Cybersecurity Vault - The Ethical Risks of Privacy

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, cybersecurity strategist and CISO at Eclipse. Today we're going to talk about the ethical risks of privacy. My guest is Reid Blackman, and Reid is the founder and CEO of Virtue Consultants, an AI ethical risk consultancy. He's also the author of a new book, Ethical Machines, as well as the former professor of philosophy at Colgate University and research fellow at UNC Chapel Hill. And I've worked with Reid in the past, and trust me when I say he's absolutely brilliant, and I love debating things like this with him. So today's podcast is created in part by Eclipse, securing data in transit through any cloud, network, or device. Welcome, Reid. Thank you for coming and talking today.

Yeah, thanks for having me. I mean, the problem is I'm already intimidated because your podcast voice is obviously better than mine.

It's my only advantage.

Very good.

Very good.

I've got nothing.

Okay, so ethics, privacy. Is there always a risk —when we're talking, is there an ethical risk when it comes to privacy? Give me your insights.

Is there an ethical risk when it comes to privacy? Yeah, look, I take it that all else equal, if there's a violation of privacy, then something ethically wrong has occurred. It's an ethical bad. Someone's probably done something ethically wrong. Someone may be blameworthy for things having gone wrong. So yeah, of course, if there's a violation of privacy, then there's an ethical issue on the table. I take it that privacy concerns are a subset of all ethical concerns.

So what are those big challenges? I mean, what are the big risks if we have privacy, you know, from a technology perspective is being undermined or, you know, regulations aren't being followed or basic human rights or something like that? Where is the technology world right now and what are those risks to our end users?

All right, so I'll articulate the sort of what I take to be two of the— is this right? I think two of the major risks, at least on one account of why these things are ethically problematic. As I sort of told you before, I'm not sure that I agree with the mainstream way of thinking about privacy, but I can talk mainstream conception of privacy or ethical conceptions of privacy. And then if we want to poke around if that's really the best way to think about it, we can do that. All right, so let's think about in the context of of AI or machine learning in particular. Because that sort of— there's a way in which I think this is fair to say that machine learning— sorry, that data ethics is a subset of machine learning ethics insofar as all machine learning requires a tremendous amount of data. So the ethical issues that pertain to machine learning will surely include, among other things, the ethical issues that pertain to data. All right. So you're in an organization, you're either procuring machine learning or AI solutions, you're designing them in-house, If you're gonna do that, you're gonna need a tremendous amount of data. Now, often that data is about me and you and everybody else in the world. It's about people. Not always, sometimes it's about what your dog looks like, but oftentimes it's data about people. And it could be the case that possession of that data, as such, constitutes a violation of someone's privacy. So just the fact that the organization has that data means that, or entails that, or it constitutes violating someone's privacy. Why would it constitute a violation of privacy to take the most sort of, well, sort of take a standard approach? It's because maybe you don't have my informed consent to have that data. So that's one way in which there's a potential privacy violation, because having data about me in a way that doesn't violate my privacy requires that I first give you my informed consent to acquire that data in the first place. That's a standard A standard line, not the only standard line, it's a standard line. So if you're doing machine learning, then you are highly incentivized to gather as much data about people as you can, all else equal, because all else equal, the more data you have, the more accurate your machine learning model is going to be. Okay, that's one, that's one place where machine learning starts to push against concerns around privacy.

And are you talking about the training aspect of those algorithms, or are you talking about the operation of those systems?

Systems and gathering data? Yeah, I'm talking about training, about how you—

So training, not necessarily the inference stuff, just simply the training the algorithms.

Got it. Yeah. You know, you want to create— what's machine learning? It's just learning by example. That's at the concept level. That's all machine learning is, learning by example. Pretty simple. Everyone can understand that. If you want a really fancy word for example, the word data will do it. So data is a fancy word for example. And so what does it mean when you have software that learns by example? It means you have software that learns by data. So all else equal, forget about computers for a second, you and I, the more examples you give us, the better we'll learn the thing that we're supposed to be learning, whatever it is. And same thing with the software or the algorithm, if you like, the more examples or the more data you give it, all else equal, the better. So that means that organizations are highly incentivized to hoover up as much data as they can, even if they don't know exactly what they're going to do with it, because one day it might become relevant to training a machine learning model. So there's a way in which— the way that I like to put it is that it's the nature of the beast of machine learning that it sort of— it calls for get more data, right? Screwdrivers don't do that. Screwdriver is a tool that doesn't say get more data. Machine learning models say, hey, the fuel of me is data. Go get a bunch of it. So data engineers, data scientists are incentivized to get as much data as they can. So that they can build a successful model. But being incentivized to gather as much data as you can, can very easily lead you to overlooking the privacy concerns that are involved in collecting that data, let alone using the data. So that's, if you like, that's the input side of machine learning, right? The input training data. Then there's the output stuff. What are the out— what's the output? It's inferred data. It's predictions about people. And so it can be the case that you— obviously, if the machine learning model or the AI is worth anything at all, it's giving you some knowledge that you didn't have before, or it's giving you some data that you didn't have before. And it may— it might be the case that you have some training data, let's say dataset A and dataset B, and there's no violation of privacy there. But when you infer C from datasets A and B using machine learning,, it might be the case that possession of that piece of data itself constitutes a violation of privacy. So the example that I like to give here is, let's say you've got permission to have data about people's geolocation. You also just have data about the addresses of therapists. And, you know, you put that together into your machine learning model and you can predict, oh, you say something like, oh, Reid goes to this address every Wednesday at 3:30, and that is also the address of a therapist, so now we know that Reid So now, new fact we know: Reid sees a therapist every Wednesday, whatever I said, Thursday at 3:30 and sees this person. And even if we grant, for the sake of argument, that having those initial datasets about my geolocation and addresses of therapists does not constitute a violation of privacy, it's arguably the case that the inferred data, the possession of the inferred data itself constitutes a violation of privacy because now you know something quite intimate about me.

And that can extend, right? That deriving that information can, you know, lead systems to be able to tell, you know, what race you are, what religion you are, what sex or sexual preferences, what medical conditions you might have. And all of those are absolutely considered private data, something that can be used against people and people have a right to decide who should know. So these AI systems are incredibly powerful, potentially, in deriving data that wasn't explicitly allowed, right? Yeah. Yeah. So whose responsibility is to make sure that they don't do that, right? Yeah. Who's— how do we fix this?

I mean, look, there's lots of things to say, and it's not as though it's going to be— it's the person, the person who's responsible. So, look, you could talk about things like there's a senior executive. It might vary by organization. With my clients, it tends to be someone like the chief data officer, chief analytics officer, when we're talking about an AI ethical risk program or responsible AI program. Of course, there are privacy officers that, you know, chief— could be chief privacy officer. But different senior executives are going to be responsible for implementing the right kinds of standards across organizationally. And that's going to affect not just the data scientists and the data engineers, but also it's going to affect people like you, the cybersecurity people. And because look, what is cybersecurity in the business of doing? And you tell me if I've got this wrong. You're in the business of making sure that the people who ought to have access to certain data do in fact have access, and the people who ought not to have access in fact do not have access to the data. So that includes Are the systems set up from a cybersecurity perspective to make sure that the data engineers and the data scientists have access to the data that they ought to have access to and do not have access to the data that they ought not to have access to when they're looking to train their machine learning models? So it's going to be, it's going to require, you know, a cross-functional team that goes from everyone from, say, the CISO and the chief data officer, chief information officer, chief technology officer, down to those sort of, you know, more in the weeds data engineers, some data scientists, whoever the weedy people, whatever you call the weedy people in cybersecurity, I don't know what you call them, cybersecurity engineers, you know, it's going to require all those people. When something goes sideways and you ask the question, who's responsible for things going sideways, then it's generally going to be a senior executive who didn't do, who was relatively I mean, in this day and age, knowing what we know, at this point, you're either negligent or reckless if you don't have the proper procedures in place.

Well, you know, in the cybersecurity world, right, we tend not to be relevant until something bad happens. And, you know, I see that with my privacy colleagues as well, because we have to work very, very closely together for the reasons you mentioned and other reasons as well, including even if you, do have the legitimate right. Let's say you are a healthcare company and you are managing people's healthcare records. Yes, you were supposed to have access to it, but I also have to protect against people outside, right? The external attackers that are coming in and potentially getting access or exposing or whatnot. But this whole process, I would assume, should not be a bolt-on, right? Understanding the ethical ramifications of what data you should have and what you're deriving should not be an afterthought, right? Tell me if I'm correct. It really should be embedded in the overall architecture before systems are even built to understand what they should be holding, what they shouldn't, what are the guidelines, what are their procedures, what are the guardrails so that the wrong data isn't allowed in and the, wrong, I guess, outputs are not derived. Is that a requirement or is this something that post-review normally for applications, let's see what it's doing and then we'll put in controls? Where? When?

Okay, so I take it there are two questions. One is, should we be proactive about this instead of reactive? That's the first question. The second question is, Does this sort of have to wind its way through the entirety of the organization? Those are great, you know, those are easy questions to answer. Of course, look, look, if it were, if it were—

I'm here to throw you softballs. Yeah, sure.

I'm saving the tough questions later. Look, ethically, of course you should be proactive, right? So there's a question about what's the force of the should. Ethically, should you? Yeah, of course. Because there are real risks that harm people. Wrong people, put peoples at risk, and all else equal, that's an ethically bad thing, so don't do it. There's also, of course, maybe not of course, but there's, I think, a clear business case, at least by way of reputational risk. So you don't want to be in the news media or social media for having a massive data breach. It's not a good look. It's not a good look. And your marketing people are going to be really unhappy, and your PR people, your communications people, be really unhappy because you may have spent lots of time building up trust, but as we all know, trust is very easy to destroy. You can spend, you know, you know, just forget about organizations, think about personally, you know, you spend 20 years, 30 years, you're loyal to your spouse and then you have an affair. Well, now trust is out the window, even though you had, you know, 20 good years, that one, that one incident really did a lot of damage, does a lot of damage. And it's the same thing with organizations, right? It could be their first breach, but if it's a significant breach, that's a significant breach of trust, not just of your data wall, so to speak. And that's really hard to undo. So I think there's very good both ethical and business reason to do it. And then of course we've got regulatory requirements around things like GDPR and CCPA and making sure that those privacy regulations are upheld. And we have new regulations coming out of the EU and Canada. So, you know, there's also regulatory reasons which are in turn business reasons. Okay, so should you be proactive about it? Yes. In fact, as I said, I think at this point, knowing what we know, seeing all the hacks that we've seen, seeing all the ethical breaches that we've seen, it's negligent if not reckless at this point not to do something proactive. So that's that. In fact, it might not be proactive, it might not be reactive to a particular incident within your organization, but at this point it's reactive to the general landscape of risks. That are actual present, have manifested many, many times. Okay. How's that so far?

It's good. I mean, you know, from a trust perspective, you know, we always say we earn it in drips and we lose it in buckets, unfortunately. Right. Okay. So enough of these questions because let's take it down to a practical level in the industry. If we've got senior executives and they're working on an, on an AI engine, a product using AI, or anything else that's gonna be harvesting large amounts of data. In their mindset, typically it's about, are we gonna make money? How do we maximize profit, right, over investment? And you've got the engineers now that are thinking more of, can we do this? Is it possible? And I'm wondering, where is that squeaky little voice that needs to say, should we be doing this? So my question to you is, in the industry, in what you're seeing, how well, how pervasive are companies and organizations, large and small, realizing what they need to do when it comes to ethics and privacy and actually doing it?

Yeah, not many. You know, not many.

I don't like that answer. Not many. —So tell me why. Tell me how does this change. Tell me if we continue down this path, me as the individual consumer that may have my private data either harvested, used, stolen, or derived, what do I do? So help me out.

—Okay, so look, there's basically— there's 3 levers of varying power. Lever number 1, appealing to, if you like, the inner conscience. Of, you know, a bunch of senior execs at multinationals who see dollar signs, who talk in dollar signs.

Yeah. Okay.

I will say I don't want to vilify the senior executives. They're under often real pressures. I mean, there are villains, of course there are villains, but there's also good people who are under real pressures, business needs, blah, blah, blah, competing, competing, you know, limited resources. Um, there's always, you know, political infighting might be a bit strong, but there's also, there's political jockeying. And so it's, it's not easy to do. So you could be a really good person amongst a sea, if not a sea, at least a pond of senior executives who have other priorities. So you can appeal to the conscience thing. It gets you some way. It's a lever. It's not, in my estimation, a particularly strong lever. So that's one. Lever number two, reputational risk. As I mentioned earlier, listen, we've got a big brand. We are known nationally, internationally, etc. And we have real competitors. And if people don't trust us because they think we're playing fast and loose with their data generally, or fast and loose with our AI, whatever it happens to be, then they're going to go elsewhere. That's not true for everyone, right? Like Google's not worried about Bing. They're just not. They're just not worried. But most companies, most organizations are not Google, right? They're the exception, not the rule. So there are very real reputational risks that can actually harm your bottom line because your consumers or your clients, if we're talking B2B, will just go elsewhere because they don't trust you for good reason. So there's reputational risk. I think that's another lever. And then the third major lever— there are other levers, I suppose— but the third major lever is regulation. Or regulatory preparedness. So we know, obviously we've got GDPR, we have the EU AI Act coming out not too distant future, could pass in the matter of a few months even. It wouldn't come into effect for I think something like 2 years until it's actually passed, but facing real fines out of Europe is a real thing. Canada is working on its own regulations with the AI and Data Act. That's a real thing. And then you throw into the mix that these are requirements on multinationals, and we're talking essentially about organizational change, which does not happen, you know, overnight within a multinational organization. You better get on it now, because if you don't get on it now, you're not going to be compliant with regulations when they actually come into enforcement. So I think those are the three major levers. Yes, there are others, like junior people pushing their senior people to take the stuff seriously. And so as a matter of something like, as a part of a strategy for employee retention and employer branding, there's a piece there. In general, I like to say that every individual in an organization is a kind of cocktail of motivations. There's never the reason that they do something. There's a bunch of reasons. And different individuals, their cocktails, so to speak, have different ratios of this or that. Ingredient, whether it's they care about ethics for its own sake, they want to do the right thing, or they want to see it as a brand advantage, or they want to avoid the reputational risk, or it's really just their own ego and they want to be known as a person who spearheaded the ethics campaign, the AI ethics campaign, or whatever it is at their organization. There are those people, and that's fine. Frankly, I don't really care about their motivational constitution as long as we can move forward and avoid doing the wrong thing.

The privacy folks, have an uphill battle. And again, they're right next to me in cybersecurity and we work so closely together, we cry often. Do you think that they are not leveraging as part of their arguments, because they've got lots of arguments for privacy, the ethical aspects enough about why privacy is important? Do you think they focus too much on those regulatory issues and, you know, regulatory compliance and, and even liability. We've seen lawsuits and whatnot come in that can be stinging as well as brand. Are the privacy people missing the boat here and they should also have those ethical arguments and discussions in their toolbox?

Yeah, of course. You know, of course. You know, look, there's not gonna be a silver bullet for these kinds of things. And like I said, different senior people, senior executives are gonna have different motivational constitutions. And so for this one, they couldn't care less about the ethics stuff. They just don't care. But reputation, they care a lot about. This other one is not so persnickety about reputation because they think, yeah, we'll be fine marketing long-term, but actually, can we just do the right thing, please? Right? So any, any, what is it? Any error in the quiver? Is that an expression?

Feels like an expression.

Yeah, any error in the quiver. Yeah, yeah, any error in the quiver, and there's more than one. Yeah, I honestly think the best arguments are the ones that you can't give. It's the occurrences. It's the Cambridge Analyticas, right? Like what makes— what really drove awareness around data privacy? Was it an argument someone gave about ethics? No, it was Cambridge Analytica and the massive impacts that that had, or at least arguably had. You know, that's what's going to push people forward the most on the ethics side of stuff. You give examples like that, the more examples like that happen, the stronger the argument comes because you don't want to be those people.

And you bring up a great example because, you know, in that case there were executives at the time that thought this would be fine, and they may not have seen any ethical red flags, let's just say, with doing that type of business and selling that type of data to this business partner. So, you know, we all live in the moment. We all believe something is ethical at any given moment, per se. How do we make sure, or how do we improve, the moral compass for people to be more, you know, united and more aligned with some kind of structure or framework? Is there something that the business world or regulation should mandate to get us all kind of focused on a similar picture of what is ethical versus not?

Okay, so there's a number of things to say here. So if you're talking about, okay, we're an organization, let's say we're a large organization, how do we set our ethical standards? So let's just, let's just pull apart two questions, which you're not confusing at all. I just want to make sure that I think we're all on the same page, including our listeners. There's what are the ethical risks that we want to avoid, and then there's how do we do it? That is to say, how do we systematically avoid those risks? So let's put the how do we avoid the stuff to the side. That's essentially a question about what does good governance look like? So let's put that to the side. And then there's a— your question, I take it, is something like— I would call it a content question as opposed to a structure question. Structure pertains to how do we systematically identify and mitigate the ethical risks of AI, for instance, whereas content refers to what are the ethical risks that we want to avoid and how to— and what are their sources? What are the sources of those risks? That's the content side. So there's a content question, which I like. Okay. There's at least two kinds of things. So first of all, we don't all have to have the same ethical standards any more than individuals all have to have the same ethical standards. You and I probably have overlap in our ethical standards, and we have probably have some places where we don't overlap. In general, say, think about political ideologies. You've got people on the left, you've got people on the right, and while there are some crazies on the left and some crazies on the right, there's a bunch of not unreasonable political positions that people hold that are not compatible with each other. So there's someone on the left, someone on the right, neither one of them is crazy, they're fully reasonable, but they've got a reasonable disagreement about, say, what constitutes justice or what the best direction for the country is And so we should allow the same things with organizations, which is to say they don't all have to have exactly the same ethical standards. They've got to be in some kind of acceptable, within the boundaries of reason, right? I take it that regulations are meant to spell out, when they're done well anyway, they're meant to spell out that boundary of the reasonable versus the unreasonable. Within the reasonable views, let, you know, let a thousand flowers bloom. Let different organizations have different ethical standards. So you can have your Hobby Lobbies, and you can have your Patagonias. That's cool. I don't think we need to say no more, you know, we can't have either one of those anymore. I don't think that's the place of regulation. So long as both are within, you know, reasonable regulatory guardrails. Okay, so now you're an organization, you say, of course we're going to play by the regulatory and legal rules, we're going to do that, but that still leaves a lot of ethical space. What do we do? And I think there are generally two kinds of things to to do in terms of specifying what your ethical standards are. The first is an ethics statement. Now, I think it's really important though that the ethics statement is not fluff because then it's nothing. If you just say you're for fairness— my favorite example of "we're for fairness" is the KKK. If you write a piece of paper that says "we're for fairness," the KKK will say, "Yeah, we'll sign that." They are for fairness in that abstract of an articulation. Therefore, they just have a very different misconception about what, you know, operationalizing that looks like. So I think, one, you state your ethical guard— you state your ethics statement in terms of your own ethical guardrails. So, for instance, because we value X, we will always Y, and we will never Z. To give you a toy example that speaks to privacy stuff, because we value privacy, we will never sell your data to a third party, for example, right? That's— now when they say, They value my privacy. Oh, I get it. What they mean by that is there's this particular thing that they will never do. They will never sell my data to a third party. Now, you want to fill it out more than that. Privacy is more than just about whether you sell the data to a third party or not. There's lots of other considerations, of course, about what respecting privacy might consist in. But you can imagine that there's a range of reasonable positions about what constitutes respecting people's privacy, all within the bounds of legality and good regulation. And different organizations are going to have different guardrails. Some will sell that data to a third party, but only after aggregating and anonymizing with the lowest probability they can manage to handle, or the lowest threat, the best threshold that— once it's reached a certain threshold of probability of not being deanonymized, or something along those lines. So there's different moves, as it were, that one can make. But so step 1, guardrails. Step 2 is what I like to call ethical case law. So we've actually done this together. You know, when you're working with organizations on what their ethical guardrails are, there's some things that, you know, 80, 90% of them are on board. And they're like, yeah, that is a line that we're not going to pass. Oh, great. Put that in the ethics statement. There are some where it's almost 50/50. There's just deep disagreement about what to do here. And I like to take those statements put them to the side, and then once we're done with the ethics statement, we say, okay, you know what we have now? Now we've got a bunch of gray area cases where there's a lack of internal alignment. Now we're gonna work through those gray areas, those tough cases. It's not gonna go to a public-facing ethics statement. It's gonna be internal, but it's gonna be internal case law. We're actually gonna solve, we're gonna decide where the organization stands on these gray issue areas. We're gonna work through it. Not everyone's gonna be happy with the solution, We need to get internal alignment or it's gonna create friction down the line. And you work through that and that becomes your ethical case law. So then when a new case presents itself, you can say, okay, well, this is a tough, this is tough. This is a gray area case. Our principles, our guardrails are kind of silent on it. It's not clear how to apply our higher level guardrails or principles to this particular case. Let's consult how we decided certain gray area issues and see how the current real situation compares against our reasoning and decisions with our— with that ethical case law that we created. So in this way, it's analogous to legal case law. So I think when organizations do that, it's a phenomenally powerful tool in aiding their deliberations when the new case is on their doorstep and there are dollar signs flying flashing in their eyes because now they've got something at least that they can try to be consistent with, specifically the judgments they made on that ethical case law.

Got it. So you've got to create that framework starting with the baseline. Okay, at minimum, we're going to meet regulatory controls and then let's step up and say for our organization, we're going to have very specific other guardrails of the, you know, precisely what and the relevance of that with examples. And that goes into that public -facing privacy statement. And then you've got the gray areas where you kind of have to decide internally, and that probably changes. And it sounds like you need to have a process and maybe even a group that coordinates that and revisits that to figure out what you're going to do internally. Not necessarily a public-facing thing, but it's internally on, on what will we do, especially when you see dollar signs. If we just grab that data, we could make a billion dollars. Okay, right, so have those controls. So that's, remember, that's the other question though.

Remember I said early, there's the how are we gonna do it, and there's what are the standards. So all I've done so far is specified what the standards are. How you implement those standards, and how you update them in response to changing market environments, changing technologies, changing culture, et cetera, that's a different kind of question. That's a question about what does governance look like given that we've defined the standards as we have.

And that can vary hugely, I assume, based on the type of company, where you're operating, the type of technology that you're using, the expectation of customers, all that kind of stuff, integration with third party and whatnot. I want to go back to this public-facing policy because it sounds a lot like your privacy policy, right? Now, every company has to have a privacy policy out on their webpage and Should there also be an ethics policy additional to the privacy policy out there? Is this something that's missing or something that companies should be considering? They need to be out there, especially if they're dealing with any type of sensitive data.

You know, I like to stay away. I know I'm supposed to be the philosopher, so I think the stereotype is that I'm committed to absolutes or something like that, but that's not true. Look, I— there are reasons for having it public-facing. There can be good reasons for an organization to have something like an ethics statement public-facing. There could be good reasons for not having it. Whether a company ought to overall make a kind of ethics statement public, it's going to depend upon their particular organization, the circumstances, the context, blah, blah, blah, blah. Should it be required by regulations or something like that? Mm, I mean, fine, on the condition that it's actually— the regulations also cover what it looks like to make sure that it's not just PR, and that there's actual substance to the statement, and that the substance articulates things like— Accountability.

They can be held accountable for meeting that statement. Right, right, exactly.

Otherwise, they can just sort of, you know, put out a statement that says, you know, we're for—

Yeah, we're good. All the justice. We're good. We're just going to do the right thing. Right. So—

You know, to me, making an ethics statement public is— it's a way of achieving something else. It's not intrinsically good to tell people. Like, you just go around telling— if you want, Matthew Rosenquist, if you want to go around saying like, hey Reid, you know, here's my ethical standards, and you sort of gave me a piece of paper, I'd be like, okay, this is— this is— thanks. Thanks for this. I don't know what to do. I don't know why you gave this to me.

But if someone's going out to my website, they are wanting to do some kind of engagement with me. So, you know, I would say, yes, having a privacy policy is important. Having a security policy, I think, is important. And I think having an ethical policy. But you said there are some companies where that does not specifically— does not make sense. Give me an example. Help me understand.

There are instrumental— so when I'm thinking about should people do it, One of the ways I'm hearing that question as an ethicist is, is it ethically obligatory to do that sort of thing? And I think that's not ethically obligatory to do that sort of thing. There might be various instrumental reasons for doing it, like it increases trust or it allows people, you know, it allows us to hold them accountable. So there's certain instrumental things, instrumental reasons for doing it. And so, yeah, I mean, I'm generally in support of it, but I wouldn't say that someone is doing something ethically wrong simply by the fact that they're not transparent with their ethics statement, right? Maybe they're not transparent with their ethics statement, but their ethical house is in order way more than the people who are really loud about it. Right. So they might be the quiet virtuous type instead of the, instead of the, the loud, you know, the loud charlatan, the loud virtue signaler.

But wouldn't that be a warning sign? I mean, if a house really is ethical, right, and they've committed, they've got the frameworks, this is their mindset. Why wouldn't they put out an ethical statement? Right? Because I'm thinking the omission of one is more of a, not a red flag, but a yellow flag.

So look, that is becoming the case. So 5 years, if you asked me this question 5 years ago, I would tell you what other companies told me, which is things like, you know, if we put an ethical statement out there that says we're really committed to ethics, yada, yada, yada. That's putting a target on our backs for journalists who are looking for us to trip up and want to publish something bad about us, like we didn't live up to our own ethical standards. We want to avoid that reputational risk, so we're not going to put that out there. And I thought, okay, that's not a crazy position. I get that. Journalists need a good story. It's always a good story when, you know, a massive multinational company with a big brand falls short of its own stated ethical standards. That's a nice story. And you don't want to be the target So, okay, I get that. I care much more about you getting your ethical house in order than I do about you telling everyone that your ethical house is in order. Now, fast forward to now, is it more of a yellow flag now? Yes, because now the expectations are changing. Since especially things like Cambridge Analytica, yeah, consumers, businesses, citizens, governments are looking more and more to see if companies have their get your technological ethical house in order. And part of that means telling us, hey, what are your standards and what are you doing? And so there's a way in which the changing expectations have made it the case that if they're not a little bit more, a little louder about it than they had to be 5 years ago, then yeah, it's a risk. In the same way that it's a risk for non-technology issues, right? So, you know, take the latest social political issue that companies are expected to take a stand on. I mean, if they didn't say anything about, I don't know, diversity 15 years ago, no problem. You say nothing about diversity now, that's a bad look. That's a bad look. Yeah, agreed.

And we saw that exact kind of series of events, those same dominoes falling in cybersecurity. You look 20 years ago and companies said, "No, we don't wanna talk about cybersecurity, what we have, what we don't." because if we do publish something about how we secure our environment, people are going to come after us. News companies are going to come after us. But that also extended, unfortunately, when there was a data breach or there was, oh no, we're not going to talk about that. We're not going to publish that. We might lose trust, right? It may be a negative news story. Well, of course you're going to lose trust. Of course it's going to be a negative news story. You lost the data, right? And the industry has evolved to go, wait a second, wait a second. If we allow people to be quiet, they will be quiet in ways that are also detrimental to the customers that they serve. And I think we saw the same thing roll out in privacy. And I think we're on that same road for ethics because there are expectations. I mean, We all kind of have ethical expectations of any transaction or business that we do, right? It's just human nature. But if we can't trust and they're not willing to talk about that or we're not demanding it, is it really there?

Yeah. Yeah, that's right. I mean, I like to put things out just slightly differently, which is to say that, look, I don't— you don't need to earn the trust. Of your clients. I think that's actually— that's too hard. That's too strong. Like, I know Apple is big on privacy. Do I trust Apple? I don't know. I don't distrust them. I think what companies should be striving for is they should, you know, we want to make sure that we give them no reason to distrust us. That's it. Don't— not to distrust. It's not like, you know, I trust my wife, right? I trust my parents. I don't trust Apple. Even if I think, you know, trust is such a such a big, such a, I don't know, big word, such a biggie, sort of like emotional commitment. That's, no, no, you got to avoid generating distrust. And it's absolutely the case that one way to generate lots of distrust now is to engage in ethically suspect behavior, even if you don't intend to, because your AI went sideways, for instance, or because there was a breach by a hacker. Or, you know, a bunch of hackers, right? So there's tons of ways to generate distrust, tons of it. And so, yeah, being transparent about what you're doing is one way to make it the case that you don't lose or don't generate distrust. But you are also— it's a risk, frankly, because you can go out there and say, hey, these are our standards. We really believe X and Y and Z. B. But then if it's just, if you like, just PR, it is true, if you don't get your ethical house in order now, those statements don't mean anything. They actually do damage to you.

They become caustic, right? You've made this statement and you're not following through on it.

Yeah, they're promises that you make. If you want to really destroy trust, make a broken promise, or break a promise. So I do think, you know, another reason that those statements are useful, again, not in intrinsically, ethically important or something like that. But one reason why those public-facing ethics statements are useful is that it's something by which the organization itself can pull the political levers to say, hey, listen, we made this promise publicly. And we are now at risk of breaking that promise. And there's another lever for getting people who weren't initially on board to getting on board. It's a little bit sneaky, but it's a way.

So then let me ask you this, because it sounds like there's, you know, the answer is it depends, and I hate that answer. That's the total lawyer answer. So if you're going to do business, or let's say you visit, let's say you visit Apple's website, right? You're visiting Apple's website. Do you really need to trust Apple? Probably not, right? You're not providing anything. But if Apple asks you, to put in your credit card number, if they ask you to upload a picture, if they ask you to be able to track your location. Now, to me, that's a different situation. Now there needs to be trust and they're asking for it. I see the field I have to fill out or the file I have to upload. And at that point in my mind, that's where, you know what, you need to have a privacy statement. You need to have a security statement. You need to have an ethical statement. 'Cause I sure as heck wanna know. I need to. And I may not be savvy enough as a consumer, but I should be. And to me, that's that delineating factor. The moment we're going to share or they're going to have private data from me or anyone, that's when that ethical statement really should be there. And those guardrails and everything that backs it up should be there.

Maybe one reason why— you have a much stronger opinion about this than I do, about the necessity of it. It's reasonable. I wonder if one reason is that you think that it's a way for consumers to do their— it enables a consumer to do their due diligence in figuring out whether they should trust this company with all the data that you just mentioned and more.

It is, because I think consumers right now are on a learning curve. They didn't know anything about security, nor did they care until bad things happened. They didn't care about privacy until bad things happened. And I think when we look at ethics, which covers a lot of all of that, I think they're not gonna care until something really bad happens, right? Cambridge Analytica, something really bad happened. But if that then downward spiraled to something even worse, Yeah, the greater the impact, the more relevance. But I think the average person doesn't think about ethics, just like they didn't think about privacy and 30 years ago they didn't think about security.

They don't really think about it now. They sort of like, they can say some of the words, like they can say the word cybersecurity now, they couldn't say that word 10 years ago. I don't think they really know what it means.

No, but they know when they get the letter of the breach of their data. They know that. They know when they see the screen of ransomware and all their files are locked. They know it. They're like, oh crap.

Well, that's when they start learning, really. That's when they're like, oh shit, I guess I should probably learn. I should call Matt and he can teach me about what the heck is going on here. Look, I have— you have much more faith or confidence or something like that in the average consumer than I do, that they're educatable and that the goal is to educate them. I sort of like— they should be vaguely aware of these issues, you know, aware of the headlines. Would be sufficient, honestly, if they just know data breach, data breach here, data breach there, and you know. But I kind of think about it the way that I think about fraud, like frauds with credit cards or something like that, or the kinds of regulations that financial services companies have to abide by so that I as a consumer am not defrauded. I don't know what those regulations are. I don't know the kinds of, I don't know all the kinds and nefarious things that they could do that they don't do because regulations are in place. And I don't want to really know. I don't want to study credit card regulations and, you know, educate myself as a consumer what, you know, you know, what, um, something like what responsible credit card generation or loan lending looks like. I'm a stupid consumer in this area. I'm ignorant, and I just want the government to just identify the really bad stuff and make sure that those companies don't do that really bad stuff to me. I think similar things about things like cybersecurity and the ethical risks that pertain to AI. I'm not, I don't think we need to educate all these people about cybersecurity and AI ethics. Some people think we, the public needs to learn more about machine learning. And I think, are you outta your mind? Machine learning? No, they don't. They don't, they can't, they won't, forget it. That can't be the— that can't be a necessary hurdle for success. What I want is the right government people to be in place to put in at least the guardrails for good regulations, and then I want senior leadership at organizations to understand the kinds of reputational and regulatory risks and what they need to put in place in order to avoid those things, and then do that stuff and actually operationalize that stuff. Now, in that And that's what I want. Is a public-facing ethics statement an absolutely essential component for that to happen? No, but it's nice to have. So it's a nice to have, not a need to have, in achieving what I think to be the ultimate goal. Making sure that you're a responsible consumer. I mean, Matt, you're a weird guy. You're obsessed with cybersecurity, right? You and 3 other people, right? But the average consumer, you know, they just need to pick up the kids. They don't have time to look at the privacy policy of any company.

Okay, so let me take a counterpoint to that because I think, and this goes back to what we were talking about before, when executives are looking at the dollar sign or they're looking worried about penalties or whatever, right? It's dollars, dollars, dollars, profitability. I totally get it. I want them to think that way. But, but one of the major influences to organizations is customers, right? If customers are going to choose them over somebody else, if customers are going to pay money or pay more, right? Your average selling price, your market share, all those kinds of things. It's all dollars, dollars, dollars. And we've been working with the public and really the, the bad guys, the attackers, have been doing most of the talking, but the public has now started to understand— started, we're still growing— that security is important. So if you're going to deal with a company that isn't secure, doesn't respect or invest in security, maybe you don't want to. Maybe you need to look to see at the competitors because that's becoming a competitive advantage. Now, do they need to know the ACLs on a firewall? Heck no! What they need to know is, is this company secure and trustworthy? When it comes to privacy and my private data, you know, are they private and are they trustworthy in handling that? And I think that same level of trust for ethics also plays a key role because it's a differentiator. It is a competitive advantage. And if it is, if it manifests that way in the industry, you're now going to have those same executives go, yep, and we need to follow our ethics statement. Otherwise, we're going to lose market share. Otherwise, our average selling price is going to go down because of demand, you know, or X, Y, and Z. If we don't, if we just go, no, people aren't going to understand ethics, security, or privacy, that will never be a financial incentive. And that's the way we move mountains. Yeah, I'm not sure that we—

maybe we don't disagree so much. I mean, look, I certainly think that the average consumer should be aware of the issue. Right? We should, you know, they should be aware of the problem, just like I am aware of the issue of fraudulent credit cards or scams with credit cards. I'm aware of predatory lending. I don't totally know what it is. I just know that there's, you know, there's agencies of the government involved to make sure that doesn't happen, and then there are internal things at credit card companies to make sure that they are complying with those regulations. Right? So awareness of the issues, absolutely, and that's why in some broad sense I love Cambridge Analytica. It did a tremendous amount to raise awareness of the issue. It was really useful. It was bad, it was intrinsically bad, but it was instrumentally useful in raising awareness. So yeah, I do think that people should be aware of, oh, there's a major issue having to do with discriminating against Black Black people and AI, for instance, right? So when there's stories about the facial recognition software misidentified a Black person as a potential suspect and was unjustly arrested, yeah, that's— people should know that stuff so that they can do things like push for politicians who yada yada. And yeah, so that they can, when there's a headline that says, you know, favorite brand X, you know, discriminated against all Southeast Asian women with their lending, you know, their lending AI, they can be like, ooh, I understand what that means and that's awful. I'm not banking with them anymore. Right? So yes, high-level awareness. Yes. That's all we need from the average consumer. I don't think we need the average consumer to take on the responsibility of doing all the vetting themselves. Right. How many companies does an average individual interact with on a daily basis? I mean, you know, dozens.

That's too tall of an ask. Nobody wants to do that. Heck, I don't even want to do that. And I'm crazy. So. Okay, so last question here. Rolling forward in time and looking at it from that corporate perspective, maybe the regulatory perspective and maybe that consumer viewpoint, where do you see— what is success in ethics and privacy, AI ethics, all that. What does that look like in the future?

Okay, here's where I think people should be going. So there's lots of talk now about AI ethics or responsible AI. We have regulations, like I said earlier, as you're well aware, regulations coming out of the EU, coming out of California, we have CCPA, of course, we have the AI and Data Act coming out of Canada. So there's stuff coming down the pipeline. I think that we need to broaden our perspective when we're thinking about ethics in general and privacy in particular. I think we need to talk about something like digital ethics, responsible digital innovation, you know, something along those lines that we need to think more about, not just the technologies that are around today, the ones that will be are going to be here, you know, tomorrow and the day after tomorrow, and proactively think about what does regulation or proper governance look like around those technologies. So, for instance, working with a client now who, they're not just doing, they are doing the AI ethics bit, but they're doing more generally a digital ethics program, which will encompass not only the AI that they're developing and procuring, but also the AR stuff that they're doing. And while they're not using blockchain for anything right now, or quantum computing for anything right now, 10 years from now, 5, 10 years from now, they very well could. Maybe they'll do VR. They don't do VR right now, but they may very well one day. So creating a governance structure that's flexible enough to take on new emerging changing technologies, I think, is really, really important. I think that's what success looks like on an organizational level. And at the, if you like, the regulatory level, I think we need regulations that don't target things technology by technology, but take a broader approach to something like data and data-driven products. So that's going to include, of course, just massive data collection, but also machine learning and blockchain and quantum and IoT and yada, yada, yada, yada. So I think that broader A broader approach is what we need. And success looks like robust digital ethical risk programs in the companies that are building this stuff, procuring this stuff, et cetera.

I love it. And all the technologies that you had mentioned, whether it be AI or quantum or blockchain or whatever, it's all about data, protecting data or massive amounts of collecting, using, processing, storing data. So looking forward and building structures and continuing to ramp up around all those technologies and not targeting one at a time, it makes a lot of sense.

Two more things, and then I'll shut up. One is it's not just about the data. As you say, it's what you do with the data. I mean, these are all different ways of doing things with data. And it turns out that there's all sorts of ways to do nefarious things with data. So putting privacy concerns to the side, let's say you've got the data in a way that doesn't violate people's privacy, there's still all sorts of ways you can go ethically sideways. Okay, that's one thing to say. And all these emerging technologies introduce new fun ways for doing ethically bad things that are also reputationally harmful and potentially regulatory and legally harmful. Okay, that's one thing. The other thing to say is though, that because they are data-driven products, whenever I sort of list the main ethical risks for a given technology, so for machine learning we have things like bias and explainability, and for blockchain there's issues about governance and third-party protections, but for every single one I have to list privacy. I have to list privacy for every single one because everyone uses data or is storing data.

And of course you say security too because that's tied in. I'm sure you meant to say privacy and security.

I mean, I take it that privacy is comprised of a number of elements, one essential element of which is security.

Yes. No, I do mean that. I gotta poke people every time they leave that out. So, okay.

Oh, I just, I just take it to be, you know, when I think about privacy, I think about 3 things. Is this right? I think about 3 things. I think about regulatory compliance, at least compliance with the current regulations. I think about cybersecurity. And then I think about what you might call the ethical perspective of privacy that has to do with the extent to which people should or ought to have control over data that's about them. That's a good triad to think.

That really is. That's a great triad. Yeah, I think so. All right. Hey, thank you for coming and sharing your insights here. And Reid kind of continues this discussion of ethics of AI in his new book, Ethical Machines, which is out now. So definitely go grab a copy, read it. Send him a message, tell him whether you liked it, and advocate for him to write his next book on this because this topic isn't going away. It's going to get more complex. It's going to get more challenging, especially as we have those new technologies and new expectations and even new violations out there that, that teach us all. So thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes. Where we chat with industry leaders like Reid to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. Thank you much.