Episode 113: Taking Control of our Personal Data

Jon Prial: Have we crossed the Rubicon when it comes to personal data? That largely depends on your perspective. Do you see the future is one where we have more agency over our data and we see the rewards from it, or are you more pessimistic? And the yes- no question here will be with the companies that profit most from our data go on profiting from our data, or will we, or both? What does it take to be okay? Today I'm joined by Lisa LeVasseur, founder of the Me2B Alliance. Lisa has been a software professional for over 30 years with her formative career years spent at Motorola developing software for the mobile phone infrastructure. Me2B's aim is to review technology products so you know right away if a product or service is treating you right, and we'll learn more about what that means. We'll be discussing a future where consumers are more educated and companies adhere voluntarily to standards that build trust with their customers. It's going to be a great episode. I'm Jon Prial and welcome to the Georgian Impact Podcast. Although you're currently running the M2B Alliance, I think it would be helpful if you could back me up a little bit and talk me through kind of wrethink. com, the company, kind of Wrethinking, the Foundation, and how that sets up where you are today at Me2B Alliance.

Lisa LeVasseur: So about 10 years ago, almost to the day, I got connected with Arlene Harris, who is a long time telecom luminary with lots of successful businesses and exits. And at that time she was on the maturing side of GreatCall, which was her most recent successful business. That's the jitterbug phones. She's always been very visionary. She is extremely visionary. She sees the target that most of us can't even see is there yet. And so she had this idea for putting people in control of their data and creating a truly family friendly kind of appliance that was safe and secure and put people in charge of not just their data, actually having come out of Telco, putting people in charge of the service relationship as well. And that's a reaction to how we used to be stuck in wireless contracts for two years at a pop. So she had this vision and I came on board about 10 years ago, and that is wrethink. com. And we basically spent several years refining... We were so far advanced, there were no talent... There were no standards, technology standards. It took us a long time to find our people, the people in privacy and identity that were creating the technology enablers that we needed in order to create the experience that we wanted to create for people and families in this household appliance. So wrethink.com is building a household family appliance that is completely secure and respects users agency, as far as their data and their services. So it is an ecosystem. It's a new kind of appliance. It's sort of like a stay for version of Amazon Echo or Google Home products that is not eavesdropping on you and is not having its way with your data. And so they'll be launching...

Jon Prial: crosstalk But it fill in device that... It's still a device that someone communicates with though. Yes. Was this Rosie?

Lisa LeVasseur: Rosie is the name of the device as in like Rosie the robot from the Jetsons.

Jon Prial: I'm so happy to hear that. So Rosie is managing family data, correct?

Lisa LeVasseur: It's managing family data. It's a hardware and software play where with the device, you get a little bit more security benefit and a little bit more bells and whistles, but it will also be a subscription application that can manage stuff. And we're starting with a particular set of value propositions. And we're really focusing on managing the residual paper in our lives. So things like... Especially people of my age, where I've got boxes and boxes of photographs from my family and... What do you do with that? It's you have it and you know you want to do something, but the services are really expensive. So how do you manage this residual paper and the residual paper in your lives? I'm still old school, so I have a lot of paper, but sometimes it can be a real headache to deal with it. So we're bringing AI in a safe way to basically automatically manage this residual paper in your life.

Speaker 3: That's neat. All right. So that's wrethink. com. Now we'll talk about Wrethinking, the Foundation that Arlene's run and how it links to you now at the Me2B Alliance.

Lisa LeVasseur: So Wrethinking, the Foundation is Arlene's personal private foundation that she established about a couple of years ago, and we are still kind of fine tuning our precise mission, but in general, we're focusing on privacy related nonprofit, philanthropic activities and organizations. And the first one we're really focusing on is the one that I created towards the end of last year, early this year, something that I had actually been contemplating for many, many years in response to something Arlene said to me many, many years ago, which was, I want to be able to go to the store and find the stuff that's safe for me. That's good for me, treats me right. And it never left me. And I thought we know how to do this. It's not rocket science. It's not magic. We've done this repeatedly. And I thought about my experiences with CDMA and the CDMA Development Group. And also just from the outside in looking at Bluetooth, things like Bluetooth where it was a technology, it was a protocol. And now it's sort of... There's a certification to it. Now it's sort of a brand people kind of... It's sort of like Kleenex in a way, Bluetooth. And so I thought" we can do this". We can actually create that customer consumer facing brand. And that's the Me2B Alliance work that I have been building diligently in earnest since around February of this year, where we kicked off and we've started to create working groups and we are going full throttle right now.

Jon Prial: Nice. So I absolutely understand Bluetooth has kind of as a brand, as a standard, as a standard bearer for certain things. We all see the funky little B with the sharp little triangle edges. So that... There's things underlying that. So the devices can talk to each other and someday your phone then gets to the next level of Bluetooth that can have two connections instead of one, they might put two antenna in, but there's underlying standards that are there. I feel like I get the sense that when you say can consumers kind of see and trust, I'm seeing, hearing this more as an underwriter's laboratory type certification than a standard certification, Bluetooth, or do you see them as the same?

Lisa LeVasseur: No, you're exactly right. So it's a question of life cycle of where we are with the appropriate standards. So ultimately, long- term vision, there does need to be an interoperability for trustable technology.

Jon Prial: Got it.

Lisa LeVasseur: That needs to happen. And I have a whole thesis about the four technology pillars that need to be standardized in order to reach that stage of interoperability. And that those four pillars actually drive my standards work and why I'm involved in the IEEE 7012 group, which is the user proffered privacy terms, machine- readable user proffered privacy terms and the vice chair there. And then I'm also actively involved in the Kantara working groups for UMA user managed access and the consent related working groups there also. So those standards are percolating. You know, there's a lot that needs to be done there.

Speaker 3: We're going to see evolution in terms of interoperability. And so you don't have to worry per se about the interfaces necessarily because they're being worked on by these other groups. And you're obviously have a guiding hand in those other groups.

Lisa LeVasseur: Exactly. I would rather not write standards. I would rather glue them together and say if you want to be Me2B certified. And again, I'm still talking longer term.

Jon Prial: Sure.

Lisa LeVasseur: What we're doing immediately is a little different and a little harder in a way than just dealing with straight technology. It's really just about gluing those standards together and saying this is what interoperability means.

Jon Prial: Well, at some point, stay on the future for a second. I'm going to pick up a device that sometimes I see there's a CE on the back. I think there's some consumer electronics device, something that I have to be careful about e- waste and stuff. Or I might see underwrited laboratory on a lamp. I might see some Me2B Alliance shields type thing on a device. If I do see that five years from now, what does that mean to me?

Lisa LeVasseur: Exactly.

Jon Prial: Why would I pick that off a shelf versus one that didn't have it?

Lisa LeVasseur: What it would mean to you is that you would feel okay if you hadn't read the full terms of the service and the privacy policy, and you weren't a software engineer who could actually poke around in the code and confirm exactly what's happening with your data and with hardware capabilities like microphones and cameras on things. It basically will let you rest easy and know what the level of trust is for a particular product or service. And it's just internet connected products and services that we're really concerned with.

Jon Prial: And you're going to distill down in your work. This is what's required to be in terms of conditions. I don't care if it's 87 pages. I don't care if it's one screen that shows up. You're going to get told... You're going to decide as part of the work you're doing, what's going to matter to consumers. And when I see that shield, I don't have to read the terms and conditions. I already know you're not surreptitiously turning on my camera, or I know that you're not selling my data to third parties. And we're going to talk about some of inaudible. But that's kind of things I will see without having to deal with the terms and condition whatsoever. I'm so happy.

Lisa LeVasseur: Yes. I mean, ideally yes, that's it. And for people who want to dig in, there'll be ways to dig in and really take a deeper look at the exact scoring that... And the exact scores for all of the different facets of evaluation. But yeah.

Jon Prial: So I do want to get to what you're doing now over the next couple of years, but let me just, only because I really want to plant this in the head of our heads of our audience here and this discussion of what's in Ts and Cs. Can you give me the top five things that you think are most important that protect consumers from a privacy perspective that would allow a company to begin to instill more trust in the company, the way they're viewed by their customers? What would be the top five things? I just made up two on the camera or whatever? What do you see as the most important things that you want companies to be doing today as you evolve with this Alliance?

Lisa LeVasseur: So I might just say one because to me it's really, right now, the biggest thing and it's disclosure of business models.

Jon Prial: Wow.

Lisa LeVasseur: Real disclosure of the business model, because I really don't think people have a clear sense of how their data is being shared, with whom it is being shared, for what purpose it is being shared. And, of course, GDPR and fair information practices say that you have the right to have that information, but I seriously don't.... I just don't think people really comprehend viscerally what it means to them. So I believe that this Me2B certification, initially, is shining a light, at least on that information to clearly say with a social media platform, for example. I won't name one, I'll just say a generic social media platform. You know, the consumer is not the customer in that, the business model is different, right? And the consumer who thinks they're sort of the customer, but they're really not, has no real sense of," Oh wow. Every little transaction, every little action that I take on this social network actually goes out to third party data brokers that I have no relationship whatsoever. And they're building an evermore detailed profile of me to be used for the highest bidder or for whomever who will purchase my profile and fundamentally manipulate me in some way." Like for instance, if we had a requirement that the vendor will list all of the entities, all of the processors, data processors, that it's sharing the data with and the revenue model behind it. Suppose you had to do that as a technology vendor. And we don't know if they will, by the way, this is sort of... We're going to start with our highest aspiration of what we think is right. And then we'll figure out what can be practical and meaningful. But if we could just do that. I feel like if people knew that they would think twice and more... The second thing is if they had a choice," Well, geez, I don't want like that. Is there somewhere else I can go to do the same thing that doesn't do that.?" So those are my top two.

Jon Prial: I think that's such a great... Because I asked for a five, you gave me one and actually maybe a second one, but I don't believe in all the readings and conversations, business model shows up. It's always a bit of a secret and terms and conditions or what I'm going to do with your data, but the context of why is the business model. And I think whether it's a B to B or B to C world that level of transparency is a great way to start for a company build trust. I really liked that answer. I didn't think I was going to... You were going to go that way. And I really think that's... It's great, you're right. It's aspirational. It's where you are today, but what a great way to start. So how are you getting there? What are your activities over the next 12, 24 months? What are you working on?

Lisa LeVasseur: Yeah, so we have a goal to get a minimum of 20 products or services certified by the end of this year. So this could be an app, it could be a website, it could be an IOT device. And we are starting to recruit some vendors because these first the handful of vendors will be a very high touch... We'll walk this path together, really.

Jon Prial: Sure.

Lisa LeVasseur: Simultaneously. So what we're developing is we have several working groups. One working group is called good cops and it's the cops part stands for code of practice. And we started with Me2B principals and we only have two. The Me2B principals are: I'm in charge, meaning I'm the individual and I'm in charge. And secondly, we agree to play nice. And what nice means, we have some deeper thinking about this rules of engagement, we call them, but there's only two principles. And so we took those principles and we kind of drafted a set of do's and don'ts as a code of practice for vendors. And we wrapped that up and now we are translating that into testable criteria. One thing that's really different about what we're doing is that we're a standards organization, but we want to skew on the side of the individual, which means then our constituents and our membership in this Alliance have to be both individuals, consumers, as well as vendors.

Jon Prial: Sure.

Lisa LeVasseur: So we're doing something a little different and in fact, usability features quite strongly into our certification process. It's it can't just be hand waved away. And we're fortunate to have Don Norman and UCSD's Design Lab supporting this and acting as an advisor to us. So we're working on the certification. And so we already have a good solid base of the certification work in place. And it does include things like this, the vendor discloses their business models.

Jon Prial: Now there are other elements, technology elements. And you talked earlier about working with other organizations. So somewhere... I can't remember, and I apologize for not... I'm on a banking website and I see e- trust or something. This has been secured by e- trust. And I may have the wrong phrase. You're not looking to replace that, but you might be an overarching umbrella that includes some of these other labels, shield certifications under you?

Lisa LeVasseur: Yeah. I'm so glad you asked that. One of the first things we did is we created a list of all of the organizations that were doing anything in the privacy arena, sort of all the NGOs and the standards bodies. And that list is over a hundred groups. And that's not even including the standards groups. Over a hundred NGOs doing something. Whether it's certification like activities, or it is just Center for Humane Technology or MyData or Epic. Or there's a whole array, a whole kind of ontology around these organizations that are doing something in order to get to this nirvana of trustable technology. And so we looked at... We are looking and continue to look at all of the organizations that are doing something like the TRUSTe or any...

Jon Prial: crosstalk That's what it is. TRUSTe, that's it. Yup.

Lisa LeVasseur: of those sorts of certifying types of entities. And, and we don't want to reproduce anything that they're doing. And so like IDEF, which came out of inaudible work and IDESG, which turned into IDEF and is now in Kantara. They have a great set of criteria. We're including those things, right? In our lists.

Jon Prial: Great.

Lisa LeVasseur: If you are already certified in these other things, that's going to go into your overall score, your overall Me2B certification score.

Jon Prial: That's great. I love it. Not reinventing the wheel, taking the best of everybody else, but realizing there's a higher level solution that you're working towards. So the one question that would come to my mind then, and maybe this is this isn't like... That comes later down the road for you. How do you begin to even define cohorts of users that might have different views of privacy or what their objectives might be? I know a lot of people that say," I don't care that they're using my data to give me ads." Maybe I don't like that. And maybe they're okay with that. Maybe they're not okay. The data is getting sold to a third party for it. How do you begin to... I don't know if there's... If it's degrees of difficulty or degrees of privacy or so how do you begin to think about what you want a single shield to stand for?

Lisa LeVasseur: So one of the other working groups we have that's active and producing things is our consumer stakeholder working group. And from a budgetary perspective, I suspect that the vast amount of our eventual budget will really be towards consumer education and awareness, including education about the mark, the Me2B mark and certification. But since we will only have a handful of products and services certified, initially, we have sort of this period of time where it doesn't make sense to go promote highly this mark because people won't be able to find it anywhere really.

Jon Prial: crosstalk Right, right.

Lisa LeVasseur: And that would just be frustrating. So what do we do in the interim? Well, we can try to understand what people's concerns and internet hygiene... What their privacy hygiene is today. If I could wave a wand, a magic wand, I would do these two things. I would have an annual state of consumer awareness, something that could be run in every market, all over the world sort of a market research in a box that could be easily and cheaply reproduced somehow, that's definitely magic. But where we could actually assess where people were in their sensitivities about the harms, the internet harms that are out there. And then the other... And then we could measure it and measure progress like," Okay in 2019, people were at this pretty low level of understanding. And oh look, we've moved it up a notch in 2020." And then we can measure. Same thing with the state of the industry and state of technology. If we could measure on like a per sector basis like automotive in 2020 is at only 5% of the market. I'm making this up.

Jon Prial: crosstalk Sure.

Lisa LeVasseur: Only 5% of the market is scores at 90% or higher and Me2B certification, whatever. But if you could run that every year and see how the industry progresses in terms of getting to behaving better. So those are two things that I would love to make happen somehow. And we're exploring ways to do that. In the meantime, one thing that we have produced, and we will publish that will be sort of a raw database for all of our educational materials, is a harms dictionary. Because we get this from a lot of people," Oh, I'm not really being harmed by this." And it's sort of maybe so, but did you know A B C D E F G.

Jon Prial: Right.

Lisa LeVasseur: And do you still agree with that statement that you're not being harmed? And so we're really working with languaging and trying to put things in terms that people can understand. That code of practice that I mentioned, one thing about that is we want it to be intelligible by both consumers and vendors, and we're going to test it to make sure that it is, and we're going to test it to make sure that it matters to people because I will guarantee our first draft of it is not going to hit on the things that matter most to everyday people.

Jon Prial: Sure. But you're on a journey and you're on an incredibly important journey that some number of years down the line, if I see a certification, I know exactly what that means. And that's a good thing for many, many people. Lisa, what a pleasure chatting. This was so insightful. I'm so excited what you're doing and wish you nothing, but the best of luck.

Lisa LeVasseur: Thank you, Jon. I really, really appreciate the opportunity.