 Good morning My name is Jonathan Zetrin and I'm pleased to moderate today's session on the big brother problem In addition to those in the room in the spirit of transparency and big siblingness I should let you know that this is being webcast live to the world at large and there are also opportunities to Tweet back with the hashtag of weff cyber as in World Economic Forum cyber and we have an incredibly Fun if Byzantine system by which those tweets can be sorted massaged sort of a big data exercise Put through the iPad here and possibly introduced into the discussion We have exactly 60 minutes, which is not a lot of time and a fantastic panel with which to cover that time So I want to jump right in It may be optimistic to call this the big brother problem because it presumes. There's only one I'd like to narrow that down a little bit and I think perhaps turning to Salil Shetty is the right way to start with that Amnesty International has been a sort of beacon to the world since 1961 Wherever there is a question of human rights. Amnesty has been there Nobel Prize winning Organization so Salil give us Your best shot at describing what's worrying you in this zone Thank you. I think if you think of the defining issues of our times in relation to human rights You know in the 60s and 70s. We're talking about civil rights and we talked about women's rights This question of the right to privacy must be one of the defining issues of our times And and essentially, you know, fundamentally, I think governments behave the same way over time I remember that you know in my house in India our letters used to be opened by the government Our phone line my father's a journalist and I was shocked one day in the morning to find our Telephone number landline on top of a list of numbers that the government was tapping because my father was Raising issues about the government's performance. So so it's not very different I mean Amnesty International's website is blocked by Saudi Arabia and China for example So these are all kind of different manifestations of government paranoia So I think essentially the same space and the idea of saying that if you have nothing to hide You don't need to worry if I think a really dangerous route to go down So kind of these open-ended fishing expeditions by guys to go and see whatever they can do I mean, it's not for no It's not with reason that the international covenant on civil and political rights and many of the world's Constitutions have enshrined the right to privacy. It is an essential right and Irrespective of which geography which location every citizen has an equal right to privacy and speaking early in 2014 What would be characterized as the one or two most significant and new threats to that privacy right? Fundamentally, it's the whole issue of you know, this this false Positioning of this debate that you have to choose between security and protection versus liberty and freedom That's the fundamental problem and of course governments have to protect citizens But you cannot have mass surveillance without a legal basis and without any judicial review This is just simply a violation of international law got it Senator Leahy, maybe I should turn to you you are now and have been now for a while the most senior member of the Senate the President pro tempore you came into the United States Senate on the heels of Watergate Certainly a lot of privacy worries there and you've been chairman of the Senate Judiciary Committee So a lot of the American legislation Dealing with things has has come through your up as it were and I'd like to let you weigh in and tell us First how afraid you are about big brother and secondly presuming there are some people out here afraid and I Gave Salil a couple opportunities to do it and he didn't take it. So pretend that he had said Snowden NSA What would you say to assure people concerned about that sort of stuff that they shouldn't be as worried Well, I tell people no matter where they're from they should always worry about the privacy being compromised Salil made it very clear when he said that every every country there's different levels of that fathers Phone being tapped and Russia blocking Amnesty International one of the great organizations I Came in at Watergate as you said the very first vote I ever cast in the Senate was for the church committee to Investigate the excesses of the FBI and others Jadgar Hoover Who is wiretapping people were protesting the Vietnam War or Taken positions he he didn't agree with now we fly forward to today if you had somebody like a Jadgar Hoover in the government with the unbelievably Different ability to wiretapping the house and you've got you've got to be frightened. I go on the assumption that privacy is an important human right and We don't make ourselves suffer by Wiretapping or investigating every single person one thing if you if you collect everything you really don't have anything You have you have the haystack. You don't have the needle in it and I Wrote the first Patriot Act. I wrote with the Dick army is very conservative House Republican leader much different philosophically tonight. We wrote in sunset provisions so force people look at it We have another one those sunset provisions coming up next year. It is forcing everybody to To look at it. I'm hoping it will make some major changes in how we collect information because we're in the United States Which should be one the freest Countries to express yourselves. We're collecting far too much information. It is not making us safer now I know that legislation can be long and complicated, but what are the Principle changes you would like to see happen in the American framework at least on surveillance well one thing that's actually getting I'm getting a lot of support from People are far more conservative and I I am and from the other party is In getting rid of the collection of mega data Collecting everything all your phone calls and metadata is data about data I meant it more as a pun calling mega data, but oh I see you said mega data. Yeah, but it is better data It is better data, of course and I know data, but every phone call you've made is in there somewhere every phone call I've made is in there somewhere. Why what are we gained by this and? It creates an area that's efficient now. I would say As critical as I've been of some of the things we've done here and as critical as I've been at the NSA I I Think of some of the countries that have been critical of the United States I think of the old movie Casablanca. I'm shocked to find gambling going on here Especially when we know the amount of wiretapping and and surveillance these other countries are suddenly very critical It's almost like being shocked that there's dinner going on a shot to dinner going on. Yeah, there were all at Davos So But anyway, what I want to try to do is cut back on the amount of mega data. I want to try to have far more oversight I Far more transparency what we do and on those cases where we have what we call for those who are not from the United States We have what we call the FISA court where you go to get Search warrants, but it's a secret court. You get search warrants to go after some of this data I'm what I'm asking that we have a permanent Council to raise the other side So it's an adversarial system and then that the decisions and This can easily be done within a short period of time be made public You know, some of the names are probably made public. I And then limitation we call national security letters where you can just go in and grab everything Just because we can do it in the United States doesn't mean we should I don't think it makes us safer any more than the horrible excesses of Watergate and and Jadgar Hoover and all made us safer. It made us less safe. Thank you Let me turn out a agi-fabella You were 26 in 1992 when you founded Vimplecom in Russia I guess then it was a hundred mobile phones now You're up to two hundred and fourteen million customers in 18 countries So that's half of your sort of biography another half is That you have since had a real interest in public safety and law enforcement and are a deputy sheriff's deputy in Suburban Chicago, correct. I am so you're a perfect person to see this from both angles Let's just start presume you're on the receiving end of the phone call There's been some process what what is it like from the point of view of an internet or Cellular service provider with governments possibly around the world Clamoring for information metadata data mega data about your customers and how does how does that get handled on the corporate side? You know, I'm gonna add first of all a much more positive View to the fact that we have all this data can be turned into a huge huge positive And so I'm gonna I'll end with that, but let me kind of address exactly what you said we work in in Countries of great opportunity. I'll call them we're in Russia. We're in Algeria. We're in Pakistan Bangladesh Canada, I'll even throw in there But I'll tell you one the last frontier what one common theme I raise that because the common theme across all of these is we get the same request from every single government They have access to absolutely everything. It's legal We comply we challenge of course that everything they're doing is by court order and or by legislation So so we take on a responsibility as a corporate because our customers trust us And we have to do our best to protect their privacy And just give us a quick flavor of the range of the challenges Is it to make sure the paperwork's in order and has the right? Officials and primitures on it or do you occasionally say we're gonna challenge this in court even if our subscriber doesn't know We've not taken anything to court we have not we've challenged with the regulator and dialogue We've been able to narrow scope So it has been a productive dialogue a lot of times at least what we found They're asking for more than what they need I mean that that's actually on my putting on my law enforcement hat of work that I've been doing in Chicago Yeah, there's a lot of data that's there already that you don't need to go and gather more There's a lot that you can do with what you have and so we actually do work with regulators with governments to say look What are you after this is all you need? You don't need more than this and we're actually finding a very receptive dialogue And that's what where I think the future of the problem Solution is going to be is in having that kind of dialogue between all the stakeholders Got it to find the right balance now. You'd wanted to say something positive about mega data. Here's your opportunity Again, there's great information that can be taught that that that can be Derived to come up with e-health initiatives with e-learning initiatives with e-government initiatives things that are out There that will help make things more efficient and being able to understand the universe of needs Is there in that mega data? It's just a matter of responsibly using it and would you and providing a real good service? And would you include that for national security purposes as respective governments gather perhaps as much as they can? Yeah, I'm probably closer to Senator Leahy's view that there probably isn't a need for such an overbearing Get everything your law enforcement has done a pretty good job of having a system of getting what you need to prosecute criminals And there is a judicial oversight You have to get warrants to go and dig deeper into different things But there's just a lot of available data that you can use responsibly without Overbearing upon everything you need to target that the real criminals you don't need to target the whole population uh-huh Brad smith, let me turn to you. You uh We're at covington in berlin in 1986 big american law firm And it's said that you made as a condition of your employment that you'd be given a personal computer for your desk And uh, maybe that pointed uh, your career direction a little bit at microsoft for at least 20 years general counsel since 2002 in the wake of 9 11 there And I gather microsoft has had to deal with Enumerable ways in which it connects to governments and i'm curious how much your experience tracks what algae was sharing I think there's a definitely a certain similarity. I think if there's one theme that sort of transcends perhaps what you're hearing from us Up on this panel. It's the notion that human rights Includes privacy And that governments should obtain information about citizens Pursuant to legal process that does indeed you know have judicial review And respect for international norms And you know what that means when it comes to not just microsoft as a company, but I think uh our industry is a couple of things number one Uh, you know when governments come to us and say help us just give us some information about some people Uh, and that happens, you know, I as you mentioned I started in this job shortly after 9 11 and there have been Many instances around the world by many governments where they say we have a problem Will you turn over information and my response has always been the same pass a law Yeah File a warrant or a subpoena give us the opportunity to consider whether we should go to court Give us the ability to work with others others to ensure it complies with international norms It is not our right. No one elected us to simply decide that we want to turn over somebody else's information That I think is one pillar I think the other pillar is due to the disclosures of the last year You know, it has become apparent at least according to what was reported in the washington post That you know, there has been Some just going and get it yourself Efforts including, you know, but from american technology companies in terms of tapping into cables You know running between data centers, you know, it was reported about the data centers for yahu the data centers for google None of us in our industry assume that those are the only two And so you see us across the industry and affect hardening our technology You know embracing stronger encryption And I think that is all to reinforce the need for governments to in fact use the rule of law And the rule of law alone to get information about citizens If an engineer walked into your office having been directed there by everyone else and said I have just invented a form of outlook email So encrypted that even though it's stored on microsoft servers even with government process No one but the sender and the recipient can read it Would you be excited about that and say now we've got our next advertising campaign or would you say this is a terrible headache? I think that Is a general trend in which technology is going I mean basically, you know, as you describe it You strengthen encryption and you enable customers alone to have the encryption keys There are some distinctions that one has to focus on and I don't know that your question directly Raises it, but it's nonetheless. I think the the heart of what you're you're addressing You know, we get You know from time to time we'll get governments wanting information not about individuals and individuals are of course Usually the suspects for criminal activity But they'll be seeking information From businesses from other governments from ngo's And our our position which I just believe in very strongly is if governments want Information from a business go serve the order on the business Don't come to us just because we happen to have the data in the data center And we've committed and stated publicly You know that we will take that position as a matter of litigation tactics We'll put that in our contracts with our customers And while, you know, some of the litigation, you know is classified I have said and I can say that we have never Turned over to any government any information that belongs to a business or an ngo or or another government In other words, we haven't yet lost such a case And one last question So far we've been talking as far as surveillance goes about Particularized targeted individuals for which there might be a warrant or other process given to the company that has the data on the individuals How about the fishing expedition that senator lehi was referring to and we can think of the most sympathetic Example may be possible, which would be we think there's some security threat. The olympics are coming up There's a particular document that is a purchase order for a certain amount of explosive you name it Anybody with that document in his or her Email account is going to be somebody we would have particular information. We just don't know who it is Could you run a scan if you could run a scan of everybody's email looking for that attachment? Would you no Not going to do it one search away to find that No, it's I mean we will do what we are ordered by governments to do if we lose a case and have no choice but to comply Yes, but yeah Let's start with the united states You know our entire constitution is based on the principle I would argue that the investigations of crimes need to be based on Individuals for which there is probable cause To believe that someone is engaged in criminal behavior Now, you know there there may be certain uses that people want to make of so-called broader metadata, but I Agree with what senator lehi says Yeah, I think that there are alternative ways to serve the public safety Without putting the civil liberties of individuals at risk in the way that you do When you move away from investigations that are based on probable cause and focused on individuals before I open it up Broadly, let's finish a visit with each of our panel members. So let me turn now to or eat Gadi ash or you also have had back in the day I guess a an affiliation with military intelligence But more recently have been at bane and company chairing bane and have been thinking a lot about this from the corporate perspective And about trust and I'd like to give you an opportunity to say something about that There's been discussion here about the nsa and about how it would be nice if it was more transparent on the other hand The nsa cannot be totally transparent without destroying its effectiveness. I think that's pretty clear and it has been established I would say that they're not the only ones in that box That data companies actually are very much. So let me give you a very quick example to illustrate that You probably never heard about a company called rap genius. It's where you go to get the lyrics to your favorite Rap singers on christmas eve It's unique headcount hit count dropped by 85 percent Why because google decided that rap genius was trying to game the algorithm of the search engine And it retaliated by moving them all the way down in their search the so-called google death penalty For which I don't know that amnesty has weighed in on that yet They have an opportunity now This was an arbitrary Rap genius admitted that they had tried to game the system if you will since apologize have been reinstated Let me be clear I'm not saying that google did something wrong. The point is that we have no way of Judging whether what they did was fair We have no way of judging with what what if the behavior of rap genius was bad or not Because we don't actually know how the algorithm the search algorithm really works And google is not about to tell us and for a very good reason If they made it public then everybody would gain the algorithm And then google and the public lose This is actually a big dilemma for google and companies like that and that's a point I'm trying to And if they had asked bane as management consultants to advise them on this dilemma, what might you say? Well, the first thing I would say is Users have to trust that the algorithm is even handed if they don't they're going to leave and your business collapses On the other hand google can't justify that trust by being completely transparent For the reasons I just mentioned before equal to the NSA So the most the most important by the way, they're not the only ones I'll just say one thing and then answer your question This is really what characterizes the way that we use the internet an awful lot of trust and very little transparency and Trust without transparency is a very frail proposition. It's a little bit like justice It needs not only to be done, but also to be seen to be done So the most important thing I would say for companies like that data companies Is to be upfront to be Proactive about those issues and and they're my root of issues people think about Facebook for example, oh, it's free. No, it's not a free service. We actually pay We pay with our data. The question is who owns the data for how long what can they do with the data? Do they have a fiduciary duty towards the people that supply them with the data? so And they're contracts, by the way, we all sign the click contract But uh, facebook's runs over 27 000 words. That's longer than uh, romeo and juliet of shakespeare So the key is Uh, and brad probably would be the best to answer that you could ask if that Thoughtless click on agree is a meaningful Agreement yes legally it might prevent you from harm But reputation wise Probably not really so the idea is be upfront Be proactive. There are a couple of ideas we can talk about Before something happens that forces you into a corner that you don't want to be in Well, the common aphorism is online if something is free It means that you're not the customer. You're the product And somebody else is getting the benefit Brad, I don't know if you have any quick thoughts on that given the number of hats you wear At microsoft and different products. Well, I'll just real quickly to answer the question Yeah, there's probably Most courts and most countries would find that the contract is enforceable, but I guess it's sort of goes back to Again, one of the points that was made earlier just because it can be done doesn't necessarily mean it should yes And you know, I think I agree fundamentally There is no such thing as trust without transparency. You just can't sustain it And you know what it also means is you can't Maintain trust if people can't understand what you're doing And I think it's hard to expect people to understand something that requires 27,000 words to explain So ultimately, I don't think you can maintain confidence without a certain level of simplicity Yes So, you know contracts serve a certain role and there's a limit on the role they serve And I think that's the real point here I guess the question behind the question is when we think of big brother the classic orwellian incarnation is as the state But today there is an addition to the state and lots of states Lots of private firms gathering all sorts of stuff I don't know how many people are taking the health challenge right now but we walked credulously into a room and The questions kept coming it wanted to know my height my weight My gender and your age all my friends Enlisting all my friends to watch how much I sleep I'm like well All right, this will be good and I should ask about that on the big brother panel tomorrow I I think the real point and I think it's really a fundamental one is just start with something simple people or people But there's two fundamental relationships that are at stake when we're talking about privacy One is the relationship between citizens and the state and that relationship has been Over the last few decades. I would say More generally debated and regulated through law in the united states for reasons that have to do in part with our constitution Then there's the relationship between consumers and companies And that relationship has been more heavily debated and regulated in europe in part for reasons that have had to do with the Constitution of the european union But of course if we're just people and it's all the same information Yeah, it's not unfair in my opinion to start to recognize that these are two halves of a common circle It doesn't mean that the answer on each half of the circle is necessarily the same But it probably does mean it's beneficial to look at how they fit together and in the process frankly Bring together some of the discussion that has been unfolding for many years in europe with some of the discussion that has been Unfolding for many years in north america. Yes Well, we should talk to our last panelist here, especially for an integrative approach sham sankar is from palantir technologies And palantir is the kind of name of a company that tends to bemuse people Can you tell us directly? What does palantir do? and give us your thought about big data And your anticipated uses of it given that you consult both i gather for public and private entities and on the use of that data certainly Uh Palantir is a big data company I think anytime you're dealing with data when we started the business 10 years ago really thinking about How do you protect data? You can't when at a political level just thinking about the government for a moment at a political level you think about Uh Do we have security and at what cost to privacy do we have privacy and at what cost to security? I think it'd be appropriate to actually model The lack of privacy as a threat to security because the lack of faith that people have in the state is actually a threat to the state and Therefore you need to actually be investing In technologies that improve privacy with the same vigor that you invest in technologies that improve security That was the thesis of the business And and that's what we focused on so what do you do? We allow you to integrate disparate data in a way that preserves the underlying Source of that information. Where did I get this data? How did I collect this data? What does that imply about who can see it under what conditions? So just as an example to try to pull a lot a number of threads here together I gather an amazon kindle knows exactly what page I read until I got bored Um, it has me tracked and even how long it took me to read it If I'm wearing my jawbone up at the same time, it'll know what pages tended to get my heart rate elevated Or if I fell asleep while I was reading it Um, I gather that part of the health challenge here is to integrate that across Everyone so for instance, I think the plan is we're going to know whether the party's on thursday night or friday night Or more interesting to people as reflected by when they called it a night or perhaps fell over in a stupor And uh, given all of those bases Could you see a public authority coming to the likes of palantir sometime and saying I want to know what our most dangerous literature is. What is it that's getting people up in arms when they read workers or the world Unites all of a sudden They're going to the following meeting. I mean, is that just crazy or is that called 2015? I think that's crazy, but I also think that uh, you know, we don't collect any data So when you think about mega data, there are two pieces to it Uh, how does the government or how does the state and the citizenry agree to the rules around what data can be collected? And we've talked that's actually a lot of our focus has been on. What are you allowed to collect? What are you allowed to get? The second part that I think is also really important given just the amount of data that exists in the world Is regulating how you're allowed to use that data. Yes Uh, and and that's a component that that's more nascent It needs a lot of thought and without without the two components So under if you're going to regulate how it's used you also need very robust Independent capabilities for oversight and auditing of it in the same way. This is probably an analogy that's that's More accessible to those on on in the security apparatus But in the same way that you pursue intelligence counter-intelligence threats with incredible vigor I think you need to pursue privacy threats with incredible vigor. They're equally challenging threats to the state, but you have confidence that restrictions can be Placed on use So that we don't have to restrict collection. It's okay that floating around in the world are what pages of what books I've read You need to do both so Restricting collection is where most people have been focused. I think that some amount of collection is inevitable As companies create more features You're going to be collecting data that was maybe originally intended to be used for advertising purposes That can subsequently have unintended uses So those unintended uses need to be governed. Yes The data already exists. So under current process, you can get access to that data Now there's a question of should you be able to get access to that data? Yes. So leo, you'd wanted to say something I think just you know in terms of the the average person like who doesn't know that much about this The details of what's going on. I think it's good to use the analogy of a video camera in your bedroom or your house Where basically you're being told that you know, we're just filming the whole thing. We're not going to look at it We're just filming it And you know, how are you going to feel about that? We might pick on some of them when we want to we look at it. That's the problem That's and and there's a boiling problem here because most people are not affected right now So no the public are not concerned with it right now, you know, it only concerns them when they start getting Their personal cases being actually investigated But actually it affects everybody, but nobody's feeling the pinch The other point I wanted to make is that, you know, particularly the world economic forum and these kind of discussions We forget that most of the world's population doesn't live in the united states and europe You know, it's just amazing how we have conversations about the world from a us and europe centric view and much of the discussions about these places And imagine what's going to be happening in other places, you know, if we're allowed to do this in the us and europe The the credibility and the impact that you know, what nsa prism gchq can do And you you mentioned, you know, have you taken up a legal case? We've tried to but you know, when it comes to these things, there is no route You actually can't even go to court because when it comes to security issues There that's the whole point about having the rule of law a judicial overview and transparency Nobody really knows what these people are up to and how are you supposed to hold them to account Plenty of places where the rule of law does not obtain but the technologies are happily finding their way into use Senator lehi and then we should open it up. Well, I just I just take a hearing some of this You look at the arab spring That I think it would be argued of headman for the social media and the ability of it To unite people we never would have seen At least the extent it did but then what happened afterward You saw governments cracking down On that you talked about how amnesty international Websites blocked in china and russia to countries that do crack down on on people's speech and their ability to transmit Senator I just wouldn't want russians to block our site. It's south arabia. Who does it along? Okay, well in south arabia another example one that should not be blocked in it for obvious reasons, but Let's the the point is this It can be very good to have it to get ideas and to have if you're going to have a participatory Population This is an extremely good way to do it But it's also going to be why Countries that do not want the diversity of views are going to Crack down you talked about the camera in your house. None of us would accept the fact that The government said we just we just would come by your house We're going to Copy everything you've done there all your files and your check receipts all that But we're not going to look at it We'd be up in arms the fact is they have the ability to do it because it's all on online today Brad and his company And some others joined an open letter to me and members of congress and to the president Asking for some controls On what we're able to do here. Actually, I I enjoyed the letter because it reflected a lot of the legislation the congressman censor brother and I have introduced to put these controls You You have you have two two things very quickly. I'll say one is of course Threat to any government When the abilities are in here Can use them in a very repressive way not in a way to Secure their people but to repress their people The other thing if governments, whether it's the united states or any other large government is seeing over using it You're going to find as the european union and others are done to try to put severe limitations which is going to make it very difficult for microsoft or google Apple and all these others To have any kind of international Ability to compete Got it I want to open it up to questions And there are lots of them. There are three mike wranglers. So whoever can attract a wrangler wins And feel free to tell us who you are if you like it is the big brother session okay I'm john again. I'm the former chairman of the French commission for the white paper on national security and defense And I want to follow up on what miss gadgesh said Because I think on the one hand we don't like the government to Look at the haystack But on the other hand in the way the haystack has become interesting For google and it has become interesting for governments because of the power of computing I mean for governments detecting anomalies In a haystack cross-checking with financial records with all sorts of other records is what's interesting and so The search process in a way has been put on its head instead of looking at an integral You look at a mass of data and you see what stands out in those data And so my question really to the panel is How can you effectively put checks and balance on algorithms On algorithms so that they are not abusive and so that the use of those algorithms is not abusive Yeah, sure or eight I won't talk from the government point of view although i've read some of what senator lehigh said and he has some ideas But let me just throw out a number of suggestions first Let's remember that the internet is relatively young. It's 20 years old So there there hasn't been that much discourse although the debate is becoming But I think for companies who have actually the most self-interest the government Can't eventually get away with it for a while and users can decide what they put Companies really decide on it for their survival and it could come if users don't use them Their business goes to hell So continuing to your point and continuing what I said before by being upfront Some i'll throw some ideas One could be uh companies data companies Having an ombudsman if you will like the press has may not be a great idea because usually he or she Worked for the company But you might think about companies coming up with a privacy board That has responsibility towards the users not unlike a board of directors that has a Responsibility towards shareholders when it comes to finances and risk This would be a board of credible outsiders That will have access to data will have to be Secret about the data like a board of directors and will come out with an annual privacy report Or you might even think about an annual audit report done by an outside third party not unlike editors In fact today's it was interesting today's financial times talks about the Concentrated cash pile puts recovery in hands of the few who are the data companies Well, I can see sorry some of these data companies actually perhaps financing an institute that is separate That would come out with Generally accepted privacy guidelines not unlike accounting guidelines more rules. Yes, that will actually serve as a Audit function as an audit privacy function Again, it's the beginning of the debate, but there are some ideas It should be so so far a number of structural adjustments that companies could make Within the corporate form to try to be more sensitive to and it's to their self-interest Yes, and it looks like augie and brad want to say something. Yes, let me just add the good news is as already said company's Self-interest mandates that the interests of the consumer and the company are the same Because if we're not a trusted guardian and a trusted advisor, we will lose that customer That is fair. It's what exxon said right up until the valdez So The question may be what's it? I agree with what we're saying here, which is it has to be backed up with action Microsoft has one initiative We actually do have exactly that within our company where we actually look at what do we do to protect the privacy of the consumer Because that is a strategic Asset, I mean at the end of the day the consumer is everything. Yes I think there's just your question is really interesting and I think to me it points to one concept that is important That doesn't answer every scenario, but it's worth thinking about if you think about the power of big data and machine learning If you're trying to have a haystack as you put it that you want to use to do research medical research social science research You name it You can anonymize the data And indeed regulators, especially in Europe, you know required Microsoft and yahoo and google To anonymize search results if they were going to be retained for more than 18 months But if you're doing a law enforcement investigation or a national security investigation Look, I'm not the foremost expert, but I don't know that anonymized haystacks Are very valuable So, you know, I said They might be but but if you're actually I Maybe But if so then maybe that's an answer on both sides of the ledger But anonymization of data is a way to preserve benefits while increasing real privacy protection Before we take the next question. I just want to ask Cham if there's anything you want to say on the topic of Big data here. How useful is it? How useful is it anonymized? Well, you know Vermont has a very public public health issue right now And actually, I think there's a lot of value in the haystack Applying connecting these two dots here if you take the payer information you have you can actually predict Who's about to overdose and that gives you an opportunity to intervene and solve a very important public health issue Uh, you know, there are limits to how far you can go with that if if it's completely anonymized You can't do the intervention, you know that someone is about to overdose Then there's a question of how do you do the intervention? But that this is what I this is exactly what I was talking about when I talked about You have to have rules around the data use so if you're going to collect all the data Which is the incidental collection here by the way is to pay the bills. It wasn't collected for this You're using the payer information to now predict overdose The question is is this a use in the public's interest that the government the state and the people can get behind And that and I think that's the level which you actually have to regulate the use Yes, very good questions. Let's take another where the microphones. Is there one over here? Ah, right here and is that uh The president of Estonia, I believe yes. Well for the purpose of this, uh, I'm currently chairing the european commission Uh steering group on cloud computing and I'm also chairing the ican group on what the hell we're going to do in this new But that's a formal title of the group Let me raise a few things. First of all, I think the big brother metaphor really is bad I think the proper metaphor is little sister the one who knows everything about you and is willing to tell anyone I thought you're gonna complain that it was sexist No, I mean if you read the book by uh Victor Meyer Schoenberg on big data, which is a good introduction I mean they have a case there where has nothing to do with computers or your use of computers Is your credit card swipes can determine if a woman is pregnant And they do direct marketing to people who because of their purchasing Which is already been termed by big data that they are pregnant because they're buying this that or something else We'll call people up or they will send direct mails to people which cause a big scandal because of People may not be public about their pregnancies Well, what happened was that we got an irate phone call from a father who said, wow How dare you send this to my 15 year old daughter? They go, oh no, now we're gonna get a tremendous lawsuit because being the litigious is usa And then the next day they call the guy up and say well We'll offer you something and then the father says actually I have to apologize. She is pregnant So in fact big data is very very effective But on the other hand this has nothing to do with your what you do on what you do on your computer So big data little sister as my but it's not big brother. I mean the corporate sector is much bigger Second issue no one's talked about because they're so concerned about privacy actually which is far more important I think is integrity data integrity one things. They're reading your mail the other is changing your content Someone's going to change your blood group So this is integrity is a term of art that means keeping it the way it originally was written And I think that's far more. That's I mean that is far more dangerous. I mean privacy fine I'm I'm very worried about privacy, but I think we have we haven't gotten beyond that because if they can look at your data They can probably change your data. Yes Um, I would argue that it's all in the security of our architecture I make a joke that our national system could probably use the nsa servers and they wouldn't know what's happening because nsa shutdown lab love a bit for 512 rsa 512 Encryption because they couldn't break into it and we use rsa 2048, which is two orders of magnitude higher 16 airtight compartments have the titanic Well No, no, I mean No, if you know anything about it then then rsa 2048 is not going to be broken for a long time. Yes. Um To put things in perspective The u.s. Is terrible, but in the united states to uh, I mean in in russia since 2003 a law says all isps have to feed their servers through through the fsb, which used to be the kgb. So yes Um, another thing is that basically I think we're overly paranoid because uh, no one's I mean rarely Do they do deep pack and inspections? They're looking at who's talking to whom? Which may in fact be a legitimate question if you're in humborg and suddenly ordering 3 000 kilograms of fertilizer. Yes, it might mean something So, I mean, let's now get overboard on all of this The privacy issue is actually new Uh, it's only since brandyce of 1895 has the issue of privacy come into the legal space So it's also not it's not this is a this is not since played on iris throttle. So we have to think about it Um, should I ask how many more are on the list? One thing I would say that people should realize there's no such thing as a free app Which is a different way of saying If you have a free app You know, you're just you're being monetized It is interesting by the way that there's not a common practice in the industry to say look I'll pay you five dollars or five euros or whatever If you agree that all my data stays with me consider me the advertiser bind myself out Why can't we buy ourselves out? It's a new business. It's a new business model. You heard it here first And finally, I would say that really I think the problem what we see here is if anyone if anyone has read the 1959 Essay by cp snow the two cultures. Yes, it never really caused much damage before But now what do we have? I mean this whole situation comes out of people saying wow Look what engineers saying what look at what we can do But they've never read anything in the humanities in their lives And if you look at the other side if you look at the stuff To be polite about what's being written about what snone is doing. It really has very little to do with reality because you know I mean the reporting is absolutely abysmal It's sensationalist and if you actually look at what is possible to be done It's not like every person in the world is having their emails read It's very hard to read emails, but they may but it's very easy to say who you're talking to President Ilvis, I thank you for that kaleidoscopic intervention And I w our seventh panelist. Thank you Yes, sir. Jeff Jarvis. Oops. There's one over here microphone. Yes, right here. I got one sir. Tim Berners-Lee So I have a list of seven things, but I want to give you the top two One of them is that Yes the fact We have to think about these things in terms of the power of the computers and the way things actually The way things that these algorithms actually Work and as somebody already mentioned that's This big haystack is looked at isn't filed by person So you can imagine how we know that the search engines do do give us tremendously Good results by scooping up absolutely everything and then looking from a long distance And in fact to be technical taking the eigenvectors of it looking for clusters looking for trends Yes, and we get used to the system being able to pick out trends in twitter And so on by looking at a huge amount and picking these things out That this you know, maybe terrorism is trending and that is not it's not That is not that concept that concept of something trending. It's not associated with any one person It's got out of the morass. So we're not going to be able to fight cyber crime Very powerfully without using these techniques which pick out the trends out of the morass and they involve I mean you're operating at that level that the poor search engine has no idea which of these people american citizens No, it has no idea which of these people are forming. You know, you know have been Have been labeled in some way as being suspected of creating some serious crime So we've got to be so to be able to say you can only work with that sort of data doesn't apply at that stage But it's not a reason for us to take heart then because what you're saying is What we've been in artfully referring to as an anonymous haystack may have many many uses that then don't implicate Maybe what we need to do is to allow the Have a very powerful haystack But have it and do that powerful processing in a non amount not anonymized haystack But have everybody who does that Be treated like the Andromeda strain like they've got they've got a horrible disease and they're locked in a bunker And basically and so that when the when the system comes up with us and thinks Wow, you know, we look we've seen we understand the patterns that happened when terrorists attacks occur And we've got something and then at that point then having processed all this Nonanonymized real real very powerful data. Yes, uh, then you go to you need to go through the court to say, okay We want to now we need to find out who it is. It's interesting to it suggests the financial markets may have the phds working on this So they can then invest accordingly once they've made their predictions. So one of the things I can so so Yes, so in so in other words The all all the talking we do about data as though it's filed by person and arose by people Is just not it's not recognizing the way search engines actually work nowadays and not not taking advantage of them our sort of What follows from that then is that people will end up With access to data which actually they could have used but where they need to as Gentleman from public here said You need to track where it came from and what it can therefore be used for So when I think one of the things we directions we need to move is from talking about thinking about locking data down to Thinking about how even if you do get the data what can use it for so what we could do with international agreements on And places like this or what sort of thing of data? Is it reasonable to use if you are giving somebody insurance for figure out somebody's insurance premium If you are deciding whether to employ them for example There are all kinds of things where you can't discriminate in a lot of countries in the u.s You're not allowed to discriminate on game grounds of gender for example We could start adding a whole lot of so this could be a lot of use restrictions that on pain of breaking the law And so in a company you just set up processes so that no we don't yes We may have lots of data But we don't use it for all the critical things which which are about people's lives. We end up Having norms about how different data is just not appropriate and perhaps even perhaps illegal for use for making those particular corporate decisions Yes, thank you. Tim should be one of those people on one of those independent Agencies it looks like you've just been volunteered to Chair the committee that's going to do it absolutely and president Ilva's a skill in naming committees and Perhaps could join as well I was just concerned on the on the use restrictions. I don't want to try to summarize everything That was just said but On use restrictions, this could also be a difficult thing much as I want to protect everybody's privacy How do you know Today Which things may be very beneficial to you tomorrow in analyses of consumer trends You're an investor. You're a buyer. You're a parent who has a child with a rare disease. I mean Sometimes can be extraordinarily helpful the more material that is out there My concern and as the united states senator my concern is That We live in an age where we give up a lot of privacy Either you nor I nor any of the expert in this room Can say what more can be taken five years from now Because these things are changing so much just think about that We could talk today, but all the great things we want to do but five years from now We don't know what might not be out there or we might not know what's out there My concern is to the extent a government Can snoop on you And can alter Your abilities to act in a free way Oh Congressmen so-and-so you're not going to support us on this Bill, you know, I'm really upset because Somebody told me one of our agencies that You've been sending money to what's this woman's name pee pee la boom. Boom. Does your wife know about this? I mean not that I would ever tell anybody but This is back to jay agarhoover. This back jay agarhoover, but don't think that just because this happened with jad agarhoover That this might not happen again, but it's my government or the governments of any of the countries here and I think that we we get Excited about all the things we can do and we should be because it's remarkable But if we don't have overriding a sense of how do we protect our privacy at some point you are going to be hurt Well senator, you've highlighted again the special responsibility that governments might have given that they are powerful and they typically have a monopoly over the use of force to Limit their snooping and their use of personal information, but I took president ilvaz's intervention and Sir tim's intervention both to be talking about in this little sibling aspect of things That today's tools that are only in the hands of the nsa and its counterpart Organizations are going to be tomorrow's corporate tools and the day after they're going to be individual tools Some of them are already in the corporate tools. Don't think that the nsa has a monopoly on that So is there any hope Of meaningful regulation or restraint there of the sort that it sounded like tim was calling for When there's not a known body of regulated companies to target well, there's certain things you can do for example uh, I have legislation and A lot of companies have not liked the idea, but now I think there's Building support for it is that when there's been a breach You're going to have to make this public Very quickly We saw with what happened with the target Oh, we've had a breach of a few hundred thousand or a few million or a few tens of millions or You know as it keeps coming down well, I think If you're putting all this stuff online and you're what is it through your credit card or your banking by By computer anything else if there's been a breach You have a right to know that immediately and yet there are companies that don't want to go along with that Yes Brad I think part of what this captures is frankly the multifaceted and complex nature of the topic Because I think a use model has a huge amount of promise Especially when you look at the the analysts of the collection of data and then its subsequent use in say the private sector but I do think that It's harder to embrace a use model at least in my opinion For the government Especially when you take into account the fact that most people in the world do not live in the united states or the european union And you know if you turn the data over to the government You basically lose I for all practical purposes any Subsequent ability as an individual or any private entity To know what the government is going to do or to restrict what the government is going to do with that information And one also needs to take into account the fact that governments change And so you know in some ways I just think there may be different answers for parts of this and other answers for other parts And I think transparency plays a key role, but in all honesty the least transparent player is always the government Companies are pretty transparent and I get how that regulation might be resisted by by some companies But that's a short sightedness that that will that will work itself out because the more transparent you are the more trust you build But the governments are the ones that are least transparent as to What they're accessing and even if that got into the public debate then at least there's a chance of finding a solution And that balance Yes, and I just add that also to back to the companies That also harms companies Especially since they are global in nature and operating under a certain law So companies that are operating under american law have a chance of losing their clients customers users in germany, which has very different in europe and Etc and actually this is a direct harm both of the economy And to the companies that operate in this region. Yes Yes, sir Of course, it's very complex and it's changing and you know, we have to be very flexible and adaptive in the way In which we deal with this But you know some of the basics of the the principles of the rule of law don't change in that sense because Essentially we're saying that if you're collecting data then there has to be some rules around that And people need to know that you're doing it and if they're not happy with what you're doing They need to be able to go to somebody and they have a right to complain and some remedy Yes, exactly the same with the usage if you're going to use it People need to know you're using it and if they're not happy with the usage they should be able to have redress Yes, so we have to kind of at one level simplify the conversation. Yes, otherwise we say everything's too complicated We can't do anything about it. No, it's a great reminder that everything new is still old again It's our reminder from president will was about brand ice and warren that we've been struggling with this for years Maybe just the last piece of the puzzle as we wrap is Perhaps the other piece of big brother back literally to the book 1984 was not just the government Surveiling people and learning what they were up to and figuring out who their dissidents were But persuading people that the government was all about in that book propaganda And when I think of propaganda somehow occasionally the thought of advertising comes into my head And we think of the most common use of data gathered particularly in the private half of things It is for better targeted advertising I don't know if I have a cat or a dog and which food then to advertise to me To imagine all of that data being put to use to send me very targeted messages designed to get me to be outraged at this or Feeling some way about that. I gather we haven't really even begun to think about that yet And I'd be interested. I'll have to read one of those privacy policies to say We reserve the right to make any use of your data to try to get you to believe whatever it is Somebody paid us to also take you three weeks to read it It's really interesting because you know if at this point in time we feel that okay, at least it's nsa and it's gchq And you know, it's our government and it's our corporations who have access But you know, you're gonna have chinese companies indian companies brazil's talking about doing a separate Cabling system and a separate, you know data centers So I mean people who are taking it very complacently right now in the west I think there's going to be a real wake-up call when there's a whole different ballgame happening somewhere else But also you're back to your transparency issue about how for example the search engine done If you knew it, they wouldn't be able to influence you because you'd understand that so we're back to where we started Yes, senator levy of the last word. Okay. I just say in the u.s You mentioned brand eyes long before brand eyes the issue of privacy is brought up in the framers of our constitution and They could not Imagine what's happening today. I I would suggest we can't imagine what's going to happen 20 years from now And we'd better start paying a heck of a lot more attention. We're paying today. So consider it a date We will reconvene here in 20 years We'll do a screening of this panel and then have a chance to laugh at our naivete But until then thank you all for sharing your wisdom. Thank you all