The Cybersecurity Vault - Andy Brown

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, cybersecurity strategist and CISO at Eclipse. Today we're going to talk about the importance of the silent war on digital privacy. We'll be talking with Andy Brown, who serves as the CEO of Sandhill East. And this is a really interesting topic. Just as our world is blossoming and being connected with digital transformation. You know, all of our data is out there and more is being generated every second. There are challenges in being able to use that data for our benefit, but also maintain that privacy and that safety and that security around that data. So today's podcast is created in part by Eclipse, which provides an elegant capability to secure data in transit. Across insecure networks and between untrusted endpoints and cloud instances. So welcome, Andy. Thank you for coming and talking with us today.

Thanks a lot. Pleasure to be here.

It's always a pleasure, you know, talking with you and picking your brain because you've got tremendous insights on what some of the leading companies and technologies and people around the world are thinking about and trying to solve. Problems people are trying to solve. So thank you very much. Just a little bit about your background. Why is data and privacy and security, why is all of that a passion of yours? What, what has triggered in your past to make this important to you?

Well, actually, I mean, I think going all the way back to the beginning of my career in the pharmaceutical industry, looking at, you know, protein binding sites and looking at how drugs interact with those protein binding sites, Now, you know, people have their entire human genome completely sequenced, and there's no more important piece of private data than your human genome. And, and we'll, you know, we'll get into the discussion about that later. But obviously, having spent 20 years in investment banking, uh, the importance of knowing your client and understanding who it is that you're dealing with and keeping all of their data private, both within a company and then within specific roles in the company is a key part of the financial services ecosystem. And you know, the financial services ecosystem has kind of acted as an identity provider in their own right to both their clients on the institutional side and just, you know, people who use banks and so on. And often people think about, you know, the bank's role as the owner of that data, but in real life, they're actually the custodians of your data. And that's a very important distinction. So I really spent my whole career actually working on data. Um, I always like to think of the terms data processing and information technology. So if you think about it, data processing, information technology, half of it is data and half of it is about the technology in both those two sets of words. Yet many times people focus much more on the technology than the information. I think in the last 3 years since digital has become so important, Data has finally made it back to the table as an equal partner with tech and has become super important in its own right rather than talking about the data maybe that's trapped in a platform and then trying to join those pieces of data together. I think data's now become an equal citizen actually with technology, which is a great change.

Well, it's definitely a symbiotic relationship, right? I mean, the more data you have or try and gather, the more technology that you need and the more technology that you now have, the more data that you can gather and potentially use it for good purposes out there, or depending on who you are, maybe for nefarious purposes.

Mm-hmm.

So, you know, it— data can be used for good, it can be used for bad, and that kind of encompasses the overall value of it. And, you know, what are you seeing as we move into this new era where we're all connected, whether it's the Fitbit on our wrist tracking our heartbeat or the financial services tracking what we spend, what we save, what we invest in, or healthcare, right? That's tracking everything. And you had mentioned our genome and what we're doing from a behavioral perspective and how that— What are you seeing as the valuation of data? How are organizations, governments, and businesses seeing the evolution of the value of data?

Well, I think if you look at the private market investment raises for companies that focus on data, you'll see some absolutely amazing multiples. To take one from last week, DataMiner, D-A-T-A-M-I-N-E-R, um, you know, companies like this are attracting massive premiums because the value of the data they have is one thing, but then if you can take the data and turn it into something that's super useful, gives people something they couldn't get any other way— so in DataMiner's case, it's events that are going to happen or events that are happening, and you get access to that information sooner than anybody else, um, that's become super powerful. But companies like Enigma, for example, in fintech, who's focused on small business data— anybody who's become like an expert or a specialist in a certain data vertical has been able to attract high multiples and, and really get plugged into the whole ecosystem as the fuel for digital. So I think, I think that area is super exciting. In financial services alone, there are literally hundreds of data companies in the startup ecosystem focused on one particular or maybe two sub-asset classes of data. Noma is a really interesting company that we've worked with really closely in the last year. That's K-N-O-E-M-A. And they basically source, you know, over 55,000 datasets of alternative data. So you can literally go to the website and type in, show me all the electrical vehicle sales in Latin America last year, and it will show you the time series of that over years. And you can literally just drag it straight into a spreadsheet, straight into a Word document, or straight into PowerPoint. So I think the, the notion of data being an equal citizen isn't just about the verbiage and the way people talk. It's about the valuations that are ascribed to these kind of companies. Now, I'll draw your attention to another, another interesting acquisition in this space., which is the, the acquisition of Ancestry.com by Blackstone. And, you know, as you know, I mean, many people had done the DNA tests on Ancestry and had opted into what's called research on Ancestry. And, you know, there was a press article about that data potentially having been shared with, with pharma companies. But I think, you know, when you think about your human genome probably being the most important asset for you to protect, you know, it's very important that even if you did give away access to it, now you start to think more carefully about who's got access to it, what purposes do they want to sell that data for potentially, and how do you want to control access to assets like that? So, I mean, you asked a very broad question in terms of the kind of scope of data, and I gave some practical examples in financial services. You see the same thing in the insurance industry. If you think about the life and annuity industry where you are underwriting someone's life experience, expectancy, the amount of data in that space has also become amazing. I mean, there's even this concept now of real-time life insurance where if you post on Facebook that you've been skydiving, your, your policy— no, literally, your, your, your premium goes up. And if you post on Facebook that you bought a Peloton and you're using it every day, your premium goes down. So, so this notion of tying behavior and data, you're going to see show up in all of the Generation 1 and Generation 2 cognition platforms that are working on data and function. That's a pattern we're seeing in multiple industries.

So, wow, you've covered so much. Let me unpack a couple of things here. You've talked about the business valuation of those who have the data or can collect tremendous amounts of data, and obviously there's a huge benefit, you know, there. There's also downstream for the end user, the everyday person, you know, me walking down the street, this data collection, this knowing who I am, what I am, how I do things, how does that benefit me as we move forward? I get the insurance companies can better decide how much they're gonna bill me, and maybe that helps me because I can get a potentially a more affordable insurance program if I'm doing good things. But should people be concerned that it's too much data about them and they're not getting any benefit, right? They're just, they're just the subject and everybody else is gaining benefit from their data. Is that something that everyday people should be worried about?

I think it is. If you look at the European legislation in this space called GDPR, the Europeans have already legislated around this collection of digital exhaust and structural data that you can tie together with digital exhaust. And you can tie that together with social network posting and watching and liking and so on to get a really, really deep profile of an individual. Now, the example I used earlier about the banks, I used it on purpose. This, this, this notion of who's the custodian of the data and who owns the data. Super, super important. If you think about, um, COVID testing and you think about the use of a platform like MyChart, right? Everyone thinks MyChart is like a platform that you log on to and then you get a whole bunch of stuff, which is kind of true. But, but every MyChart instance is separate to the health system that's using it. So for example, in New Jersey, if you signed up to 6 different, um, COVID sites to try and get your vaccination chances are you had to sign up to 6 different MyCharts, and you had to fill in all the same information in all 6 of those MyCharts. The other thing is your data is now trapped in all those MyCharts. Your MRIs, your x-rays, everything, your blood tests, everything. It's all in different versions of the MyChart. Now to me, that's the exact opposite way around to the way it should be. So if you like, the subject is the healthcare provider, the object is the customer. Why isn't the subject the customer and the object the service providers? Because if you're a customer, what do you care about? Well, I'd like to have all of my MRIs and all of my X-rays in one place. So when I sit down with my orthopedic surgeon, he only has to go to one place to get it. And by the way, I'd like it in one place as well.

So, so if you go to the emergency room, right, you want all your medical records together, or at least the latest ones, and they're not working off something that's 4 years old.

That's exactly right. And so, and so I think we're going to see two things happen here. One of them is we're going to see aggregation integration platforms, much like the Mints and the Personal Capitals in financial services, start to enable you to manage the data that is aggregated— well, that is now separated, sorry, in separate platforms about you, but apply policy to that data consistently. So for example, if you don't want any of your personal photos to be owned by any social platform that you post them on, much better to post a link to the photos that are someplace else than actually to post the photo, because there's a legal difference between the ownership of that photo after you post it. So, so this whole notion of kind of where the line is is super important. But to go back to the GDPR and, and, you know, California privacy and New York privacy and so on, I think it's absolutely, uh, certain that this country will end up with a privacy legislation framework even if the individual states have slightly different implementations of it. I think that framework should be designed around customer first. And if you think about the role of customer protection agencies in the government, one of their key roles should be to protect the data, but also to empower the customers, or the citizens really in this case, uh, to be able to manage their data effectively as well. And we can chat more about that in a bit.

Okay, but now you've painted a picture for me where the economic incentives are opposing each other. You just said that the— there are companies out there that are making tremendous amounts of money and are incentivized to be able to take this data and own it themselves, right? They own it, it's their property, and then they can, they can benefit or sell it. But on the other hand, what you're saying where we need to go is for the individuals, for us to own our own data, right? And the people that are using it only to kind of be a custodian of it when it's for our benefit. And I— yes, I mean, that makes a whole lot of sense. How do we flip that model and make the economic incentives in such a way that those companies are willing to not be the owner of that, our data? How do we do that?

Well, I think if you— if we took the simple example of financial services aggregation and we just look at what are they selling it for, right? So if you take an Intuit and Mint as an example, they're providing a very valuable service. I mean, they give you a household-level balance sheet that you can manage, and it makes managing that a lot easier. But they're using that for really 2 or 3 things. They're showing you competitive pricing on products you ordinarily buy anyway. You know, they're showing you offers that other people who have subscribed to things you subscribe to have found useful, right? So although to a certain extent they're taking the data that's custodied at the banks, aggregating it, and then, and then, and then selling it or offering access to it for people to provide offers to you, there's actually quite good value in that. If you look at social networks, on the other hand, a lot of the data that you post into social networks, you know, and, and in particular, for example, location tracking data, which is kept in, in many of these social network platforms, you know, particularly platforms used by children as well, you know, that data, in my opinion, um, should not be owned by the social media platform. It could be custodied there if each individual was allowed to apply policy to the data, right? But, but to my mind, it should not be owned. And, and so to answer your question about, um, first of all, uh, the kind of business incentives, and second of all, the capabilities, right? So if you and I are friends and we like going to the movies together, and instead of posting on Facebook that we you know, left the house in an Uber, that we got to the movie theater and we decided to go for a drink. So we registered with, you know, one of the registration apps for location that we actually went to a certain bar. We took photos of our drinks and posted them on Facebook. Then we left the bar and we went to, to, um, to the movie theater. And then we posted that we were going to this particular movie and we were at AMC. And then we thought, well, afterwards we might as well go for dinner. So we go for dinner. Dinner. And, and if you actually look at that digital exhaust, there are literally thousands of data points, and maybe even tens of thousands if you add location services in there as well. Now imagine a world where you and I could create a, a, um, a group, and it's the group of people that like going to see horror movies on Thursday nights. And we have a set of things that we do: we go for a drink, we go to the movies, we go for dinner, and then we need an Uber home, right? So, or let's say a car service home. Imagine that that group could be completely anonymized, and now the theater itself, the bar, and the car services, and the restaurant were bidding to get our business every week. Now in that example, I'm still doing the exact same things I was doing before, but I'm in control with my group of the decision as to which restaurant we choose, whether we choose Uber or Lyft, which bar we go to, and, and and which movie theater we go to. But, but, but the, the need for anonymization in, in that example requires a different kind of platform than the platforms that currently exist, which are more about something's happening, I'm posting, and essentially just creating more digital data trail for people to follow. So we've invested in a company called AtSign, which is going after that space in spades. They've created a network privacy protocol much like an IETF task force would have back in the day. Oh wow, that's a scar somewhere there. But anyway, so it wasn't as bad as GSM. Let's just— let's not go there. But joking apart, you know, you need to start off with the notion that everything that is about you is owned by you. And the things you share are shared with people on a, on a policy basis that you decide. So for example, someone you've just met, the only thing you might want to share with them is your email address, right? Someone you know better, you might want to share your cell phone number. Someone you know really well, like someone in your family, you might want to give them your address.

Yeah, maybe.

Idea that you give a contact card to somebody and it has all of that stuff on it, um, isn't really the way the world is now. The world is really thinking about attribute level. Now, if we flip this now, and I talk about another example, there's another company we're working with, uh, called OneCreation. And OneCreation is built on top of digital ledgers, which are pretty much guaranteed to be private because of the way that they're designed. And they have a number of use cases, including the MyChart one that I told you about earlier, that they're working on right now, uh, where they're making everything customer-centric. The customer gets to look at the data in their own eyes of their own volition that they own. And in the example of the human genome, you can literally take the 3 strands of the genome that you want to share with the BRCA test, drag and drop, right? So, so it's not required for you to share your entire human genome for most of the different kinds of tests, whether it's what kind of food to eat to make you lean, whatever it is, because it's different from person to person. So there's all these platforms emerging and they're like, oh, just give us your genome and we'll tell you this. Well, guess what? You don't need to give them your genome.

You don't need the whole— So it provides limiting functions, right? We can limit what data—

So let's talk about the meaning of information security for one second, Matt, because this is a really important point. Information security is not a macro topic. It's a micro topic, right? So in the example I just gave, you know, you're picking out a little piece of your genome and choosing to share that. You're entitling, to use information security speak, somebody to have access to that data, hopefully with an end date on it, right?

Well, that's the other thing that you're talking about here, right? And let's dive into it a little bit. When we move into the digital age, instead of handing your business card, which has your name and, you know, address or whatever, phone number and email, you have the ability to be selective in what data In addition, there's an opportunity there to be able to revoke that data, pull that data back at some point.

100%.

And that's something we've never had, right? In the analog world, that doesn't exist. Once you've given it out, it's gone. And even in the first few steps of our digital evolution, once the data's out there, it's out there. But now when we're talking that next generation, when we're talking about, you know, potentially blockchains or or, you know, being able to put controls around data attributes. Is that what we're going to be able to do as individuals? Revocate data and pull data back?

Absolutely. I mean, in actual fact, that technology already exists. It's actually more a matter of people building out to that use case than the technology needing to be created to do this. So, you know, another company I work with pretty closely and I'm on the board of is a company called Digital Asset. And Digital Asset is building complex business workflows between market participants who might be banks, for example, regulators who need read-only access to certain parts of the ledger record. So they might only see 3 of the fields out of 20 in, let's say, some kind of syndicated deal that's going on between the banks. So this kind of workflow now is already being created in the institutional space and in the proprietary space. And there are a number of companies now looking to do the exact same thing for individuals. And, and if you think about it, there's, there's quite a rich opportunity there. So even if you just think about your own data, and if you just tell me how many different data places do you use, and just think about, you know, your iPhone, your iPad, your, your Windows box, you know, Dropbox, Box, all these things. I mean, if you think about it, how many do you think it is for your average person?

It's got to be over 100, and they probably don't even know all of it. It's not even cognizant because even the office apps you're using are now connected to some backend cloud, right? So it's every app you're using, every device you're using, and then the chain of what they're using because they also have digital suppliers, right? And who they're sharing it with. And I don't even know if there's a map out there to say how much that data stream flows.

So I think, you know, one of the things we're seeing emerge there is this notion of being able to control at least the policy on those platforms for companies. So, you know, companies that can allow you to set a policy for anything you share on Dropbox to 2 weeks, report on all exceptions, you know, outside of the 2 weeks, which could require an investigation but may not. It might be a legitimate use case. But starting to think about data information security the way a CISO does, but implemented in a simple enough way for just the consumer to use. That's the thinking I think that's needed here.

That's interesting. That's interesting. So let me throw an idea, you know, at you because I think it's gonna be important given how much data we're generating and who's gonna have it and who's, where it's being sold or maliciously shared. Um, it's got to be important to know who has our data, right? Um, in the finance world, there's already a requirement that they give you some kind of notice or statement quarterly or something that we have your data, we have your records, so on and so forth. Do you think there's— we're going to see that same thing from a regulatory space eventually down the road? Where there will be a rule that says, hey, if you've got Andy's personal information, you have to send him a notice once a quarter to say who you are, who you've shared it with, and what data you have. And that then would give you the ability to revoke that, or at least track where it came from, you know, where it's bleeding out. Do you think that's something down the path?

I do. I think that all of these things require enough technology to make the management of that, uh, simple. And so what you've just outlined, and if we talked about 100 endpoints with different kinds of data in them, the good news is the data is all kind of the same. It's photos, it's PDFs, it's Word documents, and so on. So I think, I think the, the technique that can be used to manage that can be consistent. Um, but, but the, in order for that to happen, if you like, First of all, there has to be public debate. Then there needs to be a policy framework that says that actually we can create legislation that requires this within some timeframe. And then people will need to react to that. Now, if you think about kind of, you know, the CEO of Google, CEO of Facebook, you know, being in front of Congress on a reasonably regular basis, and very recently around this whole topic of privacy and customer information, And you think back to the 2016 election, Cambridge Analytica, the great hack, all of that stuff. I think, I think that, that there's sufficient evidence out there right now that there does need to be the right public debate and the right policy framework put in place. Some states are way ahead of that, like California and New York in the US, right? And like, like Europe with GDPR. Um, but I think honestly, the, the frameworks that have been put out there right now are a first generation of data privacy requirements. Because you've got to imagine that if we think about the amount of data being created now being huge, imagine what it will be like in 5 years' time. Because if you think about 5 years ago versus now, so I think, I think that kind of, if you like, is the basis for the requirements of a mechanism for policy management for personal data. And by the way, that's true for the enterprise. If you think back to you know, a regulation like SEC 17, which required the banks to keep essentially all instant messages, all electronic communication actually, including email, IM, and now video as well, uh, for 7 years. Um, you know, they did put criteria around it. They said you have to keep it for 7 years. It can be subpoenaed. There can be a legal hold put on it so it has to be kept for longer. But this whole notion of policy around data has existed in the corporate world for quite a long time. So I think we're really taking things that exist already, at least in terms of frameworks, and then applying them at a much broader level. But obviously the scale of the number of people and the amount of data in the consumer space is crazy.

So let's take it a little bit because you had mentioned things like the election and society and so forth. You know, with all this data about all of us being so available, there's, there's obviously risks of abuse risks of inequality, amplifying inequities, things of that sort. And, you know, how do you see as we move forward— because you talked about a lot of controls there, you talked about being able to own your data and revoke it and limit it— how do you think those capabilities will either help or hurt equality and, and equity in society moving forward?

That's a very broad topic, but let's, let's start off with kind of things that we know we can do. So if you could control your data, let's say you could, so your videos and your photos were controlled, and let's say they were watermarked as well. And now people who were essentially creating frauds or fakes of your photos or videos, um, are taking a watermarked document, uh, and, and trying to transform it. They're changing the face, they are, um, deliberately trying to create misinformation. Um, so this whole notion of fakes right now.

Yeah, deepfakes and everything else.

Yes, absolutely. So, so I mean, the way I think about all these things is The easiest way to start is with whitelisting. So, so essentially, if you've whitelisted everything and said, you know what, this is mine, I own it, it's watermarked, and you know, unless you're extraordinarily sophisticated, recreating the watermark is going to be really hard, right? Especially if you checksum everything. I mean, it's pretty hard to do. So, so I think that we're going to move into a world where known good on things like news stories, on things like videos is actually the requirement, or it's a filter you can turn on. I only want to see known good stories, right? And there's going to be a set of criteria for those stories, which basically are that the originator of the story and the digital supply chain that delivered the story to me— maybe I'm reading in Apple News, or maybe I'm reading it in Google News, or whatever— but that supply chain between the story originator and the place where I'm reading it is guaranteed with integrity. Right. That's how you build a known good architecture. So I think, I think we're going to see that done on blockchain. So, so the beautiful thing about digital ledgers and blockchain is they're immutable, right? What's in there is in there. You can, you can add append records, but the original thing is there. So, so to me, I think, you know, now we've got scale in many of these ledger technologies. We can start to think about media being part of the way that that scales. And it's the ledger thinking. And maybe, you know, if you add quantum, which then changes the processing speed and so on of how you get things into ledgers, maybe you could do everything. Maybe you could put the whole thing in there. I think, you know, whenever anyone says you can't do something, there's someone else who says, I'm gonna figure out how to do it.

Yeah. Hold my beer. Right.

So I do see this world of known good of signed artifacts using digital identity being essentially guaranteed as authentic and everything else being potentially suspect. It doesn't mean it is suspect, it just means it's potentially suspect.

It just hasn't been verified, right?

Exactly.

Measure of trust is assigned or not assigned.

Exactly. I saw a solution today, which is one of the most simple things I've seen in ages, and it's Brilliant. And it's, it's a solution to stop phone spam for brands that actually want to connect to their customers. So at the time the phone call comes in, it actually verifies whether the phone call originated from, uh, you know, a, a call center or contact center owned by the brand. And if not, it just sends it to the Bitbucket. And so, no, because people are using these known numbers as a mechanism for getting people to pick up to try and fraud them and phish them and scam them and so on. But this idea that you can actually fix that problem with literally a simple callback into the ACD that says, you know, did this number originate to this number? And it's like a 0.01-second yes or no. And if it's a no, then off you go to the Bitbucket. So I think even with something as annoying and as pervasive as, you know, phone spam, you can start to solve that problem. Now, if you tie digital identity into that as well, so I know the digital identity of the originator, I know the digital identity of the receiver. Now you can do things even cleverer. I mean, you can be much more— you can have everything encrypted. You can have that entire conversation also be recorded on blockchain. Right. So I think that we are going— and that's technology that's here now. Right. They're in deployment. Right. So I do think that we're going to see known good emerge as a technique in many industries for guaranteeing that, you know, what you see is what's real, not what somebody wanted you to see.

So what are the financial incentives around that then, right? I mean, there is effort there and there's something worth value. Is the end consumer going to be charged for that, or do you see the financial burden actually downstream to the marketing companies or the companies that are servicing the customer? Where do you see that burden get absorbed?

So I think right now, you asked the question earlier about monetization, and this is a super important question. So when you're using Gmail, and Gmail is free basically and pretty much infinite, you don't really think about the things you're giving away um, when you sign up to use Gmail. And that's true of Facebook and Google and other platforms, uh, you know, as well. And so I, I think what's— what will change is the valuation of what you think is free will become understood not to be free. It actually is what causes all these spam calls. It's what is causing data sharing between credit card issuers and massive merchant aggregators, basically. And so, if you think about it that way, I think it's inevitable that you're going to end up in a situation where you have to pay in exchange for services that do not do the kind of things that those services do if you don't want that. Now, if you like, alongside that, so you've got a world now on the left-hand side of the chasm that is not targeting you with things that you don't ask for, you don't want. And that's a—

Hugely private, hugely private, full control.

And you have to pay for those services that are private in the same way you pay for Netflix. And Netflix is a good service. It knows what you like. It offers you other things, you know, and, you know, I won't say any more than that.

It's also gathering your data, but okay. Yes.

Well, maybe it's gathering it to help you. I mean, that's the good thought there, right? On the right-hand side of the chasm, you've got people whose business models are centered around monetizing your data. And, you know, the way that the contracts are written with those companies is that they own that data because when you signed up, you signed away the rights to that data. Right.

That's the free, you know, piece of it. You don't pay, but you actually are the product.

Yes, exactly. So, so, so when I said earlier, before you do anything on the policy side, you have to have a public debate. Part of that public debate is about education, right? And, and creating comparable costs, or comps that we call them in the industry, of if you're monetized by one of these providers, this is how much you're giving away every month, and this is the hassle factor. You know, this, this is basically Plan A. Right-hand side of the chasm. Left-hand side of the chasm, you're paying for account aggregation and it's costing you $2 a month. You're paying for contact management and it's costing you $0.10 a month. You're paying for these other things and your total bill is whatever, $50 a month, let's say. But the advantage of that is that you're in control of everything. And so, you know, I see the policy platforms created on the left-hand side of the chasm then starting to percolate into policy management on the right-hand side of the chasm. And here's how that works. Many of the functions that, that you would want to use to set policy on existing platforms exist, but they're buried inside the platform somewhere. And as those platforms become more regulated, by the way, those, those functions are going to become deeper, wider, and more consumer-centric, but they're going to be buried even further in the platform. Because the platform itself has a vested interest in the consumer not using those, those capabilities. So somebody that comes along and implements a policy framework that integrates with those platforms and you say, I want to own all of my photos. I mean, because that's how simple it would be. Do you want to own your photos? Yes. Okay, well, I'm going to make sure that all the photos you posted on these sites are deleted. Yeah, they still have a copy anyway, but whatever. And I'm going to make sure those photos are copied someplace where you own them. Right. So, so, so this whole notion of essentially integrating with the current business model, but allowing policy to be enforced across the current business model while a new business model emerges, I think that's the way I expect the market to evolve from where we are today. I mean, that's, that's a prediction. It's not, it's not, it's not something that's based on fact, but there are, there are certain companies that are already thinking about this and working on it. And the thing I find with privacy advocates like the lady that runs fixfake.com, for example, I mean, these people are passionate. They really care about what they're doing and they really want to help educate people around the value of what they're giving away for free.

Now, that makes sense. Okay, so you've got on one side of the hand, we have to pay for our privacy. On the other hand, we get it free, but We have no privacy, we surrender it. And it's not a binary decision, right? It's gotta be a scale here. And you had mentioned some likely capabilities that we're gonna be able to start flipping certain switches to say, okay, I started with my pictures being on a free service, but now I wanna pay and pull that back. And it may be as simple as a checkbox in the tool that you're using, and now you're being charged and they take care of that for you. Do you also see business incentives? So for example, WeChat, right, was, you know, changed their privacy policy and some things that happened and a lot of, there was some rebellion there. And many users left WeChat because of the privacy concerns. And where did they go? They went to things like Signal, Telegram, which also have privacy much better than WeChat, and yet it's still free. They've got premium versions, but do you think privacy will be a competitive advantage and that will also lure, or should I say, push the industry to explore more on that privacy side of the spectrum?

I think that in the model that I described where the new world is emerging with the privacy built in and the old world is having to adapt in kind of the way that you just said. So maybe the existing services that are about monetizing me are actually now adapted to not monetize me if I pay, right? Because there's an equivalence in terms of value here. So you could argue it's a trade. For companies like that. The problem is, if all of your real revenue comes from advertising or selling the data to others, then it's quite a big pivot or quite a big transformation for companies like that to go through. So let's kind of think about what companies have been through those kind of transformations in the past and how well have they done. So I would say if you went back 10 years and you looked at Microsoft and Adobe that sold on-prem products on Windows. So Office was a product that ran on top of Windows. I can't remember if there was a Mac version 10 years ago or not. There probably was. Um, but one thing's for sure, there wasn't a cloud version. And all of Adobe's products were also deployed on local machines, and there was no cloud version. Now, now, um, both companies went through a significant change to move to cloud. Not only did they have to refactor their products completely they had to change their entire financial system. So they moved from, you know, 605 to 606. They started to charge SaaS revenue, which is what the 606 model is. And these things are non-trivial. I mean, you have to have separate books. You've got to run a very, very complex infrastructure while you're hybrid. But when you get to the other side and you've got everything on a subscription basis, you're in good shape.

Really good shape, right? Look at their valuations. Huge. Right.

So if you look at the fastest growing businesses in the world and you think about businesses you would invest in, nearly all of them are SaaS businesses. And SaaS is starting to pervade verticals that it was never in before, like health tech, like meditech, like insurance, and so on. So, so is it feasible that the consumer, the consumer platforms that exist today get SaaSified at the same time as new competitors emerge. So if we think about something simple like HR systems, you know, Oracle bought PeopleSoft, SAP had an HR system, there were a few smaller companies in that space, and then Workday emerged with a SaaS platform that literally just grew like a weed, right? And it forced the other companies to move their HR platforms to the cloud. Is it possible that the companies on the left-hand side of the chasm that are building fast, they're building based on a subscription model, The company I mentioned to you before, um, @sign, now has a stack of developers building new functionality on the platform. Is it possible that that momentum starts to drive the right-hand side of the chasm to move towards a subscription model? I think it is, and it's happened before, so that's why I think it's, it's feasible. So it could happen faster than you think, because if you have the public debate and the policy framework in place, which is going to be you know, you need to comply with this by some time scale, right, reasonable time scale, um, which is likely to be 3 to 5 years, I would say, um, that then, then it becomes completely feasible that what you said could happen. So, so I don't know what order that will happen in, but I think the start of the discussion is going to be the federal level discussion around privacy and what that ends up looking like in terms of legislation. Because that will both legitimize the left-hand side of the chasm and force the right-hand side of the chasm to start thinking about business models that they maybe aren't in today, or it's on some white paper that they wrote 3 years ago which said, well, if they implement this federal privacy, then this is what we would do, you know. And so, so I, I think we're going to see significant movement during this administration. I think in the next 4 years we're going to see that move significantly.

So that's a big domino that, that's gonna fall or has to fall in order for us to kind of move forward, both with the simple discussion out in, uh, in the public for, uh, everyone to understand, you know, what are the challenges and, and what are the risks, what are the opportunities, as well as start implementing some of the regulations that become a forcing function, uh, to raise all boats. And then that pushes that whole data environment forward, hopefully to a much better place where people are empowered, right? Data is used for good and less for bad, and we're more aware of it, and we're willing to accept our responsibility as part of that greater data ecosystem.

I think, yeah, I agree. I think, I think if you think about it almost the way enterprises do, you're going to end up with profiles and role types. So you're gonna end up with, you know, slightly conservative, conservative, you know, very liberal with regard to data sharing and so on. So you'll end up with a set of types and those types will be roles that you can implement both on the left-hand side and the right-hand side at the same time because in the end, you know, people are typed, right? People are comfortable, they're shy, they're private, they're very open and extrovert. So there's different kinds of people, and I think you'll see, um, you know, framework emerge that allows you to, to group that, which will make the management of the policy and entitlements miles simpler. So I think when you're thinking about how to design something to do that, that's, that's the way you would think about it. What are the key role types or behavioral types, uh, that we're looking for? So if you look at a company like, you know, Genes.ai, which is a couple of the folks from Cambridge Analytica. They've done a lot of work on this psychological testing to look at what kind of people like what kind of things. So you kind of need that type model, I think, to come up with a very simple way of implementing this. Because it might be for some people, like my dad— I mean, he uses Facebook, um, you know, he's 85. I think I would like to help him pick one of those role types and profile types that would be suitable for his use that would stop him doing anything that would be dangerous for him, for example. So I think, I think that's, that's kind of the way I see it.

Well, I think it's going to be a very interesting world where we can again achieve benefits that we probably can't even imagine, right, from a society and an individual perspective. And I know we're out of time for today, but I want to bring you back. I want to talk about You know, in order to get there, a lot of it centers around identifying individual people and making sure, you know, those policies are only being done for that person and that person has the rights to do that. And I think there's going to be a lot of tension, and especially when we talk about privacy, because that also can— well, that can be undermined when you start looking at positively identifying people and that becoming part of the dataset out in the real world. So I'd like to bring you back. I'd like to pick your brain in regards to some of the challenges around identity, some of the best practices, and what some of the companies out there are doing to innovate, to take on some of these challenges so that we can positively identify people but not sacrifice their privacy or the control of that private data. Are you interested? Are you up for it?

That sounds like a great subject for a future podcast.

All right, let's do it. We will get that, we will get that set up. So, you know, I just want to say thank you so much, Andy. It is always a great pleasure and understanding. You've got a great perspective in, in a lot of the companies out there and a lot of the brilliant people that are innovating and are seeing challenges that most of us just don't comprehend, we don't grasp. And they not only see them, they're innovating to develop solutions and capabilities and security and everything else. So I want to thank you, and, and I look forward to our next conversation.

Me too. Thank you very much.