Latest / The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store / The Future of Digital Trust EU Harmonized AI Standards and OECD Business Guidance with Sebastian Hallensleben and Punit Bhatia in the FIT4PRIVACY Podcast E156 S07

Transcript

The Future of Digital Trust EU Harmonized AI Standards and OECD Business Guidance with Sebastian Hallensleben and Punit Bhatia in the FIT4PRIVACY Podcast E156 S07 · The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store

• 0:00
  Harmonised AI standards are coming up and OECD is also
• 0:05
  planning to publish guidance for businesses.
• 0:08
  Yes, we talk about responsible, A i.e., UAI Act, the Digital
• 0:12
  Trust and so on, but businesses need guidance and that's what is
• 0:16
  coming in form of EU harmonised AI standards and OECD business
• 0:21
  guidance. And that is exactly what we're
• 0:23
  going to talk today with our guest, Sebastian Helen Spellen,
• 0:27
  who is at the forefront of this effort and involved in this.
• 0:32
  So let's go and talk to him. And as we do that, take
• 0:35
  advantage of ISO standard courses, EU regulation that we
• 0:38
  are offering you grow skills.storeorfitforprivacy.com.
• 0:43
  Welcome to the Fit for Privacy Podcast where your host Puneet
• 0:47
  Bhatia discusses the latest trends, challenges and
• 0:50
  opportunities in privacy, artificial intelligence,
• 0:52
  sourcing and related fields with industry leaders and experts.
• 0:56
  Whether you're a professional business leader or just
• 0:58
  passionate about topics like AI and privacy, this is your go to
• 1:02
  place for insightful conversations and practical
• 1:05
  advice. The Fit for Privacy podcast is
• 1:07
  brought to you by Fit for Privacy, your trusted partner in
• 1:10
  AI privacy and sourcing matters and Grow skill Store, your go to
• 1:14
  destination for top tier training on ISO standards and
• 1:17
  key EU regulations. Remember that opinions expressed
• 1:20
  in this podcast are not legal advice.
• 1:22
  Now it's time to dive in today's episode.
• 1:28
  So here we are with Sebastia and welcome to another episode of
• 1:32
  the Fit for Privacy podcast. My name is Punit, and as I said,
• 1:35
  we are with Sebastia for an exciting conversation about AI
• 1:38
  in business and the future of AI.
• 1:41
  So, Sebastia, thanks for being here.
• 1:43
  Thank you for having me. It's a pleasure to have you and
• 1:46
  let's start with a very basic question.
• 1:48
  The world is changing and what used to be a simple thing called
• 1:51
  trust is becoming digital trust. Would you share your two cents
• 1:55
  about what is digital trust in today's world?
• 1:58
  Well, I'm glad that trust has become a term that is left,
• 2:02
  right and centre in many conversations now.
• 2:05
  I struggled for a long time to properly understand what trust
• 2:09
  is, and I owe my current understanding to some
• 2:14
  philosophers of technology who define trust as accepted
• 2:19
  vulnerability. So trust is not something you
• 2:22
  can somehow create by more and more checking, but trust is the
• 2:28
  conscious decision to be vulnerable, to accept that you
• 2:31
  cannot check and verify everything.
• 2:33
  Having said that, the follow on question is then how can we
• 2:36
  justify trust? And then it becomes really,
• 2:39
  really interesting to me. This is such a core concept.
• 2:41
  Even if someone asks when were you born, you think, well that's
• 2:46
  a daft question. Of course I know when I was born
• 2:48
  I was there. Clearly that the knowledge of
• 2:51
  your birth date comes second hand or third hand.
• 2:54
  It comes from your parents, or it comes from neighbours who saw
• 2:58
  how your parents brought you home.
• 3:00
  Or it might come from a registrar in the town hall who
• 3:04
  hands you a piece of paper that says birth certificate and has
• 3:07
  your name and the date on it. You have to trust that person.
• 3:10
  So even for the most basic personal facts, we have to trust
• 3:15
  other people. And so now we are in the digital
• 3:18
  space and we're in a situation where trust is already much
• 3:22
  harder because you lack cues such as body language, you lack
• 3:28
  many other cues that we've evolved over the thousands of
• 3:31
  years to pick up on. But that's not the end of things
• 3:34
  getting worse. It's now getting to a point
• 3:37
  where AI generated fakes, AI generated bots and human beings
• 3:42
  make us even question what we thought so far we could verify
• 3:46
  with our own eyes and ears. So I would say we have to talk
• 3:51
  about digital trust because there is a crisis of trust in
• 3:55
  the digital space that needs some fairly fundamental action
• 3:59
  to address. That's very interesting because
• 4:02
  mostly when I discussed with many other colleagues, people
• 4:05
  expert like you, the dimension is trust is the confidence in
• 4:09
  the digital product or digital interaction.
• 4:13
  That's how they say. And then when we are
• 4:15
  implementing it, we take the other scenario saying let's do a
• 4:17
  risk based implementation that goes in your direction of the
• 4:20
  risk, the vulnerability you are willing to accept.
• 4:23
  So that's a very interesting definition.
• 4:25
  And you mentioned about AI, the things are changing, but can we
• 4:29
  talk about what specifically changes in this AI and quantum
• 4:33
  world? Because of course there's an
• 4:34
  immense amount of possibilities and immense amount of computing
• 4:38
  capability and but what exactly changes?
• 4:40
  Why does digital trust become all of a sudden such a hot
• 4:44
  topic? Because we were in the digital
• 4:46
  age since 1990 or 2000, whichever way you want to see.
• 4:49
  The disruptive shift is really that the economics of
• 4:54
  fabricating stuff have shifted. It's always been possible to
• 4:58
  fabricate stuff. People have been writing fake
• 5:02
  reviews since the Internet started, almost, or at least
• 5:05
  since e-commerce started. People have been doctoring
• 5:08
  photos since photography existed, and even more so since
• 5:13
  Photoshop exists. But we still have that notion of
• 5:16
  if we see a video of something or someone, well, that's real.
• 5:20
  It might be edited a little bit, it might be cropped in a weird
• 5:25
  way, it might be taken out of content context, but we were
• 5:29
  able to assume that the video itself or the audio itself is
• 5:34
  genuine. And that really changed in 2018,
• 5:38
  two, 1019, when Deepfake became widely available.
• 5:43
  And that for the first time ever, put the tools into
• 5:47
  everyone's hands, not only to fake content, but also to fake
• 5:53
  people. And that's the most important
• 5:56
  aspect, to do so at scale. It's one thing to be able to
• 5:59
  say, well, I can, I can create some fake reviews, but now I
• 6:04
  don't have to pay €10 to a student somewhere to put a
• 6:08
  review on Amazon. I can create hundreds and
• 6:11
  thousands of reviews for virtually no cost.
• 6:15
  Or if I'm a geostrategic actor who wants to influence the
• 6:18
  political discourse in another country, rather than having to
• 6:21
  pay 200 or 300 people to push certain messages, to engage in
• 6:27
  conversations, to try and shift opinion somewhere else, I can
• 6:31
  just have 100 * 1000 * 10,000 times the influence by creating
• 6:37
  convincing bots that look to everyone like human beings, that
• 6:41
  look, that can pretend that there's a certain majority
• 6:44
  opinion about some topic. And that shift in economics, the
• 6:49
  scalability of fabrication, that is the big disruption that makes
• 6:56
  me talk about a fundamental crisis of trust.
• 7:02
  And I would actually go as far as comparing the current
• 7:07
  situation in the digital space to the situation in the physical
• 7:12
  world back in the 1970s. I was born in the 1970s and that
• 7:17
  was the time when organisations, networks like the Club of Rome,
• 7:22
  were starting to raise the alarm about our physical environment.
• 7:26
  They pointed out that we are exhausting resources.
• 7:32
  They also pointed out that we are polluting our physical
• 7:35
  environment and are on a path towards making our physical
• 7:39
  environment unlivable. It took humanity a few decades
• 7:43
  to really accept the consequences and start to take
• 7:47
  action, at least slowly. And we're in a much better space
• 7:51
  now. But we've now got the equivalent
• 7:54
  situation in the digital space. Just as fundamental, we have
• 8:00
  pollution through a flood of AI fabricated bots and fakes and
• 8:05
  slop. And we have an exhaustion of a
• 8:08
  finite resource and that resource is our human attention
• 8:11
  span that is just constant. It's not growing exponentially
• 8:15
  like the rest of the web. So we are really at a point
• 8:19
  where we risk losing the digital space as an environment to live,
• 8:26
  to socialise, to do business in, to have democratic discourse in.
• 8:32
  And we should really we need to take that threat just as
• 8:37
  seriously. And the difference to the
• 8:40
  physical world is we don't have 3 or 4 decades to react.
• 8:44
  We have to be far, far quicker in our reaction.
• 8:49
  That's very well said. I mean, yes, the opportunities
• 8:54
  to create something fake or something illegit have
• 9:00
  increased, and the threshold or the cost of creation has gone
• 9:03
  down so immensely that anyone can do it.
• 9:07
  It's now a matter of should they or shouldn't they, or what do
• 9:10
  they choose to do? And then we get into the
• 9:12
  definition of morality and ethics and responsibility.
• 9:15
  But while we can talk about the human or the individual side of
• 9:19
  human responsibility or ethicality and accountability, I
• 9:25
  think it all starts with some companies building it these
• 9:28
  products and making them available for mass market,
• 9:31
  whether with good intentions or sometimes in the the dark web,
• 9:36
  whatever it is. But you're also part of the OECD
• 9:41
  work that is being done on responsible AI for business.
• 9:44
  So guide us on in this environment wherein everything
• 9:51
  is feasible and everything is seems like an opportunity.
• 9:55
  Everything is innovation and in name of innovation, how can a
• 9:59
  business keep a balanced act and do or conduct themselves in a
• 10:04
  responsible manner in this AI and quantum age?
• 10:08
  It's a very good question with many facets to it.
• 10:14
  So maybe since you since you touched on my work at the OCD.
• 10:20
  So I'm leading an expert group there together with two
• 10:24
  colleagues who try and define rules for responsible business
• 10:30
  conduct at the international level.
• 10:33
  And this is actually designed as an extension to an existing set
• 10:36
  of rules, the OECD Due Diligence Guidelines for Responsible
• 10:42
  Business Conduct for Multinational Enterprises.
• 10:45
  This has been around for I think 10 or 15 years and so far
• 10:50
  contains some notion of don't destroy the environment, don't
• 10:56
  use child labour, don't bribe local officials, some basics of
• 11:00
  good business conduct. If you operate globally and this
• 11:07
  rule book has teeth, it has an enforcement mechanism.
• 11:11
  There are national contact points that manage the
• 11:14
  enforcement. And an interesting example, you
• 11:18
  might remember the dams that broke in Brazil a few years ago,
• 11:24
  flooding whole valleys and villages with mining waste.
• 11:27
  And the company that certified those dams are safe was actually
• 11:32
  held to account under this OECD framework.
• 11:36
  So this is now getting, Simply put, an extra chapter on basic
• 11:42
  rules of AI governance. And a lot of it is around risk
• 11:48
  management, around identifying risks, about governing risks,
• 11:52
  mitigating them, and also making the decisions which risks or
• 11:59
  which levels of risks are acceptable or not acceptable and
• 12:02
  making those decisions in a sensible and transparent manner.
• 12:06
  I think we have to recognise that there are always trade-offs
• 12:12
  involved. So when we use AI, it's not
• 12:16
  possible to say, well, let's use AI in a way that has maximum
• 12:22
  privacy protection, that has maximum fairness, that has
• 12:25
  perfect transparency, that has perfect robustness, That
• 12:29
  technology simply doesn't exist. And in some cases, for example,
• 12:33
  if you look at privacy and transparency, there are even
• 12:36
  fundamental conceptual reasons why you have to, to some extent
• 12:41
  make trade-offs between the two. But what we're trying to achieve
• 12:47
  is a certain base level, if you like, of responsible conduct.
• 12:53
  So that's kind of the organisational behaviour, if you
• 12:57
  like. Your question also points at
• 13:02
  products and we have a certain baseline for AI products given
• 13:07
  in the AI Act. So the AI Act is Product Safety
• 13:11
  legislation at its core, but we also have the question of misuse
• 13:16
  of products. And if an AI company creates,
• 13:22
  for example, video fabrication tools, it's quite possible for
• 13:27
  those fabrication tools to be perfectly AI compliant.
• 13:32
  But there's still a massive potential for misuse in the same
• 13:36
  way as pharmaceuticals can be misused in in a variety of ways
• 13:41
  or many other chemicals or knives or whatever else you want
• 13:45
  to name can be misused in a variety of ways.
• 13:49
  And so it's a tricky situation for companies to navigate
• 13:56
  whether to put out a product that has both very beneficial
• 14:00
  uses and also misuses. And I don't think there's a
• 14:06
  that's A1 size fits all or an easy answer to that.
• 14:10
  It also depends on the product and on the on the market.
• 14:14
  Yeah, no, I think there are no easy answers.
• 14:17
  And when we get into the dimension of ethics,
• 14:20
  responsibility, accountability, governance, these are concepts
• 14:25
  that are interesting, but when business is there, they are
• 14:29
  usually like, what do I have to do?
• 14:32
  Because not everyone can grasp these concepts easily.
• 14:36
  And some of our colleagues are very tech driven and they're
• 14:41
  like, give me the clear requirement and that's what I
• 14:44
  need to give me a clear standard.
• 14:45
  And that's where now usually we have laws and you talked about
• 14:49
  the EUAI Act being one of those. So that gives a rules as regard
• 14:55
  what you can do and what you cannot do.
• 14:57
  But then you also talked about products being different and
• 15:01
  industries being different. So that's where we get into the
• 15:05
  game of or the playoff standards or rule of harmonised
• 15:10
  frameworks, whatever we call it. And I know you're working on
• 15:14
  that aspect also in context of the UA Act.
• 15:18
  So can you talk about some harmonised approaches with which
• 15:23
  this can be made real practical in some industries?
• 15:26
  Reason being, yes, it's important, nobody is denying
• 15:30
  that. But people need more hands on
• 15:32
  practical guidance. Yeah, I think the I Act was a
• 15:37
  very, very important step for Europe.
• 15:39
  And despite all the controversies and discussions,
• 15:45
  to me it got quite a few things right.
• 15:48
  So firstly, it got right that it's a risk based approach.
• 15:53
  So the amount of restrictions or the amount of ceremony depends
• 15:58
  on the risk level of the way in which you want to use AI.
• 16:02
  And secondly, the AI Act is very much geared towards the product
• 16:10
  rather than the application. Sorry, the acts very much geared
• 16:15
  towards the product and not the organisation.
• 16:18
  And thirdly, the AI Act doesn't try to regulate the technology
• 16:25
  but rather regulates the application, the use of the
• 16:28
  technology. And that is far more future
• 16:30
  proof than trying to regulate technology.
• 16:33
  I think the only place places in the AI Act where technology this
• 16:38
  kind of creep in is the point where AI needs to be defined to
• 16:44
  give a scope that is sort of a technology definition by
• 16:47
  necessity. And the other point is, are some
• 16:52
  of the stipulations around general purpose AI.
• 16:56
  But generally the AI got these fundamental ways of construction
• 17:01
  right and the rest is just the result of political
• 17:04
  negotiations. And I think it's a fairly
• 17:06
  reasonable middle ground overall.
• 17:09
  But from an implementation perspective, zooming in on high
• 17:14
  risk requirements, articles 8 to 15, those requirements are
• 17:21
  relatively high level. So the AI might say if you use a
• 17:26
  system in a high risk scenario, then you have to make sure there
• 17:30
  is human oversight, you have to make sure there is record
• 17:34
  keeping, you have to make sure there is cybersecurity.
• 17:37
  But it doesn't really say what that means in practise.
• 17:41
  And this is not because legislators couldn't be bothered
• 17:47
  or they couldn't agree, but this is actually by design and has a
• 17:53
  tradition in Europe because we have a synergy between
• 17:57
  regulation on one hand and standards on the other hand.
• 18:02
  There is a set of rules called the new legislative framework
• 18:06
  that explains or describes how that synergy, how that
• 18:11
  collaboration works. It's a bit of a misnomer because
• 18:16
  new legislative framework, it's not new at all.
• 18:18
  It has been around for 40 years and has been used in quite a few
• 18:23
  different regulations and standards, but it is being used
• 18:29
  for AI as well. And it basically says, well, the
• 18:33
  AI Act provides high level requirements, high level
• 18:36
  objectives and standards describe a path towards meeting
• 18:45
  those requirements. I'm very carefully saying a
• 18:48
  path, not the path. So companies are perfectly
• 18:54
  entitled to ignore standards. They can say, well, we we
• 18:58
  interpret articles 8 to 15 our own way, but that means they
• 19:03
  have to prove that what they are doing is really in line with the
• 19:07
  AI Act. And ultimately it would fall to
• 19:11
  courts to or to to supervisory authorities to see whether they
• 19:16
  agree with a company's interpretation.
• 19:19
  So there's a lot of uncertainty and you have a situation similar
• 19:24
  to the GDPR where there is only the legal text and lots of
• 19:28
  interpretations are flying around.
• 19:30
  By contrast, if you choose to follow the standards, there is a
• 19:36
  so-called presumption of conformity.
• 19:39
  So the European Commission can officially accept such a
• 19:43
  standard. It's then called a harmonised
• 19:46
  standard and if you follow a harmonised standard you're
• 19:50
  automatically presumed to be in compliance with a relevant part
• 19:55
  of the AI Act. So it's really a way of
• 19:59
  resolving the ambiguities of the regulation itself and saying,
• 20:05
  well, I'll follow the standards instead.
• 20:09
  They are more detailed than the legal text and they give me the
• 20:14
  legal certainty. If I can show I follow the
• 20:16
  standards, I'm automatically deemed to be compliant as well.
• 20:20
  And that's a very, very big, I would say it's a very big
• 20:24
  success story, that synergy between regulation and
• 20:26
  standardisation and. Hence, standards in this case
• 20:32
  play a particularly important role and one of the hats I am
• 20:37
  wearing is I'm having the honour to chair the committee at Sen
• 20:42
  Senelec that has the mandate from the European Commission to
• 20:46
  create these harmonised standards.
• 20:48
  And you can imagine that because of the big interests that AI
• 20:55
  attracts and the broad spectrum of stakeholders, this is the
• 20:58
  biggest standardisation committee ever, probably also
• 21:03
  with a broader spectrum of interests.
• 21:06
  So it's a, it's a very interesting consensus building
• 21:10
  exercise because consensus is the principle in
• 21:13
  standardisation. That's where it draws its
• 21:15
  legitimacy from. And that's also the hardest bit
• 21:20
  of that work. It's certainly very hard to get
• 21:25
  consensus with multiple people, multiple experts, but you
• 21:29
  explained it really well. But I have a follow up question.
• 21:32
  So when you talk about this harmonised standards, would we
• 21:36
  have a harmonised standard per sector, per segment or per type
• 21:41
  of product? How would it work?
• 21:42
  Because they can't be just one-size-fits-all approach.
• 21:47
  While the AI act is horizontal, it is cross cutting across cross
• 21:52
  cutting across sectors, and so fundamentally the standards have
• 21:57
  to be horizontal as well. But you've really touched on one
• 22:01
  of the other really hard bits for certain aspects.
• 22:07
  It is pretty hard to start going into more detail without
• 22:13
  becoming sector specific. So this is actually one of the
• 22:19
  trickier bits of the technical work to provide more detail than
• 22:24
  the AI Act and still remain horizontal across sectors.
• 22:28
  We do have a discussion or or several discussions in the
• 22:32
  committee sense and like JTC 21 on what are the contact points
• 22:39
  between the AI Act standards and the sectorial standards.
• 22:45
  There are certain sectors like automotive and aviation that are
• 22:51
  their own worlds standard wise and they've already created
• 22:54
  various standards around AI that they're quite far ahead in some
• 22:57
  cases. And we do have quite a few
• 23:01
  discussions on, well, how do we shape the contact points or the
• 23:05
  interfaces with the horizontal standards and the sectorial
• 23:09
  standards. That makes sense.
• 23:12
  So the world is shifting and the world is already challenging.
• 23:18
  Now, I know it's crazy to ask, but I still, if you allow me ask
• 23:26
  that question, say how do you see this going forward?
• 23:29
  Because I know you run this digital trust convention, which
• 23:33
  happened a couple of times if I remember well, and it's planned
• 23:37
  or going to happen this year, next year or every year from now
• 23:40
  on. That would be the vision.
• 23:42
  But. What are the experts like you
• 23:44
  saying in terms of the future of digital?
• 23:48
  I would say because one thing is for sure, future would be data,
• 23:51
  future would be digital, future would be AI.
• 23:53
  But how do we see this? Because when GDPR came, they
• 23:57
  said it's a strong regulation, it's future proof.
• 24:03
  Now we have the EUI Act and then of course they're both sides and
• 24:08
  both are equally correct, but and now we will have standards
• 24:12
  and of course we will have new laws, the digital laws.
• 24:15
  But how do you see, broadly speaking, if we have to look
• 24:19
  into the future, what would it look like?
• 24:24
  I would kick off by saying that the future, and in particular
• 24:29
  the future of the digital environment is not something
• 24:33
  that happens to us. It's something that we shape and
• 24:37
  we need to have the courage to shape it through policy, through
• 24:45
  technology, through societal consensus, through ideas.
• 24:52
  So that's, that's really my starting point.
• 24:56
  The digital space becomes what we make it become.
• 25:02
  And so the digital trust convention that that you
• 25:04
  mentioned is a reflection of that fundamental stance.
• 25:12
  To me, it's not enough to say, well, we have a flood of AI
• 25:17
  fabrications now and we have a trust problem.
• 25:21
  So let's just do a bit more fact checking and let's do a bit more
• 25:24
  media literacy and let's let's maybe introduce some regulation
• 25:27
  here or some fund a certain kind of start up there.
• 25:32
  Those are really patchy solutions that are not an
• 25:38
  adequate reaction to this, as you rightly say, this really
• 25:42
  fundamental shift in the digital space.
• 25:45
  And it's also not enough to just be shocked every day by what is
• 25:53
  happening, monopolies emerging and social media turning into
• 25:58
  kind of a cesspit of polarisation and so on and so
• 26:01
  forth. Yes, we can be shocked about
• 26:04
  that and be annoyed but and and kind of rail against it and say,
• 26:09
  oh, this shouldn't be happening. But that's not enough.
• 26:14
  We're not going to be able to somehow wish away or regulate
• 26:19
  away those negative directions that we are observing unless we
• 26:27
  can propose a better alternative.
• 26:31
  So to me, if we say, well, we don't like where the digital
• 26:36
  space is going and has been going for the past few years, we
• 26:41
  have to propose a better alternative.
• 26:44
  So we have to create a vision. Well, what do we think could and
• 26:51
  should the digital space look like maybe 10-15 years from now?
• 26:56
  And that is something for a discussion that requires
• 27:02
  bringing together a pretty broad spectrum of people.
• 27:06
  So you need Internet Protocol people, you need cybersecurity
• 27:09
  people, you need psychologists, you need media, you need policy
• 27:16
  makers, you obviously need AI experts, and so on and so forth.
• 27:20
  And all these communities need to come together.
• 27:23
  And the space for them to come together didn't exist.
• 27:27
  And that's why I created the Digital Trust Convention.
• 27:32
  And very thankfully the OECD and a number of other organisations
• 27:36
  joined in the effort. The OECD hosted the initial
• 27:40
  event, The next one will be hosted by Mila in Montreal.
• 27:46
  So that we can build this better alternative and mobilise people,
• 27:53
  mobilise policy makers, but also mobilise broader sections of
• 27:58
  society by saying look, we don't like where this is going right
• 28:02
  now. Here is a credible and an
• 28:05
  attractive and a possible alternative.
• 28:11
  And if that sounds too ambitious, I don't think it is
• 28:14
  too ambitious because we have been there before.
• 28:18
  We have been in a situation before where we needed to, let's
• 28:23
  say, upgrade the digital space. If we think back 1020 years, we
• 28:29
  started having those problems with man in the middle attacks,
• 28:33
  websites being spoofed, organisations being spoofed, and
• 28:37
  the whole notion that you could do something in the digital
• 28:41
  environment that had a financial or legal implication where that
• 28:46
  that was, was kind of really with high stakes started to
• 28:51
  grind to a halt because we had a trust problem even then at the
• 28:56
  time. But at the time it was kind of
• 28:59
  trust that I'm dealing with, the organisation that I think I'm
• 29:02
  dealing with. And so people knuckled down,
• 29:05
  they created the SSL protocol, they created TLS as a successor,
• 29:11
  people who created certificate authorities as a whole, new
• 29:15
  infrastructure of entities to overcome this trust problem.
• 29:22
  Websites gradually migrated from being connected to via HTTP to
• 29:28
  HTTPS. We saw the same in e-mail
• 29:31
  protocols in many other areas. And so 1015 years ago, we have
• 29:36
  that massive upgrade, that transition of the digital space
• 29:41
  that made it possible to trust organisations, to trust that
• 29:46
  you're dealing with the organisation that you think
• 29:48
  you're dealing with. Now we need the next big upgrade
• 29:53
  that is about trust between individuals.
• 29:57
  So can I, to what extent can I trust that I'm dealing with a
• 30:01
  real person? To what extent can I, or do I
• 30:05
  want to trust in what they're telling me, either on their own
• 30:10
  accord or shared from elsewhere? And this new upgrade is not only
• 30:18
  about trust, about enabling trust between individuals, it
• 30:23
  also has to be about identity. And I was really happy when you
• 30:30
  contacted me about this podcast because one of the key
• 30:34
  challenges that we need to address or where we need to
• 30:36
  propose a globally viable solution is how can we talk
• 30:41
  about trust? It forces us to talk about
• 30:44
  identity because without identity, there is no trust, no
• 30:49
  track record, hence no trust. But how can we talk about
• 30:54
  identity without giving up privacy?
• 30:57
  Because it is true to say that if we force everyone to go
• 31:02
  online with their real names, we solve quite a few problems.
• 31:07
  We solve the whole bot problem. We solve the problem of people
• 31:12
  multiplying their voice and pretending to be a crowd of 100
• 31:17
  or 1000 people with the same opinion about politics or about
• 31:21
  a product or something like that.
• 31:23
  But that's not the route we want to take.
• 31:26
  At least in the countries that that we're moving in, that's not
• 31:31
  the route we want to take. And so we need to have as a
• 31:36
  cornerstone of that 1015 year vision, how do we have privacy
• 31:42
  protecting pseudonymous identities.
• 31:45
  The requirement is actually not that onerous.
• 31:49
  And there are even technical solutions around, there's even a
• 31:51
  standard around. So all we need from these
• 31:55
  identities is that they are not traceable to a real person.
• 31:59
  We we want to be sure that they do belong to a real person, but
• 32:02
  we do not want to be able to trace back to a real person.
• 32:06
  That's the first requirement. And the second requirement is we
• 32:09
  want to be sure that these special kinds of identities can
• 32:16
  only exist in a singular fashion.
• 32:17
  So per platform, per context, per forum, you want to make sure
• 32:23
  that a physical person can only have one such identity, or maybe
• 32:28
  two or three, but at least a very small number, another
• 32:32
  identity in another forum, in another context.
• 32:35
  You don't want that universal pseudonym because it'll kind of
• 32:38
  break after a short while. But within a given platform, it
• 32:43
  needs to be singular, almost singular.
• 32:46
  And there is even part of the existing European identity
• 32:50
  standard, the IAIDA standard, that describes a way of doing
• 32:55
  that. It's even implemented in the
• 32:59
  functionality of German ID cards, so you can kind of
• 33:03
  interrogate them. They can calculate pseudonym
• 33:06
  tokens on the fly that satisfy all these constraints that mean
• 33:09
  you never have a master table anywhere, you don't have to
• 33:12
  trust anyone in between and so on and so forth.
• 33:14
  So it's kind of it's, it's not like we need massive technology
• 33:19
  breakthroughs. It's more a case of, well, if we
• 33:23
  think about the digital space with a 1015 years perspective,
• 33:27
  how would you want to want to handle trust between people and
• 33:31
  how do we roll out existing possibilities for privacy
• 33:36
  protecting identities, who can serve as the trust anchors for
• 33:40
  these identities? And to me, the those are some of
• 33:45
  the building blocks that are emerging.
• 33:49
  So that's also what makes me relatively optimistic that it
• 33:54
  can be done. It has been done before.
• 33:56
  We see the technology, the community is coming together.
• 33:59
  I mean, even at the 1st round of the Digital Trust Convention,
• 34:04
  150 people came and more joined online.
• 34:08
  And so I'm optimistic it can be done if we have the right level
• 34:14
  of ambition and courage to actually do it.
• 34:18
  Yeah, I think that's very well said.
• 34:22
  We are shaping the digital future and we will shape it in
• 34:26
  the right direction because if you look at last 10,000 years,
• 34:30
  there have been many events. Of course, we say this is unlike
• 34:34
  any other event, but all the revolutions, evolutions that
• 34:38
  have happened, we've survived and we've come up to see through
• 34:43
  that. And I'm sure we will see through
• 34:44
  this also. But you mentioned about the
• 34:47
  identity, and that is kind of a nice segue into what about your
• 34:52
  identity Would you like to share with the world who you are, what
• 34:56
  you do, what identities you have and how can people talk to you?
• 35:04
  Yeah, I, I, I do. I do wear a number of hats, so
• 35:09
  we've touched on some of them already sharing European AI
• 35:12
  standardisation. I'm also chairing some of the
• 35:15
  expert work at the OCD. I'm the founder of the Digital
• 35:20
  Trust Convention. But the one hat that we haven't
• 35:23
  touched on yet is I'm Chief Trust Officer for Rosario.
• 35:28
  Rosaro is a relatively new company that started in
• 35:33
  Singapore and is now also operating in Europe.
• 35:38
  And this is a company that was created realising that
• 35:44
  compliance in AI is not everything.
• 35:47
  Once you have a mature regulatory environment, you can
• 35:54
  assume that the products on the market will be compliant, or at
• 35:58
  least should be complied. But that doesn't tell you
• 36:03
  whether one product is better for your purposes than another
• 36:08
  product. It also doesn't tell you whether
• 36:12
  a product that you either find on the market or that you had
• 36:15
  developed internally is good enough for a given purpose.
• 36:21
  To put it in more concrete terms, suppose you want to use
• 36:28
  AI as a customer service tool and want to set up a customer
• 36:32
  service chat bot. If you're lucky enough to have
• 36:35
  an internal AI development team, they they will be able to build
• 36:39
  a chat bot relatively quickly. But then you're faced with a
• 36:43
  question. Well, when is this chat bot good
• 36:46
  enough to roll out? You don't want to roll it out
• 36:51
  too quickly because then you might have business damage,
• 36:54
  reputation damage, other problems.
• 36:57
  You also don't want to over test it because then you're wasting
• 37:01
  the time. If you're test engineers, you're
• 37:03
  too late to market. So where is that sweet spot
• 37:07
  where that chatbot is good enough?
• 37:09
  And what does good enough even mean and how can you have a
• 37:12
  conversation about that That works for the business people
• 37:17
  and organisation, that works for the governance people, and that
• 37:20
  also works for the engineer. So how do you create that shared
• 37:24
  language for these three stakeholder groups?
• 37:28
  And we, we in Rosaro, we basically built the whole chain.
• 37:32
  So we create the metrics, the quality metrics to measure
• 37:35
  quality at multiple levels so that business governance and
• 37:40
  technical teams can have that conversation covering two dozen
• 37:46
  indicators of quality in five levels.
• 37:48
  And for a given situation, you can set those levels and define
• 37:54
  that as good enough or use that to compare multiple products
• 37:58
  that you might evaluate to choose which one to buy as your
• 38:03
  chatbot. And touching on the point you
• 38:07
  made earlier about the sector specificity, if we talk about
• 38:13
  what is good enough, then we have to go into sectors.
• 38:18
  In fact, we have to go even a little bit deeper.
• 38:21
  We have to go into groups of use cases.
• 38:26
  Some of those groups of use cases can be quite wide and even
• 38:30
  cut across sectors. So if we talk about customer
• 38:33
  service chatbot, it doesn't matter whether it's insurance or
• 38:36
  banking or energy or telecoms or wherever.
• 38:40
  It also doesn't matter whether it's external facing or whether
• 38:45
  it's maybe just for employee use or for field engineer use or
• 38:49
  whatever else. You can kind of tweak the
• 38:51
  quality levels to fit all these different scenarios and use the
• 38:57
  same quality index. But if you then go to, for
• 39:01
  example, face recognition in a street scenario, kind of in an
• 39:06
  open world St scenario, you need a different set of quality
• 39:10
  indicators. Again, you could end up with a
• 39:14
  dozen, two dozen indicators that determine what, what do you want
• 39:20
  to measure about the quality of face recognition in public
• 39:25
  spaces system? And you can use the same kind of
• 39:29
  overall shape of a quality index, but the content will be
• 39:33
  very different. Then we have another, we, we
• 39:37
  actually have a quality index for defect detectors.
• 39:40
  So how good are defect detectors?
• 39:42
  How can you compare them? How do you build all the test
• 39:46
  packages underneath based on synthetic data?
• 39:49
  We kind of create our own sets of deepfakes to make sure that
• 39:52
  the detectors have never seen them before and so on.
• 39:56
  And you can do a quality indicators for action
• 40:00
  recognition in videos and so on. So I think we we, we have a
• 40:05
  pretty endless stream of opportunities.
• 40:10
  For saying, well, we are capable of describing what quality is,
• 40:16
  what good enough is. And we also have the capability
• 40:21
  to map that to actual technical tests, mostly automated
• 40:26
  technical tests based on all these low level benchmarks that
• 40:29
  are kicking around. And yeah, that's in a slightly
• 40:33
  enlarged nutshell is what we do at Rosaro.
• 40:36
  And as I said, I'm Chief Trust Officer there, which gives me
• 40:41
  the opportunity to contribute to the overall direction and also
• 40:47
  to the positioning and to that notion of, well, what is
• 40:52
  actually needed. We don't need more hype.
• 40:54
  We don't need more bubble. That's enough going in that
• 40:58
  direction. But we need that view from the
• 41:02
  sidelines to help companies that want to use AI in picking what
• 41:09
  is right for them and generating the evidence for them to take
• 41:14
  the decision rather than having to rely on on marketing claims
• 41:18
  that. Makes perfect sense.
• 41:22
  And if somebody wants to tap into this wisdom, the knowledge
• 41:26
  that you have and wants to contact you maybe for a speaking
• 41:29
  engagement or whatever, what would that be?
• 41:33
  How can they get in touch with you then?
• 41:36
  The easiest might be through LinkedIn, so I'm very happy to
• 41:40
  be contacted on LinkedIn. I'm lucky that my name only
• 41:45
  exists once on LinkedIn, at least so far.
• 41:48
  Alternatively, you can always send an e-mail to
• 41:52
  sebastian@highlandsleeping.org so first name at lastname.org or
• 41:57
  go through Rosaro. If it's more on a commercial
• 42:00
  side, there are many channels to get hold of me.
• 42:04
  Sure. So it was wonderful to have your
• 42:07
  wisdom, your knowledge. I know one hour of 45 minutes or
• 42:11
  40 minutes is not enough to capture that.
• 42:13
  But thank you so much for your time and sharing your wisdom,
• 42:17
  sharing your insights. It was wonderful to have you.
• 42:21
  Thank you for having me. And as I said earlier, I'm
• 42:26
  really impressed by you keeping up the podcast series for so
• 42:29
  many years. That is rare and good good luck
• 42:33
  for the continuation for many more years.
• 42:37
  Thank you so much, Sebastian. Thank you for joining us on the
• 42:41
  Fit for Privacy podcast. We hope you found today's
• 42:44
  conversation valuable and thought provoking.
• 42:46
  Subscribe for more insights like this.
• 42:48
  If you enjoyed this episode, we'd appreciate that you'd share
• 42:51
  it and write us a review. For consulting, visit
• 42:54
  www.fitforprivacy.com. For certifications and training
• 42:59
  on ISO standards, visit www.growskills.store.
• 43:04
  You can also contact us for bespoke training for your staff
• 43:06
  and management. Until next time, stay safe, stay
• 43:10
  compliant, and grow your skills.