ID.me CEO Blake Hall: Identity & Security

Blake Hall is the co-founder and CEO of ID.me, a secure digital identity network with over 100 million members.      

In this episode of World of DaaS, Auren and Blake dive into online security, passwords, AI, and geopolitics. Blake explains the concept of identity wallets and their potential to streamline access to services and benefits. He also breaks down why identity wallets are like VISA and Mastercard, and explains where there’s untapped opportunity for a trillion-dollar company in the identity space.  

In the second half of the conversation, Auren and Blake discuss espionage in the digital age, the influence of Iran in the Middle East, and adapting to changing warfare tactics. They close with insights into Blake’s framework for hiring executives and assessing strategic thinking, and questioning conventional wisdom in entrepreneurship.

World of DaaS is brought to you by SafeGraph & Flex Capital. For more episodes, visit worldofdaas.buzzsprout.com, and follow us @WorldOfDaaS. 

You can find Auren Hoffman on X at @auren and Blake Hall on X at @Blake_Hall

Editing and post-production work for this episode was provided by The Podcast Consultant (https://thepodcastconsultant.com)

Transcript

Auren Hoffman: 0:02

Welcome to World of DaaS, a show for data enthusiasts. I'm your host, Auren Hoffman, CEO of SafeGraph and GP at Flex Capital. For more conversations, videos and transcripts, visit Safegraph. com slash podcast. Hello, fellow data nerds, my guest today is Blake Hall. Blake is the co-founder and CEO of IDME, a secure digital identity network with over 100 million members. Blake, welcom to the World of DaaS. Thanks, Auren, appreciate you having me on. I'm really excited. Now. Passwords are something that's kind of embedded in the fabric of internet today and a lot of people don't even think about it. Alternative, even though most people don't like passwords, why are we still using passwords today and what's a better solution?

Blake Hall: 0:46

Yeah, I think these organizations tend to deliver services from the perspective of their bureaucracy and not for what is best from the point of view of the consumer. Of course, across the web we're accustomed to this. Passwords are just terrible, and our brain weren't meant to manage one or two strong passwords, much less like 300, going on 500, which is what I think is the only surveys have it at. When we first started working with the Department of Veterans Affairs, they actually had 500 plus veteran-facing websites.

Auren Hoffman: 1:15

Oh my gosh, A veteran may have to log into like 20 of them or something like that, all with different passwords and stuff.

Blake Hall: 1:22

Yeah, and when you think about then this app for, like VA facility finders and there were 40 of them, the same app with different parts of the organization had decided was a good idea but wasn't communicating with the others and nobody was really thinking about.

Blake Hall: 1:39

Well, how do Americans want to authenticate? What's the most convenient pathway for people to authenticate? And you'll see this a lot in technology, where organizations look at the world from their point of view and not from the point of view of the consumer. And I came from outside the industry, obviously, like my only real work experience prior to IDME was a lawnmowing business, lifeguarding and people shooting at me in the army, and I said I think that people should have a digital wallet that is their login and their verify data that moves with them, and that if you could have that experience, you could not only get rid of passwords, but you could also dramatically streamline access to really important civic benefits. You could increase financial inclusion. That's what we're doing, but it's really interesting in that each organization on its own can't solve this problem. You need a utility like Visa or like Mastercard as a third party to really change the way that the ecosystem works, and that's what IDME is doing.

Auren Hoffman: 2:41

So many times when you go to a website, you're often reentering the same information. In some ways, it makes sense, because we want different people to have access. Maybe you don't want everyone to have access to your credit card, but if you're buying something, you want them to have access. And then which credit card? And then, okay, well, of course, you don't want everyone to access your passport, but every once in a while you're flying international, you need United Airlines or whoever to get access to your passport information. And then, of course, you have information about your kids or something You're constantly, and they're like oh, I don't remember my kids.

Auren Hoffman: 3:13

Whatever Social security number you have to go like look it up. And the big hassle. It just makes sense that there would be like some sort of system, but we've been talking about this forever and still today, I mean, every company, including yours maybe, solves like a little piece of it there. We're still having like retype all this information over and over again, Like, do you ever see there's going to be a convergence or do you think for a long time we're going to have gazillion systems? There will?

Blake Hall: 3:39

be convergence. I'm a big student of economic and American history and looking at how markets develop. Mark Twain has this quote that history doesn't repeat itself. But it rhymes, and I think you can see that in the patterns of payment wallets, which are really the first version of what I would call identity wallets that are more holistic and representative of how our physical wallets work. And when you think about how did Visa even come to be?

Blake Hall: 4:09

We take Visa and MasterCard for granted that we can just avoid paying with cash and have these portable credentials that move in our wallets. But the story of Visa starts with Bank of America and Bank of America card in 1958, where they literally just mailed out 65,000 credit cards and people didn't know what credit cards were. It took 18 years where Bank of America actually cultivated the market and matured it to an extent where it made sense for the network layer to uncouple. And then you had the emergence of Visa and these issuing banks For identity wallets.

Blake Hall: 4:42

Idme really is like Bank of America card. We're not just a digital wallet, we are an issuer of legal identity that federal agencies and state government agencies look at the credentials that we can issue into our digital wallet as legal proof that you're you and what that's doing is. It's allowing Americans to have a single sign on where they're verified. Identity and their personal information is moving with them for the first time ever in this country across 15 federal agencies, including Social Security, irs, treasury, hhs and so on, 30 plus states, 600 private sector organizations and right now we have 120 million users and we verified over 50 million Americans' identities to the Department of Commerce standard. It's kind of like digital real ID, if you will, to verify where you?

Auren Hoffman: 5:34

Where do you think this is all going? I love that you're talking your book, which is awesome, but if we had to think out five or 10 years because we certainly have more passwords today than we did 10 years ago Maybe people use a password manager, so it's a little bit weird. It may have an Uber password to get into the password manager and then they might not even know all the passwords that they have and stuff like that. Are we going to have fewer things? Are more folks going to use systems, Whether it's ID, me or Google or other types of things? Are there going to be a small number of aggregators? Are they going to have a lot of power? So we're going to need to regulate those? How do you think the world's going to play out? I think it's going to end with four.

Blake Hall: 6:12

It'll be us, clear and the phone manufacturers like Google and Samsung, and then Apple as the four digital wallets. Just like there's Visa, mastercard, mx, Discover I think you'll see a similar breakdown and there will be consolidation. I think the first identity wallet that can do social login personalization in CRM at the top of Funnel. The verified identity can reduce fraud and charge backs. It can do payments. That company will be a $100 billion plus company with a real shot at getting to a trillion in this market. And that's where the convergence no-transcript will really have a material impact on people's lives, where the same login is facilitating account sign up and sign in the same level of personalization that Amazon delivers to folks. That data is now untethered and can move with the consumer.

Blake Hall: 6:59

So you could have a really exciting wave of innovation where newer app developers, if they're able to curry trust with folks who are signing up, those folks could provide all sorts of information about their profiles in a given context. That would then change the way that they're interacting. I don't think that's too far off. I think that's five to seven years off, because there's a lot of things that need to be true in order to mature the market to a point where you start to see that convergence it's coming between mobile driver's licenses and that's how the manufacturers are. They're looking to the DMVs to be the issuers. Idme and Clear have built our own issuing capabilities, which has allowed us to move a lot faster in terms of verifying that Oran is Oran, which is the hardest part of digital identity is verifying that you're you on the internet.

Auren Hoffman: 7:47

It is getting better. There was a point where, if you want to open up a bank account, you'd have to actually go physically into the bank and bring your birth certificate or something, and now you can at least move your face around or something. It's not the best, but at least it works. You can get a bank account open a lot quicker. You're right, it's still many years away from where the world you believe is going.

Blake Hall: 8:07

That's right. It was 1958 to 1976 for Bank of America to become Visa and then it was really into the late 80s where Visa was ubiquitous and everywhere that you want to be and you even had. I think the MX Costco deal just ended in like 2016. Diners Club, which also started in the 1950s, is still a brand that's owned by Discover. So these market developments, where there are these third-party ecosystems that need to develop to enable commerce to make people's lives more convenient, literally take 30 to 40 years from inception to being ubiquitous, just given all the coordination and standardization that's involved to change the way the market works.

Auren Hoffman: 8:49

To me there seems to be like three besides for, like the technology providers, like you guys, there's like three other stakeholders. There's the actual site or company where you're logging in to, there's the consumer that's logging in, and then sometimes there's the company which either the consumer is the employee of or has some sort of relationship, which is also maybe paying for some of these logins where, like Octa or something plays in. Everyone I know hates Octa. It's just so annoying, it's terrible experience and stuff like that. Do you see the company as a stakeholder coming into it as well?

Blake Hall: 9:25

So back to Visa, which again I think is the 1.0 version of the market. There's five stakeholders in Visa You've got the issuing bank, you've got the acquiring bank, you've got the merchant, you've got the cardholder and then you've got the network in the middle and so identity in a way that works like our physical wallets. Work is actually six-sided, so it has many of the same elements. In fact, substitute the payment processors and acquiring banks for like an Octa or a Ping or a 4DROC that help with processing credentials, just like you have Verifone. And in Genico is payment terminals Right.

Auren Hoffman: 9:57

There's like the off-zeros of the world and stuff like that.

Blake Hall: 10:00

Yeah, All this infrastructure that helps each organization kind of manage and facilitate their identities. You've got Salesforce managing CRM and things like that. The thing that's different with identity is that you have this nearly infinite number of credential issuers, depending on the use case. So where did Oren go to school and what are your educational degrees? What is your criminal background history? If you want to chaperone your kids on a field trip, where you need to go get screened for the school system. What are your content subscriptions Netflix and HBO and it's infinite.

Auren Hoffman: 10:34

It literally is infinite, it's infinite yeah.

Blake Hall: 10:36

And so what you're figuring out we call this workflow-based return on investment. The way that we see the world is that there's a lot of toll booths and these are processes that are manually administrated. They're very expensive and they're very time consuming. So, for instance, we do all the guest check-in now for MGM and Wynn, and getting to Las Vegas waiting in line with your bags for an hour at happy hour was one of the most frustrating experiences that I had, not only as a traveler, but also as somebody who would go to conventions a lot out in Las Vegas. Just a huge penalty on your life. To be able to automate that workflow and to have it work more like airline boarding passes is really transformational in terms of how it gives people time back.

Auren Hoffman: 11:15

I mean, that is so frustrating just the fact that you can't even walk into your room with your phone and stuff like that. Why is that going on? It seems like the airlines would have way more regulations than hotels. Why is it easier to go to an airline board an airplane than it is to go in a hotel? It's a great point.

Blake Hall: 11:34

That's why, when we looked at it, I think, just the level of fragmentation and technology forwardness. There's more pressure on airports to screen people in an expeditious manner than there is on hotels, and I even think there's certain types of hotels that have operational challenges that mimic airports. So if you think about airports, airports are the proverbial bottleneck. Everyone has to go through it, whereas hotel is much more fragmented, so it's more dispersed. But when you get to those large properties in a concentrated market like Las Vegas, you see these operational challenges and now you're left with smaller companies relative to the airlines and airports that have to solve for. Well, how can I develop that same level of convenience and service? So there's all these things that make it hard for why passwords still dominate the internet and why it's taking so long to solve for it.

Blake Hall: 12:23

But what's really exciting is that if you think about the easy pass and the interstate, you can look not only at a given workflow but a broader work space to say, well, what do I need to do to get to the airport? How do I get through security? How do I board the airplane? How do I get to the hotel? How do I check in? After I'm checked in, what restaurants am I going to? What shops am I going to? Why isn't there a digital passport, a wallet that allows you to bring your own identity with you to make those workflows more convenient? And that's why it's so hard, because the stakeholders, who are involved at every step of that journey this is just taking a trip to Vegas that we're talking about there's a ton of them and you have to convince them that you're the right solution, that they should allow this third-party network in there, and it takes years to just pick one workspace, one interstate if you will, and then to become that easy pass from start to finish, across that life experience.

Auren Hoffman: 13:19

Okay, yeah. Now there's these countries like Estonia that have, at least according to the press, one login across all government services. I think Singapore has some sort of national ID app that integrates. Can you ever imagine something like that happening in the US?

Blake Hall: 13:34

Yes, I mean, we're building it. Some important differences, I think.

Auren Hoffman: 13:38

So we have, like the city, state, national right. It's much harder in the US, much harder.

Blake Hall: 13:43

Much harder, and there's. In America. There's inherent distrust of government based on our founding and how we threw off our English friends, and versus what you have in Europe, but if you look at what consumers value, that is the same. They value convenience, and so in Sweden and Norway, there's a product called BankID, where they don't have a different login for healthcare and government and banking. They have BankID. The average swede uses it five times per day. Oh wow, it's visa for everything, not just payments.

Blake Hall: 14:12

And Estonia, where Tenel, our co-founder and CTO, has been just a great partner the last 14 years, is from same thing. Now, estonia only has 1.3 million people, so it's much smaller. It's like a large city in many ways, but that is the blueprint for what we're building, I think, in an American model, the federal government, I don't think should or ever will like, mandate a national ID for Americans. What you will see, though, I think, is based on these standards that are set by the Department of Commerce and NIST, which is the National Institute of Standards and Technology Within the Department of Commerce. You will start to see innovation from us, from companies like Clear and the phone manufacturers, to create options for portable and reusable identity that Americans can benefit from, and so you'll have a much more competitive market based on choice. It's going to take longer to develop because it's not mandated by the government. I think you very much are seeing as those four companies grow ourselves included the emergence of a new consumer-centric model of identity where your login and your data moves with you.

Auren Hoffman: 15:22

India, over the last decade or so, has moved into more of a national ID. Walk us through what we can learn both the pros and the cons of how they rolled it out from that.

Blake Hall: 15:33

So there's a few things I think what's interesting about the developing world is that they'll often like skip steps that you might see in the developed world, and so if you look at the challenges that India had with national identity, you maybe got a farmer who was born like 30 to 35 springs ago, not quite sure one name, a record of this person existing. Where do you even start? So actually they started with biometrics and they just said you know what your face is going to be your identity, and that's how they scale. Now, because it was centrally mandated and because the technology didn't really have time to mature and get market tested against different use cases, there were tremendous issues that they ran into in terms of how the technology works, privacy controls, all sorts of things that made it subject to fraud, and so I don't know all the details, but I do know that there's been quite a lot of turmoil around how it was executed, and that's sort of the downside of mandating a centralized system that's then rolled out at scale to like everybody. So the way they approached the problem was quite interesting. I think double OAs in the details as far as the execution In an American model, folks need to be able to opt out.

Blake Hall: 16:43

I think, in the same way that we would say to any of our customers as we create a digital flow is like hey, we're creating kind of the airline boarding pass model. It doesn't mean that you can take the counter away, though the counter is still there. If you don't want to go through this, you still have exactly what was there yesterday and in fact, the counter maybe has better service now because the line is a lot shorter as a lot of folks are going through the digital channel. But these notions of really careful technological development that's been honed by the market, privacy controls that are built in proactively what you see in Europe with GDPR, what you see in California now with the California Consumer Privacy Act that's a major difference that you will see in America and in the EU versus India, where there's a lot less regulation, for better or worse, about how they rolled out their system.

Auren Hoffman: 17:35

This idea that you could even steal someone's identity is so crazy, just like the fact that someone could get your IRS return money instead of you or bill Medicare 50,000 times for fictitious patients and stuff like that.

Blake Hall: 17:52

Yeah, but it's lost 2 billion too, yeah.

Auren Hoffman: 17:55

And then you don't get notified. You would think if someone's randomly doing something for me, like getting a return for my taxes, I would get an email or something being like hey, Orin, someone just got $300 from the IRS in your name or something. As we move to more and more of these ID systems, is it going to be harder and harder for criminals to steal IDs. Is that part of the benefit?

Blake Hall: 18:17

I think it's becoming easier for them to steal IDs, which is, quite honestly, why there's such a tailwind around these portable and reusable frameworks. I'm sure you're familiar with chat GPT you have to be living under a rock if you weren't with that one but there are these tools out there in the dark web called Fraud GPT and Worm GPT, which are these open source large language models that have been retrained to be evil, and they're being used by scammers, and so, if you'll recall, I think a year, maybe 18 months ago now, the FBI worked with LinkedIn and announced that there were 32 million fraudulent accounts on LinkedIn. I mean, that's an astonishing amount, yeah.

Auren Hoffman: 18:55

I'm surprised it's that low. Honestly, I think I've personally done a few million of those over the years.

Blake Hall: 19:03

And so what we're seeing is this unbelievable sophistication in social engineering and scams, where these aren't the old Nigerian print emails with the typos and the spelling errors, where you can be like, come on, give me a break, I'm not going to fall for that.

Blake Hall: 19:20

These are criminals who are luring young people disproportionately into job interviews and then harvesting all their information, their documents, their selfies, everything you can imagine that could then be used to perpetrate fraud, and then they go off and they pick off organizations that have their own siloed identity systems, one by one, and so there's just been a massive, massive increase in those types of attacks and the batting average where folks who would not normally fall for a scam that's run by somebody who's not proficient in English Now, through these large language models, are able to do that. We've seen some of the more sophisticated nation-state linked groups in Asia and Eastern Europe using generative AI to generate counterfeit documents and, in fact, just on X a few days ago, there was a cryptocurrency exchange and a well-known document authentication vendor that was defeated using, I think, an ID card that took the researcher like all of 10 minutes to go ahead and create and submit, and then they were in and had passed know your customer controls there to prevent the financing of terrorism.

Auren Hoffman: 20:26

It's a real problem and we're moving to where it was. You can do defake some voice now very easily. You can do defake some video super easily. There was one recently where a accountant went on a zoom and saw like their CFO and a bunch of other people on the zoom it was all deep faked and they ended up wiring $25 million 25 million, yeah. So this is happening now at a page that is going to be. We're going to see an unbelievable amount of fraud in the next few years. I agree.

Blake Hall: 20:55

I agree, yeah, and then that's where there's a different type of technology. So a lot of folks are familiar with facial recognition, which is similarity to say, like I see a picture of Oren and I go that's Oren's face. Presentation attack detection is testing to see whether that selfie is in fact a genuine human face. And is it that person's face or is it a deep fake? There's an ISO standard for it I think it's 30701-3, if I'm not mistaken. But that presentation attack detection is testing to see is that really Oren in front of me or is that a synthetic, a deep fake, somebody holding up an image or a video? That class of technology, which verifies that that is in fact a real human face, is going to be the most important thing to protect our social media conversations and, quite frankly, our democracy from extensive manipulation.

Auren Hoffman: 21:46

There's no way that that's going to work a long time. It's just a cat and mouse game. Or do you think that's possible? We'd have to cryptographically sign everything or something.

Blake Hall: 21:55

No, you can definitely defeat it through multiple layers for sure. Maybe, at the end of the day, is profit equation where it's like what's the benefit of the attack and then what does it cost me to do it, and then can I scale that the same way the entrepreneur would scale a business, so it might be worth it to go steal $25 million, but not worth it to steal $300 or something.

Blake Hall: 22:16

Right, and so when you're dealing with internet fraud, one of the first things you deal with are devices, and generally it's expensive to have more devices and procure them and to manage them, even if you're a bad guy, and so the relationship of an attacker to a device is important. The presentation detection technology that we use has defeated. I mean, I haven't seen a deep fake get through on the face of a metric side in years. Now, whether it'll stay that way is a question, but there are really cool technologies that are out there that have a way of piercing the veil, so to speak, and some of these attacks using randomized bursts of color and other things where the face will refract light in a way that is not replayable, and so I think time will tell, but for right now, we're covered. We tomorrow, we won't be.

Auren Hoffman: 23:06

In today's world, everything is very decentralized, and so there's lots of login providers, et cetera, and the bad part about that is that, well, a lot of them have really bad security and they're very, very vulnerable for tech. The good part is that, because there's lots of them, all of them only have access to a very small amount of your information and Lava is really not that valuable information anyway, or something and the fact that you subscribe to the service or something. If you move into a world where things get much more concentrated, ok, well, the good news is that you're way better security. It's way harder to hack, but the bad news is, if you do hack it if you remember the OPM hack from 10 years or so ago, you hacked it. Now, all of a sudden, you have access to the deepest secrets that are out there. It's all concentrated in one place. So is there a way to have our cake needed to still somehow like it's centralized, but there's different encrypted packets, rooms within rooms within rooms, or how do you see that evolving?

Blake Hall: 24:07

You brought up a really good point. The first thing you want to do from a privacy and security standpoint is we're not innovating in a vacuum here. So you want to say what is this model relative to the model that exists today, and is this better or worse on different dimensions, that you can look at the trade-offs and decide on balance, from a policy perspective, what makes sense? One of the challenges of, and one of the reasons why it's taken so long in this country to have portable and reusable identities through digital wallets is because the companies that have the most scale and have the most logins issued to consumers tend to be the largest application providers, and that introduces really serious questions of privacy where, if you're Facebook or Google, you have somebody's entire social media and messaging history or their search history and then you start to see their login activity across the web. We kind of view that, like Ghostbusters, don't cross those strings.

Auren Hoffman: 25:02

And Apple for sure, right, I mean you just take the few biggest guys, exactly.

Blake Hall: 25:07

We kind of say there's three layers of identity. You've got the trust layer, which is the wallet layer. That's you and your verified credentials, generally public senators, faces and their stuff are out there on their websites and your educational degrees. If you just looked at LinkedIn or Facebook, I would posit that like 95% plus of that is public. You could FOIA my military service. The next layer of identity is the application layer digital apps, and that would be what we're all familiar with, from Netflix to Facebook to TikTok and Instagram, whatever. And then you've got the physical app layer.

Blake Hall: 25:41

We think that the trust layer needs to be partitioned from the application layer of the economy. Whenever you have Facebook or Google trying to come down and welding those together, we call that a voyeur state. If you weld all three together through, like WeChat or Tencent, you have a surveillance state where China is actually using biometrics to surveil you. In our model, you basically have your own data. Most of it's already public. If you went to state licensing databases, that's where doctors are registered, that's where beauticians and dog walkers and plumbers and everything. It's already out there and it's publicly available because it's in the public interest for these credentials to be available. What is difficult at the trust layer is is that actually Orin, or is it somebody pretending to be Orin?

Auren Hoffman: 26:26

And also, is it true, did Orin try to fake it or something like that? Or I could try to claim I run a marathon in two hours, or something like that.

Blake Hall: 26:35

Yeah, exactly. And so when you think about these claims and everything else, what the wallet gets into is like this is Orin, and are these claims true or not? But you don't get into behavior. And that's really what we're talking about the difference between the trust layer and the application layer. We want to know who you are, we do not want to know what you do. If you had our logs, it'd be like Blake Hall, a veteran, logged into the VA, and I logged in the IRS tax student paying my taxes. What I do within those applications, though, if it's health care at the VA, tax at the IRS, that's decentralized within the application layer.

Auren Hoffman: 27:10

Yeah, ok, so they store that somehow. Ok, that's right.

Blake Hall: 27:15

And it's how physical wallets work. Right, I'm checking into a medical appointment. I pull out my wallet hey, I'm me, my wallet goes back in and then the system is like well, you have an appointment with Dr So-and-so for whatever, but it's a different system. So that is how it works. It allows for the decentralization and the separation of the application layer from the trust layer, and it's a really important concept. It's also really important to winning and to creating this vision of user-centric identity, because if you are a major application provider, you compete with applications that you would want to have adopt your utility. So, if you're Amazon trying to get Amazon Pay Everywhere, do you think you're going to get that into Walmart or into grocery stores? Probably not. So that's one of the reasons why it's taken this long to solve this password problem is that all these incumbents who have these natural advantages of scale they have trust issues and they have competitive brand issues that have prevented and inhibited the development of a market that's built around consumers.

Auren Hoffman: 28:14

One of the craziest things to me about this whole thing is that we have this secret nine digit number that all of us have and we're supposed to keep it so secret, but we give it out randomly to people. This social security number makes no sense to me and I think historically it was never meant to be secret either, right? It's like this very weird thing. It's like you can't tell anyone your social security. This random code or something it's like it will unlock everything in your life. It seems like we've got to get away from that.

Blake Hall: 28:46

Right, there's two things that are going on. I think the social security number is incredibly important as a unique identifier for Americans. It's like a yellow pages address to your point. It's fine. It's all been compromised, by the way, you know. Fax breach, opm yeah.

Auren Hoffman: 29:01

Equifax.

Blake Hall: 29:02

Not 80 million. So the toothpaste is out of the tube, and so a social is helpful for what we call an identity, identity resolution, which is to say, maybe there's like it's a join key. It's a join key, that's right. There's 30 Oran Hoffmans out there that have the same name and date of birth, but which one are we really talking about? Well, the social can win it down to like one.

Blake Hall: 29:24

What we're seeing now, though, is that there's been so much synthetic identity fraud that's entered the market Because the Social Security Administration will not corroborate social security numbers outside of financial institutions that are using this pretty expensive system that social security administers, and so that's created an opportunity for criminals to inject what are called synthetic identities. They will take a child's social security number or a made up and fictitious social security number. They'll add a name and date of birth to like a credit application, and then they'll create what's called a synthetic identity, because it represents a person that doesn't actually exist. If you have kids, I strongly recommend that you add them to your credit information as quickly as possible, so that their social security number is entered with their correct name and date of birth. Like all of my kids have their own credit cards.

Auren Hoffman: 30:14

Explain this. So you actually went and got credit cards for your kids. That's right.

Blake Hall: 30:20

It's just like taxes. It's a race against bad guys to like claim your own identity before someone else does.

Auren Hoffman: 30:26

So you went and essentially claimed you got a little Johnny or something like that. You go claim his thing somewhere, get him a little Visa card. So that's kind of somewhat tied to your address and everything's to somebody else. Doesn't get there first, Correct.

Blake Hall: 30:40

Once you understand how credit bureaus and data brokers work. The life cycle for ingestion doesn't come from the government, it comes from a credit application. It's kind of first come, first serve. The first time that they see that social security number and it's tied to a name and date of birth is what is entered as the initial record for that identity. And what kids, unfortunately across the country in pretty significant numbers, are finding is that they're turning 18, they go to file for credit. Oh, your social's already been used and it's been tied to extensive fraud. Where your credit score is going to be awful.

Auren Hoffman: 31:10

Isn't there a way for this? Is my naive thing for the bank to know that this social security number was issued only six years ago. So is persons probably six years old or something, or there's no way for them to know that?

Blake Hall: 31:24

Used to be that social security would issue social security numbers based on the geographic location that you were born, in a relatively chronological order.

Auren Hoffman: 31:32

Yeah, like nines were California and ones were Massachusetts or something or whatever it was.

Blake Hall: 31:38

Yep. Some years ago, though, they stopped doing that. It's like this randomized pattern, and some criminal groups have claimed hard to know that they can reverse engineer the algorithm. But now it's randomized, so there is no correlation of a social security number to age or geolocation of birth, and the industry has lost that as a fraud signal to go oh, this date of birth and the social couldn't possibly be tied together, and so that's created the opening for fraud.

Blake Hall: 32:02

So the first kind of PSA is like if you have kids, like as soon as you can piggyback them on your credit so that what the credit bureaus have matches their actual identity, and if somebody else tries to use their social security number, that would be flagged as fraud because you've already added your children to your credit report and there would be a discrepancy. So strongly urge you to do that. But I think when you look at synthetic identity fraud several years ago the Federal Reserve Bank released a report that was the fastest growing form of fraud in the financial services market so billions and billions of dollars lost every year, and that really is another reason that the industry is moving pretty strongly towards biometrics, similar to what India dealt with. You do have nearly 45 million Americans who either don't have credit history or what's called thin file they're young and Maybe they changed their name recently that are listed in the last one immigrant, or something like that.

Blake Hall: 32:53

That's right. What a lot of DMVs will do when you register your identity is they'll check to see if that face has been tied to a different identity, and there's now a direct link between the person who's applying for the identity and the identity itself. It's not a number, it's your actual selfie.

Auren Hoffman: 33:13

But how does it work? When you go to the TMV you take like one picture and just some random photo, and doing a Photo match against hundreds of millions of other random photos, which just really also just one picture, is incredibly difficult. You have a lot of false positive, false negatives. Even with the best algorithms and I'm sure the DMV does not have the best algorithms out there Is it even effective if they even a very small number of false positives or false negatives, you'll see a million matches or something. It's not gonna be that helpful.

Blake Hall: 33:48

It's much more accurate than that way. More accurate than that the top performing Algorithms are, if you look at the NIST facial recognition vendor testing programs, way, way more accurate, especially with DMV quality photos. You would be looking at a match rate that is much more likely to be a true match than a false positive. And if you took care to configure the technology the way it needs to be and without going Too deep into the weeds, the same way that you kind of see a person you're like, oh, like.

Auren Hoffman: 34:18

So all the DMVs, somehow, are like sending their photos to a more centralized system that does the fingerprint on the photos and I don't know if the DMVs are working cross-functionally.

Blake Hall: 34:28

There are some law enforcement databases that do that, but certainly within each DMV that has enabled this technology, you've got millions of records that they're doing and I know like Arizona is one of the examples of a DMV that does this and it's caught folks going through that. We're pretending to be somebody else or applying for multiple identities with the same face. The question again is like, given how it's configured and there's all these things called like confidence intervals that can cut down on the false positives, what is the gain versus what is the potential harm? The potential harm if somebody Especially could fly in an aircraft this is 9-11, 23 years ago Can put everyone else risk by traveling under a false identity.

Blake Hall: 35:09

Versus, you've got maybe a 20% false positive rate within a pool. You know the corollary. That would be like you got an 80% true positive rate where people are up to no good Registering different identities as the same person. Is that worth it? That's a policy question, I think. When you look at the security risks and the amount of fraud that's being perpetrated, that has been lost, I don't think it's a particularly close call, given that if you abandon that in favor of things like data brokers, in that there's much more structural bias, particularly against lower income Americans, where they get stuck waiting for weeks and months or have to go in person for services relative to to facial biometrics, which, in our testing, has shown to be the most Equitable out of all the components that we've tested as far as true matches.

Auren Hoffman: 36:00

We could be living in a world very soon or maybe we already are where. Back in the day, if you're like a spy or something, you would get a legend. You would have a false identity or something like that You'd show up in another country. Nowadays, if you get flagged in one country, they could be sharing with another country. If you get flagged in China, maybe you now can't show up in Venezuela or something. You're just burned forever, which you makes it very hard to like. Have these kind of more Undercoverish agents and stuff. Is that your experience? Like it's just gonna be harder and harder to like be a spy 1000%.

Blake Hall: 36:35

I mean, if you look at what China's already done to our intelligence network, there's a reason it's hard to get intel from that country.

Auren Hoffman: 36:42

Yeah, and you don't know if they're gonna share it or not with some country or something, or they have like some sort of API or something going through. Now, speaking of defense geopolitics, as you mentioned, you're a veteran. Three American soldiers were recently killed in Jordan and I think if you ask the average American, we probably didn't even know we had troops there near the Syrian border and we're becoming more and more vulnerable to things like drone attacks and stuff. Where do you see this going? Are we gonna have to have there's a lot of our base there a little bit more decentralized, which is hard to have defenses? Are we're gonna be a lot more central? Where's that gonna start going?

Blake Hall: 37:20

Again, we're trying to maintain the peace and regional stability in America's. The world's only superpower Plays a really important part in that. You can see that with the Houthis and the shipping lanes. If America doesn't keep those shipping lanes open, then who does? She's protecting the Norwegian tankers and everything else that's moving through.

Blake Hall: 37:38

The real question of that region is what to do with Iran. The Iranian influences just unbelievably malign. There was a guy that I was hunting when I was over there. His name is Kais Kazzali, and Two weeks after the October 7th attacks, the leaders of Hamas were in a rock meeting with Kais Kazzali, who's a leader of an Iranian paramilitary group. So you can see the influence of Iran across the region and really this Contest between Iran and its proxies in Saudi Arabia and its proxies and political interests, and and America's caught really in the middle, trying to maintain regional stability In the midst of Saudi Arabia and Iran really pursuing adversarial agendas. And so it's really unfortunate, obviously, when American service members are caught in the middle of that, and the drone attacks are just this new feature of this 3d battlefield. But back to the basics what is our strategy for the Middle East and for Iran in particular, in order to stop the unrest that they're sowing Throughout the region. That is causing a lot of suffering, a loss of life now.

Auren Hoffman: 38:45

You were involved in our Operations in Iraq. We went in there 21 years ago and a lot of people would say that that operation has in some ways made Iran even stronger, so it had a lot of unintended consequences and stuff. As someone who served there and probably experienced a lot of Loss of friends and other types of things like, how do you square that in your own head?

Blake Hall: 39:10

It's terrible. I mean, before we went in I told my friends like this is gonna be my generations Vietnam and you thought that, even just going in yourself, okay or I even went to combat General Petraeus of the famous line during the invasion.

Blake Hall: 39:22

When he turns the reporter he goes. Tell me how the sense? I was a Senior at Vanderbilt University and some of Rumsfeld's aides came through and they were citing all these statistics and they go 80% of Iraqis don't approve of attacks and coalition forces, yada, yada. My hand shot up and they're like, yes, could I tall? And I was like, sir, the corollary of that is at 20% due in a nation of 25 million, that's 5 million people, third world demographics going to skew younger. So let's cut it in half. For males it's 2.5 million. Lop off 500k. You're left with about 2 million fighting age males against 125,000 coalition troops, but with a tooth to tail ratio, which is logistics to war fighters, of 7 to 1, it's really 25,000 American war fighters against about 2 million Iraqi insurgents. Don't you think that's not enough soldiers? And they said well, our war planners are too good for that. And I was like, actually, general Shinseki, you know? And they were like I can't question.

Blake Hall: 40:17

So you know, General Shinseki Abizade, I grew up in a military family with a very clear understanding of the general Powell's doctrine like the American way of war, when you go to war, go to war with a clear American purpose, national interest at its stake. When decisively come home, have a clear objective.

Blake Hall: 40:35

Yeah, and we lacked all that clarity. And so, exactly, there's a lot of history in the region, with the British drew like arbitrary borders under the Sykes-Picot agreement that had created these illegitimate governments. And if you look at what Saddam Hussein did, as far as the atrocities that he perpetrated, they weren't against Sunni Arabs who were his political base. They were against the Kurds, gassing like halabja, and against the Ashiah and Jujail and the Marcia Arabs after they rose up against him. So the violence is concentrated against the groups that don't perceive the leader of the country as legitimate. And when we upset that balance and created a power vacuum, Iran absolutely exploited it. And I think that is the legacy of our involvement in Iraq is that we just gave Iran a lot more power and influence over Iraq in a way that is still playing out in a very negative manner across the region.

Auren Hoffman: 41:30

And the US in some ways has the best training you know, warfighters, et cetera. But we are slowly losing our advantage because somebody with a $200 drone can do what we used to be able to do with a $20 million drone. And you're starting to see these even outs where someone with a very small amount of budget and a little bit of ingenuity and not having to deal with all the red tape that you have to do in the US, so it's going to be harder and harder to fight our adversaries in the future, or do you not agree with that?

Blake Hall: 42:00

I do agree. I mean we'd have these multi-hundred million dollar electronic warfare systems that were deployed and, without giving away the specific tactics, I mean a base station with rental draft would defeat, you know, like 550 later. You know, I've defeated this system just by adapting. And that's really the thing is.

Blake Hall: 42:19

If you have a centralized bureaucracy and in our procurement system, which was built to fight corruption, not to innovate, fight corruption up against really really cellular Level enemies that are adapting and iterating on the edge all the time, you're going to lose. Until you adapt and General McChrystal is, I think, the best operating general of our time, if General Petraeus is the best strategist and Crystal and the operations is saying was it takes a network to fight a network and until we push more of that authority down to the edge and funding down to the edge, where we can iterate in real time and have less of these centralized years long complex deployments and really get into the cat mouse game, we're going to continue to get owned. And the latest example of that is like these drones coming from Yemen that cost thousands of dollars to build and we're shooting them down with missiles that cost millions. Even when you, when you lose because, like the economic, that don't scale.

Auren Hoffman: 43:21

Yeah, yeah, it's really interesting. Now, separately, obviously, you run a very fast growing company. I saw an interesting tweet from you asking about how to hire, executive hires and open ended questions that you ask them to see how their mind works. Like what are you some of the good open ended questions for hiring?

Blake Hall: 43:40

Sure, and just to preface it, I noticed an on meta, who's our chief people officer, ran talent for a Dalai at Bridgewater for 10 years. We'd be in conversations with executives and I'd leave and I go on and I couldn't be more clear. Like I told him exactly what I wanted them to do and he would go you're not going to see any change in behavior. He goes. All they heard was that you're just giving them more work and they don't know how to think more creatively about how to be more efficient and how to prioritize their work. And I was like what do you mean? And so on on to juice me to this theory called stratum, which is essentially understanding how somebody's brain works. And we all hear the same words in this question and I'll provide a few examples, but the way that our brain processes that question and structures it and the time horizon that we think across and everything else is quite different.

Blake Hall: 44:29

So if we were to take a relatively benign question like, tell me about the value of a bachelor's degree, the way that Thomas Jefferson would answer that question is going to be quite different from your typical high school senior.

Blake Hall: 44:41

The high school senior is going to be like well you know bachelor's science, bachelor's arts, it could do this vocational thing that maybe I'm thinking about. You're down at very tactical, linear level, thinking over the next two or three years, jefferson, and systems level thinkers. They'll reframe the question, they'll go well, what's the purpose of education and what's the purpose of education at a country level, at a community level, at a team level and at an individual level? And so the thinking across different time horizons, and then they're thinking about why you even need an education in the first place and what you're after. And what's really interesting is that thinkers can go down, so, like Jefferson, can go all the way down to the tactical conversation and hang there, but the tactical thinkers can't go up, and you will see this. Another question you could ask is like should we legalize cannabis, which may be an odd question to get an employment interview, but is one that we'll ask folks and again, we don't really particularly care.

Auren Hoffman: 45:36

Yeah with the argument. You want to hear the argument rather than yeah exactly you describe we care about.

Blake Hall: 45:41

how do you see the problem? How are you structuring it? What are the different trade offs that are at play? And so it's less important about the thing that you decide is more important than the other. It's more important about laying out the picture and understanding how you think.

Auren Hoffman: 45:55

What I like about the cannabis question is it's a well known argument. If someone's just parroting back to you what everyone's heard before the argument, then it's not as interesting. But if they're coming up with something new and injured, or I've thought about it in an interesting way, or that, it's like oh wow, tell me more. But if someone's just like, oh yeah, like whatever, here's the talking points on one side of the other, it's harder to imagine them going deep on things.

Blake Hall: 46:20

Yeah, 1000%. And so what you'll start to see the difference is the lower level stratums, like one, two and three. They're all linear relationships. So A, B, C and it's kind of what you'd expect from somebody who's like a first line manager below the systems level thinker start to see relationships between concepts. So actually A, B, C that influences E over here, and then E as a concept actually is maybe in tension with this other thing over here.

Blake Hall: 46:47

And so four is like you can start to see relationships between concepts and indirect effects. And then five is where things start to become simple. You can truly see the field for how concepts enter, play with other concepts and you can simplify it, so to say. All right, here's how it all works and interacts at a systems level. But these are like the three things that matter and if we influence these things in this way and mathematically it's a pretty small percentage of the population You're talking about 1%, maybe less that can see the field in that way and it's like speed, it's immutable in the context of a business, in the same way that once you can understand someone's brain, structures, information and processes it, whether it's complex or simple, you get a sense for how when you're giving them a task, if they can see what you can see or not.

Blake Hall: 47:38

And the thing is, if you're more than one stratum off from somebody who reports to you, it's going to feel like screaming into the abyss.

Blake Hall: 47:45

Having built a multi-billion dollar company like yourself, I'm sure you've seen along the way where it's like well, why did some executives scale and we're able to like keep up and some just kind of hit their ceiling and even though they were trying really hard and coming to work with like great intent, just weren't able to see what you're able to see.

Blake Hall: 48:04

And so something that seems pretty easy to a systems level thinker, it turns out is pretty hard to somebody whose brain doesn't work that way. In the same way that a kid who's fast can't really grok, why another kid who's not fast isn't fast? It's just something that is true. This framework allows you to see that and to screen for it, and it's enormously powerful because you can be much more kind and empathetic Once you realize that this person's showing up at work. They're trying really hard to come through for you. They don't want to let you down, but if they're not fast, you don't want to be cruel and say if only you cared, you'd be fast right. Imagine if your sports coach told you that it would just be dead.

Auren Hoffman: 48:45

Is there a sense that obviously, if someone is a quote unquote level one, it'd be very hard to train them immediately to get to level seven, but you might be able to move them up one notch and another notch over time. Or do you think it's really hard for people to move out of those?

Blake Hall: 48:59

levels. It's like rings of a tree. It's immutable. In the context of business, it takes years to move from one stratum to another. Even for folks who have stratum six and stratum seven potential, maybe in their 20s, or like a stratum four, it's going to take decades for you to move from one to the other. So it's the same reason that how long did it take General Petraeus to make General Officer? Even with incredible training and Princeton and everything else? It took decades for him to go from second lieutenant to seeing the field.

Auren Hoffman: 49:29

That means, in your case, only somebody who's 40 years old or over can hit this. At least from my experience, that does seem like there are people who can do that much faster.

Blake Hall: 49:39

Yeah, there's different places. Where you start from, there's just like speed right. There's kids who are just naturally faster earlier on in life, and so it's just where you're plotting them out. I think you'd find a lot of the founders and CEOs who've been successful and are able to scale up the business naturally start much higher in terms of their ability to see the field and then they're developing at a pretty fast clip. But it's different from skills development and training and it's different from behaviors and habits, where there is this and a cognitive capability that once you can see it, it's moving, but it's moving almost imperceptibly slow, almost like the way that you age. So it doesn't necessarily mean everyone's equal or starts from the same place by any means, but it does mean that once you see it, you can kind of know at what level that person can be successful at over the next three to five years.

Auren Hoffman: 50:26

It is the important when you have strategy to at least have a good understanding of the tactics. One of the things is that in fields that evolve very, very quickly let's say marketing or something which evolves very, very quickly or a lot of technology related things Someone who was good at tactics like 15 years ago they might be quite good at strategy now, but the tactics have changed dramatically during that time and if they're not like practicing, sometimes they end up having the wrong strategy because they missed the tactics, or do you disagree?

Blake Hall: 50:55

I would probably say that's probably more of a stratum play. I mean, there is some of that where somebody's just got a process and a playbook and they just come over and blindly try to apply it. It doesn't work anymore. But actually this is why stratum is important into my own life over in Iraq.

Blake Hall: 51:08

When I went over there, rumsfeld and Casey were over there and they'd said it's counterterrorism. So we're just going to stay on our fobs and we're going to go out Sallyforth and come back. I would come back to base and I would tell the first sergeant I was like I feel like I'm Don Quixote, like, tilt your head when it melts, go out, get blown up. Al Qaeda has a cup of chai tea and after we roll through they're back in control of the neighborhood and it was General Petraeus who came in and said it's not counterterror, it's counterinsurgency. That's really what's going on. Get out of your fobs, get into the neighborhoods and then violence just went pfft. So being able to diagnose the nature of the problem, truly to see the field, that's the first order thing and you can see it when it's missing at the top.

Blake Hall: 51:52

I would say Rumsfeld and Casey, lower stratum. They were so fixated that it was counterterror. They couldn't even look at the metrics and realize after years that they were wrong, and it took General Petraeus to go. No guys, it's this. And then here's the playbook for how we do that. And then you look at the metrics. It changed a military that was losing and on the verge of being.

Auren Hoffman: 52:12

And the new thing, if you interviewed someone like Rumsfeld just with your normal questions, you'd be able to suss that out, because obviously he was an incredibly intelligent guy and you could talk about almost anything in a super interesting high level way. But, like a lot of intelligent people, you end up in a box and it's hard to get out of that box. You even see some of the best Wall Street traders. They end up in a box and up losing all their money sometimes.

Blake Hall: 52:37

Yeah, I think you could see it because it's not about being smarter or articulate or believed on the facts. I mean, you'll get a lot of that with ACTs and SATs, like brilliant people who are lower stratum. They're brilliant on the fact but they can't truly see the field. They don't actually understand how the concepts interrelate, they can't simplify it, they can't diagnose what's really going on. There will be some interplay with values like ego obviously plays an incredibly important role in learning and being able to sort of adapt, which I think is an interesting thing to explore about how much humility and ego will get in the way of an accurate diagnosis of what's going wrong. When you look at somebody who's really smart but flunked the test for four years, something's wrong there. They were very dumb in terms of what they did. Same thing with Bremer HBS guy. I'm sure he's very smart in terms of books. Didn't do it Alexander the Great did with Aristotle, which is don't disband the army, double their salaries, make them loyal to you. You can rule, create reconciliation.

Auren Hoffman: 53:38

If I had to diagnose the foreign policy quote unquote establishment over the last 25 years, I would say they all failed. In the US. These are incredibly smart. You and I met these people incredibly smart, interesting people, but like to a T have all failed then yeah, yeah, because if I'm marching my way they can be smart in terms of putting forth an argument, phd.

Blake Hall: 54:02

When you look at where that argument hits the real world, they failed. They're very dumb in that sense, which is unfortunate. When you run into a higher level stratum, you'll see the time horizons. Over what time horizon are you thinking about Elon Musk? He's thinking over millennia how to make humans multi-planetary. Whose brain works that way? We're like everything backwards. Planning from that.

Blake Hall: 54:25

I think I know from what I experienced over in Iraq is that these really hard questions about all right, we've captured all of Al Qaeda. They're in prison in Camp Bukka. What should we do with them? Let's let them go and we let Baghdadi, who became the leader of ISIS, go. He became the leader of ISIS in our prisons in Camp Bukka, and so who made that decision? What could go wrong? That you had all of Al Qaeda and Iraq go and a year in prison together and then you have the Kurds and the ZDs running up the mountains is awful, because I've been in those villages and flowers in our body, armor and just wonderful, beautiful people. You can have really smart people, just like you had living social here in DC that raised a billion dollars and went to zero and they can work really hard and take sacrifice, like my friends who gave their lives for this country, and you can do it in a way that actually drives regression against what we want to advance in the world, which are Western values and freedom and so on.

Auren Hoffman: 55:24

This has been really interesting. Last question we're going to ask all of our guests what conventional wisdom or advice do you think is generally bad advice?

Blake Hall: 55:33

Oh my goodness, there's like double-edged all this stuff. So when folks say like, don't give up, stay the course, you have to really understand and dig deep into a framework for what they're talking about. If you stay the course and again you don't actually have a good idea about the root of the thing, you can end up in a really rough spot. And so when I started, I was pitching TroopSwap to our early investors and they would come up to me and they go Blake, I don't believe in that business model, but I believe in you, so I'm going to invest. And then they would show me a picture of their kids and this happened not just once or twice, but like a little kid. And they're like this is my daughter's like college fund. She's counting on you. I'm like, oh, hey, man, so you don't believe that this business is going to work. You're still investing. And then you're guilt tripping me with your child, holy crap.

Blake Hall: 56:25

And so one of the things that allowed me to be successful but it was still really hard was I had a very clear idea of what scientific experiment I was running.

Blake Hall: 56:36

That I was like this is my hypothesis of what the problem is, these are my assumptions, and as I run these tests, I'm going to either validate or invalidate these assumptions, and I think, as an entrepreneur, you really have to know that so that if you're going to stay the course and not quit, you are learning, because entrepreneurship is really about finding a secret in the market that nobody else knows about and then capitalizing on that and exploiting.

Blake Hall: 57:01

It's like a legal form of insider trading. If you have a clear hypothesis and you've got clear assumptions that you're either validating or invalidating I think you give it enough time You're eventually going to be successful. You're going to find something that nobody knows and you're going to be able to go get it as long as you keep iterating, as long as you keep iterating. So that's a little bit paradoxical, because the company doesn't fail and the money runs out, company fails and the founder gives up. You have to have that quantitative side of it, that framework, before you get into the qualitative stubbornness of staying the course, and both of those things have to be true at the same time. It's why it's so difficult to breathe a new company into life.

Auren Hoffman: 57:40

In some ways, you need to unwind a trade when it's going against you. That's right.

Blake Hall: 57:44

Yeah, yeah. If that's like a secular current, what is that force that's moving me that I didn't anticipate before? If you can't beat them, how do I join it? Like shift the boat, so it's moving with it All right, this has been great.

Auren Hoffman: 57:58

Thank you, blake Hall, for joining us on World of DAS. I follow you at Blake underscore hall on Twitter. Definitely encourage our listeners to engage you there. This has been a ton of fun.

Blake Hall: 58:09

Thanks, warren, appreciate you having me on.

Auren Hoffman: 58:12

If you're a super data nerd, go to worldofdAScom that's D-A-A-S. Worldofdascom and sign up for our weekly data as a service roundup newsletter. Thanks for listening. If you enjoyed the show, consider reading this podcast and leaving a review. For more World of DAS and DAS is D-A-A-S you can subscribe on Spotify or Apple Podcast or anywhere you get your podcasts. You can also check out YouTube for videos. You can find me at Twitter at atoran that's A-U-R-E-N. Oran, and we'd love to hear from you. World of DAS is brought to you by SafeGraph. Safegraph is geospatial data for physical places. Check it out at safegraphcom. And by Flex Capital. Flex Capital vests and data companies like those we talk about at World of DAS. Check it out at flexcapitalcom.