We've had the solution in the form of basic TLS cryptography and verification for decades now though, the problem is no one's implementing it.
Governments already maintain registers of legally operating businesses: there's no reason that registration should not also be issuing cryptographic certificates which verify all forms of outbound communication by that business including phone calls.
But despite telecom being almost end-to-end digital (i.e. digital to the box on the street pretty much), there's been no push to close the last 100m. "Phone lines" shouldn't exist anymore with packet switched networking: you should just dial a path against a business, which is verifies itself with TLS certificates linked to it's business registry.
You don't need reputation systems: I can count on two hands the number of organizations that have any reason to be contacting me unsolicited.
Add a minor tie-in with my bank, and my reputation list would essentially be "the government, my bank, my doctor, my insurer + any company I've done monetary transactions with recently".
And realistically in a world with this system, this is all already implemented by my phone's contact list - no more phone numbers would mean that there's no reason to think that any organization would be contacting me from a totally unique (or anonymous) identity. Instead I'd just have a contact book whitelist entry for "bank.com.au" or whatever scheme we ended up with.
As it is right now, actual government services call people from Caller ID blocked numbers, and don't widely publish allowable contact origins. Which is ridiculous.
Like the strong financial incentives to compromise certificates owned by banking websites? Securing voice communications the same as website communications is an awesome idea, and the fact that it’s possible to steal some piece of data and compromise it shouldn’t prevent us from moving in that direction.
It has happened, but there has to be a big pay off to make it worthwhile.
Smaller companies would likely be more frequent targets given they would be easier to compromise.
By the way, I'm not suggesting that the idea is useless. I'm just pointing out it isn't a panacea, and it still doesn't address the core problem raised in the article that you don't know if you are speaking to a human or not.
But the point is that the pay off itself is limited. Smaller companies have a much smaller pool of people who would have any reason to accept unsolicited calls.
This is evident in how scams work today: you either get explicitly targeted, or you dragnet using some service which everyone has i.e. a bank, the tax office, or a telecom company.
Compromising "Joe's BBQ Emporium" might be easier, but it's still (1) something you have to do (and maybe get caught then) and (2) the number of people who are going to pick up, or not immediately blacklist unsolicited calls from "Joe's BBQ Emporium" is tiny.
Does it matter if you’re talking to a human or an AI? The main thing is its intent - is it helpful, or malicious? And attaching communications to persistent reputations via certs can help guess at that.
"Authenticating that you are talking to a human and not an AI" is just a proxy for something else, most commonly wanting to be able to rate limit something. Because otherwise, why does it matter?
A lot of people are suggesting things like, have the government do it. But that has two big problems. First is privacy. If you have to prove your identity any time you want to do anything, nobody can be anonymous anymore, which is Very Bad.
Second, it assumes the government has some magic incantation that nobody else can use, as if the Post Office knows who you are in a way that your bank doesn't. But they don't. To get a government ID, they just want you to show them some other existing ID. It has no way to bootstrap itself any better than anything else. And some of the IDs they accept are easy to get... without an ID. Because everybody has to start from somewhere. The system has to be set up in a way that it works for people who emigrate from a country with untrustworthy institutions as an adult or if your house burns down and you lose all your documents you can still get new ones. An AI is going to be able to BS its way into a government ID, even assuming criminals wouldn't be able to hack into any state's DMV (as they already have).
It appears that going forward, telling the difference between a human and an AI is going to be hard. Maybe instead of trying to get better at that, we should find a different solution to the underlying problem.
The simple answer is to make account creation cost something. Nothing big, so someone who needs one account isn't paying much, but a spammer who has 1000 accounts get banned every day is out of business. And that's not even hard -- it's finally something cryptocurrency would actually be good for. Because you want a way for people to pay for access to things, while still being anonymous.
The real hard part is, how do you charge for account creation without deterring account creation?
> If you have to prove your identity any time you want to do anything, nobody can be anonymous anymore, which is Very Bad.
No one would have to prove anything. But why would I accept calls from any entity claiming to be a legally registered business which doesn't present a government issued certificate proving that? I already verify businesses by looking up business number registries. But this should be automatic to the communication even happening.
Same question with personal contacts: why would I blindly accept calls from people I don't know and who don't want to present any confirmation of their identity to me?
Now you're talking about something else. Whether the entity calling you and claiming to be your bank is, in fact, your bank is a separate issue from whether it's an AI or a human. It could be a robocall from your bank trying to upsell you on some financial product and it would still be from your bank. It could be a live human being claiming to be your bank when they're not.
And we know how to solve that one. If you get an email from bank.com, your email server knows how to verify that it was actually from the servers of bank.com, using certificates and DNS records etc. This is technology we could also apply to phone calls, notwithstanding that we haven't, and do so without any government action. Google and Apple could implement this right now if they cared to.
But that doesn't prevent spam. Because the spammer doesn't have to claim to be bank.com in particular. They can go register somethingthatsoundslikeabank.com and send their spam from there. Then you receive their spam/calls because you want to be able to receive legitimate ones from people without whitelisting them individually and the spam domain hasn't been spamming long enough to get blacklisted yet.
Real solutions look something like this: To send mail from a.example.com to user@b.example.com, a.example.com has to generate a computationally expensive hash containing their domain name and the target email address. Or transfer a few cents worth of cryptocurrency to the target in exchange for a signature of that pairing. New mail servers then have to do a lot of initial computation but once they've computed/bought hashes of 99% of the people their users communicate with they can cache the results and they're done. Spammers have to keep redoing the expensive computation every time one of their domains gets blacklisted.
Then you can AI generate all the spam you like, but if the recipients don't want it, your domains are going to get blocked, which would be expensive.
A criminal human probably can't do a perfect voice impersonation of your teenage kid or frail grandmother who desperately needs to be sent money for some urgent reason.
Sure, but that’s not too different from the current scams where there’s some excuse you can’t talk right now. In both cases it can be solved by checking if it is coming from a known number and calling the person in question to confirm.
People you know typically won’t desperately need lots of money with some elaborate story that is impossible to be immediately confirmed.
If AI suddenly leads to an increase in call spoofing, that’d be a problem of the phone network that we already face with robocalls, but wouldn’t be new.
It's the cost factor. Using AI, it's economically feasible to contact a million people, even if only a fraction bite. Not unlike the current spam calls.
Governments already maintain registers of legally operating businesses: there's no reason that registration should not also be issuing cryptographic certificates which verify all forms of outbound communication by that business including phone calls.
But despite telecom being almost end-to-end digital (i.e. digital to the box on the street pretty much), there's been no push to close the last 100m. "Phone lines" shouldn't exist anymore with packet switched networking: you should just dial a path against a business, which is verifies itself with TLS certificates linked to it's business registry.