0:02So my name is Pete Eggerman. I'm the co -founder and chief product and technology officer at Apartheid. What do we do? We waste the time. We break the business model of scammers and other threat actors globally. One thing about scam is it's a global problem. It's a $1 trillion industry. Pictures like that of scam and fraud compounds across the world, which are ran exactly like organized business. businesses. Down to the fact that they've got script writing departments, finance teams, infrastructure teams, you name it. Where we come into this is we want to break their business model and we do this in a couple of different ways. What we initially set out to do at Apartheid was change the economics of fraud and ultimately where our research began from the lab at Macquarie University in Sydney, Australia was how do we waste their time and how do we take on and I suppose waste of a human resource.

0:56that scam centres operate. So long conversations. I think our longest conversation to date has been just over two hours where we're talking to the scammers, we're extracting intelligence on those voice calls as well as engaging and then really taking out their ability for their call centre operators to be able to make more calls. So it completely demolishes their business model and starts to mean that there's less scam calls. and there's less volume hitting people and hitting telcos and networks. But what we found very, very quickly in our journey is that voice was just one element of the entire equation. So not long after we started with the voice technology and we deployed within the biggest bank in Australia and the biggest telco in Australia as our first clients, we started moving into Telegram, WhatsApp, SMS, web, email, which is surprisingly still one of the biggest threat vectors when it comes to scam and fraud, and moved across...

1:52those numbers are quite outdated, millions of conversations across each one of those channels and multiple artefacts extracted. So our agents will go and extract URLs, the metadata, understand the infrastructure of the scammers and the fraudsters that we're talking to, and be able to package all of that information up, where we work with our partners, for instance, within law enforcement, intelligence agencies, telcos and banks to take action and disrupt. But we might, just before we go too much further, I'll just play a little demo of what it sounds like on one of the calls that our bots have with scammers. I took call to be delivered to an address in San Diego, California, sir. Be for real, mate. I'm in Sydney, not bloody California. I mean, no. I typically didn't buy anything like that. Hang on, mate.

2:37Like, are you saying I usually kind of go buy on your card right now? But I'm kind of not dead. Well, like I couldn't get it, then. I just thought that I shouldn't. I still don't really buy anything.

2:58So we've got hundreds of thousands of personas that we deploy in these environments and they take on wherever our victims and wherever the population we're protecting sits. So for instance, across Australia, we mirror the demographics of the Australian population. Our deployments in the UK, very, very... similar we use personas which could be all sorts of age demographics and ranges um all sorts of cultural and different uh different uh multicultural backgrounds as well to make sure our victims our victim bots are the most convincing in what they do and what they do um one of my favorite things though is the frustration that we cause every day could you repeat that uh i don't believe that you have got to say this though sir are you the we got to you bloody you Oh dear, that sounds a bit of a chant.

3:47You are a...

3:52This is all day, every day.

4:02So we're probably one of the only companies in the world which has an OKR about the number of F-bombs that we get on our calls and text messages from scammers. It just means our product's doing the... job. So everything though from those conversations turns into intelligence. So we understand from voice what the tactics, procedures, the way that they're operating these particular campaigns. And we can see these targeted campaigns spinning up against particular targets across all of our deployments. Say for instance, we can understand when there is a scam trending within any country that we're deployed in and understand exactly what the tactics are. so it can protect consumers. But beyond that, it's understanding the mule accounts, understanding what the payment rails are and effectively all the infrastructure.

4:50So we can understand the one side of it being the procedures and the tactics, but then secondly, we've got actionable intelligence and insights that we can go and do something about. And so we partner with some of the largest banks in the world and across and telcos as well, I should say, to say, okay, we've identified that this particular bad actor is using this account. Let's take that account down. Let's debank them, or let's start to do some offensive work against them to uncover their network, understand exactly what they're doing, and blunt their attacks across multiple vectors.

5:30So something about it, and I suppose this is our little brag sheet here. We actually reduced for the biggest bank in Australia. their scam losses by 30%. The CEO of the bank at the AGM last week actually mentioned us by name. I think we're the only vendor where that's happened in recent memory around what we've done to protect all of CBA's customers. And just to give everybody an idea of the scale of that bank, they probably bank around 60% of all transactions within Australia. In terms of consumer losses, we did $183,000 of losses prevented in one afternoon. campaign. So 15 live scams, a callback scam that our agency interacted with and immediately blunted that attack for one particular bank, Macquarie in Australia. Typically, and we work with a number of intelligence sharing networks, we'll detect fraud events and detect campaigns typically 12 to 13 days beforehand.

6:21And the last one, and I updated my slides, but I don't think it's taken, is that we've done close to 17 years worth of engagement with scammers just on a voice with telcos alone to date. So effectively, wasting that much time that they've been able to really stop that impact that they've had across our customers.

6:44So some of our clients, I'll just skip through this pretty quickly, but you can see some pretty big logos there and some of the partnerships that we're building now across the US as well to start to blunt the attacks here.

6:56So one thing that I want to speak about is what we've built on Cloudflare. initially when we constructed this we're our researchers and academics and a lot of our engineering was you know cobbled together in python and having a little bit of fun and i suppose not really built for the efficiency or scale um problem that that we faced immediately ultimately this meant to massive blow it in costs especially in the early days of uh in the early days of our company so typically on a deployment we might be taking 30 or 40 000 calls we may have to deal with 150 000 calls daily numbers at any one time when a campaign spins up against a particular telco or a particular bank. So for us, that meant cost immediately. So we made the decision to work with Cloudflare to refactor and can reconsider around how we built our agent platform. So initially it was one bot per container on our AWS setup idle most of the time because, you know, if we've got a bot which is sitting engaging in WhatsApp, you're not going to get a WhatsApp message every second.

7:55So we've got bots and they're sitting there doing nothing, and that linear cost scaling for us.

8:02So why we chose Cloudflare? So we've scaled our infrastructure close to infinitely. So we're using a system of durable objects and every conversation being held by the durable object. So sleep went idle, wakes in milliseconds, and we don't have to spend the overhead in terms of managing servers and managing that infrastructure. You know, it costs less. You know, the cost stops growing then with every bot. We've got around on text close to 27,000 bots operating across countries. And each one of these, now we can scale even further and further and further to take on more conversations without that cost growing. And it's much more faster and simpler to build on. Now we've unified all of our platforms across text voice, using AI gateway and workers AI as well, to mean infrastructure is much more simple to operate.

8:50What that's meant for us is that we've been able to quickly and... rapidly scale our business, move across multiple jurisdictions, and get more intelligence coverage much, much quicker than what we used to be able to do. So today, we're using Cloudflow workers for ingress and routing of every single message that we're receiving, receiving hundreds of thousands of messages per day, relaying via Twilio and where we have direct interconnection with telcos using workers, durable objects, so one per bot to hold state. So what we can do is have conversations which may start on a voice call and then move onto WhatsApp or move even into an email or different channels. Because typically what scammers try and do is move to the encrypted channels as the end point where they'll perpetrate their scam and release that sort of intelligence. That's typically where the payload of payment information or crypto wallets or anything like that really sits.

9:41We use Cloudflare containers to maintain our connections with WhatsApp and Telegram. We're working on Signal at the moment and a few other. few other channels, including audio is there. So we can pick up the phone when someone calls us on WhatsApp and be able to have that discussion and keep that persona alive. And we're using the AI gateway. So for us, that's been a fantastic way to centralize all of our AI requests and the load that we have. As you can imagine, doing this sort of thing, generating responses is a heavy load on TTS, STT, and the model. that we use for both analytics and response generation. So it's allowed us to centralize and control that plane much, much easier than we've been able to in the past. Plus workflows, D1, R2, Warp, Gateway, just about the whole stack of Cloudflow we're using in our business today.

10:34And for us, yeah, this has been the biggest thing for us. 50% lower cost than our previous infrastructure on AWS. 500 to 1,000 concurrent bots per container that connect. to WhatsApp or to the telco and then the DO is running underneath that container and one to three milliseconds to wake an agent. What used to happen for us was if we had a pod die or something like that we'd be out of the conversation and if we're out of the conversation what it meant for our clients is that we're not actually extracting that intelligence. So in the past we'd had situations where we'd stop mid -conversation or the scammer may be right at that point where getting bank account details or extracting out that intelligence and we'd miss that. And so now we've got that confidence that every time we're in that conversation, that we're able to extract that intelligence reliably.

11:23We know that our agents are going to wake up and engage with that traffic and be able to hold that context across each one of those conversations to maximise our intelligence and what we can do in terms of disruption. One thing as well, and a lot of the we have around our engagement is based upon the concept of hidden Markov models and the Stuckelberg equation. And ultimately, what this means is every time one of our agents goes into one of these discussions with a scammer or a threat actor, we go into an adversarial environment. And the way that we consider this and the way that we deal with this when we're generating our responses is that we use a combination of LLMs in every conversation that we're having.

12:09Ultimately, our technology and where our research was in modeling every step of a conversation. For instance, during the speech, I introduced myself. We did a little bit around setting the scene. Now we're getting into the technology a little bit. We modeled that across scam and other threats so we can understand at what point is the hook, at what point is the part where the threat actor is going to provide those details, how they're building trust with a victim. And we use a machine learning approach to... influence our agents around what part of the conversation that they should be in. But ultimately, we also give the agents the ability and that orchestration to pick the different LLM models so we can make sure that we can't be fingerprinted, to make sure that the way that we're engaging in each conversation, that we have the best chance of pulling out that intelligence.

12:58So openly, what that means for us in terms of workers' AI is utilizing open models on there, models like GLM. GPT, OSS. We do run a few other models out there, but it's allowed us that flexibility and then that visibility over what we're doing. Likewise with the gateway, and then ultimately our tasks become cheaper and cheaper and cheaper. When you've got the quantum of data that we see, and we're typically sitting within around 17 ,000 groups every single day in terms of Facebook, WhatsApp, and Telegram, there's a lot of processing for us. And for us now, using things like Cleft, for instance, we can process every message in one of those groups at relatively low cost and high availability for us, which where it's meant for our business is that we've discovered all sorts of illicit activities where our bots were only looking for, for instance, typical investment scam.

13:48We've seen things like illicit tobacco, illegal gambling, people smuggling, all sorts of things. Now we can work with our clients to start to address those problems.

14:02So ultimately, a lot of what we do as well is around the agent design and how we run, I suppose, each element of the conversation. And so we have those faster models holding the conversation and keeping that sort of super low latency as we work with the scammer to extract intelligence. So what that means for us, so one of our telco clients is one of the largest in Middle East and across 18 different countries. can run that on Cloudflare right in their environment, right next to their environment at super low latency and high concurrency, which is important for us in terms of keeping the conversation flowing. But whilst we're doing that, our agents are also operating in the background to provide additional context. So we're doing tool calls, we're understanding have we seen this person before? Have we seen this particular scan pattern before?

14:51When we're on WhatsApp, for instance, or some of the text channels, we may be generating images and doing things like that as well. to provide, you know, for instance, the scammer often will say, okay, you know, can you show me proof that you've sent this payment? Whilst we're engaging, we'll send them a message on SMS or on WhatsApp or a different channel to say, hey, here's the payment receipt that we've generated in the background. You know, this is legit. In some circumstances, we're deploying as well, synthetic credit cards, canary tokens, things like that to capture infrastructure and understand exactly what is going on there. one thing that i'm really proud of my engineers is i suppose the complexity as well that's been removed from our code so we've went from 90 000 lines down to 20 000 lines in terms of running what uh what we're doing and it's meant for us this refactor has uh made it a lot easier to maintain and then start building more features so a lot of the stuff that we can now focus on has been on our product roadmap for you know quite a long time but now we've had that refactor and understand exactly where our product is sitting, we can really move a lot faster than where we have in the past.

16:00And ultimately, and I think I mentioned before, the products used on Cloudflare, workers, durable objects, containers, workflows, D1 and R2. And look, you can imagine that with a company like ours and the sort of threat actors that we're dealing with every day, we've got a pretty big target on our backs most of the time. So securing everything behind Cloudflare as well.

16:22So building fleets like this, what I'll tell anybody, is really to match the compute to the job. That's probably one of the mistakes we made early on, but now I've been able to course correct on that very, very quickly. And now we have a much, much larger fleet at quite a significantly lower cost. Things like what we do in terms of believability and that control as well, we keep human hours. That's part of what we do in terms of believability. But it's also another measure where, you know, it allows us to start to mimic and start to look more like humans when we're keeping, you know, daylight hours for the jurisdiction that we're in. We also do proxying, use a number of different ways to present as if we're in a particular country. We don't depend on the one model.

17:07That's been something that's been very, very important for us. And really sizing the model to the job has been one of the key learnings that we've had. In the past, you know, we'd use the highest quality model. and believe that that was going to be the way that we push things ahead. But ultimately, we've continued to change models and refactors so we can understand how those different models can impact the conversations that we're having with threat actors, as well as seeing and being able to experiment between choice of model for the different workloads that we have. And one thing that we've done is really, rather than going big bang, we've migrated one of our fleets of bots first and then brought the rest across. which has allowed us to keep continuity for all our clients, keep the intelligence flowing, but then build out on Cloudflare. Thanks so much for the opportunity.