
Regulation versus Damage control
Regulation indeed will be very challenging. That however doesn't mean we have to just let it roll over us.
To start with, there are two basic options:
A) To allow every single use of this technology that is not explicitly forbidden, and to allow everything that is able to weasel out of the exact wording of what is forbidden by law. If damage from the bulk usage of the technology piles up, government then can start research done by experts that more then a bit overlap with employees of the providers of the technologies for one or more years. After that they can debate in congress, senate and other parliaments for one or more years. Then comes the phase of special interest groups to give their input on the subject, after which poorly worded legislation with plenty of loopholes can be voted. Then if the law gets broken, small fish gets fried quickly and big players can get a few years of relative safety before investigations start. After that comes years of trial and appeals of state lawyers versus the best paid lawyers in the world. Everything ends with either a slap on the wrest or the state having to pay a high compensation to the tech company because there were some procedure errors in the first fine the court gave the company.
B) Allow a few clearly thought about and very well defined explicit usages. Forbid all other usages and make it unlawful. New usages need to go through a rigorous process of approval.
I am more then aware option B) has severe shortcomings. And it impedes technological innovation. Given the barrage of damage option A) is bound to create, I find it more then worthy to start looking into the possibilities of option B). We have seen what sort of responsible behaviour big tech companies have shown to users, privacy, competition laws, tax laws... in the recent past.
That leaves us with a third aspect, independent needed on top of either A) or B):
C) Stringent, well written and seriously enforced privacy laws. Why? The damage that this technology for generating a fake video from nothing but a picture and a short sample (less then a minute with some technologies) of voice will do will be multiplied if "players" have copious amounts of gathered information. If for example an attacker knows what shirt you recently bought, what your current location is, what activities and health problems you recently had, how you moan if things go bad... on one hand and if the same attacker knows the financial state of your parents, when they won't be able to physically check to meet you in person, what arguments will persuade your parents better then generic arguments, when and how you helped them out when they needed your help, when they were wrong about cybersecurity and you were right so now they needed to trust you as this time it is real... then your parents are as good as sitting ducks no matter how well you tried to educate them.
One may think it's just a matter about being sharp yourself and educate your parents, but one forgotten detail when educating them or one moment of weakness of them and it's over. Remember that many attackers will have millions of detailed records on previous attempt to influence people to data mine and throw through some "AI" to learn from. With my level of skill, I do not expect to avoid every single attempt. People with less skill, those are unfortunate sitting ducks.
Just advising users to be careful with what information they post just won't do it. Data harvesting is rampant and still on a sharp rise. Soon you likely won't be able to walk the streets without cars with "somewhat self driving abilities" to stream much of the video their cameras continuously make "in order to improve safety" back to the mothership while also data mining it for "commercial use" (including using already existing technology to lip read).
Now we are at it, add:
D) Make strict laws with real sanctions for failing them when it comes to hardware, software and services security. Devices and software riddled with security holes will be another big amplifier of the damage this deep fake technologies can do. It can allow easier covert installation of spyware and allows to activate communication software, circumvent filter lists of who can get through and even pop up look alikes of popular communication software.
Unfortunately, the "Brave New World" seems to be around the corner and it's laughing at and with us.