The Shifting Privacy Left Podcast Thu, 12 Mar 2026 22:55:32 -0400 https://shiftingprivacyleft.com/ en-us © 2026 © 2002-2023 Principled LLC. All rights reserved. yes 131c75d1-ada6-5450-9a00-50e1f258f78e Debra J. Farber (Shifting Privacy Left) episodic false Shifting Privacy Left features lively discussions on the need for organizations to embed privacy by design into the UX/UI, architecture, engineering / DevOps and the overall product development processes BEFORE code or products are ever shipped. Each Tuesday, we publish a new episode that features interviews with privacy engineers, technologists, researchers, ethicists, innovators, market makers, and industry thought leaders. We dive deeply into this subject and unpack the exciting elements of emerging technologies and tech stacks that are driving privacy innovation; strategies and tactics that win trust; privacy pitfalls to avoid; privacy tech issues ripped from the headlines; and other juicy topics of interest. 

]]> Buzzsprout (https://www.buzzsprout.com) privacy, tech, security, engineering, innovation, ethics, developers, devops, design, data science, privacy engineer, architecture Debra J. Farber (Shifting Privacy Left) https://storage.buzzsprout.com/zelrr1k09viids5vbp9vww0bytjk?.jpg The Shifting Privacy Left Podcast https://shiftingprivacyleft.com/ Debra J Farber S3E15: 'New Certification: Enabling Privacy Engineering in AI Systems' with Amalia Barthel & Eric Lybeck S3E15: 'New Certification: Enabling Privacy Engineering in AI Systems' with Amalia Barthel & Eric Lybeck In this episode, I'm joined by Amalia Barthel, founder of Designing Privacy, a consultancy that  helps businesses integrate privacy into business operations; and Eric Lybeck, a seasoned independent privacy engineering consultant with over two decades of experience in cybersecurity and privacy. Eric recently served as Director of Privacy Engineering at Privacy Code. Today, we discuss: the importance of more training for privacy engineers on AI system enablement; why it's not enough for privacy professionals to solely focus on AI governance; and how their new hands-on course, "Privacy Engineering in AI Systems Certificate program," can fill this need.

Throughout our conversation, we explore the differences between AI system enablement and AI governance and why Amalia and Eric were inspired to develop this certification program. They share examples of what is covered in the course and outline the key takeaways and practical toolkits that enrollees will get - including case studies, frameworks, and weekly live sessions throughout.

Topics Covered: 

  • How AI system enablement differs from AI governance and why we should focus on AI as part of privacy engineering 
  • Why Eric and Amalia designed an AI systems certificate course that bridges the gaps between privacy engineers and privacy attorneys
  • The unique ideas and practices presented in this course and what attendees will take away 
  • Frameworks, cases, and mental models that Eric and Amalia will cover in their course
  • How Eric & Amalia structured the Privacy Engineering in AI Systems Certificate program's coursework 
  • The importance of upskilling for privacy engineers and attorneys


Resources Mentioned:


Guest Info: 


Send a text



TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> In this episode, I'm joined by Amalia Barthel, founder of Designing Privacy, a consultancy that  helps businesses integrate privacy into business operations; and Eric Lybeck, a seasoned independent privacy engineering consultant with over two decades of experience in cybersecurity and privacy. Eric recently served as Director of Privacy Engineering at Privacy Code. Today, we discuss: the importance of more training for privacy engineers on AI system enablement; why it's not enough for privacy professionals to solely focus on AI governance; and how their new hands-on course, "Privacy Engineering in AI Systems Certificate program," can fill this need.

Throughout our conversation, we explore the differences between AI system enablement and AI governance and why Amalia and Eric were inspired to develop this certification program. They share examples of what is covered in the course and outline the key takeaways and practical toolkits that enrollees will get - including case studies, frameworks, and weekly live sessions throughout.

Topics Covered: 

  • How AI system enablement differs from AI governance and why we should focus on AI as part of privacy engineering 
  • Why Eric and Amalia designed an AI systems certificate course that bridges the gaps between privacy engineers and privacy attorneys
  • The unique ideas and practices presented in this course and what attendees will take away 
  • Frameworks, cases, and mental models that Eric and Amalia will cover in their course
  • How Eric & Amalia structured the Privacy Engineering in AI Systems Certificate program's coursework 
  • The importance of upskilling for privacy engineers and attorneys


Resources Mentioned:


Guest Info: 


Send a text



TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Amalia Barthel & Eric Lybeck Buzzsprout-15455483 Tue, 23 Jul 2024 06:00:00 -0700 2338 AI systems 3 15 full false S3E14: 'Why We Need Fairness Enhancing Technologies Rather Than PETs' with Gianclaudio Malgieri (Brussels Privacy Hub) S3E14: 'Why We Need Fairness Enhancing Technologies Rather Than PETs' with Gianclaudio Malgieri (Brussels Privacy Hub) Today, I chat with Gianclaudio Malgieri, an expert in privacy, data protection, AI regulation, EU law, and human rights. Gianclaudio is an Associate Professor of Law at Leiden University, the Co-director of the Brussels Privacy Hub, Associate Editor of the Computer Law & Security Review, and co-author of the paper "The Unfair Side of Privacy Enhancing Technologies: Addressing the Trade-offs Between PETs and Fairness". In our conversation, we explore this paper and why privacy-enhancing technologies (PETs) are essential but not enough on their own to address digital policy challenges.

Gianclaudio explains why PETs alone are insufficient solutions for data protection and discusses the obstacles to achieving fairness in data processing – including bias, discrimination, social injustice, and market power imbalances. We discuss data alteration techniques such as anonymization, pseudonymization, synthetic data, and differential privacy in relation to GDPR compliance. Plus, Gianclaudio highlights the issues of representation for minorities in differential privacy and stresses the importance of involving these groups in identifying bias and assessing AI technologies. We also touch on the need for ongoing research on PETs to address these challenges and share our perspectives on the future of this research.

Topics Covered: 

  • What inspired Gianclaudio to research fairness and PETs
  • How PETs are about power and control
  • The legal / GDPR and computer science perspectives on 'fairness'
  • How fairness relates to discrimination, social injustices, and market power imbalances 
  • How data obfuscation techniques relate to AI / ML 
  • How well the use of anonymization, pseudonymization, and synthetic data techniques address data protection challenges under the GDPR
  • How the use of differential privacy techniques may led to unfairness 
  • Whether the use of encrypted data processing tools and federated and distributed analytics achieve fairness 
  • 3 main PET shortcomings and how to overcome them: 1) bias discovery; 2) harms to people belonging to protected groups and individuals autonomy; and 3) market imbalances.
  • Areas that warrant more research and investigation 


Resources Mentioned:


Guest Info: 

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Today, I chat with Gianclaudio Malgieri, an expert in privacy, data protection, AI regulation, EU law, and human rights. Gianclaudio is an Associate Professor of Law at Leiden University, the Co-director of the Brussels Privacy Hub, Associate Editor of the Computer Law & Security Review, and co-author of the paper "The Unfair Side of Privacy Enhancing Technologies: Addressing the Trade-offs Between PETs and Fairness". In our conversation, we explore this paper and why privacy-enhancing technologies (PETs) are essential but not enough on their own to address digital policy challenges.

Gianclaudio explains why PETs alone are insufficient solutions for data protection and discusses the obstacles to achieving fairness in data processing – including bias, discrimination, social injustice, and market power imbalances. We discuss data alteration techniques such as anonymization, pseudonymization, synthetic data, and differential privacy in relation to GDPR compliance. Plus, Gianclaudio highlights the issues of representation for minorities in differential privacy and stresses the importance of involving these groups in identifying bias and assessing AI technologies. We also touch on the need for ongoing research on PETs to address these challenges and share our perspectives on the future of this research.

Topics Covered: 

  • What inspired Gianclaudio to research fairness and PETs
  • How PETs are about power and control
  • The legal / GDPR and computer science perspectives on 'fairness'
  • How fairness relates to discrimination, social injustices, and market power imbalances 
  • How data obfuscation techniques relate to AI / ML 
  • How well the use of anonymization, pseudonymization, and synthetic data techniques address data protection challenges under the GDPR
  • How the use of differential privacy techniques may led to unfairness 
  • Whether the use of encrypted data processing tools and federated and distributed analytics achieve fairness 
  • 3 main PET shortcomings and how to overcome them: 1) bias discovery; 2) harms to people belonging to protected groups and individuals autonomy; and 3) market imbalances.
  • Areas that warrant more research and investigation 


Resources Mentioned:


Guest Info: 

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Gianclaudio Malgieri Buzzsprout-15291009 Tue, 25 Jun 2024 11:00:00 -0700 2858 PETs, Fairness Enhancing Technologies, fairness, GDPR, privacy enhancing technologies, federated analytics, distributed analytics, anonymization, pseudonymization, synthetic data, differential privacy 3 14 full false S3E13: 'Building Safe AR / VR/ MR / XR Technology" with Spatial Computing Pioneer Avi Bar Zeev (XR Guild) S3E13: 'Building Safe AR / VR/ MR / XR Technology" with Spatial Computing Pioneer Avi Bar Zeev (XR Guild) In this episode, I had the pleasure of talking with Avi Bar-Zeev, a true tech pioneer and the Founder and President of The XR Guild. With over three decades of experience, Avi has an impressive resume, including launching Disney's Aladdin VR ride, developing Second Life's 3D worlds, co-founding Keyhole (which became Google Earth), co-inventing Microsoft's HoloLens, and contributing to the Amazon Echo Frames. The XR Guild is a nonprofit organization that promotes ethics in extended reality (XR) through mentorship, networking, and educational resources. 

Throughout our conversation, we dive into privacy concerns in augmented reality (AR), virtual reality (VR), and the metaverse, highlighting increased data misuse and manipulation risks as technology progresses. Avi shares his insights on how product and development teams can continue to be innovative while still upholding responsible, ethical standards with clear principles and guidelines to protect users' personal data. Plus, he explains the role of eye-tracking technology and why he advocates classifying its data as health data. We also discuss the challenges of anonymizing biometric data, informed consent, and the need for ethics training in all of the tech industry. 

Topics Covered: 

  • The top privacy and misinformation issues that Avi has noticed when it comes to AR, VR, and metaverse data
  • Why Avi advocates for classifying eye tracking data as health data 
  • The dangers of unchecked AI manipulation and why we need to be more aware and in control of our online presence 
  • The ethical considerations for experimentation in highly regulated industries
  • Whether it is possible to anonymize VR and AR data
  • Ways these product and development teams can be innovative while maintaining ethics and avoiding harm 
  • AR risks vs VR risks
  • Advice and privacy principles to keep in mind for technologists who are building AR and VR systems 
  • Understanding The XR Guild 

Resources Mentioned:

Guest Info: 

Send a text



Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> In this episode, I had the pleasure of talking with Avi Bar-Zeev, a true tech pioneer and the Founder and President of The XR Guild. With over three decades of experience, Avi has an impressive resume, including launching Disney's Aladdin VR ride, developing Second Life's 3D worlds, co-founding Keyhole (which became Google Earth), co-inventing Microsoft's HoloLens, and contributing to the Amazon Echo Frames. The XR Guild is a nonprofit organization that promotes ethics in extended reality (XR) through mentorship, networking, and educational resources. 

Throughout our conversation, we dive into privacy concerns in augmented reality (AR), virtual reality (VR), and the metaverse, highlighting increased data misuse and manipulation risks as technology progresses. Avi shares his insights on how product and development teams can continue to be innovative while still upholding responsible, ethical standards with clear principles and guidelines to protect users' personal data. Plus, he explains the role of eye-tracking technology and why he advocates classifying its data as health data. We also discuss the challenges of anonymizing biometric data, informed consent, and the need for ethics training in all of the tech industry. 

Topics Covered: 

  • The top privacy and misinformation issues that Avi has noticed when it comes to AR, VR, and metaverse data
  • Why Avi advocates for classifying eye tracking data as health data 
  • The dangers of unchecked AI manipulation and why we need to be more aware and in control of our online presence 
  • The ethical considerations for experimentation in highly regulated industries
  • Whether it is possible to anonymize VR and AR data
  • Ways these product and development teams can be innovative while maintaining ethics and avoiding harm 
  • AR risks vs VR risks
  • Advice and privacy principles to keep in mind for technologists who are building AR and VR systems 
  • Understanding The XR Guild 

Resources Mentioned:

Guest Info: 

Send a text



Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Avi Bar-Zeev Buzzsprout-15272946 Tue, 18 Jun 2024 06:00:00 -0700 3095 XR, MR, AR, VR, spacial computing, XR Guild, Generative AI, transparency, fairness, ethics, eye-tracking, 3 13 full false S3E12: 'How Intentional Experimentation in A/B Testing Supports Privacy' with Matt Gershoff (Conductrics) S3E12: 'How Intentional Experimentation in A/B Testing Supports Privacy' with Matt Gershoff (Conductrics) Today, I'm joined by Matt Gershoff, Co-founder and CEO of Conductrics, a software company specializing in A/B testing, multi-armed bandit techniques, and customer research and survey software. With a strong background in resource economics and artificial intelligence, Matt brings a unique perspective to the conversation, emphasizing simplicity and intentionality in decision-making and data collection.

In this episode, Matt dives into Conductrics' background, the role of A/B testing and experimentation in privacy, data collection at a specific and granular level, and the details of Conductrics' processes. He emphasizes the importance of intentionally collecting data with a clear purpose to avoid unnecessary data accumulation and touches on the value of experimentation in conjunction with data minimization strategies. Matt also discusses his upcoming talk at the PEPR Conference and shares his hopes for what privacy engineers will learn from the event.

Topics Covered: 

  • Matt’s background and how he started A/B testing and experimentation at Conductrics
  • The major challenges that arise when companies run experiments and how Conductrics works to solve them 
  • Breaking down A/B testing
  • How being intentional about A/B testing and experimentation supports high level privacy
  • The process of the data collection, testing, and experimentation 
  • Collecting the data while minimizing privacy risks 
  • The value of attending the USENIX Conference on Privacy Engineering Practice & Respect (PEPR24) and what to expect from Matt’s talk 


Guest Info: 

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Today, I'm joined by Matt Gershoff, Co-founder and CEO of Conductrics, a software company specializing in A/B testing, multi-armed bandit techniques, and customer research and survey software. With a strong background in resource economics and artificial intelligence, Matt brings a unique perspective to the conversation, emphasizing simplicity and intentionality in decision-making and data collection.

In this episode, Matt dives into Conductrics' background, the role of A/B testing and experimentation in privacy, data collection at a specific and granular level, and the details of Conductrics' processes. He emphasizes the importance of intentionally collecting data with a clear purpose to avoid unnecessary data accumulation and touches on the value of experimentation in conjunction with data minimization strategies. Matt also discusses his upcoming talk at the PEPR Conference and shares his hopes for what privacy engineers will learn from the event.

Topics Covered: 

  • Matt’s background and how he started A/B testing and experimentation at Conductrics
  • The major challenges that arise when companies run experiments and how Conductrics works to solve them 
  • Breaking down A/B testing
  • How being intentional about A/B testing and experimentation supports high level privacy
  • The process of the data collection, testing, and experimentation 
  • Collecting the data while minimizing privacy risks 
  • The value of attending the USENIX Conference on Privacy Engineering Practice & Respect (PEPR24) and what to expect from Matt’s talk 


Guest Info: 

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Matt Gershoff Buzzsprout-15199785 Tue, 04 Jun 2024 09:00:00 -0700 2722 Conductrics, A/B Testing, Experimentation, PEPR, data minimization 3 12 full false S3E11: 'Decision-Making Governance & Design: Combating Dark Patterns with Fair Patterns' with Marie Potel-Saville (Amurabi & FairPatterns) S3E11: 'Decision-Making Governance & Design: Combating Dark Patterns with Fair Patterns' with Marie Potel-Saville (Amurabi & FairPatterns) In this episode, Marie Potel-Saville joins me to shed light on the widespread issue of dark patterns in design. With her background in law, Marie founded the 'FairPatterns' project with her award-winning privacy and innovation studio, Amurabi, to detect and fix large-scale dark patterns. Throughout our conversation, we discuss the different types of dark patterns, why it is crucial for businesses to prevent them from being coded into their websites and apps, and how designers can ensure that they are designing fair patterns in their projects.


Dark patterns are interfaces that deceive or manipulate users into unintended actions by exploiting cognitive biases inherent in decision-making processes. Marie explains how dark patterns are harmful to our economic and democratic models, their negative impact on individual agency, and the ways that FairPatterns provides countermeasures and safeguards against the exploitation of people's cognitive biases. She also shares tips for designers and developers for designing and architecting fair patterns.

Topics Covered: 

  • Why Marie shifted her career path from practicing law to deploying and lecturing on Legal UX design & combatting Dark Patterns at Amurabi
  • The definition of ‘Dark Patterns’ and the difference between them and ‘deceptive patterns’
  • What motivated Marie to found FairPatterns.com and her science-based methodology to combat dark patterns
  • The importance of decision making governance 
  • Why execs should care about preventing dark patterns from being coded into their websites, apps, & interfaces
  • How dark patterns exploit our cognitive biases to our detriment
  • What global laws say about dark patterns
  • How dark patterns create structural risks for our economies & democratic models
  • How "Fair Patterns" serve as countermeasures to Dark Patterns
  • The 7 categories of Dark Patterns in UX design & associated countermeasures 
  • Advice for designers & developers to ensure that they design & architect Fair Patterns when building products & features
  • How companies can boost sales & gain trust with Fair Patterns 
  • Resources to learn more about Dark Patterns & countermeasures

Guest Info: 

Resources Mentioned:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> In this episode, Marie Potel-Saville joins me to shed light on the widespread issue of dark patterns in design. With her background in law, Marie founded the 'FairPatterns' project with her award-winning privacy and innovation studio, Amurabi, to detect and fix large-scale dark patterns. Throughout our conversation, we discuss the different types of dark patterns, why it is crucial for businesses to prevent them from being coded into their websites and apps, and how designers can ensure that they are designing fair patterns in their projects.


Dark patterns are interfaces that deceive or manipulate users into unintended actions by exploiting cognitive biases inherent in decision-making processes. Marie explains how dark patterns are harmful to our economic and democratic models, their negative impact on individual agency, and the ways that FairPatterns provides countermeasures and safeguards against the exploitation of people's cognitive biases. She also shares tips for designers and developers for designing and architecting fair patterns.

Topics Covered: 

  • Why Marie shifted her career path from practicing law to deploying and lecturing on Legal UX design & combatting Dark Patterns at Amurabi
  • The definition of ‘Dark Patterns’ and the difference between them and ‘deceptive patterns’
  • What motivated Marie to found FairPatterns.com and her science-based methodology to combat dark patterns
  • The importance of decision making governance 
  • Why execs should care about preventing dark patterns from being coded into their websites, apps, & interfaces
  • How dark patterns exploit our cognitive biases to our detriment
  • What global laws say about dark patterns
  • How dark patterns create structural risks for our economies & democratic models
  • How "Fair Patterns" serve as countermeasures to Dark Patterns
  • The 7 categories of Dark Patterns in UX design & associated countermeasures 
  • Advice for designers & developers to ensure that they design & architect Fair Patterns when building products & features
  • How companies can boost sales & gain trust with Fair Patterns 
  • Resources to learn more about Dark Patterns & countermeasures

Guest Info: 

Resources Mentioned:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber (Shifting Privacy Left) Buzzsprout-14961753 Tue, 30 Apr 2024 06:00:00 -0700 3252 fair design, dark patterns 3 11 full false S3E10: 'How a Privacy Engineering Center of Excellence Shifts Privacy Left' with Aaron Weller (HP) S3E10: 'How a Privacy Engineering Center of Excellence Shifts Privacy Left' with Aaron Weller (HP) In this episode, I sat down with Aaron Weller, the Leader of HP's Privacy Engineering Center of Excellence (CoE), focused on providing technical solutions for privacy engineering across HP's global operations. Throughout our conversation, we discuss: what motivated HP's leadership to stand up a CoE for Privacy Engineering; Aaron's approach to staffing the CoE; how a CoE's can shift privacy left in a large, matrixed organization like HP's; and, how to leverage the CoE to proactively manage privacy risk.

Aaron emphasizes the importance of understanding an organization's strategy when creating a CoE and shares his methods for gathering data to inform the center's roadmap and team building. He also highlights the great impact that a Center of Excellence can offer and gives advice for implementing one in your organization. We touch on the main challenges in privacy engineering today and the value of designing user-friendly privacy experiences. In addition, Aaron provides his perspective on selecting the right combination of Privacy Enhancing Technologies (PETs) for anonymity, how to go about implementing PETs, and the role that AI governance plays in his work. 

Topics Covered: 

  • Aaron’s deep privacy and consulting background and how he ended up leading HP's Privacy Engineering Center of Excellence 
  • The definition of a "Center of Excellence" (CoE) and how a Privacy Engineering CoE can drive value for an organization and shift privacy left
  • What motivates a company like HP to launch a CoE for Privacy Engineering and what it's reporting line should be
  • Aaron's approach to creating a Privacy Engineering CoE roadmap; his strategy for staffing this CoE; and the skills & abilities that he sought
  • How HP's Privacy Engineering CoE works with the business to advise on, and select, the right PETs for each business use case
  • Why it's essential to know the privacy guarantees that your organization wants to assert before selecting the right PETs to get you there
  • Lessons Learned from setting up a Privacy Engineering CoE and how to get executive sponsorship
  • The amount of time that Privacy teams have had to work on AI issues over the past year, and advice on preventing burnout
  • Aaron's hypothesis about the value of getting an early handle on governance over the adoption of innovative technologies
  • The importance of being open to continuous learning in the field of privacy engineering 

Guest Info: 

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> In this episode, I sat down with Aaron Weller, the Leader of HP's Privacy Engineering Center of Excellence (CoE), focused on providing technical solutions for privacy engineering across HP's global operations. Throughout our conversation, we discuss: what motivated HP's leadership to stand up a CoE for Privacy Engineering; Aaron's approach to staffing the CoE; how a CoE's can shift privacy left in a large, matrixed organization like HP's; and, how to leverage the CoE to proactively manage privacy risk.

Aaron emphasizes the importance of understanding an organization's strategy when creating a CoE and shares his methods for gathering data to inform the center's roadmap and team building. He also highlights the great impact that a Center of Excellence can offer and gives advice for implementing one in your organization. We touch on the main challenges in privacy engineering today and the value of designing user-friendly privacy experiences. In addition, Aaron provides his perspective on selecting the right combination of Privacy Enhancing Technologies (PETs) for anonymity, how to go about implementing PETs, and the role that AI governance plays in his work. 

Topics Covered: 

  • Aaron’s deep privacy and consulting background and how he ended up leading HP's Privacy Engineering Center of Excellence 
  • The definition of a "Center of Excellence" (CoE) and how a Privacy Engineering CoE can drive value for an organization and shift privacy left
  • What motivates a company like HP to launch a CoE for Privacy Engineering and what it's reporting line should be
  • Aaron's approach to creating a Privacy Engineering CoE roadmap; his strategy for staffing this CoE; and the skills & abilities that he sought
  • How HP's Privacy Engineering CoE works with the business to advise on, and select, the right PETs for each business use case
  • Why it's essential to know the privacy guarantees that your organization wants to assert before selecting the right PETs to get you there
  • Lessons Learned from setting up a Privacy Engineering CoE and how to get executive sponsorship
  • The amount of time that Privacy teams have had to work on AI issues over the past year, and advice on preventing burnout
  • Aaron's hypothesis about the value of getting an early handle on governance over the adoption of innovative technologies
  • The importance of being open to continuous learning in the field of privacy engineering 

Guest Info: 

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Aaron Weller Buzzsprout-14809102 Tue, 09 Apr 2024 06:00:00 -0700 2413 Privacy Engineering Center of Excellence, Privacy Engineering, CoE, HP, hiring, PETs, Privacy Enhancing Technologies, OWASP 3 10 full false S3E9: 'Building a Culture of Privacy & Achieving Compliance without Sacrificing Innovation' with Amaka Ibeji (Cruise) S3E9: 'Building a Culture of Privacy & Achieving Compliance without Sacrificing Innovation' with Amaka Ibeji (Cruise) Today, I’m joined by Amaka Ibeji, Privacy Engineer at Cruise where she designs and implements robust privacy programs and controls. In this episode, we discuss Amaka's passion for creating a culture of privacy and compliance within organizations and engineering teams. Amaka also hosts the PALS Parlor Podcast, where she speaks to business leaders and peers about privacy, AI governance, leadership, and security and explains technical concepts in a digestible way. The podcast aims to enable business leaders to do more with their data and provides a way for the community to share knowledge with one other.

In our conversation, we touch on her career trajectory from security engineer to privacy engineer and the intersection of cybersecurity, privacy engineering, and AI governance. We highlight the importance of early engagement with various technical teams to enable innovation while still achieving privacy compliance. Amaka also shares the privacy-enhancing technologies (PETs) that she is most excited about, and she recommends resources for those who want to learn more about strategic privacy engineering. Amaka emphasizes that privacy is a systemic, 'wicked problem' and offers her tips for understanding and approaching it.

Topics Covered:

  • How Amaka's compliance-focused experience at Microsoft helped prepare her for her Privacy Engineering role at Cruise
  • Where privacy overlaps with the development of AI 
  • Advice for shifting privacy left to make privacy stretch beyond a compliance exercise
  • What works well and what doesn't when building a 'Culture of Privacy'
  • Privacy by Design approaches that make privacy & innovation a win-win rather than zero-sum game
  • Privacy Engineering trends that Amaka sees; and, the PETs about which she's most excited
  • Amaka's Privacy Engineering resource recommendations, including: 
    • Hoepman's "Privacy Design Strategies" book;
    • The LINDDUN Privacy Threat Modeling Framework; and
    • The PLOT4AI Framework
  • "The PALS Parlor Podcast," focused on Privacy Engineering, AI Governance, Leadership, & Security
    • Why Amaka launched the podcast;
    • Her intended audience; and
    • Topics that she plans to cover this year
  • The importance of collaboration; building a community of passionate privacy engineers, and addressing the systemic issue of privacy 

Guest Info & Resources:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Today, I’m joined by Amaka Ibeji, Privacy Engineer at Cruise where she designs and implements robust privacy programs and controls. In this episode, we discuss Amaka's passion for creating a culture of privacy and compliance within organizations and engineering teams. Amaka also hosts the PALS Parlor Podcast, where she speaks to business leaders and peers about privacy, AI governance, leadership, and security and explains technical concepts in a digestible way. The podcast aims to enable business leaders to do more with their data and provides a way for the community to share knowledge with one other.

In our conversation, we touch on her career trajectory from security engineer to privacy engineer and the intersection of cybersecurity, privacy engineering, and AI governance. We highlight the importance of early engagement with various technical teams to enable innovation while still achieving privacy compliance. Amaka also shares the privacy-enhancing technologies (PETs) that she is most excited about, and she recommends resources for those who want to learn more about strategic privacy engineering. Amaka emphasizes that privacy is a systemic, 'wicked problem' and offers her tips for understanding and approaching it.

Topics Covered:

  • How Amaka's compliance-focused experience at Microsoft helped prepare her for her Privacy Engineering role at Cruise
  • Where privacy overlaps with the development of AI 
  • Advice for shifting privacy left to make privacy stretch beyond a compliance exercise
  • What works well and what doesn't when building a 'Culture of Privacy'
  • Privacy by Design approaches that make privacy & innovation a win-win rather than zero-sum game
  • Privacy Engineering trends that Amaka sees; and, the PETs about which she's most excited
  • Amaka's Privacy Engineering resource recommendations, including: 
    • Hoepman's "Privacy Design Strategies" book;
    • The LINDDUN Privacy Threat Modeling Framework; and
    • The PLOT4AI Framework
  • "The PALS Parlor Podcast," focused on Privacy Engineering, AI Governance, Leadership, & Security
    • Why Amaka launched the podcast;
    • Her intended audience; and
    • Topics that she plans to cover this year
  • The importance of collaboration; building a community of passionate privacy engineers, and addressing the systemic issue of privacy 

Guest Info & Resources:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Amaka Ibeji Buzzsprout-14772627 Tue, 02 Apr 2024 06:00:00 -0700 2604 privacy by design, innovation, PALS Parlor Podcast, Amaka Ibeji, LINDDUN, PLOT4AI, Hoepman Privacy Design Strategies, Strategic Privacy by Design, Jaap-Henk Hoepman, Jason Cronk, Kim Wuyts, Isabel Barbera, PETs, Cruise, Microsoft, culture of privacy 3 9 full false S3E8: 'Recent FTC Enforcement: What Privacy Engineers Need to Know' with Heidi Saas (H.T. Saas) S3E8: 'Recent FTC Enforcement: What Privacy Engineers Need to Know' with Heidi Saas (H.T. Saas) In this week's episode, I am joined by Heidi Saas, a privacy lawyer with a reputation for advocating for products and services built with privacy by design and against the abuse of personal data. In our conversation, she dives into recent FTC enforcement actions, analyzing five FTC actions and some enforcement sweeps by Colorado & Connecticut.

Heidi shares her insights on the effect of the FTC enforcement actions and what privacy engineers need to know, emphasizing the need for data management practices to be transparent, accountable, and based on affirmative consent. We cover the role of privacy engineers in ensuring compliance with data privacy laws; why 'browsing data' is 'sensitive data;' the challenges companies face regarding data deletion; and the need for clear consent mechanisms, especially with the collection and use of location data. We also discuss the need to audit the privacy posture of products and services - which includes a requirement to document who made certain decisions - and how to prioritize risk analysis to proactively address risks to privacy.

Topics Covered: 

  • Heidi’s journey into privacy law and advocacy for privacy by design and default
  • How the FTC brings enforcement actions, the effect of their settlements, and why privacy engineers should pay closer attention
  • Case 1: FTC v. InMarket Media - Heidi explains the implication of the decision: where data that are linked to a mobile advertising identifier (MAID) or an individual's home are not considered de-identified
  • Case 2: FTC v. X-Mode Social / OutLogic - Heidi explains the implication of the decision, focused on: affirmative express consent for location data collection; definition of a 'data product assessment' and audit programs; and data retention & deletion requirements
  • Case 3: FTC v. Avast - Heidi explains the implication of the decision: 'browsing data' is considered 'sensitive data'
  • Case 4: The People (CA) v. DoorDash - Heidi explains the implications of the decision, based on CalOPPA: where companies that share personal data with one another as part of a 'marketing cooperative' are, in fact, selling of data
  • Heidi discusses recent State Enforcement Sweeps for privacy, specifically in Colorado and Connecticut and clarity around breach reporting timelines
  • The need to prioritize independent third-party audits for privacy
  • Case 5: FTC v. Kroger - Heidi explains why the FTC's blocking of Kroger's merger with Albertson's was based on antitrust and privacy harms given the sheer amount of personal data that they process
  • Tools and resources for keeping up with FTC cases and connecting with your privacy community 

Guest Info: 

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> In this week's episode, I am joined by Heidi Saas, a privacy lawyer with a reputation for advocating for products and services built with privacy by design and against the abuse of personal data. In our conversation, she dives into recent FTC enforcement actions, analyzing five FTC actions and some enforcement sweeps by Colorado & Connecticut.

Heidi shares her insights on the effect of the FTC enforcement actions and what privacy engineers need to know, emphasizing the need for data management practices to be transparent, accountable, and based on affirmative consent. We cover the role of privacy engineers in ensuring compliance with data privacy laws; why 'browsing data' is 'sensitive data;' the challenges companies face regarding data deletion; and the need for clear consent mechanisms, especially with the collection and use of location data. We also discuss the need to audit the privacy posture of products and services - which includes a requirement to document who made certain decisions - and how to prioritize risk analysis to proactively address risks to privacy.

Topics Covered: 

  • Heidi’s journey into privacy law and advocacy for privacy by design and default
  • How the FTC brings enforcement actions, the effect of their settlements, and why privacy engineers should pay closer attention
  • Case 1: FTC v. InMarket Media - Heidi explains the implication of the decision: where data that are linked to a mobile advertising identifier (MAID) or an individual's home are not considered de-identified
  • Case 2: FTC v. X-Mode Social / OutLogic - Heidi explains the implication of the decision, focused on: affirmative express consent for location data collection; definition of a 'data product assessment' and audit programs; and data retention & deletion requirements
  • Case 3: FTC v. Avast - Heidi explains the implication of the decision: 'browsing data' is considered 'sensitive data'
  • Case 4: The People (CA) v. DoorDash - Heidi explains the implications of the decision, based on CalOPPA: where companies that share personal data with one another as part of a 'marketing cooperative' are, in fact, selling of data
  • Heidi discusses recent State Enforcement Sweeps for privacy, specifically in Colorado and Connecticut and clarity around breach reporting timelines
  • The need to prioritize independent third-party audits for privacy
  • Case 5: FTC v. Kroger - Heidi explains why the FTC's blocking of Kroger's merger with Albertson's was based on antitrust and privacy harms given the sheer amount of personal data that they process
  • Tools and resources for keeping up with FTC cases and connecting with your privacy community 

Guest Info: 

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Heidi Saas Buzzsprout-14768200 Tue, 26 Mar 2024 06:00:00 -0700 4533 FTC enforcement, Avast, Doordash, OutLogic, InMarket Media, de-identification, affirmative express consent, independent third-party audits, location data, browsing data, antitrust, privacy policies, privacy by design 3 8 full false S3E7: 'Personal CRM: Embracing Digital Minimalism & Privacy Empowerment' with Chris Zeunstrom (Yorba) S3E7: 'Personal CRM: Embracing Digital Minimalism & Privacy Empowerment' with Chris Zeunstrom (Yorba) This week's episode, I chat with Chris Zeunstrom, the Founder and CEO of Ruca and Yorba. Ruca is a global design cooperative and founder support network, while Yorba is a reverse CRM that aims to reduce your digital footprint and keep your personal information safe. Through his businesses, Chris focuses on solving common problems and creating innovative products. In our conversation, we talk about building a privacy-first company, the digital minimalist movement, and the future of decentralized identity and storage.

Chris shares his journey as a privacy-focused entrepreneur and his mission to prioritize privacy and decentralization in managing personal data. He also explains the digital minimalist movement and why its teachings reach beyond the industry. Chris touches on Yorba's collaboration with Consumer Reports to implement Permission Slip and creating a Data Rights Protocol ecosystem that automates data deletion for consumers. Chris also emphasizes the benefits of decentralized identity and storage solutions in improving personal privacy and security. Finally, he gives you a sneak peek at what's next in store for Yorba.


Topics Covered: 

  • How Yorba was designed as a privacy-1st consumer CRM platform; the problems that Yorba solves; and key product functionality & privacy features
  • Why Chris decided to bring a consumer product to market for privacy rather than a B2B product
  • Why Chris incorporated Yorba as a 'Public Benefit Corporation' (PBC) and sought B Corp status
  • Exploring 'Digital Minimalism' 
  • How Yorba's is working with Consumer Reports to advance the CR Data Rights Protocol, leveraging 'Permission Slip' - an authorized agent for consumers to submit data deletion requests
  • The architectural design decisions behind Yorba’s personal CRM system 
  • The benefits to using Matomo Analytics or Fathom Analytics for greater privacy vs. using Google Analytics 
  • The privacy benefits to deploying 'Decentralized Identity' & 'Decentralized Storage' architectures
  • Chris' vision for the next stage of the Internet; and, the future of Yorba

Guest Info: 

Resources Mentioned: 

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week's episode, I chat with Chris Zeunstrom, the Founder and CEO of Ruca and Yorba. Ruca is a global design cooperative and founder support network, while Yorba is a reverse CRM that aims to reduce your digital footprint and keep your personal information safe. Through his businesses, Chris focuses on solving common problems and creating innovative products. In our conversation, we talk about building a privacy-first company, the digital minimalist movement, and the future of decentralized identity and storage.

Chris shares his journey as a privacy-focused entrepreneur and his mission to prioritize privacy and decentralization in managing personal data. He also explains the digital minimalist movement and why its teachings reach beyond the industry. Chris touches on Yorba's collaboration with Consumer Reports to implement Permission Slip and creating a Data Rights Protocol ecosystem that automates data deletion for consumers. Chris also emphasizes the benefits of decentralized identity and storage solutions in improving personal privacy and security. Finally, he gives you a sneak peek at what's next in store for Yorba.


Topics Covered: 

  • How Yorba was designed as a privacy-1st consumer CRM platform; the problems that Yorba solves; and key product functionality & privacy features
  • Why Chris decided to bring a consumer product to market for privacy rather than a B2B product
  • Why Chris incorporated Yorba as a 'Public Benefit Corporation' (PBC) and sought B Corp status
  • Exploring 'Digital Minimalism' 
  • How Yorba's is working with Consumer Reports to advance the CR Data Rights Protocol, leveraging 'Permission Slip' - an authorized agent for consumers to submit data deletion requests
  • The architectural design decisions behind Yorba’s personal CRM system 
  • The benefits to using Matomo Analytics or Fathom Analytics for greater privacy vs. using Google Analytics 
  • The privacy benefits to deploying 'Decentralized Identity' & 'Decentralized Storage' architectures
  • Chris' vision for the next stage of the Internet; and, the future of Yorba

Guest Info: 

Resources Mentioned: 

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Chris Zeunstrom Buzzsprout-14687390 Tue, 19 Mar 2024 06:00:00 -0700 2591 digital minimalism, personal CRM, data minimization, minimalist design, decentralized identity, decentralized storage,consumer privacy, Yorba, Consumer Reports, Permission Slip, Fathom, Matomo, B Corp, Public Benefit Corporation 3 7 full false S3E6: 'Keys to Good Privacy Implementation: Exploring Anonymization, Consent, & DSARs' with Jake Ottenwaelder (Integrative Privacy) S3E6: 'Keys to Good Privacy Implementation: Exploring Anonymization, Consent, & DSARs' with Jake Ottenwaelder (Integrative Privacy) In this week's episode, I sat down with Jake Ottenwaelder,  Principal Privacy Engineer at Integrative Privacy LLC. Throughout our conversation, we discuss Jake’s holistic approach to privacy implementation that considers business, engineering, and personal objectives, as well as the role of anonymization, consent management, and DSAR processes for greater privacy. 

Jake believes privacy implementation must account for the interconnectedness of privacy technologies and human interactions. He highlights what a successful implementation looks like and the negative consequences when done poorly. We also dive into the challenges of implementing privacy in fast-paced, engineering-driven organizations. We talk about the complexities of anonymizing data (a very high bar) and he offers valuable suggestions and strategies for achieving anonymity while making the necessary resources more accessible. Plus, Jake shares his advice for organizational leaders to see themselves as servant-leaders, leaving a positive legacy in the field of privacy. 

Topics Covered: 

  • What inspired Jake’s initial shift from security engineering to privacy engineering, with a focus on privacy implementation
  • How Jake's previous role at Axon helped him shift his mindset to privacy
  • Jake’s holistic approach to implementing privacy 
  • The qualities of a successful implementation and the consequences of an unsuccessful implementation
  • The challenges of implementing privacy in large organizations 
  • Common blockers to the deployment of anonymization
  • Jake’s perspective on using differential privacy techniques to achieve anonymity
  • Common blockers to implementing consent management capabilities
  • The importance of understanding data flow & lineage, and auditing data deletion 
  • Holistic approaches to implementing a streamlined and compliant DSAR process with minimal business disruption 
  • Why Jake believes it's important to maintain a servant-leader mindset in privacy

Guest Info: 

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> In this week's episode, I sat down with Jake Ottenwaelder,  Principal Privacy Engineer at Integrative Privacy LLC. Throughout our conversation, we discuss Jake’s holistic approach to privacy implementation that considers business, engineering, and personal objectives, as well as the role of anonymization, consent management, and DSAR processes for greater privacy. 

Jake believes privacy implementation must account for the interconnectedness of privacy technologies and human interactions. He highlights what a successful implementation looks like and the negative consequences when done poorly. We also dive into the challenges of implementing privacy in fast-paced, engineering-driven organizations. We talk about the complexities of anonymizing data (a very high bar) and he offers valuable suggestions and strategies for achieving anonymity while making the necessary resources more accessible. Plus, Jake shares his advice for organizational leaders to see themselves as servant-leaders, leaving a positive legacy in the field of privacy. 

Topics Covered: 

  • What inspired Jake’s initial shift from security engineering to privacy engineering, with a focus on privacy implementation
  • How Jake's previous role at Axon helped him shift his mindset to privacy
  • Jake’s holistic approach to implementing privacy 
  • The qualities of a successful implementation and the consequences of an unsuccessful implementation
  • The challenges of implementing privacy in large organizations 
  • Common blockers to the deployment of anonymization
  • Jake’s perspective on using differential privacy techniques to achieve anonymity
  • Common blockers to implementing consent management capabilities
  • The importance of understanding data flow & lineage, and auditing data deletion 
  • Holistic approaches to implementing a streamlined and compliant DSAR process with minimal business disruption 
  • Why Jake believes it's important to maintain a servant-leader mindset in privacy

Guest Info: 

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Jake Ottenwaelder Buzzsprout-14595541 Tue, 05 Mar 2024 12:00:00 -0800 3249 3 6 full false S3E5: 'Nonconformist Innovation in Modern Digital Identity' with Steve Tout (Integrated Solutions Group) S3E5: 'Nonconformist Innovation in Modern Digital Identity' with Steve Tout (Integrated Solutions Group) In this week's episode, I am joined by Steve Tout, Practice Lead at Integrated Solutions Group (ISG) and Host of The Nonconformist Innovation Podcast to discuss the intersection of privacy and identity. Steve has 18+ years of experience in global Identity & Access Management (IAM) and is currently completing his MBA from Santa Clara University. Throughout our conversation, Steve shares his journey as a reformed technologist and advocate for 'Nonconformist Innovation' & 'Tipping Point Leadership.'

Steve's approach to identity involves breaking it down into 4 components: 1) philosophy, 2) politics, 3) economics & 4)technology, highlighting their interconnectedness. We also discuss his work with Washington State and its efforts to modernize Consumer Identity Access Management (IAM). We address concerns around AI, biometrics & mobile driver's licenses. Plus, Steve offers his perspective on tipping point leadership and the challenges organizations face in achieving privacy change at scale.

Topics Covered: 

  • Steve's origin story; his accidental entry into identity & access management (IAM)
  • Steve's perspective as a 'Nonconformist Innovator' and why he launched 'The Nonconformist Innovation Podcast'
  • The intersection of privacy & identity
  • How to address organizational resistance to change, especially with lean resources
  • Benefits gained from 'Tipping Point Leadership'
  • 4 common hurdles to tipping point leadership 
  • How to be a successful tipping point leader within a very bottom-up focused organization
  • 'Consumer IAM' & the driving need for modernizing identity in Washington State
  • How Steve has approached the challenges related to privacy, ethics & equity 
  • Differences between the mobile driver's license (mDL) & verified credentials (VC) standards & technology
  • How States are approaching the implementation of  mDL in different ways and the privacy benefits of 'selective disclosure'
  • Steve's advice for privacy technologists to best position them and their orgs at the forefront of privacy and security innovation
  • Steve recommended books for learning more about tipping point leadership

Guest Info: 

Resources Mentioned: 

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> In this week's episode, I am joined by Steve Tout, Practice Lead at Integrated Solutions Group (ISG) and Host of The Nonconformist Innovation Podcast to discuss the intersection of privacy and identity. Steve has 18+ years of experience in global Identity & Access Management (IAM) and is currently completing his MBA from Santa Clara University. Throughout our conversation, Steve shares his journey as a reformed technologist and advocate for 'Nonconformist Innovation' & 'Tipping Point Leadership.'

Steve's approach to identity involves breaking it down into 4 components: 1) philosophy, 2) politics, 3) economics & 4)technology, highlighting their interconnectedness. We also discuss his work with Washington State and its efforts to modernize Consumer Identity Access Management (IAM). We address concerns around AI, biometrics & mobile driver's licenses. Plus, Steve offers his perspective on tipping point leadership and the challenges organizations face in achieving privacy change at scale.

Topics Covered: 

  • Steve's origin story; his accidental entry into identity & access management (IAM)
  • Steve's perspective as a 'Nonconformist Innovator' and why he launched 'The Nonconformist Innovation Podcast'
  • The intersection of privacy & identity
  • How to address organizational resistance to change, especially with lean resources
  • Benefits gained from 'Tipping Point Leadership'
  • 4 common hurdles to tipping point leadership 
  • How to be a successful tipping point leader within a very bottom-up focused organization
  • 'Consumer IAM' & the driving need for modernizing identity in Washington State
  • How Steve has approached the challenges related to privacy, ethics & equity 
  • Differences between the mobile driver's license (mDL) & verified credentials (VC) standards & technology
  • How States are approaching the implementation of  mDL in different ways and the privacy benefits of 'selective disclosure'
  • Steve's advice for privacy technologists to best position them and their orgs at the forefront of privacy and security innovation
  • Steve recommended books for learning more about tipping point leadership

Guest Info: 

Resources Mentioned: 

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J Farber / Steve Tout Buzzsprout-14467700 Tue, 27 Feb 2024 06:00:00 -0800 3295 mobile drivers license, mDL, verified credentials, IAM, tipping point leadership, innovation, The Nonconformist Innovation Podcast 3 5 full false S3E4: 'Supporting Developer Accountability for Privacy' with Jake Ward (Data Protocol) S3E4: 'Supporting Developer Accountability for Privacy' with Jake Ward (Data Protocol) This week, I chat with Jake Ward, the Co-Founder and CEO of Data Protocol, to discuss how the Data Protocol platform supports developers' accountability for privacy by giving developers the relevant information in the way that they want it. Throughout the episode, we cover the Privacy Engineering course offerings and certification program; how to improve communication with  developers; and trends that Jake sees across his customers after 2 years of offering these courses to engineers.

In our conversation, we dive into the topics covered in the Privacy Engineering Certification Program course offering , led by instructor Nishant Bhajaria, and the impact that engineers can make in their organization after completing it. Jake shares why he's so passionate about  empowering developers, enabling them to build safer products. We  talk about the effects of privacy engineering on large tech companies and how to bridge the gap between developers and the support they need with collaboration and accountability. Plus, Jake reflects on his own career path as the Press Secretary for a U.S. Senator and the experiences that shaped his perspectives and brought him to where he is now.

Topics Covered: 

  • Jake’s career journey and why he landed on supporting software developers 
  • How Jake build Data Protocol and it’s community 
  • What 'shifting privacy left' means to Jake
  • Data Protocol's Privacy Engineering Courses, Labs, & Certification Program and what developers will take away
  • The difference between Data Protocol's free Privacy Courses and paid Certification
  • Feedback from customers and & trends observed
  • Whether tech companies have seen improvement in engineers' ability to embed privacy into the development of products & services after completing the Privacy Engineering courses and labs 
  • Other privacy-related courses available on Data Protocol, and privacy courses  on the roadmap
  • Ways to leverage communications to surmount current challenges
  • How organizations can make their developers accountable for privacy, and the importance of aligning responsibility, accountability & business processes
  • How Debra would operationalize this accountability into an organization
  • How you can use the PrivacyCode.ai privacy tech platform to enable the operationalization of privacy accountability for developers

Resources Mentioned: 

Guest Info: 

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week, I chat with Jake Ward, the Co-Founder and CEO of Data Protocol, to discuss how the Data Protocol platform supports developers' accountability for privacy by giving developers the relevant information in the way that they want it. Throughout the episode, we cover the Privacy Engineering course offerings and certification program; how to improve communication with  developers; and trends that Jake sees across his customers after 2 years of offering these courses to engineers.

In our conversation, we dive into the topics covered in the Privacy Engineering Certification Program course offering , led by instructor Nishant Bhajaria, and the impact that engineers can make in their organization after completing it. Jake shares why he's so passionate about  empowering developers, enabling them to build safer products. We  talk about the effects of privacy engineering on large tech companies and how to bridge the gap between developers and the support they need with collaboration and accountability. Plus, Jake reflects on his own career path as the Press Secretary for a U.S. Senator and the experiences that shaped his perspectives and brought him to where he is now.

Topics Covered: 

  • Jake’s career journey and why he landed on supporting software developers 
  • How Jake build Data Protocol and it’s community 
  • What 'shifting privacy left' means to Jake
  • Data Protocol's Privacy Engineering Courses, Labs, & Certification Program and what developers will take away
  • The difference between Data Protocol's free Privacy Courses and paid Certification
  • Feedback from customers and & trends observed
  • Whether tech companies have seen improvement in engineers' ability to embed privacy into the development of products & services after completing the Privacy Engineering courses and labs 
  • Other privacy-related courses available on Data Protocol, and privacy courses  on the roadmap
  • Ways to leverage communications to surmount current challenges
  • How organizations can make their developers accountable for privacy, and the importance of aligning responsibility, accountability & business processes
  • How Debra would operationalize this accountability into an organization
  • How you can use the PrivacyCode.ai privacy tech platform to enable the operationalization of privacy accountability for developers

Resources Mentioned: 

Guest Info: 

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J Farber / Jake Ward Buzzsprout-14467641 Tue, 13 Feb 2024 06:00:00 -0800 2680 developer support, privacy accountability, Data Protocol, Privacy Engineering Certification, Privacy Engineering courses 3 4 full false S3E3: 'Shifting Left from Practicing Attorney to Privacy Engineer’ with Jay Averitt (Microsoft) S3E3: 'Shifting Left from Practicing Attorney to Privacy Engineer’ with Jay Averitt (Microsoft) My guest this week is Jay Averitt, Senior Privacy Product Manager and Privacy Engineer at Microsoft, where he transitioned his career from Technology Attorney to Privacy Counsel, and most recently to Privacy Engineer.

In this episode, we hear from Jay about: his professional path from a degree in Management Information Systems to Privacy Engineer; how Twitter and Microsoft navigated a privacy setup, and how to determine privacy program maturity; multiple of his Privacy Engineering community projects; and tips on how to spread privacy awareness and stay active within the industry. 


Topics Covered:

  • Jay’s unique professional journey from Attorney to Privacy Engineer
  • Jay’s big mindset shift from serving as Privacy Counsel to Privacy Engineer, from a day-to-day and internal perspective
  • Why constant learning is essential in the field of privacy engineering, requiring us to keep up with ever-changing laws, standards, and technologies
  • Jay’s comparison of what it's like to work for Twitter vs. Microsoft when it comes to how each company focuses on privacy and data protection 
  • Two ways to determine Privacy Program Maturity, according to Jay
  • How engineering-focused organizations can unify around a corporate privacy strategy and how privacy pros can connect to people beyond their siloed teams
  • Why building and maintaining relationships is the key for privacy engineers to be seen as enablers instead of blockers 
  • A detailed look at the 'Technical Privacy Review' process
  • A peak into Privacy Quest’s gamified privacy engineering platform and the events that Jay & Debra are leading as part of its DPD'24 Festival Village month-long puzzles and events
  • Debra's & Jay's experiences at the USENIX PEPR'23; why it provided so much value for them both; and, why you should consider attending PEPR'24  
  • Ways to utilize online Slack communities, LinkedIn, and other tools to stay active in the privacy engineering world


Resources Mentioned:


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> My guest this week is Jay Averitt, Senior Privacy Product Manager and Privacy Engineer at Microsoft, where he transitioned his career from Technology Attorney to Privacy Counsel, and most recently to Privacy Engineer.

In this episode, we hear from Jay about: his professional path from a degree in Management Information Systems to Privacy Engineer; how Twitter and Microsoft navigated a privacy setup, and how to determine privacy program maturity; multiple of his Privacy Engineering community projects; and tips on how to spread privacy awareness and stay active within the industry. 


Topics Covered:

  • Jay’s unique professional journey from Attorney to Privacy Engineer
  • Jay’s big mindset shift from serving as Privacy Counsel to Privacy Engineer, from a day-to-day and internal perspective
  • Why constant learning is essential in the field of privacy engineering, requiring us to keep up with ever-changing laws, standards, and technologies
  • Jay’s comparison of what it's like to work for Twitter vs. Microsoft when it comes to how each company focuses on privacy and data protection 
  • Two ways to determine Privacy Program Maturity, according to Jay
  • How engineering-focused organizations can unify around a corporate privacy strategy and how privacy pros can connect to people beyond their siloed teams
  • Why building and maintaining relationships is the key for privacy engineers to be seen as enablers instead of blockers 
  • A detailed look at the 'Technical Privacy Review' process
  • A peak into Privacy Quest’s gamified privacy engineering platform and the events that Jay & Debra are leading as part of its DPD'24 Festival Village month-long puzzles and events
  • Debra's & Jay's experiences at the USENIX PEPR'23; why it provided so much value for them both; and, why you should consider attending PEPR'24  
  • Ways to utilize online Slack communities, LinkedIn, and other tools to stay active in the privacy engineering world


Resources Mentioned:


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Jay Averitt Buzzsprout-14389554 Tue, 30 Jan 2024 06:00:00 -0800 3111 shifting left, privacy engineer, privacy counsel, technical privacy reviews 3 3 full false S3E2: 'My Top 20 Privacy Engineering Resources for 2024' with Debra Farber (Shifting Privacy Left) S3E2: 'My Top 20 Privacy Engineering Resources for 2024' with Debra Farber (Shifting Privacy Left) In Honor of Data Privacy Week 2024, we're publishing a special episode. Instead of interviewing a guest, Debra shares her 'Top 20 Privacy Engineering Resources' and why. Check out her favorite free privacy engineering courses, books, podcasts, creative learning platforms, privacy threat modeling frameworks, conferences, government resources, and more.

DEBRA's TOP 20 PRIVACY ENGINEERING RESOURCES (in no particular order)

  1. Privado's Free Course: 'Technical Privacy Masterclass'
  2. OpenMined's Free Course: 'Our Privacy Opportunity' 
  3. Data Protocol's Privacy Engineering Certification Program
  4. The Privacy Quest Platform & Games; Bonus: The Hitchhiker's Guide to Privacy Engineering
  5. 'Data Privacy: a runbook for engineers by Nishant Bhajaria
  6. 'Privacy Engineering, a Data Flow and Ontological Approach' by Ian Oliver
  7. 'Practical Data Privacy: enhancing privacy and security in data' by Katharine Jarmul
  8. Strategic Privacy by Design, 2nd Edition by R. Jason Cronk
  9. 'The Privacy Engineer's Manifesto: getting from policy to code to QA to value' by Michelle Finneran-Dennedy, Jonathan Fox and Thomas R. Dennedy 
  10. USENIX Conference on Privacy Engineering Practice and Respect (PEPR)
  11. IEEE's The International Workshop on Privacy Engineering (IWPE)
  12. Institute of Operational Privacy Design (IOPD)
  13. 'The Shifting Privacy Left Podcast,' produced and hosted by Debra J Farber and sponsored by Privado
  14. Monitaur's 'The AI Fundamentalists Podcast' hosted by Andrew Clark & Sid Mangalik
  15. Skyflow's 'Partially Redacted Podcast' with Sean Falconer
  16. The LINDDUN Privacy Threat Model Framework & LINDDUN GO Card Game
  17. The Privacy Library Of Threats 4 Artificial Intelligence (PLOT4ai) Framework & PLOT4ai Card Game
  18. The IAPP Privacy Engineering Section
  19. The NIST Privacy Engineering Program Collaboration Space
  20. The EDPS Internet Privacy Engineering Network (IPEN)

Read “Top 20 Privacy Engineering Resources” on Privado’s Blog.

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> In Honor of Data Privacy Week 2024, we're publishing a special episode. Instead of interviewing a guest, Debra shares her 'Top 20 Privacy Engineering Resources' and why. Check out her favorite free privacy engineering courses, books, podcasts, creative learning platforms, privacy threat modeling frameworks, conferences, government resources, and more.

DEBRA's TOP 20 PRIVACY ENGINEERING RESOURCES (in no particular order)

  1. Privado's Free Course: 'Technical Privacy Masterclass'
  2. OpenMined's Free Course: 'Our Privacy Opportunity' 
  3. Data Protocol's Privacy Engineering Certification Program
  4. The Privacy Quest Platform & Games; Bonus: The Hitchhiker's Guide to Privacy Engineering
  5. 'Data Privacy: a runbook for engineers by Nishant Bhajaria
  6. 'Privacy Engineering, a Data Flow and Ontological Approach' by Ian Oliver
  7. 'Practical Data Privacy: enhancing privacy and security in data' by Katharine Jarmul
  8. Strategic Privacy by Design, 2nd Edition by R. Jason Cronk
  9. 'The Privacy Engineer's Manifesto: getting from policy to code to QA to value' by Michelle Finneran-Dennedy, Jonathan Fox and Thomas R. Dennedy 
  10. USENIX Conference on Privacy Engineering Practice and Respect (PEPR)
  11. IEEE's The International Workshop on Privacy Engineering (IWPE)
  12. Institute of Operational Privacy Design (IOPD)
  13. 'The Shifting Privacy Left Podcast,' produced and hosted by Debra J Farber and sponsored by Privado
  14. Monitaur's 'The AI Fundamentalists Podcast' hosted by Andrew Clark & Sid Mangalik
  15. Skyflow's 'Partially Redacted Podcast' with Sean Falconer
  16. The LINDDUN Privacy Threat Model Framework & LINDDUN GO Card Game
  17. The Privacy Library Of Threats 4 Artificial Intelligence (PLOT4ai) Framework & PLOT4ai Card Game
  18. The IAPP Privacy Engineering Section
  19. The NIST Privacy Engineering Program Collaboration Space
  20. The EDPS Internet Privacy Engineering Network (IPEN)

Read “Top 20 Privacy Engineering Resources” on Privado’s Blog.

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber (Shifting Privacy Left) Buzzsprout-14385777 Tue, 23 Jan 2024 14:00:00 -0800 3253 privacy engineering resources 3 2 full false S3E1: "Privacy-preserving Machine Learning and NLP" with Patricia Thaine (Private AI) S3E1: "Privacy-preserving Machine Learning and NLP" with Patricia Thaine (Private AI) My guest this week is Patricia Thaine, Co-founder and CEO of Private AI, where she leads a team of experts in developing cutting-edge solutions using AI to identify, reduce, and remove Personally Identifiable Information (PII) in 52 languages across text, audio, images, and documents.

In this episode, we hear from Patricia about: her transition from starting a Ph.D. to co-founding an AI company; how Private AI set out to solve fundamental privacy problems to provide control and understanding of data collection; misunderstandings about how best to leverage AI regarding privacy-preserving machine learning; Private AI’s intention when designing their software, plus newly deployed features; and whether global AI regulations can help with current risks around privacy, rogue AI and copyright.

Topics Covered:

  • Patricia’s professional journey from starting a Ph.D. in Acoustic Forensics to co-founding an AI company
  • Why Private AI’s mission is to solve privacy problems and create a platform for developers to modularly and flexibly integrate it anywhere you want in your software pipeline, including  model ingress & egress
  • How companies can avoid mishandling personal information when leveraging AI / machine learning; and Patricia’s advice to companies to avoid mishandling personal information 
  • Why keeping track of ever-changing data collection and regulations make it hard to find personal information
  • Private AI's privacy-enabling architectural approach to finding personal data to prevent it from being used by or stored in an AI model
  • The approach that Privacy AI took to design their software
  • Private AI's extremely high matching rate, and how they aim for 99%+ accuracy
  • Private AI's roadmap & R&D efforts
  • Debra & Patricia discuss AI Regulation and Patricia's insights from her article 'Thoughts on AI Regulation'
  • A foreshadowing of AI’s copyright risk problem and whether regulations or licenses can help
  • ChatGPT’s popularity, copyright, and the need for embedding privacy, security, and safety by design from the beginning (in the MVP)
  • How to reach out to Patricia to connect, collaborate, or access a demo
  • How thinking about the fundamentals gets you a good way on your way to ensuring privacy & security


Resources Mentioned:


Guest Info:

  • Connect with Patricia on LinkedIn
  • Check out

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> My guest this week is Patricia Thaine, Co-founder and CEO of Private AI, where she leads a team of experts in developing cutting-edge solutions using AI to identify, reduce, and remove Personally Identifiable Information (PII) in 52 languages across text, audio, images, and documents.

In this episode, we hear from Patricia about: her transition from starting a Ph.D. to co-founding an AI company; how Private AI set out to solve fundamental privacy problems to provide control and understanding of data collection; misunderstandings about how best to leverage AI regarding privacy-preserving machine learning; Private AI’s intention when designing their software, plus newly deployed features; and whether global AI regulations can help with current risks around privacy, rogue AI and copyright.

Topics Covered:

  • Patricia’s professional journey from starting a Ph.D. in Acoustic Forensics to co-founding an AI company
  • Why Private AI’s mission is to solve privacy problems and create a platform for developers to modularly and flexibly integrate it anywhere you want in your software pipeline, including  model ingress & egress
  • How companies can avoid mishandling personal information when leveraging AI / machine learning; and Patricia’s advice to companies to avoid mishandling personal information 
  • Why keeping track of ever-changing data collection and regulations make it hard to find personal information
  • Private AI's privacy-enabling architectural approach to finding personal data to prevent it from being used by or stored in an AI model
  • The approach that Privacy AI took to design their software
  • Private AI's extremely high matching rate, and how they aim for 99%+ accuracy
  • Private AI's roadmap & R&D efforts
  • Debra & Patricia discuss AI Regulation and Patricia's insights from her article 'Thoughts on AI Regulation'
  • A foreshadowing of AI’s copyright risk problem and whether regulations or licenses can help
  • ChatGPT’s popularity, copyright, and the need for embedding privacy, security, and safety by design from the beginning (in the MVP)
  • How to reach out to Patricia to connect, collaborate, or access a demo
  • How thinking about the fundamentals gets you a good way on your way to ensuring privacy & security


Resources Mentioned:


Guest Info:

  • Connect with Patricia on LinkedIn
  • Check out

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

TRU Staffing Partners
Top privacy talent - when you need it, where you need it.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J Farber / Patricia Thaine Buzzsprout-14215661 Tue, 02 Jan 2024 12:00:00 -0800 2214 #AI, Private AI, Patricia Thaine, 3 1 full false S2E39: 'Contextual Responsive Intelligence & Data Minimization for AI Training & Testing' with Kevin Killens (AHvos) S2E39: 'Contextual Responsive Intelligence & Data Minimization for AI Training & Testing' with Kevin Killens (AHvos) My guest this week is Kevin Killens, CEO of AHvos, a technology service that provides AI solutions for data-heavy businesses using a proprietary technology called Contextually Responsive Intelligence (CRI), which can act upon a business's private data and produce results without storing that data.

In this episode, we delve into this technology and learn more from Kevin about: his transition from serving in the Navy to founding an AI-focused company; AHvos’ architectural approach in support of data minimization and reduced attack surface; AHvos' CRI technology and its ability to provide accurate answers based on private data sets; and how AHvos’ Data Crucible product helps AI teams to identify and correct inaccurate dataset labels.  

Topics Covered:

  • Kevin’s origin story, from serving in the Navy to founding AHvos
  • How Kevin thinks about privacy and the architectural approach he took when building AHvos
  • The challenges of processing personal data, 'security for privacy,' and the applicability of the GDPR when using AHvos
  • Kevin explains the benefits of Contextually Responsive Intelligence (CRI): which abstracts out raw data to protect privacy; finds & creates relevant data in response to a query; and identifies & corrects inaccurate dataset labels
  • How human-created algorithms and oversight influence AI parameters and model bias; and, why transparency is so important
  • How customer data is ingested into models via AHvos
  • Why it is important to remove bias from Testing Data, not only Training Data; and, how AHvos ensures accuracy 
  • How AHvos' Data Crucible identifies & corrects inaccurate data set labels
  • Kevin's advice for privacy engineers as they tackle AI challenges in their own organizations
  • The impact of technical debt on companies and the importance of building slowly & correctly rather than racing to market with insecure and biased AI models
  • The importance of baking security and privacy into your minimum viable product (MVP), even for products that are still in 'beta' 

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> My guest this week is Kevin Killens, CEO of AHvos, a technology service that provides AI solutions for data-heavy businesses using a proprietary technology called Contextually Responsive Intelligence (CRI), which can act upon a business's private data and produce results without storing that data.

In this episode, we delve into this technology and learn more from Kevin about: his transition from serving in the Navy to founding an AI-focused company; AHvos’ architectural approach in support of data minimization and reduced attack surface; AHvos' CRI technology and its ability to provide accurate answers based on private data sets; and how AHvos’ Data Crucible product helps AI teams to identify and correct inaccurate dataset labels.  

Topics Covered:

  • Kevin’s origin story, from serving in the Navy to founding AHvos
  • How Kevin thinks about privacy and the architectural approach he took when building AHvos
  • The challenges of processing personal data, 'security for privacy,' and the applicability of the GDPR when using AHvos
  • Kevin explains the benefits of Contextually Responsive Intelligence (CRI): which abstracts out raw data to protect privacy; finds & creates relevant data in response to a query; and identifies & corrects inaccurate dataset labels
  • How human-created algorithms and oversight influence AI parameters and model bias; and, why transparency is so important
  • How customer data is ingested into models via AHvos
  • Why it is important to remove bias from Testing Data, not only Training Data; and, how AHvos ensures accuracy 
  • How AHvos' Data Crucible identifies & corrects inaccurate data set labels
  • Kevin's advice for privacy engineers as they tackle AI challenges in their own organizations
  • The impact of technical debt on companies and the importance of building slowly & correctly rather than racing to market with insecure and biased AI models
  • The importance of baking security and privacy into your minimum viable product (MVP), even for products that are still in 'beta' 

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Kevin Killens Buzzsprout-14188363 Tue, 26 Dec 2023 06:00:00 -0800 2600 AHvos, Data Crucible, Contextually Responsive Intelligence, CRI, Data Minimization, AI bias, AI accuracy, Transit Technologies 2 39 full false S2E38: "PrivacyGPT: Bringing an AI Privacy Startup to Market" with Nabanita De (Privacy License) S2E38: "PrivacyGPT: Bringing an AI Privacy Startup to Market" with Nabanita De (Privacy License) My guest this week is Nabanita De, Software Engineer, Serial Entrepreneur, and Founder & CEO at Privacy License where she's on a mission to transform the AI landscape. In this episode, we discuss Nabanita's transition from Engineering Manager at Remitly to startup founder; what she's learned from her experience at Antler's accelerator program, her first product to market: PrivacyGPT and her work to educate Privacy Champions. 

Topics Covered:

  • Nabanita’s origin story, from conducting AI research at Microsoft as an intern all the way to founding Privacy License
  • How Privacy License supports enterprises entering the global market while protecting privacy as a human right
  • A comparison between Nabanita's experience as a corporate role as Privacy Engineering Manager at Remitly versus her entrepreneurial role as Founder-in-Residence at Antler
  • How PrivacyGPT, a Chrome browser plugin, empowers people to use ChatGPT with added privacy protections and without compromising data privacy standards by redacting sensitive and personal data before sending to ChatGPT
  • NLP techniques that Nabanita leveraged to build out PrivacyGPT, including: 'regular expressions,' 'parts of speech tagging,' & 'name entity recognition'
  • How PrivacyGPT can be used to protect privacy across nearly all languages, even where a user has no Internet connection
  • How to use Product Hunt to gain visibility around a newly-launched product; and whether it's easier to raise a financial round in the AI space right now
  • Nabanita’s advice for software engineers who might found a privacy or AI startup in the near future
  • Why Nabanita created a Privacy Champions Program; and how it provides (non)-privacy folks with recommendations to prioritize privacy within their organizations
  • How to sign up for PrivacyGPT’s paid pilot app, connect with Nabanita to collaborate, or subscribe to "Nabanita's Moonshots Newsletter" on LinkedIn


Resources Mentioned:


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> My guest this week is Nabanita De, Software Engineer, Serial Entrepreneur, and Founder & CEO at Privacy License where she's on a mission to transform the AI landscape. In this episode, we discuss Nabanita's transition from Engineering Manager at Remitly to startup founder; what she's learned from her experience at Antler's accelerator program, her first product to market: PrivacyGPT and her work to educate Privacy Champions. 

Topics Covered:

  • Nabanita’s origin story, from conducting AI research at Microsoft as an intern all the way to founding Privacy License
  • How Privacy License supports enterprises entering the global market while protecting privacy as a human right
  • A comparison between Nabanita's experience as a corporate role as Privacy Engineering Manager at Remitly versus her entrepreneurial role as Founder-in-Residence at Antler
  • How PrivacyGPT, a Chrome browser plugin, empowers people to use ChatGPT with added privacy protections and without compromising data privacy standards by redacting sensitive and personal data before sending to ChatGPT
  • NLP techniques that Nabanita leveraged to build out PrivacyGPT, including: 'regular expressions,' 'parts of speech tagging,' & 'name entity recognition'
  • How PrivacyGPT can be used to protect privacy across nearly all languages, even where a user has no Internet connection
  • How to use Product Hunt to gain visibility around a newly-launched product; and whether it's easier to raise a financial round in the AI space right now
  • Nabanita’s advice for software engineers who might found a privacy or AI startup in the near future
  • Why Nabanita created a Privacy Champions Program; and how it provides (non)-privacy folks with recommendations to prioritize privacy within their organizations
  • How to sign up for PrivacyGPT’s paid pilot app, connect with Nabanita to collaborate, or subscribe to "Nabanita's Moonshots Newsletter" on LinkedIn


Resources Mentioned:


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Nabanita De Buzzsprout-14143077 Tue, 19 Dec 2023 12:00:00 -0800 2489 privacy tech, PrivacyGPT, Privacy License, Privacy Champions, privacy-by-design, privacy engineer 2 38 full true S2E37: "Embedding Privacy Engineering into Real Estate" with Yusra Ahmad and Luke Beckley (The RED Foundation) S2E37: "Embedding Privacy Engineering into Real Estate" with Yusra Ahmad and Luke Beckley (The RED Foundation) My guests this week are Yusra Ahmad, CEO of Acuity Data, and Luke Beckley, Data Protection Officer and Privacy Governance Manager at Correla, who work with The RED (Real Estate Data) Foundation, a sector-wide alliance that enables the real estate sector to benefit from an increased use of data, while voiding some of the risks that this presents, and better serving society.

We discuss the current drivers for change within the real estate industry and the complexities of the real estate industry utilizing incredible amounts of data. You’ll learn the types of data protection, privacy, and ethical challenges The RED Foundation seeks to solve, especially now with the advent of new technologies. Yusra and Luke discuss some  ethical questions the real estate sector as it considers leveraging new technology. Yusra and Luke come to the conversation from the knowledgeable perspective as The RED Foundation’s Chair of the Data Ethics Steering Group and Chair of the Engagement and Awareness Group, respectively.


Topics Covered:

  • Introducing Luke Beckley (DPO, Privacy & Governance Manager at Correla) and Yusra Ahmed (CEO of Acuity Data); who are here to talk about their data ethics work at The RED Foundation
  • How the scope, sophistication, & connectivity of data is increasing exponentially in the real estate industry
  • Why ESG, workplace experience, & smart city development are drivers of data collection; and the need for data ethics reform within the real estate industry
  • Discussion of types of personal data these real estate companies collect & use across stakeholders: owners, operators, occupiers, employees, residents, etc.
  • Current approaches that retailers take to protect location data, when collected; and why it's important to simplify language,  increase transparency, & make  consumers aware of tracking in in-store WIFi privacy notices
  • Overview of The RED Foundation & mission: to ensure the real estate sector benefits from an increased use of data, avoids some of the risks that this presents, and is better placed to serve society
  • Some ethical questions with which the real estate sector needs to still align, along with examples
  • Why there’s a need to educate the real estate industry on privacy-enhancing tech
  • The need for privacy engineers and PETs in real estate; and why this will build trust with the different stakeholders
  • Guidance for privacy engineers who want to work in the real estate sector.
  • Ways to collaborate with The RED Foundation to standardize data ethics practices across the real estate industry
  • Why there's great opportunity to embed privacy into real estate; and why its current challenges are really obstacles, rather than blockers.

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> My guests this week are Yusra Ahmad, CEO of Acuity Data, and Luke Beckley, Data Protection Officer and Privacy Governance Manager at Correla, who work with The RED (Real Estate Data) Foundation, a sector-wide alliance that enables the real estate sector to benefit from an increased use of data, while voiding some of the risks that this presents, and better serving society.

We discuss the current drivers for change within the real estate industry and the complexities of the real estate industry utilizing incredible amounts of data. You’ll learn the types of data protection, privacy, and ethical challenges The RED Foundation seeks to solve, especially now with the advent of new technologies. Yusra and Luke discuss some  ethical questions the real estate sector as it considers leveraging new technology. Yusra and Luke come to the conversation from the knowledgeable perspective as The RED Foundation’s Chair of the Data Ethics Steering Group and Chair of the Engagement and Awareness Group, respectively.


Topics Covered:

  • Introducing Luke Beckley (DPO, Privacy & Governance Manager at Correla) and Yusra Ahmed (CEO of Acuity Data); who are here to talk about their data ethics work at The RED Foundation
  • How the scope, sophistication, & connectivity of data is increasing exponentially in the real estate industry
  • Why ESG, workplace experience, & smart city development are drivers of data collection; and the need for data ethics reform within the real estate industry
  • Discussion of types of personal data these real estate companies collect & use across stakeholders: owners, operators, occupiers, employees, residents, etc.
  • Current approaches that retailers take to protect location data, when collected; and why it's important to simplify language,  increase transparency, & make  consumers aware of tracking in in-store WIFi privacy notices
  • Overview of The RED Foundation & mission: to ensure the real estate sector benefits from an increased use of data, avoids some of the risks that this presents, and is better placed to serve society
  • Some ethical questions with which the real estate sector needs to still align, along with examples
  • Why there’s a need to educate the real estate industry on privacy-enhancing tech
  • The need for privacy engineers and PETs in real estate; and why this will build trust with the different stakeholders
  • Guidance for privacy engineers who want to work in the real estate sector.
  • Ways to collaborate with The RED Foundation to standardize data ethics practices across the real estate industry
  • Why there's great opportunity to embed privacy into real estate; and why its current challenges are really obstacles, rather than blockers.

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber (Shifting Privacy Left) Buzzsprout-14044232 Tue, 05 Dec 2023 06:00:00 -0800 3880 2 37 full false S2E36: "Privacy Engineering Contracting: State of the Market & 2024 Predictions" with Jared Coseglia (TRU Staffing) S2E36: "Privacy Engineering Contracting: State of the Market & 2024 Predictions" with Jared Coseglia (TRU Staffing) This week, I welcome Jared Coseglia, co-founder and CEO at TRU Staffing Partners, a contract staffing & executive placement search firm that represents talent across 3 core industry verticals: data privacy, eDiscovery, & cybersecurity. We discuss the current and future state of the contracting market for privacy engineering rols and the market drivers that affect hiring. You’ll learn about the hiring trends and the allure of 'part-time impact,' 'part-time perpetual,' and 'secondee' contract work. Jared illustrates the challenges that hiring managers face with a 'Do-it-Yourself' staffing process; and he shares his predictions about the job market for privacy engineers over the next 2 years. Jared comes to the conversation with a lot of data that supports his predictions and sage advice for privacy engineering hiring managers and job seekers. 


Topics Covered:

  • How the privacy contracting market compares and contrasts to the full-time hiring market; and, why we currently see a steep rise in privacy contracting
  • Why full-time hiring for privacy engineers won't likely rebound until Q4 2024; and, how hiring for privacy typically follows a 2-year cycle
  • Why companies & employees benefit from fractional contracts; and, the differences between contracting types: 'Part-Time - Impact,' 'Part-Time - Perpetual,' and 'Secondee'
  • How hiring managers typically find privacy engineering candidates
  • Why it's far more difficult to hire privacy engineers for contracts; and, how a staffing partner like TRU can supercharge your hiring efforts and avoid the pitfalls of a "do-it-yourself" approach
  • How contract work benefits privacy engineers financially, while also providing them with project diversity
  • How salaries are calculated for privacy engineers; and, the driving forces behind pay discrepancies across privacy roles
  • Jared's advice to 2024 job seekers, based on his market predictions; and, why privacy contracting increases 'speed to hire' compared to hiring FTEs
  • Why privacy engineers can earn more money by changing jobs in 2024 than they could by seeking raises in their current companies; and discussion of 2024 salary ranges across industry segments
  • Jared's advice on how privacy engineers can best position themselves to contract hiring managers in 2024
  • Recommended resources for privacy engineering employers and job seekers

Resources Mentioned:


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week, I welcome Jared Coseglia, co-founder and CEO at TRU Staffing Partners, a contract staffing & executive placement search firm that represents talent across 3 core industry verticals: data privacy, eDiscovery, & cybersecurity. We discuss the current and future state of the contracting market for privacy engineering rols and the market drivers that affect hiring. You’ll learn about the hiring trends and the allure of 'part-time impact,' 'part-time perpetual,' and 'secondee' contract work. Jared illustrates the challenges that hiring managers face with a 'Do-it-Yourself' staffing process; and he shares his predictions about the job market for privacy engineers over the next 2 years. Jared comes to the conversation with a lot of data that supports his predictions and sage advice for privacy engineering hiring managers and job seekers. 


Topics Covered:

  • How the privacy contracting market compares and contrasts to the full-time hiring market; and, why we currently see a steep rise in privacy contracting
  • Why full-time hiring for privacy engineers won't likely rebound until Q4 2024; and, how hiring for privacy typically follows a 2-year cycle
  • Why companies & employees benefit from fractional contracts; and, the differences between contracting types: 'Part-Time - Impact,' 'Part-Time - Perpetual,' and 'Secondee'
  • How hiring managers typically find privacy engineering candidates
  • Why it's far more difficult to hire privacy engineers for contracts; and, how a staffing partner like TRU can supercharge your hiring efforts and avoid the pitfalls of a "do-it-yourself" approach
  • How contract work benefits privacy engineers financially, while also providing them with project diversity
  • How salaries are calculated for privacy engineers; and, the driving forces behind pay discrepancies across privacy roles
  • Jared's advice to 2024 job seekers, based on his market predictions; and, why privacy contracting increases 'speed to hire' compared to hiring FTEs
  • Why privacy engineers can earn more money by changing jobs in 2024 than they could by seeking raises in their current companies; and discussion of 2024 salary ranges across industry segments
  • Jared's advice on how privacy engineers can best position themselves to contract hiring managers in 2024
  • Recommended resources for privacy engineering employers and job seekers

Resources Mentioned:


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber (Shifting Privacy Left) / Jared Coseglia Buzzsprout-13973139 Tue, 21 Nov 2023 06:00:00 -0800 3467 privacy engineering contracting, contracts, staff augmentation, privacy hiring 2 36 full false S2E35: "Embed Ethics into Your SDLC: From Reactive Firefighting to 'Responsible Firekeeping'" with Mathew Mytka & Alja Isaković (Tethix) S2E35: "Embed Ethics into Your SDLC: From Reactive Firefighting to 'Responsible Firekeeping'" with Mathew Mytka & Alja Isaković (Tethix) This week’s guests are Mathew Mytka and Alja Isakovoić, Co-Founders of Tethix, a company that builds products that embed ethics into the fabric of your organization. We discuss Matt and Alja’s core mission to bring ethical tech to the world, and Tethix’s services that work with your Agile development processes. You’ll learn about Tethix’s solution to address 'The Intent to Action Gap,' and what Elemental Ethics can provide organizations beyond other ethics frameworks. We discuss ways to become a proactive Responsible Firekeeper, rather than remaining a reactive Firefighter, and how ETHOS, Tethix's suite of apps can help organizations embody and embed ethics into everyday practice. 


TOPICS COVERED:

  • What inspired Mat & Alja to co-found Tethix and the company's core mission
  • What the 'Intent to Action Gap' is and how Tethix address it
  • Overview of Tethix's Elemental Ethics framework; and how it empowers product development teams to 'close the 'Intent to Action Gap' and move orgs from a state of 'Agile Firefighting' to 'Responsible Firekeeping'
  • Why Agile is an insufficient process for embedding ethics into software and product development; and how you can turn to Elemental Ethics and Responsible Firekeeping to embed 'Ethics-by-Design' into your Agile workflows
  • The definition of 'Responsible Firekeeping' and its benefits; and how Ethical Firekeeping transitions Agile teams from a reactive posture to a proactive one
  • Why you should choose Elemental Ethics over conventional ethics frameworks
  • Tethix's suite of apps called ETHOS: The Ethical Tension and Health Operating System apps, which help teams embed ethics into their collaboration tech stack (e.g., JIRA, Slack, Figma, Zoom, etc.)
  • How you can become a Responsible Firekeeper
  • The level of effort required to implement Elemental Ethics & Responsible Firekeeping into Product Development based on org size and level of maturity
  • Alja's contribution to the ResponsibleTech.Work, an open source Responsible Product Development Framework, core elements of the Framework, and why we need it
  • Where to learn more about Responsible Firekeeping

RESOURCES MENTIONED:

GUEST INFO:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week’s guests are Mathew Mytka and Alja Isakovoić, Co-Founders of Tethix, a company that builds products that embed ethics into the fabric of your organization. We discuss Matt and Alja’s core mission to bring ethical tech to the world, and Tethix’s services that work with your Agile development processes. You’ll learn about Tethix’s solution to address 'The Intent to Action Gap,' and what Elemental Ethics can provide organizations beyond other ethics frameworks. We discuss ways to become a proactive Responsible Firekeeper, rather than remaining a reactive Firefighter, and how ETHOS, Tethix's suite of apps can help organizations embody and embed ethics into everyday practice. 


TOPICS COVERED:

  • What inspired Mat & Alja to co-found Tethix and the company's core mission
  • What the 'Intent to Action Gap' is and how Tethix address it
  • Overview of Tethix's Elemental Ethics framework; and how it empowers product development teams to 'close the 'Intent to Action Gap' and move orgs from a state of 'Agile Firefighting' to 'Responsible Firekeeping'
  • Why Agile is an insufficient process for embedding ethics into software and product development; and how you can turn to Elemental Ethics and Responsible Firekeeping to embed 'Ethics-by-Design' into your Agile workflows
  • The definition of 'Responsible Firekeeping' and its benefits; and how Ethical Firekeeping transitions Agile teams from a reactive posture to a proactive one
  • Why you should choose Elemental Ethics over conventional ethics frameworks
  • Tethix's suite of apps called ETHOS: The Ethical Tension and Health Operating System apps, which help teams embed ethics into their collaboration tech stack (e.g., JIRA, Slack, Figma, Zoom, etc.)
  • How you can become a Responsible Firekeeper
  • The level of effort required to implement Elemental Ethics & Responsible Firekeeping into Product Development based on org size and level of maturity
  • Alja's contribution to the ResponsibleTech.Work, an open source Responsible Product Development Framework, core elements of the Framework, and why we need it
  • Where to learn more about Responsible Firekeeping

RESOURCES MENTIONED:

GUEST INFO:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J Farber / Mathew Mytka and Alja Isaković Buzzsprout-13890617 Tue, 14 Nov 2023 06:00:00 -0800 2691 responsible firekeeping, elemental ethics, responsibletech.work, ethical intent to action gap, ethical tech, Tethix, tech ethics 2 35 full false S2E34: "Embedding Privacy by Design & Threat Modeling for AI" with Isabel Barberá (Rhite & PLOT4ai) S2E34: "Embedding Privacy by Design & Threat Modeling for AI" with Isabel Barberá (Rhite & PLOT4ai) This week’s guest is Isabel Barberá, Co-founder, AI Advisor, and Privacy Engineer at Rhite , a consulting firm specializing in responsible and trustworthy AI and privacy engineering, and creator of The Privacy Library Of Threats 4 Artificial Intelligence Framework and card game. In our conversation, we discuss: Isabel’s work with privacy-by-design, privacy engineering, privacy threat modeling, and building trustworthy AI; and info about Rhite’s forthcoming Self-Assessment Open-Source framework for AI maturity, SARAI®. As we wrap up the episode, Isabel shares details about PLOT4ai, her AI threat modeling framework and card game created based on a library of threats for artificial intelligence. 

Topics Covered:

  • How Isabel became interested in privacy engineering, data protection, privacy by design, threat modeling, and trustworthy AI
  • How companies are thinking (or not) about incorporating privacy-by-design strategies & tactics and privacy engineering approaches within their orgs today
  • What steps can be taken so companies start investing in privacy engineering approaches; and whether AI has become a driver for such approaches.
  • Background on Isabel’s company, Rhite, and its mission to build responsible solutions for society and its individuals using a technical mindset. 
  • What “Responsible & Trustworthy AI” means to Isabel 
  • The 5 core values that make up the acronym, R-H-I-T-E, and why they’re important for designing and building products & services.
  • Isabel's advice for organizations as they approach AI risk assessments, analysis, & remediation 
  • The steps orgs can take in order to  build responsible AI products & services
  • What Isabel hopes to accomplish through Rhite's new framework: SARAI® (for AI maturity), an open source AI Self-Assessment Tool and Framework, and an extension the Privacy Library Of Threats 4 Artificial Intelligence (PLOT4ai) Framework (i.e., a library of AI risks)
  • What motivated Isabel to focus on threat modeling for privacy
  • How PLOT4ai builds on LINDDUN (which focuses on software development) and extends threat modeling to the AI lifecycle stages: Design, Input, Modeling, & Output
  • How Isabel’s experience with the LINDDUN Go card game inspired her to develop of a PLOT4ai card game to make it more accessible to teams.
  • Isabel calls for collaborators to contribute to the PLOT4ai open source database of AI threats as the community grows.

Resources Mentioned:

Guest Info:

Send a text



Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week’s guest is Isabel Barberá, Co-founder, AI Advisor, and Privacy Engineer at Rhite , a consulting firm specializing in responsible and trustworthy AI and privacy engineering, and creator of The Privacy Library Of Threats 4 Artificial Intelligence Framework and card game. In our conversation, we discuss: Isabel’s work with privacy-by-design, privacy engineering, privacy threat modeling, and building trustworthy AI; and info about Rhite’s forthcoming Self-Assessment Open-Source framework for AI maturity, SARAI®. As we wrap up the episode, Isabel shares details about PLOT4ai, her AI threat modeling framework and card game created based on a library of threats for artificial intelligence. 

Topics Covered:

  • How Isabel became interested in privacy engineering, data protection, privacy by design, threat modeling, and trustworthy AI
  • How companies are thinking (or not) about incorporating privacy-by-design strategies & tactics and privacy engineering approaches within their orgs today
  • What steps can be taken so companies start investing in privacy engineering approaches; and whether AI has become a driver for such approaches.
  • Background on Isabel’s company, Rhite, and its mission to build responsible solutions for society and its individuals using a technical mindset. 
  • What “Responsible & Trustworthy AI” means to Isabel 
  • The 5 core values that make up the acronym, R-H-I-T-E, and why they’re important for designing and building products & services.
  • Isabel's advice for organizations as they approach AI risk assessments, analysis, & remediation 
  • The steps orgs can take in order to  build responsible AI products & services
  • What Isabel hopes to accomplish through Rhite's new framework: SARAI® (for AI maturity), an open source AI Self-Assessment Tool and Framework, and an extension the Privacy Library Of Threats 4 Artificial Intelligence (PLOT4ai) Framework (i.e., a library of AI risks)
  • What motivated Isabel to focus on threat modeling for privacy
  • How PLOT4ai builds on LINDDUN (which focuses on software development) and extends threat modeling to the AI lifecycle stages: Design, Input, Modeling, & Output
  • How Isabel’s experience with the LINDDUN Go card game inspired her to develop of a PLOT4ai card game to make it more accessible to teams.
  • Isabel calls for collaborators to contribute to the PLOT4ai open source database of AI threats as the community grows.

Resources Mentioned:

Guest Info:

Send a text



Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J Farber / Isabel Barberá Buzzsprout-13838867 Tue, 07 Nov 2023 06:00:00 -0800 3003 privacy by design, privacy threat modeling, AI threat modeling, Rhite, PLOT4ai 2 34 full true S2E33: "Using Privacy Code Scans to Shift Left into DevOps" with Vaibhav Antil (Privado) S2E33: "Using Privacy Code Scans to Shift Left into DevOps" with Vaibhav Antil (Privado) This week, I sat down with Vaibhav Antil ('Vee'), Co-founder & CEO at Privado, a privacy tech platform that's leverages privacy code scanning & data mapping to bridge the privacy engineering gap.  Vee shares his personal journey into privacy, where he started out in Product Management and saw need for privacy automation in DevOps. We discuss obstacles created by the rapid pace of engineering teams and a lack of a shared vocabulary with Legal / GRC. You'll learn how code scanning enables privacy teams to move swiftly and avoid blocking engineering. We then discuss the future of privacy engineering, its growth trends, and the need for cross-team collaboration. We highlight the importance of making privacy-by-design programmatic and discuss ways to scale up privacy reviews without stifling product innovation. 

Topics Covered:

  • How Vee moved from Product Manager to Co-Founding Privado, and why he focused on bringing Privacy Code Scanning to market.
  • What it means to "Bridge the Privacy Engineering Gap" and 3 reasons why Vee believes the gap exists.
  • How engineers can provide visibility into personal data collected and used by applications via Privacy Code Scans.
  • Why engineering teams should 'shift privacy left' into DevOps.
  • How a Privacy Code Scanner differs from traditional static code analysis tools in security.
  • How Privado's Privacy Code Scanning & Data Mapping capabilities (for the SDLC) differ from personal data discovery, correlation, & data mapping tools (for the data lifecycle).
  • How Privacy Code Scanning helps engineering teams comply with new laws like Washington State's 'My Health My Data Act.'
  • A breakdown of  Privado’s FREE "Technical Privacy Masterclass."
  • Exciting features on Privado’s roadmap, which support its vision to be the platform for collaboration between privacy operations & engineering teams.
  • Privacy engineering  trends and Vee’s predictions for the next two years. 

Privado Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week, I sat down with Vaibhav Antil ('Vee'), Co-founder & CEO at Privado, a privacy tech platform that's leverages privacy code scanning & data mapping to bridge the privacy engineering gap.  Vee shares his personal journey into privacy, where he started out in Product Management and saw need for privacy automation in DevOps. We discuss obstacles created by the rapid pace of engineering teams and a lack of a shared vocabulary with Legal / GRC. You'll learn how code scanning enables privacy teams to move swiftly and avoid blocking engineering. We then discuss the future of privacy engineering, its growth trends, and the need for cross-team collaboration. We highlight the importance of making privacy-by-design programmatic and discuss ways to scale up privacy reviews without stifling product innovation. 

Topics Covered:

  • How Vee moved from Product Manager to Co-Founding Privado, and why he focused on bringing Privacy Code Scanning to market.
  • What it means to "Bridge the Privacy Engineering Gap" and 3 reasons why Vee believes the gap exists.
  • How engineers can provide visibility into personal data collected and used by applications via Privacy Code Scans.
  • Why engineering teams should 'shift privacy left' into DevOps.
  • How a Privacy Code Scanner differs from traditional static code analysis tools in security.
  • How Privado's Privacy Code Scanning & Data Mapping capabilities (for the SDLC) differ from personal data discovery, correlation, & data mapping tools (for the data lifecycle).
  • How Privacy Code Scanning helps engineering teams comply with new laws like Washington State's 'My Health My Data Act.'
  • A breakdown of  Privado’s FREE "Technical Privacy Masterclass."
  • Exciting features on Privado’s roadmap, which support its vision to be the platform for collaboration between privacy operations & engineering teams.
  • Privacy engineering  trends and Vee’s predictions for the next two years. 

Privado Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J Farber / Vaibhav Antil Buzzsprout-13838702 Tue, 31 Oct 2023 06:00:00 -0700 3366 DevPrivOps, shift privacy left, privacy code scanning 2 33 full false S2E32: "Privacy Red Teams, Protecting People & 23andme's Data Leak" with Rebecca Balebako (Balebako Privacy Engineer) S2E32: "Privacy Red Teams, Protecting People & 23andme's Data Leak" with Rebecca Balebako (Balebako Privacy Engineer) This week’s guest is Rebecca Balebako,  Founder and Principal Consultant at Balebako Privacy Engineer, where she enables data-driven organizations to build the privacy features that their customers love. In our conversation, we discuss all things privacy red teaming, including: how to disambiguate adversarial privacy tests from other software development tests; the importance of privacy-by-infrastructure; why privacy maturity influences the benefits received from investing in privacy red teaming; and why any database that identifies vulnerable populations should consider adversarial privacy as a form of protection.

We also discuss the 23andMe security incident that took place in October 2023 and affected over 1 mil Ashkenazi Jews (a genealogical ethnic group). Rebecca brings to light how Privacy Red Teaming and privacy threat modeling may have prevented this incident.  As we wrap up the episode, Rebecca gives her advice to Engineering Managers looking to set up a Privacy Red Team and shares key resources.

Topics Covered:

  • How Rebecca switched from software development to a focus on privacy & adversarial privacy testing
  • What motivated Debra to shift left from her legal training to privacy engineering
  • What 'adversarial privacy tests' are; why they're important; and how they differ from other software development tests
  • Defining 'Privacy Red Teams' (a type of adversarial privacy test) & what differentiates them from 'Security Red Teams'
  • Why Privacy Red Teams are best for orgs with mature privacy programs
  • The 3 steps for conducting a Privacy Red Team attack
  • How a Red Team differs from other privacy tests like conducting a vulnerability analysis or managing a bug bounty program
  • How 23andme's recent data leak, affecting 1 mil Ashkanazi Jews, may have been avoided via Privacy Red Team testing
  • How BigTech companies are staffing up their Privacy Red Teams
  • Frugal ways for small and mid-sized organizations to approach adversarial privacy testing
  • The future of Privacy Red Teaming and whether we should upskill security engineers or train privacy engineers on adversarial testing
  • Advice for Engineer Managers who seek to set up a Privacy Red Team for the first time
  • Rebecca's Red Teaming resources for the audience

Resources Mentioned:

Guest Info:


Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week’s guest is Rebecca Balebako,  Founder and Principal Consultant at Balebako Privacy Engineer, where she enables data-driven organizations to build the privacy features that their customers love. In our conversation, we discuss all things privacy red teaming, including: how to disambiguate adversarial privacy tests from other software development tests; the importance of privacy-by-infrastructure; why privacy maturity influences the benefits received from investing in privacy red teaming; and why any database that identifies vulnerable populations should consider adversarial privacy as a form of protection.

We also discuss the 23andMe security incident that took place in October 2023 and affected over 1 mil Ashkenazi Jews (a genealogical ethnic group). Rebecca brings to light how Privacy Red Teaming and privacy threat modeling may have prevented this incident.  As we wrap up the episode, Rebecca gives her advice to Engineering Managers looking to set up a Privacy Red Team and shares key resources.

Topics Covered:

  • How Rebecca switched from software development to a focus on privacy & adversarial privacy testing
  • What motivated Debra to shift left from her legal training to privacy engineering
  • What 'adversarial privacy tests' are; why they're important; and how they differ from other software development tests
  • Defining 'Privacy Red Teams' (a type of adversarial privacy test) & what differentiates them from 'Security Red Teams'
  • Why Privacy Red Teams are best for orgs with mature privacy programs
  • The 3 steps for conducting a Privacy Red Team attack
  • How a Red Team differs from other privacy tests like conducting a vulnerability analysis or managing a bug bounty program
  • How 23andme's recent data leak, affecting 1 mil Ashkanazi Jews, may have been avoided via Privacy Red Team testing
  • How BigTech companies are staffing up their Privacy Red Teams
  • Frugal ways for small and mid-sized organizations to approach adversarial privacy testing
  • The future of Privacy Red Teaming and whether we should upskill security engineers or train privacy engineers on adversarial testing
  • Advice for Engineer Managers who seek to set up a Privacy Red Team for the first time
  • Rebecca's Red Teaming resources for the audience

Resources Mentioned:

Guest Info:


Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber (Shifting Privacy Left) Buzzsprout-13816051 Tue, 24 Oct 2023 06:00:00 -0700 2938 2 32 full false S2E31: "Leveraging a Privacy Ontology to Scale Privacy Processes" with Steve Hickman (Epistimis) S2E31: "Leveraging a Privacy Ontology to Scale Privacy Processes" with Steve Hickman (Epistimis) This week’s guest is Steve Hickman, the founder of Epistimis, a privacy-first process design tooling startup that evaluate rules and enables the fixing of privacy issues before they ever take effect. In our conversation, we discuss: why the biggest impediment to protecting and respecting privacy within organizations is the lack of a common language; why we need a common Privacy Ontology in addition to a Privacy Taxonomy; Epistimis' ontological approach and how it leverages semantic modeling for privacy rules checking; and, examples of how Epistimis Privacy Design Process tooling complements privacy tech solutions on the market, not compete with them.

Topics Covered:

  • How Steve’s deep engineering background in aerospace, retail, telecom, and then a short stint at Meta, led him to found Epistimis 
  • Why its been hard for companies to get privacy right at scale
  • How Epistimis leverages 'semantic modeling' for rule checking and how this helps to scale privacy as part of an ontological approach
  • The definition of a Privacy Ontology and Steve's belief that all should use one for common understanding at all levels of the business
  • Advice for designers, architects, and developers when it comes to creating and implementing privacy ontology, taxonomies & semantic models
  • How to make a Privacy Ontology usable
  • How Epistimis' process design tooling work with discovery and mapping platforms like BigID & Secuvy.ai
  • How Epistimis' process design tooling work along with a platform like Privado.ai, which scans a company's product code and then surfaces privacy risks in the code and detects processing activities for creating dynamic data maps
  • How Epistimis' process design tooling works with PrivacyCode, which has a library of privacy objects, agile privacy implementations (e.g., success criteria & sample code), and delivers metrics on the privacy engineering process is going
  • Steve calls for collaborators who are interested in POCs and/or who can provide feedback on Epistimis' PbD processing tooling
  • Steve describes what's next on the Epistimis roadmap, including wargaming

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week’s guest is Steve Hickman, the founder of Epistimis, a privacy-first process design tooling startup that evaluate rules and enables the fixing of privacy issues before they ever take effect. In our conversation, we discuss: why the biggest impediment to protecting and respecting privacy within organizations is the lack of a common language; why we need a common Privacy Ontology in addition to a Privacy Taxonomy; Epistimis' ontological approach and how it leverages semantic modeling for privacy rules checking; and, examples of how Epistimis Privacy Design Process tooling complements privacy tech solutions on the market, not compete with them.

Topics Covered:

  • How Steve’s deep engineering background in aerospace, retail, telecom, and then a short stint at Meta, led him to found Epistimis 
  • Why its been hard for companies to get privacy right at scale
  • How Epistimis leverages 'semantic modeling' for rule checking and how this helps to scale privacy as part of an ontological approach
  • The definition of a Privacy Ontology and Steve's belief that all should use one for common understanding at all levels of the business
  • Advice for designers, architects, and developers when it comes to creating and implementing privacy ontology, taxonomies & semantic models
  • How to make a Privacy Ontology usable
  • How Epistimis' process design tooling work with discovery and mapping platforms like BigID & Secuvy.ai
  • How Epistimis' process design tooling work along with a platform like Privado.ai, which scans a company's product code and then surfaces privacy risks in the code and detects processing activities for creating dynamic data maps
  • How Epistimis' process design tooling works with PrivacyCode, which has a library of privacy objects, agile privacy implementations (e.g., success criteria & sample code), and delivers metrics on the privacy engineering process is going
  • Steve calls for collaborators who are interested in POCs and/or who can provide feedback on Epistimis' PbD processing tooling
  • Steve describes what's next on the Epistimis roadmap, including wargaming

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Steve Hickman Buzzsprout-13702869 Tue, 10 Oct 2023 06:00:00 -0700 3095 privacy ontology, privacy taxonomy, privacy by design, privacy design process, PbD, scaling privacy 2 31 full false S2E30: "LLMs, Knowledge Graphs, & GenAI Architectural Considerations" with Shashank Tiwari (Uno) S2E30: "LLMs, Knowledge Graphs, & GenAI Architectural Considerations" with Shashank Tiwari (Uno) This week's guest is Shashank Tiwari, a seasoned engineer and product leader who started with algorithmic systems of Wall Street before becoming Co-founder & CEO of Uno.ai, a pathbreaking autonomous security company. He started with algorithmic systems on Wall Street and then transitioned to building Silicon Valley startups, including previous stints at Nutanix, Elementum, Medallia, & StackRox. In this conversation, we discuss ML/AI, large language models (LLMs), temporal knowledge graphs, causal discovery inference models, and the Generative AI design & architectural choices that affect privacy. 

Topics Covered:

  • Shashank describes his origin story, how he became interested in security, privacy, & AI while working on Wall Street; & what motivated him to found Uno
  • The benefits to using "temporal knowledge graphs," and how knowledge graphs are used with LLMs to create a "causal discovery inference model" to prevent privacy problems
  • The explosive growth of Generative AI, it's impact on the privacy and confidentiality of sensitive and personal data, & why a rushed approach could result in mistakes and societal harm  
  • Architectural privacy and security considerations for: 1) leveraging  Generative AI, and those to avoid certain mechanisms at all costs; 2) verifying, assuring, & testing against "trustful data" rather than "derived data;" and 3) thwarting common Generative AI attack vectors
  • Shashank's predictions for Enterprise adoption of Generative AI over the next several years
  • Shashank's thoughts on proposed and future AI-related legislation may affect the Generative AI market overall and Enterprise adoption more specifically
  • Shashank's thoughts on the development of AI standards across tech stacks

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week's guest is Shashank Tiwari, a seasoned engineer and product leader who started with algorithmic systems of Wall Street before becoming Co-founder & CEO of Uno.ai, a pathbreaking autonomous security company. He started with algorithmic systems on Wall Street and then transitioned to building Silicon Valley startups, including previous stints at Nutanix, Elementum, Medallia, & StackRox. In this conversation, we discuss ML/AI, large language models (LLMs), temporal knowledge graphs, causal discovery inference models, and the Generative AI design & architectural choices that affect privacy. 

Topics Covered:

  • Shashank describes his origin story, how he became interested in security, privacy, & AI while working on Wall Street; & what motivated him to found Uno
  • The benefits to using "temporal knowledge graphs," and how knowledge graphs are used with LLMs to create a "causal discovery inference model" to prevent privacy problems
  • The explosive growth of Generative AI, it's impact on the privacy and confidentiality of sensitive and personal data, & why a rushed approach could result in mistakes and societal harm  
  • Architectural privacy and security considerations for: 1) leveraging  Generative AI, and those to avoid certain mechanisms at all costs; 2) verifying, assuring, & testing against "trustful data" rather than "derived data;" and 3) thwarting common Generative AI attack vectors
  • Shashank's predictions for Enterprise adoption of Generative AI over the next several years
  • Shashank's thoughts on proposed and future AI-related legislation may affect the Generative AI market overall and Enterprise adoption more specifically
  • Shashank's thoughts on the development of AI standards across tech stacks

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Shashank Tiwari Buzzsprout-13680455 Tue, 03 Oct 2023 06:00:00 -0700 3619 generative AI, GenAI, knowledge graphs, causal inference, AI, LLMs, trustful data 2 30 full false S2E29 - "Synthetic Data in AI: Challenges, Techniques & Use Cases" with Andrew Clark and Sid Mangalik (Monitaur) S2E29 - "Synthetic Data in AI: Challenges, Techniques & Use Cases" with Andrew Clark and Sid Mangalik (Monitaur) This week I welcome Dr. Andrew Clark, Co-founder & CTO of Monitaur, a trusted domain expert on the topic of machine learning, auditing and assurance; and Sid Mangalik, Research Scientist at Monitaur and PhD student at Stony Brook University. I discovered Andrew and Sid's new podcast show, The AI Fundamentalists Podcast. I very much enjoyed their lively episode on Synthetic Data & AI, and am delighted to introduce them to my audience of privacy engineers.

In our conversation, we explore why data scientists must stress test their model validations, especially for consequential systems that affect human safety and reliability. In fact, we have much to learn from the aerospace engineering field who has been using ML/AI since the 1960s. We discuss the best and worst use cases for using synthetic data'; problems with LLM-generated synthetic data; what can go wrong when your AI models lack diversity; how to build fair, performant systems; & synthetic data techniques for use with AI.

Topics Covered:

  • What inspired Andrew to found Monitaur and focus on AI governance
  • Sid’s career path and his current PhD focus on NLP
  • What motivated Andrew & Sid to launch their podcast, The AI Fundamentalists
  • Defining 'synthetic data' & why academia takes a more rigorous approach to synthetic data than industry
  • Whether the output of LLMs are synthetic data & the problem with training LLM base models with this data
  • The best and worst 'synthetic data' use cases for ML/AI
  • Why the 'quality' of input data is so important when training AI models 
  • Thoughts on OpenAI's announcement that it will use LLM-generated synthetic data; and critique of OpenAI's approach, the AI hype machine, and the problems with 'growth hacking' corner-cutting
  • The importance of diversity when training AI models; using 'multi-objective modeling' for building fair & performant systems
  • Andrew unpacks the "fairness through unawareness fallacy"
  • How 'randomized data' differs from 'synthetic data'
  • 4 techniques for using synthetic data with ML/AI: 1) the Monte Carlo method; 2) Latin hypercube sampling; 3) gaussian copulas; & 4) random walking
  • What excites Andrew & Sid about synthetic data and how it will be used with AI in the future

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week I welcome Dr. Andrew Clark, Co-founder & CTO of Monitaur, a trusted domain expert on the topic of machine learning, auditing and assurance; and Sid Mangalik, Research Scientist at Monitaur and PhD student at Stony Brook University. I discovered Andrew and Sid's new podcast show, The AI Fundamentalists Podcast. I very much enjoyed their lively episode on Synthetic Data & AI, and am delighted to introduce them to my audience of privacy engineers.

In our conversation, we explore why data scientists must stress test their model validations, especially for consequential systems that affect human safety and reliability. In fact, we have much to learn from the aerospace engineering field who has been using ML/AI since the 1960s. We discuss the best and worst use cases for using synthetic data'; problems with LLM-generated synthetic data; what can go wrong when your AI models lack diversity; how to build fair, performant systems; & synthetic data techniques for use with AI.

Topics Covered:

  • What inspired Andrew to found Monitaur and focus on AI governance
  • Sid’s career path and his current PhD focus on NLP
  • What motivated Andrew & Sid to launch their podcast, The AI Fundamentalists
  • Defining 'synthetic data' & why academia takes a more rigorous approach to synthetic data than industry
  • Whether the output of LLMs are synthetic data & the problem with training LLM base models with this data
  • The best and worst 'synthetic data' use cases for ML/AI
  • Why the 'quality' of input data is so important when training AI models 
  • Thoughts on OpenAI's announcement that it will use LLM-generated synthetic data; and critique of OpenAI's approach, the AI hype machine, and the problems with 'growth hacking' corner-cutting
  • The importance of diversity when training AI models; using 'multi-objective modeling' for building fair & performant systems
  • Andrew unpacks the "fairness through unawareness fallacy"
  • How 'randomized data' differs from 'synthetic data'
  • 4 techniques for using synthetic data with ML/AI: 1) the Monte Carlo method; 2) Latin hypercube sampling; 3) gaussian copulas; & 4) random walking
  • What excites Andrew & Sid about synthetic data and how it will be used with AI in the future

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Andrew Clark and Sid Mangalik Buzzsprout-13634980 Tue, 26 Sep 2023 06:00:00 -0700 3272 synthetic data, multi-objective modeling, model validation, stress testing, consequential systems 2 29 full false S2E28: "BigTech Privacy; Responsible AI; and Bias Bounties at DEF CON" with Jutta Williams (Reddit) S2E28: "BigTech Privacy; Responsible AI; and Bias Bounties at DEF CON" with Jutta Williams (Reddit) This week, I welcome Jutta Williams, Head of Privacy & Assurance at Reddit, Co-founder of Humane Intelligence and BiasBounty.ai, Privacy & Responsible AI Evangelist, and Startup Board Advisor. With a long history of accomplishments in privacy engineering, Jutta has a unique perspective on the growing field.

In our conversation, we discuss her transition from security engineering to privacy engineering; how privacy cultures differ across social media companies where she's worked: Google, Facebook, Twitter, and now Reddit; the overlap of the privacy engineering & responsible AI; how her non-profit, Humane Intelligence, supports AI model owners; her experience launching the largest Generative AI Red Teaming challenge ever at DEF CON; and, how a curious knowledge-enhancing approach to privacy will create engagement and allow for fun.

Topics Covered:

  • How Jutta’s unique transition from security engineering landed her in the privacy engineering space. 
  • A comparison of privacy cultures across Google, Facebook, Twitter (now 'X'), and Reddit based on her privacy engineering experiences there.
  • Two open Privacy Engineering roles at Reddit, and Jutta's advice for those wanting to transition from security engineering to privacy engineering.
  • Whether Privacy Pros will be responsible for owning new regulatory obligations under the EU's Digital Services Act (DSA) & the Digital Markets Act (DMA); and the role of the Privacy Engineer when overlapping with Responsible AI issues
  • Humane Intelligence,  Jutta's 'side quest,' which she co-leads with Dr. Rumman Chowdhury, and supports AI model owners seeking 'Product Readiness Reviews' at scale.
  • When, during the product development life cycle, companies should perform 'AI Readiness Reviews'
  • How to de-biased at scale or whether attempting to do so is 'chasing windmills'
  • Who should be hunting for biases in an AI Bias Bounty challenge
  • DEF CON 31's AI Village's 'Generative AI Red Teaming Challenge,' which was a bias bounty that she co-designed; lessons learned; and what Jutta & team have planned for DEF CON 32 next year
  • Why it's so important for people to 'love their side quests'


Resources Mentioned:


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week, I welcome Jutta Williams, Head of Privacy & Assurance at Reddit, Co-founder of Humane Intelligence and BiasBounty.ai, Privacy & Responsible AI Evangelist, and Startup Board Advisor. With a long history of accomplishments in privacy engineering, Jutta has a unique perspective on the growing field.

In our conversation, we discuss her transition from security engineering to privacy engineering; how privacy cultures differ across social media companies where she's worked: Google, Facebook, Twitter, and now Reddit; the overlap of the privacy engineering & responsible AI; how her non-profit, Humane Intelligence, supports AI model owners; her experience launching the largest Generative AI Red Teaming challenge ever at DEF CON; and, how a curious knowledge-enhancing approach to privacy will create engagement and allow for fun.

Topics Covered:

  • How Jutta’s unique transition from security engineering landed her in the privacy engineering space. 
  • A comparison of privacy cultures across Google, Facebook, Twitter (now 'X'), and Reddit based on her privacy engineering experiences there.
  • Two open Privacy Engineering roles at Reddit, and Jutta's advice for those wanting to transition from security engineering to privacy engineering.
  • Whether Privacy Pros will be responsible for owning new regulatory obligations under the EU's Digital Services Act (DSA) & the Digital Markets Act (DMA); and the role of the Privacy Engineer when overlapping with Responsible AI issues
  • Humane Intelligence,  Jutta's 'side quest,' which she co-leads with Dr. Rumman Chowdhury, and supports AI model owners seeking 'Product Readiness Reviews' at scale.
  • When, during the product development life cycle, companies should perform 'AI Readiness Reviews'
  • How to de-biased at scale or whether attempting to do so is 'chasing windmills'
  • Who should be hunting for biases in an AI Bias Bounty challenge
  • DEF CON 31's AI Village's 'Generative AI Red Teaming Challenge,' which was a bias bounty that she co-designed; lessons learned; and what Jutta & team have planned for DEF CON 32 next year
  • Why it's so important for people to 'love their side quests'


Resources Mentioned:


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Jutta Williams Buzzsprout-13507510 Tue, 19 Sep 2023 06:00:00 -0700 3297 bias bounty, bias bounties, red teaming, privacy engineer, privacy engineering, responsible AI, ethical AI, trust 2 28 full false S2E27: "Automated Privacy Decisions: Usability vs. Lawfulness" with Simone Fischer-Hübner & Victor Morel S2E27: "Automated Privacy Decisions: Usability vs. Lawfulness" with Simone Fischer-Hübner & Victor Morel Today, I welcome Victor Morel, PhD and Simone Fischer-Hübner, PhD to discuss their recent paper, "Automating Privacy Decisions – where to draw the line?" and their proposed classification scheme. We dive into the complexity of automating privacy decisions and emphasize the importance of maintaining both compliance and usability (e.g., via user control and informed consent). Simone is a Professor of Computer Science at Karlstad University with over 30 years of privacy & security research experience. Victor is a post-doc researcher at Chalmers University's Security & Privacy Lab, focusing on privacy, data protection, and technology ethics.

Together, they share their privacy decision-making classification scheme and research across two dimensions: (1) the type of privacy decisions: privacy permissions, privacy preference settings, consent to processing, or rejection to processing; and (2) the level of decision automation: manual, semi-automated, or fully-automated. Each type of privacy decision plays a critical role in users' ability to control the disclosure and processing of their personal data. They emphasize the significance of tailored recommendations to help users make informed decisions and discuss the potential of on-the-fly privacy decisions. We wrap up with organizations' approaches to achieving usable and transparent privacy across various technologies, including web, mobile, and IoT. 


Topics Covered:

  • Why Simone & Victor focused their research on automating privacy decisions 
  • How GDPR & ePrivacy have shaped requirements for privacy automation tools
  • The 'types' privacy decisions & associated 'levels of automation': privacy permissions, privacy preference settings, consent to processing, & rejection to processing
  • The 'levels of automation' for each privacy decision type: manual, semi-automated & fully-automated; and the pros / cons of automating each privacy decision type
  • Preferences & concerns regarding IoT Trigger Action Platforms
  • Why the only privacy decisions that you should 'fully automate' are the rejection of processing: i.e., revoking consent or opting out
  • Best practices for achieving informed control
  • Automation challenges across web, mobile, & IoT
  • Mozilla's automated cookie banner management & why it's problematic (i.e., unlawful)

Resources Mentioned:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Today, I welcome Victor Morel, PhD and Simone Fischer-Hübner, PhD to discuss their recent paper, "Automating Privacy Decisions – where to draw the line?" and their proposed classification scheme. We dive into the complexity of automating privacy decisions and emphasize the importance of maintaining both compliance and usability (e.g., via user control and informed consent). Simone is a Professor of Computer Science at Karlstad University with over 30 years of privacy & security research experience. Victor is a post-doc researcher at Chalmers University's Security & Privacy Lab, focusing on privacy, data protection, and technology ethics.

Together, they share their privacy decision-making classification scheme and research across two dimensions: (1) the type of privacy decisions: privacy permissions, privacy preference settings, consent to processing, or rejection to processing; and (2) the level of decision automation: manual, semi-automated, or fully-automated. Each type of privacy decision plays a critical role in users' ability to control the disclosure and processing of their personal data. They emphasize the significance of tailored recommendations to help users make informed decisions and discuss the potential of on-the-fly privacy decisions. We wrap up with organizations' approaches to achieving usable and transparent privacy across various technologies, including web, mobile, and IoT. 


Topics Covered:

  • Why Simone & Victor focused their research on automating privacy decisions 
  • How GDPR & ePrivacy have shaped requirements for privacy automation tools
  • The 'types' privacy decisions & associated 'levels of automation': privacy permissions, privacy preference settings, consent to processing, & rejection to processing
  • The 'levels of automation' for each privacy decision type: manual, semi-automated & fully-automated; and the pros / cons of automating each privacy decision type
  • Preferences & concerns regarding IoT Trigger Action Platforms
  • Why the only privacy decisions that you should 'fully automate' are the rejection of processing: i.e., revoking consent or opting out
  • Best practices for achieving informed control
  • Automation challenges across web, mobile, & IoT
  • Mozilla's automated cookie banner management & why it's problematic (i.e., unlawful)

Resources Mentioned:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J Farber / Simone Fischer-Hübner & Victor Morel Buzzsprout-13499257 Tue, 12 Sep 2023 06:00:00 -0700 2658 privacy usability, lawfulness, automated decisions, automated decision-making, privacy research 2 27 full false S2E26: "Building Ethical Machines" with Reid Blackman, PhD (Virtue Consultants) S2E26: "Building Ethical Machines" with Reid Blackman, PhD (Virtue Consultants) This week, I welcome philosopher, author, & AI ethics expert, Reid Blackman, Ph.D., to discuss Ethical AI. Reid authored the book, "Ethical Machines," and is the CEO & Founder of Virtue Consultants, a digital ethical risk consultancy. His extensive background in philosophy & ethics, coupled with his engagement with orgs like AWS, U.S. Bank, the FBI, & NASA, offers a unique perspective on the challenges & misconceptions surrounding AI ethics.

In our conversation, we discuss 'passive privacy' & 'active privacy' and the need for individuals to exercise control over their data. Reid explains how the quest to train data for ML/AI can lead to privacy violations, particularly for BigTech companies. We touch on many concepts in the AI space including: automated decision making vs. keeping "humans in the loop;" combating AI ethics fatigue; and advice for technical staff involved in AI product development. Reid stresses the importance of protecting privacy, educating users, & deciding whether to utilize external APIs or on-prem servers. 

We end by highlighting his HBR article - "Generative AI-xiety" - and discuss the 4 primary areas of ethical concern for LLMs: 

  1. the hallucination problem; 
  2. the deliberation problem; 
  3. the sleazy salesperson problem; & 
  4. the problem of shared responsibility

Topics Covered:

  • What motivated Reid to write his book, "Ethical Machines"
  • The key differences between 'active privacy' & 'passive privacy'
  • Why engineering incentives to collect more data to train AI models, especially in big tech, poses challenges to data minimization
  • The importance of aligning privacy agendas with business priorities
  • Why what companies infer about people can be a privacy violation; what engineers should know about 'input privacy' when training AI models; and, how that effects the output of inferred data
  • Automated decision making: when it's necessary to have a 'human in the loop'
  • Approaches for mitigating 'AI ethics fatigue'
  • The need to backup a company's stated 'values' with actions; and why there should always be 3 - 7 guardrails put in place for each stated value
  • The differences between 'Responsible AI' & 'Ethical AI,' and why companies seem reluctant to talk about ethics
  • Reid's article, "Generative AI-xiety," & the 4 main risks related to generative AI
  • Reid's advice for technical staff building products & services that leverage LLM's

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week, I welcome philosopher, author, & AI ethics expert, Reid Blackman, Ph.D., to discuss Ethical AI. Reid authored the book, "Ethical Machines," and is the CEO & Founder of Virtue Consultants, a digital ethical risk consultancy. His extensive background in philosophy & ethics, coupled with his engagement with orgs like AWS, U.S. Bank, the FBI, & NASA, offers a unique perspective on the challenges & misconceptions surrounding AI ethics.

In our conversation, we discuss 'passive privacy' & 'active privacy' and the need for individuals to exercise control over their data. Reid explains how the quest to train data for ML/AI can lead to privacy violations, particularly for BigTech companies. We touch on many concepts in the AI space including: automated decision making vs. keeping "humans in the loop;" combating AI ethics fatigue; and advice for technical staff involved in AI product development. Reid stresses the importance of protecting privacy, educating users, & deciding whether to utilize external APIs or on-prem servers. 

We end by highlighting his HBR article - "Generative AI-xiety" - and discuss the 4 primary areas of ethical concern for LLMs: 

  1. the hallucination problem; 
  2. the deliberation problem; 
  3. the sleazy salesperson problem; & 
  4. the problem of shared responsibility

Topics Covered:

  • What motivated Reid to write his book, "Ethical Machines"
  • The key differences between 'active privacy' & 'passive privacy'
  • Why engineering incentives to collect more data to train AI models, especially in big tech, poses challenges to data minimization
  • The importance of aligning privacy agendas with business priorities
  • Why what companies infer about people can be a privacy violation; what engineers should know about 'input privacy' when training AI models; and, how that effects the output of inferred data
  • Automated decision making: when it's necessary to have a 'human in the loop'
  • Approaches for mitigating 'AI ethics fatigue'
  • The need to backup a company's stated 'values' with actions; and why there should always be 3 - 7 guardrails put in place for each stated value
  • The differences between 'Responsible AI' & 'Ethical AI,' and why companies seem reluctant to talk about ethics
  • Reid's article, "Generative AI-xiety," & the 4 main risks related to generative AI
  • Reid's advice for technical staff building products & services that leverage LLM's

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Reid Blackman Buzzsprout-13483508 Tue, 05 Sep 2023 06:00:00 -0700 3101 ethical AI, ethics, responsible AI, privacy, LLMs, sleazy salesperson problem, hallucination problem, deliberation problem, shared responsibility, values, guardrails, input privacy, AI ethics fatigue 2 26 full false S2E25: "Anonymization & Deletion at Scale" with Engin Bozdag (Uber) & Stefano Bennati (HERE) S2E25: "Anonymization & Deletion at Scale" with Engin Bozdag (Uber) & Stefano Bennati (HERE) This week, we're chatting with Engin Bozdag, Senior Staff Privacy Architect at Uber, and Stefano Bennati, Privacy Engineer at HERE Technologies. Today, we explore their recent IWPE'23 talk, "Can Location Data Truly be Anonymized: a risk-based approach to location data anonymization" and discuss the technical & business challenges to obtain anonymization. We also discuss the role of Privacy Engineers, how to choose a career path, and the importance of embedding privacy into product development & DevPrivOps; collaborating with cross-functional teams; & staying up-to-date with emerging trends.


Topics Covered:

  • Common roadblocks privacy engineers face with anonymization techniques & how to overcome them
  • How to get budgets for anonymization tools; challenges with scaling & regulatory requirements & how to overcome them
  • What it means to be a 'Privacy Engineer' today; good career paths; and necessary skill sets
  • How third-party data deletion tools can be integrated into a company's distributed architecture
  • What Privacy Engineers should understand about vendor privacy requirements for LLMs before bringing them into their orgs
  • The need to monitor code changes in data or source code via code scanning; how HERE Technologies uses Privado to monitor the compliance of its products & data lineage; and how Privado detects new assets added to your inventory & any new API endpoints
  • Advice on how to deal with conflicts between engineering, legal & operations teams and hon how to get privacy issues fixed within an org
  • Strategies for addressing privacy issues within orgs, including collaboration, transparency, and continuous refinement


Resources Mentioned:


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week, we're chatting with Engin Bozdag, Senior Staff Privacy Architect at Uber, and Stefano Bennati, Privacy Engineer at HERE Technologies. Today, we explore their recent IWPE'23 talk, "Can Location Data Truly be Anonymized: a risk-based approach to location data anonymization" and discuss the technical & business challenges to obtain anonymization. We also discuss the role of Privacy Engineers, how to choose a career path, and the importance of embedding privacy into product development & DevPrivOps; collaborating with cross-functional teams; & staying up-to-date with emerging trends.


Topics Covered:

  • Common roadblocks privacy engineers face with anonymization techniques & how to overcome them
  • How to get budgets for anonymization tools; challenges with scaling & regulatory requirements & how to overcome them
  • What it means to be a 'Privacy Engineer' today; good career paths; and necessary skill sets
  • How third-party data deletion tools can be integrated into a company's distributed architecture
  • What Privacy Engineers should understand about vendor privacy requirements for LLMs before bringing them into their orgs
  • The need to monitor code changes in data or source code via code scanning; how HERE Technologies uses Privado to monitor the compliance of its products & data lineage; and how Privado detects new assets added to your inventory & any new API endpoints
  • Advice on how to deal with conflicts between engineering, legal & operations teams and hon how to get privacy issues fixed within an org
  • Strategies for addressing privacy issues within orgs, including collaboration, transparency, and continuous refinement


Resources Mentioned:


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J Farber / Engin Bozdag & Stefano Bennati Buzzsprout-13424366 Tue, 29 Aug 2023 06:00:00 -0700 3014 anonymization, anonymized, privacy engineer, privacy architect, LLMs, AI, Privado, code scanning, DevPrivOps, vendor privacy, HERE Technologies, Uber 2 25 full false S2E24: "Cloud-Native Privacy Engineering via DevPrivOps" with Elias Grünewald (TU Berlin) S2E24: "Cloud-Native Privacy Engineering via DevPrivOps" with Elias Grünewald (TU Berlin) This week’s guest is Elias Grünewald, Privacy Engineering Research Associate at Technical University, Berlin, where he focuses on cloud-native privacy engineering, transparency, accountability, distributed systems, & privacy regulation. 

In this conversation, we discuss the challenge of designing privacy into modern cloud architectures; how shifting left into DevPrivOps can embed privacy within agile development methods; how to blend privacy engineering & cloud engineering; the Hawk DevOps Framework; and what the Shared Responsibilities Model for cloud lacks. 

Topics Covered:

  • Elias's courses at TU Berlin: "Programming Practical Privacy: Web-based Application Engineering & Data Management" & "Advanced Distributed Systems Prototyping: Cloud-native Privacy Engineering"
  • Elias' 2022 paper, "Cloud Native Privacy Engineering through DevPrivOps" - his approach, findings, and framework
  • The Shared Responsibilities Model for cloud and how to improve it to account for privacy goals
  • Defining DevPrivOps & how it works with agile development
  • How DevPrivOps can enable formal privacy-by-design (PbD) & default strategies
  • Elias' June 2023 paper, "Hawk: DevOps-Driven Transparency & Accountability in Cloud Native Systems," which helps data controllers align cloud-native DevOps with regulatory requirements for transparency & accountability
  • Engineering challenges when trying to determine the details of personal data processing when responding to access & deletion requests
  • A deep-dive into the Hawk 3-phase approach for implementing privacy into each DevOps phase: Hawk Release; Hawk Operate; & Hawk Monitor
  • How open sourced project, TOUCAN, is documenting conceptual best practices for corresponding phases in the SDLC, and a call for collaboration
  • How privacy engineers can convince their management to adopt a DevPrivOps approach


Read Elias' papers, talks, & projects:


Guest Info:


Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week’s guest is Elias Grünewald, Privacy Engineering Research Associate at Technical University, Berlin, where he focuses on cloud-native privacy engineering, transparency, accountability, distributed systems, & privacy regulation. 

In this conversation, we discuss the challenge of designing privacy into modern cloud architectures; how shifting left into DevPrivOps can embed privacy within agile development methods; how to blend privacy engineering & cloud engineering; the Hawk DevOps Framework; and what the Shared Responsibilities Model for cloud lacks. 

Topics Covered:

  • Elias's courses at TU Berlin: "Programming Practical Privacy: Web-based Application Engineering & Data Management" & "Advanced Distributed Systems Prototyping: Cloud-native Privacy Engineering"
  • Elias' 2022 paper, "Cloud Native Privacy Engineering through DevPrivOps" - his approach, findings, and framework
  • The Shared Responsibilities Model for cloud and how to improve it to account for privacy goals
  • Defining DevPrivOps & how it works with agile development
  • How DevPrivOps can enable formal privacy-by-design (PbD) & default strategies
  • Elias' June 2023 paper, "Hawk: DevOps-Driven Transparency & Accountability in Cloud Native Systems," which helps data controllers align cloud-native DevOps with regulatory requirements for transparency & accountability
  • Engineering challenges when trying to determine the details of personal data processing when responding to access & deletion requests
  • A deep-dive into the Hawk 3-phase approach for implementing privacy into each DevOps phase: Hawk Release; Hawk Operate; & Hawk Monitor
  • How open sourced project, TOUCAN, is documenting conceptual best practices for corresponding phases in the SDLC, and a call for collaboration
  • How privacy engineers can convince their management to adopt a DevPrivOps approach


Read Elias' papers, talks, & projects:


Guest Info:


Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J Farber / Elias Grünewald Buzzsprout-13424374 Tue, 22 Aug 2023 06:00:00 -0700 3859 DevPrivOps, DevOps, cloud native, cloud privacy 2 24 full false S2E23: "Navigating the Privacy Engineering Job Market" with George Ratcliffe (Stott & May) S2E23: "Navigating the Privacy Engineering Job Market" with George Ratcliffe (Stott & May) This week, my guest is George Ratcliffe, Head of the Privacy GRC & Cryptography Executive Search Practice at recruitment firm, Stott & May.

In this conversation, we discuss the current market climate & hiring trends for technical privacy roles; the need for higher technical capabilities across the industry;  pay ranges within different technical privacy roles; and George’s tips and tools for applicants interested in, entering, and/or transitioning into the privacy industry. 


Topics Covered:

  • Whether the hiring trends are picking back up for technical privacy roles
  • The three 'Privacy Engineering' roles that companies seek to hire for and core competencies: Privacy Engineer, Privacy Software Engineer, & Privacy Research Engineer
  • The demand for 'Privacy Architects'
  • IAPP's new Privacy Engineering infographic & if it maps with how companies approach hiring 
  • Overall hiring trends for privacy engineers & technical privacy roles
  • Advice technologists who want to grow into Privacy Engineer, Researcher, or Architect roles
  • Capabilities that companies need or want in candidates that they can't seem to find; & whether there are roles that are harder to fill because of a lack of candidates & skill sets
  • Whether a PhD is necessary to become a 'Privacy Research Engineer'
  • Typical pay ranges across technical privacy roles: Privacy Engineer, Privacy Software Engineer, Privacy Researcher, Privacy Architect
  • Differences in pay for a Privacy Engineering Manager vs an Independent Contributor (IC) and the web apps for crowd-sourced info about roles & salary ranges
  • Whether companies seek to fill entry level positions for technical privacy roles
  • How privacy technologists can stay up-to-date on hiring trends


Resources Mentioned:


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week, my guest is George Ratcliffe, Head of the Privacy GRC & Cryptography Executive Search Practice at recruitment firm, Stott & May.

In this conversation, we discuss the current market climate & hiring trends for technical privacy roles; the need for higher technical capabilities across the industry;  pay ranges within different technical privacy roles; and George’s tips and tools for applicants interested in, entering, and/or transitioning into the privacy industry. 


Topics Covered:

  • Whether the hiring trends are picking back up for technical privacy roles
  • The three 'Privacy Engineering' roles that companies seek to hire for and core competencies: Privacy Engineer, Privacy Software Engineer, & Privacy Research Engineer
  • The demand for 'Privacy Architects'
  • IAPP's new Privacy Engineering infographic & if it maps with how companies approach hiring 
  • Overall hiring trends for privacy engineers & technical privacy roles
  • Advice technologists who want to grow into Privacy Engineer, Researcher, or Architect roles
  • Capabilities that companies need or want in candidates that they can't seem to find; & whether there are roles that are harder to fill because of a lack of candidates & skill sets
  • Whether a PhD is necessary to become a 'Privacy Research Engineer'
  • Typical pay ranges across technical privacy roles: Privacy Engineer, Privacy Software Engineer, Privacy Researcher, Privacy Architect
  • Differences in pay for a Privacy Engineering Manager vs an Independent Contributor (IC) and the web apps for crowd-sourced info about roles & salary ranges
  • Whether companies seek to fill entry level positions for technical privacy roles
  • How privacy technologists can stay up-to-date on hiring trends


Resources Mentioned:


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / George Ratcliffe Buzzsprout-13395029 Tue, 15 Aug 2023 12:00:00 -0700 2772 privacy engineer, privacy engineering, job market, hiring trends, privacy architect, privacy software engineer 2 23 full false S2E22: Why You Need an 'Outside-In' Approach to Privacy Risk Monitoring with Sanjay Saini (Privaini) S2E22: Why You Need an 'Outside-In' Approach to Privacy Risk Monitoring with Sanjay Saini (Privaini) Get ready for an eye-opening conversation with Sanjay Saini, the founder and CEO of Privaini, a groundbreaking privacy tech company. Sanjay's journey is not only impressive due to his role in creating high-performance teams that have built entirely new product categories, but also for the invaluable lessons he learned from his grandfather about the pillars of successful companies - trust and human connections. In our discussion, Sanjay shares how Privaini is raising the privacy bar by constructing the world's largest repository of company privacy policies and practices. It's a fascinating dive into the future of privacy risk management.

Imagine being able to gain full coverage of your external privacy risks with continuous monitoring. Wouldn't that revolutionize your approach to risk management? That's exactly what Privaini is doing! Sanjay explains how Privaini utilizes AI to analyze, standardize, and derive meaningful "privacy views" and insights from vast volumes of publicly-available data. Listen in to understand how Privaini's innovative approach is helping companies gain visibility into their entire business network to make quicker, more informed decisions.

Topics Covered:

  • What motivated Sanjay to found companies that bring trusted systems to market and why he founded Privaini  to  focus on continuous privacy risk monitoring
  • How to quantitatively analyze & monitor privacy risk throughout an entire 'business network' and what Sanjay means by 'business network'
  • Which stakeholders benefit from using the Privaini platform
  • The benefits to calculating a "quantified privacy risk score" for each company in your business network to effectively monitor privacy risk
  • How Privaini leverages AI to discover external data about companies' privacy posture and why it must be used in a responsible and deliberate way
  • Why effective privacy risk monitoring of a company's business network requires an “outside-in” approach
  • The importance of continuous monitoring & the benefits to using an 'outside-in' approach
  • What it takes to set up an enterprise's network with Privaini for full coverage of external privacy risks
  • The recent Criteo fines and how Privaini could have helped Criteo surface privacy risks about its vendors
  • Why Sanjay believes learning about the “right side” of the equation is necessary in order to "shift privacy left."


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Get ready for an eye-opening conversation with Sanjay Saini, the founder and CEO of Privaini, a groundbreaking privacy tech company. Sanjay's journey is not only impressive due to his role in creating high-performance teams that have built entirely new product categories, but also for the invaluable lessons he learned from his grandfather about the pillars of successful companies - trust and human connections. In our discussion, Sanjay shares how Privaini is raising the privacy bar by constructing the world's largest repository of company privacy policies and practices. It's a fascinating dive into the future of privacy risk management.

Imagine being able to gain full coverage of your external privacy risks with continuous monitoring. Wouldn't that revolutionize your approach to risk management? That's exactly what Privaini is doing! Sanjay explains how Privaini utilizes AI to analyze, standardize, and derive meaningful "privacy views" and insights from vast volumes of publicly-available data. Listen in to understand how Privaini's innovative approach is helping companies gain visibility into their entire business network to make quicker, more informed decisions.

Topics Covered:

  • What motivated Sanjay to found companies that bring trusted systems to market and why he founded Privaini  to  focus on continuous privacy risk monitoring
  • How to quantitatively analyze & monitor privacy risk throughout an entire 'business network' and what Sanjay means by 'business network'
  • Which stakeholders benefit from using the Privaini platform
  • The benefits to calculating a "quantified privacy risk score" for each company in your business network to effectively monitor privacy risk
  • How Privaini leverages AI to discover external data about companies' privacy posture and why it must be used in a responsible and deliberate way
  • Why effective privacy risk monitoring of a company's business network requires an “outside-in” approach
  • The importance of continuous monitoring & the benefits to using an 'outside-in' approach
  • What it takes to set up an enterprise's network with Privaini for full coverage of external privacy risks
  • The recent Criteo fines and how Privaini could have helped Criteo surface privacy risks about its vendors
  • Why Sanjay believes learning about the “right side” of the equation is necessary in order to "shift privacy left."


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J Farber / Sanjay Saini Buzzsprout-13304143 Tue, 01 Aug 2023 07:00:00 -0700 2239 privacy risk monitoring, privacy risk, privacy policies, Sanjay Saini, Privaini, privacy tech, Credio, privacy posture 2 22 full false S2E21: Containing Big Tech, Federal Privacy Law, & Investing in Privacy Tech with Tom Kemp (Kemp Au Ventures) S2E21: Containing Big Tech, Federal Privacy Law, & Investing in Privacy Tech with Tom Kemp (Kemp Au Ventures) This week’s guest is Tom Kemp: author; entrepreneur; former Co-Founder & CEO of Centrify (now called Delinia), a leading cybersecurity cloud provider; and a Silicon Valley-based Seed Investor and Policy Advisor. Tom led campaign marketing efforts in 2020 to pass California Proposition 24, the California Privacy Rights Act, (CPRA), and is currently co-authoring the California Delete Act bill.

In this conversation, we discuss chapters within Tom’s new book, Containing Big Tech: How to Protect Our CIVIL RIGHTS, ECONOMY, and DEMOCRACY; how big tech is using AI to feed into the attention economy; what should go into a U.S. federal privacy law and how it should be enforced; and a comprehensive look at some of Tom’s privacy tech investments. 

Topics Covered:

  • Tom's new book - Containing Big Tech: How to Protect Our Civil Rights, Economy and Democracy
  • How and why Tom’s book is centered around data collection, artificial intelligence, and competition. 
  • U.S. state privacy legislation that Tom helped get passed & what he's working on now, including: CPRA, the California Delete Act, & Texas Data Broker Registry
  • Whether there will ever be a U.S. federal, omnibus privacy law; what should be included in it; and how it should be enforced
  • Tom's work as a privacy tech and security tech Seed Investor with Kemp Au Ventures and what inspires him to invest in a startup or not
  • What inspired Tom to invest in PrivacyCode, Secuvy & Privaini 
  • Why having a team and market size is something Tom looks for when investing. 
  • The importance of designing for privacy from a 'user-interface perspective' so that it’s consumer friendly
  • How consumers looking to trust companies are driving a shift left movement
  • Tom's advice for how companies can better shift left in their orgs & within their business networks


Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week’s guest is Tom Kemp: author; entrepreneur; former Co-Founder & CEO of Centrify (now called Delinia), a leading cybersecurity cloud provider; and a Silicon Valley-based Seed Investor and Policy Advisor. Tom led campaign marketing efforts in 2020 to pass California Proposition 24, the California Privacy Rights Act, (CPRA), and is currently co-authoring the California Delete Act bill.

In this conversation, we discuss chapters within Tom’s new book, Containing Big Tech: How to Protect Our CIVIL RIGHTS, ECONOMY, and DEMOCRACY; how big tech is using AI to feed into the attention economy; what should go into a U.S. federal privacy law and how it should be enforced; and a comprehensive look at some of Tom’s privacy tech investments. 

Topics Covered:

  • Tom's new book - Containing Big Tech: How to Protect Our Civil Rights, Economy and Democracy
  • How and why Tom’s book is centered around data collection, artificial intelligence, and competition. 
  • U.S. state privacy legislation that Tom helped get passed & what he's working on now, including: CPRA, the California Delete Act, & Texas Data Broker Registry
  • Whether there will ever be a U.S. federal, omnibus privacy law; what should be included in it; and how it should be enforced
  • Tom's work as a privacy tech and security tech Seed Investor with Kemp Au Ventures and what inspires him to invest in a startup or not
  • What inspired Tom to invest in PrivacyCode, Secuvy & Privaini 
  • Why having a team and market size is something Tom looks for when investing. 
  • The importance of designing for privacy from a 'user-interface perspective' so that it’s consumer friendly
  • How consumers looking to trust companies are driving a shift left movement
  • Tom's advice for how companies can better shift left in their orgs & within their business networks


Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Tom Kemp Buzzsprout-13172356 Tue, 11 Jul 2023 15:00:00 -0700 3333 Containing Big Tech, Kemp Au Ventures, U.S. privacy legislation, federal privacy law, privacy tech, seed investment, angel investment, Global Privacy Control, GPC, PrivacyCode, Secuvy, Privaini, privacy law enforcement 2 21 full false S2E20: Location Privacy, Data Brokers & Privacy Datasets with Jeff Jockisch S2E20: Location Privacy, Data Brokers & Privacy Datasets with Jeff Jockisch This week’s guest is Jeff Jockisch, Partner at Avantis Privacy and co-host of the weekly LinkedIn Live event, Your Bytes = Your Rights, a town hall-style discussion around ownership, digital rights, and privacy. Jeff is currently a data privacy researcher at PrivacyPlan, where he focuses specifically on privacy data sets. 

In this conversation, we delve into current risks to location privacy; how precise location data really is; how humans can have more control over their data; and what organizations can do to protect humans’ data privacy. 

For access to a dataset of data resources and privacy podcasts, check out Jeff’s robust database — the Shifting Privacy Left podcast was recently added.


Topics Covered:

  • Jeff’s approach to creating privacy data sets and what “gaining insight into the privacy landscape” means.
  • How law enforcement can be a threat actor to someone’s privacy, using the example of Texas' abortion law
  • Whether data brokers are getting exact location information or are inferring someone’s location.
  • Why geolocation brokers had not considered themselves data brokers.
  • Why anonymization is insufficient for location privacy. 
  • How 'consent theater' coupled with location leakage is an existential threat to our privacy.
  • How people can protect themselves from having data collected and sold by data and location brokers.
  • Why apps permissions should be more specific when notifying users about personal data collection and use. 
  • How Apple and Android devices treat Mobile Ad ID (MAID) differently and how that affects your historical location data.
  • How companies can protect data by using broader geolocation information instead of precise geolocation information. 
  • More information about Jeff's LinkedIn Live show, Your Bytes = Your Rights.


Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week’s guest is Jeff Jockisch, Partner at Avantis Privacy and co-host of the weekly LinkedIn Live event, Your Bytes = Your Rights, a town hall-style discussion around ownership, digital rights, and privacy. Jeff is currently a data privacy researcher at PrivacyPlan, where he focuses specifically on privacy data sets. 

In this conversation, we delve into current risks to location privacy; how precise location data really is; how humans can have more control over their data; and what organizations can do to protect humans’ data privacy. 

For access to a dataset of data resources and privacy podcasts, check out Jeff’s robust database — the Shifting Privacy Left podcast was recently added.


Topics Covered:

  • Jeff’s approach to creating privacy data sets and what “gaining insight into the privacy landscape” means.
  • How law enforcement can be a threat actor to someone’s privacy, using the example of Texas' abortion law
  • Whether data brokers are getting exact location information or are inferring someone’s location.
  • Why geolocation brokers had not considered themselves data brokers.
  • Why anonymization is insufficient for location privacy. 
  • How 'consent theater' coupled with location leakage is an existential threat to our privacy.
  • How people can protect themselves from having data collected and sold by data and location brokers.
  • Why apps permissions should be more specific when notifying users about personal data collection and use. 
  • How Apple and Android devices treat Mobile Ad ID (MAID) differently and how that affects your historical location data.
  • How companies can protect data by using broader geolocation information instead of precise geolocation information. 
  • More information about Jeff's LinkedIn Live show, Your Bytes = Your Rights.


Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J Farber / Jeff Jockisch Buzzsprout-13089130 Wed, 05 Jul 2023 12:00:00 -0700 2589 location privacy, geolocation 2 20 full false S2E19: Privacy Threat Modeling - Mitigating Privacy Threats in Software with Kim Wuyts (KU Leuven) S2E19: Privacy Threat Modeling - Mitigating Privacy Threats in Software with Kim Wuyts (KU Leuven) This week's guest is Kim Wuyts, Senior Postdoctoral Researcher at the DistriNet Research Group at the Department of Computer Science at KU Leuven. Kim is one of the leading minds behind the development and extension of LINDDUN, a privacy threat modeling framework that mitigates privacy threats in software systems.

In this conversation, we discuss threat modeling based on the Threat Modeling Manifesto Kim co-authored; the benefits to using the LINDDUN privacy threat model framework; and how to bridge the gap between privacy-enhancing technologies (PETs) in academia and the commercial world.    

Topics Covered:

  • Kim's career journey & why she moved into threat modeling.
  • The definition of 'threat modeling,' who should threat model, and what's included in her "Threat Modeling Manifesto."
  • The connection between threat modeling & a 'shift left' mindset / strategy.
  • Design patterns that benefit threat modeling & anti-patterns that inhibit.
  • Benefits to using the LINDDUN Privacy Threat Modeling framework for mitigating privacy threats in software, including the 7 'privacy threat types,' associated 'privacy threat trees,' and examples.
  • How "privacy threat trees' refine each threat type into concrete threat characteristics, examples, criteria & impact info.
  • Benefits & differences between LINDDUN GO and LINDDUN PRO.
  • How orgs can combine threat modeling approaches with PETs to address privacy risk.
  • Kim's work as Program Chair for the International Workshop on Privacy Engineering (IWPE), highlighting some anticipated talks.
  • The overlap of privacy & AI threats, and Kim's recommendation of The Privacy Library of Threats 4 AI ("PLOT4AI") Threat Modeling Card Deck
  • Recommended resources for privacy threat modeling, privacy engineering & PETs.
  • How the LINDDUN model & methodologies have been adopted by global orgs.
  • How to bridge the gap between the academic & commercial world to advance & deploy PETs.

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week's guest is Kim Wuyts, Senior Postdoctoral Researcher at the DistriNet Research Group at the Department of Computer Science at KU Leuven. Kim is one of the leading minds behind the development and extension of LINDDUN, a privacy threat modeling framework that mitigates privacy threats in software systems.

In this conversation, we discuss threat modeling based on the Threat Modeling Manifesto Kim co-authored; the benefits to using the LINDDUN privacy threat model framework; and how to bridge the gap between privacy-enhancing technologies (PETs) in academia and the commercial world.    

Topics Covered:

  • Kim's career journey & why she moved into threat modeling.
  • The definition of 'threat modeling,' who should threat model, and what's included in her "Threat Modeling Manifesto."
  • The connection between threat modeling & a 'shift left' mindset / strategy.
  • Design patterns that benefit threat modeling & anti-patterns that inhibit.
  • Benefits to using the LINDDUN Privacy Threat Modeling framework for mitigating privacy threats in software, including the 7 'privacy threat types,' associated 'privacy threat trees,' and examples.
  • How "privacy threat trees' refine each threat type into concrete threat characteristics, examples, criteria & impact info.
  • Benefits & differences between LINDDUN GO and LINDDUN PRO.
  • How orgs can combine threat modeling approaches with PETs to address privacy risk.
  • Kim's work as Program Chair for the International Workshop on Privacy Engineering (IWPE), highlighting some anticipated talks.
  • The overlap of privacy & AI threats, and Kim's recommendation of The Privacy Library of Threats 4 AI ("PLOT4AI") Threat Modeling Card Deck
  • Recommended resources for privacy threat modeling, privacy engineering & PETs.
  • How the LINDDUN model & methodologies have been adopted by global orgs.
  • How to bridge the gap between the academic & commercial world to advance & deploy PETs.

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra Farber / Kim Wuyts Buzzsprout-13089122 Tue, 27 Jun 2023 11:00:00 -0700 2705 privacy threat modeling, LINDDUN, privacy threat types, privacy threat trees, threat model, privacy engineering, privacy threats 2 19 full false S2E18: Making Digital Contact Cards Private, Shareable & Updatable with Brad Dominy (Neucards) S2E18: Making Digital Contact Cards Private, Shareable & Updatable with Brad Dominy (Neucards) I am delighted to welcome my next guest, Brad Dominy. Brad is a MacOS and iOS developer and Founder & Inventor of Neucards, a privacy-preserving app that enables secure shareable and updatable digital contacts. In this conversation, we delve into why personally managing our digital contacts has been so difficult and Brad's novel approach to securely manage our contacts, architected with privacy by design and default.

Contacts have always been the “junk drawer” of digital data, where people have information that they want to keep up-to-date, but are rarely able to based on current technology. The vCard standard is outdated, but is the only standard that works across iOS, Android, and Microsoft. It is still the most commonly used contact format, but lacks any capacity for updating contacts. Once someone exchanges their contact information with you, it then falls on you to keep that up-to-date. This is why Brad created Neucards: to gain the benefits of sharing information easily, privately (with E2EE) and receiving updates across all platforms.


Topics Covered:

  • Why it is difficult to keep our digital contacts up-to-date across devices and platforms.
  • Brad describes his career journey that inspired him to invent Neucards; the problems Neucards solves for; and why this became his passion project for over a decade
  • Why companies haven’t innovated more in the digital contacts space
  • The 3 main features that make Neucards different from other contact apps
  • How Neucards enables you to share digital contacts data easily & securely
  • Neucards' privacy by design and default approach to sharing and updating digital contacts
  • How you can use NFC tap tags with Neucards to make the process of sharing digital contacts much easier
  • Whether Neucards can solve the "New phone, who dis?" problem
  • Whether we will see an update to the vCard standard or new standards for digital contacts
  • Neucards' roadmap, including a 'mask communications' feature
  • The importance of language; the difference between 'privacy-preserving' vs. 'privacy-enabling' architectural approaches

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> I am delighted to welcome my next guest, Brad Dominy. Brad is a MacOS and iOS developer and Founder & Inventor of Neucards, a privacy-preserving app that enables secure shareable and updatable digital contacts. In this conversation, we delve into why personally managing our digital contacts has been so difficult and Brad's novel approach to securely manage our contacts, architected with privacy by design and default.

Contacts have always been the “junk drawer” of digital data, where people have information that they want to keep up-to-date, but are rarely able to based on current technology. The vCard standard is outdated, but is the only standard that works across iOS, Android, and Microsoft. It is still the most commonly used contact format, but lacks any capacity for updating contacts. Once someone exchanges their contact information with you, it then falls on you to keep that up-to-date. This is why Brad created Neucards: to gain the benefits of sharing information easily, privately (with E2EE) and receiving updates across all platforms.


Topics Covered:

  • Why it is difficult to keep our digital contacts up-to-date across devices and platforms.
  • Brad describes his career journey that inspired him to invent Neucards; the problems Neucards solves for; and why this became his passion project for over a decade
  • Why companies haven’t innovated more in the digital contacts space
  • The 3 main features that make Neucards different from other contact apps
  • How Neucards enables you to share digital contacts data easily & securely
  • Neucards' privacy by design and default approach to sharing and updating digital contacts
  • How you can use NFC tap tags with Neucards to make the process of sharing digital contacts much easier
  • Whether Neucards can solve the "New phone, who dis?" problem
  • Whether we will see an update to the vCard standard or new standards for digital contacts
  • Neucards' roadmap, including a 'mask communications' feature
  • The importance of language; the difference between 'privacy-preserving' vs. 'privacy-enabling' architectural approaches

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Brad Dominy Buzzsprout-12853299 Tue, 16 May 2023 13:00:00 -0700 2881 digital contacts, E2EE, end to end encryption, privacy architecture, iOS, updatable contacts, shareable contacts, digital contacts management 2 18 full false S2E17 - Noise in the Machine: How to Assess, Design & Deploy 'Differential Privacy' with Damien Desfontaines (Tumult Labs) S2E17 - Noise in the Machine: How to Assess, Design & Deploy 'Differential Privacy' with Damien Desfontaines (Tumult Labs) In this week’s episode, I speak with Damien Desfontaines, also known by the pseudonym “Ted”, who is the Staff Scientist at Tumult Labs, a startup leading the way on differential privacy. In Damien’s career, he has led an Anonymization Consulting Team at Google and specializes in making it easy to safely anonymize data. Damien earned his PhD and wrote his thesis at ETH Zurich, as well as his Master's Degree in Mathematical Logic and Theoretical Computer Science.

Tumult Labs’ platform makes differential privacy useful by making it easy to create innovative privacy and enabling data products that can be safely shared and used widely. In this conversation, we focus our discussion on Differential Privacy techniques, including what’s next in its evolution, common vulnerabilities, and how to implement differential privacy into your platform.

When it comes to protecting personal data, Tumult Labs has three stages in their approach. These are Assess, Design, and Deploy. Damien takes us on a deep dive into each with use cases provided.

Topics Covered:

  • Why there's such a gap between the academia and the corporate world
  • How differential privacy's strong privacy guarantees are a result of strong assumptions; and why the biggest blockers to DP deployments have been eduction & usability
  • When to use "local" vs "central" differential privacy techniques
  • Advancements in technology that enable the private collection of data
  • Tumult Labs' Assessment approach to deploying differential privacy, where a customer defines its 'data publication' problem or question
  • How the Tumult Analytics platform can help you build different privacy algorithms that satisfies 'fitness for use' requirements
  • Why using gold standard techniques like differential privacy to safely release, publish, or share data has value far beyond compliance
  • How data scientists can make the analysis & design more robust to better preserve privacy; and the tradeoff between utility on very specific tasks & number of tasks that you can possibly answer
  • Damien's work assisting the IRS & DOE deploy differential privacy to safely publish and share data publicly via the College Scorecards project
  • How to address security vulnerabilities (i.e. potential attacks) to differentially private datasets
  • Where you can learn more about differential privacy
  • How Damien sees this space evolving over the next several years

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> In this week’s episode, I speak with Damien Desfontaines, also known by the pseudonym “Ted”, who is the Staff Scientist at Tumult Labs, a startup leading the way on differential privacy. In Damien’s career, he has led an Anonymization Consulting Team at Google and specializes in making it easy to safely anonymize data. Damien earned his PhD and wrote his thesis at ETH Zurich, as well as his Master's Degree in Mathematical Logic and Theoretical Computer Science.

Tumult Labs’ platform makes differential privacy useful by making it easy to create innovative privacy and enabling data products that can be safely shared and used widely. In this conversation, we focus our discussion on Differential Privacy techniques, including what’s next in its evolution, common vulnerabilities, and how to implement differential privacy into your platform.

When it comes to protecting personal data, Tumult Labs has three stages in their approach. These are Assess, Design, and Deploy. Damien takes us on a deep dive into each with use cases provided.

Topics Covered:

  • Why there's such a gap between the academia and the corporate world
  • How differential privacy's strong privacy guarantees are a result of strong assumptions; and why the biggest blockers to DP deployments have been eduction & usability
  • When to use "local" vs "central" differential privacy techniques
  • Advancements in technology that enable the private collection of data
  • Tumult Labs' Assessment approach to deploying differential privacy, where a customer defines its 'data publication' problem or question
  • How the Tumult Analytics platform can help you build different privacy algorithms that satisfies 'fitness for use' requirements
  • Why using gold standard techniques like differential privacy to safely release, publish, or share data has value far beyond compliance
  • How data scientists can make the analysis & design more robust to better preserve privacy; and the tradeoff between utility on very specific tasks & number of tasks that you can possibly answer
  • Damien's work assisting the IRS & DOE deploy differential privacy to safely publish and share data publicly via the College Scorecards project
  • How to address security vulnerabilities (i.e. potential attacks) to differentially private datasets
  • Where you can learn more about differential privacy
  • How Damien sees this space evolving over the next several years

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J. Farber / Damien Desfontaines Buzzsprout-12457123 Tue, 09 May 2023 13:00:00 -0700 2767 differential privacy 2 17 full false S2E16: Words with Impact; Communication Tips for Privacy Technologists with Melanie Ensign (Discernible) S2E16: Words with Impact; Communication Tips for Privacy Technologists with Melanie Ensign (Discernible) I'm delighted to welcome guest, Melanie Ensign, Founder and CEO of Discernible, where she helps organizations adopt effective communication strategies to improve risk-related outcomes. She's managed security & privacy communications for some of the world's most notable brands, including Facebook, Uber & AT&T.

Melanie counsels executives and technical teams to cut through internal politics, dysfunctional inertia & meaningless metrics. For the past 10 years, she's also led the press department & communication strategy for DEF CON. Also, Melanie is an accomplished scuba diver and brings lessons learned preventing, preparing for & navigating unexpected high-risk underwater incidents to her work in security & privacy. Today's discussion focuses on the importance of communication strategies and tactics for privacy engineering teams. 

Topics Covered:

  • Melanie's career journey and how she leveraged her experience in shark science to help executives get over their initial fears of the unknown in security & privacy
  • How Melanie guides and supports technical teams at Discernible on effective communications
  • How to prevent 'Privacy Outrage'
  • The value of preventing privacy snafus rather than focusing only on crisis comms
  • How companies can use technical communication strategies & tactics to earn trust with the public
  • The problem with incentives - why most social media metrics have been bullshit for far too long
  • Why Melanie decided to leave big tech to start Discernible
  • Insight into the 7 Arthur W. Page Society Principles, a 'code of ethics' for communications professionals
  • What makes for a good PR story that the media would want to cover
  • Why press releases are mostly ineffective except for announcing funding raises
  • The importance of educating the community for which you're building
  • Melanie's advice to Elon Musk, who does not invest in a comms team
  • What OpenAI could have done differently, and whether their go-to-market strategy was effective
  • The importance of elevating Compliance teams to Business Advisors in the eyes of stakeholders

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> I'm delighted to welcome guest, Melanie Ensign, Founder and CEO of Discernible, where she helps organizations adopt effective communication strategies to improve risk-related outcomes. She's managed security & privacy communications for some of the world's most notable brands, including Facebook, Uber & AT&T.

Melanie counsels executives and technical teams to cut through internal politics, dysfunctional inertia & meaningless metrics. For the past 10 years, she's also led the press department & communication strategy for DEF CON. Also, Melanie is an accomplished scuba diver and brings lessons learned preventing, preparing for & navigating unexpected high-risk underwater incidents to her work in security & privacy. Today's discussion focuses on the importance of communication strategies and tactics for privacy engineering teams. 

Topics Covered:

  • Melanie's career journey and how she leveraged her experience in shark science to help executives get over their initial fears of the unknown in security & privacy
  • How Melanie guides and supports technical teams at Discernible on effective communications
  • How to prevent 'Privacy Outrage'
  • The value of preventing privacy snafus rather than focusing only on crisis comms
  • How companies can use technical communication strategies & tactics to earn trust with the public
  • The problem with incentives - why most social media metrics have been bullshit for far too long
  • Why Melanie decided to leave big tech to start Discernible
  • Insight into the 7 Arthur W. Page Society Principles, a 'code of ethics' for communications professionals
  • What makes for a good PR story that the media would want to cover
  • Why press releases are mostly ineffective except for announcing funding raises
  • The importance of educating the community for which you're building
  • Melanie's advice to Elon Musk, who does not invest in a comms team
  • What OpenAI could have done differently, and whether their go-to-market strategy was effective
  • The importance of elevating Compliance teams to Business Advisors in the eyes of stakeholders

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Debra J Farber / Melanie Ensign Buzzsprout-12697654 Tue, 02 May 2023 06:00:00 -0700 3581 communications, privacy, trust, authenticity, Discernible Inc, crisis comms, PR, public relations 2 16 full false S2E15: 'Watching the Watchers: Transparency & Control Research' with Umar Iqbal, PhD (University of Washington) S2E15: 'Watching the Watchers: Transparency & Control Research' with Umar Iqbal, PhD (University of Washington) This week's guest is Umar Iqbal, PhD, a Postdoctoral Scholar at the Paul G. Allen School of Computer Science & Engineering at the University of Washington, working in the Security and Privacy Research Lab. Umar focuses his research on two themes: 1) bringing transparency into data collection and usage practices, and 2) enabling individuals to have control over their own data by identifying & restricting privacy-invasive data collection & usage practices of online services


His long-term research vision is to create an environment where users can reap the benefits of technology without losing their privacy by enabling preemptive privacy protections and establishing 'checks & balances' on the Internet. In this discussion, we discuss his previous and current research with a goal of empowering people to protect their privacy on the Internet. 


Topics Covered:

  • Why Umar focused his research on transparency
  • Umar's research relating to transparency, data collection & use, with a focus on Amazon's smart speaker & metadata privacy and potential EU regulatory enforcement
  • His transparency-related work related to browsers & API's, and the growing problem of using fingerprinting techniques to track people without consent
  • How Umar plans to bring control to individuals by restricting online privacy-invasive data collections
  • How he used a ML technique to detect browser fingerprinting scripts based on their functionality
  • Umar's research to determine the prevalence of online tracking & measure how effective currently-available tracker detection tools are 
  • His research on early detection of emerging privacy threats (e.g., 'browser fingerprinting' & 'navigational tracking', etc.) and his investigation of privacy issues related to IoT (e.g., smart speakers & health & fitness bands that analyze people's voices)
  • How we can ensure strong privacy guarantees and make a more accountable Internet
  • Why regulations need technological support to be effective for enforcement
  • Umar's advice to developers / hackers looking for 'privacy bugs' via dynamic code analysis and a discussion of the future of 'privacy bug bounties'

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week's guest is Umar Iqbal, PhD, a Postdoctoral Scholar at the Paul G. Allen School of Computer Science & Engineering at the University of Washington, working in the Security and Privacy Research Lab. Umar focuses his research on two themes: 1) bringing transparency into data collection and usage practices, and 2) enabling individuals to have control over their own data by identifying & restricting privacy-invasive data collection & usage practices of online services


His long-term research vision is to create an environment where users can reap the benefits of technology without losing their privacy by enabling preemptive privacy protections and establishing 'checks & balances' on the Internet. In this discussion, we discuss his previous and current research with a goal of empowering people to protect their privacy on the Internet. 


Topics Covered:

  • Why Umar focused his research on transparency
  • Umar's research relating to transparency, data collection & use, with a focus on Amazon's smart speaker & metadata privacy and potential EU regulatory enforcement
  • His transparency-related work related to browsers & API's, and the growing problem of using fingerprinting techniques to track people without consent
  • How Umar plans to bring control to individuals by restricting online privacy-invasive data collections
  • How he used a ML technique to detect browser fingerprinting scripts based on their functionality
  • Umar's research to determine the prevalence of online tracking & measure how effective currently-available tracker detection tools are 
  • His research on early detection of emerging privacy threats (e.g., 'browser fingerprinting' & 'navigational tracking', etc.) and his investigation of privacy issues related to IoT (e.g., smart speakers & health & fitness bands that analyze people's voices)
  • How we can ensure strong privacy guarantees and make a more accountable Internet
  • Why regulations need technological support to be effective for enforcement
  • Umar's advice to developers / hackers looking for 'privacy bugs' via dynamic code analysis and a discussion of the future of 'privacy bug bounties'

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/446086 Debra J Farber / Umar Iqbal Buzzsprout-12401515 Tue, 18 Apr 2023 06:00:00 -0700 2371 transparency, control, ethical hacking, online tracking, privacy enhancing technologies, PETs, privacy guarantees, privacy assurance 2 15 full false S2E14: Addressing Privacy with Static Analysis Techniques Like ‘Taint-Tracking’ & ‘Data Flow Analysis’ with Suchakra Sharma (Privado.ai) S2E14: Addressing Privacy with Static Analysis Techniques Like ‘Taint-Tracking’ & ‘Data Flow Analysis’ with Suchakra Sharma (Privado.ai) This week, we welcome Suchakra Sharma, Chief Scientist at Privado.ai, where he builds code analysis tools for data privacy & security. Previously, he earned his PhD in Computer Engineering from Polytechnique Montreal, where he worked on eBPF Technology and hardware-assisted tracing techniques for OS Analysis. In this conversation, we delve into Suchakra’s background in shifting left for security and how he applies traditional, tested static analysis techniques — such as 'taint tracking' and 'data flow analysis' — for use on large code bases at scale to help fix privacy leaks right at the source.

---------
Thank you to our sponsor, Privado, the developer friendly privacy platform.
---------

Suchakra aligns himself with the philosophical aspects of privacy and wishes to work on anything that helps in limiting the erosion of privacy in modern society, since privacy is fundamental to all of us. These kinds of needs have always been here, and as societies have advanced, this is a time when we require more guarantees of privacy. After all, it is humans that are behind systems and it is humans that are going to be affected by the machines that we build. Check out this fascinating discussion on how to shift privacy left in your organization.

Topics Covered:

  • Why Suchakra was interested in privacy after focusing on static code analysis for security
  • What 'shift left' means and lessons learned from the 'shift security left' movement that can be applied to 'shift privacy left' efforts
  • Sociological perspectives on how humans developed a need for keeping things 'private' from others
  • How to provide engineering-focused guarantees around privacy today & what the role should be of engineers within this 'shift privacy left' paradigm
  • Suchakra's USENIX Enigma talk & discussion of 'taint tracking' & 'data flow analysis' techniques
  • Which companies should build in-house tooling for static analysis, and which should be outsourcing to experienced vendors like Privado
  • How to address 'privacy bugs' in code; why it's important to have an 'auditor's mindset;' &, why we'll see 'Privacy Bug Bounty Programs' soon
  • Suchakra's advice to engineering managers to move the needle on privacy in their orgs

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week, we welcome Suchakra Sharma, Chief Scientist at Privado.ai, where he builds code analysis tools for data privacy & security. Previously, he earned his PhD in Computer Engineering from Polytechnique Montreal, where he worked on eBPF Technology and hardware-assisted tracing techniques for OS Analysis. In this conversation, we delve into Suchakra’s background in shifting left for security and how he applies traditional, tested static analysis techniques — such as 'taint tracking' and 'data flow analysis' — for use on large code bases at scale to help fix privacy leaks right at the source.

---------
Thank you to our sponsor, Privado, the developer friendly privacy platform.
---------

Suchakra aligns himself with the philosophical aspects of privacy and wishes to work on anything that helps in limiting the erosion of privacy in modern society, since privacy is fundamental to all of us. These kinds of needs have always been here, and as societies have advanced, this is a time when we require more guarantees of privacy. After all, it is humans that are behind systems and it is humans that are going to be affected by the machines that we build. Check out this fascinating discussion on how to shift privacy left in your organization.

Topics Covered:

  • Why Suchakra was interested in privacy after focusing on static code analysis for security
  • What 'shift left' means and lessons learned from the 'shift security left' movement that can be applied to 'shift privacy left' efforts
  • Sociological perspectives on how humans developed a need for keeping things 'private' from others
  • How to provide engineering-focused guarantees around privacy today & what the role should be of engineers within this 'shift privacy left' paradigm
  • Suchakra's USENIX Enigma talk & discussion of 'taint tracking' & 'data flow analysis' techniques
  • Which companies should build in-house tooling for static analysis, and which should be outsourcing to experienced vendors like Privado
  • How to address 'privacy bugs' in code; why it's important to have an 'auditor's mindset;' &, why we'll see 'Privacy Bug Bounty Programs' soon
  • Suchakra's advice to engineering managers to move the needle on privacy in their orgs

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/436088 Debra J. Farber / Suchakra Sharma Buzzsprout-12308815 Tue, 11 Apr 2023 06:00:00 -0700 2082 taint tracking, static code analysis, data flow analysis, privacy bug bounty, privacy vulnerabilities, privacy attacks 2 14 full false S2E13: Diving Deep into Fully Homomorphic Encryption (FHE) with Kurt R. Rohloff (Duality Technologies) S2E13: Diving Deep into Fully Homomorphic Encryption (FHE) with Kurt R. Rohloff (Duality Technologies) I am delighted to welcome this week’s guest, Kurt Rohloff. Kurt is the CTO and Co-Founder of Duality Technologies, a privacy tech company that enables organizations to leverage data across their ecosystem and generate joint insights for better business while preserving privacy. Kurt was also Co-Founder of the OpenFHE Homomorphic Encryption Software Library that enables practical and usable privacy and collaborative data analytics.

He's successfully led teams that are developing, transitioning, and applying first-in-the-world technology capabilities for both the Department of Defense as well as for commercial use. Kurt specializes in generating, developing, and commercializing innovative secure computing technologies with a focus on privacy and AI/ML at scale. In this episode, we discuss use cases for leveraging Fully Homomorphic Encryption (FHE) and other PETs.

In a previous episode, we spoke about federated learning; and in this episode, we learn how to achieve secure federated learning using fully homomorphic encryption (FHE) techniques.


Kurt has been focused on and supported homomorphic encryption since it was first discovered, including his involvement in one of the seminal projects, funded by DARPA, where he ran an implementation team, called PROCEED.


FHE, as opposed to other kinds of privacy technologies, is more general and malleable. As each organization has different needs when it comes to data collaboration, Duality Technologies offers three separate models for collaboration, which enable organizations to secure sensitive data while still allowing different types of sharing.


Topics Covered:

  • How companies can gain utility from a dataset while protecting the privacy of individuals or entities
  • How FHEs help with fraud prevention, How FHEs help with fraud prevention, secure investigations, real-world evidence & genome-wide association studies
  • Use cases for the three collaboration models Duality offers: Single Data Set, Horizontal Data Analysis, and Vertical Data Analysis
  • Comparison & trade-offs involved between federated learning and homomorphic encryption
  • Proliferation of FHE Standards
  • OpenFHE.org, the leading open source library for implementations of fully homomorphic encryption protocols

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> I am delighted to welcome this week’s guest, Kurt Rohloff. Kurt is the CTO and Co-Founder of Duality Technologies, a privacy tech company that enables organizations to leverage data across their ecosystem and generate joint insights for better business while preserving privacy. Kurt was also Co-Founder of the OpenFHE Homomorphic Encryption Software Library that enables practical and usable privacy and collaborative data analytics.

He's successfully led teams that are developing, transitioning, and applying first-in-the-world technology capabilities for both the Department of Defense as well as for commercial use. Kurt specializes in generating, developing, and commercializing innovative secure computing technologies with a focus on privacy and AI/ML at scale. In this episode, we discuss use cases for leveraging Fully Homomorphic Encryption (FHE) and other PETs.

In a previous episode, we spoke about federated learning; and in this episode, we learn how to achieve secure federated learning using fully homomorphic encryption (FHE) techniques.


Kurt has been focused on and supported homomorphic encryption since it was first discovered, including his involvement in one of the seminal projects, funded by DARPA, where he ran an implementation team, called PROCEED.


FHE, as opposed to other kinds of privacy technologies, is more general and malleable. As each organization has different needs when it comes to data collaboration, Duality Technologies offers three separate models for collaboration, which enable organizations to secure sensitive data while still allowing different types of sharing.


Topics Covered:

  • How companies can gain utility from a dataset while protecting the privacy of individuals or entities
  • How FHEs help with fraud prevention, How FHEs help with fraud prevention, secure investigations, real-world evidence & genome-wide association studies
  • Use cases for the three collaboration models Duality offers: Single Data Set, Horizontal Data Analysis, and Vertical Data Analysis
  • Comparison & trade-offs involved between federated learning and homomorphic encryption
  • Proliferation of FHE Standards
  • OpenFHE.org, the leading open source library for implementations of fully homomorphic encryption protocols

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/429036 Debra J. Farber / Kurt R. Rohloff Buzzsprout-12308804 Tue, 04 Apr 2023 06:00:00 -0700 2923 fully homomorphic encryption, PETs, FHE, privacy enhancing technologies, duality technologies 2 13 full false S2E12: 'Building Powerful ML Models with Privacy & Ethics' with Katharine Jarmul (ThoughtWorks) S2E12: 'Building Powerful ML Models with Privacy & Ethics' with Katharine Jarmul (ThoughtWorks) This week, I'm joined by Katharine Jarmul, Principal Data Scientist at Thoughtworks & author of the the forthcoming book, "Practical Data Privacy: Enhancing Privacy and Security in Data." Katharine began asking questions similar to those of today's ethical machine learning community as a university student working on her undergrad thesis during the war in Iraq. She focused that research on natural language processing and investigated the statistical differences between embedded & non-embedded reporters. In our conversation, we discuss ethical & secure machine learning approaches, threat modeling against adversarial attacks, the importance of distributed data setups, and what Katharine wants data scientists to know about privacy and ethical ML.

Katharine believes that we should never fall victim to a 'techno-solutionist' mindset where we believe that we can solve a deep societal problem simply with tech alone. However, by solving issues around privacy & consent with data collection, we can more easily address the challenges with ethical ML.  In fact, ML research is finally beginning to broaden and include the intersections of law, privacy, and ethics. Katharine anticipates that data scientists will embrace PETs that facilitate data sharing in a privacy-preserving way; and, she evangelizes the un-normalization of sending ML data from one company to another. 


Topics Covered:

  • Katharine's motivation for writing a book on privacy for a data scientist audience and what she hopes readers will learn from it
  • What areas must be addressed for ML to be considered ethical
  • Overlapping AI/ML & Privacy goals
  • Challenges with sharing data for analytics
  • The need for data scientists to embrace PETs
  • How PETs will likely mature across orgs over the next 2 years
  • Katharine's & Debra's favorite PETs
  • The importance of threat modeling ML models: discussing 'adversarial attacks' like 'model inversion' & 'membership inference' attacks
  • Why companies that train LLMs must be accountable for the safety of their models
  • New ethical approaches to data sharing
  • Why scraping data off the Internet to train models is the harder, lazier, unethical way to train ML models


Resources Mentioned:


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week, I'm joined by Katharine Jarmul, Principal Data Scientist at Thoughtworks & author of the the forthcoming book, "Practical Data Privacy: Enhancing Privacy and Security in Data." Katharine began asking questions similar to those of today's ethical machine learning community as a university student working on her undergrad thesis during the war in Iraq. She focused that research on natural language processing and investigated the statistical differences between embedded & non-embedded reporters. In our conversation, we discuss ethical & secure machine learning approaches, threat modeling against adversarial attacks, the importance of distributed data setups, and what Katharine wants data scientists to know about privacy and ethical ML.

Katharine believes that we should never fall victim to a 'techno-solutionist' mindset where we believe that we can solve a deep societal problem simply with tech alone. However, by solving issues around privacy & consent with data collection, we can more easily address the challenges with ethical ML.  In fact, ML research is finally beginning to broaden and include the intersections of law, privacy, and ethics. Katharine anticipates that data scientists will embrace PETs that facilitate data sharing in a privacy-preserving way; and, she evangelizes the un-normalization of sending ML data from one company to another. 


Topics Covered:

  • Katharine's motivation for writing a book on privacy for a data scientist audience and what she hopes readers will learn from it
  • What areas must be addressed for ML to be considered ethical
  • Overlapping AI/ML & Privacy goals
  • Challenges with sharing data for analytics
  • The need for data scientists to embrace PETs
  • How PETs will likely mature across orgs over the next 2 years
  • Katharine's & Debra's favorite PETs
  • The importance of threat modeling ML models: discussing 'adversarial attacks' like 'model inversion' & 'membership inference' attacks
  • Why companies that train LLMs must be accountable for the safety of their models
  • New ethical approaches to data sharing
  • Why scraping data off the Internet to train models is the harder, lazier, unethical way to train ML models


Resources Mentioned:


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/423609 Debra J Farber / Katharine Jarmul Buzzsprout-12308797 Tue, 28 Mar 2023 06:00:00 -0700 3328 PETs, ethical machine learning, ThoughtWorks, Practical Data Privacy, Data Wrangling with Python,ChatGPT, fairness, accountability, transparency, ML, privacy enhancing technologies, distributed data, data scraping, consented models, ML attacks 2 12 full false S2E11: Lessons Learned as a Privacy Engineering Manager with Menotti Minutillo (ex-Twitter & Uber) S2E11: Lessons Learned as a Privacy Engineering Manager with Menotti Minutillo (ex-Twitter & Uber) This week, we gain insights into the profession of privacy engineering with guest Menotti Minutillo, a Sr. Privacy Engineering Manager with 15+ years of experience leading critical programs and product delivery at companies like Uber, Thrive Global & Twitter. He started his career in 2007 on Wall Street as a DevOps & Infrastructure Engineer; and now, Menotti is a sought-after technical privacy expert and Privacy Tech Advisor. In this conversation, we discuss privacy engineering approaches that have work, the skillsets required for privacy engineering, and the current climate for landing privacy engineering roles.

Menotti sees privacy engineering as the practice of building or improving info systems to advance a set of privacy goals. It's like a 'layer cake' in that you have different protections and risk reductions based on threat modeling, as well as different specialization capabilities for larger orgs.

It makes a lot of sense that he's held weaving roles from company to company. His journey into privacy engineering was originally 'adjacent work' and today, he shares lessons learned from taking a PET like differential privacy from the lab to systematizing it into an organization to deploying it in the real-world. In this episode, we delve into tools, technical processes, technical standards, the maturing landscape for privacy engineers, and how the success of privacy is coupled with the success of each product shipped.

Topics Covered:

  • How Menotti found his way to managing privacy engineering teams
  • Menotti's definition of 'privacy engineer' & the skillsets required
  • What it was like to work at Uber & Twitter, which have multiple privacy engineering teams
  • Best practices for setting up teams & deploying solutions
  • Privacy outcomes that privacy engineers should keep top of mind
  • Best practices for privacy architecture
  • Menotti positive experience while at Uber working with Privacy Researchers from UC Berkeley to take differential privacy from the lab to a real-world deployment
  • Lessons learned from times of transition, including while at Twitter during Musk's takeover 
  • Whether privacy was a 'zero interest rate bet,' and what that means for privacy engineering roles given current economic realities

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week, we gain insights into the profession of privacy engineering with guest Menotti Minutillo, a Sr. Privacy Engineering Manager with 15+ years of experience leading critical programs and product delivery at companies like Uber, Thrive Global & Twitter. He started his career in 2007 on Wall Street as a DevOps & Infrastructure Engineer; and now, Menotti is a sought-after technical privacy expert and Privacy Tech Advisor. In this conversation, we discuss privacy engineering approaches that have work, the skillsets required for privacy engineering, and the current climate for landing privacy engineering roles.

Menotti sees privacy engineering as the practice of building or improving info systems to advance a set of privacy goals. It's like a 'layer cake' in that you have different protections and risk reductions based on threat modeling, as well as different specialization capabilities for larger orgs.

It makes a lot of sense that he's held weaving roles from company to company. His journey into privacy engineering was originally 'adjacent work' and today, he shares lessons learned from taking a PET like differential privacy from the lab to systematizing it into an organization to deploying it in the real-world. In this episode, we delve into tools, technical processes, technical standards, the maturing landscape for privacy engineers, and how the success of privacy is coupled with the success of each product shipped.

Topics Covered:

  • How Menotti found his way to managing privacy engineering teams
  • Menotti's definition of 'privacy engineer' & the skillsets required
  • What it was like to work at Uber & Twitter, which have multiple privacy engineering teams
  • Best practices for setting up teams & deploying solutions
  • Privacy outcomes that privacy engineers should keep top of mind
  • Best practices for privacy architecture
  • Menotti positive experience while at Uber working with Privacy Researchers from UC Berkeley to take differential privacy from the lab to a real-world deployment
  • Lessons learned from times of transition, including while at Twitter during Musk's takeover 
  • Whether privacy was a 'zero interest rate bet,' and what that means for privacy engineering roles given current economic realities

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/419910 Debra J Farber / Menotti Minutillo Buzzsprout-12363553 Tue, 21 Mar 2023 11:00:00 -0700 3203 privacy engineer, privacy engineering manager, zero interest rate bet, ZIRB, PEPR, Twitter, Uber, privacy outcomes, privacy architecture 2 11 full false S2E10: Leveraging Synthetic Data and Privacy Guarantees with Lipika Ramaswamy (Gretel.ai) S2E10: Leveraging Synthetic Data and Privacy Guarantees with Lipika Ramaswamy (Gretel.ai) This week, we welcome Lipika Ramaswamy, Senior Applied Scientist at Gretel AI, a privacy tech company that makes it simple to generate anonymized and safe synthetic data via APIs. Previously, Lipika worked as a Data Scientist at LeapYear Technologies, and was the Machine Learning Researcher at Harvard University's Privacy Tools Project.


Lipika’s interest in both machine learning and privacy comes from her love of math and things that can be defined with equations. Her interest was piqued in grad school and accidentally walked into a classroom holding a lecture on Applying Differential Privacy for Data Science. The intersection of data combined with the privacy guarantees that we have available today has kept her hooked ever since.

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------

There's a lot to unpack when it comes to synthetic data & privacy guarantees, as she takes listeners on a deep dive of these compelling topics. Lipika finds elegant how privacy assurances like differential privacy revolve around math and statistics at their core. Essentially, she loves building things with 'usable privacy' & security that people can easily use. We also delve into the metrics tracked in the Gretel Synthetic Data Report, which assesses both 'statistical integrity' & 'privacy levels' of a customer's training data.

Topics Covered:

  • The definition of 'synthetic data,' & good use cases
  • The process of creating synthetic data
  • How to ensure that synthetic data is 'privacy-preserving'
  • Privacy problems that may arise from overtraining ML models
  • When to use synthetic data rather than other techniques like tokenization, anonymization, aggregation & others
  • Examples of good use cases vs poor use cases for using synthetic data
  • Common misperceptions around synthetic data
  • Gretel.ai's approach to 'privacy assurance,' including a focus on 'privacy filters,' which prevent some privacy harms outputted by LLMs
  • How to plug into the 'synthetic data' community
  • Who bears the responsibility for educating the public about new technology like LLMs and potential harms
  • Highlights from Gretel.ai's Synthesize 2023 conference

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week, we welcome Lipika Ramaswamy, Senior Applied Scientist at Gretel AI, a privacy tech company that makes it simple to generate anonymized and safe synthetic data via APIs. Previously, Lipika worked as a Data Scientist at LeapYear Technologies, and was the Machine Learning Researcher at Harvard University's Privacy Tools Project.


Lipika’s interest in both machine learning and privacy comes from her love of math and things that can be defined with equations. Her interest was piqued in grad school and accidentally walked into a classroom holding a lecture on Applying Differential Privacy for Data Science. The intersection of data combined with the privacy guarantees that we have available today has kept her hooked ever since.

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------

There's a lot to unpack when it comes to synthetic data & privacy guarantees, as she takes listeners on a deep dive of these compelling topics. Lipika finds elegant how privacy assurances like differential privacy revolve around math and statistics at their core. Essentially, she loves building things with 'usable privacy' & security that people can easily use. We also delve into the metrics tracked in the Gretel Synthetic Data Report, which assesses both 'statistical integrity' & 'privacy levels' of a customer's training data.

Topics Covered:

  • The definition of 'synthetic data,' & good use cases
  • The process of creating synthetic data
  • How to ensure that synthetic data is 'privacy-preserving'
  • Privacy problems that may arise from overtraining ML models
  • When to use synthetic data rather than other techniques like tokenization, anonymization, aggregation & others
  • Examples of good use cases vs poor use cases for using synthetic data
  • Common misperceptions around synthetic data
  • Gretel.ai's approach to 'privacy assurance,' including a focus on 'privacy filters,' which prevent some privacy harms outputted by LLMs
  • How to plug into the 'synthetic data' community
  • Who bears the responsibility for educating the public about new technology like LLMs and potential harms
  • Highlights from Gretel.ai's Synthesize 2023 conference

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/412005 Debra J. Farber / Lipika Ramaswamy Buzzsprout-12308780 Tue, 14 Mar 2023 06:00:00 -0700 2738 synthetic data, privacy guarantees, ML overtraining, privacy assurance, privacy filters, Gretel.ai, Synthesize conference, large language models, LLMs 2 10 full false S2E9: Personalized Noise, Decaying Photos, & Digital Forgetting with Apu Kapadia (Indiana University Bloomington) S2E9: Personalized Noise, Decaying Photos, & Digital Forgetting with Apu Kapadia (Indiana University Bloomington) In this episode, I'm delighted to welcome Apu Kapadia, Professor of Computer Science and Informatics at the School of Informatics and Computing, Indiana University. His research is focused on the privacy implications of ubiquitous cameras and online photo sharing. More recently, he has examined the cybersecurity and privacy challenges posed by AI-based smart voice assistants that can listen and converse with us.


Prof. Kapadia has been excited by anonymized networks since childhood. He has memories of watching movies where a telephone call was being routed around the world so that it became impossible to trace. What really fascinates him now is how much there is to understand mathematically and technically in order to measure that amount of privacy. In more recent years, he has been interested in privacy in the context of digital photography and audio shared online and on social media. His current research is focused on understanding privacy issues around photo sharing in a world with cameras everywhere.

In this conversation, we delve into how users are affected once privacy violations have already occurred, the implications of privacy of children when it comes to parents sharing photos of them online, the fascinating future of trusted hardware that will help ensure "digital forgetting," and how all of this is a people problem as much as it is a technical problem.


Topics Covered:

  • Can we trick 'automated speech recognition' (ASR)?
  • Apu's co-authored paper: 'Defending Against Microphone-based Attacks with Personalized Noise'
  • What Apu means by 'tangible privacy' & what design approaches he recommends
  • Apu's view on 'bystander privacy' & the approach that he took in his research
  • How to leverage 'temporal redactions' via 'trusted hardware' for 'digital forgetting'
  • Apu’s surprising finding in his research on "interpersonal privacy" in the context of social media and photos
  • Guidance for developers building privacy-respective social media apps
  • Apu's research focused on cybersecurity & privacy for marginalized & vulnerable populations
  • How we can make privacy & security more 'useable'

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> In this episode, I'm delighted to welcome Apu Kapadia, Professor of Computer Science and Informatics at the School of Informatics and Computing, Indiana University. His research is focused on the privacy implications of ubiquitous cameras and online photo sharing. More recently, he has examined the cybersecurity and privacy challenges posed by AI-based smart voice assistants that can listen and converse with us.


Prof. Kapadia has been excited by anonymized networks since childhood. He has memories of watching movies where a telephone call was being routed around the world so that it became impossible to trace. What really fascinates him now is how much there is to understand mathematically and technically in order to measure that amount of privacy. In more recent years, he has been interested in privacy in the context of digital photography and audio shared online and on social media. His current research is focused on understanding privacy issues around photo sharing in a world with cameras everywhere.

In this conversation, we delve into how users are affected once privacy violations have already occurred, the implications of privacy of children when it comes to parents sharing photos of them online, the fascinating future of trusted hardware that will help ensure "digital forgetting," and how all of this is a people problem as much as it is a technical problem.


Topics Covered:

  • Can we trick 'automated speech recognition' (ASR)?
  • Apu's co-authored paper: 'Defending Against Microphone-based Attacks with Personalized Noise'
  • What Apu means by 'tangible privacy' & what design approaches he recommends
  • Apu's view on 'bystander privacy' & the approach that he took in his research
  • How to leverage 'temporal redactions' via 'trusted hardware' for 'digital forgetting'
  • Apu’s surprising finding in his research on "interpersonal privacy" in the context of social media and photos
  • Guidance for developers building privacy-respective social media apps
  • Apu's research focused on cybersecurity & privacy for marginalized & vulnerable populations
  • How we can make privacy & security more 'useable'

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/402170 Debra J. Farber / Apu Kapadia Buzzsprout-12267602 Tue, 07 Mar 2023 06:00:00 -0800 2791 privacy research, IoT privacy, voice assistants, digital forgetting, personalized noise, decaying photos, interpersonal privacy, tangible privacy, bystander privacy, temporal redactions, useable privacy, automated speech recognition 2 9 full false S2E8: Leveraging Federated Learning for Input Privacy with Victor Platt S2E8: Leveraging Federated Learning for Input Privacy with Victor Platt Victor Platt is a Senior AI Security and Privacy Strategist who previously served as Head of Security and Privacy for privacy tech company, Integrate.ai. Victor was formerly a founding member of the Risk AI Team with Omnia AI, Deloitt’s artificial intelligence practice in Canada. He joins today to discuss privacy enhancing technologies (PETs) that are shaping industries around the world, with a focus on federated learning.

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------


Victor views PETs as functional requirements and says they shouldn’t be buried in your design document as nonfunctional obligations. In his work, he has found key gaps where organizations were only doing “security for security’s sake.” Rather, he believes organizations should be thinking about it at the forefront. Not only that, we should all be getting excited about it because we all have a stake in privacy.


With federated learning, you have the tools available to train ML models on large data sets with precision at scale without risking user privacy. In this conversation, Victor demystifies what federated learning is, describes the 2 different types: at the edge and across data silos, and explains how it works and how it compares to traditional machine learning.We deep dive into how an organization knows when to use federated learning, with specific advice for developers and data scientists as they implement it into their organizations.


Topics Covered:

  • What 'federated learning' is and how it compares to traditional machine learning
  • When an organization should use vertical federated learning vs horizontal federated learning, or instead a hybrid version
  • A key challenge in 'transfer learning': knowing whether two data sets are related to each other and techniques to overcome this, like 'private set intersection'
  • How the future of technology will be underpinned by a 'constellation of PETs' 
  • The distinction between 'input privacy' vs. 'output privacy'
  • Different kinds of federated learning with use case examples
  • Where the responsibility for adding PETs lies within an organization
  • The key barriers to adopting federated learning and other PETs within different industries and use cases
  • How to move the needle on data privacy when it comes to legislation and regulation

Resources Mentioned:

Guest Info:

Follow the SPL Show:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Victor Platt is a Senior AI Security and Privacy Strategist who previously served as Head of Security and Privacy for privacy tech company, Integrate.ai. Victor was formerly a founding member of the Risk AI Team with Omnia AI, Deloitt’s artificial intelligence practice in Canada. He joins today to discuss privacy enhancing technologies (PETs) that are shaping industries around the world, with a focus on federated learning.

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------


Victor views PETs as functional requirements and says they shouldn’t be buried in your design document as nonfunctional obligations. In his work, he has found key gaps where organizations were only doing “security for security’s sake.” Rather, he believes organizations should be thinking about it at the forefront. Not only that, we should all be getting excited about it because we all have a stake in privacy.


With federated learning, you have the tools available to train ML models on large data sets with precision at scale without risking user privacy. In this conversation, Victor demystifies what federated learning is, describes the 2 different types: at the edge and across data silos, and explains how it works and how it compares to traditional machine learning.We deep dive into how an organization knows when to use federated learning, with specific advice for developers and data scientists as they implement it into their organizations.


Topics Covered:

  • What 'federated learning' is and how it compares to traditional machine learning
  • When an organization should use vertical federated learning vs horizontal federated learning, or instead a hybrid version
  • A key challenge in 'transfer learning': knowing whether two data sets are related to each other and techniques to overcome this, like 'private set intersection'
  • How the future of technology will be underpinned by a 'constellation of PETs' 
  • The distinction between 'input privacy' vs. 'output privacy'
  • Different kinds of federated learning with use case examples
  • Where the responsibility for adding PETs lies within an organization
  • The key barriers to adopting federated learning and other PETs within different industries and use cases
  • How to move the needle on data privacy when it comes to legislation and regulation

Resources Mentioned:

Guest Info:

Follow the SPL Show:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/396366 Debra J Farber / Victor Platt Buzzsprout-12209272 Tue, 28 Feb 2023 06:00:00 -0800 2480 federated learning, PETs, Victor Platt, privacy enhancing technologies, input privacy, output privacy, private set intersection, OpenMined, horizontal federated learning, vertical federated learning, AI, machine learning, Our Privacy Opportunity, data val 2 8 full false S2E7: Bring Your Own Data, ChatGPT & Personal AIs with Markus Lampinen (Prifina) S2E7: Bring Your Own Data, ChatGPT & Personal AIs with Markus Lampinen (Prifina) In this conversation with Markus Lampinen, Co-founder and CEO at Prifina, a personal data platform, we discuss meaty topics like: Prifina’s approach to building privacy-respected apps for consumer wearable sensors; LLMs (Large Language Models) like Chat GPT; and why we should consider training our own personal AIs.

Markus shares his entrepreneurial journey in the privacy world and how he is “the biggest data nerd you’ll find.” It started with tracking his own data, like his eating habits, activity, sleep, and stress, an then he built his company around that interest. His curiosity about what you can glean from one's own data made him wonder how you could also improve your life or the lives of your customers with that data.

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------

We discuss how to approach building a privacy-first platform to unlock the value and use of IOT / sensor data. It began with the concept of individual ownership: who should actually benefit from the data that we generate? Markus says it should be individuals themselves.

Prifina boasts a strong community of 30,000 developers who align around common interests - liberty, equality & data - and build and test prototypes that are gathering and utilizing the data working for individuals, as opposed to corporate entities. The aim is to empower individuals, companies & developers to build apps that re-purpose individuals' own sensor data to gain privacy-enabled insights.

---------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
---------

Topics Covered:

  • Enabling true, consumer-grade 'data portability' with personal data clouds (a 'bring your own data' approach)
  • Use cases to illustrate the problems Prifina is solving with sensors
  • What are large language models (LLM) and chatbots trained on them, and why they are so hot right now
  • The dangers of using LLMs, with emphasis on privacy harms
  • How to benefit from our own data with personal AIs
  • Advice to data scientists, researchers and developers regarding how to architect for ethical uses of LLMs
  • Who's responsible for educating the public about LLMs, chatbots, and their potential harms & limitations


Resources Mentioned:


Guest Info:

  • Follow Markus on

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> In this conversation with Markus Lampinen, Co-founder and CEO at Prifina, a personal data platform, we discuss meaty topics like: Prifina’s approach to building privacy-respected apps for consumer wearable sensors; LLMs (Large Language Models) like Chat GPT; and why we should consider training our own personal AIs.

Markus shares his entrepreneurial journey in the privacy world and how he is “the biggest data nerd you’ll find.” It started with tracking his own data, like his eating habits, activity, sleep, and stress, an then he built his company around that interest. His curiosity about what you can glean from one's own data made him wonder how you could also improve your life or the lives of your customers with that data.

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------

We discuss how to approach building a privacy-first platform to unlock the value and use of IOT / sensor data. It began with the concept of individual ownership: who should actually benefit from the data that we generate? Markus says it should be individuals themselves.

Prifina boasts a strong community of 30,000 developers who align around common interests - liberty, equality & data - and build and test prototypes that are gathering and utilizing the data working for individuals, as opposed to corporate entities. The aim is to empower individuals, companies & developers to build apps that re-purpose individuals' own sensor data to gain privacy-enabled insights.

---------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
---------

Topics Covered:

  • Enabling true, consumer-grade 'data portability' with personal data clouds (a 'bring your own data' approach)
  • Use cases to illustrate the problems Prifina is solving with sensors
  • What are large language models (LLM) and chatbots trained on them, and why they are so hot right now
  • The dangers of using LLMs, with emphasis on privacy harms
  • How to benefit from our own data with personal AIs
  • Advice to data scientists, researchers and developers regarding how to architect for ethical uses of LLMs
  • Who's responsible for educating the public about LLMs, chatbots, and their potential harms & limitations


Resources Mentioned:


Guest Info:

  • Follow Markus on

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/391573 Debra J. Farber / Markus Lampinen Buzzsprout-12209256 Tue, 21 Feb 2023 06:00:00 -0800 3540 personal AIs, privacy, ChatGPT, LLMs, large language models, sensors, model, developers, generative AI, Prifina 2 7 full false S2E6: 'Privacy Left Trust' with Gary LaFever (Anonos) S2E6: 'Privacy Left Trust' with Gary LaFever (Anonos) Today, I welcome Gary LaFever, co-CEO & GC at Anonos; WEF Global Innovator; and a solutions-oriented futurist with a computer science and legal background. Gary has over 35 years of technical, legal and policy experience that enables him to approach issues from multiple perspectives. I last saw Gary when we shared the stage at a RegTech conference in London six years ago, and it was a pleasure to speak with him again to discuss how the Schrems II decision coupled with the increasing prevalence of data breaches and ransomware attacks have shifted privacy left from optional to mandatory, necessitating a "privacy left trust" approach.

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------

Gary describes the 7 Universal Data Use Cases with relatable examples and how they are applicable across orgs and industries, regardless of jurisdiction. We then dive into what Gary is seeing in the market in regard to the use cases. He then reveals the 3 Main Data Use Obstacles to accomplishing these use cases and how to overcome them with "statutory pseudonymization" and "synthetic data."


In this conversation that evaluates how we can do business in a de-risked environment, we discuss why you can't approach privacy with just words - contracts, policies, and treaties; why it's essential to protect data in use;  and how you can embed technical controls that move with data for protection that meets regulatory thresholds while "in use" to unlock additional data use cases. I.e., these effective controls equate to competitive advantage.

Topics Covered:

  • Why trust must be updated to be technologically enforced - "privacy left trust"
  • The increasing prevalence of data breaches and ransomware attacks and how they have shifted privacy left from optional to mandatory
  • 7 Data Use Cases, 3 Data Use Obstacles, and deployable technologies to unlock new data use cases
  • How the market is adopting technology for the 7 use cases and trends that Gary is seeing
  • What it means to "de-risk" data
  • Beneficial uses of "variant twins" technology
  • Building privacy in by design, so it increases revenue generation
  • "Statutory pseudonymization" and how it will help you reduce data privacy risks while increasing utility and value

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Today, I welcome Gary LaFever, co-CEO & GC at Anonos; WEF Global Innovator; and a solutions-oriented futurist with a computer science and legal background. Gary has over 35 years of technical, legal and policy experience that enables him to approach issues from multiple perspectives. I last saw Gary when we shared the stage at a RegTech conference in London six years ago, and it was a pleasure to speak with him again to discuss how the Schrems II decision coupled with the increasing prevalence of data breaches and ransomware attacks have shifted privacy left from optional to mandatory, necessitating a "privacy left trust" approach.

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------

Gary describes the 7 Universal Data Use Cases with relatable examples and how they are applicable across orgs and industries, regardless of jurisdiction. We then dive into what Gary is seeing in the market in regard to the use cases. He then reveals the 3 Main Data Use Obstacles to accomplishing these use cases and how to overcome them with "statutory pseudonymization" and "synthetic data."


In this conversation that evaluates how we can do business in a de-risked environment, we discuss why you can't approach privacy with just words - contracts, policies, and treaties; why it's essential to protect data in use;  and how you can embed technical controls that move with data for protection that meets regulatory thresholds while "in use" to unlock additional data use cases. I.e., these effective controls equate to competitive advantage.

Topics Covered:

  • Why trust must be updated to be technologically enforced - "privacy left trust"
  • The increasing prevalence of data breaches and ransomware attacks and how they have shifted privacy left from optional to mandatory
  • 7 Data Use Cases, 3 Data Use Obstacles, and deployable technologies to unlock new data use cases
  • How the market is adopting technology for the 7 use cases and trends that Gary is seeing
  • What it means to "de-risk" data
  • Beneficial uses of "variant twins" technology
  • Building privacy in by design, so it increases revenue generation
  • "Statutory pseudonymization" and how it will help you reduce data privacy risks while increasing utility and value

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/384440 Debra J Farber / Gary LaFever Buzzsprout-12179640 Tue, 14 Feb 2023 06:00:00 -0800 3513 privacy left trust, universal data use cases, Schrems II, Anonos, Gary LaFever, PETs, privacy enhancing technologies, anonymization, pseudonymization, pseudonymisation, proportionality, GDPR, privacy, statutory pseudonymization, data sharing, analytics 2 6 full false S2E5 - What's New in Privacy-by-Design with R. Jason Cronk (IOPD) S2E5 - What's New in Privacy-by-Design with R. Jason Cronk (IOPD) R. Jason Cronk is the Founder of the Institute of Operational Privacy Design (IOPD) and CEO of Enterprivacy Consulting Group, as well as the author of Strategic Privacy by Design. I recently caught up with Jason at the annual Privacy Law Salon event and had a conversation about the socio-technical challenges of privacy, different privacy-by-design frameworks that he’s worked on, and his thoughts on some hot topics in the web privacy space.

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------

We start off discussing updates to  Strategic Privacy by Design, now in it's 2nd edition. We chat about the brand new ISO 31700 Privacy by Design for Consumer Goods and Services standard and consensus process and  compare it to the NIST Privacy Framework, IEEE 7002 Standard for Data Privacy, and Jason's work with the Institute of Operational Privacy Design (IOPD) and it's newly-published Design Process Standard v1. 


Jason and I also explore risk tolerance through the lens of privacy using FAIR. There’s a lot of room for subjective interpretation, particularly of non-monetary harm, and Jason provides many thought-provoking examples of how this plays out in our society. We round out our conversation by talking about the challenges of Global Privacy Control (GPC) and what deceptive design strategies to look out for.


Topics Covered:

  • Why we should think of privacy beyond "digital privacy"
  • What readers can expect from Jason’s book,  Strategic Privacy by Design, and what’s included in the 2nd edition
  • IOPD’s B2B third-party privacy audit
  • Why you should leverage the FAIR quantitative risk analysis model to define address effective privacy risk management programs
  • The NIST Privacy Framework and developments of its Privacy Workforce Working Group
  • Dark patterns & why just asking the wrong question can be a privacy harm (interrogation)
  • How there are 15 privacy harms & only 1 of them is about security

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> R. Jason Cronk is the Founder of the Institute of Operational Privacy Design (IOPD) and CEO of Enterprivacy Consulting Group, as well as the author of Strategic Privacy by Design. I recently caught up with Jason at the annual Privacy Law Salon event and had a conversation about the socio-technical challenges of privacy, different privacy-by-design frameworks that he’s worked on, and his thoughts on some hot topics in the web privacy space.

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------

We start off discussing updates to  Strategic Privacy by Design, now in it's 2nd edition. We chat about the brand new ISO 31700 Privacy by Design for Consumer Goods and Services standard and consensus process and  compare it to the NIST Privacy Framework, IEEE 7002 Standard for Data Privacy, and Jason's work with the Institute of Operational Privacy Design (IOPD) and it's newly-published Design Process Standard v1. 


Jason and I also explore risk tolerance through the lens of privacy using FAIR. There’s a lot of room for subjective interpretation, particularly of non-monetary harm, and Jason provides many thought-provoking examples of how this plays out in our society. We round out our conversation by talking about the challenges of Global Privacy Control (GPC) and what deceptive design strategies to look out for.


Topics Covered:

  • Why we should think of privacy beyond "digital privacy"
  • What readers can expect from Jason’s book,  Strategic Privacy by Design, and what’s included in the 2nd edition
  • IOPD’s B2B third-party privacy audit
  • Why you should leverage the FAIR quantitative risk analysis model to define address effective privacy risk management programs
  • The NIST Privacy Framework and developments of its Privacy Workforce Working Group
  • Dark patterns & why just asking the wrong question can be a privacy harm (interrogation)
  • How there are 15 privacy harms & only 1 of them is about security

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/383160 Debra J. Farber / R. Jason Cronk Buzzsprout-12177884 Tue, 07 Feb 2023 06:00:00 -0800 3512 privacy by design, PbD, consent, IOPD, Institute of Privacy Design, privacy design, ISO 31700 2 5 full false S2E4: Training the Next Wave of Privacy Engineers with Nishant Bhajaria (Uber) S2E4: Training the Next Wave of Privacy Engineers with Nishant Bhajaria (Uber) Nishant Bhajaria is the Director of Privacy Engineering, Architecture, & Analytics at Uber and Author of "Data Privacy: A Runbook for Engineers.” He’s also an Advisor to Data Protocol, Privado & Piiano. In our conversation, we discuss privacy engineering trends, educational materials that Nishant has developed, and his advice to privacy technologists, engineers, and hiring managers. 

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------


Nishant is a great example of a cross-functional, influential agent who has adapted to the ever-growing privacy discipline. He describes himself as an engineer for the attorneys and an attorney for the engineers, which has helped him secure positions at WebMD, Nike, Netflix, and now Uber. 

Nishant shares his advice for career development, both through the lens of how to break into the privacy space and also how to grow within your role. He explains how he’s been able to get board-level understanding about the importance of privacy as a product, not an afterthought. He also highlights takeaways from his book and online courses.


Topics Covered:

  • How privacy engineers can secure their jobs during this widespread tech industry layoff 
  • Privacy tech as the glue between different teams and in-house services
  • How to make privacy more visible to the business as something that benefits the bottom line 
  • Common mistakes that Nishant sees engineers make when it comes to privacy 
  • What’s covered in Nishant’s ‘Privacy by Design’ courses 

Resources Mentioned:

Guest Info:

Follow the SPL Show:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Nishant Bhajaria is the Director of Privacy Engineering, Architecture, & Analytics at Uber and Author of "Data Privacy: A Runbook for Engineers.” He’s also an Advisor to Data Protocol, Privado & Piiano. In our conversation, we discuss privacy engineering trends, educational materials that Nishant has developed, and his advice to privacy technologists, engineers, and hiring managers. 

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------


Nishant is a great example of a cross-functional, influential agent who has adapted to the ever-growing privacy discipline. He describes himself as an engineer for the attorneys and an attorney for the engineers, which has helped him secure positions at WebMD, Nike, Netflix, and now Uber. 

Nishant shares his advice for career development, both through the lens of how to break into the privacy space and also how to grow within your role. He explains how he’s been able to get board-level understanding about the importance of privacy as a product, not an afterthought. He also highlights takeaways from his book and online courses.


Topics Covered:

  • How privacy engineers can secure their jobs during this widespread tech industry layoff 
  • Privacy tech as the glue between different teams and in-house services
  • How to make privacy more visible to the business as something that benefits the bottom line 
  • Common mistakes that Nishant sees engineers make when it comes to privacy 
  • What’s covered in Nishant’s ‘Privacy by Design’ courses 

Resources Mentioned:

Guest Info:

Follow the SPL Show:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/376909 Debra J. Farber / Nishant Bhajaria Buzzsprout-12147778 Tue, 31 Jan 2023 02:00:00 -0800 2557 privacy engineering, privacy engineer, privacy engineering certification, LinkedIn Learning, tech, hiring, Data Protocol, Privacy Engineering Certification, Privado 2 4 full false S2E3: Fixing Consent & Transparency on the Web with Mark Lizar (Digital Transparency Lab) S2E3: Fixing Consent & Transparency on the Web with Mark Lizar (Digital Transparency Lab) To kick off Data Privacy Week 2023, I’m joined by Mark Lizar, CEO of the Digital Transparency Lab and Founder of 0PN: Open Privacy Network. 

Mark is also the Vice Chair of the IEEE Cybersecurity for Next-Generation Connectivity Systems' Human Control & Flow Sub-Committee and Editor & Lead Author of the ANCR Notice Record Specification and Framework at the Kantara Initiative. 

In our conversation, we unpack the current standards and specifications for transparency and data control in the digital space. Mark shares some of the innovative solutions he and his colleagues are working on to bridge the gap in web consent. 


---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------


Mark unpacks his interpretation of the open transparency standards, laws, and tech required for privacy to scale digitally. One of the major use cases he’s working on at 0PN is called ‘Do Track,’ which is a response to the shortcomings of the current ‘Do Not Track’ mechanism that we have in place today. The Controller Credential Standard allows users to specify or direct consent, and he shares some exciting examples of how users can use ‘Do Track’ to take back control over their own data. 

Mark breaks down the four levels of privacy assurance achieved Controller Credential Framework and explains what’s needed to gain market traction for this privacy-enabling tech standard. He also gives us a peek into what else they’re working on over at the Digital Transparency Lab and how to get involved with the organization and their efforts..

---------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
---------

Topics Covered:

  • A simple way to understand online consents vs. system permissions 
  • Why it’s important to see who's controlling our data 
  • How the new Controller Credential gives people autonomy over their own data
  • International privacy instruments that can be scaled for local use 
  • A new digital model for representing physical privacy 

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> To kick off Data Privacy Week 2023, I’m joined by Mark Lizar, CEO of the Digital Transparency Lab and Founder of 0PN: Open Privacy Network. 

Mark is also the Vice Chair of the IEEE Cybersecurity for Next-Generation Connectivity Systems' Human Control & Flow Sub-Committee and Editor & Lead Author of the ANCR Notice Record Specification and Framework at the Kantara Initiative. 

In our conversation, we unpack the current standards and specifications for transparency and data control in the digital space. Mark shares some of the innovative solutions he and his colleagues are working on to bridge the gap in web consent. 


---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------


Mark unpacks his interpretation of the open transparency standards, laws, and tech required for privacy to scale digitally. One of the major use cases he’s working on at 0PN is called ‘Do Track,’ which is a response to the shortcomings of the current ‘Do Not Track’ mechanism that we have in place today. The Controller Credential Standard allows users to specify or direct consent, and he shares some exciting examples of how users can use ‘Do Track’ to take back control over their own data. 

Mark breaks down the four levels of privacy assurance achieved Controller Credential Framework and explains what’s needed to gain market traction for this privacy-enabling tech standard. He also gives us a peek into what else they’re working on over at the Digital Transparency Lab and how to get involved with the organization and their efforts..

---------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
---------

Topics Covered:

  • A simple way to understand online consents vs. system permissions 
  • Why it’s important to see who's controlling our data 
  • How the new Controller Credential gives people autonomy over their own data
  • International privacy instruments that can be scaled for local use 
  • A new digital model for representing physical privacy 

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/371456 Debra J. Farber / Mark Lizar Buzzsprout-12096997 Tue, 24 Jan 2023 06:00:00 -0800 3032 privacy, consent, standards, transparency, credential, permissions, security, controller, digital privacy, surveillance, web, trust, control, Consent Receipts, Digital Transparency Lab, Kantara Initiative, 0PN, Open Privacy, ZPN, Zero Public Network 2 3 full false S2E2: "Software Libraries, SBOMs & Wicked Privacy, Oh My!" with Michelle Dennedy (PrivacyCode) S2E2: "Software Libraries, SBOMs & Wicked Privacy, Oh My!" with Michelle Dennedy (PrivacyCode) Michelle Dennedy is Co-Founder & CEO of PrivacyCode, Inc., Partner at Privatus Consulting, and the Co-Author of The Privacy Engineer's Manifesto. In our lively conversation, we discuss the digital cost of information, the privacy problems that her company solves for, and how the Privatus Wicked Privacy™ framework differs from other approaches.

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------


As Michelle puts it, we’re living in an ‘innovation palooza’ right now. But, there’s still progress to be made. Michelle highlights how we can change the investment proposition to get more VCs and investors to see privacy is a strategic business enabler. At PrivacyCode, they’re focused on creating a simple way to communicate the language of ‘people data’ across specialities.

Part of the solution includes having a software bill of materials (SBOM), which is essentially a list of ingredients that make up software components. Michelle shares a tangible example of how an SBOM creates flow, compliance, and transparency in new areas of tech. She also touches on her consulting work, including her simple strategy for determining privacy benefit metrics.


Topics Covered:

  • Privacy as a strategic enabler
  • Why Michelle thinks "today's VCs are more of a mood than an algorithm"
  • How PrivacyCode allows users to orchestrate requirements across various departments and lets specialists operate in their "zone of genius"
  • What a Software Bill of Materials (SBOM) is & why we need one to ensure privacy
  • Michelle's advice to privacy engineers on how to leverage an SBOM for quality code
  • Michelle's work at Privatus Consulting and their Wicked Privacy Framework
  • Examples of creative, straightforward privacy metrics

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Michelle Dennedy is Co-Founder & CEO of PrivacyCode, Inc., Partner at Privatus Consulting, and the Co-Author of The Privacy Engineer's Manifesto. In our lively conversation, we discuss the digital cost of information, the privacy problems that her company solves for, and how the Privatus Wicked Privacy™ framework differs from other approaches.

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------


As Michelle puts it, we’re living in an ‘innovation palooza’ right now. But, there’s still progress to be made. Michelle highlights how we can change the investment proposition to get more VCs and investors to see privacy is a strategic business enabler. At PrivacyCode, they’re focused on creating a simple way to communicate the language of ‘people data’ across specialities.

Part of the solution includes having a software bill of materials (SBOM), which is essentially a list of ingredients that make up software components. Michelle shares a tangible example of how an SBOM creates flow, compliance, and transparency in new areas of tech. She also touches on her consulting work, including her simple strategy for determining privacy benefit metrics.


Topics Covered:

  • Privacy as a strategic enabler
  • Why Michelle thinks "today's VCs are more of a mood than an algorithm"
  • How PrivacyCode allows users to orchestrate requirements across various departments and lets specialists operate in their "zone of genius"
  • What a Software Bill of Materials (SBOM) is & why we need one to ensure privacy
  • Michelle's advice to privacy engineers on how to leverage an SBOM for quality code
  • Michelle's work at Privatus Consulting and their Wicked Privacy Framework
  • Examples of creative, straightforward privacy metrics

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/359647 Debra J Farber / Michelle Dennedy Buzzsprout-12005078 Tue, 10 Jan 2023 06:00:00 -0800 3453 privacy, metrics, Wicked Privacy, PrivacyCode, Privatus Consulting, Michelle Dennedy, software libraries, data value, privacy by design, SBOM, software bill of materials, engineers, developers, shift left, VC, privacy tech 2 2 full false S2E1: Driving Privacy Left: Vehicular Privacy with Andrea Amico (Privacy4Cars) S2E1: Driving Privacy Left: Vehicular Privacy with Andrea Amico (Privacy4Cars) Of the almost 300 million cars that are in circulation in the U.S., the vast majority collect consumer’s personal information. Every time you connect your phone via USB or Bluetooth, your car is designed to download data and store it locally. The automotive industry is grossly behind when it comes to data privacy and safety, but that’s where Privacy4Cars comes in. 

Privacy4Cars is the first (and only) privacy tech company focused on identifying the challenges posed by vehicle data. They create solutions to better protect consumers and businesses by offering improved privacy, safety, security, and compliance. 

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------

In our conversation, Andrea reveals how personal data flows through vehicular systems and networks. He highlights the type of data that can be easily found in cars, such as your frequently visited addresses, garage codes, text messages, emails, and so on. Andrea explains the different privacy concerns that have so far remained unaddressed across the industry and his theory on why these gaps exist. 


It might be unsettling to hear about the state of privacy in the automotive industry, but fortunately, the folks at Privacy4Cars are dedicated to creating new standards. Andrea shares what the industry reaction has been to Privacy4Cars’ initiatives and highlights some other organizations that are leading innovation on this issue. 

---------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
---------

Topics Covered:

  • Andrea’s professional background and what inspired him to launch Privacy4Cars
  • Debunking common myths about data storage and security in cars 
  • Where car data privacy falls under EU GDPR
  • How Privacy4Cars helps companies solve compliance issues
  • Feedback from third-party wholesalers, dealerships, and service providers 
  • Advice for automotive software developers when architecting systems and networks in this space 

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Of the almost 300 million cars that are in circulation in the U.S., the vast majority collect consumer’s personal information. Every time you connect your phone via USB or Bluetooth, your car is designed to download data and store it locally. The automotive industry is grossly behind when it comes to data privacy and safety, but that’s where Privacy4Cars comes in. 

Privacy4Cars is the first (and only) privacy tech company focused on identifying the challenges posed by vehicle data. They create solutions to better protect consumers and businesses by offering improved privacy, safety, security, and compliance. 

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------

In our conversation, Andrea reveals how personal data flows through vehicular systems and networks. He highlights the type of data that can be easily found in cars, such as your frequently visited addresses, garage codes, text messages, emails, and so on. Andrea explains the different privacy concerns that have so far remained unaddressed across the industry and his theory on why these gaps exist. 


It might be unsettling to hear about the state of privacy in the automotive industry, but fortunately, the folks at Privacy4Cars are dedicated to creating new standards. Andrea shares what the industry reaction has been to Privacy4Cars’ initiatives and highlights some other organizations that are leading innovation on this issue. 

---------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
---------

Topics Covered:

  • Andrea’s professional background and what inspired him to launch Privacy4Cars
  • Debunking common myths about data storage and security in cars 
  • Where car data privacy falls under EU GDPR
  • How Privacy4Cars helps companies solve compliance issues
  • Feedback from third-party wholesalers, dealerships, and service providers 
  • Advice for automotive software developers when architecting systems and networks in this space 

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/353742 Debra J Farber / Andrea Amico Buzzsprout-11949739 Tue, 03 Jan 2023 06:00:00 -0800 3476 privacy, data protection, cars, vehicles, automotive, dealerships, fleets, surveillance, data retention, data deletion, Privacy4Cars, Andrea Amico, ethics, hacking 2 1 full false S1E9: Funding Web3 Privacy & Recent Web3 Trust Fails with Jim Nasr S1E9: Funding Web3 Privacy & Recent Web3 Trust Fails with Jim Nasr This week, I continue my conversation with Jim Nasr, CEO of Acoer about privacy and using distributed ledger technology (DLT). We discuss his work leading The HBAR Foundation's Privacy Market Development Fund and the trends he sees across grant applicants. We also chat about the collapse of FTX and the ripple effect it’s had on the crypto space. 

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------


Jim tells us about the types of innovations The HBAR Foundation seeks to fund; why privacy & security usability is an imperative; uses cases for decentralized identifiers (DIDs) and new "DID methods" like PKH. We also discuss FTX's collapse and how to provide real transparency and data regulation in DLT technology. 


---------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
---------


Topics Covered:

  • The HBAR Foundation’s search for projects to fund that enhance privacy usability
  • Exciting privacy use cases Jim has seen using Hedera's DLT, including those that enable high-value, privacy-preserving transactions 
  • What went wrong with FTX and what we can learn from it's collapse 
  • How decentralized identity can enable the next iteration of web privacy
  • The tech behind MetaMask's Snap software that allows anyone to safely extend capabilities of their wallet 

Resources Mentioned:

Jim Nasr’s Info:

Follow the SPL Show:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week, I continue my conversation with Jim Nasr, CEO of Acoer about privacy and using distributed ledger technology (DLT). We discuss his work leading The HBAR Foundation's Privacy Market Development Fund and the trends he sees across grant applicants. We also chat about the collapse of FTX and the ripple effect it’s had on the crypto space. 

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------


Jim tells us about the types of innovations The HBAR Foundation seeks to fund; why privacy & security usability is an imperative; uses cases for decentralized identifiers (DIDs) and new "DID methods" like PKH. We also discuss FTX's collapse and how to provide real transparency and data regulation in DLT technology. 


---------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
---------


Topics Covered:

  • The HBAR Foundation’s search for projects to fund that enhance privacy usability
  • Exciting privacy use cases Jim has seen using Hedera's DLT, including those that enable high-value, privacy-preserving transactions 
  • What went wrong with FTX and what we can learn from it's collapse 
  • How decentralized identity can enable the next iteration of web privacy
  • The tech behind MetaMask's Snap software that allows anyone to safely extend capabilities of their wallet 

Resources Mentioned:

Jim Nasr’s Info:

Follow the SPL Show:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/342716 Debra J Farber / Jim Nasr Buzzsprout-11880124 Tue, 20 Dec 2022 06:00:00 -0800 3523 Privacy, DLT, distributed ledgers, Acoer, hashgraph, The HBAR Foundation, Hedera, cryptocurrency, crypto, FTX, trust, usable privacy, centralized exchanges, adoption, transactions, web3, DIDs, verified credentials 1 9 full false S1E8: Leveraging Distributed Ledgers for Privacy Assurance with Jim Nasr S1E8: Leveraging Distributed Ledgers for Privacy Assurance with Jim Nasr Today, I am joined by Jim Nasr, CEO of Acoer. I had the pleasure of collaborating with Jim on several projects during my 6-month stint as Privacy Strategist for Hedera. Jim joins me today to discuss the use of distributed ledger tech (DLT) to provide computational trust for real-time applications. Jim and I speak about the development of secure, privacy-preserving, and traceable technologies, which can gain adoption via open protocols and usable interfaces.

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------

In part one of this two-episode conversation, Jim explains Acoer's approach to building DLT-enabled software and its initial application to healthcare and clinical trials. Jim shares his background and experience in tech both academically and professionally; as an entrepreneur in software development; his roles in large-scale tech companies and with the government at the CDC; and how he enjoyed “getting his hands dirty” in public health to bring automated trust and accountability to the space. At Acoer, Jim continues his previous work - to build open technologies - by leveraging DLT and also building interfaces with usable privacy and security. 


In this conversation, Jim also covers the security and privacy approaches that Acoer takes to ensure that its products work as advertised and so that the machinery of its clients is never compromised.

----------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
----------


Topics Covered:

  • How Acoer designs and builds its tech as components to be absorbed & consumed by other machines
  • How using DLT reduces the need for intermediaries
  • Acoer's approach to building decentralized apps & why it chose to build on hashgraph tech instead of blockchain
  • Benefits gained from DLT's "data stamping" to computationally prove transactions & to assist during data leakages, compliance issues, or to demonstrate privacy assurance
  • How you can use NFTs to represent individuals' consents via RightsHash

Resources Mentioned:

Jim Nasr's Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> Today, I am joined by Jim Nasr, CEO of Acoer. I had the pleasure of collaborating with Jim on several projects during my 6-month stint as Privacy Strategist for Hedera. Jim joins me today to discuss the use of distributed ledger tech (DLT) to provide computational trust for real-time applications. Jim and I speak about the development of secure, privacy-preserving, and traceable technologies, which can gain adoption via open protocols and usable interfaces.

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------

In part one of this two-episode conversation, Jim explains Acoer's approach to building DLT-enabled software and its initial application to healthcare and clinical trials. Jim shares his background and experience in tech both academically and professionally; as an entrepreneur in software development; his roles in large-scale tech companies and with the government at the CDC; and how he enjoyed “getting his hands dirty” in public health to bring automated trust and accountability to the space. At Acoer, Jim continues his previous work - to build open technologies - by leveraging DLT and also building interfaces with usable privacy and security. 


In this conversation, Jim also covers the security and privacy approaches that Acoer takes to ensure that its products work as advertised and so that the machinery of its clients is never compromised.

----------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
----------


Topics Covered:

  • How Acoer designs and builds its tech as components to be absorbed & consumed by other machines
  • How using DLT reduces the need for intermediaries
  • Acoer's approach to building decentralized apps & why it chose to build on hashgraph tech instead of blockchain
  • Benefits gained from DLT's "data stamping" to computationally prove transactions & to assist during data leakages, compliance issues, or to demonstrate privacy assurance
  • How you can use NFTs to represent individuals' consents via RightsHash

Resources Mentioned:

Jim Nasr's Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/336594 Debra J Farber / Jim Nasr Buzzsprout-11852476 Tue, 13 Dec 2022 06:00:00 -0800 3139 privacy, blockchain, hashgraph, Hedera, distributed ledgers, DLT, healthcare, consent, public ledger, intermediaries, decentralization, RightsHash, iPrivata, Jim Nasr, privacy assurance, instant audit, accountability, innovation 1 8 full false S1E7: Privacy Engineers: The Next Generation with Lorrie Cranor (CMU) S1E7: Privacy Engineers: The Next Generation with Lorrie Cranor (CMU) In this episode, I’m joined by Lorrie Cranor, FORE Systems Professor, Computer Science and Engineering & Public Policy at Carnegie Mellon University (CMU); Director, CyLab Usable Privacy and Security Laboratory; and Co-Director, of CMU's MSIT-Privacy Engineering Masters Program. We discuss the different tracks within the Privacy Engineering Program at CMU, privacy engineering hiring trends, the need for industry education, and Lorrie’s research outside of the classroom.

----------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
----------

Lorrie explains how this next generation of privacy experts and engineers can work together to bring new architectures, innovations, and software to market. She describes the kind of hands-on work in which her students participate, including a capstone project sponsored by Meta that’s exploring ways the platform can integrate more privacy education into its UI/UX.

In addition, Lorrie shares her perspective on the job market for privacy engineers for recent grads and explains how CMU’s Certificate Program in Privacy Engineering aims to meet the high demand for experienced privacy experts with knowledge of privacy engineering concepts. We also get into her research on cookie banners and privacy “nutrition labels” for IoT devices.


Topics Covered:

  • Lorrie’s professional background and what drew her into privacy engineering
  • What candidates can expect from the Privacy Engineering Program at CMU 
  • Insights into how people interact with cookie banners and potential solutions to improve the user experience
  • Ways that we can bridge the hiring gap in our industry
  • Different sectors outside of tech that are looking for privacy experts, including finance and retail

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> In this episode, I’m joined by Lorrie Cranor, FORE Systems Professor, Computer Science and Engineering & Public Policy at Carnegie Mellon University (CMU); Director, CyLab Usable Privacy and Security Laboratory; and Co-Director, of CMU's MSIT-Privacy Engineering Masters Program. We discuss the different tracks within the Privacy Engineering Program at CMU, privacy engineering hiring trends, the need for industry education, and Lorrie’s research outside of the classroom.

----------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
----------

Lorrie explains how this next generation of privacy experts and engineers can work together to bring new architectures, innovations, and software to market. She describes the kind of hands-on work in which her students participate, including a capstone project sponsored by Meta that’s exploring ways the platform can integrate more privacy education into its UI/UX.

In addition, Lorrie shares her perspective on the job market for privacy engineers for recent grads and explains how CMU’s Certificate Program in Privacy Engineering aims to meet the high demand for experienced privacy experts with knowledge of privacy engineering concepts. We also get into her research on cookie banners and privacy “nutrition labels” for IoT devices.


Topics Covered:

  • Lorrie’s professional background and what drew her into privacy engineering
  • What candidates can expect from the Privacy Engineering Program at CMU 
  • Insights into how people interact with cookie banners and potential solutions to improve the user experience
  • Ways that we can bridge the hiring gap in our industry
  • Different sectors outside of tech that are looking for privacy experts, including finance and retail

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/324486 Debra J Farber / Lorrie Cranor Buzzsprout-11807121 Tue, 06 Dec 2022 04:00:00 -0800 2703 privacy engineer, privacy engineering, CMU, Carnegie Mellon University, CyLab, Usable Privacy, Masters in Privacy Engineering, Certificate in Privacy Engineering, privacy by design, computer science, hiring, IoT nutrition labels, cookies 1 7 full false S1E6: The Explosion of Privacy Tech with Lourdes Turrecha (TROPT) S1E6: The Explosion of Privacy Tech with Lourdes Turrecha (TROPT) This week, I’m joined by Lourdes Turrecha, Founder & Chief Privacy Tech Strategist at The Rise of Privacy Tech (TROPT). TROPT's mission is to fuel privacy innovation by bringing together privacy tech founders, investors, buyers, & expert-advisors to bridge the existing tech-capital-expertise gaps in the field. As a member of TROPT's Advisory Board, I’ve seen 1st-hand TROPT's innovative resources and events that they offer the industry.

----------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
----------

In our conversation, Lourdes and I explore the different facets of TROPT, particularly focusing on what’s included in the recently-published "TROPT Privacy Tech Stack 2.0 Whitepaper 2022." We discuss how buyers currently navigate the space, how TROPT supports privacy tech founders & the 5 biggest challenges that we see across privacy tech.

The whitepaper is a first-of-its-kind landscape that categorizes the different categories of privacy tech so the market can better understand the breadth and depth of the space. It highlights current trends and visions for the future of privacy tech, and addresses solutions to those 5 major pain points. Lourdes also dives into what we can expect from the TROPT Data Privacy Week 2023 in January and how to get involved. 


----------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
----------


Topics Covered:

  • TROPT’s free resources and paid offerings for privacy tech key players
  • The thought process behind the TROPT Privacy Tech Stack Review program 
  • The current frustrations of many privacy tech buyers and users' experience, especially on the B2B side
  • An overview of the 3 main topics covered in the whitepaper 
  • Proposed solutions for the challenges we’re facing in privacy tech 

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> This week, I’m joined by Lourdes Turrecha, Founder & Chief Privacy Tech Strategist at The Rise of Privacy Tech (TROPT). TROPT's mission is to fuel privacy innovation by bringing together privacy tech founders, investors, buyers, & expert-advisors to bridge the existing tech-capital-expertise gaps in the field. As a member of TROPT's Advisory Board, I’ve seen 1st-hand TROPT's innovative resources and events that they offer the industry.

----------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
----------

In our conversation, Lourdes and I explore the different facets of TROPT, particularly focusing on what’s included in the recently-published "TROPT Privacy Tech Stack 2.0 Whitepaper 2022." We discuss how buyers currently navigate the space, how TROPT supports privacy tech founders & the 5 biggest challenges that we see across privacy tech.

The whitepaper is a first-of-its-kind landscape that categorizes the different categories of privacy tech so the market can better understand the breadth and depth of the space. It highlights current trends and visions for the future of privacy tech, and addresses solutions to those 5 major pain points. Lourdes also dives into what we can expect from the TROPT Data Privacy Week 2023 in January and how to get involved. 


----------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
----------


Topics Covered:

  • TROPT’s free resources and paid offerings for privacy tech key players
  • The thought process behind the TROPT Privacy Tech Stack Review program 
  • The current frustrations of many privacy tech buyers and users' experience, especially on the B2B side
  • An overview of the 3 main topics covered in the whitepaper 
  • Proposed solutions for the challenges we’re facing in privacy tech 

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/316708 Debra J Farber / Lourdes Turrecha Buzzsprout-11646180 Tue, 29 Nov 2022 08:00:00 -0800 3226 privacy tech, privacy, privacy tech landscape, privacy-enhancing technologies, TROPT, The Rise of Privacy Tech, Lourdes Turrecha, privacy innovation 1 6 full false S1E5: The Rise of Global Data Sharing Platforms with Stephen Wilson (Constellation Research) S1E5: The Rise of Global Data Sharing Platforms with Stephen Wilson (Constellation Research) I’m joined by Stephen Wilson, accomplished data protection innovator, researcher, analyst and advisor who leads Digital Safety and Privacy efforts at Constellation Research and is Managing Director of Lockstep Technologies. In our conversation, we discuss the importance of information value chains, the emergence of data sharing platforms, discuss why data should be like clean drinking water, and explore the problems with "data ownership."

--------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
--------

Stephen explains the push for more data sharing and to establish user-centric business models that deliver value for businesses and benefits for individuals. We discuss emerging tools that assure the orderliness, fairness, and transparency of information value chains and why Stephen aims to take data processing "out of the shadows" with his research.

Lastly, we discuss key Facebook & Google EU court cases that addresses collection & use of facial biometrics  from people without sufficient consent and the challenges that Google and search engines have with addressing "the right to be forgotten." Plus, we discuss the privacy expectations within the ‘digital town square,’ particularly through the lens of Twitter and Facebook. 

---------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
---------

Topics Covered:

  • Stephen’s assertion that privacy is about restraint: what you choose to not know.
  • The rise of data sharing platforms to facilitate and scale global information value chains.
  • How if data is like “crude oil,” then it requires safe handling, and why we should treat data like "clean drinking water" instead.
  • The importance of data quality, data originality, and data lineage.
  • Stephen’s analysis of the growing market for “Data Protection as a Service," which includes: data clean rooms, privacy APIs, and more.
  • Why you don’t need to own your own data to get good privacy outcomes.

Resources Mentioned:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> I’m joined by Stephen Wilson, accomplished data protection innovator, researcher, analyst and advisor who leads Digital Safety and Privacy efforts at Constellation Research and is Managing Director of Lockstep Technologies. In our conversation, we discuss the importance of information value chains, the emergence of data sharing platforms, discuss why data should be like clean drinking water, and explore the problems with "data ownership."

--------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
--------

Stephen explains the push for more data sharing and to establish user-centric business models that deliver value for businesses and benefits for individuals. We discuss emerging tools that assure the orderliness, fairness, and transparency of information value chains and why Stephen aims to take data processing "out of the shadows" with his research.

Lastly, we discuss key Facebook & Google EU court cases that addresses collection & use of facial biometrics  from people without sufficient consent and the challenges that Google and search engines have with addressing "the right to be forgotten." Plus, we discuss the privacy expectations within the ‘digital town square,’ particularly through the lens of Twitter and Facebook. 

---------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
---------

Topics Covered:

  • Stephen’s assertion that privacy is about restraint: what you choose to not know.
  • The rise of data sharing platforms to facilitate and scale global information value chains.
  • How if data is like “crude oil,” then it requires safe handling, and why we should treat data like "clean drinking water" instead.
  • The importance of data quality, data originality, and data lineage.
  • Stephen’s analysis of the growing market for “Data Protection as a Service," which includes: data clean rooms, privacy APIs, and more.
  • Why you don’t need to own your own data to get good privacy outcomes.

Resources Mentioned:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/307165 Debra J. Farber / Stephen Wilson Buzzsprout-11736717 Tue, 22 Nov 2022 06:00:00 -0800 3564 data sharing, value chain, privacy, information flow, data quality, data originality, data lineage, data minimization, Lockstep, Constellation Research, World Bank, data protection as a service, privacy APIs, data clean rooms, digital identity, data owner 1 5 full false S1E4: The Hitchhiker's Guide to Privacy Engineering & Creative Privacy with Mert Can Boyar (Privacy Innovation Lab) S1E4: The Hitchhiker's Guide to Privacy Engineering & Creative Privacy with Mert Can Boyar (Privacy Innovation Lab) In this episode, I interview Mert Can Boyar,  Director of Privacy Innovation Lab at Bilgi University and Founder of privacy tech company, Verilogy. Mert walks us through his creative approach to educating on core privacy engineering concepts, particularly through the lens of storytelling, visual art & music. He also shares his vision & mission behind his passion project, “The Hitchhiker’s Guide to Privacy Engineering."

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------

Mert tells his "origin story" and dives into how he ended up in privacy and data protection. He highlights the thread of art & entrepreneurship throughout his career, which has taken him from musician to lawyer to start-up founder, and now educator. 


Privacy Innovation Lab is a multi-stakeholder hub for privacy innovation. Mert highlights exciting projects that his students are working on, including an assessment tool to help practitioners build fair & lawful AI models and new tech in the self-sovereign identity (SSI) space. 


While working at the lab, Mert came up with a “creative privacy" strategy, which he uses to inspire young minds about privacy engineering. In this episode, he takes us behind-the-scenes of his comic book project that’s meant to educate people who want to understand how modern software and data processing technologies function. 

---------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
---------

Topics Covered:

  • What initially sparked Mert’s interest in data and privacy protection 
  • How Mert uses his multifaceted & creative skillsets to bridge knowledge gaps between privacy law & engineering
  • Verilogy’s open source database tool that automates and streamlines the work that Mert was doing as a privacy lawyer 
  • Fascinating projects underway at Privacy Innovation Lab 
  • What Mert hopes to achieve with The Hitchhiker’s Guide to Privacy Engineering

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> In this episode, I interview Mert Can Boyar,  Director of Privacy Innovation Lab at Bilgi University and Founder of privacy tech company, Verilogy. Mert walks us through his creative approach to educating on core privacy engineering concepts, particularly through the lens of storytelling, visual art & music. He also shares his vision & mission behind his passion project, “The Hitchhiker’s Guide to Privacy Engineering."

---------
Thank you to our sponsor, Privado, the developer-friendly privacy platform
---------

Mert tells his "origin story" and dives into how he ended up in privacy and data protection. He highlights the thread of art & entrepreneurship throughout his career, which has taken him from musician to lawyer to start-up founder, and now educator. 


Privacy Innovation Lab is a multi-stakeholder hub for privacy innovation. Mert highlights exciting projects that his students are working on, including an assessment tool to help practitioners build fair & lawful AI models and new tech in the self-sovereign identity (SSI) space. 


While working at the lab, Mert came up with a “creative privacy" strategy, which he uses to inspire young minds about privacy engineering. In this episode, he takes us behind-the-scenes of his comic book project that’s meant to educate people who want to understand how modern software and data processing technologies function. 

---------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
---------

Topics Covered:

  • What initially sparked Mert’s interest in data and privacy protection 
  • How Mert uses his multifaceted & creative skillsets to bridge knowledge gaps between privacy law & engineering
  • Verilogy’s open source database tool that automates and streamlines the work that Mert was doing as a privacy lawyer 
  • Fascinating projects underway at Privacy Innovation Lab 
  • What Mert hopes to achieve with The Hitchhiker’s Guide to Privacy Engineering

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/294537 Debra J Farber / Mert Can Boyar Buzzsprout-11646230 Tue, 15 Nov 2022 00:00:00 -0800 2674 privacy engineering, creative privacy, Hitchhiker's Guide to Privacy Engineering, Privacy Innovation Lab, Verilogy, Privacy Awareness 1 4 full false S1E3: "Will 'Global Privacy Control' (GPC) Fix Web Privacy?" with Roy Smith (PrivacyCheq) S1E3: "Will 'Global Privacy Control' (GPC) Fix Web Privacy?" with Roy Smith (PrivacyCheq) In this episode, I’m joined by Roy Smith, CEO and founder of PrivacyCheq, a privacy tech company that develops privacy-enhancing technologies for mobile and web. We discuss the history of online privacy and data protection laws, current challenges within the ad tech space, and GPC, a newly proposed web standard for signaling privacy preferences.

-----------
Thank you to our sponsor, Privado, the developer friendly privacy platform
-----------

A most common myth that Roy sees end-users buying into is that cookie banners are all that a company need  deploy for compliance with modern privacy and data protection laws. Roy breaks down how adtech companies use "the cookie myth" to distort how people perceive what's required for operational compliance. He illustrates the tsunami of global privacy regulations related to adtech and the limitations that exist due to siloed consent data. 

We dive deeper into the W3C's newly proposed Global Privacy Control (GPC) specification and how GPC lets users signal their desired privacy levels just by browsing the web. Roy unpacks why it was developed and what problems it solves on a legal level. He also highlights his concern that implementing GPC will create a false sense of privacy as GPC signals depart from consumer expectations. 

Listen to  our conversation on the benefits and drawbacks of GPC.

-----------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
-----------

Topics Covered:

  • How the regulatory framework for privacy and tracking has changed over time 
  • The global response to surveillance capitalism
  • The challenges and downfalls of the IAB's Transparency & Consent Framework (TCF)
  • The problem of “consent fragmentation”
  • The W3C’s newly-proposed Global Privacy Control (GPC) specification
  • Where Roy sees opportunities for improvement
  • The nuances between WC3’s "do-not-sell or share interaction" and "do-not-sell or share preference"
  • Roy's point of view regarding web privacy and whether GPC is sufficient for signaling privacy preferences, the benefits to the adtech industry, and potential drawbacks. 

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> In this episode, I’m joined by Roy Smith, CEO and founder of PrivacyCheq, a privacy tech company that develops privacy-enhancing technologies for mobile and web. We discuss the history of online privacy and data protection laws, current challenges within the ad tech space, and GPC, a newly proposed web standard for signaling privacy preferences.

-----------
Thank you to our sponsor, Privado, the developer friendly privacy platform
-----------

A most common myth that Roy sees end-users buying into is that cookie banners are all that a company need  deploy for compliance with modern privacy and data protection laws. Roy breaks down how adtech companies use "the cookie myth" to distort how people perceive what's required for operational compliance. He illustrates the tsunami of global privacy regulations related to adtech and the limitations that exist due to siloed consent data. 

We dive deeper into the W3C's newly proposed Global Privacy Control (GPC) specification and how GPC lets users signal their desired privacy levels just by browsing the web. Roy unpacks why it was developed and what problems it solves on a legal level. He also highlights his concern that implementing GPC will create a false sense of privacy as GPC signals depart from consumer expectations. 

Listen to  our conversation on the benefits and drawbacks of GPC.

-----------
Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.
-----------

Topics Covered:

  • How the regulatory framework for privacy and tracking has changed over time 
  • The global response to surveillance capitalism
  • The challenges and downfalls of the IAB's Transparency & Consent Framework (TCF)
  • The problem of “consent fragmentation”
  • The W3C’s newly-proposed Global Privacy Control (GPC) specification
  • Where Roy sees opportunities for improvement
  • The nuances between WC3’s "do-not-sell or share interaction" and "do-not-sell or share preference"
  • Roy's point of view regarding web privacy and whether GPC is sufficient for signaling privacy preferences, the benefits to the adtech industry, and potential drawbacks. 

Resources Mentioned:

Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://twitter.com/shiftprivacypod/status/1590058529381306368? Debra J Farber / Roy Smith Buzzsprout-11619786 Mon, 07 Nov 2022 22:00:00 -0800 3067 privacy, adtech, cookies, do not track, IAB, GPC, COPPA, W3C, GDPR, do not sell, CCPA, surveillance capitalism, DaisyBit 1 3 full false S1E2: "The Magic of Zero Knowledge Biometrics" with Dave Burnett (ZeroBiometrics) S1E2: "The Magic of Zero Knowledge Biometrics" with Dave Burnett (ZeroBiometrics) (Episode Transcription)

This week, I’m joined by Dave Burnett, VP of Strategy at ZeroBiometrics, to discuss his company’s cutting edge approach to using one’s face to biometrically-authenticate to systems w/o storing personal data, preventing breaches. We’ll discuss current approaches to deploying biometric authentication, unpack surrounding privacy & security challenges, and explore his company’s tech & why it may enable the biometrics industry to leapfrog over current tech hurdles as there’s now a privacy-preserving method to biometric authentication .

—------
Thank you to our sponsor, Privado, the developer friendly privacy platform.
—------

Rather than iterate on older technology, ZeroBiometrics approached its biometric authentication tech using a clean-sheet design. As a result, they created tech that captures no personal data, not even a biometric. Thus, it doesn't know what someone looks like and doesn’t save personal data to authenticate. In our conversation, Dave pulls back the curtain this magical-sounding tech and shares compelling examples of how ZeroFace enables privacy-preserving biometric identification, verification, authentication, and account recovery. 

The expansion of biometrics is unstoppable at this point. Security risks and privacy issues are too significant, and global legislation can't keep up. Dave illustrates why we can't keep working within the old biometric paradigm if we want to protect our identities and personal data and explains how his team works to bridge the gap between technologists and end-users.

Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.

Topics Covered:

  • Key challenges as we evolve from mobile biometrics to other use cases.
  • Technical & policy differences that affect privacy.
  • How industry leaders like Apple have approached facial & fingerprint biometrics.
  • How ZeroFace authenticates you w/o knowing what you look like
  • Addressing privacy usability challenges in the crypto space.
  • ZeroBiometrics’s impressive metrics for false acceptance (FAR) & rejection rates (FRR)
  • How using a ZeroFace's QR code can radically change the way we travel, ship goods & authenticate to our devices


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> (Episode Transcription)

This week, I’m joined by Dave Burnett, VP of Strategy at ZeroBiometrics, to discuss his company’s cutting edge approach to using one’s face to biometrically-authenticate to systems w/o storing personal data, preventing breaches. We’ll discuss current approaches to deploying biometric authentication, unpack surrounding privacy & security challenges, and explore his company’s tech & why it may enable the biometrics industry to leapfrog over current tech hurdles as there’s now a privacy-preserving method to biometric authentication .

—------
Thank you to our sponsor, Privado, the developer friendly privacy platform.
—------

Rather than iterate on older technology, ZeroBiometrics approached its biometric authentication tech using a clean-sheet design. As a result, they created tech that captures no personal data, not even a biometric. Thus, it doesn't know what someone looks like and doesn’t save personal data to authenticate. In our conversation, Dave pulls back the curtain this magical-sounding tech and shares compelling examples of how ZeroFace enables privacy-preserving biometric identification, verification, authentication, and account recovery. 

The expansion of biometrics is unstoppable at this point. Security risks and privacy issues are too significant, and global legislation can't keep up. Dave illustrates why we can't keep working within the old biometric paradigm if we want to protect our identities and personal data and explains how his team works to bridge the gap between technologists and end-users.

Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.

Topics Covered:

  • Key challenges as we evolve from mobile biometrics to other use cases.
  • Technical & policy differences that affect privacy.
  • How industry leaders like Apple have approached facial & fingerprint biometrics.
  • How ZeroFace authenticates you w/o knowing what you look like
  • Addressing privacy usability challenges in the crypto space.
  • ZeroBiometrics’s impressive metrics for false acceptance (FAR) & rejection rates (FRR)
  • How using a ZeroFace's QR code can radically change the way we travel, ship goods & authenticate to our devices


Guest Info:

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/276703 Debra J Farber / Dave Burnett Buzzsprout-11591992 Tue, 01 Nov 2022 06:00:00 -0700 3566 biometrics, authentication, ZKPs, zero-knowledge proofs, usable privacy, privacy-preserving architecture 1 2 full false S1E1: "Guardians of the Metaverse" with Kavya Pearlman (XRSI) S1E1: "Guardians of the Metaverse" with Kavya Pearlman (XRSI) (Transcription)

Welcome to the first episode of Shifting Privacy Left. To kick off the show, I’m joined by Kavya Pearlman, Exec Director of The eXtended Reality Safety Initiative (XRSI) to discuss  current challenges associated with extended reality (XR), the XRSI Privacy & Safety Framework, and the importance of embedding privacy into today’s technology.

---------
**Thank you to our sponsor, Privado, the developer friendly privacy platform**
---------

In our conversation, Kavya describes her vision for bridging the gap between government & technologists. While consulting  Facebook back in 2016, she’s witnessed 1st-hand the impacts on society when technology risks are ignored or misunderstood. As XR technology develops, there’s a dire need for human-centered safeguarding and designing for privacy & ethics. 

We also discuss what it’s been like to create standards while the XR industry is still evolving, and why it’s crucial to influence standards at the foundational code-level. Kavya also shares her advice for builders of immersive products (developers, architects, designers, engineers, etc.) and what she urges regulators to consider when making laws for web3 tech. 


Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.


Topics Covered:

  • The story behind XRSI, its mission & overview of key programs.
  • The differences between the "XR" & "metaverse."
  • XRSI's definitions for new subsets of "personal data" w/in immersive experiences: biometrically-inferred data & psychographically-inferred data.
  • Safety, privacy & ethical implications of XR data collection & use. 
  • Kavya explains the importance of the human in the loop.

Check out XRSI:

Guest Info (Kavya Pearlman):

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> (Transcription)

Welcome to the first episode of Shifting Privacy Left. To kick off the show, I’m joined by Kavya Pearlman, Exec Director of The eXtended Reality Safety Initiative (XRSI) to discuss  current challenges associated with extended reality (XR), the XRSI Privacy & Safety Framework, and the importance of embedding privacy into today’s technology.

---------
**Thank you to our sponsor, Privado, the developer friendly privacy platform**
---------

In our conversation, Kavya describes her vision for bridging the gap between government & technologists. While consulting  Facebook back in 2016, she’s witnessed 1st-hand the impacts on society when technology risks are ignored or misunderstood. As XR technology develops, there’s a dire need for human-centered safeguarding and designing for privacy & ethics. 

We also discuss what it’s been like to create standards while the XR industry is still evolving, and why it’s crucial to influence standards at the foundational code-level. Kavya also shares her advice for builders of immersive products (developers, architects, designers, engineers, etc.) and what she urges regulators to consider when making laws for web3 tech. 


Listen to the episode on Apple Podcasts, Spotify, iHeartRadio, or on your favorite podcast platform.


Topics Covered:

  • The story behind XRSI, its mission & overview of key programs.
  • The differences between the "XR" & "metaverse."
  • XRSI's definitions for new subsets of "personal data" w/in immersive experiences: biometrically-inferred data & psychographically-inferred data.
  • Safety, privacy & ethical implications of XR data collection & use. 
  • Kavya explains the importance of the human in the loop.

Check out XRSI:

Guest Info (Kavya Pearlman):

Send a text



Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Buzzsprout - Launch your podcast


Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.

]]> https://shiftingprivacyleft.com/audio/8323/269795 Debra J Farber / Kavya Pearlman Buzzsprout-11543756 Mon, 24 Oct 2022 21:00:00 -0700 3403 metaverse, ethics, privacy, safety, XR, virtual reality, augmented reality, developers 1 1 full false