-: Afternoon, everyone.
I'm Peter Cook ABA's chief communications officer.
Thank you for joining us for this virtual press briefing.
It is starting at an unusual time this afternoon
because there have just been meetings here at the ABA
between the Financial Services Sector Coordinating Council,
members of the Treasury Department talking about AI
and a host of other issues.
In a moment, we're gonna hear from leaders
from both the FSSCC and the Treasury Department,
but first, I wanna introduce Rob Nichols,
the president, CEO of the American Bankers Association
for some opening remarks on today's event.
And then after the conclusion of Rob's remarks
and our opening speakers,
we'll also engage with some Q&A
I wanna encourage you now to submit your questions
through the Q&A function on screen
so that we can collect as many questions as possible,
get to as many as possible during the Q&A portion.
We've had a number of reporters register for this event,
including a significant number
of registered just this afternoon.
So we wanna get to as many of those questions as possible.
Again, thank you for taking part
in this virtual news conference.
And with that, I wanna bring it to the lectern here
Rob Nichols, president, CEO of the ABA.
-: Thank you, Peter.
Welcome, everybody.
I'm pleased to welcome everyone
to this virtual news conference.
We are proud, very proud to host this event today
and today's meeting
of the Financial Services Sector Coordinating Council
and top officials from the Treasury Department.
Only through this kind of industry
and government collaboration
and coordination can we continue
to successfully defend against the significant
and evolving threats to the US financial system.
Cyber criminals and fraudsters are not new threats
of course, but with the advent of artificial intelligence,
the challenges they pose will only increase
as the treasury's recent report on managing AI-specific
cyber and fraud risks laid out quite well.
The good news as that report also showed
is that banks are not new to AI.
Our sector has been using AI
and machine learning for longer than most industries.
We know that bank investments and technology
and innovation can help us fight back against the bad guys
to protect our customers and the broader financial system.
We also recognize that we cannot do this alone.
This is why this needs to be a coordinated effort
between the private and the public sectors,
which is why I'm so pleased
to see the Treasury Department here today
in working alongside the nation's banks, trade associations,
and other key players in the financial services sector.
As a former assistant secretary of the Treasury responsible
for engaging with the private sector, I know
that we can have far more impact working together
than working alone.
And we can working together,
solve these major important problems.
So let me offer a personal thank you
and a welcome to Todd Conklin, the chief ai officer
and deputy assistant secretary
for Cybersecurity and Critical Infrastructure Protection
for being here, Todd, thank you.
And express our industry's deep appreciation
for the Treasury Department's willingness
to engage on this super important task.
I also wanna thank more than the 70 members
of the financial services sector coordinating council
or FSSCC, as we like to call it, for their ongoing efforts
to protect the financial system.
I'm also incredibly pleased
to welcome the council's top leadership here to the ABA
for this news conference.
Debbie Guild is the current chair of the FSSCC.
In her day job,
Debbie serves as the executive vice president
and head of enterprise technology
and security for PNC Financial Services Court.
Also here is my ABA colleague Paul Benda,
the current vice chair of FSSCC.
Paul is Abba's executive vice President
for Fraud, Risk and cybersecurity.
They will each deliver some opening remarks.
Then Peter Cook will return to lead the Q&A session
with Debbie, Todd, and Paul.
I invite Debbie now to this podium to kick things off
and then we'll hear from Todd and Paul.
Debbie, thank you for your leadership.
The floor is yours.
-: Thank you so much, Rob.
I'm staying here, I believe.
I am Debbie Guild.
I am the chair
of the Financial Services Sector Coordinating Council.
A little bit of background. The financial services sector
is an intertwined ecosystem of federally
and state chartered banks, credit unions, asset managers,
trading firms, and insurance firms.
One of our main priorities is coordinating
critical infrastructure and homeland security activities
within the financial services industry,
and we work closely with our US government counterparts,
specifically with the US Treasury,
to proactively protect the sector against threats.
I'm pleased to be here to amplify the work being done
by the US Treasury as well as the private sector,
and outlining an approach to understanding both the promise
and the peril of artificial intelligence specifically
to the financial services sector.
There is no doubt that the threat landscape is being shaped
by the advancements in AI
and our perception of reality
is going to be influenced by the output.
Thus, we should all care.
Looking through a cybersecurity and fraud lens,
the use of this technology can be used to mimic identities
and this will have broad implications across all facets
of society, specifically to authentication.
That moment where you are trying to prove you are
who you say you are.
The pace of change is speeding up
but at this rate of change,
it's both exciting and concerning.
It took several decades to get Gen AI to version one.
We've seen this move to version three
and four in a matter of months.
And with this speed comes the increased probability
of increased risk.
So not only are we challenged by the mounting threat
related to AI advancements, but we must also be attuned
to the potential vulnerabilities this technology
could represent as we use it to combat this threat.
With the promise of this new technology comes peril
and we need to collaborate to ensure
that the sector is protected.
AI effectively lowers the barrier of entry
for less skilled adversaries,
and enables easier identification of vulnerabilities.
In the short term, this technology has the potential
to give our adversaries the advantage.
Fraud information sharing is more nuanced than cyber
and privacy is an issue since it involves identities.
But we figured out how to share actionable data for cyber.
We need to apply that similar process to fraud.
Collaboratively, we, as an industry, need
to mount a coordinated defense.
We have to get better and faster
at sharing actionable insights.
Data completeness, data integrity, data quality,
and data privacy and security concerns will emerge
as a larger risk as AI is more widely implemented.
One of the key findings of treasuries research is the need
for a traceable record for Gen AI solutions
that provides transparency on who
and what you are interacting with and how it's been trained.
Currently, gen AI can generate results
and there's no requirement to disclose what data was used.
The recommendation is to create sort of a nutrition label
for all gen AI to help trace what data was used.
Multiple state legislatures are considering laws requiring
that consumers be notified
whenever AI is used to generate content.
We, as an industry, need to be a voice
during those discussions, helping to identify ways
to inform regulations that will protect our customers,
and also allow us to operate efficiently.
By establishing standards
that can establish trust as an industry,
we will be in a stronger position to defend our customers,
our institutions, and our industry at large.
Now I'd like to introduce my treasury counterpart,
Todd Conklin, who is the Deputy Assistant Secretary of Cyber
and who was recently appointed Treasury's
chief AI officer.
Todd.
-: Thank you, Debbie, really appreciate.
I always hate following Debbie, but it's great to be here.
And thank you, all, for joining us today.
As previously mentioned, I'm Todd Conklin
Treasury's chief AI officer
and deputy assistant secretary for Treasury's Office
of Cybersecurity and Critical Infrastructure Protection.
I would like to say thank you to the Treasury team.
I could not be prouder of treasury's AI report
and how it underlines the revolution in our approach
to public-private partnership work
that treasury has led alongside our colleagues
here in this room and at the table.
Before I discuss our report on AI-based cyber threats
and fraud, I wanna take a moment
to highlight the cloud executive steering group for CESG.
In February, 2023, Treasury released
financial services sector's adoption of cloud services.
That report was written
after Treasury, alongside partners in the financial
and banking information infrastructure committee,
interviewed approximately 50 financial institutions,
cloud service providers, financial service providers,
financial industry trade associations,
and independent think tanks to understand
how financial service providers use
and rely on cloud services
and to understand how the financial services industry
plans to use cloud services in the future.
The cloud services report also identified gaps
in the financial services sectors use of cloud services.
The cloud executive steering group
was established in May, 2023
to address the gaps identified in treasury's cloud report,
and it now serves as the model
for our next steps in collaboration
and for the general awareness.
That group is led by PNC CEO, Bill Demchak,
and then the heads of two regulatory agencies,
Rohit Chopra from CFPB and Michael Hsu at the OCC.
So the work done by the by that group tells a broad
and compelling story about how government
and the private sector have come together to solve one
of the financial services sector's most depressing problems.
When the group kicked off, Treasury partnered
with the financial services sector, coordinated council
and regulatory agency partners to identify
and then leverage the right organizations
and personnel across government
and the private sector to bring considerable expertise
to bear everyone, not just the private sector,
demonstrated the seriousness of their intentions
by committing resources to the work streams at all levels,
including participation at various senior levels
across both the sector and the regulatory agencies.
Together, Treasury, FSSCC,
and participating trade organizations,
in addition to cloud service providers,
have spent the last year diligently crafting
effective practices and document intended
to aid financial institutions of all sizes at every phase
of their cloud adoption journey.
As our work is set to conclude in the coming months,
we are confident in our path
towards strong deliverables and outcomes.
Not only does the aggregate work raise the collective bar,
but we are also preparing a series of recommendations
that we hope will serve as the baseline
for raising regulatory standards in the future.
And much of the work and lessons learned
in that cloud executive steering group process
will be leveraged for our future AI work,
which I'm gonna discuss now.
On March 27th, 2024 Treasury released managing
artificial intelligence specific cybersecurity risks
in the financial services sector.
The report outlines best practices as well as a series
of next steps to address immediate AI-related
operational risk, cybersecurity and fraud challenges.
We conducted in-depth interviews with 42 stakeholders
within and outside of the financial sector.
This included interviews with financial firms
of all sizes from globally, systemically important
financial institutions to local banks
and credit unions, as well as major technology companies
and data providers, financial sector trade associations,
cybersecurity, and anti-fraud service providers
in addition to the federal regulatory agencies.
We believe that the success of our report on cloud services
helped build trust in the AI report process
and promoted candid conversations with participants.
Participants understood
that Treasury was looking to paint an accurate picture
of the usage of AI technology
in the financial services sector
for the purposes of cybersecurity and fraud prevention.
Treasury also sought a sector-wide perspective
and attended several AI discussions led by the FSSCC
as part of their AI paper writing process.
Treasury incorporated aspects
of that paper in our own report
and also added that report as an addendum
to the overall treasury report.
Additionally, the treasury report noted
that the financial services sector has been using
so-called traditional AI for many years.
In the cybersecurity space,
AI is often used in anomaly detection, behavioral analytics,
and data loss prevention.
Many interviewees use products
that pool anonymized network data from many customers
and use that data to train their models.
Firms stated that AI often allows them
to detect fraud in real time instead of having
to run batch jobs on their past transactions,
which could allow hours or even days to pass
before a fraudulent activity is detected.
Like our report on cloud services,
the AI report has a next step section
that identifies gaps in the sector's current AI usage
that we plan to address collectively going forward.
For example, in our discussions with financial institutions,
it became clear that AI means different things
to different institutions.
We have 10 next steps, so I won't name them all,
but other next steps include addressing the capabilities gap
between small mid-size and large institutions,
the need to narrow the fraud data divide
and also expanding the NIST AI Risk Management Framework,
all issues that we discussed in full earlier today.
I hope that it is evident to all of those
who participated in both our cloud
and AI work, that we have changed
how the public private partnership
in the financial services sector operates.
In the past, we cooperated and were able
to collectively identify challenges,
but we did not materially address these challenges together
in a regulatory manner.
That is no longer the case.
We now have a model for how to implement positive solutions
for our toughest challenges from cloud to AI and beyond.
So thank you for being here
and I'd like to now hand the podium over
to Paul Benda from American Banker Association.
-: Thank you, Todd.
And thank you, Debbie, for your insightful remarks.
As both Todd and Debbie have discussed,
defense of the financial sector
has to be a team sport involving both the government
and private sectors and engage the whole financial sector
from the smallest institution to the largest.
Along those lines, I'd like to acknowledge the hard work
of the treasury critical infrastructure team
led by Todd Conklin who has partnered
with the private sector at a level not often seen
and done so in a way that's been extremely helpful.
His work building the structure
of the cloud executive steering group,
engaging senior leaders from both the public
and private side has enabled us to explore
and identify concrete ways that we can work together
along with the technology industry
to better protect financial institutions
and their customers.
One of the things that strikes me
about both our cloud efforts and the treasury AI paper
that was published is the focus on protecting
not only large institutions, but institutions of all sizes.
Every discussion that was had always included a conversation
regarding how our ideas could help
those smaller institutions who may not have the resources
that large institutions can bring to the table.
I know that treasury and everyone in the FSSCC
plant to carry this theme forward
as we focus on artificial intelligence,
both the potential it provides and the perils it presents.
As we look forward next steps, we'll be looking for ways
that we can take good ideas from government,
best practices and capabilities, large institutions,
and find ways those capabilities can be tailored
for small institutions.
A goal of this public-private partnership
is to identify roadblocks that make it difficult
for smaller institutions
to truly leverage advanced AI capabilities.
It could be a lack of access to those advanced capabilities,
a possibility of data needed to train their anti-fraud
and cybersecurity systems
or challenges they have when working
with some of the largest technology providers in trying
to perform the regulatory mandated third party oversight.
We have these issues as part of our discussions
that occurred earlier today.
We've agreed to set up another partnership
similar to the one that was used
in our cloud security executive group.
We'll start this effort with a series
of monthly meetings focused not only on ways
the financial sector can leverage AI,
but also ways we can close some of the capability gaps
that exist between larger and smaller institutions.
For example, small institutions by their nature,
have less data to train their systems.
Can the fraud indicator exchange information sharing system
that the ABA is developing that will be piloted
with both large and small banks later this year,
provide a source of data to help close this gap?
Can some of the ideas developed
during our cloud discussions focused on leveling
the playing field between large technology companies
and smaller institutions regarding
how they can better accomplish their third party oversight
be applied in the AI space.
I look forward to exploring these ideas
and others with the FSSCC and our partners in treasury
and have passed is prologue.
I'm very hopeful we'll come forward with concrete ideas,
institutions of all sizes.
Thank you.
Peter, to you.
-: Great, thank you to the three of you.
And now we wanna get to your questions.
Thank you to those of you who've submitted your questions
using the Q&A feature on screen, encourage others to do so
if you haven't already.
And we're gonna try and get through as many of these
as we can in the limited time we have
with the three of them.
Let me go to our first question here.
"What do you think is the biggest challenge right now
in confronting AI specific cyber and broad threats?
And are the bad guys already winning?"
Todd, maybe I'll ask you to take that on first.
-: No, I don't think the bad guys are already winning.
I do think they have an initial advantage
in the ability to access generative AI tools
that are financial services firms are for good reason,
hesitant to bring into their operational environment
at this time.
So from that perspective, there's a slight advantage.
That being said, one of the stories we wanted
to tell in the AI study
that treasury released a couple weeks ago
was that our financial services firms
have been leveraging AI for the better part
of a decade or more now.
Especially in the cybersecurity and fraud space.
And there's been a lot of lessons learned from that
and positive lessons learned from that
and in actually a sign significant reduction in fraud
at some of our largest institutions
because of the use of AI tools from a defensive perspective.
That being said, I think the biggest gap in that space
is making sure the advantages on the defensive side
in both the cybersecurity
and fraud spaces are scaled to our smallest institutions.
And I think we do that very, very well
in the cybersecurity space.
I think we have some growth to do
in the fraud space in that regards.
That's something that we're gonna be mindful of
in our next steps.
And we started the discussion today
on how do we ensure that we're, again, leveraging
the capabilities of our largest institutions
and making sure that our smallest institutions
have the same advantage from a defensive perspective.
-: I would just add, I mean, I think the fraudsters
are certainly very active.
That's no surprise.
And I think to what you were saying,
we're gonna need AI to defend against AI.
So we're gonna have to make sure that we're continuing
to match that both the defensive
and offensive opportunities.
But to your point, I think we're well positioned for that.
We've more in front of us,
but I think we're well-positioned.
Peter: All right, Debbie,
you'll get the next question here.
"What's next besides meetings
to talk about the challenges posed by AI.
Are there specific goals
for this public private effort moving forward?"
-: There are very specific goals
for the public-private effort.
Part of the financial services sector coordinating council,
our mission is to take those 70 participants
and make sure that we're gathering sector wide input
to make sure that we're providing that
to our public counterparts in a coordinated response
to the challenges, the threats that we're seeing
so that we can eliminate the seams across the sector
that the adversaries would otherwise work through.
So the operative word there is coordinated
in terms of what we have in front of us.
We have the rails that you heard Todd talk about earlier
that we defined for the cloud work streams.
We're gonna leverage some of those rails to gather
that input and provide meaningful responses,
if you will, to some of the challenges that we're seeing
that will again, help make sure
that we're protecting the sector.
Peter: Great.
Paul, you'll get the third question,
I think you're probably best prepared
to take this one on.
"The treasury report talked about a credit capability gap
between large and small banks when it comes to AI.
How big is that gap?
What is the industry doing to close?"
-: Thanks, Peter.
So, you know, I think that's one of the things
I addressed in my remarks.
You know, by their nature, small institutions
simply don't have the same volume of data
to train their systems on.
They may not have access to some
of the same high-end technical systems
that some of those larger institutions have.
And that was one of the things
called out in the treasury board.
And so I think that's gonna be a focus
of our effort going forward.
It was a focus of our discussions that we had just today.
How can we better prepare
and arm those small institutions to take advantage
of these advanced capabilities?
Can we take those lessons learned
from those larger institutions
that are more leaning forward,
that have sandboxes they can play in
to test out these capabilities
and extend those to small institutions?
Can we figure out ways for them to get the data they need
to train their systems so they're just as effective
or as effective as they possibly can be?
So that's definitely a focus that we have
as we move forward in this effort,
is to trade those lessons learned, figure out ways
to provide more data, better training for those systems
and get them deployed faster.
Peter: Next one came in.
"From your perspective, what gen AI tools are banks
and other financial institutions currently testing?
What tools are they looking at for the future?"
Anyone wanna take that on?
-: Yeah, I guess, and this was reflected in the 42
in-depth interviews that Treasury did as part of the makeup
of the AI report.
And a lot of our largest institutions have been working
directly with specifically on Microsoft
copilot development potentially for internal use
at the sector level.
That being said, the current plan
and thinking on many of the institution side
is not for financial services
that would impact the customer,
it's more for informing internal operations
and also in the cybersecurity space in particular.
Peter: Yeah, one follow up to that
from the same question.
"Why is it important for FIs
to test use cases for generative AI?"
-: I think it's important in those use cases to again,
sort of strike that balance between enabling innovation,
how you're defending against threats
and how you're understanding do you have the right
sort of controls in place with this new technology.
So the use cases provide excellent real examples
of how to identify and detect issues
where controls might need to be put in place.
So it creates a sort of a safe sandbox, if you will,
for advancing the innovative side of using AI.
Peter: Next question.
And Todd, I know you mentioned this earlier, "Can you share
how your work with the cloud service providers informs
what the industry and treasury is trying to do here?"
-: Yeah, fantastic version
and it really, I think it's served as the model
for public-private partnership,
where historically, we've met collectively
multiple times a year.
We've shared intelligence information
that's been downgraded.
We had really great dialogues,
but the work didn't transcend
to the regulatory levels, right?
And I think that's something we proved
that we can advance the model
to drive significant improvements in the ecosystem.
In some cases, that go up to that regulatory level.
In other cases
because of the private partnership bringing in
the technology companies to the conversations,
there are advancements that they're gonna be willing
to make on their side now that they understand
the collective ask of the sector.
And that was one thing
that the technology companies in particular cloud providers
reflected the treasury in the makeup
of the treasury cloud report going back a couple of years,
was that they really did wanna be good partners
and good third parties on behalf of the financial sector.
But the financial sector has 7,000 plus operators
in the space and sometimes it's difficult for them
to know exactly who to listen to, right?
So what we've been able to do is show them
a pathway to a more consolidated view from the sector
thanks to this partnership with the FSSCC
and with the ABA team and VPI, of course.
Peter: Todd, you get this next one as as well.
"How is the cybersecurity and infrastructure security agency
involved in next steps?"
-: Yeah, fantastic.
And I'll say we did this report in lockstep with them
and they provided us with a significant amount
of technical edits, as did a NIST
and I will say, which is a commerce entity
that in particular, NIST
and the NIST Risk Management Framework came up
multiple different times as a guidepost
that many financial sectors firms use.
We did identify though
that some firms did have some obstacles to applying
that risk management framework at an operational level.
So this is something that we messaged directly back
to both assisted teams and NIST
and we did receive commitments
and we are gonna work in lockstep bringing
the financial sector directly to NIST in the future
as the next step of this process so that the next update
to the risk management framework
will have some operational elements
that are reflections then of that engagement directly
with the financial services sector.
Peter: Great. Next one.
"Can you all go into more detail on the idea
of nutrition labels
for data models from the treasury report?
Will banks and outside companies be willing
to give that information up?"
-: Look, I don't think it's gonna be something
that everybody will care about.
Not everybody reads nutrition labels,
but in terms of providing more insight into who
or what you're interacting with, if you think about
what nutrition labels do is they give you insight
so you can make decisions.
So when you're interacting with, you know, an AI model,
are you interacting with, you know,
somebody right out of college
or something right outta college
or 20-year industry veteran?
And we have very little way of knowing
how mature a particular AI entity is.
So if you think about the notion of being able
to sort of disclose when was the date of the last training
of this model, how much data was it trained on,
how big was the data set that it was trained on?
And then, you know,
if you think about the correlation relative to, you know,
disclosing, you know, what allergens
might be included in there?
You know, is there a potential bias in the dataset?
Are there known defects that, you know,
could be sort of disclosed on this nutrition label?
Because it's not gonna be, you know, perfect
and we want it to advance, but we want people to be informed
of the entity that they're interacting with.
The P in GPT is pre-trained.
So at some point, it stopped being trained
and I think it's important for people
to know when it stopped being trained.
And I think that just a very practical optic
in terms of that form of disclosure
informed people are gonna making decisions
based on the output, making sure
that they know what confidence to place in those decisions,
I think might be an important factor as we move forward.
-: Data is a really main element of the treasury AI report.
It's really layered throughout
and has multiple sections too
that are specific to the data issue.
And the most acute problem that we identified then
is the reliance of the smaller institutions on external data
in a way that historically hasn't been a requirement.
And I think that's gonna open up also
some additional potential operational risk concerns
from bringing the data in-house
in addition to the nutritional label aspect.
And the nutritional label aspect is really significant
to enable those smaller institutions
who are gonna be relying on those third party data sources
to meet the level of explainability that's gonna be required
of them by the regulatory oversight community.
So they're gonna have a model risk management
explainability hurdle in addition to being able
to explain the data.
And that's only gonna really happen
if they could have a really robust conversation
with those third party providers
on a clean playing field
where it's clear what's gonna be asked
of the firms from the regulatory community
and then what the firms are gonna need to ask
of the third party data providers.
Peter: There's been a lot of reporting about deep fakes.
"How does AI escalate that thread?"
Basically, we've got a couple questions on this front.
What is the industry fearing basically?
Paul, you wanna take that on?
-: Yeah, I mean I think it's one of the things
that's the accessibility issue.
You know, you could do deep fakes years ago,
but it took a lot of time, it took a lot of effort,
it took a lot of money and now we've got people, you know,
spoofing, you know, celebrities.
Tom Hanks is out there selling dental plans supposedly.
And so people can do this relatively easily.
You know, I've actually built deep fakes just
as demonstrations for our bankers
and you can get a very effective deepfake access to a system
for $1 a month that's there
and also do video deepfakes now.
So I think the challenge that we've got, you know,
there's multiple challenges that banks face.
They look at it from how are they gonna authenticate
their customers if they can't necessarily trust voices
that they're hearing.
I think banks have a lot of systems in place that allow them
to work through those issues.
The harder one actually
is how are they gonna help protect their customers?
You know, how do they, what can banks do
to help protect their customers from being scammed?
What can we put in the backend to try
and maybe slow down payments that they might be trying
to make that might have indications
or red flags that are going to scammers?
Because, you know, people look at whether it's a caller ID
that shows up that says it's US government,
or they look at a video from someone
who supposedly their romantic partner from overseas
and they get convinced
because of those technology hurdles that are in there.
And so I think it's gonna turbocharge some
of the scams that our customers are being exposed to.
We're already seeing this with crypto investment schemes,
you know, and banks are gonna do everything they can
to try and, you know, make customers aware
that this is an issue and put systems on the back end
that can maybe slow down some of those payments
or maybe make customers aware that this is something
that, you know, might be a scam.
Peter: Next question up.
"Is it realistic for financial institutions
to always have a human in the loop
overseeing this technology?
Won't that undermine the efficiency
and speed gains you get from using AI?"
-: Yeah, I think it's gonna sort of depend
on the level of detail.
So as an example, could you have a human in the loop
that's you know, inspecting
generatively created code, source code
and they can review that code, you know,
for, you know, security for syntax, etc.,
yeah, they can do that.
Then you're gonna have sort of a model reviewer.
But at some point, there would necessarily
be human supervision involved
and it won't necessarily have to be for every single widget
that's produced at the model level.
You would sort of certify things
at the sort of a bulk level I guess I would say.
So at the end of the day though,
from a financial perspective, you know, we are expected
to supervise our work to manage operational risk.
And so there will have to be somebody, if you will,
ultimately accountable for supervising the work.
Peter: All right, we got time for two more here.
It seems like third parties
like the core providers will play a major role
moving forward in the application
of AI and financial services.
How confident are you that they will be up to the challenge?
I think somebody was in the treasury report.
Anyone wanna take this on?
-: Yeah, I can start with this one.
And I think they have a significant role to play,
as does frankly the US Treasury Department
in terms of making sure we're working in lockstep
with our sector partners to try to close the gap
between our largest and smallest institutions.
And so many of our smallest institutions are reliant
on those core providers
for a lot of their core processes.
I think that's something that we did as part of this process
of bringing multiple core providers
into the interview discussion
to understand what their AI adoption strategies are.
And we really did focus on both the cybersecurity
and fraud use cases.
And we're gonna definitely try to encourage
as much innovation in that space as reasonably possible.
-: Well, and Peter, this is something,
you know, ABA is focused on.
We have a core providers committee.
We know that that's the entry point for new technologies
for a lot of our smaller banks technology moving very fast.
And so that's been a message
that we've been working with the core providers.
How can they provide these new capabilities
to smaller banks, you know, both to be better protect
their customers from AI threats or fraud threats
or others, but also be competitive.
It's a competitive space out there.
They wanna provide new services to their customers.
So, you know, we are seeing some core providers
are really stepping into that challenge,
are really figuring out ways
that they can integrate new technologies faster
and others know it's a challenge
that they need to meet head on.
So it's an ongoing discussion with us
and you know, the treasury AI white paper
really helps us highlight that issue.
And so having this partnership with treasury,
I think is just gonna simply bring more light to that issue
that we need to accelerate the pace of change there.
-: I think the other thing that's really good about the work
that we're doing is AI is gonna represent a number of things
to our country and to, you know, quite frankly, the world.
But what we're trying to do here is really make sure
that we're understanding the unique needs
from the financial services sector
and really shine a spotlight on that.
And one of the key elements of what we're trying
to drive here is, again, going back
to that word "coordinated."
We're trying to make sure that from the core providers
to the third parties,
to the US government, you know, to the trades
that we're all coordinated in our approach here
in terms of both the voice of what we need
as well as defending the sector against threats.
Peter: I'm just gonna take two in
'cause we just got one more in here.
"So similar to deepfakes,
there's been some concern in the industry
that AI will contribute
to an increased threat from ransomware.
What is the group's strategy for addressing that threat?"
-: I mean, the first thing
is we gotta all work together, but ransomware, you know,
there's two major entry modes for ransomware
and you know, one of them is, you know, social engineering
and the other one is exploitation of vulnerability.
So the social engineering is gonna get exacerbated,
it's gonna probably gonna get worse
before it gets better with the ability
to now use perhaps a deep fake to extract
somebody's, you know, credentials from them
and/or, you know, use that interaction to incite, you know,
or trigger fraud.
And we've seen that certainly in the news
very, very recently.
And again, it's probably gonna get worse
before it gets better.
So we're gonna have to work really hard.
The first step in that is gonna be around education,
which is hard because, you know, there's things like,
"Well, you know, look for these tells,
look for somebody who,
you know, does it appear to be sort of dull and lifeless
or is it, you know, a lively version of this person?"
And it's gonna be very difficult
just like when you first saw the first emails come out
to discern, "Is this, you know, legitimately, you know,
my cousin who passed away from whatever. "
we're gonna have to educate the population
on a whole new level of accuracy to be able
to discern is something authentic or is it not?
And that's gonna be difficult.
In the meantime, we're gonna work really hard
for better digital signatures to help make sure
that we're able to help our, you know, customers
or you know, other people in our ecosystem to be able
to discern what's authentic and what's not.
But you know, it's gonna be a little bit
of an ongoing, I guess I should say arms race.
And we've been at it for a while.
This is a new generation.
-: And I will say that's something
where cybersecurity for a long time
and has really been approached as a team sport
and the rapid sharing
and on the government side, the rapid declassification
of intelligence to share with the sector
has been a really a critical element of that
over the last couple of years especially.
And I think that's something we're trying to be mindful of
and purposeful of is how do we bring
that mindset into the fraud, into the fraud ecosystem.
That's something that we're gonna collectively work on
going forward.
Peter: All right, last question here.
"How is the banking industry going
to attract the technical talent needed to stay ahead
of the bad guys and find ways to use AI for good?"
-: I'll take an initial stab at it,
but I think the first thing that I would say
is you've heard a lot of news reports around the fact
that when we use AI internally, we sort of free up talent.
So that's gonna sort of be step one is to make sure
that we're leveraging AI to, you know, free up talent
to work on AI.
So that's, you know, one of our approaches.
And we're always recruiting, I would say, you know,.
We're constantly recruiting for people who have, you know,
talented people who wanna leverage their skills
to sort of fight the good fight.
So it's a constant part of who we are
and what we're gonna continue to do.
But Paul, I don't know if you wanna share.
-: Yeah, well, you know, a little bit different.
So I come from DOD from DHS,
one of the things I loved about my job,
there was a sense of mission.
And I will tell you I love my job here
because my job is to help banks protect their customers
from bad guys.
And so I think that's a message we need to get out.
Your bank is there to build systems
and capabilities to stop the bad guys
from scamming people out of their money,
stop the bad guys from breaking into those systems.
If you wanna make a difference, if you wanna protect people,
protect their livelihoods, come work in banking.
And I think, I believe, I'm truly believe
that we're making a difference here.
I'm proud to be up here with these folks.
'Cause our job, it's easy.
We're white hat guys, you know.
We're all here to protect the American people
from the bad guys that are trying to steal from them.
So I love my job.
-: And deputy secretary was out front at the start
of this administration on this issue
and he produced an op-ed,
I think the first year the administration just highlighting
that there was a gap of 600,000 cybersecurity professionals.
I think that's only grown since that op-ed
and he proposed let's rethink the pipeline
for cybersecurity professionals.
Rethink how we train,
let's rethink the minimum requirements
for these positions and let's try
to create a more diverse pipeline.
And also, this target people who need to be upskilled
who maybe are in prior positions in the economy
who maybe no longer exist
or maybe will no longer exist in the future
and let's upskill them into the cybersecurity jobs.
So treasury try to be really (indistinct) on that front.
Just yesterday, we rolled out formally our partnership
with Google and the Grow with Google program.
Treasury curated two cyber cloud
specific cybersecurity trainings with Google,
which are now free and publicly available on YouTube.
And if you pass those trainings, treasury will consider you
for cyber IT positions regardless of your broader background
or your geography in the country.
-: I think a number of people are also reducing
their requirements for a four-year degree
and hiring people based on either experience
and/or certifications into the roles.
And that's certainly broadened the pool.
-: Great.
With that, thank you to the three of you
for your time for sharing your insights here.
Paul, Todd, Debbie, thank you.
Thank you to members of the FSSCC team
as well as the Treasury team who supported this effort
and have continued to support these meetings
and this collaboration going forward.
We will share after this concludes a link to the recording
of this press briefing.
And if you have follow up questions, feel free to reach out.
Until then, thanks for joining us today
and from all of us here at ABA, we'll see you soon.