Latest / Dataministeriet - A data protection and privacy podcast / 77. Wicked Privacy and Privacy Engineering. II Guest: Michelle Finneran Dennedy (ENG)

Transcript

77. Wicked Privacy and Privacy Engineering. II Guest: Michelle Finneran Dennedy (ENG) · Dataministeriet - A data protection and privacy podcast

0:00
Hey, OK, welcome until dot. I mean hysteria at met Mel
0:04
Philip Johnsium. OK, have any dark comio builta
0:09
till Angeles. Hello and welcome to the
0:12
Ministry of Delta. And today I have one of my idols
0:18
as a guest again. She is one of the true privacy
0:23
stars, a trailblazer regarding privacy engineering and data
0:27
ethics, one of the first, maybe one, the first privacy officer,
0:32
chief privacy officer in the world, formerly at companies at
0:36
Cisco, McAfee, Sun Microsystems. But currently she is the chief
0:42
data strategy officers, airbags technologies.
0:46
But that is because her company that she founded was acquired
0:51
Privacy Code. There she was also the CEO and
0:56
not the list. She is also a partner at
0:59
Privatus Strategy Consulting. That is important.
1:03
We will come back to that. So a warm welcome to Michelle
1:08
Fenner and Danity. Thank you so much.
1:11
It's so so lovely to see you. Unfortunately not in person this
1:14
time, but it's great to talk to you again.
1:17
Yeah, actually, I still remember when I first saw you like a
1:22
decade ago in Stockholm. Yep.
1:26
And I'm now you don't blush, but I was so impressed by you
1:30
because you entered the stage, you didn't have any slide, any
1:35
manuscript, and you spoke for an hour and that.
1:39
Was you know, people around me will tell you that's a frequent
1:42
occasion. Hopefully I said something that
1:44
was at least lasting. That's really interesting
1:48
because the only thing I still remember is that you spoke about
1:51
your children. Lovely.
1:54
Yeah, that's good. If I can leave nothing else,
1:57
they are my. If I do remember, at least one
2:00
of them is a daughter. Two, I've got 2 girls, yeah.
2:04
Both are girls, OK? Both are girls and one is
2:07
working for a bank now this is how long it's been and the other
2:11
one is is my last teenager. Her teenage years end in a
2:15
couple of weeks. She will be. 20 But as I said,
2:18
you you made a really great impression.
2:20
I also forgot that you also written at least two books. 1 is
2:25
the Privacy Engineer's Manifesto getting from Policy to code and
2:31
also the Privacy Engineer's Companion.
2:34
So the first. I think it's almost 1012 years
2:38
ago now. Yeah, 2014 and we were talking
2:41
about the future of AI and the foreword was written by Eric
2:47
Bonnebo, who is a pioneer in swarm technologies, So one of
2:50
the very early AIS before we all were talking about it.
2:53
So I I feel quite good that we we guessed correctly when we
2:56
launched. I, I mean, I really read them
2:59
now before this session. I mean, it's remarkable how well
3:05
they hold up. They really do.
3:06
I'm glad you said that because part of the part of the reason
3:10
they hold up so well is we went for the classics.
3:14
We weren't trying to make points or score big marketing things.
3:19
We, we really went and researched and talked to people
3:22
and, and the whole premise of the book was really my dad and I
3:24
talking on the weekends and catching up.
3:27
And he was a security architect and I was primarily law at that
3:31
side and sort of figuring out how to speak to technical people
3:35
so that they could understand me and vice versa.
3:37
So a lot of these methodologies, they go back to even the 1950s
3:42
and 60s and we picked up the things that worked.
3:45
And we we I still work on basic principles, which is why I can't
3:49
speak without nodes. Is these things are are paths
3:53
that already exist and I think they will help us in guiding
3:56
ourselves forward to the future. Maybe maybe we can remind the
4:00
listeners about some of the content and it's first of all
4:03
getting around previously what it is, your head around it.
4:08
And also about a little bit about privacy engineering, but
4:11
not when you say engineering sounds very technical, but it's
4:14
not the only technical. It's also I get organizational
4:17
measures, previously policies, strategy and so on.
4:22
So just to be clear in this book, engineering is not like
4:26
only technical stuff. That's right.
4:29
It's it's kind of think about it as if you're going for a hike.
4:32
You can have all your mountaineering equipment and
4:34
your great shoes and your jacket.
4:36
If your body's not in the gear and your body's not going
4:39
forward, you're not really on a hike.
4:41
So when I talk about engineering, we talked about the
4:44
old school definition of problem solving.
4:46
If you want to build a bridge, you have to understand where you
4:50
want to build the span, you want to understand the materials
4:52
involved, and then you build and then you actually have users
4:56
that use it. So when we talk about privacy
4:58
engineering in particular, it is people, process and technology
5:03
and probably in that order. On the flip side, again on the
5:07
first book, is that it's thrilled.
5:09
On the web it is. It is had I noticed it was going
5:13
to be this one with. Internet connection.
5:16
Yeah, you can get it everywhere. You can get on Google Books.
5:19
You can of course get it on apress.com, which is my
5:21
publisher, but Amazon, Barnes and Noble, all sorts of IT.
5:26
And I triple E websites will carry it as well.
5:29
It was it was the foundationer for some of the methodologies in
5:33
the 317 ISO standard as well as 7002 I triple E standard.
5:38
So I'm really proud that it's still being used.
5:42
There's a part of the back of my greedy brain that says, gosh, I
5:44
should have at least asked for a dollar contribution each time
5:48
you download it, because it's been downloaded a couple of
5:50
million Times Now. I mean, I downloaded a couple of
5:55
times. I'm glad it's.
5:58
Computer I get I need to download it again like so what's
6:02
the biggest difference or or resemblance between privacy by
6:06
design like the principle of Doctor Anne Kavokia your ideas
6:12
in the privacy engineering. Yeah, it's a great, it's a great
6:15
question. So Anna actually has there's a
6:17
blurb in the book that Anne Dr. Kabuki and wrote herself when
6:22
she really articulated privacy by design.
6:25
It's a principle and a policy orientation.
6:28
So it is, you know, 0 sum game. She's talking about game theory
6:32
and she's talking about user centricity.
6:35
So it's all of sort of the outcome things when you take
6:38
privacy by design and you hand it to an engineer, they kind of
6:42
nod at it and go, yes, I agree with all of this.
6:46
But it, there's, there's a, the bridge missing.
6:48
It's kind of like I'm pointing across a Cliff and saying I want
6:51
to go there. There is privacy by design.
6:54
That's what I need to do. And we actually, she and I were
6:57
both presenting on the mainstage at the data commissioners
7:00
conference in I think it was 2010.
7:03
And this is when she went into the private session with the
7:06
rest of the commissioners and agreed to put privacy by design
7:10
in every new piece of legislation.
7:12
And it was unanimous. And that's how it ended up in
7:15
GDPR. She and I were on stage actually
7:18
and including another Swedish scientist talking about things
7:21
like having embedded smart concrete on the roads to take
7:26
toll taking. And my piece inside was there's
7:30
privacy by design as a desire. There's we want to build toll
7:34
roads for Swedish citizens. And then how do you actually
7:37
connect those dots and have a functioning system that takes
7:41
the policy in the law, breaks it down into a series of
7:44
requirements, shows you how to document and build on those
7:48
requirements through the build. And then most importantly, for
7:51
anyone who's ever built anything, what you say you're
7:54
going to build and what you actually build have sometimes
7:57
significant variances. And not necessarily because
8:01
priorities are time changed. It's just that once the whole
8:04
system works together, there's system things that need to be
8:07
looked at and checked to see if they still add up to, to really
8:11
drift in the overall thing. So it's QA at the end of that.
8:15
And then we revisit, did this and indeed solve the problem of
8:19
privacy by design? And most importantly, does that
8:22
privacy by design design still fit the bill for what was the
8:27
primary objective? Are you still getting accurate
8:30
data? Are you making sure that people
8:32
are safe? Are you making sure that that
8:34
data is secure? People sometimes think security
8:37
is the superset and privacy is the subset.
8:40
It's really the opposite way around.
8:43
It's really, you want to secure what you think is precious.
8:46
So that's how you sort of, that's how we sort of think
8:48
about this on a systems and systems and industrial design
8:52
sort of point of view here. And then once you've gotten to
8:55
the end of all that, not only do you have something that you can
8:58
say, Yep, compliance, who cares about compliance really, other
9:02
than regulators? What you really are checking off
9:05
is how valuable is this and not just a cumulative score of
9:09
value, How valuable is the user interface?
9:12
How much weight and efficiency can I build into the process to
9:16
protect that data along the way? How usable is the, is the data
9:21
as a set? And then are there subsets that
9:25
can either be anonymized and reused or discarded because
9:29
they're wasting energy? We're all going to be worried
9:31
about energy and energy transition.
9:33
So all of these things become really utility signpost so that
9:38
we're getting better metrics out of the system.
9:39
At the end of the day, it's a bit of a mouthful, but that's
9:42
that's where you see this. This the longevity of this
9:46
methodology is it really does contemplate needs changing users
9:51
changing, systems aging out and technology evolving.
9:54
I completely agree with you and two things pop up in my mind.
9:58
One is the agile wide way of working.
10:01
This really ties into this. Like did we end up where we
10:04
wanted to end up? Or should we iterate it once
10:07
more and iterate it once more and once more and once more You
10:11
you kind of you're never actually in the final stage.
10:14
Correct, Correct. This is about people.
10:17
And I think of privacy by design, the way that a doctor
10:21
looks at our bodies. Like what my body could tolerate
10:24
in its 20s. You know, I used to try to do
10:26
long distance running. I now do Pilates and yoga and
10:30
weight training because my body is older and its needs have
10:34
changed. So it's the same objective, be
10:37
healthy, but what goes into that health decision and what health
10:41
decision that looks like? Systems are no different.
10:44
It doesn't mean you're compromising.
10:46
It just means that you're always reassessing.
10:48
Is that human in the loop still getting what they need?
10:52
And especially with especially with the LLM outputs as they are
10:55
today. Talk about iteration.
10:57
Like it's very hard to re enter something into one of those chat
11:03
kind of things and get the exact same result out.
11:07
That could be quite dangerous, especially when you are talking
11:09
about compliance, which is all about consistency.
11:12
You might be getting an answer, it may not be consistent.
11:16
So now we're changing and saying, aha, we're not just
11:19
looking for a good answer, we're also looking for consistency.
11:23
So sometimes even my metrics will change as we go along
11:27
system the system's drift. And actually, science is about
11:31
being able to replicate it over and over again.
11:35
Exactly. I actually, I, I named I have a
11:38
new puppy and his name is Newton.
11:40
And you know, Sir Isaac Newton is known mostly for, you know,
11:43
his his physics, but he also was really the inventor of the
11:47
scientific method. And that's what we're talking
11:50
about here. Let's experiment, Assume that
11:52
we're always a little bit wrong and and see are we on course or
11:56
do we need to course correct or is something more efficient?
11:59
Quite frankly, it's not always about hiding and locking.
12:03
And I think that's where privacy often gets a bad rap that we are
12:06
somehow stilted or only no facing or or past facing.
12:13
Nothing could be further than the truth for the privacy
12:16
professional who really is doing a great job.
12:18
We we, we shift with humanity and we try to get our ethics in
12:23
front of the laws before they become laws.
12:26
And another thing I I came to think of is that what you
12:30
describe is more of a process and a shifting something look
12:35
more hard to touch. But in the EU, in GDPR and the
12:40
Court of Justice is very lawyers, very legal.
12:44
Have you're discussing one word and what it means?
12:49
Yes, is a little bit the opposite of actually serving
12:55
privacy. I, I, I will heretically agree
13:00
with you enthusiastically because I think if we get so
13:03
rallied about a word and we we lose, why do we have this here?
13:07
We're really protecting human rights, particularly in the
13:10
European theater where we've articulated it pretty clearly.
13:14
This is about integrity, this is about autonomy, this is about
13:19
having a community that respects the the the individual's rights
13:24
to live a certain way and have have their own self sovereignty.
13:28
It's interesting because that ethic sounds very different than
13:31
some of the ethics that you see out of Asia or the Middle East,
13:34
where it's much more collective. You're looking at Ubuntu, you're
13:38
looking at Buddhist tradition, you're looking at Dharma, and
13:42
it's really what is the best for the community and the goal.
13:45
When you look at these things together, particularly when you
13:47
try to build them into a system and you say this community says
13:51
individual first, this community says community first.
13:54
You, you somehow think that this is only going to be a clash.
13:58
But This is why when you break this down and look at privacy
14:01
engineering in this way, you can start to say, let's now talk
14:05
about what we're going to disclose not to be compliant, to
14:09
be transparent, just for transparency's sake.
14:12
What are we actually communicating?
14:14
How are we getting feedback that that communication actually
14:17
works so that we understand that of course law enforcement has to
14:22
do its thing. Of course we have to make sure
14:25
planes don't fall out of the sky.
14:27
That's really important. We think, how do we sort of look
14:30
at all these things together? And the nice thing about being
14:32
in the age of artificial intelligence and machine
14:35
learning and agentic execution is all of that same complexity
14:40
that's overwhelming us right now.
14:42
And all of that complexity that's causing massive risk
14:46
because it's easier than ever to grab stuff that's not yours.
14:50
We have those same tools, so we can start to look more at the
14:54
organicness of sometimes people change their minds.
14:58
Can we build in the capability of sort of a decaying
15:01
permission? Rather than saying, ah, you, you
15:04
said yes over here and we're now just going to say arbitrarily 10
15:08
years later, that's not true. Sometimes that's the case.
15:12
Sometimes instead you want to say every visit I get to revisit
15:16
my consent or every time I go to a restaurant, I don't want to be
15:19
served the same thing. I want to have a menu.
15:22
So I think some of the same tools that are super, super
15:24
scary from that perspective of here's the one word, I have to
15:28
make sure that word is true. By being able to build an
15:31
architecture of proof and proof of controls, we actually can
15:36
still fulfill the spirit of that law and and yet move forward
15:41
instead of being left behind. You mentioned like you trust
15:44
going on an airplane and I think that's a really good analogy
15:48
because we trust a toaster, we trust the airplane, our car, we
15:53
trust very many things in our day-to-day life without reading
15:59
every single detail and manual and so on.
16:03
But all of a sudden we're expected in previously to kind
16:07
of do all of that, meet the great derailing ourselves
16:11
instead of going back to that suicide like on the trust basis.
16:14
I think that's maybe it's because it's still young area or
16:19
maybe it's because it's really hard to understand.
16:21
I think it might be a little bit of both.
16:23
It's, it's in some ways it's so obvious that no one wants to get
16:27
into the complexity. Like did you say yes?
16:29
Did you say no? Informed consent is hard and
16:33
understanding context. You know, the example I always
16:35
use because it's a memorable 1, is if I walked into an office
16:39
and just started taking my clothes off, most people would
16:42
look at you like you're pretty odd, unless it was my doctor's
16:45
office. And then it's very much
16:47
expected. So to understand the context of
16:50
the container, to understand how we're supposed to behave, to
16:53
understand what's OK in that context with each one of us,
16:58
those things are variant in our regular people world, and we
17:02
just sort of forget how many decisions we're ethically
17:04
making. It's not that it's against the
17:06
law to take off my clothes when I go into my professional
17:09
office. It might be a little too much
17:12
exposure, but it's ethically not allowed.
17:14
That's not what the community rules say.
17:16
That's not how you conduct business.
17:19
And we all know that and we're consenting.
17:21
That doesn't mean it's implied consent because we get squirrely
17:25
on that in privacy land, but I think we need to.
17:28
It's sometimes is we over complicate it by saying it's
17:31
impossible or we under complicate it by saying that
17:34
it's a yes or no choice. And the answer, as in everything
17:38
else is it depends. And there's ways of building in
17:42
these sorts of moral crumple zones.
17:44
There's, there's actually a wonderful research paper called
17:47
moral crumple Zones. And she talks about the, you
17:51
know, in, in car manufacture and, and in plane manufacturer
17:55
as well. There's all these fail safe
17:56
systems. So if you're driving in your
17:58
little car, it used to be in the 1970s, it's just a solid-state,
18:01
giant piece of metal. If you hit something, all of
18:04
that physics is going to be coming at you.
18:06
Sir Isaac Newton, he was a smart guy.
18:08
Nowadays they, they design it so that there's these empty hollows
18:11
in parts of your car that will absorb that pressure.
18:14
And so you see these horrifically stretched up
18:17
vehicles and a person walks out of them because we've designed
18:21
for that sort of moral failure. We haven't yet started doing
18:24
that for privacy. And we think we really, really
18:26
must have sort of a crumple zone where we know that we're going
18:30
to have some failed yeses. We know that we're going to have
18:32
some incorrect information, so now we can correct it.
18:36
Now we can think about re consent where it's really
18:39
important or the context has changed without sending me 100
18:43
page document that, you know, I happen to be a lawyer, so I'm
18:46
trained to read this stuff. I don't want to read it either.
18:50
You have to send me better cues to say, do you still want to
18:52
participate in this and and have a way for me to consent to be a
18:56
part of that. So that's that's interesting.
18:58
And the also links to one of the of the criteria in privacy by
19:03
design. So sorry if it's, I will ask you
19:07
about it because I think that is the most complicated concept.
19:10
Positive sum, not 0 sum. Can you explain that to the
19:15
audience? Yeah, And, and this comes out of
19:18
sort of Anne's studies in Anne Kavukian's, I shouldn't call her
19:22
Anne, Dr. Kavukian, her she's also a friend, but this is part
19:27
of her, her game theory in studying is that you the, the
19:30
belief that it is either you have privacy and there's all the
19:35
sorts of things you have to do and it's sort of a, a catechism
19:37
of privacy, if you will, or you have no privacy.
19:42
And if you want progress, if you want innovation, if you want
19:44
speed, you cannot have privacy. It really isn't zero or one.
19:49
Both people can win together. So with a company, I'll, I'll
19:53
say company, but it works for governments and NGOs and such.
19:57
But when a company wants your data and your participation,
20:03
they want you to either be buying stuff from them or they
20:07
want to observe stuff about you because it's valuable to them.
20:11
The first kind of strokes here to make it non 0 sum were there
20:15
were all these ideas about paying for your privacy.
20:19
So every time I participate on Facebook, I get paid.
20:22
Well, that's fine, except it turns out that they would be
20:26
paying me about $5 to use your €5 to to use all of my stuff in
20:33
a very complicated and they're making billions of dollars.
20:36
So that's not fair. Making it non 0 sum doesn't just
20:39
mean paying people for participation.
20:41
It means making services that are worth their while and making
20:46
interfaces that are easy enough to use without tricking people.
20:49
And so that's where we get into non 0 sum.
20:51
I like to keep in touch by using social networks.
20:55
I don't want people to invade my home or treat me unfairly or
21:01
decide that they're not going to talk to me because of, you know,
21:04
whatever algorithm has now shut me off without any participation
21:08
or any way of checking. It's almost like a credit score
21:10
where in the US you're, you're legally entitled to see your
21:14
credit score and improve it. If you think something unfair is
21:17
there, it's still really, really hard, even though it's legally
21:21
possible. That system is very broken in
21:23
the US and and it's consolidating it even further so
21:26
that only one or two credit agencies can actually decide
21:30
whether you are credit worthy enough to buy a home.
21:33
That is not 0 sum that that is really not designing for the
21:37
person in mind. That's got a huge moral crumple
21:39
zone when we start to bring the users in, when we start to
21:42
understand that not all information coming in or off of
21:46
a website should be tracked or can be tracked or just because
21:50
you can scrape a website doesn't mean that you should be
21:53
auctioning off that site. That describes a human being.
21:56
So this is where that that sort of concept and it is a gaming
21:59
concept because the scenarios change ethically as the stakes
22:04
change and the stakes get higher and higher.
22:06
So if you have a product or or a service rather like without this
22:11
concept, let's pretend it's called Facebook or or something
22:15
similar running that service, I have no clue.
22:18
But I guess it's really expensive.
22:20
And as far as I understand, like people are not really right now
22:24
at least willing to pay for for such service.
22:28
Or maybe they are, but most people seems not to be.
22:31
They need to actually get money somehow.
22:34
Yeah. And I think it's interesting
22:36
because especially now I will guess that there is a Facebook
22:41
replacement company starting up somewhere right now.
22:44
There's no reason that some of these companies are trillion
22:48
dollar companies and still unable to build in decent
22:53
privacy controls. Maybe they'd quote, UN quote,
22:57
only be $100 billion company and do things correctly.
23:02
Exactly. That's a company that will be
23:04
around in 50 years from now. Some of these companies that are
23:08
around, as soon as their founder is gone, they're done.
23:11
And you know, I'm not saying that that particular company is,
23:14
but I don't see a lot of innovation coming out of them.
23:16
And I see a lot of lost opportunity just shedding off.
23:21
And they sort of do these weird flailing things like with these
23:24
Meta glasses. And you know, there's there's
23:26
ways I would love to have glasses that told me how to
23:29
pronounce everybody's name. I'm terrible with names.
23:33
I'm even worse with faces. So I've got a double whammy is
23:36
like if you've got like a little beard scruff thing, you'd have
23:40
to tell me your name until I heard you speaking.
23:43
It's so bad. And not because I don't like you
23:45
and not because I don't know you, but if I had those glasses,
23:48
that to me is such a huge value add.
23:50
What I don't want, I don't want people going into the restroom
23:53
with me with their stupid meta glasses on.
23:56
I don't want them to go to my I mean, my kids are grown now, but
23:59
I don't want them going into school yards and seeing
24:02
children. I definitely don't want them
24:04
sharing information because they don't like what something is
24:08
going on in in somebody's nosy neighbor, you know, you know,
24:12
fight over a fence or a dog. So there's all of these misuses.
24:17
I just think the capital that needs to be deployed needs to be
24:21
deployed better. It's not an impossibility at
24:24
all. And the proof is how rich these
24:26
guys are. All of that money, a fraction of
24:29
that money. If you sent me into Facebook
24:31
today and said here's $50 million, Michelle, fix this
24:34
trillion dollar business, I could fix it.
24:37
I could fix it for a lot less than that.
24:38
I have to be allowed to fix it by the chairman.
24:41
I believe you with the glass. I saw some news like today and
24:45
yesterday about that they had used the glasses and exposed
24:50
people without clothes. It's ridiculous.
24:53
And, and we've been through this before.
24:55
We've been here before. Remember the, the glass holes,
24:59
they used to call them, you know, when they had the Google
25:02
glasses and they called everyone a glass hole that was wearing
25:05
these things. There's ways of fixing this.
25:07
And the minute they came out, immediately they were the, the
25:11
glasses were jail broken so that they could turn the light off.
25:14
So they didn't indicate that they were recording.
25:17
The other part of this is particularly I'm, I'm more
25:19
familiar with the US laws. There are surveillance laws that
25:22
exist in the US. They need to be held accountable
25:27
when something is already breaking an existing law.
25:30
We don't need to wait 10 years for people to make a new law.
25:33
We need to actually exercise our rights and have these laws and
25:38
actually hold these people into account.
25:40
That's that's unacceptable and completely preventable behavior.
25:44
Since you mentioned that I'm in school, how is it in in schools
25:48
in the USI know how it is here. I have two children, two
25:52
daughters as well. School age, Yeah.
25:55
I haven't seen anyone having these glasses at least.
25:59
But I mean, they all have their cell phone.
26:02
Yeah. They're not allowed to use it
26:04
during the daytime. They kind of live it in, in,
26:07
locked in, in the morning, and then they pick it up when they
26:10
go home. So it's recording, not recording
26:13
like recording, recording like we're recording, but it's
26:16
fetches data. Yeah, it knows where that phone
26:20
is, for example, like it's orienting itself in space.
26:23
It's it's receiving messages. It's some, some kids have got
26:29
the, the watches and other things on sending their
26:31
biometric data. I, I don't think there's going
26:34
to be a slow down in, in the Internet of Things or the
26:38
Internet of everything sending out more and more information,
26:41
particularly as we're feeding these AI products that we're
26:46
only going to see more, more, more of that.
26:49
So we have to understand that if the data is going to flow, how
26:52
are we going to treat this? The way I look at it, for some
26:56
of these, these sort of, I call them information oceans, not
27:00
data lakes. They're really oceans of
27:01
information. Are we treating them more like
27:04
organic things? Like I may eat something that is
27:08
unagreeable to my body. I have a system that most cases
27:12
has a way of eliminating that through 11 tube or another that
27:16
that bad thing is coming out. How are we doing that with data
27:21
so that if for example, some kid has left their phone on and
27:24
maybe it's recording and it shouldn't or it's has GPS turned
27:29
on and it shouldn't, Is there a way of thinking about on the
27:34
client side, how do we block those trackers?
27:36
I work with a great company right now called Locker and they
27:40
just walk around like digital citizens and they scan every
27:44
major company and, and get a general score of what the risk
27:49
is going on with data being transmitted.
27:51
And then for their clients that do a particular protection.
27:54
So everyone could lock down that web side and app side, on the
28:00
receive side, on the server side, there's no reason why we
28:05
can't filter out that kind of information.
28:07
So yes, it's trickier than not collecting it.
28:10
Yes, it's more expensive. But if you are someone who's
28:13
assimilating that kind of data, you have to be aware that that's
28:17
who you are. Now you're in the restaurant
28:19
business, everyone's got to wash their hands and have fresh food
28:22
or it's just not going to work. So it's sort of the price of
28:25
participation these days. And and we shouldn't ever look
28:28
at it like it's quote UN quote, just data or data exhaust.
28:32
This is data about humans. But is it that the challenge
28:36
that we kind of allowed all the devices to build on a fishing
28:40
expiration all the time? It has been and I think that's
28:43
changing. I mean, you see unfortunately
28:46
don't see a lot of it in the US right now.
28:48
We're in a bit of a place in the US, but we see places like
28:52
Australia. Julian and Grant is the safety
28:55
commissioner of the world's first safety commissioner.
28:57
They're trying strategies, I don't know whether they'll work
28:59
or not, of banning people under 16.
29:02
Yeah. So I don't believe in it,
29:05
unfortunately. I don't think it's going to
29:06
work, but I love, I think everything else that she's been
29:09
doing has been really great in just education and understanding
29:13
that, you know, prosecuting people that are harming kids,
29:16
all that stuff. But I think I think the notion
29:19
of an E safety commissioner is really, really smart.
29:22
And I know there's a number that are being set up globally thanks
29:25
to Julie really and and the Australian government.
29:28
I think that's we can't wait to have a a safety commissioner
29:32
everywhere. We don't have one in the US, not
29:34
even close. So we have to think about this
29:37
at a more organic level of as you say, is what are you giving
29:40
to your kids? And there's again, this is
29:42
contact. So when my kids first got their
29:45
devices, first of all, it was, you know, they're, they're 20
29:49
and 25 now. So it still was early enough
29:51
that I could actually look at all the apps they had.
29:53
Now it's impossible. There's there's some company out
29:57
there right now that I'm sure is inventing an agent for parents
30:02
to have some sort of an agentic review of what's going on in
30:05
your kids world right now without surveilling them,
30:08
because that's the other part of this.
30:10
The way I approach my kids was a little different than even kids
30:13
parents in my neighborhood. I said, we're starting with
30:16
trust. A lot of people start with
30:18
nothing and then they give a little bit, little bit.
30:20
I said, no, no, you've grown up with me.
30:22
You know my position on privacy and, and a lot of mommy's
30:25
friends are in the privacy and security business.
30:27
So it's not like my kids came at it with 0.
30:31
But I said, listen, I'm going to start off assuming that you know
30:34
what you're doing, you've got training, you understand how to
30:37
control your passwords and such. And then we're going to figure
30:40
out, we're going to have check insurance.
30:41
And then if I need to restrict your trust, and I did in some
30:44
cases, you know, curfews had to be changed.
30:47
Certain friends were not going to be coming around the house as
30:49
much as they were. Then I started peeling back, but
30:52
that's how we did it in my home. For other people's homes, it
30:55
starts with very restricted. Mom checks your phone every
30:59
night, mom reads your texts. This mom ain't got no time for
31:01
that. So it's really figuring out what
31:05
is the right ethic for you and your kids and most importantly
31:08
for me. And This is why I worry about
31:10
people being restricted from access.
31:13
This is the world. So I don't want your kid to wake
31:16
up and have 0 experience when they're not coming home to you
31:21
with tears in their eyes because somebody's been a bully.
31:24
I don't want them sitting alone in a dorm room the first time
31:27
someone asked them to take a nude and then suddenly they're
31:31
getting blackmailed and not able to get a summer internship.
31:33
I think we need to not, not not supporting nudes, to be very
31:37
clear, but having a place where you can grow with your kid
31:41
because they're learning ethics online too.
31:44
And you're teaching them to be privacy engineers, whether you
31:47
know it or not, about what's acceptable for how much they
31:51
want exposed. And, and what's it going to look
31:53
like when they're adults and they're looking back at what
31:56
they posted with all these weird, you know, especially with
31:59
girls, like all their faces and their little outfits.
32:02
Yeah, actually, I don't think we know what will happen because
32:06
we. Don't and all.
32:07
These I'm I'm I'm playing around with, I mean, it's it's also a
32:11
little bit scary because my youngest is only 10 and now we
32:15
kind of playing around with Claude.
32:17
Yep, and she thinks that Claude is really, really funny.
32:21
Yeah, yeah. And if I compare Claude Li to to
32:26
example copilot or other ones I use, they are not funny, they're
32:32
just boring. This is really like interacting
32:35
with a real person on the other side with smileys emojis.
32:40
I'm kind of making fun of me, her dad.
32:45
I was like blown away when I like woah this is something
32:49
else. Yeah, there's people falling in
32:52
love with these things. Yeah, and I can, I understand
32:55
that. I totally, totally get it
32:58
because things that I would be embarrassed to say even to a
33:02
doctor, you're just saying it to yourself.
33:05
But you're not. But you're not.
33:08
You're saying it to Sam Altman. Do you trust Sam with your 13
33:11
year old? I don't think so.
33:13
So really, really interesting to say that sometimes I wish I will
33:19
become like 150 years old to like see all the development,
33:23
like, where are we heading? People are like, oh, AI is going
33:26
to take over. AI will help them do their
33:29
homework. Like it was a controversy when
33:31
when we were allowed to bring a a calculator into a math test,
33:35
my dad was so upset. He wanted to come to the school
33:38
and say how dare you allow her to bring a calculator.
33:41
We had to do it on paper. They're going to have AI because
33:44
this is how they're going to work.
33:45
This is how they're going to fill out their driver's forms.
33:48
This is how they're going to be judged.
33:50
So it's we don't know. I agree with you, Phillip.
33:53
It's like, I kind of want to see what's in the future.
33:55
And I kind of been like, oh, it's a good thing I'm old.
33:58
Maybe I don't have to look. I actually the first 5-6 years
34:04
of my life we didn't have a television.
34:06
Yeah, same. So I I still remember when they
34:10
brought home a television the first time.
34:13
And I mean, that's absurd even in from Sweden.
34:16
In Sweden, all of my friends had televisions.
34:19
Yeah. But my father was really anti
34:22
technology. He didn't get the cell phone
34:25
until he was like really old. He barely used it before he
34:29
passed and so on. I mean, so we didn't take, we
34:33
always took the trend down to the continent in Europe instead
34:36
of taking airplane. But I think I think you should
34:40
maybe not be that anti tech, but maybe a really bit cautious.
34:46
But I'm kind of embracing everything.
34:48
But we caution. But you're bringing in that,
34:51
that that grounding that you grew up with of I think that's,
34:56
that's where the skills for kids.
34:58
And I used to tell parents when I was like doing cyber safety
35:01
for kids training and stuff is, you know, on all of our
35:04
holidays, the best thing you can do is keep your family wet.
35:08
They're not bringing that phone in the pool.
35:10
They're not going surfing with the phone.
35:11
Keep the family wet. At least they'll have some
35:14
minutes. And, and it's really, really
35:16
important to just continue to revisit whether it comes
35:21
through. Like Cory Doctorow has written
35:23
some great books that are good for young adults to think about
35:26
super surveillance, to talk about what, what your ethics
35:32
are. You know I I said to my kids
35:33
growing up, you know, I live in Silicon Valley.
35:36
My daughter came home when she was maybe 3rd or 4th grade, so 8
35:41
or 9 and she said mommy are we poor?
35:44
And I said honey we have ATV and a washer dryer inside our house.
35:53
We are living beyond my dreams. This is great.
35:57
And my parents did did fine, but they started with nothing and
36:00
worked out to be fine. I said what do you mean?
36:04
Are we not rich? And she said, well, you know
36:06
Susie, her dad has a helicopter that lands over here because he
36:12
was one of these big venture people and this guy's got an
36:15
elevator in his house. And I said none of this is
36:19
normal. So when we talk about stuff and
36:23
I talk about how spoiled you are and I am the one doing the
36:26
spoiling, know that we're coming from a different language
36:30
because my language is, you know, we are 4 kids a year
36:34
apart. My mom used to RIP our gum in
36:36
half and like each kid got 1/2 stick of gum.
36:40
Like we're half stick of gum people.
36:42
When I said no to my kids for candy, it was because I thought
36:46
they were having too much sugar. When my mom said no to me, it's
36:49
because we had no money for candy.
36:51
Understanding what those boundaries are and just being
36:53
very open of I don't understand your kid world like you don't
36:58
understand that 10 year old having this relationship with a
37:02
bot. And so one of I'm actually
37:05
writing a book right now. It's called lighthouse
37:06
leadership, how how to design and navigate systems that don't
37:10
eat people. And one of my lighthouse
37:13
leadership in air quotes lessons is I accidentally learned with
37:18
my kids because we don't come from the same planet as I just,
37:23
and I use this phrase a lot is just tell me more.
37:26
Those 3 words of hey, I'm talking to Claude and he's
37:30
really funny and they're using a pronoun of he or they've renamed
37:34
it a different name. And so just sitting back and
37:36
saying tell me more to really bring these these things to
37:40
light. And it works for the executives
37:42
just as well. How do you want to use this?
37:45
What does this mean to you? How does this make you feel?
37:47
There's nothing wrong in an engineering to have something
37:51
that feels good. The reason we have haptics on
37:53
our on our cell phones is because it doesn't feel right to
37:56
tap it without having that button for certain generations
38:00
like us. So tell me more is a magical
38:04
phrase while we're while we're dealing with our kids, while
38:07
we're dealing with our clients of what is it?
38:09
How do you want to feel about this?
38:10
Do you want to feel safe? Do you want to feel like you're
38:12
taking appropriate risk? Do you want to feel like you're
38:16
in the vanguard of of devil may care?
38:20
That's your brand? That that kind of just that
38:23
phrasing of slowing you down really helps you build the right
38:25
requirements in and and it also really let your kids teach you
38:29
things that will blow you away how sophisticated they are.
38:32
So, So what, why do you think we're heading with with AI?
38:36
Will it be, I mean, this is a living question.
38:39
Will it be integrated in our life?
38:42
Oh yes. I think there's there's three
38:45
and you know, I like you. I remember watching Maverick on
38:48
TV with like his giant and Tom Selleck with the giant block,
38:53
quote UN quote mobile phone that was like 50 lbs of So we've come
38:57
a long way and it used to be like a each personal computer
39:01
was like there was one in the house and it would sit in a
39:04
room. We've already changed so much we
39:06
don't even recognize ourselves. But Even so, I've seen really
39:10
three turning points. 1 is the web itself, used commercially to
39:16
advertise things and to explain things.
39:19
The second is being able to pay for things online.
39:23
So now not only is a billboard, but it's actually interactive in
39:26
a commercial kind of way. And the 3rd and, and I and I'm
39:30
skipping over my, my role at my last role at Sun was Chief
39:34
governance Officer for cloud. So we had to design decide if we
39:37
were going to have blue content or we had to decide what
39:41
jurisdictions we were going to block, etcetera.
39:43
Even that was really utility and an energy strategy.
39:47
This what we're calling AI now beyond the LLMS, but the fact
39:51
that every 10 year old knows how to use AI now, the fact that we
39:55
can have agents on top of agents acting as more cellular than
40:01
data center, this will not change this this change that the
40:05
shift, this expectation that there is a machine that does
40:09
magical things. We in the compliance world and
40:13
the governance world have to UN magic it and make sure that the
40:16
actual gears are working. But for everyone else,
40:19
societally, ethically, globally, even geopolitically, we're going
40:25
to have to figure out what are we doing with our water?
40:28
Takes a lot of water to keep these data centers running.
40:30
Do we have enough energy? If we had a margin call on every
40:34
energy supply right now to supply what we're talking about
40:38
for AI, we don't have enough materials on this planet to
40:42
cover it. So we're going to have to make
40:43
some hard ethical decisions. And only 60% of the world is
40:48
online right now. So there's 4040% billions of
40:52
people who are existing on this planet with us right now who
40:56
don't have any access to this at all.
40:58
So they will be impacted by it. They will our food supply will
41:02
be impacted by this, our energy will be impacted by this.
41:06
Our currencies are already being changed of who's going to be the
41:11
the reference currency for the world.
41:13
So we're in for a lot of changes.
41:16
And sometimes that's overwhelming.
41:18
That's when it's time to, I think, lean into it.
41:20
And sometimes I have to lean into it by leaning into poetry
41:24
and feelings or entertainment and silliness or non fiction or
41:30
or fiction to imagine it. And then we figure out, all
41:34
right, now let's put all the things on the table that we have
41:37
because like I said before, the bad guys have AI.
41:40
But guess what? So do the good guys.
41:44
So now we have to figure out how do I be a good guy with all this
41:47
super bionic capability around us?
41:50
A lot to think of. There's a lot coming at us right
41:52
now. Yeah, it is.
41:55
I mean, and the speed you talked about the big block cell phone,
41:59
I mean it that was around for like 1-2 years and then it
42:03
became a little bit smaller and then a little bit smaller and
42:06
then eventually like the iPhone, the smartphone, it took years.
42:10
Yeah, and don't forget your buddies next door, the Nokia
42:13
phones. But now it's like each model is
42:19
like 10 times power more powerful.
42:22
And it took two months. Yes.
42:24
And, and I, I need to say that because I, I actually saw today
42:29
might have been yesterday a parent with an agentic ally
42:33
being the parent for that person's children, like
42:37
reminding to take the basketball clothes.
42:41
And I felt like, well, that's actually my job.
42:44
Yeah, yeah. And if I can't do even that tiny
42:48
small things for my children and I need an AI, then something
42:52
else is broken. Yeah, I think so.
42:55
But I also think in that case, because I was always that mom,
42:59
at the last second, the girls would say, oh, mom, we have to
43:02
bring 50 cupcakes tomorrow morning and it'd be 10:00 PM and
43:06
I'd go, how's this going to happen?
43:11
Some of that stuff I think will free you as well.
43:15
So it's like the past. Year, but some might make you
43:18
Dumber. Oh, for sure, for sure.
43:21
Well, believe me, there are people self-serving stupid to
43:25
themselves right now in this in this world.
43:27
We have we have access to the world's information and and yet
43:31
people are getting Dumber than ever.
43:33
Like some of the things they believe and some of the things
43:35
they do and the people that tell me I just don't want to look at
43:38
the world right now because it's too scary.
43:40
So I'm doing nothing. It's hard for me to comprehend
43:42
because that's not how my brain is wired.
43:45
I, when I get confused, I, I research to a fault and, and,
43:49
and it causes me great psychological pain.
43:52
So it's, I'm not saying my way is the best way.
43:55
It's just my way. So yes, there will be people
43:58
that check out, there will be terrible things.
44:02
And, and I've seen it younger and younger.
44:04
I mean, when we first started working to prevent human
44:08
trafficking, when I was at Intel McAfee, at that point, people
44:12
were logistically trying to move children's bodies around to get
44:16
to the people that wanted to buy them.
44:18
That the age was around 15. The average age of the
44:22
trafficked child is now down 1012 years old.
44:25
We're talking about babies. Why?
44:28
Because they can do it all online.
44:30
They can whistle up a victim in their hotel room.
44:32
They can they can whistle up a synthetic child being abused in
44:37
in online. So the terribleness of humanity
44:42
is going to accelerate at an incredible pace.
44:46
This is why it's so important for the people who cannot stop
44:50
leaning in and being a mom to the world and caring about the
44:55
kid that's only being parented by an agentic bot.
44:58
And everything looks OK on the outside, but every time they
45:01
come to your house, you know, they haven't had a hug in a
45:03
while. It's up to us that have the
45:05
empath, you know, empathic imperative not to compensate for
45:08
them, but to try to build something that's going to
45:11
attract them into the fold and say, this is our humanity.
45:14
This is where ethics live. It's group think.
45:17
It's really figuring out how do you balance the worst of us and
45:20
the best of us so that the most of us can really have a
45:23
thriving, you know, at least a place that the bad guys know
45:26
that they wish they were in. So someone also said that I'm in
45:31
and going back tomorrow, adulthood, people that actually
45:36
kind of exam, taking an exam, for example, in law, since we
45:41
were lawyers and AI taking over everything that the junior
45:45
lawyer is doing, how would he ever be a senior lawyer?
45:50
That's The thing is like if you can't craft an argument, you're
45:54
only going to get the schlock that's out there already.
45:59
So you're you're eventually you're going to get beat hard.
46:01
You're going to have. To we need to figure out, I
46:03
think, because it's not only our profession, of course, it's in
46:06
many professions that the same would happen because AI will be
46:11
able to do already now like all this stuff, but you need to do
46:15
this stuff to reach the complicated stuff.
46:18
Absolutely. There is one thing that I need
46:22
to pivot into. It's wicked problems.
46:25
Yes. I'm going to be very honest, I
46:30
never heard it before I started to preparing for this discussion
46:36
I did. I didn't even know of the
46:38
concept. Wicked problem.
46:40
I didn't either. Interact with that a lot.
46:44
Really interesting. And of course, Wicked to me is a
46:47
movie, but that's why I said that.
46:49
We're going to come back to your consultancy firm, Private
46:54
Strategy Consulting. Yeah, let's wrap it up with
46:56
that. Yeah.
46:57
So I'm very excited about Wicked Privacy.
47:01
So Brian Lee is my partner at Privatus.
47:03
And so there's Publicus, which is your public bubble of sort of
47:09
awareness thing. And then there's Privatus, which
47:13
is your own private information sphere.
47:17
So Brian came out of signal intelligence and data and he was
47:21
a professor at Berkeley and a couple of the military instance
47:25
out here in Monterey before that was was Lieutenant Colonel in
47:29
the US Army doing intelligence stuff.
47:31
He and I worked together. I was the CEO of a data
47:33
analytics company for a short time and he was there on the
47:37
technology side and and said, you know, I think privacy is a
47:40
wicked problem. And I said I don't know what
47:42
that is. Tell me more.
47:44
So it actually is a class of problems.
47:47
That is, you know, the thinking goes back into the 70s and it's
47:51
and think about things like childhood hunger, health,
47:55
poverty, peace, anti nuclear proliferation, which is what he
47:59
was working on and privacy. So a wicked problem.
48:03
The the number one thing that you need to know about a wicked
48:05
problem and why wicked privacy, why privacy is a wicked problem
48:09
is it does not have an ending or a solution.
48:12
So it's a type of problem that the minute you solve one
48:15
problem, so in privacy, you solve the problem of secrecy by
48:19
applying encryption, you create another problem.
48:22
What do we do about key management?
48:24
What do we do about law enforcement needing to have
48:27
information to solve crimes? So every problem that you solve
48:31
in a wicked problem often generates new challenges.
48:35
But it's also characterized as there's a number of different
48:38
types of personas that have a stake.
48:40
So you have users, you have builders, you have resource
48:43
providers, Everybody has a different stake and a different
48:47
take and what they're looking at as success.
48:50
Just like privacy. Somebody wants to use the data,
48:53
someone wants to be left alone, another person wants to buy the
48:56
data. And so it goes.
48:58
And you have a limited set of resources and realistic.
49:01
What's the technology state today?
49:03
How educated and cultured are my team?
49:05
And so when you're solving wicked problems, you're
49:07
constantly looking at this holistic way of solving a
49:11
resource limited, never ending problem set that's outcome is
49:17
really legacy. Like you're never going to stop
49:20
solving healthcare. Even if you've cured cancer,
49:23
you're probably going to create some new thing we've not heard
49:26
of or created yet. If you've solved consent, we
49:30
still haven't solved. How do we balance rights and and
49:34
observation? So looking at privacy instead of
49:37
as a single journey or a battle, we use battle language for
49:41
security all the time of like a mission or keep up the bad guys
49:44
or fighting off the malware. Instead, it really looks at it
49:49
as a holistic problem set with a bunch of different stakeholders
49:53
and a bunch of different people that own different pieces of the
49:56
problem. So when we talk about and Brian
49:59
and I will go in and do leadership training for Wicked
50:01
privacy merely for fairly senior people that each have a really
50:06
important, you know, game changing piece of the pie for
50:09
their company. And so we come in and we say how
50:12
do we get all of these objectives achieved and have a
50:15
common agreement of what we're going to do right now and how
50:18
we're going to clean up those unknown factors when they pop
50:21
out of the top of it. Thank you so much for being my
50:25
guest. Absolutely.
50:26
Thank. You for spreading delight about
50:29
Wicked previously and wicked problems.
50:31
Thank you so much. And that was it for today.
50:35
Thank you all for listening in. And don't forget to subscribe on
50:39
your favorite podcast platform to Dota Ministeriat.
50:43
And you can also TuneIn to listen to the former episodes at
50:49
any podcast platform. Stay tuned for the next episode.