The Identity Illusion: Deepfakes, Superfans & the Battle for Authenticity with Dan Meacham

In the second episode of The Black Hat Files, host Phillip Wylie sits down with Dan Meacham, VP, Information & Content Security at Legendary Entertainment.

The conversation goes straight to one of the most complex challenges facing security teams today: identity.

• How do you protect what’s real when anything can be replicated?
• What happens when superfans, insiders, or bad actors blur the line between engagement and exploitation?
• And how do organisations respond when deepfakes and synthetic media start to scale?

Drawing on his experience protecting one of the world’s leading entertainment companies, Meacham breaks down the risks surrounding digital identity, content security and the growing sophistication of social engineering tactics.

From deepfakes to fandom-driven threats, this episode explores what it takes to defend authenticity in a landscape where trust can be manufactured.

Because when identity can be copied, protecting what’s real becomes the priority.

Transcript

SPEAKER_01 0:00

Mentioned how you were the industry that really created deepfakes. I know. We should apologize now because you know if it hadn't been for media and entertainment space, we wouldn't really have the faculties and capabilities we have today for deepfake. I can't do e-discovery inside Copilot as an example or inside Gemini. I think there's a potential of a lot of data leakage. As much as the technology makes things easier for us, it also opens up a lot of opportunity for risks and exposures.

SPEAKER_00 0:35

You're listening to the Black Hat Files, your backstage past the cybersecurity's global stage. I'm your host, Philip Wiley. Every month we bring you an exclusive interview recorded at Black Hat MEA from the heart of the industry. These are the stories we're telling. Let's crack open the files. Today I have joining me Dan Meechum, uh VP of information security and content security at Legendary Entertainment. The title of this episode is The Identity Illusion, The Fakes Super Fans, and the Battle of Authenticity. Welcome to the show, Dan.

SPEAKER_01 1:04

Thank you.

SPEAKER_00 1:05

So before we get too far into the episode, would you mind kind of sharing a little bit about your background?

SPEAKER_01 1:09

Sure. I'm Dan Meachum. I've worked in the cybersecurity space for close to 30 years now, it seems to be. Getting out there early in the days back when we're using IPX and SPX on the Novell networks. But for the last 10 plus years, I've been at Legendary Entertainment and we make movies and we also have television shows and comics and a digital presence with nerdist.com. And with that particular piece, I started out with the cyber side and ended up into content security, then uh also brand enforcement and then physical security. So uh I report directly into the CEO and my team, we cover everything from the corporate stuff down to the production and even to premieres.

SPEAKER_00 1:51

Very cool. So yeah, very familiar with your company. I watch a lot of movies. Uh prior to 2018, I kind of got busy with conference stuff community, so I didn't have as much time. But I used to watch over a hundred movies a year in theaters.

SPEAKER_01 2:03

Oh my gosh.

SPEAKER_00 2:04

Well, thank you. Thank you for supporting my 401k. You're welcome. I just don't think anything beats for me the theater experience, you just can't beat it. Home theater, I've just never never been able to get a good replacement for that. So I just really love the theater experience.

SPEAKER_01 2:20

Right. The the sound, the picture. Uh, especially if the theater has a great bulb in there, the projector, and they got the color just right and the sounds just right. But you know, things have been changing over time. So now we're moving more into having those as experience centers. And so whether it's a four-dimensional seats that you sit on that vibrate, to having the screen get wrapped around you on the sides, or changing the venue to be, you know, a diner, or even as a sports arena to watch sports. So it's really interesting to see where our industry is enhancing the different experiences for our consumers.

SPEAKER_00 2:55

Yeah, it's pretty interesting the the theater experiences. You mentioned how how that's changed, uh, just be able to dine in theaters and have the reclining seats and have the comfort compared to the the old days. Two of my grandparents, my grandmother and grandfather used to work at a drive-in movie theater, and my grandfather was the projectionist. So they had the old type of film where you had to splice together and then certain part of the movie you'd have to switch reels.

SPEAKER_01 3:19

Right. Those are good old days. Yeah. And we still have that with all of our products that we put on IMAX as well with the big, big reels. But you know, some of that's changing, especially with the way the industry's going, with all the introduction to the technology and AI, is at some point you're going to be able to do content on demand. And so you may be at some point be able to pick what movie you want to watch in the theater through crowdsourcing. So some of the theaters may have a particular auditorium set aside for Friday nights, and everybody upvotes what movie they want to watch for Friday night. And then maybe at some point in the future, you may say, hey, generate a movie that involves these characters with this type of plot. And then it could be auto-generated in a matter of minutes to for your for your entertainment.

SPEAKER_00 4:05

That's interesting you say that, especially when you think about how that could work in the gaming world. How you know the adventures can go way beyond what you know was originally scripted.

SPEAKER_01 4:15

This is also kind of interesting that you mentioned that because the gaming engines are a big core of what we have in our productions today out on set. So you hear a lot about the Unreal Engine being used in things like Fortnite and so forth. Well, when you watch some of the different shows, say for example, like The Mandalorian, that was actually filmed in front of a big 8K or 10K wall. And that's actually like an Unreal Engine that's behind that, that particular talent and that actor. So now instead of having all of the different props in a whole set design, it's very minimum because it's all done on a big screen. And as the camera move pans up, the background pans down. And so it really allows us to uh embrace the world with the talent and have that experience while they're on set. Because if you're doing something with a green screen like we used to, uh, you're looking at dots. And then sometimes you may have to adjust where you want people to be looking. Sometimes the lighting is off and everything else. But say, for example, if this was one of those volume sound stages where the wall behind us was all screens, the ceilings all screens and everything else. If the director wanted to, they can just draw a little uh sun up there at the side to the side, and they can choose it to be more warm or more cool. And as the brightness on there reflects down onto you and casts shadows onto the costume, it actually also casts shadows into the artifacts that are in the three-dimensional world that's created on that panel.

SPEAKER_00 5:44

Yeah, that's very interesting, especially when when you mentioned the positioning the sun and setup. It makes me think of back to the old days when I was doing AutoCAD, how you could do the 3D drawings and you would set the lighting on the person and you would select your lighting point. So it's kind of interesting how that three third dimension can make it more of a challenge. But it I guess the technology in AI is helping out with that.

SPEAKER_01 6:07

Yeah, see, technology is, but then as much as the technology makes things easier for us, it also opens up a lot of opportunity for risks and exposures. And especially since most of everything we film today is digital and we stream from camera to devices uh to like the director or on a virtual production, we may actually be streaming what we're shooting real time to somebody on the other side of the world. So that way, you know, if that's part of a story writer or that's the graphic designer that wants to see how they want to uh position a tree behind somebody's head, because the director is like, I need you to move this, or let's rotate the world a little bit. Uh, it really does open up some exposures there. The other things, too, that's also kind of fascinating is, you know, as we have the cameras here, we may have somebody that has an iPad that's watching on the iPad, and they can take screenshots as we go because we may have to reset the scene. Like, is the hair in the right spot? You know, is the splatter or, you know, is the product placement in the right spot? And so, or looking in from a stunt coordinator and say, hey, I need you to move a little bit more to the left because we don't want to have this particular type of risk. And so having all of this new technology in our workforce is pretty amazing to have real-time response and awareness of what we're actually shooting. But then there's also a lot of downstream effects that we also have to take a look at in our supply chain and when we talk about like post-production, such as visual effects or localization. And what localization is, is say, for example, we shoot a movie in Los Angeles and it's in English, and we're going to distribute it into China. Well, we need to have the market in China to speak the native language, or we need to have subtitles. And so our supply chain will take our product and then from that use different technologies and tools. And in today's world, we're using a lot of AI to create those sounds, to create the dialect, to create the subtitles.

unknown 8:06

Yeah.

SPEAKER_00 8:06

So one of the things I I could see is an interesting interesting challenge is just seeing how securing and making sure the content doesn't get leaked or stolen by threat actors. Because you know, the old days when it was film, that's physical security. But nowadays you got the all this digital content. It seems like that could be a challenge to try to be able to protect and make sure that that data is not stolen.

SPEAKER_01 8:28

Right, right. So in the old days, right, if somebody would have to actually physically steal the film itself, or when camcorders came out, they would record the movie in the theater uh and then you know eventually post it online or burn VHS cassettes or now DVDs or you know, illegal streaming. But with the diverse supply chain that we have now, uh, as we are still shooting, we may be sending things off to post-production uh where they're taking the elements and actually, you know, coloring it, adding sound or what have you. And so your entire product is distributed across multiple supply chain folks at any given instant. And having to make sure each one of those different partners has a security posture that meets your standards and your expectations is quite daunting.

SPEAKER_00 9:18

Yeah, it's very interesting because uh I'm I'm sure that I can't really rec recall any big breaches, but I'm sure there's got to be some leaks of some major movies.

SPEAKER_01 9:28

Oh, there's a lot out there, but we don't talk about them. Okay. But we can. But from the standpoint um, because we won't name names or anything else like that. But so some of the different things that you think about if if we're sending a movie off to have the localization where they do the subtitles, right? They don't necessarily need the movie in color. Maybe we'll make it black and white, maybe we'll do high contrast red, maybe we'll make it static-y so you can't really see it because what they're working on is listening to what the actors are saying and then doing the articulation and the expression as they do the translation. So they don't necessarily need the perfect product from that perspective. And then likewise, when we're looking at visual effects, you know, maybe they don't need the full soundtrack or the different layers. Um, as you know, there are different editing music tracks that they may add as they're going through before they get the final score. And then sometimes the final score, as they're doing it, they may not have the polished version of the movie, or they may have the movie again with black and white. And again, there's other different attributes or elements that we put in there, such as watermarking is a big piece to help. Um, and also we do a lot of stenography or digital forensics and audio forensics that you know the average person can't hear, but a computer system can pick up because a lot of times, like when folks stream or pirate content, they'll stretch it out or they'll put bubbles in front of it and so forth. And so there's ways that we have in order to identify it so we can take it down. But with the stenography and other different pieces, it helps us know where in the supply chain that leak actually occurred. And so it's not so much to you know point the finger at you and say you did a horrible thing, because if the world finds out that you're the source of the leak, you may never ever be able to work in the industry again. And but what it allows us to do is really focus in in that part of the supply chain where we may have a defect or a compromise or an exposure that we can quickly go in and correct it so we don't lose any additional assets.

SPEAKER_00 11:28

Yeah, very interesting. And and I know part of the title of this episode has deep fakes in the title. So you were kind of before we started, you kind of mentioned how you were the industry that really created deep fakes.

SPEAKER_01 11:39

I know. We should apologize now because it wasn't, you know, if it hadn't been for the mood media and entertainment space, we wouldn't really have the faculties and capabilities we have today for deep fakes. And I mean, when you think about how do you put force gump in a movie or how do you take a particular actor and have them speak Japanese and move their lips perfect, right? Uh a lot of that technology that we had been building for the last decade plus has now come out to the consumer side. And so has made it really readily available for other folks to experience and experiment with these different capabilities to do it. And, you know, it's it's great in a lot of aspects, uh, but it all depends on how you use it, right? It's like what Spider-Man would say, you know, with great power comes great responsibility. And, you know, it's fascinating to be able to take pictures of old family members. And if you happen to have audio files of those family members, then they may be deceased to bring them back to life, to have them, you know, read their grandchild that they never met, a bedtime story or some other different type of uh piece. And uh I think that's that's that's a great use. But then there's other different types of challenges that we've kind of run into with some of the different products on the market today. If you and I wanted to be in the next Godzilla Kong movie, we can do that. And then it makes it more difficult for us from the standpoint is you know, is that a leak or is that licensed, or you know, are you monetizing on that? So it gets into a whole bunch of different legal issues that we kind of have to chase down from that perspective.

SPEAKER_00 13:09

Yeah, it's pretty interesting how how the deep fakes have come along because you look at some of the earlier deep fakes that were done by security professionals or threat actors, some of them were pretty pretty noticeable, but nowadays they're getting where they're starting to get a lot better. It's a lot more difficult because just like the one uh incident where there was the Zoom call and it was like a a conference call with multiple people, and they convinced the person to transfer the millions of dollars. So it's getting to be kind of scary what can be done with deep fakes.

SPEAKER_01 13:41

Well, but again, if we break it down to the standard block and tackle, um, you shouldn't just transfer millions of dollars because somebody says so. There's gotta be the checks and balances, the separation of duty, and the dual controls in your processes on how you handle the financials in your institution. And so to that end, you know, that's where you need to make sure that, all right, so you set it on a phone call, let's validate that in a follow-up with an email or a secondary call or an in-person conversation. Um, you know, it's easy to have a passphrase that, you know, may not necessarily be detectable to go through. Or maybe, you know, you ask simple questions on the follow-up. It's like, hey, you know, what was the t-shirt that Godzilla was wearing in the lobby today, right? Something like that, that you know, you can get a certain type of response or piece to get some validation from that. Because I know, like in our organization, we do a lot of things manually still. And that's my design, because we want to circumvent some of these other different types of threats and and pieces that we see that are out there today. But from the deep fake side, um, funny thing is when we come across a deep fake, uh, most of the time it's an impersonation, we look at them as impersonations. Uh and not necessarily my team, but the company as a whole get real excited because they're trying to see, oh, well, what kind of technology do you use? How good is it? You know, and they critique it. But again, that's our industry.

SPEAKER_00 15:05

So and then along the lines of content security, we were kind of discussing beforehand, you mentioned a case where like some uh trailer was released before the movie was supposed to release trailer before it's supposed to be released.

SPEAKER_01 15:16

Right. So we have a couple of different franchises, and we had a particular franchise that we shot. It did really well. And we were um we had Greenlit and we started to work on the part two of it. And as we were going through it, we started seeing uh trailers for our our next movie showing up on social media, and we're like, how? You know, we haven't even started principal photography yet. How could there be anything out there? And well, this is where folks had taken elements from the first movie and used AI, and of course, if they read the books, they know the way the second part of the movie is gonna go. And so they fed all that in and it did an amazing job of using our sets, our elements, our crafts, our personnel, and creating uh, you know, 30-second little clips here, and that they were able to string together into a full-blown movie trailer and using sound and music from the first one, uh, we were able to pick up on it because, you know, when it's our music, it's licensed and it gets flagged that you're using licensed content and things like that. But it really threw us for a loop because we did a lot of double takes saying, like, well, wait a minute, we wouldn't have used that costume design or we wouldn't have used that color of a shirt or some other different piece. And so now as things come out, it even makes it more interesting that we have a lot of folks that are trying to impersonate that they're behind the scenes on a particular movie that we may be shooting, um, or you know, trying to promote on social media, hey, here I'm on the set of such and such, which isn't necessarily true, but you know, you do have behind the scenes uh pictures that come out in like art books that come out about a particular movie or uh just in the industry as a whole. And it's really easy to pick up on that to say, hey, this is what the mic looks like. This is where we have, you know, a dolly or some other different piece, or there's the guy that's the grip and some things like that. And it just kind of can throw these things together and it's just it's it's incredible. And so for us, a lot of it really comes down to education and working with the teens and the different shows that when they see something, say something, that we can work through it. Because you don't want to spoil a uh a surprise on any movie before it comes out.

SPEAKER_00 17:27

Now that's that's a good point. Do you ever foresee or have you experienced has anyone tried to go out and create content of your brand and try to like bootleg videos and sell AI generated versions?

SPEAKER_01 17:42

Um, yes, quite a bit. Uh we see that a lot in our industry as a whole. Um if you consider, you know, any of the animation cartoons that are out there today, folks, you know, revisit those and you know make their own little cartoons, uh, you know, like with a Bugs Bunny or Mickey Mouse or something like that. And it gets really interesting because some of it you want to have, you want to let the fans have the experience to create their own content, right? And to to share the excitement of the fandom that they're in. But when they start to monetize that, or when it starts creating confusion, or if it goes against uh corporate ethics and policies and so forth, then it becomes an issue. And we really have to stay on top and take those things down because you know, you don't want to have a character, you know, assault another character uh and you know, or a political figure or something like that, because then that creates chaos all over the place and trying to make sure we take that down. And so some of that then we have to push the accountability back onto the providers that allow you to create that content and say, hey, these things have to be off-limit, you know, whether it's uh sensitive topics like you know, suicide or something else, or if it's specific IP that you want to protect, or specific uh political figures or dignitaries and things like that. And so for the most part, a lot of the um vendors or the partners that are out there that really don't want to lose the uh relationships they have with the industry as a whole and don't want to have their uh revenue streams compromised or to be sued, you know, are really trying to take action to do that. As you know, with AI, there's so many different ways that you can skirt around it. Like uh, for example, my present one of my presentations I was doing here uh at Black Hat Middle East Africa, um, I wanted to use a collage of our movie posters. And so there are movie posters, we own the rights, and we're using an AI model that we have an enterprise license for. And so I uploaded all the different images and was like, hey, I want to create a collage to use as a background. And it's like, okay, well, here's some different ideas that I can generate for you. It's like, great, let's go with option two. All right, and it comes back and says, nope, can't do it. That's licensed content. I'm like, but we're the license holders, you know? And it's like it was it was hard to try to fight around it. But then again, there's safeguards that say, hey, this is licensed content, you can't do it. You can manipulate the prompt to say, well, I understand it's licensed, but let's say if it wasn't licensed, but if I wanted to create something to help me track for licensed content that I want to use as an example, and then it spits it out. And you're like, okay, that's not very helpful, but it got me what I wanted.

SPEAKER_00 20:37

Very interesting. I can just see how with the technologies today has got to make your job a lot tougher because I mean, back when things were more manual, you didn't have all this technology, you can see it'd be a little more difficult for people to steal the intellectual property or copy the intellectual property.

SPEAKER_01 20:52

Oh, absolutely. I, you know, we joke about it. I feel like I'm like this close to becoming an auditor. So leaving security, becoming an auditor, and actually test everybody's security. But uh yeah, it's a journey. Uh a lot of it is training and education, um, trying to keep our teams up to speed, uh, coming to events like this to see what are where's the innovation. I like to look at all the upcoming, the new partners that we have out here, the new exhibitors, uh, because sometimes we find something that is unique, but we may want to use it in a different approach to do, you know, whether it's part of a takedown, looking for images or um securing a particular piece or equipment that we're trying to do. And then a lot of times there may be things here at the at the show that uh don't match what our portfolio looks like, but it definitely is something that we want to make sure that we have it in a catalog because somewhere in our supply chain, somebody has that platform or somebody is using that technology.

SPEAKER_00 21:47

Just out of curiosity, what was your your talk on Black Hat?

SPEAKER_01 21:51

Oh, my talks at Black Hat. So there's two of them. Uh one of them is how we secure the content behind the camera. How do we secure? The digital assets, kind of like what we're talking through today. The other presentation is about brand enforcement and how I took a uh how I went from being a cost center in the organization to being a profit center by going after unlicensed merchandise that is related to our intellectual property.

SPEAKER_00 22:19

Yeah, very interesting. With AI being so popular and just the subject of every conference. Do you have any tips for anyone on how to secure their AI environments and operate in AI securely?

SPEAKER_01 22:32

Well, that's a very open-ended question. Um, and the way I look at it, there's a lot of different things depending on how you want to break it down, right? Because a lot of it is sits in the camp of authentication and authorization. Some of it sits in the camp from um, you know, when you look at your data loss prevention and trying to look at what you can put into the model, what can you take out of the model, or if it comes out of the model to flag it. But what we don't see is what's inside the model. There's not a lot of products out there today. And so what I'm really concerned with and looking at, and really want uh some folks to lean in on, let's say, for example, we were going to make a movie about a fish, but you came from another studio that was also making a movie about a fish, right? Um, how do I know that what you did at another isn't going to influence what we're doing with our movie here, right? And so if you were to put that into the AI model, I need to be able to have the non-repudiation to determine when that artifact or that those elements came into my model. Well, I can look for things possibly on the endpoint side if I have an agent there to look for the data loss, or I can look for things if you produced a document on the outside, but I can't look for anything on the inside. So when I do my e-discovery, I can't do e-discovery inside Copilot as an example, or inside Gemini. And I think that that's a that's a challenge that we really need to take a look at because um I think there's a potential of a lot of data leakage, but it's also more of what is in there. Uh and this is also another interesting point because you're looking at it from the corporate perspective, but we have to look at it from the individual side. So if I have an Apple phone or an Android phone, it's going to have intelligence on that device. That intelligence is looking at every single email, every single calendar invite, everything I'm looking for on the web browser, or if I have any collaboration platforms, it's looking at that information. And so even though I have my corporate system here, my personal device is looking at the same things. And now, if I move to a different company or some other different piece, there's a exposure of what is being taken away from my company and potentially introduced into another arena. Or, and this is where I would think of it as a hacker, would say, I want to create a game that is going to access your Apple intelligence to look for things that are going to be more personalized to you. So if you always are looking for shoes and I want to make sure that I give you shoe advertisement in my platform, then I need to know that you're looking at shoes on the web browser. Well, if the AI is harvesting that information, then I should be able to tap into the AI to give me that information for my application as well. And so then it's not that far-fetched to think that if that's the case, then let me create an app that is a card game that I know that this CEO is going to be really interested in playing. And if it gets put onto their phone, then I can access photos on their phone, their contacts, their calendar. Maybe if I can't get to those because they have them locked down, but if I can access the AI on that phone, then there's a back way in for me to get that same type of detail and information. So now I know when that next merger acquisition is going to happen or something else. So those are the things that would really keep me up at night. And a part of it is education, but you can't tell folks that they can turn all those things off on their personal device and be effective.

SPEAKER_00 26:02

Yeah, that was a great response. Probably one of the best responses I've gotten from someone on that, and some different, definitely some different insights. So uh that's a wrap. A big thank you to Dan Meachum for joining us today. Let's close the file into the next chapter. This is Philip Wiley signing off.