 Thank you, Brian, and thank you for that introduction, which even without your iPad you you managed Thank you all for your attention and your interest in coming out tonight But I think you had to be here because I got to tell you we are at a really really interesting turning point when it comes to privacy I think Qatar is at a particularly interesting turning point because of your consideration of the privacy law But I think we're at this interesting point now where? People are asking when I say I speak about the future of internet privacy They say oh you mean there there is one there is a future how is that possible? We already have all this data out there about us is it conceivable that we're going to get any privacy back When we're sharing our data on social networks when ads are tracking us when websites are tracking us when what we search is tracked When our mobile devices are tracking us How can you talk about there being a future for internet privacy and I do think we're at a point today Where there is so much data that's being shared that we need to decide whether we want a world where? Data empowers us where we find things quicker. We get directions We get what we want served up and personalized for us, and we are smarter and more powerful Because of the data that's available to us and because of the personalization Or are we going to have a world where everyone knows more about us? Websites and apps and mobile devices and companies and governments, and we're increasingly we're hemmed in Decisions are made about us. Do we even know how businesses are using the data that's collected and is it always for our benefit? I think there is a future for responsible data use I don't see how we're going to put this back in a box. We want to connect We want to interact with each other right our youth and adults of every age want to use Social media to connect across cultures across countries or within families that are spread Through distance we want mapping services We are going to continue sharing data because we see the benefits The question is are the folks who we share that data with going to have our interests in mind Now I will tell you it's very dangerous thinking that you know you're an expert and even in this audience You know you are folks who come out to a lecture Who work at ministries who are in the technology business who? Care enough to discuss internet privacy. So you are already an elite You're not the average person, you know who's going about their business without thinking about Policy and it's very dangerous to be in our space and then to make decisions about privacy because we can forget What the average person actually understands? What the average person wants to do to stop and think or do they want to just download something? Do they want to just go about their business it can be very easy to miss the game? And so the one thing I actually think that I've been able to do during my career is not be an expert But to try to keep that view of the average person on the street I was a state legislator for many years and when you're a local elected official You really need to keep in touch with the people because you you are You know constantly responding to the concerns in the issues they raise And I've kept that non-expert. So I'm going to try to talk to you today as Someone who isn't an expert and to prove that I'm not an expert. I'll tell you something that happened to me Not that long ago one of my best friends became the chief privacy officer of a company called the facebook.com it was known as then and He said you have to take a look at this and I said you're silly, you know, you ought not to go work there It's for college kids What you're doing is going to be far more successful He didn't listen to me He did go and he convinced me to sign up and have a look and I got hooked I was interested I was there poking some old friend and connecting with somebody across the Atlantic and Sure enough. I very soon had you know, several hundred friends old employers old girlfriends relatives cousins People I worked with and I was very excited My wife was not so excited because I come home from a long day at work and then there I was in my home office Poke here poke this one do this one And she'd get very frustrated you're working all day and now here you are coming home and you're wasting your time with Facebook So I said, oh, I know what I'll do There was this little application that you could download for a Facebook The fun wall or something like that and it sent a sparkling smoochie kiss So I said, okay, I'll send my wife a kiss and she'll appreciate that this is not such a big waste of time I'm doing something a little bit romantic here So I downloaded and I click send and then I'm like wait, I didn't select her name here What how did I send it what and sure enough this application has pre-checked all my friends So no big deal or it's a little embarrassing that the ex-girlfriend the ex-employer some journalists reporters workers Okay, it's a little bit embarrassing, but no big deal. I immediately post at the top of my page Friends I like you very much, but I love only my wife This application has turned me into an over-amorous spammer my apologies But no, no, no, no, you see my friend the new chief privacy officer at Facebook. He was on the job He didn't want people accidentally spamming everybody so Facebook had put in place a rate limiting feature I couldn't unsend it, but Facebook in its servers on the back would only send out Seven or eight of the messages a day so for the next three or four months Somebody selected from amongst my various friends would get this spooky smarkling kiss for several months My wife claims that she's never actually received it So I think us so us experts have to sort of remember that we're designing these things for actual, you know humans who are busy These these interfaces need to be as simple as getting in and driving a car We can't expect people to become experts like us who spend a good part of our day thinking or dealing with these issues Okay, so let's talk a little bit about I started describing this world where everybody was Tracked and profiled and maybe you started saying wait. I thought he was a moderate here I thought he's not a scary actor on privacy So I want to describe to you a little bit what the system looks like today when you actually go on the web And what I think needs to happen to put you back in charge and I'm optimistic that this is going to happen so we pull out the chart if we can that shows of the online advertising ecosystem and And as soon as it comes up, you'll see it. I'll see it Okay There it is so Here's our Friendly average person sitting at the computer and they've just pulled up a popular website They haven't clicked on anything. They haven't downloaded anything. They've just visited a page The average user has no clue that their browser goes on a mission every time you visit a typical web page It goes to an ad server and it shows some information about itself some information about you and it gets an ad It goes to an analytics company where information is recorded so the website can analyze usage It may go to a market researcher. It may go to an ad exchange. It may go to a data exchange an affiliate marketer 30 or 40 places Perhaps at many popular sites that have the full array of the bells and whistles that you see ads and tracking and so forth Many of these are sites that any average person can set up and put on free code You don't need to be a big developer to put on Google analytics. You don't have to pay for it Even it's free. You don't have to be a giant company to have ads delivered on your site You put on a little bit of code You don't even have to know how to program it you cut and you paste and you drop and then from then on What you do as you visit these sites is logged and is recorded and the ads that you see are tailored based on what's known about you and Stock markets where companies bid to try to reach the kinds of users they want Because of offline information that's been added to your cookie is then quickly and instantly available It's become very efficient. It's become very fast and it does something very interesting It helps support much of the free content out there So industry throughout the world says well, this is a good thing Would you rather pay for the site or would you rather it be free? Well, it's free, but it's not completely free. It's free in exchange for your data And if I understand what's happening when I visit a website and I understand that you're trying to serve me And you're trying to help me I might value it when you use an Amazon or a Netflix or other services that are obviously Customized and they're tracking some very important information your books videos things that people can be very sensitive about Generally in countries around the world people like it. I understand you're trying to sell me something But you're trying to help me find what I want no crime there But when I'm traveling around the web and things are being tailored and I don't understand how it's happening Then I'm a little bit worried about what's happening And I don't know who's getting the data and is it being used to maybe give me a higher price because of what you know about me Am I going to be discriminated against? Who else has access to that data? Who knows what I'm searching for some of the most Sensitive information one rep a writer called it the database of intentions all the things that we think in our heads That might be in search results and so my argument is as this becomes increasingly a controversial practice around the world The Europeans want to regulate it where users should have to expressly opt-in In the US the debate's been going on for maybe a decade the Regulators have called for a do not track list one of the most popular things that was ever done in the United States Was a do not call list we have maybe a hundred and fifty million people who've signed up to not be Direct marketed through over telephones because they don't want to be interrupted during their dinner They don't want the intrusion and so they've signed up for the do not call list And so some policymakers have said maybe we need to do not track list now How exactly you might sign up to not be tracked creates a lot of technical challenges, but you can see why it has the right? Political sound so can this be solved? I mean are we at this sort of impasse where the companies must track you? And the only alternative is for you to actually pay for the service my argument is that making this information Transparent Demystifies it telling you what I'm doing. I'm trying to help you. I'm trying to serve you. I'm trying to sell you something That's not so scary doing something secretly in the background That's a bit scary So some companies Google Yahoo others has started showing users their profile You can click through to their privacy policy and then they've got a place where they'll show you that Clickstream profile that's been created about you now. What do you think's happening when people click through do they run away? Oh my gosh, look what's known about me. Oh my goodness in fact not What Google has reported is that of every 15 users who click through and take a look at their profile This is somebody interested in sports and finance and vacations to Switzerland What they do is they don't turn it off of every 15 users 10 look at it and do nothing For actually edit it. They take some information. They add some information. They want it to be right One out of 15 actually turns it off So I think that starts to show you that when people see what's going on. They don't run away from this They feel empowered by it. So one of the things our thing tank did was as we said how we can explain this to people I can't show everyone a chart and it start explaining cookies and log files and IP addresses And how the targeting and the appending is happening the average user is just doing their business So we said how about let's turn it let's turn to the market is not the lawyers Not the policymakers who will design us a very complicated notice that again the elite will read How do we turn to the people who are experts at talking to actual consumers the marketers though people who are trying to sell you Things in the first place. Let's ask them to work with us to design a symbol And so we tested some symbols in the US the Federal Trade Commission said we have some ideas for what that should say We said okay, we'll test it. What do you want to say? They said it should say on every ad Why this ad and then people will know hey, there's something to investigate over here And we said, you know, I don't think that accomplishes we want to brand this we wanted to mean something You know in the hotel which room is the restroom because there's a symbol there and mean something in many countries You know that there are certain products that can be recycled because of the symbol, right? We know what certain road signs are because we've been educated to to Understand what they mean. What is the symbol that says something like? Smart data at work here for you. How do we do that? when I was the consumer affairs commissioner in the city of New York the colleague of mine was the Transportation commissioner and one of his big projects was to try to change all the signs wherever there was construction going on The signs used to say something like we apologize for the delays. We regret the inconvenience He hated that he insisted that all the signs be changed to something like your taxpayer dollars at work for you To the positive and I thought he was crazy I didn't understand and now I stand and I look at this a couple of years later and I say look How do we communicate with users? We are doing something smart for you make it work better Maybe give us more data to make it work smart as opposed to we're sneakily tracking you in the background By the way, read about how we're protecting your privacy When we've done testing of privacy policies and people start reading and they're talking to a business who is in the business of marketing and using their data and the first line is Here's how we respect your privacy and we share your data in these ways You can imagine the you know the reaction is very cynical. Yeah, thank you But if you said to the user We're using your data to try to sell you things we think you want We want to do as good a job as possible. Are we getting it right now? We're in a relationship that makes some sense So when we tested at the request of the federal transportation why this ad do you know what people said? They said I'm just going about my business here. I'm checking my email. I'm looking at a website. I'm doing a search What are you asking me a question? Why this ad I? Don't know the answer. Is it a quiz? I don't like being quizzed or is this a trick? And I got a click to find out whether I even care about this answer and then maybe I won't be able to click back There'll be a pop-up. I'll lose my place if you have something to say to me Say it and then I'll click and I'll learn whether I need to know more information That was an intuitive to the regulator the regulator said well We should tell people privacy information and we know how to write a legal notice actually doing the consumer testing was Incredibly interesting and you start learning how people think and how they act and how they want to communicate So we tried to design some symbols that were meaningful to the users and industry groups in the end of the day Too weak did a bit turned it from a very interesting symbol into a less interesting symbol But many of the banner ads that you see today On the internet now come with this little triangle with an eye Industry has not done a lot of job educating around this So this can be there and if you didn't pay attention to it. You didn't even see it It was invisible so my argument is that if this has any hope of working They need to communicate with users around it But billions and billions of those little banner ads now come with that little symbol Which is supposed to indicate to users? Smart data is at work for you and when you click on it you then get some information and then hopefully they haven't required this But many sites are actually showing you some of that online data We'll see whether that's enough for policymakers Some of them still want do not track Industry doesn't love the idea of do not track. They believe that Users will expect that there is no tracking whatsoever The reality is some data ends up being recorded whenever you interact with sites and services Some of it is useful some of it is necessary some of it is critical to creating Analytics that are that is necessary and one of the big challenges for policymakers is when do you ask and when do you? Don't ask when does asking mean that you'll certainly say no Because you don't see the benefit to you even though maybe there's benefit to society We saw the UK information commissioner Who has been dealing with the latest revisions to privacy law in Europe where cookies in many countries are gonna need to be Opt-in users will have to say I agree and the industry isn't all that pleased with this They worry that users will say no, thank you. I don't want your cookie keep it I'm not hungry And so the information commissioner said you know what I'll show you how easy it is to do and He put on his site now Again, this is not a marketing company where maybe I'll be skeptical was this is a government agency in charge of protecting your privacy Why not say yes to him right? What's he gonna do with the data? And he said here's a cookie and we use this cookie for analytics. We're not gonna market to you We're not gonna send you any ads. This is just for us to understand how our site is used What's wrong with that? Well, what do I care doesn't help me? Yes in the long run? It's good for all the other users of the site It helps you design the site better, but it's not gonna do anything to me And so unfortunately very very few people. I think 15 or 20 percent Agreed and as a result his analytics were no longer useful in fact the information commissioner in the in England in the UK is also the Access to information commissioner and helps police government responding to requests by citizens for access to government data So he was asked. Hey, could you give us the records before and the records after and sure enough? Before when nobody was being asked for any permission to do analytics The majority of users were in some were blocking cookies But the majority were in and as soon as it went to opt-in boom it disappeared and so we see some challenges It's very easy to say just ask users, but what if users don't see the direct benefit to them that minute? You know in many countries in Europe there is an opt-out when it comes to organ donations in other countries in Europe Like here. There is an opt-in. You must make an express decision the rates in the countries where organ donation is Opt-out is very very high The rate in countries where it's opt-in is much lower the defaults rule when it comes to Really important decisions like this where people have strong feelings right where you would think people really would make a strong decision Whether or not the default was one way or another. This is something that has religious connotations moral ethical, right? There are things to think about When it comes to a click or data where the issues are important, I'd argue, but perhaps It can be easily rushed past Users end up doing what the default is and we've seen that very powerful And so when we decide how to do a privacy law and when we decide when to ask you We've got to sit back and we've got to say when is this data collection good for society When is it going to create products and services that are useful? Mobile is one of we have where we have perhaps one of the most interesting challenges Many of you may have seen many of the news reports around Google's location services product. So here's how this works and let's bring up the mobile Symbol the mobile chart for a second. So you heard Brian talk about mobile being very personal, right? There was a study done recently that 80 or 90 percent of the people actually sleep with their phones in their bed It's within their reach. It's next to their dresser, right? This is personal. What can be more personal than this device that is in your pocket or is, you know next to to your bed when you're up when you're sleeping and Many of us use the location services that are enabled by these by these phones and it's very useful, right? We get directions and The way those location services work well, right number one, they use the cell towers but number two to get Data more quickly and be more more accurate. They look for local Wi-Fi routers, right? And Google and Microsoft and Skyhook and a few other companies have driven the world Driven the world recording the numbers the MAC addresses the IDs of The local wireless networks the one you have in your home the one that this hotel is broadcasting and They've written down Where they've seen that router now Google got in trouble because many of us don't encrypt that network don't have a password And so while they were recording this information They accidentally recorded whatever you were transmitting over the network. They were maybe it was a password Maybe it was a snippet of email and they didn't intend to they were driving by because they were building this big database of where every Wi-Fi router is and They were recording also for their street view product, right? So they accidentally recorded all kinds of pieces of information. They got in big trouble They deleted it and so forth but a lot of people woke up and said what you're driving around the world and recording Everyone's little Wi-Fi hotspot. What are you doing with that? And you're not the only one doing it everyone does it and it turns out that our Mobile phones location works quite well because in addition to triangulating off cell towers The local Wi-Fi right if I turn on my phone right now The reason it very quickly will find my location is because the Google car or the Microsoft car or one of the other companies Drove by the hotel wrote down that this MAC address that's broadcast by the Wi-Fi here is at this latitude and longitude at this hotel and boom It can pinpoint me far more quickly without running down the battery and so forth So that's kind of useful But if you asked me if I asked you out of the blue when you turned on your phone you bought your new iPhone 4s by the way may we record Any of the Wi-Fi routers in your house to build a global giant database Which will use to improve location services most people would say well explain to me Where's my teenager someone I need someone here to you know Tell me what's happening over here and most of us would say I don't know doesn't sound good to me Right, but yet if we didn't do this by default The service wouldn't exist if 10% of us opted in then we turn it on and sometimes it would work because it would have the information And sometimes not so the compromise that Google has made with some of the European regulators is that an opt out will be provided If you can figure out how to go in and change the address on your router So we talked about they do not call list we talked about do not track so now there's another one It's called do not track my router and put me in the global database of of Mac addresses so that my phone doesn't contribute to this global Positioning system, but I can still use it when I turn on my phone and have advantage of everyone else's right So most of us aren't going to use it and the data collection will take place So the mobile system is even more challenging We we looked at the online advertising system and all the places where your data goes and we had a bunch of companies the website The ad network the other parties in the system Here's where it gets even trickier when it comes to mobile because I've got a mobile website sometimes I have an app that I've downloaded I have the Apple or the Android or the Symbian platforms and then I've got the mobile advertisers and Each of them co-exists with each other sometimes, you know integrated and sometimes not and That same set of very complicated ad networks and tracking and appending your data is now being built So just as to support that app ecosystem right because a lot of those apps that you downloaded are also free Ha ha now we've learned free in internet privacy means Not so free free of money, but in return for your data now. We're doing good business here Okay, now we're merchants and we're negotiating what the deal is and and understanding what our terms are as opposed to Navigating around everything's free and everything is good. There's a data exchange here now Now that we're bargaining. How do I make sure that what you're doing with the data is what I want? Do we need it into a privacy law? Probably do we need good policies and practices? We do Do we need consumers being in control because the device is easy enough to use? So I used to love what Apple did because again Do we want someone spending the time reading a privacy policy a scientist at Carnegie Mellon? University did an interesting test of how much it would cost in terms of the hours You know people spend if we had to read all of the privacy policies You know and it was billions of dollars to the economy in the u.s If every single person on the 50 or 60 different sites that they dealt with had to sit there and spend you know Five minutes ten minutes reading the different policies how much time that would take out of the day? So clearly we don't want people reading the policies. So we need those symbols We need those icons we need those better ways that the marketers can design to communicate about data use So Apple as this champion of you know usability with innovative devices for a long time Was doing some very interesting and useful stuff when my location was going somewhere There was a little arrow that showed up and it didn't say privacy learn about privacy. It said an arrow My location is going to someone and there was a little arrow letting me know. I like that simple Reasonable the newest version of the iphone which I ran out because I had to get I Don't I don't know why I needed an iPad. I'm now hooked on my iPad. I need it all of a sudden I need the latest iphone and As I turned it on it encouraged me to turn on location Okay, and then the arrow disappeared So no longer will I know it's there it's buried you can go find a setting it takes six clicks to get to it That will let you turn that arrow back on to tell you when location is being shared What a step backwards, right? Tell me show me the other day I was playing with some of the settings on my phone and I saw which apps had recently been getting my location Oh, so this is interesting Google Maps. Okay. I get it you it's a mapping service You had my location, but there was a battery charging app that I have that helps me Better know when my phone is going to run down. It was getting my location So what what is going to find the low closest outlet to plug in? I mean that would be useful, but no it doesn't do that and I realized of course it was because of the Targeted ads, but how about asking me because I'd rather the ad be local and relevant and targeted But when you do it without telling me something then I feel again you've taken You've taken some advantage of me We're increasingly seeing some of the companies working on tracking you across the screens So one screen is my mobile phone screen my TV screen and then my PC screen And so we need to push companies to do more not just to follow very narrow legalistic privacy rules But to make data use a feature and when you talk to a company about privacy It's very hard to talk to a marketer about privacy. He's in he or she's in the business of using your data Privacy is for banks and security and keeping data close We're talking to someone who's looking to use data to give you a better service So we need to talk to them about Responsible data use we need to talk to them about how they can do better Selling their service and do better providing service by using the data in a way that I am in control of and then I may Give you more information so that you can do a better job At at doing so and in the mobile world It's more important than ever because I have a very small screen and it can be hard to communicate And so we need to think beyond privacy policies for ways that we can engage users. Should it tell me? Should it read me my privacy policy? You know the new iPhone 4s has a voice recognition tool that everybody is very excited about called Siri I don't think it understands my New York accent because I asked it the other day Siri What's your privacy policy and it said I'm sorry. I can't help you with that So I'm hoping somebody maybe with a very good, you know A clear accent will be able to get a better answer They it has of course a written policy, but I was hoping it could that it could respond to me We did a study a little while ago, and we hope to do this maybe in Europe and in the mid-east But we did it in the US Mexico and Canada because we think that different cultures Look at data use and look at privacy with different views And so we said to people in the US and in Canada Mexico. We did focus groups We said give us your phone. They said no, no, no said come on. Give us your phone We'll give it to you back to you. Give us your phone Are you sharing your location with anything with any service any app and some new some didn't so we said okay Now we're gonna show you and we took it and we said hey look and of course a majority of them You know we're wrong. They thought they weren't sharing and they were but the reactions were very different The US folks they were annoyed, but they were sort of well. I guess that app was free So I don't like that so much. Maybe I'll turn it off, but but I need that app. So whatever The Canadians started cursing Started cursing on the video on started cursing Mexico The users said oh That's a good thing because if something happens somebody's kidnapped They'll know where you are Mexico has unfortunately a very big problem with drug gangs and kidnappings And there were people who you know had this happen to them had a family member or or very aware of it from the media And so they looked at it in a completely different way what we also found is that a lot of the instructions from the companies were in in English and In in Mexico Where not everybody spoke good English? They assumed that if it because some things were translated and some not so they assumed well What was translated is relevant to me and if it wasn't translated then this is only applicable in the United States It's not applicable in Mexico. Of course. They just didn't do a good job translating everything, but users assumed the average user assumed This is not for me. This is this is irrelevant. Okay, so big deal. We're tracking you on your computer We're tracking you on your phone But your home is still safe, right? That's the sanctuary for privacy the four walls of your home well One of the big priorities around the world has been building out a smart grid and a smart grid can do a great deal to help us Manage energy better to avoid peak events so that people understand that they shouldn't put their dishwasher on While they're doing their load of laundry more efficiently and smartly managed power across the system But it also means that the utility the power provider The company giving you the smart meter Can learn and understand what you're doing in your house Because the meter is reporting back every 15 seconds how power is being used Light is on in this room your home the heat lamp is on in the bathroom Someone's taking a shower you haven't done a load of laundry in three weeks and now you're finally doing it But it looks like it's all towels because of the Particular way that the heavy load right so you say to me who cares about that information Well, guess what if I had said to the people who were building the early internet Listen, you have to worry about people's searches being tracked. You have to worry about the websites sharing everything you do They would have said to me. What are you talking about the internet? This is about research universities exchanging big files with each other to be able to do research Maybe people will use this also for email. That seems interesting But tracking everything that's being done no way and so when I talked to some of the utilities today And I say listen, let me show you what's happening in the web Let me show you what's starting to happen on the mobile world You're building a platform that's going to record information about what's happening in the household. What's your plan? So, oh, no, no, no, I just looking to do this little piece here We know that if you build it they will come and indeed there are marketers who spend millions and millions a year Understanding why you do the wash on Thursday and how they can best sell you the right kind of detergent that you'll feel is Going to do a better job. And so if the data can be collected, it will be government may want its Parents may want to look in on what their teenager is doing when they're out of the home by Understanding, you know what was going on in the house if we build it There will be reasons and so My argument is not don't build it my argument isn't that these data uses are useful They are useful, you know internet folks used to talk for a long time about how one day will have a smart refrigerator And what will it do it will? It'll tell you when to order some more milk And we haven't seen that yet, you know and around my house We already have a smart system, you know, my wife sends me a text message. You don't you finish the milk Why didn't you buy any more milk pick it up on your way home, right? And it works and it's electronic But we do already have smart devices where my refrigerator GE makes Already devices where my refrigerator will speak to my washer dryer and say hey, I'm doing the wash now Don't make ice because who cares when ice is made We just care that the you know the bucket is full when we need it But if the ice is made in the middle of the night We don't want a peak power event happening when some other major power is being used in your house So that's nice that my smart appliances are talking to each other But who else are they talking to and we need to make sure that we are the ones empowered by the private data and the Activities because there will be useful tools there will be Better ways to to turn on and off your home security system You'll go on vacation and you'll adjust your thermometer There's a plethora of really interesting and innovative new Uses that will be built who knew that we wanted to poke each other on Facebook and then that would you know be the basis for for revolutions for social action for Families being you know keeping in touch for all the different things that are being done with social media an identity system You know of sorts being built for for the web because we all found it useful to interact with each other And so we don't even know what the smart uses that the people who build these smart homes will put But we do know that if it's a data layer, we need to have the rules in place now So that's really hard. How do you put rules in place now? Without preventing the exciting things that will happen and I will tell you I would have screwed it up Let's go back to Facebook again Do you remember when you early on? When you signed up for Facebook you went and you saw your face and your friends and you looked at the picture And then you could go to visit your friends and click to their pages and it was interesting But mr. Zuckerberg and his brilliance said no no no no that's not enough when you go to Facebook He said I'm gonna turn on the news feed and you're gonna see not your page You're gonna see all the things everyone else is doing right and people hated it I would have said if I was the chief privacy officer there. Oh, no opt-in ask people because You're changing this if I break up with my girlfriend if I lose my job if I make some announcement about some news in my life It's one thing to put it on my page It's another thing to blast it out to all my friends ask people first I would have said and the users didn't like it either Facebook used to have 10 million users at that point a Group formed with a million one out of ten joined a group saying stop it Stop it Facebook. You've turned us all into stalkers. We hate it and people hated it and then They loved it because it was interesting to go and see what was going on and you kept coming back over and over and over to see what was new and what was going on and Clearly spreading news spreading information Organizing so many of the powerful tools of social media are empowered by this notion of being able to share that information widely I'd have been against it easily You could have seen strict privacy laws that could mandate very Express consent and many of us would have said no and so the challenge for people working on privacy laws When is it okay to do something without asking when is it okay to have the analytics without saying may I please have the When is it okay to put people into the water to change so people can see and feel it I didn't need an iPad and then I did When is it acceptable? How do we know not to harm you? How do we know not to embarrass you? But when can we do something innovative that we didn't think of before? Without saying please sit down and give me express permission because either it may not seem useful to you until you do it That's I think one of the real challenges of balancing Privacy and and innovation That's one of the challenges of figuring out how to deal with big data I was just in Mexico City where the annual meeting of all the data regulators Where countries have privacy laws many of them have privacy commissioners and there's an annual meeting every year And those data regulators get together and they discuss what are the biggest challenges they faced And so there was a wonderful presentation about big data and the presenter showed all the brilliant new things that researchers and companies And others are doing with data sets, you know Google flu trends can tell hospitals when the flu is going to break out because people are searching for symptoms Do I have the flu? I'm sneezing. What should I do and so forth hospitals can learn about breaks Traffic can be analyzed based on the movement of cell phones and so we can understand better how people converge You can imagine if one was planning for the Olympics perhaps a relevant topic You know to think about in the country of understanding how people are going up path and the traffic changes and so forth that may Need to be made when people come and go from stadiums and what one can learn by analyzing at a very high level Medical research right we need to know the outcomes of patients with appropriate privacy protections But we need those data sets to help learn useful things So all kinds of wonderful data is going to be used for so many interesting innovations And the response from some of the regulators when they saw this was not Big data means really interesting challenges. We need this data used for innovation for research for for the future But it could also be misused. How do we ensure the proper use? How do we? Provide some privacy by design some sort of de-identification What can we do to make sure we get the benefit without the harms the discussion was very much Big data we need big enforcement and that's a trivial way I think to look at what are some of the really challenging days We need to think about data optimization, you know in emerging economies in areas where the technology Advances are going to be a key part of success. We certainly need to make sure that users feel comfortable feel trusted Have rules and policies and laws in place against abuse and against harm But we need to leave room open for those innovative optimized uses of of data one of the big issues During my days at AOL Was a very terrible thing that happens one of our very smart researchers Put search data put users searches on the web Researchers wanted it who knows what they could learn from it. He thought it was de-identified It didn't have anyone's names, but if I have six months of your searches Boy, I can probably figure out it to you right there is just so many clues and some number of people were figured out And it became a terrible embarrassment to the company with litigation and stories and lawsuits and The European data regulator said oh my goodness Search engines are keeping data for a long time. That's a big problem. Why are you keeping it? Stop keeping it? Well, they can't stop keeping it right by using the history of searches We can improve and make sure that the relevant search comes up. You need to understand how users are searching You can imagine this sort of analysis and the conclusions and the valuable data that can come out of analyzing this and they said well Okay, six months and my question has been where that magic number come from who did that analysis of Here's the additional value you get every day from keeping this and then here's the additional risk And we need to figure out that model where the optimization and the risk sort of converge So that we can make really smart decisions That ensure that we get the benefits of data use, but that we minimize the hams So I talked about today as a particular turning point And I will tell you privacy has always been an interesting issue I've made a living working in it for many years But what has happened in the past two or three years is that this issue which was an issue of Policymakers of the geeks of the technologists of the experts. This was not an issue that was on the front page I've worked on a couple of presidential campaigns in the United States And I end up working on the privacy piece and then the first of the big debates comes and the candidates are going to be debating important issues about foreign policy and the economy and and critical issues to the future of the country and I say to them, okay, I've done the privacy briefing book Shall I meet with the candidate to make sure he's well briefed on the privacy issues and some much savvier politician than I says kid There's not going to be a privacy question in a presidential debate. Are you crazy is going to be about you know war and about the Peace in the Middle East and about the economy. No one's going to be asking a privacy question to a presidential candidate But in the past couple years that dynamic has changed the Facebook of the world the social media of the world have changed privacy from being something that is sort of experts and chief Privacy officers. I remember the first time I told somebody that my job when I was at double-click when I was at AOLs chief privacy officer You know they said to me Is that mean like you help fight against spam or are you in charge of the parental controls and when I said no I try to come up with appropriate policies for ethical data use Okay, thank you. That was not all that interesting today. You say to somebody I work in privacy. They say ah Facebook I got it and so it has become a Front-page issue where every politician knows that talking about it is of interest It's of interest to the media and it's of interest to the average citizen people are concerned about their children Are they spending too much time? Are they at risk? They want to they want to they've always felt challenged at being in control of what their kids are doing online But all of a sudden their kid has seven hundred friends Who are these friends and I and how do I understand and how do I have some control over that? But the other interesting thing that has changed is that privacy used to be about big companies or government making decisions about you and Now it's some app developer who lives in the Ukraine who wrote an interesting app That everyone liked and downloaded and now he has 30 million customers, but he's 17 years old The top-selling app for a few weeks in the the iTunes store was a bubble popping program where you could just sit and you know Bubble pop bubble pop and it was written by a 14 year old kid who wrote his privacy policy his mother Right and so what are we expecting of many of these app developers? But some of them have more data than the biggest companies in the country because they can have access to your phone book They can have access to your location. They can have access to all sorts of useful information that helps provide the service But it's a lot of information And we're asking them to what have a law firm help them comply with data privacy law So we have to make this easy enough and simple enough that that small app developer but by the way you because of your Profile and the friends that you are linked to are now also making decisions about sharing your friends data and Sharing information about them. And you know what? We're not used to it We talk about the youngsters having to be trained about how to live online. We're not used to it The other day in my neighborhood a friend Well, I didn't know him so well. He's a neighbor He had a birthday party. No, I wasn't invited to this party in the past I wouldn't know it wouldn't have bothered me if I had heard he was having a party and he didn't invite me I said, oh, well, you know, I'm not such good friends with him. No big deal But friends of mine were at that party and they were posting pictures. These are grown-ups 46 years old They were posting pictures of it on Facebook. Hey, we're at so-and-so's 50th birthday party And all of a sudden I looked at it and I was back in high school and I thought those days were beyond us Now these adults are very smart people. They probably say to their children. Don't talk to strangers Okay, talk to strangers if they look like they're okay because it's somebody who's you're meeting in a school environment You know, we teach our kids how to navigate who they can interact with and we feel like we're gonna give them the Morals and values but here they all are without thinking twice. Oh wait a second This is sort of public, but it's not completely public because Jules might see it and who's invited and who's not just that day I had said to my son He's um, he's 10 now This was he was seven or eight at the time and he was going around his class saying hey Are you going to so-and-so's birthday party and I said to him listen be careful not everybody's invited So, you know, you need to be careful. You'll insult somebody by asking them But here are the grown-ups without Having that same sort of thought that we were teaching our kids and so we are all struggling I think to become good drivers and we need to make it as easy as driving the other day my mother-in-law Was babysitting my daughter and she let her play a video game on the computer and my daughter gets on it's a game She's never played before and she starts doing and typing and so forth and my mother-in-law says She's a genius. How does she know how to do that? And I said you don't understand. She's grown up with the computer She knows you you look you pull if it's read you click and so forth. I said you the other day you rented a car You never drove that car before did you read the owner's manual? Did you read exactly and this is a car? It's a machine of death you can kill somebody with this thing and you just got in you looked around Maybe where the lights were changed the gear and boom you're driving on the street And so yes the youth of today are driving are growing up with some of the skills But are they growing up with the understanding and are we if we're not experts if we're not using these tools and Understanding how to be power users. How are we possibly? conceivably Helping educate and train our users. Okay, so let me talk for one more second about social media because the big complaint is Facebook MySpace Other social networks give us our privacy and I think I've already Suggested that we're sharing this information. It's out there because we want to connect with each other But what they do need to do for us? I think is not give us our privacy We're there to share what they need to do is give us the tools so that we can shape our identity and Put our best foot forward and represent ourselves in the way we intend to it's about our Reputation and what we need is the tools to make sure that the attributes of ourselves the authentic things that we want to share Are shareable and that we're sharing the more private things only with family only with only with friends and not with a broader audience We need to think a bit more about the fact that in today's digital world People rarely have one job for 40 or 50 years You know the way at one point you came and you worked for a company and you got a pension in so many countries around the World people have three four or five different jobs, which means you're interviewing you're being looked at you're being assessed each time Your digital reputation is critical Two years ago. We released a study along with Microsoft where they went out and they actually surveyed Interviewers people who interview for jobs and they said how do you get your information? And as you imagine 80 to 90 percent of them said oh we search we look online We look at social media profiles. This is the new you know job Screening tool and so you need to take some control and that doesn't mean hide everything It means having the tools to delete what you don't want to put your best foot forward and present And so you say to yourself I'm not looking for a job now, so this doesn't matter to me Well, let me tell you a secret from the job recruiting world The best candidates are not the people looking for jobs Some of them are very good some of them are not so good, which is why they're looking for jobs The senior headhunters and the recruiters aren't out there looking for people who are looking for jobs They're looking for the stars looking for the people who are very happy and very good at what they do And so the really interesting more senior jobs. That's who they want They want to steal the really successful candidates and they're not looking but they're a findable They're out there so the most important time to have that really good reputation is not only when you're looking for a job It's when you're not looking for a job and when you're going to be found and discovered and where people are going to Judge and assess so before I take questions. Let me just talk for a second about what's going on globally You know in the US we don't have a global general privacy law We have a sectoral approach. We protect health privacy. We protect kids privacy. We protect financial privacy Every time there's a problem. We come up with a law to solve that problem One of the fastest laws ever passed in the United States was the video rental protection act because Somebody was being nominated for the Supreme Court and the reporters Were doing research to try to find out more about this person and one reporter said oh I'll go get his video records from the local video rental store because he's a very conservative individual Let's go find out what kind of movies he's watching Congress then said wait a second you can get people's video rental records because we rent movies too and Whoa, boom we very very quickly had a very strict law that protects your video rental records lightning fast But we don't have a general law and the Obama administration for the first time has proposed a very General privacy law with industry groups coming up with codes of conduct that they will pledge to that then can become enforceable under the law Congress is very bitterly divided. We don't expect to see it happening very soon One of the reasons why the administration wants to advance a privacy law is because they want to try to become a little bit More interoperable with the European Union Companies are complaining or chafing at some of the challenges of moving data from Europe to the US Cloud computing which has become such a big priority for so many companies Where the goal is that the data is anywhere in the world? Can clash with European law where you may have to keep the data in a very specific country so we see countries around the world Considering privacy laws many of them looking to the European Union because they want to be adequate under the European Union But many emerging economies Wondering whether they could ever live with a very strict opt-in privacy law if they want to continue to support Innovation and the free flow of data. They want to be data centers. They want to ensure that app developers see That country as an attractive and a place where business can be easily done But at the same point if there is no protection in place You've got consumers and you've got countries around the world being concerned that there isn't a Baseline of safe privacy and so for a while you saw a very big clash between the US Saying our way is good our way is protect particular sectors Our way is have a general consumer protection law not a privacy law Tell people what you're doing be honest don't deceive them But not necessarily privacy and then a very strict European human rights privacy is a right It's the most important right and it overrides very often other rights And so we've seen non-stop arguing back and forth now. You see the US moving a little bit to try to Have a general privacy law the Europeans at the same time looking at their privacy law looking at their directive and Updating it. It's now been you know almost a generation that it's been in place With the internet changing a lot of the issues and so we're starting to see the Europeans This go through a process at deciding what the future of their privacy law should be I think the world is at a turning point I think it's a unique and special time for you to be considering your privacy law From what I've seen so far. It seems to be a real interesting way of threading the needle And you actually may be leading because I think although the US will put out a proposal We're gonna see a challenging political time before you see anything actually pass and so Yours may be one of the first interesting new ways to both support privacy support innovation and I hope Support an internet where users set the tone for the future As opposed to all the other parties out there deciding what our future should be for us So I hope that I've talked a little bit about the future of internet privacy I hope I've convinced you there is a future for it But that the fate of that future is very much in your hands, and I'd be delighted to take some questions