Does Your Privacy Scale?

scale.bythebay.io: Devin Loftis, Does Your Privacy Scale?

Recording: scale.bythebay.io: Devin Loftis, Does Your Privacy Scale?

so coming in here thanks for coming to a talk on privacy and I'm going to apologize ahead of time there's no code in this talk this is a very high-level talk I've gone to conferences and spent all days at conferences about this topic so I try to distill it down into 20 minutes let's see how I do so about me VP of engineering of alumel I'll talk a little about what Val ml does here in a second but basically I am familiar with privacy and compliance frameworks because I've taken several companies through these frameworks before done privacy as a director of engineering or VP of engineering and those roles or as a systems developer as well you know I'm providing my my input based on past experience and yes I am from the south you'll detect an accent through the talk and this keeps running on me so I'm not a lawyer I'm not a government representative I'm not selling services I have a job I don't want to I don't want a night job and I'm not advocating a comprehensive solution and I'm not a psychic these these things are changing a little bit there's still a little wiggle room and these these frameworks so I'll do my best to kind of point those things out real quick you know just I want to talk a little bit about Val ml and what we do we are a security company as well we care about privacy our job is to protect domains and emailing domains from being fished or used for phishing attack vectors online today we've authenticated three billion plus emails I'm happy to talk to you about what we do this isn't a pitch but just wanted to give you a little idea and background on what we do in Balham L because you can see where I care about privacy very succinctly and you know it's something that we care deeply about it Balam L so I'm going to start talking about the just regulatory landscape of things right now this is a little background again it's a little dry but it's important to understand you know what we're looking at and so this quote kind of sums it up well this quote is from Bill Gates I'll let you read it but while you're reading it you know basically what we have is a trust issue there's this this perception that there's these big companies collecting all this data about us and they're using this data in a way we can understand I mean we gather what you know pet you know what quintillion bytes of data a day it's a two hundred billion dollar business almost I mean there's a lot of information going on and we're all sitting at a data conference it's paying our it's paying the bills for us as well so there's a lot of mistrust when it comes out there with data and so what's happened to our states and local municipalities have looked at that and said we need to do something here we need regulations we need to regulate this industry we need to regulate data what they disconnected how its collected and so what happened was you had the situation on the the left where you had a bunch of different regulatory agencies popping up and the you are trying to play whack-a-mole with privacy you were trying to meet all these different standards and you know what's happened now is those standards have consolidated and they've consolidated two privacy shield the the term you use you'll hear these days because it's six months away is gdpr this is not a talk on GDP are I can talk to you about GDP are again I'm not licensed but I can't talk to you about it is something we're looking at right now and there are these cross-border privacy regulations between like the US Mexico the APEC region and so these these regulations are starting to standardize they're starting to overlap a lot but there's some subtle differences and so what I looked at is and I'm hitting button too quickly here what I looked at was what can we do with systems engineers data engineers developers and number one is know what your privacy statement says I mean it sounds really basic but I've read a lot of privacy statements I've drafted privacy statements but I understand what happens within your privacy statement because this is the tool that regulators will look at when they're looking at your company and it defines what you can and can't do with data within your company so number one if you don't have one draft one there's examples if you work with a law firm you have a VCU you're an incubator there's resources to drop these things but also understand what's in there it defines who your who you're talking to who who can who you can collect data from how you can collect data those types of things and so just understand what's in that privacy statement and then finally contracts play a role in this too when you're working with other vendors and providing data to other vendors or in the public domain I understand what you're allowed to do and what you're not allowed to do again I'm not talking to you from the point of view of drafting these things but it's very important as an engineer you understand what's going on within these vehicles as far as data because this is what regulators look at so the term you'll hear thrown out the gdpr is it's a big thing within gdpr it's a big thing with privacy shield is this concept of designing for privacy so what does that mean it's a very vague term essentially if you look at definitions and you talk to people it really means store only what you need to store so it sounds common sense but no data hoarding you get away from data hoarding or classify or storing data especially sensitive personal information that you don't need just because you think you might need it the advice would be not the stored if you don't need it or don't have an explicit purpose for it and then you know isolate that data as well I mean we work with microservices distributed systems things like that throwing everything in a big data lake is great but if that data lake is somehow compromised you have access to everything so you know store data in isolation it's just good domain you know it's domain driven design it's you know just very good practice and that way if there is a breach or compromise you know part of the data might be compromised but yeah you could potentially isolate data and not have it all compromised and then finally understand what's in your systems as well and so this is something that a compliance officer replied knocking to your desk one day and asked for and it will be a data privacy assessment or data privacy impact assessment just be aware it's coming especially if you do business with any citizens in the EU or your company is transferring data from the EU to the US and so what they're going to really want to know is what data you're storing and classification in the data if it's personal if it's sensitive sensitive information is like healthcare information or it's information used to classify people that are in unions or political preferences or sexual orientation things like that also they're what I know if you encrypt your data so encrypt your data at rest if you're an Amazon this is dirt simple so encrypt your data use HTTPS know where it's stored know who has access to it and know who it's shared with explicitly who it shared with those are the things they are going to be interested in so if you can get out ahead of it you'll save yourself a lot of headache down the road so next is opting in and so this is Devon's attempt at creating us alive because I thought I had too many words on my slide so I wanted to put some graphics up there but the opting in is very important right now so when users sign up for your system they have to explicitly opt-in to your terms and privacy that is very explicit it's very well it's a best practice now and then there's this other step and this is called the double opt-in where you have to send them a message and you have to authenticate that they are who they say they are MailChimp's in trouble for this right now actually we are good friends with MailChimp we know them very well but they actually by default turned off double opt-in a while back and that caused a controversy and especially be dealing with again EU a privacy shield data in the EU double opt-in is a must and then once you do an opt-in you have to give customers the opportunity to opt out of your system as well this can be as simple as disabling their account I mean this doesn't have to be very explicit doesn't it be very fancy but there has to be a mechanism to where they can say I don't want to use your service anymore so you know I'm turning off my access and you have to honor that access so next is kind of data locality this is a more advanced issue and you know I'm waiting my hands here a little bit I know this is a lot harder to implement than I'm talking as I'm talking about it but first and foremost try to keep your data as close to the to the users country residents as possible I'll say that or region if they're in the or something like that and especially if it's sensitive or government data or heavily data for heavily regulated industries easy for me to say it has to stay a lot of times within that country within that country's balance and then if to get around like we all do machine learning AI we want to classify this data we want to train on this data so if you are doing that try to try to transmit that data in aggregate if you can't or souter naanum eyes that data as you're sending it or transferring it so that personal information isn't leaked or compromised or anyway next is this concept of and I told you I was going through this very fast I'm happy to talk more about it one on one if you need to but it's a very important concept for people is this idea of a right to be forgotten and what this is stating at a very high level is I don't want my data in your system anymore remove all personal information from your system our information that you've collected about me in your system again this is the trust issue of companies gathering massive amounts of information I don't know what decisions are being made I don't know how my data is being used so get my data out of your system this is really tricky and the regulations are a little vague and there's a lot of great area here so as you start digging into this you you'll bang your head against your desk a little bit because there are some reasons to retain data obviously if it's needed for legal reasons if it's needed for you know business operations think of fraud detection or statute of limitation things like that you have the right to retain that data another one is you have to provide evidence that the data was deleted right so you have to somehow retain a record saying that you deleted their data again there's ways to do that and maintain private maintain privacy but that's one of the other issues you'll run into there and then on the data portability side of things there are mandates dating that users must be able to export their data from your system and that data needs to be in a structured machine readable format who knows what that is right it could be CSV it can be JSON it can be whatever this doesn't have to be automated either this could be someone making a privacy request and you say 30 and just in your privacy saving you say 30 days later we'll get all the data your system a lot easier said than done I know but those are some of the things that the regular regulators are looking for so let's talk about profiling real quick so this is where this is especially in the EU where they're really sensitive about making automated decisions about users and so and if you are taking in data and you are making those decisions about users in an automated fashion there are serious implications if those decisions can affect a person's legality finances limits their opportunity if you're making like a recommendation decision for jobs or things like that Alec you can even discriminate by accident and there's a lot of you know case studies out there where people have accidentally been discriminated about through you know automated decisions and things like that so I won't go into those but you need to be aware of those things and if you do fall in this category of profiling users or making automated decisions about users you have to do these things that a minimum number one you have to make sure that a human can intervene in the decision making process and so in your pipeline somewhere you have to have a mechanism for a human to interact and alter that decision also you have to be able to explain how that's done in layman's terms so large matrices and a linear algebra and talking about back propagation is not going to be satisfactory to a user they're not going to understand that you have to explain in layman's terms how you're using data to make those decisions and then finally you have to allow a provision for users to challenge those decisions again these are decisions that are being made they're at a level where they're affecting those users personal lives but you have to have a mechanism it could be an email or something like that where they can challenge those decisions and this one's a little morbid but I think it's very relevant I spend a lot of time thinking about this at a security company plan for the worst and just assume a breach is going to happen you know Joe in accounting is gonna accidentally send out an email with a customer's information or something like that I mean assume some type of breach is going to happen so as an engineer you know there are some things we need to think about as we're designing these systems number one make sure you have you know some type of breach detection in place there's a lot of intrusion detection services or auditing logging there's a myriad of services out there so I'm not going to promote any of those but just make sure that you do have adequate controls in place so that you can detect that something did happen in your system or some anomalous activity happened within your system and then react don't sit on that oh that's probably nothing you know you know we won't do anything about that I think if anything there's a lot of sensitivity to this right now I think Equifax I think other breaches that have occurred and I think one of the things essence learn there is it's how we react to those breaches that really talk about who we are as a company or who we are as engineers there are having breaches out there that have been reacted to pretty quickly people talked about if they've gotten out in front of it and it's been kind of a ok it happened you know that's not great but you know we appreciate the way you responded to it and then part of that is just understanding where you fit into that pipeline of if there is a breach like you know understanding what you need to do who you need to communicate with who you need to notify and then the questions you're going to get asked over and over again is what date got compromised what data was affected who was affected when did this occur and so just be able to answer those questions with the intrusion detection services or whatever you have within your systems to detect these things ok so this is just kind of a summary of what you know a summary slide here I'll put these out so this is kind of a just a list of what I just went over but again this is at a very high level look at your trellis compliance and privacy frameworks out there these are just some things I pulled out that you know in general if you're practicing these things you'll make it through these efforts pretty pretty cleanly but I'm happy to answer more questions or dive down deep into any of these so if you need if you need to do that just hit me up I'll be around and that's it thank you [Applause] [Music] Thanks so it's about moving mr. Gaeta so do things of that what if you've got things like pawns or aggregation data you know what's the what's of the level where you have to retrain your models without these are big revisions about it and the second thing is like what happens if the person dies because then they're no longer available thank you for when you do Facebook you just like that how processes are you required to do right so I'll answer the second part of that one first the the death aspect that's a really interesting question so right now there's no obligation like you know if a person dies there's really no obligation there it's interesting I think Facebook did this recently a couple other companies I've heard about where they have this provision where you can delegate an account to someone after so many months of inactivity like in case of a death you can say like three months later you know a year later there's no activity on this account you can delegate it to you know loved one or something like that or next akin I that's not a regulation though that's just not something that required to I think some people are trying to be proactive here on the first question it's a it's a that's a really dicey question and I'll be honest with you depending on who you talk to you'll get a different answer but what I have gleaned from my conversations is as long as you have models and everything trained on personal data but within the model you can't get dive into that model and detect that oh this is Devon Loftus and San Francisco you're okay like if the data is an aggregate and the models at a level where there's a wide enough population of data statistically where you can't pinpoint specific users or specific people within that data you'll be good because that's data in aggregate in those terms and there they tend to be okay with that [Music] we seem to be able speaking from the perspective our roles as in place as in our oldest citizens what do you think are the biggest opportunities for raising the bar you know yes these things are going to have to be there written the regulations are there to explain this in terms that are common language but just raise the bar literacy for people understanding what's really happening might people say kinda see is dead but a lot of times I'm not really convinced that people just don't understand by taxes right so just simple things like what happens with the cookies in your gravity understand that which you've been willing to teach you four different steps to make something slightly different happen you know when you think are the best opportunities for sorting we're also we are all in place somewhere but we're also citizens right right so that's a great question and I I'll be honest I don't have a great answer from that so before that I come from a deeply read state by people who by some relatives who don't like to use a credit card because it might be tracked you know I mean I I have these discussions with people all the time and what I I think there's some level of the the technology is getting so ubiquitous in our daily lives that there's some level of okay well you're using your phone you're doing these things you know you're you know people aren't knocking on your door but I don't know I don't have a good answer of getting that out to the masses I do my own part like when I'm talking to my friends and relatives about what's going on when they see these breaches and things like that I talk to them like okay let's not REO 'very act here you know let's let's talk about things I actually promote services with them there's like services like have I been poned you know that where you put in your user name or an email address and it'll tell you you've been part of a data breach I actually subscribe to that service myself it's well well trusted it's not run by any company it's a guy that does it from Australia I recommend those types of services so they have some awareness of where their data is and what's going on but we're competing to against like I think marketing is playing a large part of this like we're competing against these companies are promoting darkweb scans that's possible right like you know and all these fear tactics are out there like you know why lawyer now getting in on board and like Oh have you been part of a breach and you know scaring people like that so you know we each have to do our part and promote what's going on and talk about what's really going on we need to all be able to explain it as well like I mean we you know we could go to a conference here talk about some very advanced topics but if you can't distill that topic down into some and talk to somebody that has no math background no computer background it's gonna sound very academic and it's gonna be very off-putting quite honestly so I think that's what we can do is learn how to explain these things in layman's terms to kind of dispel some of that myth and some of that you know are around these things but that's the best answer I have and it's not a great one [Music] [Applause]