Latest / Dataministeriet - A data protection and privacy podcast / 79. Legislators, do it! II Guest: Bruce Schneier (ENG)

Transcript

79. Legislators, do it! II Guest: Bruce Schneier (ENG) · Dataministeriet - A data protection and privacy podcast

0:00
Hello and welcome to today's episode of Dota Ministeriat.
0:05
My guest today, he needs very little introduction in our world
0:10
of security and privacy. His name is Bruce Schneider, is
0:14
the internationally renowned security technologist.
0:18
He was referred to security guru by the Economist.
0:23
He's a lecturer at the Harvard Kennedy School, fellow at the
0:27
Berkman Klein Center for Internet and Society at Harvard,
0:31
board member of Electronic Frontier Foundation.
0:35
You have written many books on the area.
0:39
You have a huge blog, you have a newsletter and your speaker at
0:45
the conferences, and I think one of the more famous book more
0:51
recently is Delta and Goliath. So please warm welcome, Bros.
0:56
Well, thank you. And even more recently write a
0:59
book on AI and democracy called Rewiring Democracy.
1:02
So let's get going. One of the questions I normally
1:05
ask is how did you even get into this area?
1:08
I know that you were more into encryption in the beginning.
1:12
You know, so I'm not sure what this area is I, I've worked for,
1:17
I don't know, somebody think pretty much forever in computer
1:21
security and privacy, right? Encryption, network security,
1:25
it's all one thing. I don't have a good origin story
1:29
and I'm asked all the time, how did you get into this?
1:31
I don't remember. And you know, really I sort of
1:35
generalized what I do throughout the years and decades and you
1:39
know, now I do mostly policy, but it's all about security and
1:42
privacy of computerized systems. You know, I wrote a book on
1:46
cryptography, as you mentioned in the mid 1990s and have been
1:49
writing and speaking and working ever since.
1:52
And you know, now I'm writing about AI security.
1:54
So the the the details change but the topic stays the same.
1:58
So back in the days like in the 90s you mentioned, but if we go
2:02
even further back from, from the early days of cameras,
2:06
newspapers, telegraphs and up until as you mentioned AI right
2:12
now, would you say that previously has become more
2:15
important, less important or as important?
2:19
You know, I mean, privacy is a human thing.
2:22
It's not a tech thing. I mean, tech effects privacy.
2:26
The importance is the importance of the human being and human
2:29
beings haven't changed. So I think it is just as
2:32
important now as it always has been.
2:34
I mean, certainly the threats change, right?
2:37
Computers and networks and all of the devices that are, are
2:42
constantly spying on us, you know, that is that's changing.
2:48
But I think the the importance remains the same.
2:50
So would you say that it's harder to understand our own
2:56
privacy today than before you mentioned surveillance?
3:00
I think it is harder simply because it is more, it's opaque
3:05
that it's not as obvious when it's happening, right?
3:07
If there were, you know, 10 people following you around at
3:10
all times, writing out everything you did, you would
3:13
notice that you you'd look behind you and say, who are you
3:15
people? But that same thing is happening
3:17
to you as you browse the Internet.
3:19
But because those trackers are invisible, because you're not
3:21
seeing them, you don't, you don't notice it as easily and
3:27
you don't necessarily know what's going on.
3:30
So I do think that technology makes it harder to understand
3:34
what's happening because it makes it invisible, right?
3:37
The cameras used to be big. Now they're tiny, those sorts of
3:40
things. If you go back to how the mass
3:46
variance maybe not started, but at least like accelerated and a
3:51
couple of years later, the start from governmental perspective, a
3:55
couple of years later, iPhone, Facebook, it was more of the
3:59
corporate. Were they interplaying like
4:02
somehow, yeah, I agreed to be surveyed because of security,
4:06
because I want my nation to be secure.
4:08
And then kind of the corporate world tapped into that.
4:12
Yeah, it really depends on where.
4:15
And so in the United States, we tend to mistrust government
4:21
surveillance, but a perfectly acceptance of corporate
4:24
surveillance. The EU is pretty much the
4:27
opposite of that, which to me is is always interesting, but there
4:32
certainly has been a interplay, a marriage of convenience
4:35
between corporations and governments in terms of spying,
4:40
that the corporate surveillance is really based on persuasion,
4:47
on manipulation, on advertising. Government surveillance is more
4:51
about law enforcement or control, social control,
4:54
depending on the country you're in.
4:55
And we do see both. But you know, certainly in the
4:59
United States, we see governments buying data that
5:05
they can't easily or even legally collect in some cases
5:08
from corporations that are spying on everything we do for
5:11
the business purposes. You go someplace like China
5:15
where corporate and government surveillance is much more
5:18
intermingled that, you know, corporations spy on people for
5:22
the government. There's a much tighter
5:24
interplay. Whereas in the US it's much more
5:26
of a convenient interplay. And, you know, it really, it
5:29
really depends. You know, we are, we are
5:32
definitely finding that that the surveillance of course is, is
5:36
pervasive just because everything we do involving a
5:39
computer produces an audit trail and those are, are records of
5:45
what happens. I mean, you mentioned the
5:47
iPhone, which is probably the most comprehensive surveillance
5:50
device ever invented. You mentioned Facebook, right,
5:54
which which is also a very pervasive surveillance platform.
5:58
It is where you talk to your friends.
6:00
But yes, over the years, I mean, 2000 terrorist taxes, 20 of 2001
6:05
were a tipping point. I mean, that was a point in the
6:08
United States government said we need to spy on everybody, but
6:12
also social media, Google, I mean, these are also tipping
6:15
points. And then we saw more with the
6:18
invention of the iPhone, as you mentioned, where you have
6:20
surveillance that follows you around.
6:22
And then these are all sort of things that happened over the
6:26
past few decades. And now we have AI able to
6:29
analyze this information in ways that wasn't possible previously.
6:33
Taking AI and government, right at this moment we have this
6:37
battle between two AI giants. Open AI and anthropic.
6:43
Yeah. Why aren't you adding Google and
6:47
X? Yeah, I mean, yeah.
6:49
So, so I think they're definitely actually are seeing
6:52
battles between the tech monopolies.
6:54
I mean, these are all monopolies, all US corporations.
6:58
And so, so yes, I think we are, we are definitely seeing battles
7:04
between those two. Yeah, I think or I know that you
7:07
wrote that Will the normal person is quite bad at actually
7:12
assessing the risks relating to all of this.
7:15
I mean, so, yes. And then this is because they're
7:18
technical and they're subtle, You know, what are the risks for
7:22
your information being known by the vast ad network that is
7:26
trying to manipulate you at every turn?
7:28
What are the risks to your government, whoever that is or
7:32
some other government, whoever that is, knowing your data?
7:36
I think, I think it is it is hard for us to to figure out the
7:41
risks if if we are not technical.
7:44
So I'm a lawyer, I'm a bit technical, but what would you
7:47
say like are the main risks with all of the civilians both from a
7:52
governmental perspective and maybe outtake corporate?
7:56
Well, it's depends, right? If you were recently the leader
8:00
of Iran, the risks were that the US would drop a bomb on your
8:03
head and kill you. So there, there, there is a risk
8:07
if you are a random person in the US, the EU, Canada, you
8:13
know, the risks are that your personal, your personal life
8:19
will be known by strangers and it might get leaked.
8:24
I mean, I'm just, I'm just naming some risks.
8:27
I mean, I don't know who you are.
8:29
If you're a journalist, if you're a human rights defender,
8:32
if you are a dissident in a in some country, your risks are
8:35
going to be different. So I don't know the answer to
8:37
your question of what you know, what the risks are.
8:40
It depends on who you are. So you also wrote in another
8:43
article that people tend to like adopt behavior from the
8:47
surveillance. Yeah, and some people write
8:49
about this, some people write about the, the, the, the
8:54
chilling effects, right. That censorship leads to self
8:58
censorship. And I mean, you can, you can
9:00
imagine this being true, right? And you can think about living
9:04
in a country where saying the wrong thing gets you arrested,
9:08
that if you know you're constantly being watched, you
9:11
will be careful of what you say, right?
9:13
That that's, that's not unreasonable defensive behavior,
9:18
right? So, yes, so we do know that that
9:21
censorship leads to self leads to self censorship.
9:24
So this this is censorship as a form of of of social control.
9:29
Do you have any like actual example when people have been
9:33
negatively impacted from the data that is collected?
9:36
I mean, yes, there are lots of stories.
9:38
I don't have them off top of my head.
9:40
I mean, you can Google around just like everybody else.
9:43
But yeah, I mean, there are lots of examples of, of data being
9:47
either you and so with a couple of things you're worried about,
9:49
you're worried about the companies using them maliciously
9:53
or in a way you don't want. We worry about the government
9:56
companies sharing them with governments, right?
9:58
the United States, we know that the customs and ICE is using
10:03
corporate data to, to round up people to deport them.
10:06
So there's one and also worried about about security breaches.
10:10
So I don't take a random one. Optus was a large telco in
10:15
Australia in 2022. Hackers broke in and stole
10:19
personal information about millions of of users.
10:23
So there's there's another example.
10:24
So in the beginning when all of this started, let's say 25 years
10:28
ago or something, OK, or Facebook area and WhatsApp era
10:34
and all of this, were we a bit naive to to let it go too far?
10:39
Because before we said like, hey, this might not be that
10:42
good. You know, I mean, we, I don't
10:44
know who we are. I mean, certainly I think there
10:47
was a a failure to regulate AI. I'm sorry, I regulated social
10:52
media AI because making the same mistakes with AI in my head that
10:56
it's. So we did, we really did fail to
10:58
regulate social media. There was a belief that that we
11:01
didn't need to. And I think we're paying the
11:04
price for that now. Certainly the EU is trying and
11:09
doing better than than others. So, yeah, I don't know if it was
11:13
naivete or, but we surely didn't realize that this was so
11:19
important that it would be so critical to, to democracy, to,
11:26
to sort of everything that we really needed to, to think about
11:29
how to regulate this, this technology.
11:33
And, and so we're making the same mistakes with AI that, you
11:36
know, we are not, we are not regulating this technology And,
11:39
and we should and we need to. Here we have the AI Act.
11:43
I know that you're struggling in the US with regulating AI.
11:47
We're not struggling. We're not doing it, OK.
11:49
Yeah. Don't, don't, don't assume that
11:53
sugar. Coat it.
11:54
I mean, this is the United States.
11:55
The money does not want regulation and the US, the money
12:00
gets what the money wants in terms of law.
12:02
So. Would you have an idea about how
12:04
to regulate AI? You know, I mean, there's,
12:07
there's there's a long discussions.
12:09
I mean that that is not a, you know, here's a four sentence
12:13
answer. That is a very complicated
12:15
question and you know, we need to figure it out.
12:19
But both in the US, even though you're not working on
12:22
regulation, but we are, we have it and they are trying to revamp
12:27
it already and. Like, because it moves, because
12:29
it moves fast. And also, you know, no, I mean,
12:32
the US is pressuring the EU not to enforce its regulation.
12:38
So, yeah, I mean, and yeah, I mean, we can talk about the EUAI
12:42
Act, I mean, in detail. It could pull it out.
12:44
Look at the provisions, things that gets right, things that
12:47
gets wrong. But at least you're freaking
12:49
trying. At least you're trying.
12:51
And that feels really important in this, in this day and age to
12:56
to try to regulate this technology.
12:59
I I totally agree of course. But it constrains behavior.
13:02
I mean, the benefit of a regulation is it constrains
13:06
behavior. We're concerned about, you know,
13:08
companies overreaching, doing things we don't want.
13:11
We're we're concerned about this technology being used for bad
13:15
and the way you constrain that is the regulation.
13:19
So how how effective in your opinion is like the current
13:24
legislation on more data taken previously?
13:27
Not Li. I think it's too soon, but just
13:29
the PR for example. I think GDPR has done a lot of
13:33
good. Honey, I, I just taught GDPR in
13:35
my class I'm, I'm, you know, this semester I'm at the
13:37
University of Toronto and I'm teaching secretary of policy
13:40
here. And I just did a class on, on
13:42
GDPR. You know, I pulled up, you know,
13:45
the latest enforcement actions and you know what, what's going
13:49
on. And it, it, it took a while to,
13:52
to get going, but I am, I'm in general, you know, pleased and
13:58
impressed with the amount of GDPR enforcement that happens in
14:02
the EU. I mean, it's not perfect, but I
14:05
think we're doing well. So thank you.
14:10
Yeah. I mean, it's been a role model
14:12
for other legislation in California.
14:15
Passed a law based on GDPR. I believe other countries have
14:19
as well. So where does the discussion
14:21
stand right now in the USI mean you have in some states,
14:26
obviously California. As well, California is the big
14:30
player here, New York and Massachusetts less so, but you
14:34
know, you could pull up. There's a map of state privacy
14:37
regulations and it's about 1/2 of the states I put the map up
14:41
in my class last week that are, that are implemented
14:44
comprehensive price regulations and more are are is in the
14:47
works. You know, I'm in Canada.
14:50
Canada's not doing great, but it does have privacy commissioners
14:53
in a way that the US doesn't. So there are some things
14:57
happening here in Canada. EUI mean you followed on GPR
15:03
with the Digital Markets Act, Digital Services Act, and then
15:07
the AI Act. So I mean, we are seeing some I
15:10
think pretty comprehensive, you know, AI and big tech
15:16
regulations in the EU. I know North-south Korea, I was
15:20
told has has done something about AI regulation.
15:25
So have you any advice to our lawmakers about how to regulate
15:30
now that at least in my opinion and my opinion is the technology
15:33
is moving so fast, it's like try.
15:37
Right, My, my advice is basically don't take advice on
15:39
podcasts. It's hard, but, you know, do it.
15:44
Yeah, do. Don't pray to do it.
15:46
This is important that it does not stifle innovation.
15:50
It is not bad. It is a good thing to do, and
15:54
even if if the US pressures you not to do it, do it anyway.
15:58
This is important. The neat thing about EU
16:00
regulation is that it affects companies worldwide.
16:04
It does. EU blocks a merger.
16:06
It doesn't happen anywhere. When EU demands a change to a
16:10
platform, it often happens around the world.
16:13
Yeah. Is that good or bad?
16:16
I think it's great. I like the fact that I benefit
16:20
from the GDPR even though I'm not a European.
16:25
So I, I want to look back to this shilling effect a little
16:28
bit because I've, I've been thinking quite a lot about it.
16:32
How much do you actually think that over time, not the
16:37
individual behaviour like we said, like some might not Google
16:41
and so on, but like in general, have we actually changed our
16:45
behaviour as humans or as a group?
16:48
You know, I mean, you can say a lot and a little.
16:53
I mean, certainly, you know, in, in the the way we use tech, the
16:57
way tech permeates our lives, things have changed
17:00
dramatically, right? I mean, you know, we, we don't
17:04
talk by phone anymore. We talk by text and that that's
17:07
a new thing. And that's generation, you know,
17:10
we use these platforms, these are, these are new.
17:13
And as technology changes, you know, the, the, the things we
17:17
use change, but it's still human connection, still humans talking
17:22
to humans. And that I think doesn't change
17:24
at all because that's that's us as as a social species.
17:27
So do you think it will change even more like if you look 20
17:31
years from now or maybe? 30 years from now.
17:34
Years from now. No one.
17:36
Everyone will have grown up with tech.
17:39
But everyone grew up with tech 20 years ago.
17:41
They grew up with different tech.
17:43
Everyone has grown up with tech since the beginning of tech,
17:46
which you can say is 100 years old or five, whatever, whatever
17:49
gates you want, right? You grow up with a tech you grow
17:52
up with, and tech changes at some rate while you're growing
17:56
up and after you're growing up. And so you're always going to
17:59
have, you know, the younger generation understanding the
18:02
tech more as tech moves faster. That of course is bigger, right?
18:06
That effect is is much more pronounced.
18:09
But that's not new, right? That's that's as old as tech.
18:14
Is it moving faster? That data seems to indicate,
18:17
yes, if you look at like rate of adoption of different tech of
18:21
you know, 100 something years ago of the telephone of then
18:25
later of you know the Internet and then maybe of Facebook and
18:30
then maybe of smartphones, right, you look at different
18:34
tech, yes, it does seem that we are adopting tech faster.
18:39
So do you think that the Internet introduction or the
18:44
ally to the common man now, are they equally important or is one
18:51
more important than the other? You're asking questions about
18:55
history. You have to, you know, Fast
18:57
forward 50 years and have historians answer.
19:00
I don't think anyone can answer that question today.
19:02
I mean, they can make it up. But could you even predict like,
19:05
how far away can you predict like in the future, right now?
19:08
With AI, yeah, I don't know, four months.
19:11
Four months. I wouldn't be comfortable doing
19:13
more than that. I mean, right.
19:14
I mean things are changing really fast.
19:21
So going back a little bit to this, do you said AI and the
19:24
tech and and the massive AIS actually cost one person's death
19:29
right now, But law enforcement in general are also using this
19:33
not for minor criminals. So to say, if you if it's, if
19:37
it's like a degree of among criminals and sometimes a wall
19:43
algorithm, AI, whatever you use, they get it wrong.
19:46
And I think, well, I know that you've written like it's quite
19:50
easy for anyone to actually see this because you get ads that
19:55
are irrelevant to you. And if you look at an ad, it's a
19:59
little bit annoying. But if it's all of a sudden
20:02
transferred to law enforcement, it's it could be really, really.
20:07
And that's right. I mean, I mean, the same
20:09
technology that can serve you ads can, can end up dropping a
20:12
drone on your head. Yeah, yes, that, that, that
20:15
that's certainly very true in the United States where, you
20:18
know, ICE is using commercial data to to arrest people and,
20:22
you know, in some cases torture them, in some cases deport them,
20:26
and some cases kill them. Is it also true that it could
20:30
also be that benefit all of us that we are finding more
20:34
criminals? You know, and this is, this is
20:36
what you're told, right, that that mass surveillance helps you
20:41
because it, it finds the criminals and it turns out we
20:45
can find criminals anyway. And it also turns out that if
20:48
you look at the history of, of governments, that mass
20:51
surveillance is not used in that way, that it's more about social
20:56
control, that it's more about power.
20:58
So now, yes, that you, you, you will, you will be, you'll.
21:02
They will try to convince you that this is for your own
21:04
benefit. So this sounds like Eastern
21:07
Europe. I mean, it sounds like any
21:08
totalitarian country you name, I mean, you're one of them.
21:12
But certainly you can look at Middle East countries, you can
21:16
look at African countries, you can look at China, you can look
21:20
at Italian countries, all through history and all around
21:22
the world. So going back a little bit to
21:26
where you started out with security more than privacy, at
21:30
least from what I read of you. I don't know.
21:33
I mean, I think they're largely the same.
21:35
So I'm not, I'm not sure. I don't I don't separate them
21:38
like. No, you don't distinguish.
21:39
They go hand in hand. Right.
21:41
I mean, there's no, there's no security without privacy and
21:44
privacy doesn't work without security, so.
21:45
Before the Millennium, you actually wrote the worst enemy
21:48
to security is that it is complex or it could be
21:52
complexed. Would you say that it's the same
21:55
true for privacy? It should be easy.
21:57
No, it is complex, and it's complex because the technology
22:00
is complex. So it's the worst enemy that
22:02
it's complex. Yeah, I mean, but that's that's
22:05
that's about that's a computer statement.
22:08
That's because computers are complex, right.
22:11
So complexities were saying the security.
22:14
What I mean is that simple systems are easier to secure,
22:18
are easier to keep private, and the more complex the system is,
22:22
the harder it is. And, and currently, I mean, at
22:25
least I, I don't understand, I, I on that technical level.
22:31
Right. And, and you know, and a lot of
22:33
people don't AI is, is it's famously talked about as as a
22:38
black box that it's very hard to figure out.
22:41
Is it really a black box? No, it's not really a black box.
22:44
It's the opposite of a black box.
22:45
You can look at absolutely everything going on in it, but
22:48
it is so incredibly complex that people think of it as a black
22:52
box could. The real black box is your
22:54
brain. I can't open it up.
22:56
I don't know how, what's going on in there.
22:57
Sometimes I, I, I, I can't feel like when you get the argument,
23:01
the it's so complex at the black box that we get a little bit
23:04
fatigue also like it's, it's more that we don't take the time
23:09
to actually learn. You know, but but if take the
23:12
time to actually learn means get a graduate degree in the field,
23:17
I'm OK with that, right. You know, I mean, it shouldn't
23:20
be that everyone has to get a graduate degree in this topic to
23:24
to feel safe. So so yes.
23:28
But some would even say that legislation is too complex.
23:32
OK, so So what do you do right? If legislate is too complex, we
23:36
give up on society. No, we can seem.
23:39
Have, through the centuries, legislated complex things.
23:42
We legislate aircraft, we legislate pharmaceuticals, we
23:45
legislate complex economic system like we regularly
23:50
legislate things that are complex.
23:54
You know, if you get hired as a legislator, this is your damn
23:57
job. Do it.
23:58
It's too complex. Then quit and someone else will
24:01
take your place. I have no sympathy for this is
24:04
too complex to legislate. My wife, she has Facebook, I
24:12
don't and so on. And she often mentioned it's
24:16
like, yeah, but I have nothing to hide.
24:18
I think that you said like that's the worst argument.
24:21
Yeah, it is. Because, you know, I'm sure she
24:23
wears clothes. I'm sure she doesn't want her in
24:26
most regrets to everybody. I mean, something to hide is the
24:29
wrong way to think about it. It's control over your personal
24:33
life. Who gets to decide what to know
24:37
about you? Is it you or is it somebody
24:39
else? That's the real question.
24:41
It's not about something to hide.
24:43
But is it only about control or because?
24:47
It's not only about control, but it is about control.
24:49
So it's multiple things, but GDPR have a lot of obligations
24:54
requirements that it's not about control that you can't even
24:57
actually waive. It's mandatory.
25:00
Yeah, and I think that's probably good.
25:03
There are some things, I mean, and we in society, you know, we,
25:06
we, there's many mandatory things that we, that we, that we
25:09
have in society. I'm largely OK with that.
25:12
One thing that I'm a little bit curious about when it comes to
25:15
control is whether or not we should actually use or or have
25:20
the right to use it more like a currency or commodity, our
25:24
person that I or that's a really bad idea.
25:27
It is, you know, there's really isn't a good market because your
25:31
date is not worth that much. Your data to Facebook is worth
25:33
about 8 American dollars a year. That's it.
25:36
It's only an aggregate. So there's not enough money to
25:39
make it a viable market. So thinking of your data as your
25:42
property doesn't work. It's really about, it's really
25:45
about rights. So I think a rights regime works
25:48
better than a property regime, right?
25:49
If it's a property, you know, you're going to, you're going to
25:52
give it away in ways you don't understand too cheaply.
25:55
And, and we do that in society. I mean, right now, I mean I'm
25:58
sure it's true in the EU, it's true in the US that it is
26:00
illegal to sell your kidney. Like we have decided that even
26:04
though that is your property, it is not a legal market.
26:07
You know, we do not want a market in in body organs and we
26:11
have declared that illegal. And the same could be valid for
26:14
personal data, you know I. Mean it's not it's not the same.
26:17
As no exactly but but. Yes, same way to think about it.
26:22
So you mentioned right now, what is the right like you?
26:25
Is it human, right or? Yeah, I mean, there's a lot of
26:28
people talk about it is a fundamental right to privacy.
26:33
It is as a human right, It is in the Declaration of Rights of Man
26:36
privacy. It is in EU foundational
26:39
documents. So yes, I mean, this is not,
26:41
this is not weird. I mean, this is this is, this is
26:44
generally viewed, yes. I wanted to speak a little bit
26:50
about breaches, because just now, last week here in Sweden,
26:55
the Data Protection Authority published their annual report,
26:58
and in the report one number is the number of person that the
27:02
bridge is reported only in Sweden to the parties 12,000
27:07
last year. OK.
27:08
Is that a lot or a little? I don't know.
27:11
I don't know. It was an increase by.
27:14
It doubled OK. In one year.
27:16
I mean it's a serious question I'm asking should I say yay only
27:21
12,000 now I mentioned the the Australia breach that was like 8
27:25
point something million people and that was just one breach.
27:28
I mean 12,000 really low to me. But these are only the reported
27:32
ones to the authority I'm. Sure.
27:33
I mean, there's, there's, there's always going to be a lot
27:35
of things that are not reported. But I know that you have a.
27:38
Good feel of what the what the ratio is.
27:41
Presumably people in Sweden know these numbers, I judge.
27:43
And now I'm going back to, to actually quite a long time ago,
27:47
2009, I think that you were like quite advocating more of a you
27:52
should be public about breaches. Yeah.
27:56
And, and, and certainly that is more the law now in the United
28:02
States. Most states have public
28:05
disclosure laws. A lot of countries do as well.
28:08
That I, I used to have a company that, among other things,
28:11
tracked disclosure, breach disclosure laws around the
28:13
world. And and yes, there there's a lot
28:17
more requirements to make these things public, not not to hide
28:22
them from your customers and users.
28:24
So in the GDPRI mean as you know and all of this 12,000 were
28:28
reported on the GDPR. It's not like that You, you, you
28:31
don't have to build public about it.
28:33
You report it to the authority and then it's in a black box
28:37
again. OK, that, that that's the, so
28:39
the, the US laws I'm familiar with are, are public disclosure
28:43
laws. But sure, I mean, I guess that
28:45
could be private ones as well. I think more public the better,
28:48
so I'm in favor of the public ones.
28:49
OK, that, that was actually my question, whether or not it's
28:53
better to like. Shame the goals of these laws is
28:57
public shaming, right? That that if companies can't
29:00
hide the fact that they've been breached, then they're going to
29:04
have better security. And it's easier for the
29:07
individual to actually take action if they.
29:09
Were easier as possible because the individual now knows what's
29:12
going on instead of it being hidden from them, but yes.
29:15
So would you want to say that if it creates trust if you go
29:20
public with a bridge? Don't know if it creates trust.
29:23
It might create. It might create mistrust.
29:25
What it creates is reality, right?
29:27
You know the people know what's true.
29:29
Yeah, but what I meant is that if you kind of hide something
29:33
and then it actually is revealed anyway.
29:36
Yes, then you are. You're definitely even more
29:38
mistrusted. And with that comment, we have
29:41
come to the end of today's episode.
29:44
I thank you so much, Bros, for joining me and thank you all the
29:47
listeners for listening in. Don't forget to subscribe on
29:51
your favorite podcast platform. Until next time, have a great
29:55
time.