Magazine menu Close Magazine menu

Policy

Latest stories

global transparency

The tech industry can’t go on this way. Here’s how it must change.

  • min read
    • If you're creating or investing in new technologies, today's landscape – with increasingly complex data regulation – can be daunting. What if shared technology standards and cooperation could help make things safer and better? These perspectives from global digital policy and tech leaders are highlights from Kaspersky's Shaping the Digital Future Summit 2020. Transparency protects technology users Tyson Johnson, CEO, CyberNB "Transparency is fundamental to critical infrastructure like utilities, telecommunications and healthcare working together. We need transparency to build a society that protects the technology user. "Lack of trust in the supply chain is a barrier to adoption, particularly for Incident Command Systems (ICS) and industrial internet of things (IIoT) systems. A trustworthy supply chain needs unifying, global standards to decide what technology is allowed. We need to look at cyberspace as a global commons needing global standards." Tech and policy leaders debate transparency in cybersecurity at Shaping the digital future summit, 2020. Welcoming the new tech entrepreneurs Cory Doctorow, journalist and science fiction writer "Interoperability in tech is understood narrowly, but it can be mystical – it's embedded in our world. We can wear different socks and shoes by different makers without asking their permission to swap. "Today, we see the erosion of competitive compatibility. New products that plug into existing products without the maker's permission. Apple reverse-engineered Microsoft's formats to make the iWork suite in 2005. Since then, they've blocked similar attempts from others at interoperable systems with their products. "With the rise of tech monopolies, technologists' horizons have shrunk, but India, the US and the EU all show interest in breaking monopolies. Tech entrepreneurs should set their sights high to dethrone big tech and own a piece of a smaller pie. "Every pirate wants to be an admiral. The state's role is to make sure the tools that made yesterday's upstarts successful are available for the next generation of entrepreneurs. "Would we ever have imagined the internet becoming just five dominant websites? If we don't imagine beyond, we can only try to get them to pull up their (interoperable) socks and behave themselves. We need to learn from former monopolies like AT&T and British Telecom. It's not that executives aren't good at accommodating billions of people's needs – no one can do that. "We need pluralism in services shaped by people who use them. GBWhatsApp, an East African WhatsApp clone with enhanced privacy, is maintained by local people to meet their needs. That's better than transparency – it's transparency plus autonomy. "An overseeing organization can help with standardization. But the answer isn't to try and make Zuckerberg (Facebook CEO) be the best overlord of six billion people he can be. It's to reduce his power. "Anti-competitive business models treat customers as adversaries, like a medical firm that patents an insulin pump that only works with their own-brand insulin. You can't override a policy set by the manufacturer. If a hack causes a malicious act, you can't change it, like this exposed vulnerability in Johnson & Johnson product that could lead to a dangerous overdose. "It's like the 'trolley dilemma' about who a self-driving car would save or kill in an accident. If we ever have a situation where a car may choose to hurt its owner, you're in deep security trouble." Transparency is no silver bullet Jon A Fanzun, Special Envoy, Switzerland's Federal Department of Foreign Affairs "Transparency isn't a silver bullet solution. It's a prerequisite that helps build trust. "Businesses report lack of uniform demand for cybersecurity products. There's a greater need in niche areas, but products are chosen on price and ease of use. In our Geneva Dialogue discussing responsible behavior in cyberspace, we hear concerns about complex regulatory frameworks. "We must develop a baseline of cybersecurity requirements that every organization can apply, and build capacity to help them meet regulatory demands. We need incentives to encourage developers to make more secure technologies, but there also needs to be incentives to buy more secure over lower-cost products." Securing the cyber age Eugene Kaspersky, CEO, Kaspersky "We're living in a world that's becoming more connected. From the Stone Age to the plastic age, technology is taking us into the cyber age. Our precious commodity is no longer physical resources – it's data. "Researchers at Kaspersky see threats increase in number and sophistication. To protect ourselves, we can make products less attractive to hackers as they're so secure the cost to attack outweighs the gain. We call this cyber-immunity. "We're building a world that depends on cyber to support its critical infrastructure, like healthcare and utilities. These systems are vulnerable in their design and deployed as a 'black box' – we don't know what's inside. But cybercriminals can open the box and take what they want. We'll face more cyberthreats if we rely on non-transparent frameworks. Without nations cooperating, it's hard to investigate cybercrime gangs working across borders. "Business leaders tell me they want to store their data in-house, so in case of a leak, they have access. They don't want a 'black box' – they want it to be transparent and accessible to their customers. "Some data should be kept and processed locally, as we've done by opening international data centers with our Global Transparency Initiative. These centers let customers review source code, as cybersecurity is critical for business transparency." Developing a toolkit for global cooperation Ghislain de Salins, Policy Analyst, OECD "The biggest threat of all is ourselves. There's limited cybersecurity awareness in society, but also little cooperation between stakeholders. Ethical hackers or security researchers can be threatened by big corporates when they reveal technology vulnerabilities. This doesn't help build a more secure world. "Cooperation is crucial. We need to shift responsibility to the supply side. A lot of the burden is on consumers to secure their devices, but we now see 'security by design' principles emerging that put the emphasis back on suppliers. "To establish standards, our challenge is an absence of norms. If you sell your product to 13 markets, you need to comply with 13 regulatory frameworks. It dilutes rather than improves security efforts. "Designing policy is like designing software – it's iterative. Try something, and if it fails, change tack. Transparency policy isn't an end in itself. It's a means to empower stakeholders to hold each other accountable. It's not about regulatory frameworks or rigid regulation. At OECD, we prefer to adopt a 'toolkit' with different tools that best fit your policy objective, like voluntary standards and self-certification. We see an appetite for governments to do more, which happens when voluntary frameworks don't go far enough." Build cyber-resilience as businesses go digital Evgeniya Naumova, Vice President of Global Sales Network, Kaspersky "Cybersecurity isn't just about protecting hardware or software. It's about protecting people. Cybersecure systems help protect our workplaces, data and health. Recently, the world was shocked by the first patient death related to a cyberattack. Perhaps it's no surprise – TV and movies have long played out this threat. "Business and society rely on IT systems to function. They need to be cyber resilient. A compromised system causes more than cybersecurity damage – it hemorrhages data, money and customer trust. "You need to strengthen your infrastructure and supply chain, like monitoring your vendor's data usage. We regularly review our ecosystem and give our partners tools to protect themselves. We choose reliable software and security-assessed third-party applications through our Cyber Capacity Build Program. "You can earn trust by being more transparent. Kaspersky asked people in 15 countries if transparency is essential. One in two think governments should be transparent about how they process data. A transparency policy helps, which may contain independent test results and data processing information. Our 2020 survey of businesses found nearly 2 in 5 have no transparency policy. Telecoms and utilities are advancing faster; 68 percent have a policy. But healthcare (57 percent) and government (54 percent) are falling behind. There's more work to be done." Opinions reflect an edited version of those expressed by the speaker at the event.
brittany kaiser interview

After Cambridge Analytica, Brittany Kaiser has a solution for personal data privacy

  • min read
    • In 2018 she hit the headlines as the whistle-blower exposing data privacy violations between Cambridge Analytica and Facebook. Trained as a human rights lawyer, Brittany Kaiser since testified at the UK government's fake news inquiry. Kaiser has now established a foundation helping the next generation live a safer digital life to experience the benefits of technology, and has explored her experiences in her book, Targeted, and the Netflix documentary The Great Hack. I spoke with Brittany about how personal data use could shift from harming to saving society, and what business can do. Brittany Kaiser, Co-Founder, Own Your Data Foundation Susi O'Neill: How can legislation best protect our data rights? Brittany Kaiser: There's a dichotomy in the privacy community: Many say data rights should be human rights. But we've had human rights protecting privacy enshrined in law for decades. During my legal training, I was frustrated by how hard it is to uphold human rights law in court. People can't easily get compensation for human rights abuses. Privacy isn't real – suing to protect it under human rights has never worked. A legal framework won't help when data is the world's most valuable asset class. It's a multi-trillion dollar industry – we can't stop it from functioning. Access to data makes organizations more effective. We should legislate so people are protected from bad actors and abuse, but in a way that lets artificial intelligence, data science and the internet of things (IoT) help us solve the world's greatest problems. How can we change the status quo of organizations, rather than people, owning our data? The framework I like to work with is data ownership. Property is the most potent form of law. If someone damages your property, you'll win compensation, even with fractional ownership. If I own 20 percent of Facebook's data about me, I should get 20 percent of the revenue from it. Data ownership as a business model could look a lot like Airbnb. If data is my property like my house, if you want to use it, I say how you can use it, for how long, and we agree a price before I hand over the keys. It should be transparent. Perhaps I give a license for six months or a year. Then I get compensated, either upfront or as a dividend based on use. This solves the world's most significant human rights problem: Extreme poverty. Many supply chains are damaged after the pandemic – the United Nations says 270 million are at risk of starvation. If everyone owns their data, some could earn enough to feed themselves. Zuckerberg (Mark Zuckerberg, Facebook CEO) says everyone's data is only worth 17 US dollars a quarter. I think it's worth far more and that's just Facebook data, but let's work with this figure. Two billion people live on less than 2 US dollars a day, so 17 dollars every three months would make a huge difference. Data could solve poverty. It's a bold and far-reaching idea that personal data could be turned into personal value. How can we improve privacy standards at the same time? Right now, data protection and privacy legislation is an ideal. It's new, and we're in a pandemic where some countries have given exemptions, so laws haven't been fully ratified. We're heading in the right direction to provide more transparency and rights. The goal should be, once people are educated, we have the legislation in place and technologies to secure our data. After that, no one should access it until we give consent. And we consent because we're incentivized. Now we have no incentive, so people shout about privacy. There's no benefit except to open ourselves up to abuse. Business and government have exposed us to this. What if we flip the incentive structure? I could share my data with a diabetes research company, earn money and help cure diabetes. People would opt-in. How would a personal data market work in practice? Personal data is the world's most valuable industry, but we can't see or participate in it, even though our data is in these markets. We should control and decide which data markets to take part in and what to consent to. Like sharing your data with the government so they can help prevent a terrorist attack. Or a pharma researcher, so medicines work better on women and minorities, rather than the 18-year-old white guys that sign up to medical trials for beer money. You could consent to smart cities and IoT (internet of things), so there are fewer traffic accidents. You could use your time to do surveys or watch targeted content for a universal earned income. Most policymakers propose a universal basic income as a handout from the government. The income from your data you've earned from its value – it's not a handout. It could pay for a few groceries, or in some economies, for your apartment. A 'data wallet' could show the data you're producing and opportunities to join different marketplaces or research. You decide which opportunities to participate in. Thousands of companies are building solutions to solve parts of this problem – digital identity management, smart contracts and automated monetization like token rewards or digital money. Soon, we'll see enterprise-level solutions that we can use reliably. After your experience with the Cambridge Analytica scandal, you've talked about data being used as a weapon in democracy. What does this mean? Data weaponization means using data to target people for purposes they didn't consent to. It could be considered violent. Data has been used to target people who break social norms, to incite racial hatred and violence, and by political organizations to suppress voters. We need to solve this problem in a more systemic way. Put pressure on big tech companies who are doing too little, too late. We need to pass regulation that demands they invest. With the money they make, they could invest more in solving this problem. Zuckerberg says he's got thousands of people working on it. Why don't you have hundreds of thousands of people solving it? It's nothing compared to efforts made towards shareholder profits. What role can regulation and cyber standards play in safeguarding our data? I'm doing legal work about the custodian responsibilities and standards expected of those holding our data. If they prioritize fiduciary responsibilities before obligations to shareholders, there will be more ethical practices. Right now, the greatest responsibility is consumer protection, but organizations have little incentive to protect your data. Facebook has already been fined over 5 billion US dollars for failing to protect its customers. But it isn't enough. We need stricter legal protocols. In 2019, Senator Elizabeth Warren put the Corporate Executive Accountability Act bill to the US government. It's proposed that if a company allows a data breach or hack through negligence, its executives are criminally liable. It's a vital step. If Zuckerberg or Sheryl Sandberg (Facebook COO) thought they were going to jail or lose their job, they'd have more incentive to protect people. In both the Cambridge Analytica and Equifax scandals, it's gross negligence. It's nothing to do with cybersecurity protocols. For Equifax, 3,000 security certificates weren't updated, then they got hacked. And their business is holding and sharing personal data. I was an expert witness in the case against them. A lawyer said not installing the update was like leaving the house with the doors open and lights on, then being surprised to get robbed. We need to enforce higher cybersecurity standards if you want to hold personal data. If you've shown good practice and have upheld standards, then no, you shouldn't be held criminally liable as you've done everything you reasonably can. Some hackers are really good, and some vulnerabilities too hard to predict. What can governments and regulators do to help businesses comply? I believe most businesses want to do the right thing. We need to make it easy and affordable for them. That's one of the most important things about California's Proposition 24. They've established the first data protection commission. 50 staff will use their expertise to help companies comply, so it's not a burden. We need more of this worldwide, particularly as many businesses and economies have taken a hit with the pandemic. What advice would you give an employee if they see a potential data breach in their company? Always raise the red flag internally first. Your company may not know they're doing something wrong, or it's a decision by one rogue employee. They could fix it. But if you continually raise flags and suddenly you're being cut out of meetings, getting cold-shouldered, or you get fired, it's time to go public. A whistleblowing lawyer is one path, or you could directly approach a data regulator. Hold the company to account to make sure they comply and can't misuse their power. What's the philosophy of your Own Your Data Foundation? I co-founded the Own Your Data Foundation in 2019 when I realized it would take time to get the right data protection legislation, and the enterprise-level tech isn't yet available. The sustainable way is to empower people to protect themselves. We give digital literacy training for the Digital Intelligence (DQ) curriculum, which this year became an Institute of Electrical and Electronics Engineers (IEEE) global standard. Leading technology universities, government ministries, think tanks and Microsoft developed it. It's supported by UNICEF, the World Economic Forum and OECD. It begins by assessing your digital intelligence and giving you a DQ score – like IQ or EQ – to improve upon. Training topics include your data rights, cybersecurity protocols and media literacy. Tests include spotting fake news and phishing, how to show emotional intelligence online and protecting yourself and others from cyberbullying. We also explore mental and physical health and stop device addiction. After I'd trained to be a human rights lawyer with Amal Clooney, my first paid job was at Amnesty International in London. Over ten years, they implemented a human rights education program through 13 countries' education ministries. For the DQ program, I'm excited as the IEEE standard was only released this year. The Kingdom of Saudi Arabia announced at the G20 Summit they're adopting it and will include it in their national education curriculum by 2022. In ten years, I hope every country is teaching this. What problem does the DQ curriculum help solve? This year we've been thrown into a new digital life unprepared, with far more screen time and more platforms. Many people aren't yet digitally literate. We have to educate fast. That's why we're delivering our courses low-cost, or free in some cases, with virtual classes and resources to make it accessible across the world. DQ is essential. It should be part of everyone's education – whether you're a child, parent or worker. Older people are also vulnerable as some are using this tech for the first time. Our foundation delivers training of trainers, supporting the teachers, to establish good habits early for young people. Many companies' most significant cybersecurity risk is a staff member who doesn't recognize a phishing attempt. At work, HR should deliver professional programs, training new staff to protect themselves and your organization. To find out more about digital intelligence (DQ) training, contact Own Your Data Foundation. Comments represent the opinions of the interviewee.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries