 from San Francisco, it's theCUBE. Covering RSA Conference 2020 San Francisco, brought to you by SiliconANGLE Media. Hey, welcome back, everybody. Jeff Frick here with theCUBE. We're at RSA 2020 here at Moscone. It's a really pretty day outside in San Francisco. Unfortunately, we're at the basement of Moscone, but that's because this is the biggest thing going in security. It's probably 50,000 people. We haven't got the official number yet, but this is the place to be, and security is a really, really, really big deal, and we're excited to have our next guest. I haven't seen her for a little while, since Day to Privacy Day. I tried to get Scott McNeely to join us. He unfortunately was presposed to couldn't join us. It's Michelle, a fitter in identity. Just as good. Get her new job, the CEO of Drumwave. Michelle, great to see you. Great to see you too. I'm sorry, Ms. John, Privacy Day. I hope you celebrate it. I know, I know. So Drumwave, tell us all about Drumwave. Last we saw you, this is a new adventure since we last spoke. So this is my first early stage company. We're still seeking Series A. We're a young company, but our mantra is we are the data value company. So they have had this very robust analytics engine that goes into the heart of data and can track it and map it and make it beautiful. And along came McNeely, who actually sits on our board. Oh, does he? And they said, we need someone, it's all happening. So they asked Scott McNeely, who is the craziest person in privacy and data that you know? And he said, oh my God, get the identity woman. So they got the identity woman and that's what I do now. So I'm taking this analytics value engine. I'm pointing it to the board. As I've always said, Grace Hopper said, data value and data risk has to be on the corporate balance sheet. And so that's what we're building, is a data balance sheet for everyone to use to actually value data. So to actually put a value on the data. So this is a really interesting topic because people talk about the value of data. We see the value of data wrapped up not directly but indirectly in companies like Facebook and Google and those types of companies who clearly are leveraging data in a very different way. But it is not a line item on a balance sheet. They don't teach you that at business school next to capital assets. Right, so how are you attacking the problem? Because that's a huge, arguably, will be the biggest asset anyone will have on their balance sheet at some point in time. Absolutely, and so I go back to basic principles. The same as I did when I started privacy engineering. I look at, I say, okay, if we believe that data is an asset and I think that at least verbally, we all say the words yes, data is an asset instead of some sort of exhaust, then you have to look back and say, what's an asset? Well, an asset under the accounting rules is anything tangible or intangible that is likely to cause economic benefit. So you break that down. What is the thing? Why you got to map that thing? So where is your data? Well, data tells you where it is. Instead of bringing in clipboards and saying, hey, Jeff, my man, do you process BII? We don't do that, we go to your system and when you go on drum wave, you're automatically receiving an ontology that says what is this likely to be using some machine learning and then every single column proclaims itself and so we have a data provenance for every column. So you put that into an analytics engine and suddenly you can start asking human questions of real data. Do you ask the questions to assess the value of the data or is the ultimate valuation of that data in kind of the categorization and the ontology and knowing that I have this, this, this and this or we know what the real value is, the soft value is what you can do with it. But when you do the analytics on it, are you trying to get to kind of unlock what the potential underlying analytic value is of that data that you have in your possession? Yeah, so the short answer is both. And the longer answer is, so my co-founder Andre Veloso believes, and I believe too, that every conversation is a transaction. So just like you look at transactions within the banking context and you say, you have to know that it's there, creating a data ontology. You have to know what the context is. So when you upload your data, you receive a data provenance. Now you can actually look at, as a data controller, you open what we call your wallet, which is your portal into our analytics engine. And you can see across the various data wranglers, so each business unit has put their data on because the data's not leaving your place. It's either big data, small data, I don't really care data. Everything comes in through every business unit, loads up their data set, and we look across it and we say, what kind of data is there? So there's quantitative data saying, if you took off the first 10 lines of this column in marketing, now you have a lump of data that's pure analytics. You just share those credentials and combine that data set. You know you have a clean set of data that you can even sell, or you can create an analytic because you don't have any PII. For most data sets you look at relative value. So for example, one of the discussions I had with a customer today, we know when we fail in privacy. We have a privacy breach and we pair lawyers and so on. Do you know what a privacy success is? Hopefully it's like an offensive lineman. You don't hear their name the whole game, right? Because they don't get a holding call, right? Until they put the ball in the hole. So who's putting the ball in the hole? Sales is a privacy success. You've had a conversation with someone who was the right someone in context to sign on the bottom line. You have shared information in a proportionate way. If you have the wrong data, your sales cycle is slower. So we can show, are you efficiently sharing data? How does that correlate with the results of your business unit? Marketing is another privacy success. There's always that old adage that we know that 50% of marketing is a waste, but we don't know what's 50%. Well now we can look at it and say, all right, marketing can be looked at as people being prepared to buy your product or prepared to think in a new persuasive way. So who's clicking on that stuff? That used to be the metric. Now you should tie that back to how much are you storing for how long, related to who's clicking, and tying it to other metrics. So the minute you put data into an analytics engine, it's not me that's going to tell you how you're going to do your data balance sheet. You're going to tell me how dependent you are on digital transactions versus tangible building things, selling things, moving things, but everyone is a digital business now. And so we can put at least the intelligence on top of that. So you, the expert in value, can look at that value and make your own conclusions. And really what you're talking about then is tying it kind of to my own processes. So you're almost kind of parsing out the role of the data in doing what I'm trying to do with my everyday business. Exactly. So that's very different than looking at say something like say a Facebook or an Amazon or a Google that are using the data not necessarily, I mean they are supporting kind of regular processes, but they're getting the valuation bump because of the potential. Right or selling it or doing new businesses based on the data, not just the data and support of the current business. Exactly. So is that part of your program as well do you think? Absolutely. So we could do the same kind of ontology and value assessment for an Apple. Apple assesses value by keeping it close. And it's not like they're not exploiting data value. It's just that they're having everyone look into the closed garden and that's very valuable. Facebook started that way with Facebook circles and way back when and then they decided when they wanted to grow, they actually would start to share. And then it had some interesting consequences along the line. So you can actually look at both of those models as data valuation models. How much is it worth for an advertiser to get the insights about your customers, whether or not they're anonymized or not. And in certain contexts, so healthcare, you want it to be hyper-identifiable. You want it to be exactly that person. So that valuation is higher with a higher correlation of every time that PII is associated with a treatment to that specific person with the right name and the same sort of junior or a senior or a missus or doctor, all of that correlated into one. Now your value has gone up. Whether you're selling that data or what you're selling is services into that data which is that customer's needs and wants. What, in doing this with customers, what's been the biggest surprise in terms of a value, of a piece of value in the data that maybe just wasn't recognized or kind of below the covers or never really kind of had the direct correlation or association that it should have had? Yeah, so I don't know if I'm going to directly answer it or I'm going to sidewind it. But I think my biggest surprise, wasn't a surprise to me, it was a surprise to my customers. The customers thought we were going to assess their data so they could start selling it or they could buy other data sources, combine it and rich it and then either sell it or get these new insights. And that's what they brought you in for. Yeah, I know, cute, right? All right. All right. So I'm like, okay. The aha moment, of course, is that first of all, the, oh my God moment in data rarely happens. Sometimes in big research cases, you'll get an instance of some biometric that doesn't behave organically. But we're talking about human behavior here. So the aha, we should be selling phone data to people with phones should not be an aha. That's just bad marketing. Right, right. So instead the aha for me has been a how eager and desperate people are for actually looking at this. I really thought this was going to be a much more steep hill to climb to say, hey, data's an asset. I've been saying this for over 20 years now and people are kind of like, yeah, yeah, yeah. Now for the first time I'm seeing people really want to get on board and look comprehensively. So I thought we'd be doing little skinny pilots. Oh no, everyone wants to get all their data on board so they can start playing around with that. So that's been a really like a wake up call for a privacy go. Right, well it's kind of interesting because you're kind of at the tail end of, you know, kind of the hype cycle on big data, right? With Hadoop and all that that represented it and went up and down and everyone, nobody had. Well we thought more was more. We thought more was more, but we didn't have the skills to manage it and there was a lot of issues. But and so now you never hear about big data per se but data's pervasive everywhere. Data management is pervasive everywhere. And again we see the crazy valuations based on database companies that are clearly getting that. And data privacy companies. I mean, look at the market in BC land and any DCs that are looking at this, talk to mama. I know what to do. But we're seeing one feature companies like blowing up in the marketplace right now. People really want to know how to handle the risk side as well as the value side. Am I doing the right thing? That's my number one thing that not CPOs are because they all know how crazy it is out there. But it's Chief Financial Officers are my number one customer. They want to know that they're doing the right thing. Both in terms of investment but also in terms of morality and ethics. Am I doing the right thing? Am I growing the right kind of business? And how much of my big data is paying me back or going back to accountancy rules. The definition of a liability is an asset that is uncurated. So I can have a pencil factory because I sell pencils and that's great. That's where I house my pencils. I go and I get, but if something happened and somehow the driver disappeared and that general manager went away. Now I own a pencil factory that has holes in the roof that has rotting merchandise that kids can get into and maybe the ceiling falls or the fire. All that is, if I'm not utilizing that asset is a liability and we're seeing real money coming out of the European Union. There was a hotel case where the data that they were hoarding wasn't wrong. It was about real people who had stayed at their hotels. It just was in the 90s. And so they were fined 14.5 million euros for keeping stale data. An asset had turned into a liability and that's why you're constantly balancing. Is it value? Is it risk? Am I taking so much risk that I'm not compensating with value and vice versa? And I think that's the new aha moment of really looking at your data valuation. Yeah, and I think that was part of the big data thing too where people finally realized it's not a liability. Thinking about I got to buy servers to store it and I got to buy storage and I got to do all this stuff and they just let it fall on the floor. It's not cheap. But it's got a great, but it does have an asset value if you know what to do then. Absolutely. So let's shift gears about privacy specifically because obviously you are the queen of privacy. So GDPR went down and now we've got the California kind of version of GDPR. We do. Love to get kind of your update. Did you happen to be here earlier for the keynotes and there was a conversation on stage about the right to be forgotten? Oh dear God, now tell me. And is it even possible? And very steam group of panelists up there just talking about very simple instances where you know I searched on something that you did and now I want to be forgotten. Yeah. Your search gets pretty complicated. And it gets pretty complicated. Did no one watch Back to the Future? I guess not. Did we not watch that show Back to the Future where all their limbs start disappearing? Yes, yes. It's hard to implement some of these things. This has been my exhaustion with the right to be forgotten since the beginning. Humanity has never desired a right to be forgotten. Now people could go from one village to the next and redo themselves, but not without the knowledge that they gained in being who they were in the last village. Speaking to people along the way. Right? I mean, you become a different entity along the way. So the problem always was really differential publicity. So some dude doesn't pay back his debtors. He's called a bad guy. And suddenly any time you Google him or Bing him, it does Bing still there, right? So you could Bing someone, I guess. And then that would be the first search term. That was the harm. Was saying that your past shouldn't always come back to haunt you. And so what we tried to do is use this big, soupy term that doesn't exist in philosophy and art. The Chimera Rues had a great right to be forgotten plan. See how that went down? That was not very pleasant. No, it was not pleasant. Because what happens is you take out knowledge when you try to look backwards and say, well, we're going to keep this piece in there. We are what we are. I'm a red hot mess. But I'm a combination of my red hot messes. And some of the things I've learned are based on that. So there's a philosophical debate, but then there's also the pragmatic one of like, how do you fix it? Who fixes it? And who gets to decide who's right it is to be forgotten. Right. And what is the goal? I mean, that's probably the most important thing, right? Is what is the goal that we're trying to achieve? What is the bad thing that we're trying to avoid versus coming up with some kind of grandiose idea that probably is not possible, much less practical? There's a suit against the Catholic Church right now. I don't know if you've heard this. And they're not actually in Europe. They live in Vatican City, but there's a suit against about the right to be forgotten. If I decide I'm no longer Catholic, I'm not doing it mom, I'm hearing you. Then I should be able to go to the church and erase my baptismal records and all the rest. Oh, I hadn't heard that one. I find it, first of all, as someone who is culturally Catholic, I don't know if I can be as saintly as I once was as a young child. What happens if my husband decides to not be Catholic anymore? What happens if I'm not married anymore but now my marriage certificate is gone from the Catholic Church? Are my children bastards now? Michelle's going deep. What the hell? Like literally what the hell? So I think it's the unintended consequence without, you know, this goes back to our formula. Is the data value of deletion proportionate to the data risk? And I would say the right to be forgotten is like this. Now having an index ability or an erasability of a one-time thing, or I'll give you another corner case. I've done a little bit of thinking, so you probably shouldn't have asked me about this question, but in the US, when there's a domestic abuse allegation or someone calls 911, the police officers have to stay safe. And so typically they just take everybody down to the station, men and women. Guess who are most often the aggressors? Yes. Usually the dudes. But guess who also gets a mugshot and fingerprints taken? The victim of the domestic abuse. That is technically a public record. There's never been a trial. That person may or may not ever be charged for any offense at all. She just was there in her own home having the crap beat out of her. Now she turns her life around, she leaves her abusers, and it can happen to men too, but I'm being biased. And then you do a Google search and the first thing you find is a mugshot of suspected violence. Are you going to hire that person? Probably not. Well, begs a hold. Are you supposed to do that? Of course not. This is the generation where everything's been documented all along the way. So whether they choose or not choose or want or don't want and how much of its based on surveillance can be predicted you didn't even know. I thought you were going to say, and then you ask Alexa, can you please give me a recording of what really went down, which has also been done. Well, that'll happen too, right? It has happened. Yeah. It has happened, actually. Which then you say, well, is having the data worth the privacy risk to actually stop the perp from continuing the abuse? Exactly. And one of my age-old mantras, there's very few things that rhyme, but this one out that does. But if you can't protect, do not collect. So if you're collecting all these recordings in the domestic, think about how you're going to protect. There's other people that should have hired you on that one. We won't go there. So much stuff to do. All right, Michelle. Unfortunately, we have to leave it there. But thank you for stopping by. I know it's kind of not a happy ending. We're building things to fix this. But good things with Drumwave. So congratulations. Thank you. We continue to watch the story evolve and I'm sure you'll be nothing but phenomenal success. It's going to be a good time. All right, thanks a lot, Michelle. Thank you. Michelle, I'm Jeff. You're watching theCUBE. We're at RSA 2020 in San Francisco. Thanks for watching. We'll see you next time.