okay thanks very much Simon I had less
gray hair in that photo to be honest I'm
going to be loved I'm going to level
with you I had actually planned to do a
standard presentation on personal data
privacy but actually the next 30 minutes
is going to be more of a rant and
actually it's going to be a rant for a
number of reasons first of all because I
just got back from San Francisco for the
RSA conference and this was a conference
of security and privacy professionals
this was I think they called it the the
super bowl of the security and privacy
industry I actually saw a number of
things about the way that our
professionals are managing their data
which actually worried me considerably
but equally we're going to talk about
the advent of IOT as well because I
think you know one of the things that
people don't realize is that all of
these wonderful devices that we have in
our home our tracking everything that we
do and selling that data on to who knows
so when we get started it always makes
me laugh whenever I put this quote up
because everybody here knows this quote
in fact we know that personal data has
economic value we've known about it for
about 15 years I think and yet when you
go and talk to people outside they have
absolutely no idea that data has
economic value I always ask this
question and I say was anybody surprised
at the price that whatsapp were required
by Facebook only remembers how much they
were bought for 19 billion dollars only
by the way anybody surprised at that
number one or two so I actually actually
soon after they've got acquired i did a
news program with CNBC and you know they
asked me and they said well that's a lot
of money for a company that really
hasn't made a profit and i said well do
you really think it's worth that much
money and i said well i think it is
because if you consider it whatsapp were
required for the equivalent of 42
dollars per record now if you reverse
Instagram were required for thirty
dollars per user
and youtuber required for approximately
twenty dollars per user in other words
what that means is the actual value of
personal data is increasing so our
digital footprint is an incredibly
valuable commodity and organizations
across the world recognize that
commodity now that second point that
consumers and governments are looking
for change it's slightly tongue-in-cheek
I have absolutely no idea consumers are
completely blind and entirely oblivious
to this market economy in which there
personally identifiable data is making
billionaires of people all across the
world they have absolutely no idea but I
think there is a huge opportunity and
that really is i guess the purpose of
this talk is for us as an industry to be
able to introduce ethical practices now
i'm not talking about regulatory
compliance this is not about regulatory
compliance this is about the ethical use
of data giving users the ability to be
able to control and have transparency
over their data and actually get real
market return for their personally
identifiable information that i think is
the opportunity that we face so I was
going to stand up and I was going to
talk to you about a couple of blogs and
a couple of stories that I've actually
witnessed around this concept of the
perceived value of personal data in
order to do that I was going to share
with you a recent story that I wrote in
The Telegraph so of course i went to the
Telegraph website and i found the story
and of course as you can tell i'm
looking to buy a car I didn't ask for
that I didn't tell the Telegraph I
didn't tell anybody that it's okay for
you to keep trying to sell me stuff that
I don't need but there it is and I think
that's a really good example because I
actually provided consent for somebody
to be able to track my web history in
fact all of you provide
you provide explicit consent I mean if
you remember years ago everybody got
upset because the NHS was using the
concept of implicit consent we know
what's best for you and everyone said
well how dare a doctor even consider
they they know what's best for my
medical history now I want explicit
consent so now you've got it
congratulations it's on about page 27 of
the terms of service every time that you
sign up for any digital service at some
conferences I talked about a south park
episode for those of you that have seen
it will know what I'm talking about we
need to move away from this concept that
we are actually providing people consent
because we simply aren't as an industry
as a society we aren't providing people
consent putting it on page 27 28 / Terms
of Service and expecting people to read
it and understand it is just
preposterous does everybody remember the
company vtech that were recently
compromised remember everybody remember
this now here was a company who provide
electronic toys for children now sadly
they actually got compromised and all of
the information that children had and
provided all of their content was made
accessible to criminals that's pretty
bad right so what do you think vtec did
I mean of course they did the
investigation they work with law
enforcement but what do you think their
response was anybody that has a chance
and actually I tweeted this not so long
ago they edited their privacy policy and
in the privacy policy they stated by
accepting these terms of service you
accept that your information may be
accessed by unauthorized third parties
that's hilarious right they wanted to
absolve themselves of the liability of a
protecting your information and so we
had a really long debate and I would
encourage all of you to have this
discussion afterwards because the
question becomes well under principle
seven of the Data Protection Act they
can't do that but they're a global
company so how is that enforceable if
they don't have any assets in the UK how
is that going to be enforceable in fact
the ICO came out and said you can't do
that that's unacceptable but regardless
of the fact whether it's legal or
compliant or not I went and gave a talk
at a local school and there were parents
there and I was talking to them at that
about the vtec case I asked him the
question said does anybody know or
didn't anybody by v tech toys in the
last three months and hands went up and
I asked him the question and I said well
are you aware of this particular policy
change are you aware that this is a
company that is actually given away
information to criminals information
about your children and not one hand
went up they were completely unaware
entirely oblivious that this is the
world that we live in that they've
actually bought equipment in which
they've authorized or allowed potential
hackers to basically steal information
and they are then held responsible and
they had no idea of this so if we move
forward you know I think this concept of
oil in the in a row what is it personal
data being in the new oil I think we in
reality what we're seeing is we're
seeing two types of business models you
know and and I've actually seen some of
that with regard to targeted marketing
but service personalization as well and
generally speaking I think this market
somewhere in the region of between 50 to
70 billion dollars per annum I mean
that's roughly what it's worth which is
pretty impressive but we actually did a
study and we asked consumers we said
well what what is your perception of
personal data what do you actually want
and they came back with a number of
things first of all they were
control they want to have a say over who
has access to their data and for me this
kind of comes back down to this concept
of consent again it's not about implicit
or explicit consent to me it's about
informed consent it's about actually
telling me what you're going to do with
this and saying are you okay with this
and me saying yeah okay I am or actually
no I'm not it reminds me that when I
went actually we went to go and see
despicable me 2 at a local cinema it's a
dreadful film by the way but my
four-year-old loved it and we were there
and i think i spent about 30 pounds to
go i think was a rock five tickets was
two adults and three children which is
extortionate now by the way I have just
had to say cinema tickets are just
expensive as anything but at the time we
bought these tickets of about 30 pounds
and you know the patellar behind her you
know the cash register she said to me
well do you want to join our loyalty
card program and I went you know what
what do i get if i spend 30 pounds above
all you'll get a free you'll get a free
cinema ticket next time you're here and
I said well actually that's probably
worth it I'm happy to trade my personal
data for this and so I said okay fine
I'll join join your loyalty program and
she said oh that's going to be another
15 pounds please I was like sorry you
want me to pay you twice now at this
point my wife gets embarrassed because I
do this a lot I'm sure all of you do
that as well you always ask questions or
actually when you're at a restaurant and
someone takes away your credit card
you're like no no come back come back
and bring the machine here that I'm that
kind of guy I'm the kind of guy that
watches like movies about cybersecurity
and says perhaps nonsense that will
never happen and I started to let's just
say have a a debate with this young girl
and I felt really bad for her because I
said well you want me to be you want me
to pay twice I said well this is
ridiculous is that I'm paying you with
my personal data and she didn't
understand the concept and I said well
am I the only person that's ever
discussed this with you I hope that
wasn't the word I use and she said yeah
she said we've got about 200,000
customers
and I asked her I said well what are you
going to do with this and she had no
idea and it reminds me of my chocolate
story you know we were at westfield and
Cadbury's of giving away free creamed
eggs and the queue for people handing
over their personal data for chocolate
was about 50 to 60 people deep and when
I asked them what they're going to do
with the data I walked around the back
there was a privacy policy it was like
tumbleweed in cobwebs so we're not
having this discussion we're not
explaining to people what they're going
to do with their data and I think in
part because people aren't asking the
question but that's what we need to
start to do is get people to start
asking the question and then we need
transparency on the information that
we've provided show of hands how many of
you have a smartphone how many of you
have apps on that smartphone every one
of us can you tell me just one app what
data it collects where it sends that
data who it shows that data with who
they sell that data with and how it
communicates just one app can you tell
me about all of the apps you have no and
I'm the same by the way you are this is
the privacy industry and yet you're
giving away your information to app
providers you're giving away your
information and they're selling it on
and you have no idea who they're selling
it on to doesn't that worry you we have
no transparency today and do you think
it's going to get any better we need to
start demanding transparency and not
only transparency about what you're
doing on my device but actually what
you're going to do with my information
if you get the opportunity and I'm sure
many of you have seen this have a read
up of the whatsapp investigation by the
Canadian Data Protection Authority and
they got on a Dutch Data Protection
Authority have a look at what they said
and actually have a look at what they
did and that's just one application done
years and years ago this to me is key
fair value this to me is how this
industry actually becomes a line item in
business because I genuinely believe
that there is real economic value in
personally identifiable data
and if you remember the World Economic
Forum cited this economy to be worth a
trillion euros by 2020 in Europe alone
here's the really cool part two-thirds
of that will be realized by the consumer
so we have the ability to be able to
allow consumers to be able to get
monetary gain from personally
identifiable data or their data I think
when they can see the value in that then
they will start to take protective
mechanisms in place trying to use fear
uncertainty and doubt to get people to
change their behavior doesn't work trust
and I like this piece they said don't be
creepy and the concept of don't be
creepy we're seeing this all of the time
you know every time you do a web
transaction every time you're out and
about you get targeted messages you get
people trying to sell you stuff and I
didn't ask for this I didn't ask for
someone trying to sell me in this an
when I was doing research that to me is
creepy and I remember I gave a
presentation and I was on a panel of
digital marketing companies right you
know what that means and I said you're
creepy as an industry the whole industry
so thus far has been relatively creepy
but i think you know we can begin to
change the dialogue i love this quote
everybody remembers Tim Cook from Apple
when he changed the privacy policy was
about last year and he said you are not
the product I thought that was fantastic
and I'm really hopeful that
organizations will begin to see that
personally identifiable data or privacy
actually can be a bottom line and
actually add value to the business but
if you're getting it for free and as I
tell my kids they said dad the app is
free and I keep reminding him of this
I'm one of those dads as well
I am I took when my dog was four years
old I started to teach you how to use
metasploit which was a hacking tool kit
and now actually teaching them how to
use tor but I think it's important they
need to understand what information is
being collected about them because that
is the world we're moving towards now
this actually is a diagram taken from
NIST I are 76 28 which is the volume 2
smart grid mandate on privacy on privacy
as we move forward every single device
that we have in our home is going to be
collecting information about us how many
of you have more than 10 IP connected
devices in your home today keep your
hand up if you have 20 30 all right you
might be me 40 no all right so I'm still
the most saddest guy in the room
actually funny story is whenever I do
that I ask people in the audience once
and somebody somebody said they had 75
devices and I think the thing that
surprised me was he was still married
and I use the word he by the way as well
but the you know these types of devices
are going to be collecting for vast
amounts of data in our home now this is
just one by the way this is taken from a
smart meter and this is what we called
and I don't like to use acronyms but
this is what we call nyame which is
non-intrusive activity load monitoring
now every smart meter will be collecting
transactional data about what you do in
your house you know the fact that you've
going to switch the washing machine on
use the toaster and made a cup of tea
six times in a day that's probably in an
English house by the way does that worry
anyone are you happy with this type of
data being collected about your home are
you happy with the fact that the utility
knows that you had the hot tub and hot
tub on at eleven o'clock at night they
are you happy with this anyone now this
is interesting because not only can I
tell the fact that you're running a
washing machine I can also tell what
model number that wash
machine now that's based on what we call
a polling interval so we will ask the
meter every 15 minutes if we decrease
that polling interval down to two
seconds what do you think we find out
then this might worry you by the way you
may not want to hear this what what's
the saying because viewers of a nervous
and dismissive in disposition may want
to look away now or is it match of the
day they go if you don't want to know
the scores just go on mute now actually
if we decrease the polling interval down
to two seconds we can also tell what TV
shows you're watching absolutely true by
the way and which country so there was a
country in Europe that had there was a
DSO who had sold smart meters and there
was a vulnerability found and all of
their customers had this particular
issue whereby the utility knew what TV
shows every single one of their
customers were watching which country do
you think that was from I hear Germany
right because at it absolutely was
Germany you know the fastian of privacy
is what I keep getting told but the
people didn't know people had no idea of
these implications but I want to kind of
turn this on its head I you know this is
worrying but this is reality right we
have to accept that IOT is going to be
providing more insights into our home
and if you get the opportunity have a
look at this project called hat the hub
of all things and this is a university
project which is looking to provide that
level of insight into every smart home
as we move forward but I believe what we
can begin to do is provide informed
consent transparency and value to
consumers now why can't I turn around to
the consumer and say well listen you're
running that washing machine at seven
o'clock at night that washing machine
isn't particularly efficient so what we
can do is we can provide you with a new
washing machine which is more efficient
but in doing so we can give you a
discount of thirty to forty percent and
by the way the return on investment to
you is three months we can save energy
you can get economic value and I believe
that a more ethical way to do things
this I think is a move towards this
concept of personally of the personal
data economy and you're already
beginning to see this right the
insurance industry putting black boxes
in your car that's an example of this
and that in a sense was what the
Department of Business through the my
data project tries to do it tries to
provide transparency over what
information organizations have about you
so I do think that there is a way
forward it is pragmatic it is quite
worrying it is quite scary but if we can
provide value to consumers give them
transparency and informed consent I can
say no I can say no actually I don't
want you to know this information I
don't want you to be able to sell this
data on it's all about value you know
people will always argue and say well I
don't use facebook or I do use Facebook
but to be fair they provide you with
value they give you a service and it's
your choice whether you want to use it
or not now that of course is the great
business world that that of course is
the way that the commercial industry is
moving forward there is an alternate and
flip side to this and I think vtec was
an example of that Ashley Madison was an
example of that and we actually
conducted research to say well okay we
organizations are collecting vast
amounts of data about all of us and it
seems like every single day there's and
other organization compromised so what I
wanted to do is just give you a
alternate view as well which is as we're
collecting all of this information about
you me our children and our family what
happens as a result of that well what
happens as a result of that is this
information is being targeted by who
knows nefarious individuals out there
and what they're beginning to do now is
they're beginning to sell this
information on so the need to be able to
have better degrees of protection that
the need to be able to actually
understand what's being sold as is key
now this is taken from a research paper
we did call the hidden data economy and
the intent of that was to show people
what happens after a data breach so this
one actually this one scared me the most
and it's not particularly insightful
because we all know personal data is
available for sale but we found this
young man he was 19 years old based in
the east of england and i remember
having this conversation so we sent it
to the police and we said look can you
let this particular individual know that
his personal data is being sold by
primitives so there's a knock at the
door and he answers the door and he says
you know we explained to him what we
found you know the fact that we've got
is you his demographics we've got every
single one of his digital accounts his
password his email accounts even his mum
and dad's details by the way this mum
and dad's facebook accounts email
accounts the whole nine yards and he
asked me a question he said well what
can I do and I said well change your
passwords first of all and don't be so
promiscuous when you're on the internet
you know don't dump all your data out
there and then of course the
conversation changed because we had
other examples where we had medical data
which was being sold and sold those
which have been stolen and sold online
and then they asked me that question
said well what do I do about my medical
data any ideas because I don't know the
answer and that's the reality of the
world that we live in is that you know
what I call digital information like a
digital tattoo and I'm sure many of you
have heard the concept you can't tell
but I love tattoos and completely
covered head to toe and I gave away too
much
damn it oh but it's like a tattoo you
know and I always tell people about this
concept that whereby you know you try
removing your information from the
internets like trying to remove a tattoo
you know it's expensive it painful it's
painful it leaves scars and that's
exactly the world that I was trying to
explain to this particular individual
and what we're beginning to witness and
what we're beginning to see is you know
I talked about personal data as being
the new oil of the digital world these
guys have known it for years and they've
been targeting large databases and large
systems to exfiltrate data to be able to
go out and sell that on and it doesn't
just end there you know personal data is
being stocks sold we've got identities
being sold and even to the point of if
you wanted to be really granular and
target people based upon specific
profession you can do that on the left
hand side you have a particular seller
who's known to us on Alpha Bay and he's
actually selling information about
physicians based in the United States
based on a hospital that he compromised
and that's the world that we live in and
to be honest it this marketplace is
getting broader and richer and even more
data is coming online all of the time
everybody remembers when target were
breached we saw the information based
upon the target breach was just 140
million credit card details online for
sale within two weeks it was
instantaneous almost and of course it
doesn't end there because this was taken
naturally from a hematology lab based in
France and there was a group of hackers
who were trying to blackmail this
laboratory to say unless you pay us a
certain amount of ransom we will dump
all of your patient data online and so
the blood results of every single one of
their patients was then dumped online
I'm come about done naturally
I do this not to spread fear uncertainty
and doubt and I did warn you that this
was pretty much a rant which it kind of
is but I think there are two key points
that we should recognize here so first
of all we have to recognize that we call
it a threat landscape with in cyber
security but the number of groups out
there going out and targeting
organizations across the world stealing
information and dumping that data and
selling it on is growing at an
exponential rate I wrote a paper called
33 years ago actually called cyber crime
exposed in which I said today
cybercriminals require no technical
knowledge to become cyber criminals and
that's absolutely true and if I get the
opportunity I can I can send you the
paper when I talk about this particular
research the talk is entitled my dad
could be a cybercriminal and the
funniest thing was when I spoke at
Oxford Oxford University my dad was
actually in the front row and he didn't
appreciate that too late it's out you
can't do anything about it what are you
going to do right so the first thing we
have to recognize is that there is
enormous economic value in the data that
we have the actual value of that data is
increasing exponentially pretty much
increasing exponentially although there
are some nuances here you know the the
market cost of some of these assets is
quite low but the demand is still high
what I mean by that is five years ago
credit cards were being sold at one
hundred and fifty dollars two hundred
and thirty two hundred fifty dollars
today they're about three dollars a
piece but the demand is there it's just
suppliers just completely come in you
know it's it's been incredible but the
actual value of personal data is
increasing exponentially the perceived
value of personal data in other words
how consumers value their data is less
than zero two years ago it was worth a
cream egg now if you want to go and
watch despicable me 2 you've got to pay
for the privilege of somebody capturing
your personal data actually decreasing
in value and that model can't work and I
think that's an issue
but I do think we as an industry have
the opportunity to be able to look at
things like I OT and allow people the
market opportunities to get fair value
the ability to be able to get real
transparency and informed consent and
that to me goes beyond the concept of
using compliance as a driver towards
privacy because that to me just creates
a baseline and you know what I want more
than a baseline I actually wouldn't mind
a trillion euros by 2020 personally by
the way I need more tattoos right so you
know my my asp of all of you today is
you know have a look at the research and
if you are interested in some of these
new concepts and these new business
models start having this discussion with
the business that you're in you know in
the past and you know I worked in
security information governance and
privacy I've always been the guy that's
been told about projects like a day
before it goes live I remember getting a
phone call at four thirty on a Friday
saying we're rolling out a program for
20 million consumers across the water
across the country can you please
approve it I was on Friday afternoon and
now by the way if you try to phone me I
never answer the phone after 4 30 just a
tip what I'd like to be able to do is
move to a world and HR was with one of
the largest car manufacturers this just
on monday is where we can look to
actually provide real value to the
business but do so by providing
solutions which I think are ethical and
go beyond compliance with that thank you
very much
yeah we've got some quite some time for
questions I think I'm not okay I'm not
answering questions about my tattoos by
the way hi my name's Kate may feel some
mistake um I'm just interested in your
views on what the consumers feel about
this because whenever I talk to friends
outside the privacy industry they don't
care normal people right normal people
don't care and I understand how a lab
would be blackmailed and that's bad for
that business and indeed for that I
suppose but I think in turn in inside
the privacy sector and we worry about it
more than our consumer market do I think
you're right and and to be honest I
think we have the same friends because
they you know whenever I talk to people
like what I do they're like well I don't
really care because the bank will just
you know if my credit card gets
compromised they'll just give me my
money back but I think there are some
things that are going to be changing so
first of all banks and no longer going
to be blanket providing you a refund and
I know if a number of cases in which
people have made the same mistake once
or twice and they go back to the bank
and the bank said well I'm not going to
i'm not going to pay for and so i think
this a this comes down to the concept of
accountability and I think
accountability is now beginning to be
placed upon consumers which is slowly
but surely changing changing the shift
but we've always tried to educate users
by saying do this because if you don't
the world is going to fall in and you
know the Four Horsemen of the Apocalypse
will come and you know the worst thing
is going to happen but I protect things
that I attribute that has a value so for
example i lock my car because my car has
value I don't necessarily care about my
data because I don't perceive that to
have value and I think if we can begin
to have this discussion about economic
value that our data has and actually
show examples whereby they can make
money through their personally
identifiable data then perhaps we'll
start to take it more seriously then
perhaps we'll begin to try to protect it
but right now how many people I mean if
you go and talk to your normal friends
and say what's the
any of your personal data probably
nothing right it's like what's the value
of intellectual property I don't know
this question too
hi stefan from City I want the question
on the idea of informed consent I mean
how do you see the panel bit with all
the devices the Internet of Things how
even if people care how will they be
able to manage that just in terms of
times and capacity yeah it's going to be
hard it's going to be really difficult
but we've got a couple of pilot projects
underway one particular in smart grids
and the intent of that is to try to
introduce informed consent by actually
talking by doing focus groups and
explain to people what we're doing but I
think its scale it's going to be very
very difficult but you know you can lead
a horse to water but you can't force it
to drink so I think you know what will
provide the tools will provide
communications mechanisms will explain
to people what we're trying to do there
will be normal people that will just say
well I don't care but at least we can
try to provide that information to make
it available for people it reminds me
actually my brother got an
internet-connected doorbell and and he
was sick leave is crowing about this he
said I've just got this
internet-connected doorbell and you know
what it will text my phone every time
somebody's at my house and I can see
pictures of who's at my house and I went
well are you aware that this is
collecting data about you I use are you
concerned about the security and privacy
issues anywhere I don't really care now
his doorbell rings at four o'clock every
morning and now he takes security
seriously but those are examples of you
know people being feature driven and not
really considering the implications so
what we can do is we can provide the
information you can be ethical but we
can't force people to value their
information there has to be up to them
oh it's equipped another Lilith okay so
we got time for no problems thanks very
much