Speaker 1: This is Baritune Day with a very special episode of
Speaker 1: Spit for You. Normally, with this show, I sit down
Speaker 1: with a musician who you know and love, and the
Speaker 1: scientists who you probably don't know but definitely love a
Speaker 1: little bit more by the end of our time together,
Speaker 1: and we take this approach to find the story in
Speaker 1: the science of DNA. We have explored race, we have
Speaker 1: explored adoption and sperm donation, but this show has a
Speaker 1: different format. It's still me and two people, but we
Speaker 1: are going back a little farther to the foundation of
Speaker 1: what genetic testing even involves, to the data, and to
Speaker 1: the big questions around what it means to spit in
Speaker 1: a tube and share your data with other people with
Speaker 1: a company, what it means for all of us to
Speaker 1: live in this very connected world where our information is
Speaker 1: a necessary input to get all the conveniences we have
Speaker 1: become attached to. We're gonna talk about data. We're gonna
Speaker 1: talk about privacy, We're gonna talk about permission and controls
Speaker 1: in this hyper connected world we're living in. And we're
Speaker 1: gonna do that because I think it's important and the
Speaker 1: folks who I make this show with at I heard
Speaker 1: and twenty three and Me gave me the keys. I
Speaker 1: could say whatever I want, y'all. In the past few years,
Speaker 1: I have started to question how the system is set up.
Speaker 1: Do I really need to disclose as much about myself
Speaker 1: as I have been in order to live a quality life.
Speaker 1: At the exact time that I was approached to host
Speaker 1: this show, I was really coming into my own as
Speaker 1: a critic of technology. So I couldn't just say yes
Speaker 1: to a show sponsored by a genetic testing company. I
Speaker 1: had to do my research, and I read the terms
Speaker 1: of service myself from front to back, which were very readable.
Speaker 1: To my surprise, I had some privacy oriented activist friends
Speaker 1: take a look and they said, you know, this is
Speaker 1: pretty good. In fact, I demanded to speak with the
Speaker 1: highest level people at twenty three and Me before I
Speaker 1: would agree to do the show, because I wanted to
Speaker 1: understand what they were doing to protect the information about
Speaker 1: me that they had, and to use it in a
Speaker 1: responsible way that I would always feel like I had
Speaker 1: some choice and some agency in that matter. I got
Speaker 1: onto the product because I trusted the representation of what
Speaker 1: that product was, and I have personal curiosity. My older
Speaker 1: sister had recently done a twenty three in me, and
Speaker 1: she was curious about my results because we don't share
Speaker 1: a father. So there's some mystery in there that science
Speaker 1: might help resolve. But this episode returns to that original
Speaker 1: hesitation I had about doing this show, that question what
Speaker 1: happens with our information? And this show is not just
Speaker 1: about twenty three and me and my information in those
Speaker 1: terms of service. It's actually a bigger view. We're gonna
Speaker 1: take on what it means to be connected in this
Speaker 1: data driven world and what some of the costs are
Speaker 1: on a security level, what does it mean to try
Speaker 1: to have people sponsibly hold our data, and on a
Speaker 1: larger system level, with artificial intelligence and algorithmic recommendations on
Speaker 1: everything from what we buy to how many years we
Speaker 1: might face in the criminal justice system. This stuff really matters.
Speaker 1: So I'm happy you're joining me. I have two other
Speaker 1: people to join me. Gina Matthews is a computer science
Speaker 1: professor whose research focuses on algorithmic decision making, on bias,
Speaker 1: on accountability, on essentially what we do with all the
Speaker 1: data that we've collected. She was a fellow at the
Speaker 1: Data in Society Research Institute. She received Magic Grant, which
Speaker 1: is the best type of grant to receive the Magic
Speaker 1: Grant from the Brown Institute for Media Innovation. Gina, Welcome
Speaker 1: to the show. Thanks so much for having me. Thank you.
Speaker 1: And we also have ri E L. Silverstone. He is
Speaker 1: a data privacy and security expert. He spent the past
Speaker 1: twenty five years focusing on really complex security processes and
Speaker 1: policies for all kinds of organizations, including companies that work
Speaker 1: with genetic information. His title is Incredible External Data Protection
Speaker 1: Officer and Managing Director at Data Protectors. Thank you so
Speaker 1: much for being here. Thank you for I'd like to
Speaker 1: start with you, r L. Because I think there's information
Speaker 1: that's about us, that's in systems and I want confidence
Speaker 1: to know that it is being managed responsibly and securely.
Speaker 1: And then further downstream, there's what we do with that information.
Speaker 1: On this first point on securing the data, what's an
Speaker 1: external data protection officer? So we bring the people together
Speaker 1: that can protect data best. There is such a lack
Speaker 1: of professionals with experience in the world, so we teach
Speaker 1: on companies how to protect their data. We also interact
Speaker 1: between the company and data protection authorities, especially in Europe,
Speaker 1: and advise them on how to solve for demanding situations. Okay,
Speaker 1: so you're really deep in there. How did you come
Speaker 1: to this field? A few years ago? I was in
Speaker 1: the middle of the computer revolution in Silicon Valley. What
Speaker 1: do you mean you were in the middle of it.
Speaker 1: So I went to high school in California, So you
Speaker 1: were literally in the middle of in the middle. Yeah.
Speaker 1: So I got very interested in computer science and security
Speaker 1: and privacy back when I was fourteen. Did something happen
Speaker 1: when you were fourteen to get you interested in this.
Speaker 1: It's my high school. Some students were contacted by the FBI, okay,
Speaker 1: because they were doing things they weren't supposed to do
Speaker 1: and freaking and hacking like early hacking days. So the
Speaker 1: word hacking is actually good. It's the freaking that's not good. So,
Speaker 1: and just to clarify, freaking is when people are getting
Speaker 1: unauthorized access to the phone network. Yes, you were saying,
Speaker 1: the FBI based some calls to more than calls. The
Speaker 1: FBI showed up in front of some of my schoolmates
Speaker 1: and they had some splaining to do because they were
Speaker 1: usually computers to do things that people didn't think they
Speaker 1: could or would do. And that's all we do in security.
Speaker 1: Your job is to decide what you could do with
Speaker 1: the computer, or what you should do with the computer.
Speaker 1: My job is what you shouldn't do. So since then
Speaker 1: you've been on the journey that's got you now at
Speaker 1: data protectors. But with some of the other type of
Speaker 1: risks you've been exposed to. Your problems you've seen in
Speaker 1: terms of trying to secure computer systems. Sure, so many
Speaker 1: people don't know how to secure computer systems, not because
Speaker 1: of evil, but because they just don't know. So they're
Speaker 1: looking for people to teach them. And opinions vary. But
Speaker 1: I've seen where data was used for bad for example,
Speaker 1: to human trafficking, for example, to affect a balanced transfer
Speaker 1: within the bank. But I've seen more computers and computer
Speaker 1: security really affect people. For example, one of the systems
Speaker 1: I was responsible for control the temperature of heart lung
Speaker 1: machines at hospitals. Imagine if that computer just shut down
Speaker 1: for no reason, people could die. One other questions that's
Speaker 1: been on my mind every day because I opened up
Speaker 1: my news app and I see the same story. I
Speaker 1: see organization company government entity X has lost millions of
Speaker 1: personal records of category. Why social security numbers, phone numbers,
Speaker 1: bank records, entire social media profiles. Why does this continue
Speaker 1: to happen Because companies generally see data protection as attacks
Speaker 1: and they like paying tacts as much as you and I,
Speaker 1: So they do either the bare minimum needed or they
Speaker 1: are very sensitive for security elect twenty three and me
Speaker 1: because they know they wouldn't have a business if there
Speaker 1: was a break. Then they invest more resources and make
Speaker 1: it the higher priority. That's it is. It's cost them money,
Speaker 1: and then many of them don't want to spend it.
Speaker 1: So that's the primary one. The secondary one is, look
Speaker 1: a security people, we've got to be right a hundred
Speaker 1: percent of the time. A hacker only has to be
Speaker 1: lucky once, so processes have to be fixed. Well, I'm
Speaker 1: glad someone like you is helpfully on the job. I
Speaker 1: want to bring you in Gina. I'd love for you
Speaker 1: to explain someone we know a bit from arial how
Speaker 1: he got started. What was your introduction to computers and computing?
Speaker 1: How did you end up in this field? I added
Speaker 1: computers and computing as a second major when I was
Speaker 1: an undergrad. Once I started with programming, I just really
Speaker 1: liked the instant gratification nature of it, the ability to
Speaker 1: change something and and also just build a whole world
Speaker 1: that you wanted to build. I went to graduate school
Speaker 1: at UC Berkeley, which also was kind of the heart
Speaker 1: of the dot com boom there in Silicon Valley, and
Speaker 1: was super excited about the potential of computing. I felt
Speaker 1: like it was kind of a fundamental human good. It
Speaker 1: was automating tasks that were drudgery, it was connecting people,
Speaker 1: was giving more people voice. I just felt super good
Speaker 1: about it. And then over time I just saw more
Speaker 1: and more uses. Not that those other uses ceased to exist,
Speaker 1: but I saw the funded uses, the pushed uses, drifting
Speaker 1: more and more to surveillance and manipulation. Over time, I
Speaker 1: just felt more and more compelled to try to do
Speaker 1: something to change that direction. On the front end of
Speaker 1: your career, your hands on with computing, and now you
Speaker 1: are hands on with trying to shift the direction of computing.
Speaker 1: But how does that early access, in that early atmosphere
Speaker 1: shape your perspective? Now it's interesting. I went to a
Speaker 1: twenty year reunion of my grad research group. I have
Speaker 1: a lot of academic siblings who are very highly placed
Speaker 1: at big companies, and some of them will even say
Speaker 1: I'm basically just a network plumber. I mean, they're, you know,
Speaker 1: incredibly talented systems building folks, but they feel very distant
Speaker 1: from the impact of those platforms and systems on the
Speaker 1: lives of individuals. I just can't do that. I've been
Speaker 1: a system builder and I enjoyed that very much, and
Speaker 1: I've been a security expert type person. But making the
Speaker 1: cargo faster and locking the car down into its current
Speaker 1: course doesn't seem to make a lot of sense when
Speaker 1: you don't agree with the way it's being driven. Can
Speaker 1: you explain kind of your approach on this topic, and
Speaker 1: especially around big data systems or algorithms. What is your
Speaker 1: role in this? I think we're right to worry about
Speaker 1: accidental breaches or hackers getting in and taking data, but
Speaker 1: I'm honestly more concerned about things that I consider to
Speaker 1: be unacceptable that are perfectly legal. Um. Just today, it's
Speaker 1: interesting I read uh that France is banning analytics on
Speaker 1: judges decisions. It's interesting, right, that's public information, So the
Speaker 1: pattern of decisions that judges make, they don't want people
Speaker 1: doing analytics on that. It's the same kind of thing
Speaker 1: when that happens to you and you realize it's not
Speaker 1: just little pieces of data, but people are stringing it
Speaker 1: together into big conclusions about your life. You feel violated,
Speaker 1: and this kind of let us surveil you, let us
Speaker 1: analyze you, but don't you dare do it to us
Speaker 1: is a pattern I'm not at all happy with. So
Speaker 1: I worry about the wild west of surveillance and manipulation
Speaker 1: of individuals, and especially about big decisions that are made
Speaker 1: about people's lives based on the little pieces of information
Speaker 1: about them that make up big data. Do you think
Speaker 1: that enough people understand the balance and the tradeoff that
Speaker 1: we're making. I think there are decisions I've made historically
Speaker 1: where I just didn't think about it. I was happy
Speaker 1: to get the free storage from the service. I was
Speaker 1: happy to get a discount or coupons from the grosser.
Speaker 1: How do you see awareness of that balance or the
Speaker 1: ability to challenge it developing over time. I think a
Speaker 1: lot of people are uneasy with it, but don't see
Speaker 1: an effective way to be a citizen of the modern
Speaker 1: world without it, because we haven't demanded a different playing field.
Speaker 1: The boundary for invasion of privacy really shifts over time.
Speaker 1: A photo of me posted, is that invading my privacy?
Speaker 1: You think? With facial recognition, you can find anybody. And
Speaker 1: what if I'm just in a picture someone took someplace.
Speaker 1: Do you think just your location information is personal data?
Speaker 1: It's just longitude latitude. But if you assemble that over time,
Speaker 1: you see where you work, where you live. Do you
Speaker 1: go to a religious institution, do you go to a psychiatrist?
Speaker 1: So many things that you might think are not private
Speaker 1: become private with more ability to analyze and link it
Speaker 1: with other types of information. So I want to play
Speaker 1: a game with both of you. I call it what's
Speaker 1: the worst that can happen? And so I'd like your
Speaker 1: imaginations and your experience to be brought to bear on question.
Speaker 1: I'll start with you R. E. L. There are theoretical
Speaker 1: risks associated with data breaches and hacking, and then there's
Speaker 1: things that actually have happened. What are the risks that
Speaker 1: most concern you? Where are the multiple alarms ringing in
Speaker 1: your business and in your life? That's a great question.
Speaker 1: So Number one, most of our data, our name in
Speaker 1: the US, even our picture, if it becomes hack. So
Speaker 1: what I mean? We used to have that in the
Speaker 1: phone books. We used to have it in our high
Speaker 1: school yearbooks. We printed it in a physical thing called
Speaker 1: the Facebook. So we have points of data that are
Speaker 1: out there. The points of data by themselves do absolutely nothing.
Speaker 1: I can even give you a copy of your d
Speaker 1: n A, but it doesn't mean anything to anyone because
Speaker 1: there's no context. When there is context, and when the
Speaker 1: data can be made to do things it wasn't mean
Speaker 1: to be, for example, not a GPS location, but the
Speaker 1: GPS location for time, which shows you how you're going
Speaker 1: around the city of London, for example. So when that
Speaker 1: is out there, not only can it be marketed to
Speaker 1: provide you things air quotes, but it is also dangerous
Speaker 1: because of two things that people don't normally think about.
Speaker 1: The first one is anticipating what you're going to do.
Speaker 1: So it's a big company knows that there are thirty
Speaker 1: year old single people in this building, they're more likely
Speaker 1: to offer lattice there. But the biggest strengths there is
Speaker 1: no technology today that would act to limit them trying
Speaker 1: to change you or your preference. So not just anticipating
Speaker 1: but I want, but creating what I want, manipulating right,
Speaker 1: and it actually exists right. We used to call it marketing,
Speaker 1: but in the future it can actually go into the
Speaker 1: psychological realms. You have more and more data. You can
Speaker 1: literally get into a situation that you're being manipulated to buy,
Speaker 1: to sell, or to do any other action good or bid. Right,
Speaker 1: that's pretty scary. You're playing a game very well, thank you.
Speaker 1: It's the terrifying future, Gina. Do you want to jump
Speaker 1: in on what's the worst that can happen? What are
Speaker 1: the grounded fears and concerns that you have based on
Speaker 1: your experience in the series. I love this game, and
Speaker 1: in fact I play this game exactly when I give
Speaker 1: talks about this. The thing that I think in fact
Speaker 1: is happening to you and is super important is big
Speaker 1: decisions made about your life based on that big data.
Speaker 1: Will you have access to credit? Will there be police
Speaker 1: in your neighborhood? Will you even hear about a job
Speaker 1: that's available. How will your performance on a job be rated?
Speaker 1: Will your insurance rates go up? Will you have access
Speaker 1: to a university? Big, big decisions about our lives are
Speaker 1: being made with little pieces of information that we cannot
Speaker 1: anticipate the risk of your insurance rates go up? If
Speaker 1: you purchase plus size clothing, what have you purchasing for
Speaker 1: somebody else? Your interest rates go up if you charge
Speaker 1: marriage counseling, because you know that could have a big
Speaker 1: financial impact on your life. There's lots of little things
Speaker 1: that you don't have any way of anticipating the outcome
Speaker 1: it could have. Well, follow up question on the insurance
Speaker 1: rates and plus size clothing, can you explain that a
Speaker 1: little further because I did not know that. Yeah, so
Speaker 1: information about your purchasing habits can be shared with insurance companies.
Speaker 1: Just like when you go to get a job, you
Speaker 1: can voluntarily sign away rights for them to look at
Speaker 1: your credit history, your social media history. When you're trying
Speaker 1: to get into the country and get a visa, there's
Speaker 1: many times you can say no, but if you want
Speaker 1: that job or you want that visa, you might have
Speaker 1: to say yes. And then you have voluntarily given people
Speaker 1: access to all sorts of deep wells of information about you.
Speaker 1: That's a perfect segue to my personal experience with this.
Speaker 1: I went on this data detox journey where I basically
Speaker 1: collected all the information that had been collected on me.
Speaker 1: It's a big social platforms search engines, credit agencies, data brokers.
Speaker 1: I found people with profiles of me that I've never
Speaker 1: heard of, and a lot of the information was inaccurate.
Speaker 1: I was frustrated by that because I thought, well, you're
Speaker 1: supposed to be big tech, you're supposed to know all
Speaker 1: these things. But I was also relieved because I'm like,
Speaker 1: thank goodness, they got that wrong. But then I'm like,
Speaker 1: but they're going to make these big life decisions, Gina
Speaker 1: that you're talking about. Do I want them making those
Speaker 1: decisions based on accurate information about me or inaccurate information
Speaker 1: like what is best for me? You know, Yeah, you
Speaker 1: tell me, you guess correctly and it's private information, or
Speaker 1: you guess incorrectly and you make an illegitimate decision about me.
Speaker 1: And this is another fact. If you don't participate in
Speaker 1: data collection, then people will make decisions about you based
Speaker 1: on people that they determined to be like you for
Speaker 1: whatever definition that is. Yeah, these are what shadow profiles
Speaker 1: that some companies create to kind of mimic the population
Speaker 1: that doesn't necessarily have an account with them, but they
Speaker 1: can still be re presented in a database. Sometimes we
Speaker 1: call them avatars, even though they don't have a picture.
Speaker 1: But there are some companies out there that create an
Speaker 1: avatar that knows to some degree what you're going to buy.
Speaker 1: Next week, next year, which is why the intent behind
Speaker 1: the g d PR in Europe was to give people
Speaker 1: the right to rectify their data and also declaration where
Speaker 1: companies got that data. You brought up g d p
Speaker 1: R R E L and this is the general Data
Speaker 1: Protection regulation rules set across the EU that a lot
Speaker 1: of us experienced through new pop ups on websites we
Speaker 1: visited and forcing us to acknowledge a very legal sounding
Speaker 1: thing would have been the practical results of g d
Speaker 1: p R, you know, in terms of what you just described.
Speaker 1: So here's the situation out there. G DPR has been
Speaker 1: in effect for a year. There's over three hundred thousand
Speaker 1: cases in Europe involving either complaints from individuals or data
Speaker 1: breaches data bridges about nine There's more than fifty six
Speaker 1: million euros and penalties already levied in the first year.
Speaker 1: Presumably is going to be much much higher. The law
Speaker 1: has been created to some degree because they wanted to
Speaker 1: get to a point where a potential penalty will be
Speaker 1: painful for those organizations. All right, So we've got a
Speaker 1: lot more complaint activity, We've got some fine levying activity.
Speaker 1: Do you see a shift in actual behavior by companies yes, absolutely,
Speaker 1: So I see behavior shift in two different areas. First,
Speaker 1: in Europe, people are asking a lot more questions. The
Speaker 1: individual citizen rate is more aware and they're asking more questions.
Speaker 1: And companies that before didn't have a data protection officer
Speaker 1: now does. So there's over half a million data protection
Speaker 1: officers in Europe right now. Full employment for data protectors,
Speaker 1: well there's only seventeen licens professionals. But so I'm hearing
Speaker 1: a great job opportunity here for those For those that
Speaker 1: you're looking for a new field to get into data
Speaker 1: protector growing market, go ahead, absolutely. But the exciting changes
Speaker 1: in the US. There are companies in the US that
Speaker 1: have never worried about data protection to that level, but
Speaker 1: now if they play in Europe, they have to play
Speaker 1: by European rules. In the US, many companies have started
Speaker 1: asking questions they never asked before. How do I protect
Speaker 1: the data so I won't get fine? How do I
Speaker 1: protect the data so I won't be in the newspapers?
Speaker 1: And how do I protect the data so customers will
Speaker 1: not stop buying for me? Well, that sounds like a
Speaker 1: good story, and I'd love to hear Gina from you.
Speaker 1: We've gotten shaken a bit by the negative possibilities. But
Speaker 1: what are you seeing in terms of a shift in
Speaker 1: a better direction, Whether it's you know, how we put
Speaker 1: some limits around the recommendations and algorithms and these big
Speaker 1: life decisions that are going to affect so many of us,
Speaker 1: Where is the oversight emerging from at I think the
Speaker 1: GDPR is a good first experiment in this space. I'm
Speaker 1: happy to see it. I think in the academic community,
Speaker 1: in the practitioner community, there's a lot of discussion about
Speaker 1: things we can do and that's a step in the
Speaker 1: right direction. So things like explainable AI algorithms so that
Speaker 1: it's not just a recommendation based on machine learning with
Speaker 1: big data that can't be explained. You can link it
Speaker 1: back to a particular data point and its weight in
Speaker 1: the decision. Doing things like looking at the demographics of
Speaker 1: the training data, there's ways to look for patterns of
Speaker 1: bias in decisions. Algorithms and systems developed and tested on
Speaker 1: a certain demographic are not going to automatically perform well
Speaker 1: on another. One of the things that emerges is how
Speaker 1: old this challenge is. I remember learning that the medical field,
Speaker 1: in terms of both treatments and drug development as is
Speaker 1: very long history of using the male body as the
Speaker 1: default human. Every recommendation, dosage is treatment. We're all designed
Speaker 1: for this kind of average male body, and it turns
Speaker 1: out that's not the average body in the world. There
Speaker 1: are many different types of bodies, and we're going back
Speaker 1: and people are kind of filling in the blanks. When
Speaker 1: I'm hearing you talk about opting in and having more
Speaker 1: accurate systems, having blanks in the data set, it seems
Speaker 1: to me that a we want a representation of as
Speaker 1: many as possible in this tool that's defining our whole future,
Speaker 1: so long as be it's paired with a level of accountability, oversight,
Speaker 1: correct ability, you know, in terms of we're going to
Speaker 1: find mistakes. No systems ever perfect, but do we have
Speaker 1: a mechanism to correct those mistakes and serve people in
Speaker 1: the process. But to count on the will of a company, Plus,
Speaker 1: it doesn't feel like a good long term plan for humanity.
Speaker 1: That's exactly the right. As human beings, we stink in
Speaker 1: self regulation just not gonna happen. Plus, look, the principles
Speaker 1: are simple. First principle is transparency. Here's what I'm going
Speaker 1: to collect from you, and here's why then there's the
Speaker 1: accountability actually do only the things I said I'm going
Speaker 1: to do, and then rectification. You've got to know about
Speaker 1: something that is wrong about your data. If you don't know,
Speaker 1: you can't fix it, and then your ability to both
Speaker 1: correct it or have it deleted. I think surveillance is
Speaker 1: sold to people based on the ability to benefit their lives,
Speaker 1: but then they don't necessarily get that in return. Like
Speaker 1: for example, I was just at a conference AI for
Speaker 1: Good in Geneva. We're talking about for all sorts of
Speaker 1: potential great things like waste in our food distribution systems,
Speaker 1: or the ability to get better medical care, to reduce
Speaker 1: inefficiencies our transportation system. That still doesn't mean that it's
Speaker 1: going to benefit the people that you surveil and manipulated
Speaker 1: to get it. I think we need better answers than
Speaker 1: companies just out of the goodness of their heart, returning
Speaker 1: to people that efficiencies that come from artificial intelligence and
Speaker 1: machine learning and big data and algorithms. People think that
Speaker 1: we're going to share the benefits, but I don't think
Speaker 1: that we have a structure to really enable the sharing
Speaker 1: of those benefits right now. I agree. I would like
Speaker 1: to give us an example, a real example of something
Speaker 1: that takes place today, and then I would like to
Speaker 1: suggest the solution. Guess this is perfect, My co host
Speaker 1: are l here taking us to the next level. I
Speaker 1: think the solution will actually come with the help of
Speaker 1: big tech companies like twenty three and meet now have
Speaker 1: an incentive to request an overarching privacy framework in the
Speaker 1: United States. Why well, the gdp R is all for Europe.
Speaker 1: But in the US, the privacy laws that exists, and
Speaker 1: there are many of them, more than a hundred and
Speaker 1: twenty exists the level of a city, a county, or state.
Speaker 1: But the company, like the ones I mentioned, we cannot
Speaker 1: expect them to comply with something like seventeen thousand different
Speaker 1: jurisdictional privacy laws. If every one of them is going
Speaker 1: to be different from every other, there's no way to
Speaker 1: comply with that. So they should champion, using their big budgets,
Speaker 1: a situation where the US Senate the US Congress comes
Speaker 1: together and makes a countrywide national privacy framework with a
Speaker 1: national agency that regulates privacy because right now in the
Speaker 1: US that's just the FTC and they have a day job.
Speaker 1: I wanna remember some of the good things I asked
Speaker 1: you what the worst case scenario was there there was
Speaker 1: a flying game. I want to ask you, what's the
Speaker 1: best case scenario? How would we operate if you had
Speaker 1: your say completely or at least a bit more arial.
Speaker 1: What's the best that could happen? Well, best solution would
Speaker 1: be for everyone to be aware of his or her
Speaker 1: value and also have their profile with certain bits, perhaps censored,
Speaker 1: stored in a digital way for which they can give
Speaker 1: access when they want the access to be given about
Speaker 1: what they want the access to be given. Right again,
Speaker 1: not to mention everything about Europe is great, because they
Speaker 1: certainly have their own challenges. In Europe, there's a new
Speaker 1: law called PSD two PC. The two allows people to say, okay,
Speaker 1: my bank has such such information about me. If an
Speaker 1: insurance company wants to see my data from my bank,
Speaker 1: they got to ask me to approve or disapprove or
Speaker 1: automatically disapproved the sharing of the data. To make it easy,
Speaker 1: it's tied to people's cell phones, for example, So you
Speaker 1: get a text the company wants to get your data,
Speaker 1: and then you approve. Then they can make something ideally
Speaker 1: better tailored to you. Now, the distance to get there
Speaker 1: in the US is a bit long. But that's one example. Gina,
Speaker 1: what's the best that can happen? Well, I think that
Speaker 1: there's a lot of potential for optimizing our world. I mean,
Speaker 1: our transportation system could use a lot of efficiency gains,
Speaker 1: our food distribution system could use a lot of efficiency gains,
Speaker 1: connecting people, getting people the information they need just in time,
Speaker 1: helping us navigate our world find things. There's a lot
Speaker 1: of power there. It's often powerful for both good and ill.
Speaker 1: We don't look at both sides. We need a collective
Speaker 1: will to say to turn technology to the uses we
Speaker 1: want and prevent it in cases we don't. And really
Speaker 1: that has to be done with legislation or some kind
Speaker 1: of collective control. I'm worried about big decisions made algorithmically
Speaker 1: about people's lives, but human decision making is no picnic either.
Speaker 1: People make a different decision before lunch and after lunch
Speaker 1: they make snap decisions based on crazy things. We haven't
Speaker 1: exactly been following hiring law anyway. If you see a candidate,
Speaker 1: you can make a biased decision based on gender or
Speaker 1: race or disability status and not admit you're doing it.
Speaker 1: But people at least do grow they consider other information.
Speaker 1: You can appeal to them. You can convince them to
Speaker 1: move forward and progress. Artificial intelligence systems, machine learning systems
Speaker 1: put inside a black box are institutionalizing the past. People
Speaker 1: think they're really progressive. I see a great potential for
Speaker 1: a mix of human decision making and automated decision making
Speaker 1: where people are deployed not to rubber stamp decisions, because
Speaker 1: that's a bad use of people. They just blank out
Speaker 1: and don't really engage on every decision, but to debug decisions.
Speaker 1: But that is going to mean incentivizing teams of people
Speaker 1: to actually find problems, and no company is going to
Speaker 1: be truly incentivized to find problems in their system. So
Speaker 1: we need adversarial testing, We need access to data. We
Speaker 1: need to ask the question, what is going to incentivize
Speaker 1: this to get better? Because there's so many systems. I've
Speaker 1: been doing a bunch of work in criminal justice systems,
Speaker 1: and in criminal justice systems, if they're making the wrong decision,
Speaker 1: you know what, they say, you're just complaining because you're guilty.
Speaker 1: It's not like a bug in your iPhone that a
Speaker 1: bunch of people report and eventually it goes away, even
Speaker 1: though in your world it feels like you're the only
Speaker 1: one that sees this bug and no one else does.
Speaker 1: In things like criminal justice, there may be no incentive
Speaker 1: for it to get better unless we force transparency and
Speaker 1: accountability and adversarial testing and things like that, which we're
Speaker 1: not doing well. I feel like we're making some progress.
Speaker 1: I think that I definitely was frightened a bit by
Speaker 1: some of the visions you've painted in some of my
Speaker 1: own experience and research in this area. I even think
Speaker 1: privacy is often not the best word to describe what
Speaker 1: we're really getting into. For me, it's words like permission, consent, sovereignty, agency,
Speaker 1: self determination. Building those into the system as well is
Speaker 1: a necessary evolution of this whole platform. Can we layer
Speaker 1: in that level of accountability, transparency, adversarial testing so that
Speaker 1: the benefits of these systems accrue to more and that
Speaker 1: we're highlighting and reducing the downside so we can maximize
Speaker 1: all the good stuff that we know it's possible. We
Speaker 1: have a long long way to go and the world's
Speaker 1: moving fast. This is not going to happen automatically. Listeners
Speaker 1: should not be like, oh, there's a lot of ways
Speaker 1: we know how to do this. It'll just happen if
Speaker 1: we're patient. That's my point is that where we are
Speaker 1: used to computer systems improving in this way, they will
Speaker 1: not improve unless we fight for it. I think there's
Speaker 1: this famous quote like the arc of history is long,
Speaker 1: would have been towards justice. Big statement. I don't know
Speaker 1: where it was originally stated, but I also don't think
Speaker 1: it's quite true. I think people bend it towards justice,
Speaker 1: And there's constantly in every era of technology, in every
Speaker 1: age of any society, you gotta fight for your freedom.
Speaker 1: You've got to put in the work and not assume
Speaker 1: that a firm more updates just gonna come along with
Speaker 1: rights installed, right, with dignity installed, with respect installed, saying no,
Speaker 1: we're gonna have to argue for that, and constantly agitate
Speaker 1: for it and fight for it and ask better questions
Speaker 1: even if the answers aren't already right there. Doing this
Speaker 1: kind of conversation is definitely helping me see that picture
Speaker 1: even more clearly. Are Yeah, but there's one thing that
Speaker 1: every company can do, and we should demand the company. Okay, yes, so,
Speaker 1: first life cycle. Everybody knows the term life cycle. How
Speaker 1: does life end with death? Companies that collect data frequently
Speaker 1: forget the last step in the life cycle. So I've
Speaker 1: seen companies that keep data, sometimes even credit card data.
Speaker 1: There's twenty years old. What are you gonna do with
Speaker 1: the twenty year old credit card data? You take that fact,
Speaker 1: and you take the fact that again, I hate to
Speaker 1: be cheerleader for the GDP are alone, but I see
Speaker 1: your side job here. It's literally cheerleader for the GDPR.
Speaker 1: But the thing is, the GDP also requires companies to
Speaker 1: make sure the data is always up to date. So
Speaker 1: since data, once it's put on the internet rarely does,
Speaker 1: it's up to organizations to do automatically ideally deleted data.
Speaker 1: When you collect the data, decide how long it's going
Speaker 1: to live. The companies also get a lesser requirement to
Speaker 1: spend money. I'm aware. For example, one company in the
Speaker 1: US deleted some five yota bytes of data because they
Speaker 1: had that much data historically. I know a lot about computers,
Speaker 1: but YadA bites. I think I've heard that once in
Speaker 1: my life. That's just a lot, right, It's just a
Speaker 1: technical term for like a lot. Hold, Okay, well, I mean, look,
Speaker 1: you think about there is a natural incentive I think
Speaker 1: for organizations to just minimize liability. Data is seen as
Speaker 1: the new oil in some circles, as the currency, as
Speaker 1: this thing of value, but it's also a liability. Now,
Speaker 1: this is a personal question for you are because we
Speaker 1: spoke briefly about this, I want to bring it back
Speaker 1: down to individual level and data because you Mr. External
Speaker 1: Data Protection Officer, Mr. I've been in computer security since
Speaker 1: I was fourteen years old. You've used twenty three and me.
Speaker 1: I do, and we rarely actually have people on the
Speaker 1: show talking directly about this service in particular. But I'm
Speaker 1: just curious why you chose to use the service and
Speaker 1: what you got out of it. When I was growing
Speaker 1: up in Israel, I only have the twelve for relatives
Speaker 1: in my family tree. My grandparents never talked about Europe
Speaker 1: before the Holocaust. They didn't want to remember. At a
Speaker 1: certain point, I felt a little bit ungrounded, so I
Speaker 1: used twenty three and ME and I found some hints
Speaker 1: for geographical distribution of my family. A year later, I
Speaker 1: was in poland decided to go with the investigators from
Speaker 1: archives and to look up things and careful what you
Speaker 1: wish for Today I have about thirteen thousand blood relatives.
Speaker 1: Is not aware of there were second cousins living next
Speaker 1: door or one straight over that I didn't know existed,
Speaker 1: and now they do and we're planning a reunion. But
Speaker 1: it's hard to plan a reunion for people. Yes, that's
Speaker 1: called a festival. That's right. Then we're gonna give shirts out.
Speaker 1: So I have family in Australia, in the US, of course, Canada, Israel,
Speaker 1: but I also have relatives in Uruguay, in Switzerland and
Speaker 1: in many other countries. And now I have a family
Speaker 1: that's beautiful, thank you. But before I used them, I
Speaker 1: did my own assessment. I want to disclose exactly everything
Speaker 1: I did, but but I certainly got to a comfort level.
Speaker 1: And one of those things is the simple fact that
Speaker 1: before they share your data with anyone, they ask your permission.
Speaker 1: If you agree, then they share the data points that
Speaker 1: you agree to share health or to be just familiar
Speaker 1: with the people that you want them to share it with.
Speaker 1: You have the control now in the world of the
Speaker 1: identified data. In other words, when they collect two million
Speaker 1: genomes and they find certain probabilities or discoveries or what
Speaker 1: have you, I'm happy for my DNA to be used
Speaker 1: for that. Maybe they'll find a better pill for me
Speaker 1: and I can grow hair again. But before I used them.
Speaker 1: I did my own due diligence. That's similar to my story.
Speaker 1: I looked into it and I was like, Okay, I'm
Speaker 1: good with this. There are parts of it that I'm
Speaker 1: sure I maybe won't be so great with down the line.
Speaker 1: I'll be vigilant and try to pay attention and look
Speaker 1: out for that possibility. But for what I've gotten out
Speaker 1: of it, it felt like a choice that I was
Speaker 1: willing to make. And I think as we start to
Speaker 1: wrap this up and think about what needs to happen,
Speaker 1: it sounds like there's three levels of activism and engagement.
Speaker 1: There's the individual. We should all be better about knowing
Speaker 1: what we're signing up for, and to the extent that
Speaker 1: we have a choice to not sign up, exercise that choice.
Speaker 1: I know in some cases it's really more compulsory, but
Speaker 1: where you can exercise that. Then there's the companies, the
Speaker 1: people who are actually holding all this information making their
Speaker 1: decisions and who won't always make good decisions out of
Speaker 1: the goodness of their heart, and so making sure that
Speaker 1: they are more accountable, incentivized in a structured way. And
Speaker 1: then there's our g d p R cheerleader over here.
Speaker 1: I will never let me forget that government at a
Speaker 1: national level and potentially even international as the Internet knows
Speaker 1: no bounds, but certainly at national levels needs to act
Speaker 1: and step in because right now, without an enforcement mechanism,
Speaker 1: it's hard for us to feel protected. It's actually hard
Speaker 1: for companies too, maybe who want to do the right
Speaker 1: thing to have a simple way to try to execute that.
Speaker 1: Am I'm missing something in my attempt to kind of
Speaker 1: synthesize everything in a paragraph, as far as what else
Speaker 1: our listener needs to know about how to get to
Speaker 1: the next step. First of all, it's your If you
Speaker 1: don't care about there, it's freely don't expect others to
Speaker 1: protect it for you. The second bit is this, every
Speaker 1: time you get a frequent flyer card, any kind of
Speaker 1: loyalty card, yeah, think about what it is you're giving up.
Speaker 1: There are some things for which sharing data is perfect,
Speaker 1: but in the reality of what you have is a
Speaker 1: situation where your data is offered to roughly two million
Speaker 1: websites every time you open the search, decide what it
Speaker 1: is you want, and go find out who has it.
Speaker 1: It's not as hard as it was a year ago,
Speaker 1: but you have to take the first time. Gina Is
Speaker 1: there any extra advice you want to offer to our listener.
Speaker 1: Don't underestimate the power of showing up and asking questions
Speaker 1: and writing and expressing your opinion and caring. There's not
Speaker 1: nearly enough of that, and there's a lot of stuff
Speaker 1: happening that really could use some eyeballs and some comments
Speaker 1: and some outrage here here. I would second that, and
Speaker 1: I want to thank both of you for showing up,
Speaker 1: are asking questions, for sharing your opinions, and for so
Speaker 1: clearly caring. Thank you for doing this special podcast, and
Speaker 1: thank you for giving these issues this platform in voice.
Speaker 1: I want to dig in more on today's topics and guests.
Speaker 1: Check our show notes, and if you enjoyed the episode,
Speaker 1: share it with a friend, all your friends, and be
Speaker 1: sure to leave a review. If you want more surprising
Speaker 1: stories about how we're all related, search and follow Spit
Speaker 1: on iHeart Radio or subscribe wherever you listen to podcasts.
Speaker 1: Spit is an i Heeart radio podcast with twenty three
Speaker 1: in me. I'm Barraitune Day Thurston. You can find out
Speaker 1: more about me at bartune Day dot com or on
Speaker 1: social media wherever Barraitune Days are found.