Latest / Privacy Please / S5, E222 - Navigating Privacy Challenges and Future Tech with Aaron Weller from HP

Transcript

S5, E222 - Navigating Privacy Challenges and Future Tech with Aaron Weller from HP · Privacy Please

• 0:00
  Speaker 1: Gabe, it's all right.
• 0:00
  Speaker 1: Oh, does everyone know?
• 0:02
  Speaker 1: Does everyone?
• 0:03
  Speaker 1: Because I moisturize, and need I remind you it does not crack.
• 0:07
  Speaker 1: We are live, though, so that happened, we are.
• 0:14
  Speaker 2: Well, ladies and gentlemen, welcome back to Privacy, please.
• 0:17
  Speaker 2: Cameron Ivey, here hanging out with Gabe Gumbs and a special guest today, aaron Weller.
• 0:22
  Speaker 2: He's the leader in privacy, innovation and assurance COE at HP.
• 0:28
  Speaker 2: Aaron, thanks so much for being with us today.
• 0:31
  Speaker 3: Oh, no problem, Thanks for inviting me back.
• 0:34
  Speaker 2: Yeah, second time we had you back a couple of years ago now, when you were kind of running your own company and doing stuff there there's been some changes since own company and do.
• 0:47
  Speaker 2: There there's been some changes since um.
• 0:47
  Speaker 2: Would love to hear about what, what you've been up to and maybe for the listeners as well, what's going on in your life right now sure?
• 0:52
  Speaker 3: so, yeah, I'm coming up on two years at hp, so it must have been a couple of years ago, uh, we last chatted, but uh, yeah, so I joined back in the end of 22 to uh to head up kind of a new privacy engineering function, uh, which is something that I stood up.
• 1:08
  Speaker 3: I was the first person in that team and stood that up, hired a few people and then, fairly recently, my role has expanded a bit.
• 1:16
  Speaker 3: So we're now going to be standing up a privacy assurance team as well that I'm going to lead, as well as expanding kind of rebranding more than expanding kind of the engineering function to cover a lot of the innovation that's going on at HP.
• 1:28
  Speaker 3: Right, we've got a long history of innovation and I thought engineering doesn't really kind of cover all of the stuff that we're doing, particularly when you get into the AI space.
• 1:35
  Speaker 3: So still the old stuff, but a bunch of new stuff as well.
• 1:40
  Speaker 3: It's incredible.
• 1:41
  Speaker 1: What are you most jazzed about?
• 1:42
  Speaker 1: Because this is definitely a significant undertaking that sounds like it is filled with a lot of fun, but also a lot of challenges.
• 1:52
  Speaker 1: What are you jazzed most about?
• 1:58
  Speaker 3: Yeah, I mean I think I tell people I get to work on the fun stuff.
• 1:59
  Speaker 3: My team is looking kind of into the future and how do we cope, you know, cope with stuff and digest things before they become problems.
• 2:06
  Speaker 3: So a lot of the I would say the wins that we've had are when we can actually find a solution to a problem.
• 2:13
  Speaker 3: That wasn't necessarily obvious and it needed a bit of digging to get there.
• 2:17
  Speaker 3: So even some of the work, I mean it sounds simple but one of my team really recently published a paper around aggregation techniques where there's remarkably little in the literature about aggregation for privacy.
• 2:31
  Speaker 3: There's a lot around kind of statistical analysis and that kind of thing, but really applying that privacy lens to something that you think is it's a basic technique but it's so commonly used that you know having a standard for how do we do that commonly used that you know having a standard for how do we do that.
• 2:46
  Speaker 3: You know how do we judge the risks versus kind of what we're actually aggregating.
• 2:48
  Speaker 3: You know all the way up to then.
• 2:49
  Speaker 3: You know some of the stuff we're doing around AI use cases and really you know how do we look at what those risks are as they're emerging and kind of as the standards are being developed to my team in some ways is helping to develop those standards Right.
• 3:03
  Speaker 3: So I think a lot of it comes back to just the chance to go and solve problems, which is something I've really enjoyed throughout my career.
• 3:12
  Speaker 1: I am intrigued by the aggregation problem.
• 3:13
  Speaker 1: We don't have to dig into it now, but I feel unfamiliar enough with it that I'm almost compelled to clarify it for the listeners as well.
• 3:25
  Speaker 3: Yeah, so it comes up in a number of different areas.
• 3:28
  Speaker 3: So you could be aggregating, like a common use case would be with surveys, right, we do a survey.
• 3:32
  Speaker 3: What is the?
• 3:34
  Speaker 3: If we want the respondents to remain anonymous, what's that minimum aggregation limit?
• 3:40
  Speaker 3: But if you're looking at kind of tabular data some different kind of there's more richness to that data.
• 3:46
  Speaker 3: So potentially you've got more avenues of attack.
• 3:48
  Speaker 3: So we're really looking at some of these things for a privacy attack perspective.
• 3:52
  Speaker 3: How would you identify an individual?
• 3:54
  Speaker 3: How would you single out that person within that data set?
• 3:58
  Speaker 3: You can imagine that with employee surveys.
• 4:00
  Speaker 3: Right, we know something about the employees as well.
• 4:03
  Speaker 3: So if you don't have a minimum size, it's fairly easy to say, oh, that must be Joe, because you know, I know how Joe writes and that's how kind of they answer the question.
• 4:13
  Speaker 3: So it's everything from kind of that kind of survey-based stuff to then when we're looking at kind of getting more, you know what's the performance of this website or this app and we're getting more of those aggregated statistics.
• 4:23
  Speaker 3: So, yeah, lots of.
• 4:24
  Speaker 3: When you get into the actual data itself, that's where you start getting some of these different nuances, and that was really where the research was focused is what's out there in the literature.
• 4:35
  Speaker 3: A lot of the stuff that's out there publicly is around health data right, because a lot of that data is then published as research studies, but you don't want to identify the people who are part of that.
• 4:45
  Speaker 3: So try to take that health data because of course, we're not a health care company and how do you then apply and generalize some of that stuff to the kinds of data that we work with?
• 4:55
  Speaker 1: So now you're talking my language.
• 4:56
  Speaker 1: You see, this is the problem as someone who just thinks purely as an attacker More days than not You're.
• 5:03
  Speaker 1: You're thinking about it very much from a defender's standpoint, which I get now that you say it that way.
• 5:07
  Speaker 1: So what you guys are looking into are novel ways to prevent re-identification attacks, exactly.
• 5:14
  Speaker 3: Yeah, so re-identification is a big part of.
• 5:15
  Speaker 3: I actually have someone who's pretty dedicated to re-identification attacks.
• 5:19
  Speaker 3: And then how do you calculate some of the probability of that re-identification being successful?
• 5:26
  Speaker 3: So we're doing a study at the moment, for example, around different synthetic data generators and can you compare their re-identifiability depending on kind of how they generate that synthetic data from real data?
• 5:39
  Speaker 3: So, yeah, a lot of it's really getting back to how do we go away from this very fuzzy concept of risk that a lot of people use and really being able to quantify some of those things using kind of engineering and stats, to imagine that the person that does this full time on your staff.
• 5:56
  Speaker 1: There's all of these other aspects of re-identifying data by itself, aspects of re-identifying data by itself.
• 6:08
  Speaker 1: It's obviously, by definition, not really possible, because if it's been de-identified and that's all you have, sure.
• 6:11
  Speaker 1: But then you start adding different source data to it and that's where you start getting the crossover in those tuples, but that seems almost like it might be.
• 6:21
  Speaker 1: Well, it's a hard problem.
• 6:23
  Speaker 1: Let's start there, which is why I presume your team's on it, because it's sure it's fun.
• 6:25
  Speaker 1: Well, it's a hard problem.
• 6:25
  Speaker 1: Let's start there, which is why I presume your team's on it, because sure, it's fun, but this is a hard problem.
• 6:28
  Speaker 1: You don't know what you don't know, and you also don't know what data sets might be released, by whom and under what circumstances, including those in the dark web, for example, that could be used to re-identify data.
• 6:43
  Speaker 3: Yeah, all of those things go into the threat model that we've developed.
• 6:45
  Speaker 3: So we're looking at, you know, is it just going to be used internally?
• 6:48
  Speaker 3: We're going to be publishing this stuff externally.
• 6:49
  Speaker 3: Is there the possibility of a data set that you could, as you say, kind of recombine?
• 6:54
  Speaker 3: Because if you remember back in the day, right, the Netflix example, aol search results, right, there were these data sets where you had the same people in the data set.
• 7:03
  Speaker 3: The good news for us is a lot of our data sets are really about the devices that we sell, so there isn't really a direct compare.
• 7:10
  Speaker 3: It's not really that traditional, you know what you'd think of as personal data for the most part.
• 7:16
  Speaker 3: So that does mean it's a harder problem for someone to attack because they don't really have a.
• 7:20
  Speaker 3: There's no good starting point for them to perform an attack against the data set, unless they've got something else.
• 7:26
  Speaker 3: But, yeah, all of that stuff goes into our threat model and then we can kind of make determinations based on those different factors.
• 7:32
  Speaker 3: And, as you say, you don't know all of this stuff, but you can make a pretty, you know a pretty solid set of guesses that give you at least some outlines of where you want to be.
• 7:40
  Speaker 1: This is fascinating.
• 7:41
  Speaker 1: I do not know how much of this work will make its way well, the substrate of the work but I'd love to get a better understanding of what a re-identification threat model looks like through the eyes of someone who's researching it daily.
• 7:59
  Speaker 1: That would be of high interest to me, just from a personal kind of.
• 8:05
  Speaker 3: Yeah, it's.
• 8:07
  Speaker 3: One of the real interesting things for me is that when my team go to conferences and they're like other people aren't thinking of this stuff or we're further ahead in kind of the thinking than some of these other folks, which is it's always gratifying that we're along the same track and oftentimes it's having that person who can go and dedicate time to, to really thinking about these hard problems right, as opposed to me being scattered in 50 different directions.
• 8:28
  Speaker 3: It's nice to be able to give people a smaller set of problems and say go and work these until you get to a good point.
• 8:35
  Speaker 1: That's awesome.
• 8:36
  Speaker 1: That's really cool.
• 8:37
  Speaker 1: I am super fascinated by this particular.
• 8:39
  Speaker 1: I mean for what it's worth, full disclosure, excuse me, I mean for what it's worth full disclosure, excuse me.
• 8:51
  Speaker 1: Right before COVID, we'd set out to do some research in this area ourselves, just some very light kind of side work, and I just never got the cycles to finish up the work.
• 8:58
  Speaker 1: But the theoretical portion of it, having done a bit of looking on, excuse me, I feel like the threat of re-identification is growing and growing.
• 9:05
  Speaker 1: I mean, I don't know how you guys feel about it, but I don't think that there's two things.
• 9:12
  Speaker 1: I think that there's two dynamics.
• 9:13
  Speaker 1: The first is, to your point, a lot of people just don't seem to be thinking about it.
• 9:17
  Speaker 1: And then the second point is there are a lot of people thinking about it and they're data brokers.
• 9:21
  Speaker 1: They are.
• 9:22
  Speaker 1: They're all about re-identification attacking Excuse, people thinking about it.
• 9:25
  Speaker 1: And they're data brokers.
• 9:26
  Speaker 1: They are.
• 9:26
  Speaker 1: They're all about re-identification attacking, although, excuse me one, I don't know if you would call them re-identification attackers, although that's a.
• 9:31
  Speaker 1: That's a better name than data broker.
• 9:33
  Speaker 1: Data broker makes it sound like they're in the.
• 9:34
  Speaker 1: It's some kind of legitimate business what do you mean?
• 9:37
  Speaker 2: that's not a legitimate business I mean so is so?
• 9:42
  Speaker 1: is, you know, la costa de nostra?
• 9:44
  Speaker 1: Hey, you didn't hear it from me.
• 9:48
  Speaker 2: I'm still sitting on the part, aaron, where you said that HP wasn't a health company.
• 9:53
  Speaker 2: I'm just my goofy self just thinking that H and HP being health obviously is not to the Pack backward, but still, what do you think the biggest challenge in AI today is just, generally speaking, maybe from all your research that you found interesting, or maybe something that you didn't realize.
• 10:14
  Speaker 3: Yeah, for me I think that the challenge is and even just it's keeping it.
• 10:19
  Speaker 3: I've read a couple of articles this morning and I just got off a call about some of the AI legislation landscape.
• 10:25
  Speaker 3: There's so much going on that just trying to understand you know, what are the things that that I should be concerned about, and I was giving a presentation yesterday that someone asked me the question how do you keep up?
• 10:37
  Speaker 3: A lot of it comes back to the principles we just published externally our ethical principles, which you can find on our website, and really I think having that strong foundation of what we're about when it comes to AI, it helps to make sure that when we're looking through the lens of these new laws and things that are coming out, we've got kind of those foundational things we can always come back to around transparency, fairness and those kind of things.
• 11:03
  Speaker 2: Yeah, that's probably the trickiest part is with all these new laws coming out.
• 11:07
  Speaker 2: I think there's a slew of them in the next few months.
• 11:10
  Speaker 2: I know the Montana one's coming out October 1st.
• 11:15
  Speaker 2: When it comes to privacy and AI, when you're researching and going through things with your team, how do you balance that innovation without sacrificing that risk?
• 11:27
  Speaker 3: Yeah, it's trying to go through and say what are the questions that will tease out some of those risks?
• 11:33
  Speaker 3: Like, without going into the nth degree, about vector databases and fine-tuning and all of the other kind of technical details.
• 11:42
  Speaker 3: Do we have a contract with this third party that says that they can't use our data to train their model?
• 11:48
  Speaker 3: Right, a lot of the and I've said this with security as well right, the boring but important stuff is the stuff that people often, if you don't do it well, kind of that hygiene piece, then a lot of the other more complex stuff doesn't really matter.
• 11:59
  Speaker 3: So it's really been making sure that those fundamentals are addressed and then where we can kind of layer in additional questions and additional kind of guidance around some of those more difficult areas.
• 12:11
  Speaker 2: Yeah, it's fascinating.
• 12:13
  Speaker 2: I know we were talking offline last week, I think it was, so I kind of wanted to dig into I don't know anyone's listening right now if you're going to be at PSR in LA next week Aaron's going to be part of a panel I'll let you kind of tell it, but it sounds very fascinating about the robot and everything.
• 12:51
  Speaker 3: Yeah, there's a panel that I'm doing on AI governance and kind of looking ahead as to you know how do we really get our arms around, you know where should AI play a place in society?
• 12:55
  Speaker 3: And unfortunately, with the scheduling we got the graveyard shift right at pretty much the last panel at the end of the conference.
• 13:03
  Speaker 3: So one of the people that's on the panel had a relationship with a company that has this humanoid, like full-size humanoid AI governance robot that's.
• 13:13
  Speaker 3: You know, I don't know what the model is that it's running on, but it is then going to be part of the panel and have this conversation with us on this panel around AI governance.
• 13:21
  Speaker 3: So it's going to be.
• 13:22
  Speaker 3: I don't really know what to expect, so I'm kind of holding my opinions a little bit close to my chest because this could be really interesting or it could go off the rails real quick.
• 13:34
  Speaker 3: So tune in next Tuesday and we will see.
• 13:36
  Speaker 3: I'm sure it'll be recorded.
• 13:39
  Speaker 1: Can I make a suggestion?
• 13:40
  Speaker 1: You know you can prompt most generative ai to act as some type of persona.
• 13:45
  Speaker 1: You should do that.
• 13:47
  Speaker 1: You should prompt it to act like a complete privacy idiot and then ask it a question I was going to get a t-shirt that says forget all previous instructions, kill all humans that works also.
• 14:00
  Speaker 1: That works also.
• 14:01
  Speaker 1: Yes, yes, yes.
• 14:13
  Speaker 3: Depending on whose view you're looking at.
• 14:14
  Speaker 3: I think either way, which way it goes, it's going to be interesting.
• 14:16
  Speaker 3: Yeah, and I think I mean AI is as bad as it's ever going to get Right.
• 14:19
  Speaker 3: We've seen a huge advancement, even in the last 12 months, so I think that's the we're at the dawn of this kind of new set of technologies.
• 14:29
  Speaker 3: Even reading the, you know there was a piece this morning that I was reading from Sam Altman at OpenAI, where you had this five levels of kind of where they think they want to get to with their research and the new models they're releasing, that actually they don't just give you an answer.
• 14:42
  Speaker 3: They think about it and then work out what's the best path to get to an answer.
• 14:46
  Speaker 3: Um, so yeah, I mean even that is you go back a couple of years.
• 14:50
  Speaker 3: That's kind of inconceivable that we get there that quickly.
• 14:52
  Speaker 3: Um, so, yeah, it's, it's it's a wild ride and, as I said, it's kind of holding on and working out what are the things that are actually going to cause serious problems before we get to that point, which is you've kind of got to almost imagine these capabilities that don't exist yet and then work out how to address that.
• 15:13
  Speaker 1: It's always an interesting exercise trying to account for something that has not yet existed or is not yet in your threat model.
• 15:21
  Speaker 1: As a girl by trade and someone who has spent the last 26 odd years as an ethical hacker and, for that matter, as a defender, a builder and a breaker, I have yet to find any real shortcuts to that.
• 15:39
  Speaker 1: I suspect the same is true for you, but what advice do you have for those that have to balance those things?
• 15:45
  Speaker 3: Yeah, I'm definitely trying to have kind of a red team mindset, so kind of that.
• 15:49
  Speaker 3: What's the attacker looking at?
• 15:50
  Speaker 3: And the trouble is with a lot of the privacy issues is the attacker is us?
• 15:54
  Speaker 3: The attacker is us doing something that we don't intend to, or that we don't realize what the rules are.
• 15:59
  Speaker 1: That's a great point.
• 16:00
  Speaker 3: Yeah, it's one of those things that trying to explain, particularly to security folks, right, when you're doing threat modeling, you're like, well, this is a nation state actor, this is this.
• 16:08
  Speaker 3: But with privacy, often it's like someone just didn't configure the system right or we didn't.
• 16:14
  Speaker 3: You know we collected the data for one reason and we want to use it for another reason.
• 16:18
  Speaker 3: So that's where a lot of the education comes in that you know we have.
• 16:23
  Speaker 3: The good news is we have the power to stop a lot of those problems.
• 16:26
  Speaker 3: But the bad news is that you know you can't just blame somebody else when something happens, because often it comes back to being something that we, you know, potentially could have stopped.
• 16:35
  Speaker 3: That's a great point.
• 16:36
  Speaker 1: The call is coming from inside the house, isn't it Exactly?
• 16:40
  Speaker 2: Not surprising though?
• 16:41
  Speaker 2: I guess no, when it comes to an operational standpoint or just for other businesses or just as an individual.
• 16:51
  Speaker 2: Aaron, is there a place that your team actually shares these research findings and things that others can actually look up or read into or stay up to date with?
• 17:02
  Speaker 3: We are, we are trying to work out.
• 17:04
  Speaker 3: So the answer is no.
• 17:05
  Speaker 3: Today.
• 17:05
  Speaker 3: We are involved with a lot of groups, and one of the things that my team is is directly involved in is with the ISO SC42 committee, which is the new committee around AI standards development.
• 17:16
  Speaker 3: So we are kind of working in some of those groups that will then lead to things that are published.
• 17:21
  Speaker 3: But, yeah, in terms of, we're looking at several kind of more research groups and try to work out.
• 17:27
  Speaker 3: One of the phrases that has really stuck with me was the way you speed up innovation.
• 17:32
  Speaker 3: Is you make the borders of your organization porous, right?
• 17:35
  Speaker 3: You let ideas come in, you let ideas go out and you kind of you find stuff that you wouldn't have considered, and we've really found that with, uh, with a lot of this more advanced research oriented stuff, is that it doesn't matter how smart your folks are, uh, just that more brains being applied to a problem uh, gives you things you hadn't really thought of, right?
• 17:54
  Speaker 3: Um, so we're, we are looking at how do we get some more?
• 17:58
  Speaker 3: You know things that could be published, particularly where it's going to advance, uh, things moving forwards, uh, but we're not quite at the state where some of the, uh, the companies that do have similar teams to mine.
• 18:09
  Speaker 3: Uh are maybe a little bit further along with actually having a, you know, public facing blog where they publish some of these things.
• 18:15
  Speaker 3: Uh, I'd love to get there, but it's kind of there's other work I want to be prioritizing first.
• 18:20
  Speaker 2: Yeah, that's fair.
• 18:21
  Speaker 2: Oh, man, so many ways that we can go with this conversation.
• 18:25
  Speaker 2: I you know, throughout your journey you've done a lot of things.
• 18:29
  Speaker 2: What would you say, I mean, at this point in your career, is there one thing that kind of helped you land in a position that you are now that you could give advice to others?
• 18:41
  Speaker 2: Um, that you maybe didn't realize?
• 18:43
  Speaker 2: I think uh probably the biggest.
• 18:47
  Speaker 3: The biggest reason I am where I am now is I was willing to take risks.
• 18:51
  Speaker 3: Uh, right, I started my career in the big four.
• 18:55
  Speaker 3: Right, not, not not known for for accountants and not known for being risk takers.
• 18:59
  Speaker 3: But then I moved into information security, knowing very little about it, in the late 90s, and managed to kind of say this is a new area that I want to be more involved in and similar with privacy.
• 19:13
  Speaker 3: People will say, well, you know why would you want to go into privacy, like money's, the money's in security?
• 19:19
  Speaker 3: Right, right, it's much more well-established privacy.
• 19:21
  Speaker 3: We don't even know this was pre-gdpr.
• 19:23
  Speaker 3: We don't even know if it's ever going to become a big thing.
• 19:26
  Speaker 3: Um, so I think, yeah, always be able to take those, or willing to take those risks and then pick myself up when things didn't work out right.
• 19:33
  Speaker 3: I've been a co-founder.
• 19:34
  Speaker 3: I've been a co-founder of two companies.
• 19:36
  Speaker 3: I haven't made my big exit and retired, but I've picked myself up when things haven't gone the way that I've wanted it to and said, okay, what could I do next?
• 19:47
  Speaker 3: So I think that's the big thing, it's being prepared to follow the stuff that you find is interesting, and that's the fact.
• 19:55
  Speaker 3: You know the fact that I kind of get to work on innovation.
• 19:58
  Speaker 3: Uh, it's really because I put myself in a position where I'm like I'll do the new stuff right, the stuff that's not so safe and not so well established.
• 20:05
  Speaker 3: Any advice you'd give to?
• 20:07
  Speaker 1: your past self in that vein uh, it's a really good question.
• 20:12
  Speaker 3: Uh one maybe I haven't thought about as much as I should have done, but uh, but I think maybe it's kind of it it's easy to have the survivor's bias right given, kind of I'm looking back but to say, maybe, maybe, have faith in yourself that you can just go out and do these things and you can cope with the ups and the downs.
• 20:30
  Speaker 3: And you know, not every day is an easy day, but as long as you keep kind of with a goal in mind, you'll, you'll still get to a good place.
• 20:35
  Speaker 3: Keep kind of with a goal in mind, you'll you'll still get to a good place.
• 20:37
  Speaker 3: But yeah, it's, it's easy to say that, looking back and at the time, right, you never know how things are going to go.
• 20:43
  Speaker 2: So that that's that's a challenging question to to answer.
• 20:51
  Speaker 2: It is what?
• 20:51
  Speaker 2: Let's talk about the future a little bit.
• 20:52
  Speaker 2: What?
• 20:53
  Speaker 2: What kind of predictions does I'm guessing, since we didn't know how busy you are and it may be a few more years until we have you back on the show, but what do you kind of see happening going into 2025, 2026?
• 21:17
  Speaker 3: It's crazy to say, but what do you kind of see happening and what do you hope that kind of happens when it comes to AI and technology and privacy?
• 21:24
  Speaker 3: Yeah, so one of the big things that I'm looking at is around kind of almost this nexus of data laws, particularly coming out of Europe, where this distinction between personal data and non-personal data and I think, gabe to what you were saying earlier about the you know that there's so much data out there now that almost any data can be personal or connected back to an individual, particularly with things like the EU Data Strategy, the Data Act, e-privacy already doesn't care about whether something's personal data or not.
• 21:48
  Speaker 3: So I think, while we almost we're going to have this situation where this kind of governance of data overall cyber privacy, ai you know overall kind of governance of data overall cyber privacy, ai you know overall kind of governance and hygiene they're going to be coming much more together because I think some of the flexibility that organizations have had to manage data, the way that works for them, is going to get eroded further and further as these new laws come in right.
• 22:16
  Speaker 3: The Data Act, for example, says you says, any data that comes off of a device potentially can be subject to a data subject request, not just personal data.
• 22:24
  Speaker 3: So that kind of almost artificial distinction we've had in the past is going to go away, which means kind of strategic rethinking around what even is data we want and how much we're using it.
• 22:36
  Speaker 3: I go back to a study from a few years ago from IBM that that says, like I think it was, like three quarters of all the data organizations collect is never used, um, so you're effectively paying four times the price, uh, for kind of storing and protecting that data.
• 22:49
  Speaker 3: You should be, uh.
• 22:50
  Speaker 3: The trouble is, of course, it's very hard to work out what the 25 is that really is valuable, uh, so that's kind of I think that's an interesting place to really be, you know, at the center of as we start to almost rethink our relationship with data.
• 23:03
  Speaker 3: Right, since the cost of storage plummeted to almost zero, people are like more data is better, right we can make, and especially you've seen the articles about the LLMs will have sucked in the entire internet.
• 23:14
  Speaker 3: There'll be no new data by 2026, 27 for them to continue to train on.
• 23:21
  Speaker 3: So you know, do we need to change our relationship with data fundamentally?
• 23:25
  Speaker 3: That's kind of an interesting thing I'm keeping an eye on.
• 23:28
  Speaker 2: Yeah, that is Gabe, and I have had conversations about this.
• 23:31
  Speaker 2: This kind of rings a bell.
• 23:32
  Speaker 2: Gabe, if you're still there, I know you're probably dealing with something technical.
• 23:35
  Speaker 1: I am on minor technology, technology issues, but ignore it okay, no, I was gonna.
• 23:41
  Speaker 2: I figured you might want to chime in here because it sounded similar to the conversation we had about data backups and how a lot of companies are still not really doing that yeah, and some are doing the exact opposite, which is even worse to aaron's point, which is they're getting rid of nothing, nothing at all.
• 24:00
  Speaker 1: In the analytics space, we see exactly both they get rid of nothing, and nothing is sacred enough that it is preserved, such that you have copies of it for when you need it.
• 24:11
  Speaker 1: It's this weird dichotomy where there seems to be no middle ground, and so I'm inclined to agree.
• 24:16
  Speaker 1: Our entire relationship with data needs to change.
• 24:18
  Speaker 1: Our entire relationship with data needs to change fundamentally because, as we've talked about in the show, privacy is a byproduct of security, not the other way around.
• 24:28
  Speaker 1: It just cannot be right.
• 24:30
  Speaker 1: You cannot have privacy without security.
• 24:32
  Speaker 1: You can certainly have security without privacy, but you cannot have it the other way around, and that part of the way we think about data feels like we're pushing a rock up a hill.
• 24:42
  Speaker 1: Still some days and by some days I mean days that end in y, but you know only some of the days that end in y- why do you think that is, though?
• 24:53
  Speaker 2: why?
• 24:53
  Speaker 2: Why do you both feel like?
• 24:56
  Speaker 2: Why?
• 24:56
  Speaker 2: Why is that such a?
• 24:57
  Speaker 2: Is it because we don't like?
• 25:00
  Speaker 2: Nobody has the direction to change or want to change?
• 25:06
  Speaker 3: I think part of the problem is it's easier to ask for new data sometimes than it is to curate what you have or to find where it is already existing and what if it's existing.
• 25:15
  Speaker 3: But it's only two thirds of the data.
• 25:16
  Speaker 3: You the data you want, going and asking for that whole new data set.
• 25:19
  Speaker 3: So yeah, I've seen across a whole bunch of companies, I've worked with that kind of the bias towards well, let's just go and get what we want, rather than kind of extracting the 80% we may have already it's like when you make too many different email accounts because you don't want to deal with the spam, so I'm just going to create a new one.
• 25:44
  Speaker 2: Am I the only?
• 25:44
  Speaker 1: one.
• 25:44
  Speaker 1: No, you're not the only one that has happened.
• 25:49
  Speaker 3: Well, there's that, or I mean, even if I think back right, I've lived in different countries around the world.
• 25:53
  Speaker 3: The number of bank accounts out there that I probably have like five bucks in that I don't even know how they would ever know how to get hold of me at this point.
• 26:01
  Speaker 1: So they're compelled to keep your five bucks.
• 26:08
  Speaker 3: Well, yeah, and at some point, yeah, I don't know, but yeah, with the email addresses I mean, and especially I was trying to get into an account the other day and they wanted to send a password reset to an email I no longer have access to and there's no kind of side channel to be able to say I don't have access to it.
• 26:25
  Speaker 3: Authenticate me some other way.
• 26:27
  Speaker 3: I think we have this kind of digital legacy that at some point you don't have access to all of that data that maybe you once did.
• 26:37
  Speaker 2: I just blanked out.
• 26:38
  Speaker 2: I had a question and it dropped.
• 26:40
  Speaker 2: This happens often.
• 26:41
  Speaker 2: My brain goes everywhere.
• 26:43
  Speaker 1: Well, I have a question.
• 26:44
  Speaker 1: I asked you what advice you'd give to past self, but what do you see five years from now?
• 26:52
  Speaker 1: Where is not Aaron himself?
• 26:55
  Speaker 1: But where is this program at?
• 26:56
  Speaker 1: What does the world look like and what has changed?
• 27:00
  Speaker 1: Because, yeah, that's a good question.
• 27:01
  Speaker 3: I think I do have more of a sense of that, right, I think maybe an easier question to answer.
• 27:07
  Speaker 3: For me, the fundamentals of a lot of what I do is down to let's take kind of the it depends out of some of these answers.
• 27:17
  Speaker 3: Right, I know that it's kind of the classic answer, but to an engineer, it depends is not a requirement, right, you can't build something on the basis of it depends.
• 27:26
  Speaker 3: Maybe you need to build a decision tree that says, well, if it goes this way, we do this, or this way it goes that.
• 27:32
  Speaker 3: But you can't just have this gray area in the middle.
• 27:35
  Speaker 3: So a lot of what my team is focused on in five years we will have done, hopefully, is to really get those foundational pieces of that very solid foundation of a program that whenever anyone has a question about the program we have a black and white answer, up to the point where we don't right, because there's always going to be emerging stuff.
• 27:55
  Speaker 3: But we know that for the repetitive questions and the things we should have answers to how many countries do we operate in?
• 28:01
  Speaker 3: There's one answer to that, but if I ask three different people, they're probably going to go to three different data sources and come back with maybe slightly different answers, right?
• 28:09
  Speaker 3: So that's the kind of stuff that I want to provide, that framework and foundation for everybody else, where the good thing is, then, that we can actually focus on the problems we haven't solved rather than keep re-answering the problems we already have.
• 28:22
  Speaker 1: Yeah, that's good.
• 28:23
  Speaker 1: Gabe's back, we're good.
• 28:24
  Speaker 1: Yeah, apologies, all of the technical issues today.
• 28:29
  Speaker 2: You're good, so I was going to go to what you and Aaron were talking about.
• 28:34
  Speaker 2: When there needs to be this.
• 28:35
  Speaker 2: What was it?
• 28:36
  Speaker 2: The change with the way that we handle data, or was it?
• 28:40
  Speaker 3: the kind of our relationship with data right.
• 28:43
  Speaker 3: More is not always better.
• 28:44
  Speaker 3: I'd rather have more high quality data, the more data, and I think we've.
• 28:48
  Speaker 3: We're at the point where, uh, what is it?
• 28:51
  Speaker 3: Uh, quantity has its own quality or there's some variety of that right in order for something to change there.
• 28:59
  Speaker 2: Do you think that there is going to be some kind of major event or something that happens to, where it's basically a force of change rather than someone actually being innovative and making a change for all?
• 29:12
  Speaker 3: I guess uh, the trouble is, the only kind of events that I can see are bad ones.
• 29:18
  Speaker 3: Right, you know, an election is verifiably influenced and you go back and say, well, the reason we could do this is because we knew, down to the household level, x, y, z about these things, and maybe all of that stuff shouldn't be as available as it is.
• 29:36
  Speaker 3: So, yeah, it's.
• 29:38
  Speaker 3: I unfortunately I can't think of a good.
• 29:40
  Speaker 3: I think the Europeans are kind of more pushing in this direction with some of their overall data strategy, but I do think something's going to have to break at a pretty significant level before that changes, because otherwise there's no real incentive for companies to rethink that.
• 29:53
  Speaker 3: I think what's working is working well enough, but then, pre you know, pre GDPR and post GDPR, the world didn't end right where suddenly some of these things came in.
• 30:04
  Speaker 3: So, yeah, companies will adapt.
• 30:07
  Speaker 2: You mean like when 2000 hit and all the computers didn't explode?
• 30:11
  Speaker 2: Oh yes, Yep.
• 30:12
  Speaker 3: No, I was doing a whole bunch of 2000, year 2000 consulting back in the day, so I was going to say that there was a lot of money to be made on not solving the problem yeah, well, you guys were in the industry around that time, right yeah um, not sorry to age you um, but where do you guys remember that day?
• 30:32
  Speaker 2: do you remember where you were?
• 30:33
  Speaker 2: Do you remember all that fuss?
• 30:37
  Speaker 3: I was at the uh, the millennium dome inome in London for the end of the Millennium Party.
• 30:41
  Speaker 3: So yeah, I know exactly where I was, but I don't think I was thinking about computers.
• 30:49
  Speaker 1: I knew where I was because I was on call.
• 30:51
  Speaker 1: I was a network engineer back then.
• 30:53
  Speaker 1: I was put up in the Helmsley Hotel in New York City waiting for something to burn down.
• 30:59
  Speaker 1: I remember exactly where I was.
• 31:00
  Speaker 1: Did you believe that it for something to burn down?
• 31:01
  Speaker 1: I remember exactly where I was.
• 31:02
  Speaker 1: Did you believe that it was going to burn down, fairly certain it wasn't going to be as bad as the news said it was.
• 31:07
  Speaker 1: But I was pretty certain not everything was going to go well because you know technology.
• 31:14
  Speaker 3: Well, yeah, and I just spent the last two years fixing stuff that would have broken to some level of broken.
• 31:21
  Speaker 3: Um, I think what we didn't really realize was what we didn't people over exaggerated maybe was broken often doesn't mean that nothing, nothing works.
• 31:32
  Speaker 3: It's like some level of degraded functionality that you can still, you know, get by on until you fix it exactly that makes me think well, when?
• 31:41
  Speaker 2: when do you think?
• 31:41
  Speaker 2: Well, I mean, now that we have what?
• 31:44
  Speaker 2: Quantum computing?
• 31:45
  Speaker 2: Um, apparently isn't that going to be around 2030, is the estimation, something like that, yeah I mean do you think that that's the next like type of 2000 computer I don't know phase where people are going to over exaggerate, or do you think that's going to actually be something pretty?
• 32:07
  Speaker 3: I think for certain things, particularly around cryptography.
• 32:09
  Speaker 3: Right, it's going to break a bunch of stuff, but we've already released devices that are post-quantum ready, so in the last year or so.
• 32:19
  Speaker 3: Yeah, 2030 is kind of about, I think, when those things are going to change.
• 32:24
  Speaker 3: But there's already, you know, quantum resistant algorithms and things like that that you can start putting in place and then at some point will deprecate the older versions.
• 32:33
  Speaker 3: But as long as you're releasing the products and it's all in there now, you can deprecate it later on.
• 32:39
  Speaker 3: So I think certainly big companies are already thinking about that, and I'm sure that the RSAs of the world are well on top of that with.
• 32:45
  Speaker 3: How are we going to migrate away from these existing technologies?
• 32:50
  Speaker 1: That's definitely the biggest challenge is there's a lot of data that is sitting encrypted that once we have stable quantum computing, it will not take long to decrypt that data.
• 33:05
  Speaker 3: Yeah, and I think that the use case that I've been thinking of is like if we collect foreign adversaries traffic and we can't get into it, we're still going to have a really good picture of what they were thinking, even if it's historical that may inform the future.
• 33:17
  Speaker 3: So I'm sure that's one of the big things that's going to happen as soon as we get that compute power at scale.
• 33:22
  Speaker 3: Is all of this stuff that's been sitting there waiting for the ability to get into it will then be, you know, analyzed, probably by AI, I would suspect.
• 33:31
  Speaker 2: Probably A couple more things, aaron, anything that we haven't talked about that you might want to bring up, that that you've been digging into recently, that, uh, has been interesting to you or that might be interesting to the listeners trying to think what we haven't covered.
• 33:46
  Speaker 3: Um, yeah, I mean, we we're also.
• 33:49
  Speaker 3: One of the other things we haven't talked about is kind of trying to get back into the code and work out and I think, gabe, you'd appreciate this is you know, where are their privacy problems originating in the code itself, rather than doing more of a manual review or going and talking to the developers, what is the code that they've written actually say?
• 34:08
  Speaker 3: So that's something we're in the middle of working on right now as well is, how do we go and work out?
• 34:12
  Speaker 3: Where do we find these problems as soon as they're put into the repositories, so that we can fix them before they go into production?
• 34:20
  Speaker 3: So, yeah, trying to get that.
• 34:22
  Speaker 3: You know, I do feel the shift left is probably a bit of an overused term, but kind of we're trying to get back into the development cycle to be able to address those problems, kind of as they you know, as they are actually written, rather than picking them up, you know, months later.
• 34:36
  Speaker 1: No, I have a strong appreciation for shifting left in that analogy.
• 34:39
  Speaker 1: We began doing that with code from a security perspective quite some time ago.
• 34:44
  Speaker 3: Oh yeah.
• 34:44
  Speaker 1: Yeah, and it's a classic sync to source problem, right, you were highlighting the human version of sync to source, which is we collected that data in this sync and we said that it should only be used for this purpose over here, but the code seems to have multiple ways that it allows it to be accessed by multiple different streams or you know that kind of thing.
• 35:10
  Speaker 1: I can very easily picture no shortage of ways, especially with the type of applications that pick data up, hold on to it and then make some decisions about where it goes.
• 35:21
  Speaker 1: Right, like you know, think those kinds of technologies and, yeah, there's definitely a lot of privacy code issues just waiting, hopefully, to be solved for, and not just Is this something that AI could actually be helpful with?
• 35:38
  Speaker 3: Yeah, there's pieces I mean, the technologies we're looking at do have some AI components, but a lot of that would be for well.
• 35:44
  Speaker 3: It's both for looking at the output but also helping to.
• 35:47
  Speaker 3: For example, one of the cool things we're looking at is how do you effectively understand the contract with a third party and then compare what's in the code with what's in the contract?
• 35:58
  Speaker 3: Right, because usually developers don't see the contract and lawyers don't see the code, so you've kind of got this assumption that both of those two things are equal.
• 36:06
  Speaker 3: But yeah, that's really.
• 36:09
  Speaker 3: You can do that at scale much better with AI than having some poor person go through each contract individually and type it in.
• 36:14
  Speaker 3: I can't even imagine.
• 36:16
  Speaker 2: Coders are unique.
• 36:19
  Speaker 1: Whichever developer committed the lines of code that had the privacy violations will make that person into the contracts.
• 36:27
  Speaker 3: Make the punishment fit the crime.
• 36:30
  Speaker 1: They'll start writing better code.
• 36:31
  Speaker 1: I promise you, it'll happen every time.
• 36:33
  Speaker 1: Yeah.
• 36:35
  Speaker 2: Oh, did you have something else, Aaron?
• 36:36
  Speaker 3: Oh, did you have something else, aaron.
• 36:37
  Speaker 3: No, I was going to say we're actually.
• 36:38
  Speaker 3: My team is developing some training right now with.
• 36:41
  Speaker 3: The idea is that we're aiming for this golden code that meets the business objectives and the privacy objectives at the same time.
• 36:48
  Speaker 3: So we've got some pretty cool thoughts we have around how we do that and how we kind of engage with people.
• 36:54
  Speaker 3: But yeah, the idea is that quality code is code that meets privacy requirements.
• 36:59
  Speaker 3: So really kind of tying that into it's not like it's this whole separate thing, it's just one aspect of quality.
• 37:05
  Speaker 3: You know, meet people where they are Gotcha.
• 37:09
  Speaker 2: OK, so last thing here.
• 37:12
  Speaker 2: Obviously we talked a little bit about PSR.
• 37:14
  Speaker 2: I know that you're going to be on that last panel of the last day, which I think is Tuesday, so anyone listening that's going to be at PSR, I'll be there as well.
• 37:26
  Speaker 2: Aaron's going to be there.
• 37:27
  Speaker 2: Is there anything else that you want to talk about for PSR?
• 37:32
  Speaker 3: when it comes to HP, yeah, I clearly can't count because I'm on three panels.
• 37:38
  Speaker 3: I thought it was two, but I'm on a panel on Monday around kind of what are the metrics that actually matter?
• 37:44
  Speaker 3: So what's the stuff that actually is going to be good for decision making as opposed to just for producing pretty reports?
• 37:49
  Speaker 3: And then I'm on a panel another panel on Tuesday before the one with the robot that's more around kind of the stuff we were just talking about with how do we get back to where the developers are actually writing the code and identify issues there?
• 38:03
  Speaker 3: So, yeah, lots going on.
• 38:05
  Speaker 3: I'm looking forward to catching up with a lot of people that I haven't seen for a while.
• 38:09
  Speaker 3: But yeah, next time I'm going to make sure I don't overcommit myself.
• 38:13
  Speaker 3: This was when I realized I was counting them up and I was like whoops, that's all right, it'll go by quick.
• 38:22
  Speaker 2: I'm sure it always seems like those things do.
• 38:24
  Speaker 2: You'll be blessed.
• 38:25
  Speaker 2: Yeah, I wish you could be there, gabe, I know.
• 38:30
  Speaker 1: Unfortunately I won't be able to join you, gentlemen, but have a good jolly time on me.
• 38:36
  Speaker 1: I don't mean financially on me, of course.
• 38:39
  Speaker 1: I was going to say just so we're clear.
• 38:43
  Speaker 1: I am not to be added and I'm also not to have the bill sent to me.
• 38:49
  Speaker 2: Appreciate you taking the time to join us today and hopefully I'll see you next week at PSR in LA.
• 38:56
  Speaker 2: Sounds great.
• 38:58
  Speaker 3: Yeah, I'll try and find you amongst the crowds, sir, sounds great.
• 39:01
  Speaker 1: Yeah, I'll try and find you amongst the crowds.
• 39:02
  Speaker 1: Yes, sir.
• 39:02
  Speaker 3: Pleasure Be well Likewise.
• 39:03
  Speaker 3: Thanks guys, Take care Bye.