RAC WA

"Big tech finally agreed on something. It changed nothing." That's the title of what I'll be presenting at CyberCon Melbourne in October! Earlier this year I put in a submission to AISA under the theme of supply chain and data provenance, and among a big field (around 800 this year, apparently), mine made the cut for a 40 minute breakout session. It's awesome, because I get to talk about something I think really matters but that mostly gets discussed in circles of people who are already into it. Everyone should care about this one, because the quality of our news and media as well as elements of public safety depend on it. Here's the gist. Not long after I put my talk in, Google and OpenAI announced how they were going to prove what's real online: every image gets a signed receipt, a hidden watermark, and your browser does checking for you. For about an afternoon there, it looked like "deepfakes" were sorted. I feel the clever cryptography was the easy part, and to be fair they nailed it. But we are struggling with the hard part: who actually runs the trust list, who can afford to be one of the "trusted" ones, and whether any of it survives someone taking a screenshot. Fair warning though: this stuff is changing so fast. It's already moved since I submitted originally, and I'd put money on it changing again before October. Which is sort of the whole point! It's on 14-16 October at the MCEC. Come and find me. https://lnkd.in/gX73Ehwp #cybercon2026 #cybersecurity

This is a very rare opportunity in WA - send this to a unicorn, or apply yourself.

Great opportunity to step into a L2 Senior Risk & Compliance Advisor role driving risk oversight and strengthening our business’s regulatory and control environment. You’ll be supported by an excellent leader and team making this a stand out opportunity to step into.

There’s a growing push toward media provenance. Work like CAI (Content Authenticity Initiative), C2PA (Coalition for Content Provenance and Authenticity), and Project Origin are all pointing in the same direction: attach cryptographic provenance to media so we can tell who published something and whether it’s been altered. The idea makes sense. Detection of stuff will lag the creation of it. In addition, at least anecdotally, I’m seeing more and more often in casual conversation that people are becoming increasingly unsure whether what they’re looking at is genuine, edited, or even attributable to a real source. As technology reshapes how data and media move, concepts of authenticity and non-repudiation are definitely becoming larger areas of focus for my world. Historically, we treated source and origin as reasonable shortcuts for trust. If something came from a known publisher or platform, we mostly assumed it was legit. That was never perfect, but the distribution constraints kept the problem contained. That assumption doesn’t really hold anymore. Content is copied, edited, re-encoded, and reposted constantly. Scroll a bit too far past a cat meme your partner sent you and you’ll end up watching a video of someone’s face overlaid on another video, reacting to it, with thousands of views, instead of the original footage. It is positively bewildering. It is though, a good illustration of how hard it’s become to even identify media of worth, before you get anywhere near verification. The problem has shifted from getting access to something to proving its origin, integrity across change, and accountability for it. Where I pause though is not the crypto. I’m worried about what will grow around it. When the main drivers are going to be large vendors, major media organisations, camera manufacturers, and social platforms, the question becomes less about whether provenance works technically for me, and more about how much influence we are comfortable concentrating over what is seen as “authentic” and how that is presented to everyone else. We’ve seen this before with SSL. What started as a technical integrity mechanism slowly turned into a platform-mediated trust signal, shaped by browser root stores, CAs, and UI decisions. A relatively small group of browsers now effectively decide what “trusted” means for everyone else. Content authenticity risks (and sort of already is) heading down a similar path. None of this means provenance is the wrong direction. It’s probably unavoidable. But the hard problems won’t be the maths. They’ll be governance, incentives, UX, identity assurance, revocation, and probably most importantly who controls the trust signals. Curious to how others, and my peers in cyber security are thinking about this, both technically and ethically.