The TechnologIST | Q&A with Applied Trust and Safety Team on TrustCon

Welcome back to The TechnologIST! I'm Sophia Mauro . In this month's edition:?

• Read a Q&A with IST's Applied Trust & Safety team
• Listen to new episodes of Hack the Plan[e]t, a podcast?on securing our nation's critical infrastructure?
• Cast your vote for Megan Stifel and Taylor Grossman for the CyberScoop 50 awards
• Check out recommended reading from the IST team on the latest in?tech and security?

Spotlight on Trust & Safety: IST at TrustCon

IST’s Applied Trust & Safety Initiative team members?Eric Davis, Senior Vice President for Special Projects, and Fatima Faisal Khan,?Associate for Ecosystem Trust & Safety, headed to TrustCon last week.?What exactly is TrustCon? What were some of?Eric and Fatima's key takeaways from the conference? And what?is IST up to in the?field of trust & safety? In this month’s newsletter, I sit down with Eric and Fatima to learn more.

Eric Davis : “TrustCon is unlike just about any other tech conference (and I’ve been to more than I care to count!). This is the third year of TrustCon, the premiere global conference for Trust & Safety professionals, put on by the Trust & Safety Professional Association (tspa.org). I’m a founding advisor to the TSPA and have participated in the conference each year. In 2022, there were about 35 sessions. This year there were 150 sessions, and, once again, it was a sold out show. An unfortunate conference success metric is the number of times you want to attend multiple panels simultaneously.?

The rapid growth of TrustCon underscores both the need for this type of conference, as well as the great leadership of Charlotte Willner, the TSPA Executive Director, and the rest of the TSPA team. This year felt like a milestone, with Trustcon at an early age on its way to settling in as an institution.

From the time you enter the registration area, you start to pick up on the enthusiasm of conference participants and volunteers. People are happy to be there and are enjoying reconnecting with folks in person, for goodness’ sake. The closest comparisons are probably DEF CON and some of the smaller community-driven security conferences. Like such events, TrustCon is a bit of a release valve, a gathering of like-minded true believers, with a strong community and a “summer camp” sensibility, although the energy is different from my DEF CON experiences.

At first glance, an observer noting people dressed casually and in homemade TrustCon gear, custom bracelets and t-shirts, probably wouldn’t match them with the TrustCon sessions, such as Whole-of-Sector Approaches to Countering Terrorist Use of the Internet; Cross-Sector Collaboration for Tackling Online Child Sexual Exploitation and Abuse; Indirect Swarming & Its Potential Threat to Democracies; The Convergence of Violent Extremism – Facilitators, Manifestations, Threats;?and?The Co-Evolution of Cybercrime and Safe Browsing Over the Last 2 Decades. I think that the dichotomy (which is really not a dichotomy) is as fitting a representation of TrustCon as any.”

Fatima recently joined IST as our Associate for Ecosystem Trust & Safety. Welcome! Can you tell me a little bit more about your background in trust & safety? What led you to IST??

Fatima Faisal Khan : “Thank you! Like many in the trust and safety field, I found my way here somewhat serendipitously. Growing up with the internet, I was academically fascinated by how online communities shape identity through ideological and psychosocial support systems. My curiosity led me to explore these dynamics further, especially as I spent several years working on human rights issues faced by defenders in online spaces during the Covid pandemic. This period underscored the importance of maintaining healthy online spaces as crucial for human rights, akin to our physical world.

This realization propelled me to Notre Dame, where I delved into deliberative technologies and user-first pro-social design approaches for online platforms. My fellowship at Wikimedia allowed me to engage with editor communities on issues of disinformation and electoral propaganda in South and Southeast Asia. IST’s Applied Trust & Safety Initiative offered the perfect marriage of all my research interests. I'm thrilled to be here and eager to connect with the T&S community and engage in meaningful projects. During such a pivotal year due to numerous elections and evolving AI regulations, I'm excited about the impactful work IST has planned in this space!”

After attending TrustCon last week, what are some of the key trends you’re seeing in the trust & safety space? How does your work at IST play into these trends?

Fatima: “There’s no escaping the significant impact that AI, particularly generative AI, has had on the trust and safety field, and this was a recurring theme throughout the panels at TrustCon. Key trends include discussions on elections, combating CSAM (Child Sexual Abuse Material), new tools, and signal sharing. The latter, in particular, stood out to me.?

During one panel I attended, panelists emphasized the importance of making tools accessible across the industry and adapting them to new technological advancements as we move forward. The panel highlighted how fostering a strong open-source culture and well-documented mechanisms can create a space and opportunity to emulate the cybersecurity model.

There are ongoing efforts, such as the Tech Coalition’s Lantern initiative, that also reflect impactful cybersecurity models. Similarly, IST is launching a project to study, plan, and catalyze an operational hub for T&S practitioners to facilitate signal and intelligence sharing and collaboration across the industry, modeled in part on the Information Sharing and Analysis Center (ISAC) approach. This initiative will be crucial in advancing collaborative efforts and enhancing the overall safety of online platforms.”

Eric, you moderated the TrustCon panel, “2024 Elections and AI Case Studies: Beware the Six-Fingered Man” with Diane Chang, Alexis Crews, and Swapneel Mehta.?Halfway through 2024, how exactly has AI impacted this “Year of Elections”—and how will it continue to make an impact in the months to come??

Eric: “At present, the impact is unclear. So far, it’s been difficult to distinguish causation from correlation. What we do know is that AI has been embraced, in both conventional and unconventional ways, as a tool for disinformation and propaganda by state actors and others seeking to manipulate election outcomes. Moreover, research increasingly demonstrates the manipulative capabilities of deepfakes.

In addition to the conventional use of deepfakes denigrating candidates, we expect to see the continued use of generative AI to improve the public image of controversial politicians. Some of the latter will be overt, such as using cuddly avatars, while some will be more subtle, involving slightly altered versions of candidates in recorded speeches or wittier versions answering questions online. This area requires further research: at what point does continued exposure, even knowing something is inauthentic, start to influence a person’s sense memory and perception of the actual candidate?

As problematic as deepfakes are, they’re also shiny objects that can distract from other malign uses of AI in elections, such as more sophisticated and distinct content for synthetic news sites and social media account personas. Likewise for emerging issues that aren’t yet on the radar – we’re effectively still in early days.”

In addition to moderating a discussion on the impact of AI on 2024 elections, you also participated in a TrustCon panel on election integrity best practices. What are some of these best practices??

Eric: “A few examples of best practices:

• Audit your services and systems for election Trust & Safety risks, and develop plans to address the risks.
• Decide and fully articulate the platform’s role, and plan accordingly. If misinformation about voting locations are spreading through the site, is that a problem for you to solve? If so, what are the authoritative sources for information? Is there an established channel for communication with them?
• Develop information integrity policies that are technology agnostic. Disinformation is disinformation, regardless of whether it was produced by photoshop or an AI-powered image generator.
• Establish clear decision-making protocols with senior leadership – many election platform issues escalate very, very rapidly.
• Election day is not the last day for election controversies, accompanied by issues on your platform. Plan accordingly.”?

Elsewhere at IST

IST and CTA Submit Comments on Cyber Incident Reporting for Critical Infrastructure Act

IST and the Cyber Threat Alliance, along with co-signer Chainalysis, submitted comments this month in response to CISA’s Notice of Proposed Rulemaking on the Cyber Incident Reporting for Critical Infrastructure Act. Our response to the NPRM draws from the Cyber Incident Reporting Framework, a joint effort led by IST and CTA which was submitted to CISA as part of the initial RFP for implementing this legislation and rulemaking.?

Improving Nuclear Hotlines: Experts Speak

On July 19,?Deputy Director for Nuclear Policy Sylvia Mishra and Technology Policy Analyst Christian S. moderated a webinar with the authors of “Improving Nuclear Hotlines: Relevance and Use Cases.” Panelists Dr. Rabia Akhtar , Manpreet Sethi , Dmitry Stefanovich , and Dan Zhukov unpacked their briefs assessing the status of crisis communications in nuclear-armed states and took questions from the audience.?

IST in the News

CyberScoop50 awards nominate IST’s Megan Stifel and Taylor Grossman!

Every year CyberScoop, a leading source of government and cybersecurity news, nominates 50 cybersecurity leaders in government and the private sector to be recognized for their service. This year, two members of the IST team are nominated! Make sure to cast your vote for Deputy Director for Digital Security Taylor Grossman for Most Inspiring Up and Comer, and Chief Strategy Officer Megan S. l for Cybersecurity Visionary.

Megan Stifel on IST’s response to CISA’s proposed cyber reporting rules

As the CIRCIA comment period came to a close, some private companies urged CISA to rethink its proposed reporting rules, citing confusing and overly broad rules. Speaking with the Wall Street Journal, Megan S. reflected on the industry response, drawing from IST’s own interactions with critical infrastructure companies. “I think there’s common ground, and a recognition that we need to have this reporting,” she said.

Conversations on Critical Infrastructure

The latest from Hack the Plan[e]t

Hack the Plan[e]t, hosted by IST Senior Adjunct Advisor Bryson ?? Bort , explores the critical infrastructure systems that we rely on every day, asking whether connecting these systems to the Internet leaves us more vulnerable to attacks by our enemies. In its fourth season, IST is excited to produce the podcast alongside ICS VILLAGE !

Joe Marshall is a Senior IoT Security Strategist at Cisco Talos Intelligence Group. When Russia invaded Ukraine in 2022, Joe helped coordinate a multinational, multi-company coalition of volunteers and experts to find a technological solution. In this episode, Bryson and Joe sit down to discuss Joe’s efforts in Ukraine, how he got the go-ahead from Cisco leadership, and more.

For three years, Mark Montgomery served as Executive Director of the Cyberspace Solarium Commission, created by congressional mandate to develop strategic approaches to defending against cyber attacks. Now, he directs CSC 2.0, an initiative that works to implement the recommendations of the Commission. In this episode, Bryson and Mark talk about Mark’s time at the Commission, his pitch for a Cyber Force, and the politics of cybersecurity and the latest cyber policy.

What We're Reading

Want more tech and security content? Check out some of the ISTeam's favorite pieces from the past month:?

• The spy trade isn’t what it used to be. For the Economist's Technology Quarterly, Shashank Joshi details how advancements in technologies like AI, “ubiquitous technical surveillance,” and an overload of data changed intelligence gathering.?
• In the latest from the Stanley Center, IST Crisis Communications Resilience Working Group member Dr. Rabia Akhtar, along with Ruhee Neog, examined the Non-Attack Agreement between India and Pakistan. “While the agreement does not solve foundational issues of trust and conflict between India and Pakistan—and perhaps never set out to do so—it is a vital component of the nuclear risk reduction framework,” they write.
• The Treasury Department is partnering with Wall Street banks to deter and defend against cyber attacks. Dubbed Project Fortress, the joint effort will include “offensive actions,” Deputy Treasury Secretary Wally Adeyemo wrote in a letter to bank CEOs.?
• 63% of K-12 schools experienced a ransomware attack in 2024, according to a new Sophos report, a nearly 20% decrease from 2023. At the same time, the price tag on recovery for schools has doubled, averaging $3.76 million.?
• A Bitcoin mining operation in Granbury, Texas might be making residents sick. The problem, it seems, is the noise. “We’re living in a nightmare,” local Sarah Rosenkranz told TIME.?
• Any generative AI tools used by the Federal government should be risk evaluated first, the director of the Department of Homeland Security’s AI Corps Michael Boyce said. However, establishing a program like FedRAMP, which standardizes the government’s approach to security assessment, authorization, and continuous monitoring of cloud products and services, would carry its own set of limitations in the context of GenAI.??
• AT&T was the victim of a massive hack in 2022, the company announced earlier this month. The stolen data includes "records of calls and texts of nearly all of AT&T's cellular customers" between May and October 2022. The FCC is investigating.??
• A new hotline is being built between the presidential offices of China and the Philippines, the latest in a series of efforts to diffuse territory disputes in the South China Sea. “Both sides recognized that there is a need to restore trust, rebuild confidence and create conditions conducive to productive dialogue and interaction,” the Philippine Department of Foreign Affairs said in a statement.?
• All Tech is Human, a nonprofit dedicated to tackling tech problems together, released its?2024 Ecosystem Pulse Report. The report offers a snapshot of the nonprofit’s demographic makeup, growth over time, and the development and impact of their ecosystem-building strategy.

The Institute for Security and Technology designs and advances solutions to the world’s toughest emerging security threats. It is a nonpartisan, nonprofit organization?based in the San Francisco Bay Area dedicated to solving critical international security challenges through better technology and policy. Donate today to support our mission.