Why Big Tech's Privacy Promises Are Lies

1
00:00:00,080 --> 00:00:08,560
All these companies that are claiming to be so innovative cannot figure out how to market a product to

2
00:00:08,560 --> 00:00:13,839
you unless they can spy on you all the time. That to me is like the opposite of innovation.

3
00:00:14,240 --> 00:00:16,160
Our guest today is Melanie Enzen.

4
00:00:16,160 --> 00:00:20,560
Melanie is here to help us cut through the marketing and legal speak that large companies and organizations

5
00:00:20,559 --> 00:00:26,239
use and help us discern from the outside what might really be going on inside and how they view our data

6
00:00:26,320 --> 00:00:28,959
and their responsibility to us as customers.

7
00:00:28,960 --> 00:00:34,000
Melanie is the founder and CEO of Discernible, a consulting firm that helps security and privacy teams

8
00:00:34,000 --> 00:00:38,559
learn how to communicate effectively with other parts of the company, including leadership, to increase

9
00:00:38,560 --> 00:00:44,240
their influencing company policies and projects, as well as ensuring privacy and security aren't just afterthoughts.

10
00:00:44,240 --> 00:00:48,399
She's also well known in the hacker community for her decade-long leadership of the press department for

11
00:00:48,399 --> 00:00:50,960
DEF CON, the world's largest hacker convention.

12
00:00:50,960 --> 00:00:55,519
Before Discernible, Melanie managed security, privacy, and engineering communications for major global

13
00:00:55,520 --> 00:01:01,679
brands, including Facebook, Uber, and ATT. Without further ado, here's our interview with Melanie and Sung.

14
00:01:01,679 --> 00:01:04,879
Melanie, thank you so much for taking the time to come and talk to our audience.

15
00:01:04,879 --> 00:01:10,159
I'm really excited because uh in the privacy space, I think we deal with a lot more formal companies than

16
00:01:10,159 --> 00:01:13,439
people realize. Uh I'm thinking like Proton, Signal, Red Hat.

17
00:01:13,439 --> 00:01:16,959
But we've never interviewed someone who's so deeply entrenched in that world before.

18
00:01:16,960 --> 00:01:21,759
And I think you have some really cool insight and perspective having been on that side of things.

19
00:01:21,760 --> 00:01:26,799
So first question, having been on both sides of the company curtain, so to speak, what surprised you the

20
00:01:26,799 --> 00:01:31,039
most about how companies talk about privacy internally versus what they tell consumers?

21
00:01:31,040 --> 00:01:36,000
So if we back up like a little bit, I think it may be helpful to have some context about how I got into

22
00:01:36,000 --> 00:01:44,719
privacy because I kind of I kind of got voluntold to take on privacy in in a role when I was working in Silicon Valley.

23
00:01:45,120 --> 00:01:49,120
My initial kind of thinking about privacy was as a consumer, right?

24
00:01:49,120 --> 00:01:53,120
As a consumer of various technologies and you know in the world.

25
00:01:53,120 --> 00:02:00,319
And I had very strong opinions about my privacy and about privacy in general.

26
00:02:00,320 --> 00:02:08,159
And then when I was, you know, assigned to take on the privacy communications role at one of these companies,

27
00:02:08,159 --> 00:02:15,760
I realized that even just my definition of privacy was very different from the company's definition of privacy.

28
00:02:15,759 --> 00:02:23,120
And I think one of the things to keep in mind for folks that are not on the inside of that curtain with

29
00:02:23,120 --> 00:02:34,000
with these techies compan is that a lot of these companies see privacy as a function of compliance meaning

30
00:02:34,640 --> 00:02:40,560
everybody inside the company who says that they work on privacy, they're not really privacy advocates,

31
00:02:40,560 --> 00:02:42,960
even if they see themselves that way.

32
00:02:42,960 --> 00:02:50,480
What they are actually advocating for is how do we enable the company to do what the company already wants

33
00:02:50,479 --> 00:02:58,320
to be doing in a way that doesn't run afoul of any regulations or like legal limitations.

34
00:02:58,319 --> 00:03:02,640
They're always trying to get away with as much as they possibly can.

35
00:03:02,640 --> 00:03:06,639
I have a number of good friends who still work at those companies.

36
00:03:06,640 --> 00:03:11,840
And again, they they see themselves as privacy advocates. I certainly did.

37
00:03:11,840 --> 00:03:17,840
But the reality is, I think of a lot of these privacy teams as like tax attorneys.

38
00:03:17,840 --> 00:03:23,359
Companies don't hire tax attorneys because they're trying to pay as many taxes as possible.

39
00:03:23,360 --> 00:03:31,439
So, you know, we a lot of these tech companies that have huge, huge privacy teams, regardless of how the

40
00:03:31,439 --> 00:03:39,120
individuals see themselves as privacy advocates or privacy professionals, they are working within the

41
00:03:39,439 --> 00:03:47,920
constraints and kind of shared reality of the organization that you know this is what the company wants

42
00:03:47,920 --> 00:03:53,199
to do and within those constraints can they think about privacy.

43
00:03:53,200 --> 00:03:57,680
And so I don't know that I would say it was something that surprised me.

44
00:03:57,680 --> 00:04:04,400
I think it was something that was deeply disappointing to realize that they weren't asking me to help

45
00:04:04,400 --> 00:04:11,840
with privacy because they respected my my expertise or my ability to drive change.

46
00:04:11,840 --> 00:04:16,159
You know, they they weren't really asking me to be a change agent, right?

47
00:04:16,399 --> 00:04:18,959
Despite what they say in all the the job interviews.

48
00:04:18,959 --> 00:04:27,680
Like there's some really smart, really wonderful people in these privacy teams. And they have been sold a bill of goods.

49
00:04:27,680 --> 00:04:32,240
In terms of, you know, the company, company, these companies are very good at flattering you during the

50
00:04:32,560 --> 00:04:36,399
interview process. They make you think that they deeply care about privacy.

51
00:04:36,800 --> 00:04:44,879
And in all fairness, if that were true, they would already be doing it. Fair enough.

52
00:04:44,959 --> 00:04:50,560
So on that note, well was there a moment or incident that made you realize that how we talk about security

53
00:04:50,560 --> 00:04:54,800
and privacy is just as important as privacy and security itself?

54
00:04:54,800 --> 00:05:02,800
Yeah, so working inside this company, so my I was on the corporate communications team with inside uh

55
00:05:02,879 --> 00:05:11,680
in inside these companies so my I reported into like the PR and marketing folks but my my remit and what

56
00:05:11,680 --> 00:05:19,759
I was responsible for was helping the security and privacy teams with their communication needs. Right.

57
00:05:19,759 --> 00:05:28,800
And so I sat with the engineers and the GRC teams and the legal teams and you know the that whole cross-functional

58
00:05:28,879 --> 00:05:33,680
kind of cohort that actually works on security and privacy initiatives.

59
00:05:33,680 --> 00:05:40,720
I was part of that organization, part of that um kind of dotted line reporting i don't think that there

60
00:05:40,720 --> 00:05:48,800
was just one specific moment but that this series of kind of death by a thousand cuts where i saw my very

61
00:05:48,879 --> 00:05:57,839
smart very, capable, very empathetic and compassionate colleagues getting shut down time after time after

62
00:05:57,840 --> 00:06:06,240
time with other engineering teams, HR teams, marketing teams, product teams, you know, when they would

63
00:06:06,240 --> 00:06:12,000
try to advocate for you know something that was more respectful of individual privacy.

64
00:06:12,000 --> 00:06:19,840
And what I realized was that a lot of these colleagues who otherwise were very capable were not good at

65
00:06:19,840 --> 00:06:23,360
advocating for themselves or their projects.

66
00:06:23,360 --> 00:06:31,839
And so you know again with I mentioned a couple minutes ago that, when companies see this as compliance,

67
00:06:31,840 --> 00:06:38,480
they look at it as what's the bare minimum that we have to do so that we can move forward.

68
00:06:38,480 --> 00:06:46,400
And I think every privacy professional inside these companies who goes along with that framing does a

69
00:06:46,400 --> 00:06:53,680
huge disservice to themselves, to the function, and to the concept of privacy in general, because we're

70
00:06:53,680 --> 00:07:01,360
allowing the company to define that pri privacy is about legal requirements rather than privacy is about

71
00:07:01,360 --> 00:07:04,399
treating people with respect and not trying to exploit them.

72
00:07:04,720 --> 00:07:10,639
From your experience, what's the single biggest misconception the average person has about their digital privacy today?

73
00:07:10,720 --> 00:07:14,879
So there's gonna be two. I was thinking about this earlier today.

74
00:07:14,879 --> 00:07:21,520
The first I is that they think that the I hear from a lot of people that toothpaste is out of the tube,

75
00:07:21,519 --> 00:07:22,560
so to speak, right?

76
00:07:22,560 --> 00:07:30,879
That there there really isn't a point in trying to claw things back because it's all been, you know, stolen,

77
00:07:30,879 --> 00:07:37,120
sold or you know, leaked anyways. And the reality is is that data has a shelf life.

78
00:07:37,120 --> 00:07:45,199
Data that was stolen, sold, leaked, whatever, five years ago, it doesn't have the same value that it does today.

79
00:07:45,199 --> 00:07:50,960
It's one of the reasons why these companies are constantly sharing data with each other because the most

80
00:07:50,960 --> 00:07:54,160
recent data is the data that's most valuable to them.

81
00:07:54,160 --> 00:08:01,200
And so a lot of the data that may have been lost in the past is already in the graveyard nobody's fighting

82
00:08:01,199 --> 00:08:09,120
over that so there still is a reason to you know want to protect your current data and your future data

83
00:08:09,439 --> 00:08:15,120
because that is what's most valuable. And you know, we we have not completely lost this.

84
00:08:15,120 --> 00:08:18,160
The only thing we can do to completely lose is to give up.

85
00:08:18,160 --> 00:08:28,720
The second thing that I was thinking about is that I think even some of the companies who you might think

86
00:08:28,720 --> 00:08:35,360
are the most privacy preserving, they're doing privacy because they have to, not because they want to.

87
00:08:35,360 --> 00:08:41,680
There is this level of pressure, I think, that we have to keep on them externally, particularly in the

88
00:08:42,000 --> 00:08:46,240
United States, where we don't have comprehensive privacy laws, right?

89
00:08:46,240 --> 00:08:54,639
So it's not an accident that companies, because companies see privacy as a regulatory issue, they are

90
00:08:54,639 --> 00:09:00,800
putting so much money into preventing regulation from being written and being passed. So those are the two things.

91
00:09:00,879 --> 00:09:02,400
It's one, like don't don't give up.

92
00:09:02,560 --> 00:09:08,639
There is still reason to fight and to try to do what you can and to learn about what these companies are

93
00:09:08,639 --> 00:09:14,960
doing and how they're exploiting you. But then on the other hand, you just you have to check everything.

94
00:09:14,960 --> 00:09:19,760
I know that you know some of the conversations that that we've had have been about marketing and various

95
00:09:19,759 --> 00:09:24,319
other things and how do you actually really know what's true based on what these companies say.

96
00:09:24,320 --> 00:09:27,840
But the truth is you just can't take their word for it. Can't.

97
00:09:28,159 --> 00:09:32,240
Especially I like the first point because I've long ago I wrote a blog post about like why you should

98
00:09:32,240 --> 00:09:35,840
care about privacy even after years of like not protecting your data.

99
00:09:35,840 --> 00:09:38,880
And that was one of the things I pointed out, is like, yeah, you change, you grow.

100
00:09:38,879 --> 00:09:44,240
Like, God willing, you're not the same person you were five years ago. Hopefully you've grown and that data's stale now.

101
00:09:44,240 --> 00:09:49,440
So and the the technology changes and the world around us is changing, right?

102
00:09:49,759 --> 00:09:54,000
There's a lot of people who used to not worry about their privacy, who are now worried about their privacy

103
00:09:54,159 --> 00:09:57,759
because we have AI now. We didn't have that 10 years ago.

104
00:09:57,759 --> 00:10:04,799
So, you know, as things change, it does actually change the calculus of what's at risk when it comes to

105
00:10:04,800 --> 00:10:05,840
our privacy, right?

106
00:10:05,840 --> 00:10:11,199
I think a lot of us are watching things happening in the world and are very concerned about who has access

107
00:10:11,200 --> 00:10:13,920
to our data right now and what they could do with it.

108
00:10:13,919 --> 00:10:20,480
So, you know, even if you yourself don't ever change, but I agree with you, I think most people do change.

109
00:10:20,480 --> 00:10:23,600
But even if we never did, the world around us is always changing.

110
00:10:23,600 --> 00:10:29,440
And that changes the value as well as the risk of any data about us.

111
00:10:29,440 --> 00:10:32,560
You mentioned marketing and that does bring us to our next topic.

112
00:10:32,560 --> 00:10:38,400
So all companies have to market and to oversimplify it, I know marketing is complicated, but basically

113
00:10:38,480 --> 00:10:42,240
the point of marketing is you want to highlight the good things that the company does and kind of downplay

114
00:10:42,240 --> 00:10:48,240
the shortcomings. But some companies really go too far. I'm thinking of like a lot of VPN ads on YouTube, for example.

115
00:10:48,240 --> 00:10:55,360
So I think this is a debate I see a lot in the privacy community is how how can we tell when like a company's

116
00:10:55,360 --> 00:10:58,160
gone too far versus like they're just marketing?

117
00:10:58,159 --> 00:11:04,159
We should cut them some slack, even if it's not technically 100% accurate. Do you have any thoughts on that? Yeah.

118
00:11:04,159 --> 00:11:10,319
So, and and I will say this as somebody who I've never been on the marketing team. I'm marketing adjacent.

119
00:11:10,320 --> 00:11:15,759
So I'm kind of like the cousin to marketing, so to speak, from my past life, right?

120
00:11:15,759 --> 00:11:18,720
So I have not done all the things that marketers do.

121
00:11:18,720 --> 00:11:22,160
I'm just watching them do it because their desk is next to mine, right?

122
00:11:22,399 --> 00:11:30,480
And I think first and foremost, in general, this is a very, very broad statement, but I think from consumers

123
00:11:30,480 --> 00:11:37,440
to industry groups to policymakers, we give marketing way too much slack.

124
00:11:37,600 --> 00:11:42,480
Most of the things that they think they need our data for, or at least that they say they need our data

125
00:11:42,480 --> 00:11:51,199
for, are bullshit. I have this conversation with um like founders and startups all the time where they they get obsessed

126
00:11:51,200 --> 00:11:56,720
with these like metrics that come from social media because social media platforms are one of the biggest

127
00:11:56,720 --> 00:12:03,120
privacy offenders and they're like oh we need to be able to track this I'm like do retweets pay your bills?

128
00:12:03,120 --> 00:12:06,799
Like this, why is this a number that we're tracking?

129
00:12:06,800 --> 00:12:13,439
And why did we decide that it's worth exploiting people so that you can see how many times someone liked the post?

130
00:12:13,440 --> 00:12:20,799
Right? And and to be fair, a lot of these analytics are possible without all of the invasive technologies.

131
00:12:20,800 --> 00:12:25,679
You can't actually count how many people like your posts without tracking them across the internet.

132
00:12:25,680 --> 00:12:31,440
But so I do think that the marketing function in general deserves a lot more scrutiny than they're getting.

133
00:12:31,440 --> 00:12:40,079
I have testified for some state legislators who are working on privacy laws, and they often ask me specifically

134
00:12:40,080 --> 00:12:45,279
about marketing because they're like, oh well if we if we can't collect this data or we can't sell this

135
00:12:45,279 --> 00:12:48,480
data, then marketers will marketers don't need to be doing that.

136
00:12:48,480 --> 00:12:53,120
They don't like that's a made-up metric that they gave you because they're addicted to this data.

137
00:12:53,120 --> 00:12:59,760
And so they're trying to think of reasons to hold on to it because it it's less about the performance

138
00:12:59,759 --> 00:13:06,559
of marketing the function and it's more about the performance of the marketer who has to put together

139
00:13:06,560 --> 00:13:12,640
a presentation at some point with numbers on it and who is going to have an individual performance review

140
00:13:12,720 --> 00:13:16,560
where they need to show lines going up and to the right.

141
00:13:16,560 --> 00:13:21,759
I'm sorry, I would rather work on fixing that problem instead of just saying they get you know access

142
00:13:21,759 --> 00:13:23,840
to whatever they think that they need.

143
00:13:23,840 --> 00:13:30,399
And so from a marketing perspective, that first thing is, you know, just because a company says that they

144
00:13:30,399 --> 00:13:35,200
need something for marketing, I don't think we should give it to them, you know.

145
00:13:35,200 --> 00:13:41,680
To me, marketing is not a good enough reason for a lot of the abuse that we see.

146
00:13:41,680 --> 00:13:50,720
Secondly, when a company uses privacy in their marketing. My spidey sense goes off for another number of reasons.

147
00:13:50,720 --> 00:14:00,240
And these are the things that I'm like clocking as I'm reading through the materials. Is the product built for privacy?

148
00:14:00,240 --> 00:14:06,480
Or does it look like they threw privacy at the end because they thought perhaps people would be concerned

149
00:14:06,480 --> 00:14:10,399
about things that were up higher up on the list? Right?

150
00:14:10,399 --> 00:14:18,240
Is it, for example, are you an advertising company and you've realized that you know it's a bit out of

151
00:14:18,240 --> 00:14:24,080
vogue at the moment? And so now you have a bunch of language on your website about how you care about privacy.

152
00:14:24,080 --> 00:14:28,879
In all fairness, if that were true, you probably would not have started an advertising company.

153
00:14:28,879 --> 00:14:37,040
And so we do think that it's worth thinking about how close is the privacy to the core product of the

154
00:14:37,039 --> 00:14:44,960
business versus is this just like you know a label that they've slapped on the website because they've

155
00:14:44,960 --> 00:14:48,960
been getting questions about it, right? Well said.

156
00:14:48,960 --> 00:14:54,159
So on that note, do you think that there's a a fundamental tension between a company's growth incentives

157
00:14:54,159 --> 00:14:55,439
and consumer privacy?

158
00:14:55,440 --> 00:15:01,440
Like could a for-profit company ever actually prioritize privacy or are those just fundamentally incompatible?

159
00:15:01,440 --> 00:15:06,960
Yeah, I I I don't think that they are fundamentally incompatible.

160
00:15:06,960 --> 00:15:14,480
I think where we run into the tension between the two is when you have a company that believes that growth

161
00:15:14,480 --> 00:15:17,680
is worth hurting people over.

162
00:15:17,840 --> 00:15:25,760
If you think it's worth exploiting people to grow or to make more money, that's not a privacy issue, that's

163
00:15:25,680 --> 00:15:27,680
a character flaw, right?

164
00:15:28,080 --> 00:15:34,960
And so, you know, we've had this debate and these kinds of discussions in other parts of consumer protection,

165
00:15:34,960 --> 00:15:37,759
whether it's environmental issues.

166
00:15:37,759 --> 00:15:42,000
You know, we're having big debates on this right now when it comes to data centers and the pollution and

167
00:15:42,000 --> 00:15:46,720
the energy costs and you know the water usage and all of that.

168
00:15:46,720 --> 00:15:52,960
Like the question is not should you be allowed to grow as a company, but it but at what cost, right?

169
00:15:52,960 --> 00:16:01,360
And in all fairness, all these companies that are claiming to be so innovative cannot figure out how to

170
00:16:02,000 --> 00:16:08,880
market a product to you unless they can spy on you all the time. That to me is like the opposite of innovation.

171
00:16:08,879 --> 00:16:15,680
If you actually are the one controlling my checkbook, then you you didn't really sell me on anything, right?

172
00:16:16,000 --> 00:16:19,120
So I don't think that tension has to exist.

173
00:16:19,120 --> 00:16:25,840
And I think in other parts of consumer protection, we have successfully fought really hard for the companies

174
00:16:25,840 --> 00:16:32,960
to either pay for the cost of those consequences or actually learn how to innovate so that those products

175
00:16:32,960 --> 00:16:35,439
and services are safer, right?

176
00:16:35,440 --> 00:16:42,480
We don't have seatbelts and airbags in our cars because the manufacturers prioritized safety.

177
00:16:42,480 --> 00:16:45,120
We had to fight for that and force them to do it.

178
00:16:45,120 --> 00:16:49,680
And so again, this is it it's another reason why I think it's so important that people don't give up on

179
00:16:49,680 --> 00:16:54,960
this because we're the only ones that are actually going to be able to to force them to change.

180
00:16:54,960 --> 00:16:58,720
I like the car example because I'm thinking in my head now too that I don't know what the regulations

181
00:16:58,720 --> 00:17:03,760
are, but I know that now a lot of cars have like side airbags and under-the-wheel airbags and like it

182
00:17:03,840 --> 00:17:09,039
it almost became I guess I'm not much of a car guy, so I could be wrong, but it seems to me like once

183
00:17:09,039 --> 00:17:14,399
that enforcement came into place, it became like then it became a feature like, oh, our car is safe.

184
00:17:14,400 --> 00:17:17,759
Yeah, well our car is safer and it just kind of built from there.

185
00:17:17,839 --> 00:17:24,159
Wouldn't it be great if people didn't have to die before we decided that save products were important?

186
00:17:24,160 --> 00:17:31,359
Like how how many people have to be hurt for us to decide that this is important? For sure.

187
00:17:31,360 --> 00:17:35,839
Actually, on that note, my next question is: in the past, you've drawn parallels between the tobacco industry's

188
00:17:35,839 --> 00:17:39,759
playbook and what's happening in tech, specifically around consent and safety.

189
00:17:39,759 --> 00:17:45,279
So especially for maybe younger listeners who were not around when there was a smoking section in the

190
00:17:45,279 --> 00:17:48,960
restaurant, can you explain that comparison and how they're similar?

191
00:17:49,360 --> 00:17:56,320
Yeah, so I I I have to give give a shout-out to my friends over at uh Internet Safety Labs because they're

192
00:17:56,720 --> 00:18:05,759
they initially introduced me to this comparison which I latched onto you almost uh instinctively because

193
00:18:05,759 --> 00:18:12,079
there's a part of this comparison that rings true for me as a former public relations student.

194
00:18:12,079 --> 00:18:16,000
Like I I have two degrees in this discipline.

195
00:18:16,000 --> 00:18:21,680
Kind of the worst stuff that was happening from a marketing and advertising perspective with the tobacco

196
00:18:21,680 --> 00:18:28,000
industry, the origin of a lot of that is an individual who's kind of considered the father of public relations.

197
00:18:28,000 --> 00:18:34,960
So I have very strong feelings about what the function of public relations could and should be doing today.

198
00:18:34,960 --> 00:18:39,759
But our origins, in all fairness, they're not without scandal.

199
00:18:39,759 --> 00:18:49,760
And so this is particular individual was hired by the tobacco industry to help market cigarettes to women.

200
00:18:49,759 --> 00:18:54,800
Like this is the person who's responsible for the campaign of like freedom torches.

201
00:18:54,880 --> 00:19:02,240
Like, can you imagine convincing a whole bunch of women who because we were already being oppressed by

202
00:19:02,240 --> 00:19:16,480
society, felt like we we we were so eager for independence and for autonomy that we were, you know, easily

203
00:19:16,480 --> 00:19:25,200
persuaded, and I'll say easily just in general terms, but we became a persuadable population for something

204
00:19:25,200 --> 00:19:29,759
that kills you, you know, that causes cancer.

205
00:19:29,759 --> 00:19:36,720
And you know, one of the most widely used tactics of the tobacco industry, which a lot of these tech companies

206
00:19:36,720 --> 00:19:43,759
are doing today, is that they actually do opposition research and try to discredit scientists and experts

207
00:19:43,759 --> 00:19:47,360
who are saying this has a negative effect on our health.

208
00:19:47,360 --> 00:19:52,960
And so then, you know, the tobacco industry, you know, would do their own research and be like, actually,

209
00:19:52,960 --> 00:20:01,359
like like do you remember when we all thought that like wine could be good for you because it had antioxidants in it.

210
00:20:01,360 --> 00:20:06,160
Like these are the types of things that the tobacco company was doing and was really trying to convince

211
00:20:06,160 --> 00:20:09,360
people that there weren't any negative side effects.

212
00:20:09,360 --> 00:20:17,200
Now, I think we could have a intelligent debate about whether or not products like tobacco should exist, right?

213
00:20:17,200 --> 00:20:25,040
Do these companies have a right and should we give them the opportunity to sell these products that are harmful, right?

214
00:20:25,039 --> 00:20:29,759
But in all fairness, vehicles are also harmful.

215
00:20:29,759 --> 00:20:35,519
There's a lot of things that could cause harm, and this is why the this like rules and regulations are

216
00:20:35,519 --> 00:20:41,839
so important because it helps minimize the potential negative effects of these various products, right?

217
00:20:41,839 --> 00:20:48,159
And as a society, there have been times where we've decided, you know what, there is just not enough regulation

218
00:20:48,160 --> 00:20:54,640
and enough like guardrails that we can put around this business model to make it safe, we're just not

219
00:20:54,640 --> 00:20:57,200
allowing these types of businesses, right?

220
00:20:57,440 --> 00:21:02,000
Human trafficking comes to mind as an obvious and extreme example of that, right?

221
00:21:02,000 --> 00:21:07,440
There are types of businesses that we are saying this is just not allowed there's no way to make this

222
00:21:07,440 --> 00:21:14,720
okay right and i think a lot of companies particularly data brokers right now are really fighting hard

223
00:21:14,720 --> 00:21:20,960
to not get added to that list. But in all fairness, a lot of them are causing more harm than good.

224
00:21:20,960 --> 00:21:28,480
So, you know, if the regulation does in fact put them out of business, well, maybe that was the point, right?

225
00:21:28,480 --> 00:21:36,000
If you can't run a business that doesn't hurt people, we're not obligated to, you know, to concede that.

226
00:21:36,000 --> 00:21:38,000
Not every business has a right to exist.

227
00:21:38,000 --> 00:21:42,800
That's there's no constitutional right in the United States that businesses get to exist.

228
00:21:42,880 --> 00:21:50,800
And so the tobacco industry was the PR campaigns and the marketing and just they didn't have the same

229
00:21:50,799 --> 00:21:57,840
types of regulations that we have now in terms of how close you you can get to lying without getting a

230
00:21:57,839 --> 00:21:59,519
call from the FTC?

231
00:21:59,519 --> 00:22:06,559
So the tobacco company, I think, was able to do a lot more just blatant lying in their official communications

232
00:22:06,559 --> 00:22:10,000
than what some of these companies can do now, right? They're very careful.

233
00:22:10,000 --> 00:22:15,760
The words on their website, the words in their terms of service, these things are very carefully crafted now.

234
00:22:15,759 --> 00:22:20,880
But it doesn't stop their executives and their spokespeople from, you know, misleading people.

235
00:22:20,880 --> 00:22:27,839
And so I know a lot of people in the tech industry that are on, you know, the communications teams, the

236
00:22:27,839 --> 00:22:34,159
marketing teams, the public policy teams, they think they're so smart that they have found ways to persuade

237
00:22:34,559 --> 00:22:40,559
policymakers and customers and other like, oh weren't we so sneaky that we're getting away with this thing?

238
00:22:40,559 --> 00:22:42,559
And I'm like, you didn't invent it.

239
00:22:42,559 --> 00:22:47,440
It was invented by the guy who was trying to kill people a hundred years ago with cigarettes.

240
00:22:47,440 --> 00:22:54,160
That's whose playbook you're using. My next question is about uh companies and communication with the public.

241
00:22:54,160 --> 00:22:59,360
When there's a major data breach or a privacy scandal, what is the first thing that the internal team

242
00:22:59,360 --> 00:23:05,360
usually gets wrong when they try to communicate with the re with the public? It's a good question.

243
00:23:05,360 --> 00:23:10,560
I think the first thing that they get wrong is God, everyone's gonna hate me.

244
00:23:10,559 --> 00:23:16,240
Starting with the lawyers and asking, what do we have? to say The lawyers need to be in the room 100%.

245
00:23:16,240 --> 00:23:23,759
I am definitely not advocating for lawyers to be cut out because it is important for them to be there.

246
00:23:23,759 --> 00:23:32,400
However, when you come from a place of what do we have to do, you are actually cutting yourself off from

247
00:23:32,400 --> 00:23:38,720
all of the opportunities of how could we demonstrate that we're better than this? Right?

248
00:23:38,720 --> 00:23:45,520
Everything you see coming from a company that looks like it was written by a lawyer was written by a lawyer.

249
00:23:45,519 --> 00:23:49,280
And that's exactly how it reads to everybody. Right.

250
00:23:49,279 --> 00:23:55,759
I don't know if you've ever read anything from a lawyer and thought, wow, this person really cares about me.

251
00:23:55,759 --> 00:24:01,599
You know, this organization like really gets what's happening and how I'm impacted by this, right?

252
00:24:01,839 --> 00:24:04,159
No, that that's not how it comes across.

253
00:24:04,160 --> 00:24:11,120
And so a lot of times they don't think about what they're going to communicate until something happens.

254
00:24:11,120 --> 00:24:15,680
And now they're scared and they're worried and they run to the lawyers because the lawyer is the only

255
00:24:15,680 --> 00:24:21,520
one with enough confidence to fake it till they make it in terms of how do we communicate with humans.

256
00:24:21,519 --> 00:24:29,200
So a lot of the communication that's coming from these organizations, it maybe, maybe it meets a legal

257
00:24:29,200 --> 00:24:38,639
requirement, but it's counterproductive to building trust, preserving a reputation, and demonstrating

258
00:24:38,640 --> 00:24:40,960
credibility in the moment, right?

259
00:24:41,120 --> 00:24:55,519
Unfortunately, the one thing that we Is that bad things will happen by accident, even sometimes, right?

260
00:24:55,680 --> 00:24:59,600
I can't promise you that nothing bad will ever happen.

261
00:24:59,600 --> 00:25:07,359
What I should be able to promise is that when it does happen, I will care and I will walk you through it.

262
00:25:07,360 --> 00:25:10,639
And you're not going to have to go through that alone.

263
00:25:10,640 --> 00:25:16,720
And I should be able to promise that I'm doing everything I can to minimize the times where that happens

264
00:25:16,880 --> 00:25:23,120
and to minimize the impact of each incident. And that is not a legal conversation.

265
00:25:23,120 --> 00:25:29,200
I'm happy to have conversations with the attorneys about how do we communicate that feeling in a way that

266
00:25:29,200 --> 00:25:34,240
doesn't violate the law, right? I'm not advocating for breaking laws.

267
00:25:34,480 --> 00:25:42,720
But there is a an outcome from all of this communication that really needs to serve a higher purpose other

268
00:25:42,720 --> 00:25:50,319
than avoiding litigation. Because let me tell you, at least in the United States, you're going to get sued anyways.

269
00:25:50,319 --> 00:25:56,960
The lawsuits are coming. There's not a standard of merit before something gets filed, right?

270
00:25:56,960 --> 00:26:01,039
So maybe it won't actually end up in trial, maybe the judge will throw it out.

271
00:26:01,039 --> 00:26:07,119
There's a number of reasons why it could die before it actually sees courtroom, but it's still gonna get filed.

272
00:26:07,120 --> 00:26:13,039
You're still gonna have to spend time, money, and energy dealing with it, even if it gets dropped or thrown

273
00:26:13,039 --> 00:26:16,480
out, like you're you're still paying outside counsel to deal with it.

274
00:26:16,480 --> 00:26:23,279
And so the question is who do you want to be as an organization showing up in that moment?

275
00:26:23,279 --> 00:26:31,440
Do you want to be seen by a judge or a jury or mediator as a company that's trying to hide something,

276
00:26:31,440 --> 00:26:34,640
a company that wasn't doing the right thing to begin with?

277
00:26:34,640 --> 00:26:42,079
Or do you want to be seen as the company that actually cares and tried to be honest and try to really

278
00:26:42,079 --> 00:26:47,280
demonstrate what you're doing to prevent this from happening and what's going to happen in the future. Right.

279
00:26:47,279 --> 00:26:54,480
The legal requirement really is the floor in these conversations. It's not the be all end all.

280
00:26:54,480 --> 00:27:00,560
And the second thing that I will add, the second most common mistake that I've seen, and this truly breaks

281
00:27:00,559 --> 00:27:09,680
my heart because it's just, it's so sad. It's almost comical. But don't let AI write your incident comms for you.

282
00:27:09,680 --> 00:27:16,800
Because it it has that same kind of icky feeling when you read the lawyer statement, but now you know

283
00:27:16,799 --> 00:27:21,440
that the organization didn't even care enough to ask the lawyer to write it.

284
00:27:21,440 --> 00:27:26,319
You put it into a website, and that's how much you care about this relationship.

285
00:27:26,720 --> 00:27:29,840
I've been getting a lot of emails lately from people.

286
00:27:29,840 --> 00:27:33,760
I mean, I I always get emails from people that are like, hey, you should list my thing on your website.

287
00:27:33,759 --> 00:27:38,000
But over at my project, The New Oil, I've been getting a lot more lately that are very clearly written by AI.

288
00:27:38,000 --> 00:27:42,559
And it's so frustrating because even if it is a project that makes sense to be on the website, it's like

289
00:27:42,640 --> 00:27:46,080
you you didn't even care enough to like actually write me. Yeah.

290
00:27:46,079 --> 00:27:53,360
It it it's very it comes across as very almost condescending. But but like disrespectful, right?

291
00:27:53,360 --> 00:27:59,039
Like just you weren't actually concerned about me. And people can see that.

292
00:27:59,360 --> 00:28:01,840
So that actually uh ties into the next question.

293
00:28:01,840 --> 00:28:06,960
You touched on this a little bit, especially with the AI one, but how do we tell a good PR response from a bad one?

294
00:28:06,960 --> 00:28:11,280
How do we know when a company is like taking a seriously, owning the responsibility and trying to make

295
00:28:11,279 --> 00:28:17,039
it right versus just reassuring the investors and trying not to get sued and all that? Yeah.

296
00:28:17,039 --> 00:28:26,240
So a couple of things is a company that's really taking this seriously first and foremost is not blocking

297
00:28:26,880 --> 00:28:34,160
materials from getting indexed by search engine. I was thinking about that, the no index tag on disclosure pages.

298
00:28:34,160 --> 00:28:40,560
Oh, that pisses me off. That is that's particularly interesting to me because it's it's counterproductive.

299
00:28:40,559 --> 00:28:47,440
It's not helpful. To be fair, the only people I've ever heard advocate for doing this are the attorneys.

300
00:28:47,440 --> 00:28:52,879
And And uh I'm I am not allowed to give legal advice. I'm not a lawyer.

301
00:28:52,880 --> 00:28:57,119
Um, but lawyers love to give PR advice all the time.

302
00:28:57,120 --> 00:29:05,200
And the thing is, is if there is somebody looking for information about your company and an incident,

303
00:29:05,200 --> 00:29:14,640
a breach, a leak, something, wouldn't you want them to hear it from you on your disclosure page, like

304
00:29:14,640 --> 00:29:20,000
to get your side of it, to get your explanation in the context that you've written.

305
00:29:20,000 --> 00:29:27,920
I don't understand why you would want to hide that so that people who are searching for it only get everybody

306
00:29:27,920 --> 00:29:34,640
else's commentary on it. So yeah, hiding disclosures is is one thing.

307
00:29:34,640 --> 00:29:39,759
The second thing is can they actually articulate what happened.

308
00:29:39,759 --> 00:29:42,720
And there's varying degrees of this depending on the type of company, right?

309
00:29:42,720 --> 00:29:48,880
If it's a B2B company and it's very technical, they should have a technical postmortem. They really should.

310
00:29:48,880 --> 00:29:53,519
Because if nothing else, their enterprise customers are going to need that in order to do an accurate

311
00:29:53,519 --> 00:29:56,560
risk assessment with the vendor relationship.

312
00:29:56,559 --> 00:30:04,160
Now, if it's a B2C company and depending on the company, like for example, you may not expect to have

313
00:30:04,160 --> 00:30:12,399
a full technical disclosure from a granola bar manufacturer, right? But maybe it depends, right?

314
00:30:12,400 --> 00:30:14,159
There really is no one size fits all.

315
00:30:14,160 --> 00:30:18,880
It depends on the culture and the relationship these organizations have with their stakeholders.

316
00:30:18,880 --> 00:30:24,720
But for a B2C company like that, you may not get all the technical stuff on the website simply because

317
00:30:24,720 --> 00:30:33,279
there aren't that many people interested in it. But there should be a way to get the information if you are.

318
00:30:33,279 --> 00:30:41,440
So, you know, if if for example it's like, hey, we do have a technical, you know, document, here's how

319
00:30:41,440 --> 00:30:44,000
you can reach out to us if you're interested in it.

320
00:30:44,000 --> 00:30:50,559
Um I've seen a couple of companies, particularly if they have really valuable proprietary information,

321
00:30:50,559 --> 00:30:56,319
that they can only share some of those details with their customers and sometimes under an NDA if it's

322
00:30:56,240 --> 00:31:06,160
not already covered in their contract uh with with their customers. But it should be available to whoever wants it.

323
00:31:06,160 --> 00:31:13,519
And if you can tell when people are like, okay, they're either intentionally not telling me, which is a problem, right?

324
00:31:13,519 --> 00:31:15,440
Because they're not trustworthy.

325
00:31:15,440 --> 00:31:21,360
Or the other thing that I find most often is that they don't know they're doing it wrong.

326
00:31:21,360 --> 00:31:28,160
They don't have the experience expertise to competently communicate in this moment.

327
00:31:28,160 --> 00:31:35,040
And so I've heard from a lot of companies that things went as well as could be expected because they truly

328
00:31:35,039 --> 00:31:37,839
just didn't know what good looked like.

329
00:31:37,840 --> 00:31:48,000
And that also concerns me because if I can't trust that you know how to handle this incident, likeike

330
00:31:48,160 --> 00:31:51,119
we know where incidents are coming.

331
00:31:51,120 --> 00:31:57,920
So, you know, the it's it's not just the transparency and the honesty, honesty piece, but also the competency.

332
00:31:58,000 --> 00:32:01,840
Have you proven that I can trust you to handle these types of situations.

333
00:32:02,240 --> 00:32:08,080
So sometimes companies get caught breaking the rules or you know getting a scandal, and they usually get fined.

334
00:32:08,079 --> 00:32:13,200
I've heard conflicting answers on this from experts, but do you think in your expertise, are these finds

335
00:32:13,200 --> 00:32:18,159
meaningful or are do companies just treat them as like a cost of doing business? This is a cost of doing business.

336
00:32:18,160 --> 00:32:19,440
It's just a tax.

337
00:32:19,440 --> 00:32:28,720
To be honest, for better or worse, I think the meaning of the fines is for constituents to see that their

338
00:32:28,720 --> 00:32:30,880
government is doing something.

339
00:32:30,880 --> 00:32:36,000
I don't think this is the most effective thing the government could be doing, but it is important for

340
00:32:36,000 --> 00:32:38,559
people to see they're doing something.

341
00:32:38,559 --> 00:32:45,359
And so I don't think it's meaningful in the sense that it television really convinced companies to change.

342
00:32:45,360 --> 00:32:52,240
And for the largest companies who are often the most egregious when it comes to these kinds of exposures,

343
00:32:52,400 --> 00:32:56,240
it doesn't hurt them. They barely feel it, if at all.

344
00:32:56,240 --> 00:33:04,240
But it is important for people to see that their government gave a shit. So it it's not that there isn't any meaning.

345
00:33:04,240 --> 00:33:10,639
It's just not I don't think that they're accomplishing what they hope to. Gotcha.

346
00:33:10,880 --> 00:33:15,440
So some companies love to show off certain certifications like ISO, I don't know what the numbers are,

347
00:33:15,440 --> 00:33:19,920
or privacy shield, which for listeners, that was actually invalidated by courts a few years ago, but that's

348
00:33:19,840 --> 00:33:25,359
neither here nor there. What are your opinion of these? Are these helpful I would say heuristics?

349
00:33:25,360 --> 00:33:30,240
Like obviously they're not an end-all be-all, but can those be helpful heuristics for consumers or are

350
00:33:30,240 --> 00:33:34,480
they just compliance checkboxes that consumers shouldn't even bother paying attention to?

351
00:33:34,880 --> 00:33:39,120
I think they are only useful for enterprise customers.

352
00:33:39,120 --> 00:33:46,160
I don't think they mean anything to consumers and I don't think that consumers should put a lot of faith in them.

353
00:33:46,160 --> 00:33:52,480
The reason for that is because a lot of these certifications aren't actually checking the things that

354
00:33:52,480 --> 00:33:59,920
consumers care about. A lot of if you think about the worst offender in privacy.

355
00:33:59,920 --> 00:34:02,960
I promise you they have all these certifications.

356
00:34:02,960 --> 00:34:09,679
And so the certification does does tell you that they're doing some good things in certain areas.

357
00:34:09,760 --> 00:34:16,639
But for consumers, it's usually not the areas they care about. Now, for business customers, it is different.

358
00:34:16,639 --> 00:34:25,760
And this is primarily why those certifications became so popular because they were a bunch of consumer

359
00:34:25,760 --> 00:34:34,480
products and services back in the day. Maybe I should have prefaced this for anyone listening who was born after 1990.

360
00:34:34,480 --> 00:34:37,040
This is story time.

361
00:34:37,039 --> 00:34:43,599
That you know, when these companies they wanted to move into the enterprise space, they wanted to start

362
00:34:43,599 --> 00:34:46,480
selling their tools and their software to companies.

363
00:34:46,480 --> 00:34:51,119
They make more money off of companies than they do on consumers most of the time.

364
00:34:51,119 --> 00:34:58,400
They get really, really large contracts, and it gives them a more stable recurring source of revenue compared

365
00:34:58,400 --> 00:35:02,559
to like individual monthly subscriptions that they might get from you or from me.

366
00:35:02,559 --> 00:35:10,239
And so as these companies were trying to move into becoming a tool or a product that companies would buy,

367
00:35:10,240 --> 00:35:17,839
companies have this very complicated process for assessing their vendors and understanding how much risk

368
00:35:17,840 --> 00:35:23,519
are they introducing to the company by choosing certain tools or certain software.

369
00:35:23,519 --> 00:35:29,120
And there's varying degrees of risk depending on, you know, how much data does that tool need access to,

370
00:35:29,119 --> 00:35:34,800
how connected they're gonna be to other systems at the company, like all of those things can actually,

371
00:35:34,800 --> 00:35:39,679
you know, increase risk because if something happens to this tool through this product, it's gonna impact

372
00:35:39,679 --> 00:35:46,400
other products of our business. So one of the things that enterprises ask about are these certifications?

373
00:35:46,400 --> 00:35:53,439
Because it's kind of a shorthand to be able to say, okay, do you have an access control system?

374
00:35:53,440 --> 00:35:58,960
Do you have a process for managing vulnerabilities in your software?

375
00:35:58,960 --> 00:36:05,279
And so a lot of these certifications have become that shorthand of if you have this particular certification,

376
00:36:05,280 --> 00:36:10,159
then yes, we do have these programs, we do make these types of investments, all of that.

377
00:36:10,159 --> 00:36:13,760
What it doesn't check for is whether or not it works.

378
00:36:13,760 --> 00:36:23,040
And so you can have a privacy program that gets you a certification, but what they're not being audited

379
00:36:23,039 --> 00:36:30,880
on is does this company care about privacy? And when given the choice, do they choose privacy over something else?

380
00:36:30,880 --> 00:36:39,920
So So it is valuable for enterprise customers. It helps us skip some steps in the evaluation process.

381
00:36:39,920 --> 00:36:46,239
And for a lot of companies, it's a must have if you want to get their business.

382
00:36:46,240 --> 00:36:53,920
But for consumers, I I would not be I would not be putting any meaning into that certification as a consumer.

383
00:36:54,079 --> 00:36:58,639
So at the time of this recording, we covered a story, uh, we being privacy guides, we covered a story

384
00:36:58,639 --> 00:37:02,960
last week about Apple's private relay. There's a bug that exposes IP address.

385
00:37:02,960 --> 00:37:07,599
And the researchers went public with this immediately instead of doing responsible disclosure.

386
00:37:07,599 --> 00:37:11,839
And the reason they gave is they were worried that Apple was basically just gonna keep burying it and

387
00:37:11,840 --> 00:37:15,039
not actually fix it, and this was gonna hopefully force them to do it.

388
00:37:15,039 --> 00:37:19,599
And uh I remember when you heard that story, you kind of disagreed with their choice to skip the responsible

389
00:37:19,599 --> 00:37:24,400
disclosure phase. So uh why do you still champion responsible disclosure?

390
00:37:24,400 --> 00:37:30,079
And how do you think in a situation like that, a researcher could kind of get the best of both worlds

391
00:37:30,159 --> 00:37:34,799
of still do the responsible disclosure, but also make sure that the company doesn't just bury it and they

392
00:37:34,800 --> 00:37:37,119
never get it get to publish it. Yeah.

393
00:37:37,119 --> 00:37:42,319
So first I just want to caveat for everybody that I don't actually know what happened between the between

394
00:37:42,320 --> 00:37:48,000
this company and Apple, right? All I know is what everybody else has read on the blog.

395
00:37:48,000 --> 00:37:55,679
But based on that, and you know, my 20 years of experience working specifically with security researchers

396
00:37:55,679 --> 00:38:05,839
and bug bounty programs, I have a very strong sinking suspicion that either one or both sides of this

397
00:38:05,840 --> 00:38:09,839
equation is not effective in communicating.

398
00:38:09,840 --> 00:38:17,359
And I see this all the time between external researchers and the internal security teams.

399
00:38:17,360 --> 00:38:25,759
They often talk past each other. Emotions can get really high. A lot of this communication is happening asynchronously.

400
00:38:25,760 --> 00:38:30,159
I don't think any of these people are gonna win awards for their writing abilities.

401
00:38:30,159 --> 00:38:33,920
Like it's a really difficult communication environment.

402
00:38:33,920 --> 00:38:41,519
And if you don't have the skills to do this effectively, it's so easy to get frustrated.

403
00:38:41,519 --> 00:38:47,440
I have seen security engineers get really frustrated at researchers, in all fairness, because they're

404
00:38:47,440 --> 00:38:49,360
just reading the emails incorrectly.

405
00:38:49,360 --> 00:38:52,639
Like I've sat down with researchers, I'm like, that's not actually what they're saying.

406
00:38:52,639 --> 00:38:55,119
You're mad about a thing that they never actually said.

407
00:38:55,119 --> 00:39:01,119
But like they their interpretation of it, like you know, determines how they make decisions about this.

408
00:39:01,119 --> 00:39:03,759
And the same thing is true on the researcher side.

409
00:39:03,760 --> 00:39:10,080
I have written several blog posts about the communication issues that we have on both sides here because

410
00:39:10,079 --> 00:39:16,799
there's asynchronous communication a lot of the times, and there's an imbalance in terms of information.

411
00:39:16,800 --> 00:39:22,639
Both sides do not have the same amount of information about what they're talking about.

412
00:39:22,639 --> 00:39:28,799
You know, the external researchers do not see what's happening inside the company, and the folks inside

413
00:39:28,800 --> 00:39:35,360
the company are off their judgment is often influenced and impacted by the way they think as employees, right?

414
00:39:35,360 --> 00:39:38,319
In order, like their loyalty to that organization.

415
00:39:38,320 --> 00:39:43,839
And in some cases, they may be the one who built the damn thing and they're feeling very possessive about

416
00:39:43,840 --> 00:39:48,400
the fact that you found a problem. No one likes when their baby is called ugly, right?

417
00:39:48,720 --> 00:39:55,440
And so they this is just a hotbed for communication missteps in general.

418
00:39:55,440 --> 00:39:59,119
Now, I don't know for sure if that happened in this case.

419
00:39:59,119 --> 00:40:04,079
Because like I said, I don't have any knowledge of the communication that went between these two groups.

420
00:40:04,079 --> 00:40:11,920
I just feel like it because I have been involved in disclosures with Apple and have had both positive

421
00:40:11,920 --> 00:40:16,559
and negative experiences. So I feel like any one of these is actually possible.

422
00:40:16,559 --> 00:40:22,319
But it's really important to be able to say for your own credibility and your own reputation, it's really

423
00:40:22,320 --> 00:40:24,880
important to be able to say that you tried.

424
00:40:24,880 --> 00:40:30,559
Now, just because you disclose something to a company does not mean you have to play by their rules.

425
00:40:30,559 --> 00:40:37,199
If they're dragging their heels, if they're not fixing things, you don't work for them, you can disclose

426
00:40:37,200 --> 00:40:44,559
something, and if if they're taking an insanely long amount of time, and you decide that the best thing

427
00:40:44,559 --> 00:40:48,639
for protecting the users, and this is the part that I think is so important, the priority has to be protecting

428
00:40:48,639 --> 00:40:53,920
the users. It's really obvious when your number one priority was getting publicity for your research.

429
00:40:53,920 --> 00:40:59,599
But you know, if you decide that the thing that's most important for protecting individuals is that this

430
00:40:59,599 --> 00:41:06,239
needs to be disclosed because this company is being irresponsible and not fixing something, then you need

431
00:41:06,240 --> 00:41:12,480
to be able to say, We've really tried, we tried to warn them, they didn't listen, and we've taken this

432
00:41:12,480 --> 00:41:16,960
extraordinary step because our priority is protecting the individual.

433
00:41:16,960 --> 00:41:19,920
That is really important from a credibility perspective.

434
00:41:19,920 --> 00:41:24,559
Because now we are sitting here wondering why, why wouldn't you have done this?

435
00:41:24,559 --> 00:41:35,599
And in all fairness, I have spent my entire career working with analytical, logical, rational, technical thinkers.

436
00:41:35,599 --> 00:41:43,919
And so many of them are scared to have awkward or difficult conversations. That doesn't mean we get to skip them.

437
00:41:43,920 --> 00:41:50,639
It means we learn, we develop the skills and we learn how to navigate those situations.

438
00:41:50,639 --> 00:41:55,759
And when I see situations like this, again, totals like this is a speculation.

439
00:41:55,760 --> 00:42:01,759
I don't actually know what happened between these two groups, but I have seen it so many times where we

440
00:42:01,760 --> 00:42:09,199
could have avoided getting to this point if we had the appropriate communication skills on both sides.

441
00:42:09,200 --> 00:42:15,679
Because even within a company, oftentimes the thing, you know, the people you're reporting the issue to,

442
00:42:15,679 --> 00:42:17,919
they're not the people who do the fixing.

443
00:42:17,920 --> 00:42:24,639
They're just the report takers and they do the analysis and they're like, okay, yes, this is in fact a real thing.

444
00:42:24,639 --> 00:42:28,960
They've got to now go convince somebody else to actually do the fixing.

445
00:42:28,960 --> 00:42:34,080
Well, that somebody else has existing priorities and a different boss.

446
00:42:34,079 --> 00:42:39,839
And maybe they're trying to build something very quickly because they've got a release date coming up, right?

447
00:42:39,840 --> 00:42:46,719
All of this becomes a communication challenge that you've got to learn how to overcome regardless of which

448
00:42:46,720 --> 00:42:50,639
side of the issue you're on, whether you're the researcher or internally.

449
00:42:50,639 --> 00:42:57,360
And this is an area in security where you know we have seen communication failures over and over and over

450
00:42:57,360 --> 00:42:59,440
again for many, many years.

451
00:42:59,519 --> 00:43:04,400
I'm sure you love this video, but it reminds me of the um the Key and Peel sketch where they're texting

452
00:43:04,400 --> 00:43:10,639
each other to hang out. Yeah. It's just, yeah, you want to go right now? You wanna go right now? You wanna go?

453
00:43:10,639 --> 00:43:16,639
Oh, this guy. Yeah, uh viewers should look that up if they haven't seen it. There is a moment I will never forget.

454
00:43:16,639 --> 00:43:21,039
This was in a previous life when I was uh still working in Silicon Valley.

455
00:43:21,039 --> 00:43:26,319
The thing that I was working on with the security team at the time with their Buck Bounty program was

456
00:43:26,400 --> 00:43:35,440
teaching them to focus on the objective and the long-term outcome that they wanted from this engagement

457
00:43:35,599 --> 00:43:40,160
rather than trying to win the conversation.

458
00:43:40,159 --> 00:43:46,879
Engineers love to win conversations and it destroys relationships and it destroys trust.

459
00:43:46,880 --> 00:43:53,119
And so the head of product security at one point actually told me that the lessons they learned through

460
00:43:53,119 --> 00:43:58,160
working with me on bug bounty communications improved their marriage.

461
00:43:58,159 --> 00:44:03,360
Because now they knew how to communicate with somebody in a moment of disagreement.

462
00:44:03,360 --> 00:44:11,199
And that person always knew that the relationship was valuable, right? That I'm we're having this disagreement.

463
00:44:11,200 --> 00:44:15,839
This is an awkward and uncomfortable communication, but we're having it because I want to preserve the

464
00:44:15,840 --> 00:44:17,440
relationship, right?

465
00:44:17,440 --> 00:44:27,759
And when you stop trying to win the conversation, it helps diffuse a lot of the emotions and it de-escalates

466
00:44:27,760 --> 00:44:33,599
a lot of the the assumptions that we make about the other person that we're talking to. Yeah.

467
00:44:33,599 --> 00:44:38,400
I'm not an expert on that, but I am married and I always tell people it's like you and the spouse versus

468
00:44:38,400 --> 00:44:41,199
the problem is a lot more productive. Yeah, exactly.

469
00:44:41,200 --> 00:44:46,960
And if you companies have bug banning programs because they want to solve that problem with researchers.

470
00:44:46,960 --> 00:44:52,079
In fact, it's one of the things that I tell clients is like if if you're not prepared to be on the same

471
00:44:52,079 --> 00:44:58,639
team as the researchers, do not launch a book bounty program because that's what you're promising. You know?

472
00:44:58,960 --> 00:45:01,920
So what would a consent model that actually serves consumers look like?

473
00:45:01,920 --> 00:45:05,519
Would it be like a regulatory fix, a technical fix, or a cultural shift?

474
00:45:05,840 --> 00:45:11,839
I don't think there's a consent model that solves this problem. I don't think we can solve it with consent.

475
00:45:11,840 --> 00:45:18,240
What we have right now is consent, which has been diluted to disclosure.

476
00:45:18,320 --> 00:45:25,280
So all these companies have privacy policies or privacy notices. Those are not contracts.

477
00:45:25,280 --> 00:45:29,199
It is not there to tell you how much they care about your privacy.

478
00:45:29,200 --> 00:45:35,920
It is there to disclose, often in very vague terms, intentionally vague, because they're going to change

479
00:45:35,920 --> 00:45:42,159
soon, to disclose certain things that they're doing to avoid regulatory action.

480
00:45:42,159 --> 00:45:48,319
So they can't be um they can't be accused of lying to you about what they were doing.

481
00:45:48,320 --> 00:45:52,960
So they put in their privacy policy with very vague language. So they're like, well, we told you what we were doing.

482
00:45:52,960 --> 00:45:56,159
We told you we were drowning the puppies, like it's right here.

483
00:45:56,159 --> 00:46:00,960
You know, you just you can't save the puppies through disclosure.

484
00:46:00,960 --> 00:46:07,920
You have to tell the company that killing puppies is unacceptable.

485
00:46:08,000 --> 00:46:13,360
So again, they there are certain business models and there are certain business practices that we as a

486
00:46:13,360 --> 00:46:19,839
society and that we as a country and even as states or cities or whatever jurisdiction and regulatory

487
00:46:19,840 --> 00:46:26,960
body we're talking about, we have decided there are certain practices that are not okay. We don't allow them.

488
00:46:26,960 --> 00:46:32,480
Fraud, for example, right? You could make a lot of money doing fraud.

489
00:46:32,480 --> 00:46:39,040
We've decided we don't want that in our market and in our society. And so that's illegal.

490
00:46:39,039 --> 00:46:41,280
We could make a lot of these things illegal.

491
00:46:41,280 --> 00:46:47,039
And then you wouldn't have to read the very, very long privacy policy that was written by a lawyer for a lawyer.

492
00:46:47,039 --> 00:46:52,239
But you know, it's again, it's it, I don't think consent is the problem number one because i don't think

493
00:46:52,240 --> 00:47:01,919
these companies actually care about how they get consent if they truly cared again the concept of consent

494
00:47:01,920 --> 00:47:09,040
is about you should know so you can make your make a choice based on what works best for you.

495
00:47:09,039 --> 00:47:17,199
If companies really cared what worked best for you, they wouldn't try to get you addicted to a product

496
00:47:17,440 --> 00:47:21,200
or a platform or any kind of technology.

497
00:47:21,200 --> 00:47:28,079
If they really cared what was best for you, they would be giving you different choices in the first place.

498
00:47:28,240 --> 00:47:35,759
Or they would realize that this choice is just clearly messed up and we should never inflict that on anybody.

499
00:47:35,760 --> 00:47:39,519
So I just I don't think consent is the fix here.

500
00:47:39,519 --> 00:47:46,799
Um, because i i i don't think we have a way for it to be truly informed consent because if if we were

501
00:47:46,800 --> 00:47:53,920
truly informed we would not we would not be in this situation we're we're not truly given the information

502
00:47:54,240 --> 00:47:58,639
in the moment we're making the decision, nor are we being given true choices.

503
00:47:58,639 --> 00:48:04,480
We're being given manufactured artificial choices because the choices themselves have been chosen for us.

504
00:48:04,880 --> 00:48:09,920
I agree about the uh it's not really informed consent and if people were informed things would look very

505
00:48:09,920 --> 00:48:16,960
different and if we were actually given the option of choosing what we actually want right if you're choosing

506
00:48:16,960 --> 00:48:30,000
between like red and green well I don't consent to do either one of those, you know?

507
00:48:30,000 --> 00:48:33,519
So yeah, I I could rant about that all day. I agree.

508
00:48:33,760 --> 00:48:38,879
But actually on that note, people say they care about privacy, but they still use apps that track them everywhere.

509
00:48:38,880 --> 00:48:41,679
And your work deals a lot with human behavior.

510
00:48:41,679 --> 00:48:46,800
So from your perspective, would you say that this is like a failure of education or, are things just designed

511
00:48:46,800 --> 00:48:53,040
to be too addictive to resist, or are there not enough good alternatives? Like what's your take on that?

512
00:48:53,039 --> 00:48:57,679
If you're finding this interview insightful and interesting, please consider supporting our work at Privacy

513
00:48:57,679 --> 00:49:00,399
Guide so we can continue to bring you more like it.

514
00:49:00,400 --> 00:49:05,519
Privacy Guides is a nonprofit that researches and shares privacy-related information and facilitates a

515
00:49:05,519 --> 00:49:10,079
community on our forum and matrix where people can ask questions and get advice about staying private

516
00:49:10,079 --> 00:49:12,319
online and preserving their digital rights.

517
00:49:12,320 --> 00:49:17,280
You can sign up for a membership and get early access to bonus videos, bonus content, a private signal

518
00:49:17,440 --> 00:49:22,800
chat with other privacy enthusiasts, and more at privacyguides. org/slash donate.

519
00:49:23,599 --> 00:49:29,920
So there's a couple things happening all at once that kind of creates this perfect storm, which the companies

520
00:49:29,920 --> 00:49:37,039
love to talk about because they think that the gap between what we say and what we do somehow gives them

521
00:49:37,039 --> 00:49:40,880
permission to keep doing what they're doing. So there's a couple things I want to know.

522
00:49:40,880 --> 00:49:47,360
Is number one, I think our mechanisms for getting people's feelings about feedback are deeply flawed.

523
00:49:47,519 --> 00:49:53,199
I don't know many people who wouldn't say they care about privacy if that's the way you ask it.

524
00:49:53,200 --> 00:49:59,119
And so the the actual mechanisms and the instruments we're using to get this feedback, I think, is really important.

525
00:49:59,119 --> 00:50:05,600
And a lot of it is either funded or done by these companies. And so it's it's unhelpful on purpose.

526
00:50:05,599 --> 00:50:12,159
The second thing again and this touches back a bit on what we talked about with consent is that if the

527
00:50:12,159 --> 00:50:24,559
choice is either use this uh map app on your phone or not know where you are right now that that's not

528
00:50:24,559 --> 00:50:33,360
really a fair choice right and the fact that so one of the there's a really popular like growth strategy

529
00:50:33,360 --> 00:50:38,639
at these companies, particularly when they're small, or if it's a new product, they try to get it in as

530
00:50:38,639 --> 00:50:42,799
many places as possible where you don't have to choose. Right.

531
00:50:42,800 --> 00:50:47,440
So like things like bloatware and things that are like automatically done like on your phone when you

532
00:50:47,440 --> 00:50:52,079
buy your phone, right? Like those types of things. Like did you really choose to put that up on your phone? No.

533
00:50:52,079 --> 00:50:53,679
Your phone came with it.

534
00:50:53,679 --> 00:50:58,239
And if you don't want it to trap you you have to do the work to figure out how to turn that off right

535
00:50:58,400 --> 00:51:03,279
so it's like those types of things where it's like it's not really you don't really make that choice.

536
00:51:03,280 --> 00:51:08,639
So again comparing like I care about privacy but I have this app on my phone that I may not even know is on my phone.

537
00:51:08,639 --> 00:51:13,600
I may not even know what it's doing. Those that's not comparing apples to apples, right?

538
00:51:13,599 --> 00:51:19,599
So the so the research methodology here is something that I think we need to be really mindful of first and foremost.

539
00:51:19,599 --> 00:51:25,440
But you know, again, the if you're not really given a choice, I mean like think about like when you go

540
00:51:25,440 --> 00:51:30,159
to the doctor, I don't know if you've ever had to go to like the ER or urgent care or something, you're

541
00:51:30,079 --> 00:51:36,879
filling out these forms. The choices fill out the forms or sit in that chair and no one will help you.

542
00:51:36,880 --> 00:51:42,639
These are not situations where you can really say that I don't care about privacy because I chose to fill

543
00:51:42,639 --> 00:51:51,279
out the form because I was bleeding internally, right so I again it's mostly it's mostly the offending

544
00:51:51,280 --> 00:51:59,519
companies who keep pointing to this perceived gap between attitudes and behaviors hoping that no nobody

545
00:51:59,519 --> 00:52:07,119
looks under the hood on the research side, but then also on the behavior side and say, well, well, do

546
00:52:07,119 --> 00:52:13,200
people really have full autonomy to choose whatever they want? No, they they don't.

547
00:52:13,200 --> 00:52:22,239
So I think it's a manufactured dilemma. It's a freedom torch, if you ask me. Nice callback. And yes, very accurate.

548
00:52:22,240 --> 00:52:26,559
You mentioned that you've testified in in front of a few different uh state legislatures.

549
00:52:26,559 --> 00:52:32,960
Uh, specifically here, I've got Vermont written down for state bill 71, arguing for privacy as the default.

550
00:52:32,960 --> 00:52:37,199
So, especially this year, privacy guides has been focusing a lot more on like getting people involved

551
00:52:37,200 --> 00:52:41,199
in in legislation and stuff. So for those people, a couple of questions.

552
00:52:41,200 --> 00:52:46,400
What was the experience like engaging with lawmakers who may not deeply understand this technology or

553
00:52:46,400 --> 00:52:47,920
not understand it at all?

554
00:52:47,920 --> 00:52:53,679
And can you impart any advice to listeners who may want to get involved more on the legislative side of things? Sure.

555
00:52:53,680 --> 00:53:02,239
Um so I I have I have some good news, which is that there are more and more legislators who do actually

556
00:53:02,240 --> 00:53:04,159
understand the technology.

557
00:53:04,159 --> 00:53:11,039
So one of the reasons why I got involved with Vermont is because they have people in the state legislator

558
00:53:11,039 --> 00:53:16,799
who are former software engineers who actually do understand what is happening here.

559
00:53:16,800 --> 00:53:23,519
And they have done a ton of outreach to experts and other members of the industry like myself to get these

560
00:53:23,519 --> 00:53:25,280
different perspectives, right?

561
00:53:25,280 --> 00:53:32,159
The technical perspective, but as well as how does the culture how does this whole like organism function

562
00:53:32,480 --> 00:53:37,760
because in some cases you know like we're we're fighting a monster so we need to understand where the

563
00:53:37,760 --> 00:53:45,199
weaknesses are right so so that is good news. We we do have some fresh blood coming in, so to speak.

564
00:53:45,200 --> 00:53:46,880
And they do have technical experience.

565
00:53:46,880 --> 00:53:52,480
And so if you if you are lucky enough to have somebody like that in local government, reach out to them.

566
00:53:52,480 --> 00:53:55,039
They will be thrilled to hear from you.

567
00:53:55,039 --> 00:54:01,519
They'll be thrilled to hear any expertise that you may have or even just your concerns as a constituent.

568
00:54:01,519 --> 00:54:08,079
In Vermont in particular, I was testifying as somebody who was, you know, again, marketing adjacent and

569
00:54:08,079 --> 00:54:14,400
I I know all these tricks that the companies use to try to make you feel bad as a uh policy maker for

570
00:54:14,400 --> 00:54:20,079
wanting to to uh put regulation on them. But I'm also a small business owner.

571
00:54:20,079 --> 00:54:28,719
And I have such a visceral response to these very large companies going into local communities and convincing

572
00:54:28,720 --> 00:54:33,599
local chambers of commerce and local business owners that they can't survive without them.

573
00:54:33,599 --> 00:54:40,639
We're being used as small businesses, we're being used as human shields so that very large tech platforms

574
00:54:40,639 --> 00:54:48,080
and data brokers and other like multi-billion dollar companies won't have to pay the price for the consequences

575
00:54:48,079 --> 00:54:52,560
of their products on our society and on our communities.

576
00:54:52,559 --> 00:54:58,079
And I have worked really hard as a small business owner to try to eradicate as many of those platforms

577
00:54:58,079 --> 00:55:00,239
from my business as I possibly can.

578
00:55:00,240 --> 00:55:07,520
Like we recently just um I had been hunting and hunting and hunting for a place to put our website that

579
00:55:07,840 --> 00:55:10,159
you know didn't have all these trackers.

580
00:55:10,159 --> 00:55:17,759
The the platform we had been using previously had like a toggle where you could turn off the trackers,

581
00:55:17,760 --> 00:55:22,480
but the dormant code was still on the site, and that really bothered me.

582
00:55:22,480 --> 00:55:29,199
Number one, it's sh code quality, but number two, I was like, what who's gonna believe that I've just

583
00:55:29,200 --> 00:55:34,639
turned off this toggle? The code is still here in the source code, everybody could see it.

584
00:55:34,639 --> 00:55:40,639
And so we we moved our website to to an open source platform where we can audit the code.

585
00:55:40,639 --> 00:55:47,119
Everyone on our site can see the code. Like if I don't want tracking, it's not there. Right?

586
00:55:47,360 --> 00:55:51,599
These kinds of options were not always available to small business owners.

587
00:55:51,599 --> 00:55:58,000
And so they were manipulated by these big platforms where it's like, you know, you either advertise here

588
00:55:58,079 --> 00:56:03,199
or you host your website here or you're invisible and nobody will ever find you on the internet.

589
00:56:03,200 --> 00:56:04,880
That's not true anymore.

590
00:56:04,880 --> 00:56:13,599
We have tools and we have platforms that will allow us as business owners to be respectful of our customer privacy.

591
00:56:13,599 --> 00:56:15,759
And that scares the big guys.

592
00:56:15,760 --> 00:56:21,920
And so, you know, I I love speaking on behalf of small businesses and the things that I have done to market

593
00:56:21,920 --> 00:56:29,759
my company and to grow my business that didn't require me to use all of these, you know, really exploitative platforms.

594
00:56:29,760 --> 00:56:35,199
And you know, the policy makers needed to hear that just as much as they hear from, you know, the big

595
00:56:35,200 --> 00:56:40,079
tech lobbyists that are like, you know, if you if we can't collect all this data, then all these mom and

596
00:56:40,079 --> 00:56:45,679
pop shops on Main Street will will close. And that's not true.

597
00:56:45,680 --> 00:56:50,960
There are certain things where I think, you know, if if we're going to put stricter restrictions on everybody,

598
00:56:50,960 --> 00:56:54,960
then, you know, let's think about can we give grants to small businesses, right?

599
00:56:54,960 --> 00:57:01,759
Like this comes a lot with um some of the things that we want to do to preserve privacy and also to increase

600
00:57:01,760 --> 00:57:05,359
security may require some additional technical investments.

601
00:57:05,360 --> 00:57:12,800
Well you know what if you're a small company and you're running a health clinic? Like hygiene is not optional.

602
00:57:12,800 --> 00:57:18,480
We don't cut out small clinics from our you know sanitation regulations.

603
00:57:18,480 --> 00:57:23,599
You know, but what we can do is offer some assistance to help them meet that standard.

604
00:57:23,599 --> 00:57:28,319
Because the size of your organization shouldn't determine whether or not you're allowed to hurt people.

605
00:57:28,320 --> 00:57:34,239
So, you know, particularly when I've been talking to Verm Vermont, it's been as a small business owner

606
00:57:34,240 --> 00:57:38,640
to help them understand where they're being lied to by the big companies.

607
00:57:38,639 --> 00:57:43,119
Yeah, when you put it that way, the the whole like, oh, they the mom and pop businesses can't survive without us.

608
00:57:43,119 --> 00:57:47,920
And in my head, I'm like, they were here way before the tech companies. What are you talking about? Yeah.

609
00:57:47,920 --> 00:57:53,519
And and in all fairness, like they're wasting so much money on those platforms.

610
00:57:53,519 --> 00:57:59,039
Like that's they they've convinced these small businesses that they can't survive without some of these

611
00:57:59,039 --> 00:58:04,480
advertising platforms and you can. Totally can.

612
00:58:04,880 --> 00:58:08,880
You're involved in efforts to bring more women and minorities into cybersecurity.

613
00:58:08,880 --> 00:58:12,079
Why does representation matter in this field and how does it benefit everyone?

614
00:58:12,400 --> 00:58:17,039
We all have a limitation in our experiences and the way that our minds work.

615
00:58:17,039 --> 00:58:22,480
My brain is wired a very particular way, for better or worse. It's what makes me who I am.

616
00:58:22,480 --> 00:58:27,759
But sometimes I don't see the complete picture on something or sometimes actually I use this analogy with

617
00:58:27,760 --> 00:58:28,880
my partner all the time.

618
00:58:28,880 --> 00:58:36,159
I'm a I love doing jigsaw puzzles and there was there was a a moment where I would I was on vacation so

619
00:58:36,159 --> 00:58:44,159
I didn't have like my whole like old lady puzzle setup and uh I I was like pulling pieces out of the box

620
00:58:44,159 --> 00:58:48,639
and trying to like find where they fit on the table and my partner was like why don't you just put all

621
00:58:48,639 --> 00:58:52,720
the pieces on the table so you can see all of them at the same time.

622
00:58:52,720 --> 00:58:58,559
And I'm gonna be really honest with you, that thought had not crossed my mind. But it seemed so obvious, right?

623
00:58:58,559 --> 00:59:04,960
But the moment where I was in and what I was focused on, I was kind of being myopic in my thinking and

624
00:59:05,599 --> 00:59:13,279
having different people with different lived experiences and different backgrounds helps us find better

625
00:59:13,280 --> 00:59:16,560
ideas it helps us find better options.

626
00:59:16,559 --> 00:59:22,960
And in all fairness, like I mean I think a really obvious example that people might already be familiar

627
00:59:22,960 --> 00:59:30,880
with is the like motion activated like hand dryers in the restrooms, in like public restrooms that weren't

628
00:59:30,880 --> 00:59:34,319
tested appropriately for people of color.

629
00:59:34,320 --> 00:59:42,159
And so it was not recognizing people's hands when they were trying to dry their hands in the restrooms.

630
00:59:42,240 --> 00:59:50,800
And you're like, what? What what good is a hand dryer that only works for a percentage of the people using the bathroom?

631
00:59:50,800 --> 00:59:58,239
And so you can see how just like having, I don't know, basic levels of diversity are important just to

632
00:59:58,240 --> 01:00:01,760
make sure your product works and that it's usable by more people.

633
01:00:01,760 --> 01:00:08,559
Especially think about like if you're at a startup and like your number one priority is growth why why

634
01:00:08,559 --> 01:00:11,519
would you build a hand dryer that can't be used by everybody?

635
01:00:11,519 --> 01:00:14,800
That's going to limit how many people you can sell it to, right?

636
01:00:15,680 --> 01:00:23,039
So, you know, if you're not going to do it for altruistic reasons, at least do it for competency reasons. Right.

637
01:00:23,200 --> 01:00:28,559
Do it because it's the smarter choice, not just the right choice. All right. Last question.

638
01:00:28,559 --> 01:00:32,799
Where can our audience go to learn more about your work? Ah, that is a good question.

639
01:00:32,800 --> 01:00:40,239
So you can see all of my writing on my website, which is discernibleinc. com. All my blog posts are there.

640
01:00:40,240 --> 01:00:45,039
You can subscribe if you want to, if you want to get you know those sent directly to your inbox.

641
01:00:45,039 --> 01:00:54,639
We also run weekly in So every Wednesday we run a live scenario for subscribers who want to jump in and

642
01:00:54,639 --> 01:01:01,440
participate and practice and, you know, develop their skills on different communication aspects of incident response.

643
01:01:01,440 --> 01:01:07,360
If the timing of those drills doesn't work for you, you can also sign up just to get the the debrief.

644
01:01:07,360 --> 01:01:10,799
So you can still get access to the library of all of our various scenarios.

645
01:01:10,800 --> 01:01:15,279
You can run through them on your own if you want to. You can run through them with your team if you want to.

646
01:01:15,280 --> 01:01:19,520
But going to my website is the easiest place to find me.

647
01:01:19,519 --> 01:01:23,599
We'd like to thank Melanie again for being so generous with her time and speaking to us.

648
01:01:23,599 --> 01:01:30,239
If this topic interests you, definitely be sure to f We also have a bonus video for our supporters where

649
01:01:30,240 --> 01:01:35,440
we ask Melanie some more questions about things like the terms of service, her hobbies, and even a question

650
01:01:35,440 --> 01:01:40,079
from one of our supporters. You can sign up to see that at privacyguides. org slash donate.

651
01:01:40,079 --> 01:01:44,079
If the policy side of privacy is what interests you, then perhaps you would be interested in our interview

652
01:01:44,159 --> 01:01:49,839
we did earlier this year with Cindy Cohen, the former executive director of the Electronic Frontier Foundation.