tracks how the online world manipulates us. And starts off with social media incentives which are designed around promoting more outrage and less actual news. This in turn fuels real-world violence, then amplified by efforts of authoritarian-run nations who target Americans and polarize the public sphere even further. The next layer changes info ops into info warfare, feeding more outrage and conflict. The final layer is our elections, aided by the lack of real news and no general agreement on facts.

Their report is a chilling account of the state of things today, to be sure. And thanks to fewer “trust and safety” staff watching the feeds, greater use of AI in online searches by Google and Microsoft, and Facebook truncating actual news in its social feeds and as a result referring less traffic to online news sites, we have a mess on our hands. News media now shares a shrinking piece of the attention pie with independent creators. The result is that “Americans will have fewer facts to go by, less news on their social media feeds, and more outrage, fear, and hate.” This week it has reached a fever pitch, and I wish I could just turn it all off.

The report focuses on three issues that have divided us, both generationally and politically: immigration, abortion, and the Israel/Hamas war. It takes a very data-driven approach. For example, the number of #FreePalestine hashtag views on TikTok outnumber #StandWithIsrael by 446M to 16M and on Facebook and Twitter the ratio is 18 and 32 times respectively. The measurement periods for each network varies, but you get the point.

The report has several conclusions. First, personalized social media content has formed echo chambers that are fed by hyper-partisan sources which blurs news and propaganda, Journalism and source vetting is becoming rarer, and local TV news is being remade as they compete with cable outrage channels. As more of our youth engage further in social media, they become more vulnerable to purpose-fed disinformation and manipulation, and less able to distinguish between news and propaganda too. And this generational divide continues to widen as the years pass.

Remember when the saying went, if you aren’t paying for the service, you are the product? That seems so naïve now. Social media is now a tool of geopolitics, and gone are the trust and safety teams that once tried to filter the most egregious posts. And as more websites deploy AI-based chatbots, you don’t even know if you are talking to humans. This just continues a trend about the worsening of internet platforms that Cory Doctorow wrote about almost two years ago (he used a more colorful term).

In her address to the Nobel committee back in 2021, Ressa said, “Without facts, you can’t have truth. Without truth, you can’t have trust. Without trust, we have no shared reality and no democracy.”

Behind the scenes at my local board of elections

If you have concerns about whether our elections will be free and fair, I suggest you take some time and visit your local elections board and see for yourself how they operate and ask your questions and air your concerns. That is what I did, and I will tell you about my field trip in a moment. I came away thinking the folks that staff this office are the kind of public servants that demand our respect for doing a very difficult job, and doing it with humor, grace, and a sense of professionalism that usually doesn’t get recognized. Instead, these folks are vilified and targeted by conspiracies that have no place in our society.

First, some background. I wrote in August 2020 about the various election security technologies that were being planned for the 2020 election here. And followed up with another blog in December 2020 with the results that those elections were carried out successfully and accurately, along with another blog written last August about further insights about election security gleaned from the Black Hat trade show.

A few weeks ago, I was attending a local infosec conference in town and got to hear Eric Fey, who is one of the directors of the St. Louis County election board. He spoke about ways they are securing the upcoming election. The county is the largest by population in the state, home to close to a million people.

He offered to give anyone at the conference a tour of his offices to see firsthand how they work and what they do to run a safe, secure and accurate election.

So naturally I took him up on it, and we spent an hour walking around the office and answering my numerous questions. Now he is a very busy man, especially this time of year, but I was impressed that a) he made good on his offer, and b) was so generous with his time with just an interested citizen who didn’t even live in his jurisdiction. (I live in nearby St. Louis City, which has its own government and elections board.)

There are about fifty people in the elections board offices, split evenly between Democrats and Republicans. Wait, what? You must declare your affiliation? Yes. That is the way the Missouri elections boards are run. Not every county is big enough to have an elections board: some of the smaller counties have a single county clerk running things. And Fey is the Democratic director. He introduced me to his Republican counterpart.

Part of the “fairness” aspect of our elections is that both parties must collaborate on how they are run, how the votes are tabulated, and how ballots are processed. And doing this within the various and ever-changing election laws in each state. We went into the tabulation room, which wasn’t being used. There were about a dozen computers that would be fired up a few days before the election, when they are allowed to start tabulating the absentee and mail ballots. These computers are not connected to the internet. They run special software from Hart InterCivic, one of the  election providers that the state has approved. These machines are never connected online. Okay, but what about the results?  Fey says, “We us brand new USB’s for a single transaction. We generate a report from the tabulation software and then load that report on the USB. That USB is then taken to an internet connected computer and the results are uploaded. That particular USB is then never used again in the tabulation room.”

Speaking of which, when the room is filled with workers, the door is secured by two digital locks and must be opened in coordination. Think of how nuclear missile silos are manned: in this case though, as you can see in the above photo, a Democrat must enter their passcode on their lock, and a Republican must enter their different passcode on their lock.

The Hart PCs have a hardware MFA key and are also password protected and have separate passwords for the two parties. What happens when they need new software? The county must then drive them to their Austin offices, where they are updated, in one of their vehicles, with both parties present at all times. This establishes a chain of custody and ensures they aren’t tampered with.

The elections board office is attached to a huge warehouse filled to the brim with several items: The voting machines that will be deployed to each polling place of course. The tablets that are used by poll workers (as shown here) to scan voters’ IDs (typically drivers licenses) and identify which ballot they need to use. These ballots are printed on demand, which is a good thing because that process eliminated a lot of human error in the past when voters got the wrong ballots. And loads of paper: the board is required to keep the last election’s ballots stored there. And commercial batteries spare parts for all the hardware too: because on election day, they travel around to keep everything up and running. Why batteries? In case of power failure in the polling place. Don’t laugh – it has happened.

Getting the right combination of polling places is more art than science, because the county has limited control over private buildings. One Y decided they didn’t want to be a polling place this year, and Fey’s staff found a nearby elementary school. Public buildings can’t decline their selection.

One thing Fey mentioned that I hadn’t thought about is how complex our ballots typically are. We vote for dozens of down-ballot races, propositions, and the like. In many countries, voters are just picking one or two candidates. We have a lot of democracy to deal with, and we shouldn’t take it for granted.

So how about ensuring that everyone who votes is legally entitled to vote? They have this covered, but basically it boils down to checking a new registration against a series of federal and other databases that indicate whether someone is a citizen, whether they live where they say they live, whether they are a felon, and whether they are deceased. These various checks convinced me that there aren’t groups of people who are trying to cast illegal votes, or bad actors who are harvesting dead voters. Fey and I spent some time going through potential edge cases and I was impressed that he has this covered. After all, he has been doing this for years and knows stuff. There have been instances where green card holders registered by mistake (they are allowed to vote in some Maryland and California local elections, but not here in Missouri) and then called the elections board to remove themselves from the voting rolls. They realize that a false registration can get them imprisoned or deported, so the stakes are high.

Let’s talk for a minute about accuracy. How are the votes tabulated? There are several ways. In Missouri, everyone votes using paper ballots. This isn’t typically a problem to process them, because as I said they are freshly printed out at the polling place and then immediately scanned in. This is how we can report our results within an hour of the polls closing. The ballots are collected and bagged, along with a cell phone to track their location, and then a pair drivers (D + R) head back to the office. Fey said there was one case where a car was in an accident, and the central war room that was tracking them called them before they had a chance to dial 911. They take their chain of custody seriously on election night.

If you opt for mail-in ballots, though, the ballot quality becomes an issue. Out of the hundreds of thousands of ballots the county office received in 2020, about four thousand or so looked like someone tried to light them on fire. Each of these crispy ballots had to be copied on to new paper forms so they could be scanned. Why so many? Well, it wasn’t some bizarre protest — it turns out that many folks were microwaving their ballots, because of Covid and sanitation worries. It was just another day of challenges for the elections board, but they took it in stride.

The paper ballots are then put through a series of audits. First the actual number of ballots are counted by machine to make sure the totals match up. They had one ballot that was marked with two votes, with one crossed out. So the team located the ballot and saw that the voter changed their mind, and corrected their totals. That is the level of detail that the elections board brings to the final count. They also pick random groups of ballots to ensure that the votes match what was recorded.

As you can see, they do their job, and I think they do it very well. If you are thinking about your own field trip, ballotpedia.org is a great resource if you want more details about how your state runs its elections, where and how to vote, and contacts at your local election agency.

Portable air pumps for bike and car: a work in progress

As an avid cyclist, I have collected a variety of tools to keep my tires inflated, both on the road and at home. These include:

  • A floor pump that has a pressure gauge and fits both Presta and Schrader valve types. We have both here in my family. This is used most frequently, because high-pressure tires tend to lose air over time.
  • A portable pump that has a Presta connection that I carry with me when I am riding. This is useful if I get a flat and have to inflate a new tire just enough to fit it on my rims.
  • A collection of CO2 high-pressure cartridges that can inflate my Presta tires up to full pressure. These are good for a single blast of air.

My social feeds have been filled with various ads for portable electric air pumps. In the distant past, these things were portable in the same sense that the first portable computers were: they were bulky and you wouldn’t want to carry them very far. But the latest generation of pumps weigh about a pound and could easily be carried with you on a ride, or fit in your car’s glove compartment. They range in price from $40 to $120, mostly made in China, and resemble an old-style walkie-talkie in dimensions. I bought one of the cheaper ones on AMZ.

The features that I wanted included:

  • Rechargeable battery via USB. The battery should last through a few inflations of your car tires, because you are pushing a lot more air. The unit that I got needed infrequent recharging. The pump’s screen should give you a rough idea of how much charge is available. Having a USB cable also makes recharging from your car simple, if you have the right cables.
  • A long enough hose that fits between the tire and the pump, so you can maneuver the pump around the target tire more easily.
  • Fits both kinds of tires. The way my pump does this is with a small and imminently losable adapter that screws on to the Schrader valve if you want to inflate a Presta tire. This adapter is very hard to fit on the valve stem, and gets tight enough to ensure you aren’t deflating your tire before you even start the inflation process. It took me a few tries to figure out the process of attaching and detaching the pump from both bike and car, and it would be easier if the vendor had two separate hoses, rather than the add-on adapter, but I didn’t find a unit that came that way.
  • Easy operation and usable screen. My pump shows the existing pressure when attached, and you can set it to stop automatically at a given pressure for both bike and car scenarios. That is helpful, especially for bike tires that can be easily overinflated. It also shows battery status too.

One question was could the new electric unit replace both my hand pump and CO2 cartridges on my rides? Even the smaller units still weigh more than the combination, but it is possible, although you probably have to carry it on your person or if you have a big enough bag on your bike. (My hand pump has a bracket to fit on my bike’s frame ) However, this means using the new pump twice when fixing a flat during a ride: once to get some air in the tire before you put it on the rim, then re-attach for the full inflation. It would be nice if the new pump could snap on and off the valve like my other pumps, but I didn’t see any units that offered that kind of mechanism.

I am not recommending my specific pump, and am calling the whole genre a work in progress. Some of them get very hot as their tiny pump motors work overtime to push the air through, especially for car tires. Some weigh a lot more making them difficult to carry in the back pockets of your jersey. The attach/detach process can be tricky: one time I unscrewed my valve stem completely when trying to remove the short air hose. And there doesn’t seem to be any relationship between price, quality, and user satisfaction from what I could tell.

Direct admissions: a new way to get into college

For the past couple of years, high school seniors have been part of an interesting experiment called direct admissions. Basically, there are systems that allow them to get conditional pre-acceptance offers, without having to fill out much of an application in advance, or even think about where they want to attend. What makes these offers interesting is that they arrive unsolicited. There are a few caveats, but hundreds of students are now attending college using this method.

Back in the pre-historic era when I was a high school senior when I had to walk uphill both ways to school, we had to fill out applications by hand. There was no CommonApp, a system by which a thousand or so colleges agree to basically open source the application process. They are one of the entities involved direct admissions, I’ll get to them in a moment. Each place had its own essay to write. You also had to take standardized tests from places like the College Board, the dreaded SAT or ACT. And then there were the application fees.

Direct admissions puts all that aside. You have to have good grades, of course, or good enough grades for the particular school that you want to attend. But that’s about it. No more stuffing silly clubs to pad your pre-college resume. No more parental nagging about whether you have written word one on your essays.

Not every college is on board, yet. But it clearly is the coming wave. As costs to attend college continue to rise, the onerous application process has to be simplified. One private venture is leading the charge called Niche. Their website has a portal for students to enter the direct admissions world and while there is some information to fill out, it doesn’t seem all that difficult.

There are several states that have signed up to include every graduating high school senior in the program. They notify all graduating seniors in the fall where they have been accepted, based on their GPAs. Minnesota, for example, has 55 two and four year colleges — both private and public — part of the program. Students then have to complete an application to the school of their choice. Missouri has several schools that take direct admissions, including probably one of the best engineering schools in the state.

CommonApp began testing direct admissions in 2021, and now has more than 70 participating schools. Niche began its program in 2022 and now has its own group of 100 or so schools. (Forbes has more details here.) The two have somewhat different qualification criteria. With CommonApp, students have to live in lower-income households to get app fees waived and be the first in their generation to enter college, and can only apply to in-state colleges. Niche doesn’t have any income or geographic threshold.

As the NY Times wrote earlier this year, colleges want more students and need more applicants to maintain their student population. Idaho, which is one of the states with a program, found that student enrollment increased by several percentage points in the first year.

Now, you might guess that the top tier Ivies aren’t on board with direct admissions: they get plenty of attention from the best students. But for many other schools, this could be a way to attract students that may have never considered or even heard of the school. And who doesn’t like getting a “you may already have been admitted” notice? It could be a big ego and motivational boost for some seniors.

If you have a kid that has used direct admissions, please post your experiences, I would be interested to hear from you.

The AI takeover of photography

I have been a casual camera user for decades, ever since I got a simple box camera in my teens. I actually had a job as a professional photographer when I got out of college, and built my own darkroom in several homes for printing black and white pictures. This obviously was during the pre-digital era. The past few years I have been enjoying my smartphone’s camera, which keeps getting more and more capable. Going digital meant no more darkroom, and being able to print to an online photo processor by uploading my images. Here is a photo that I took recently.

Well, I come bringing bad news, although it initially doesn’t seem that way. First, cameras are getting smarter. It isn’t just a matter of better resolution images, but better software. The new Google Pixel 9 has something called Reimagine, which has some very neat tricks for in-phone picture editing as shown in this threads post by Chris Welch..This used to be the domain of a skilled Photoshop operator. Now you just tap on the right buttons.

Second, AI is moving into more “original” photography. Google’s ImageFX is now available in preview here— you type in a description of a photo that you are interested in, and within a few seconds, it creates a few images that you can choose from. My prompt of a “high-resolution photo-realistic interior of ornate teal art deco living room” brought the following image:

That is a pretty nice setup. Note the lighting effects, and reflections in the glass table  and mirror are pretty darn good.

So what is the bad news you may ask? Well, as someone reminded me, what we are seeing here are the absolute worst images that AI has produced, and the quality will only get better, much better given the pace of AI development. Soon the lenses on the back of your phone will be redundant. Those travel photos that you took of your last trip to someplace exotic? Chances are someone else has been there, posted the pix, and some AI engine has gobbled it up. Just a few clicks and you can be added in the foreground. What about pictures of things? Now Google’s Lens has been improved: it is now part of the Android OS and you can do all sorts of tricks with it to identify what you are seeing on a web page or IRL. No need to set up a pesky set of lights or to compose the perfect image. Just crop with your finger.

While you mull that over, I want to leave you with one last image, of a real electric power station near Budapest. At least, I think it is real and not some AI construct. But soon, it won’t matter much, just as we have forgotten all about using stop bath and learning the zone system.

The evolution of how brand impersonation attacks use social media

A new academic study of more than 1.3 million social media accounts was given recently at this month’s Usenix conference in Philadelphia. The paper, entitled The Imitation Game: Exploring Brand Impersonation Attacks on Social Media Platforms, makes for interesting reading and sadly shows just how well developed this ecosystem is. Ironically, as business brands pay more attention to social media interactions with their customers, they also enable imposters to launch attacks because people now expect companies to interact with social media. This means that there are many scam accounts that impersonate the brands to create confusion. These lure customers into providing private data and can result in stolen funds and further attacks. The research claims to be the first large-scale measurement of the social scamming ecosystem.

The research team, which was composed of academics from Germany and the US as well as from Paypal, identified almost 350,000 usernames performing various typosquatting techniques to impersonate more than 2,800 brands across Twitter (I know it is called something else, don’t remind me), Instagram, YouTube and Telegram.

Typosquatting is using deliberate typos in user and domain names to make it appear that paypel_support is really the people answering your connection problems. It is not a new problem when it comes to domain names, but as I wrote earlier this year for DarkReading, its use is proliferating in a variety of ways. One way that I didn’t mention is how fraudsters are using it across social media networks. Twitter “is the primary platform for brand impersonation attacks, with fraudsters frequently using typosquatting in their usernames. Roughly a third of these deceptive profiles also use official logos to appear more legitimate.”

The team found that brand impersonation involves multiple steps: after setting up a fake profile (oftentimes using the real brand’s logo to lend legitimacy), the fraudsters engage with customers through posts and offer phony incentives such as discount cards, free services and the like. But the attackers then collect sensitive data, including identities, credit card numbers and other details that are used to engage them in other fraudulent activities.

The most commonly targeted brand is Netflix, which is troubling because right now Netflix is sending out numerous legit messages heralding a change in their account pricing. Apple is the second most targeted brand.

The researchers have several suggestions to try to stem the tide, but admit these will be tough to implement. One of them is pretty obvious: in their work with Paypal, they found that many brands haven’t done their homework and failed to use Know Your Customer methods and continually scan for stolen identities, monitoring their brand mentions online or check for fraud card usage. One recommendation is to send out a quick autoresponse to a customer query to try to engage them before the scammer does. Another is for social media platforms to validate a brand when a new account is created, so that the owner of the proposed paypel_support account really is someone@paypal.com and not fakeuser123123@gmail.

What happens when your plane’s GPS doesn’t work

Many of us have a love/hate relationship with our GPS’s. We love the fact that they can tell us when a route is filled with traffic, or a better way to get from Point A to Point B. But we hate it when we are running late and when the GPS route is a convoluted series of seemingly contradictory turns down small side streets, or when we are somewhere where coverage is spotty or blocked.

That is fine when we are in a car, or using transit. But what happens, as I pose in the subject line, when you are flying a plane and its GPS quits working? It sadly is happening with increasing frequency, as the places around the world that are part of conflict zones continues to expand, and because spoofing or blocking GPS signals is one way to prevent military actors from getting precise positions. That link will document exactly what is happening, and you can click on other links at the end of that post to understand the different types of spoofing that have been observed. The number of incidents has risen alarmingly in the past several months, with as many as 1350 daily flights encountering spoofing, but averaging 900.

Now, that may sound like a lot of flights, but when you consider that these days about 100,000 flights fly every day around the world, it is admittedly still a small number. However, the spots where GPS signals are unreliable have expanded to ten distinct areas. Some of these you might suspect, such as around the Middle East and Russia for example.

(I wrote a few years ago about the Russian airlines. This is yet another reason to steer clear of any flights that come near the place.)

But there are several problems behind this data. First, flight crews are not trained to switch off their GPS when spoofing happens. In fact, they run a variety of automated systems that rely on the global GPS network with all sorts of acronyms. Some spoofing hits the autopilots driving the plane, some hit the ground collision radar that prevents planes from hitting the side of a mountain, others hit the transponders that broadcast the plane’s identity. Second, the symptoms aren’t consistent across all these systems: Each system exhibits different behavior when they get spoofed GPS signals. This means that aircrews are losing trust in their instruments, which is not a good thing. Third, the air traffic controllers — particularly the ones handling long-haul transoceanic flights — have to work harder to separate the planes flying a particular route which are in trouble, which means lower passenger capacity and more flight delays. In some cases, the situation happens close to a landing, which means some planes have to “go around” and take time and fuel to attempt a second landing. Finally, there are a bunch of aircraft-related international organizations that work together in a very delicate balance, and spoofing upsets that particular applecart. Imagine the UN, only worse.

GPS spoofing is now being used as a weapon of war, and it is sadly catching on as the investment in small armed drones is small but the damage that they can cause is great if they can rely on precise positioning for their targets. Sadly, it will take some time before the civil aviation industry can retool to work around spoofing in any effective manner.

How to stop face fraud schemes

The latest in face fraud has little to do with AI-generated deep fake videos, according to new research this week from Joseph Cox at 404 Media. It involves a clever combination of video editing, paying unsuspecting people to record their faces and holding up to the camera blank pieces of paper. Sites such as Fotodropy and others have sprung up that have real people (as shown here) that are the face models, moving their heads and eyes about at random during the course of the video.

This goes beyond more simplistic methods of holding up a printed photograph or using a 3D-printed mask of a subject, what was known as face spoofing. That produced a static image, but many financial sites have moved to more complex detection methods, requiring a video to show someone is an actual human. These methods are called document liveness checks, and they are increasingly being employed as part of know-your-customer (KYC) routines to catch fraudsters.

The goal is not to have your actual face on a new account but someone that is under the control of the hacker. Once the account is vetted, it then can be used in various scams, with a “verified” ID that can lend the whole scam more believable.

Back in the pre-digital days, KYC often meant that a potential customer would have to pay an in-person visit to their local bank or other place of business, and hand over their ID card. A human employee would then verify that the ID matched the person’s face and other details. That seems so quaint now.

The liveness detection does more than have a model mug before the camera, and requires a customer to follow stage directions (look up, look to your left) in real time. This avoids any in-person verification in near-real-time and shifts the focus from physical ID checks to more digital methods. Of course, these methods are subject to all sorts of attacks just like anything else that operates across the internet.

There are several vendors who have these digital liveness detection tools, including Accurascan, ShuftiPro, IDnow.IO and Sensity.AI, just to name a few that I found. Some of these features can measure blood flow across your face and capture other live biometric data. This post from IDnow goes into more detail about the ways facial recognition has been defeated in the past. It is definitely a cat-and-mouse game: as the defenders come up with new tools, the fraudsters come up with more sophisticated ways around them. “This had led to growing research work on machine learning techniques to solve anti-spoofing and liveness checks,” they wrote in their post.

The one fly in these liveness routines is that to be truly effective, they have to distinguish between real and fake ID documents. This isn’t all that different from the in-person KYC verification process, but if you paste in a fake driver’s license or passport document into your video, your detection system may not have coverage on that particular document. When you consider that there are nearly 200 countries with their own passports and each country has dozens if not hundreds of potential other ID documents, that is a lot of code to train these recognition systems properly.

Note that the liveness spoofing methods are different from deepfake videos, which basically attach someone’s face to a video of someone else’s body. They are also a proprietary and parallel path to the EU’s Digital Wallet Consortium, which attempts to standardize on a set of cross-border digital IDs for its citizenry.