Tuesday, April 24, 2018

Facebook CEO Mark Zuckerberg testifies on data protection

What we saw last week of the Facebook CEO Mark Zuckerberg two day testimony in front of nearly a hundred law makers of the United States house and senate was remarkable. The whole discussion centered on privacy and trust, in both the corporations and the governments, as it relates to data. Being in the industry from a technology perspective I was able to interpret the discussion through my introspective lens.

Knowing the history of these types of committees, they have immense authority including the power to regulate or breakup companies that get too much power and wealth. The politicians from both spectrums of the national parties spoke with the same message that there was a choice of government regulation or corporation self-regulation based on where the trust would best be stored and where it best can remain.

This stems from Facebook’s user’s data being provided to third party companies such as Cambridge Analytica who potentially used this data for nefarious reasons, including with the interference of electoral processes.

If the decision is to be government mandated controls, it would be accompanied with other implication such as a class action lawsuit file by as many as 87 million Facebook users whom may have had their Facebook data collected without their permission. Further consequences would be breaking up of the company, mandatory sharing of data for extreme vetting to help ICE in deportation efforts, mandating auditing of third party storage, consequences towards presumed violation of the FTC consent decree placed on Facebook, violation of corporate contribution laws, and even charges of treason as it relates to citizens data heading overseas to potential enemies of the state, referred to as ‘Russians’, and used in electoral interference.

An area Mr. Zuckerberg was reluctant to expose was how many ‘data points’, the term used by the members, Facebook collects on users. The general speculation is that it’s thousands per user, to the point where they know you better than yourself. This is another area of concern for some members who represent predominantly black communicates in which ad targeting was done by segmentation based on race. The main point drawn by Mr. Zuckerberg is that Facebook does not use this data but rather matches users with certain data points to advertisers searching on these specifics. Only upon a successful match does the company earn revenue.

This hearing was insightful in that we got to see the inner workings of the Facebook business model and value chain. In general the more specific data points per user helps the company generate more segments, some of which have greater value than others. What it further seems is that the Facebook algorithms promote a ‘positive feedback loop’ used to coral users into more extreme viewpoints to generate more revenue by creating controversy!

One main concern expressed by the politicians was the silencing of conservative voices. Facebook’s solution towards monitoring speech is to hire individuals who are located throughout the world to police content until the Artificial Intelligence (AI) is able to take over. My main concern is who will provide the rules of the road to this AI? What if it is learning by the current content being blocked, such as those brought up by the members of the YouTube personality stars Diamond and Silk or the Pro-life organizations? This is a very slippery road, and from the US perspective, the first amendment to the Constitution should hold true of freedom of speech. Perhaps a better and cheaper solution would be a more hands-off approach.

Another area of concern brought up by a congressman was regarding a chat application called Whatsapp that is owned by Facebook. The implication made was that messages are, or would be, read by algorithms that then would work with other ad systems without human intervention, yet the perception of users is that their messages were private.

A few politicians had concerns around the implication that Facebook creates ‘Shadow User’ accounts. These are non-users who have a profile within Facebook that was constructed off data collected from individuals in common that have installed the mobile app on their device and gave permission to this app to access their phonebook. Facebook may be able to commoditize these shadow accounts without consent via website targeted ads. The business strategy is great, with the obvious missed step of legal implications, or the thought that the benefit would outway the costs. Steps can get missed if you don’t have an experienced team, which is tough when you’re on the cutting edge.

Because Facebook is trail blazing in areas without precedent, congress was eagerly asking Mr. Zuckerberg to take lead in implementing industry standards. They want to ensure industry and progress isn’t hindered through over-regulation.

The general tone was that the members do not want to regulate so long as Facebook makes major concessions and ‘leads the charge’ towards having other technology companies agree to a kind of code-of-conduct towards privacy and security measures.

There was much legislation mentioned during the sessions, of which included the: Honest ads act, SESTA (Sex and human trafficking), Consent Act, Child Online Privacy and Protection Online Act, Browser Act (Privacy legislation), Secure and Protect Data Act, GDPR, My data act, etc.). If I had to take a broad view at summarizing the points brought as it relates to the legislation, which I’ll call the online Bill of Rights, it would include the following:
  1. Platforms should be ideological Neutral as a public forum (First Amendment of the Constitution)
  2. Not to engage in harmful content such as racism, nudity, terrorism, violence, sex and human trafficking.
  3. Understanding the beneficial owner of political and issue ads using government identity and address verification.
  4. Mandatory opt-in and explanation of how their data will be used
  5. Readable contracts that have to fit on one page.
  6. Users own their data (and can get a portion of revenue it generates)
  7. Companies have an information fiduciary to hold personal data in trust
  8. No commercial use of biometrics data
  9. Targeting ads should be on data authorized to share
  10. Not capturing race or gender in their segments of housing, employment, and credit.
  11. No discriminatory ads on race, gender, family status, sexual orientation, disability, or veteran status using ad targeting
  12. No capturing or creating of ‘shadow user’ information or accounts
  13. Limit how many data points, or specific data points, per user.
  14. Time limit for responding to request to delete a user’s data
  15. Delete data after certain period (7 years just like the banks)
  16. Users request to be deleted should be applied to third parties who their data was shared.
  17. Data stored within the borders of the nation
  18. Notifying users when there is a breach
  19. Notify users when their data is being shared and allowing to prohibit this sharing
  20. Affirmative permission before being used on other networks
  21. No cross device tracking
  22. No pixel tracking
  23. Provide protection for those less than 16 years old by not using their data without permission of their parents
  24. All data deleted of users under the age of 13
  25. Government access to data in a national security situation such as election interference
  26. Not allow sale by online pharmacies (in order to prevent the opioid crisis)
  27. Bug bounties to also focus on not permissible sharing of information.

I’m not saying all these points are good, specifically the pixel and cross device tracking, but it was what I have captured. In my opinion these really should scale depending on the size of a company’s user-base. Implementing this type of regulation for a startup would be capital intensive and would burden new entrants into the market. In general users are in some way responsible for what they share on the internet.

I do not blame Facebook for offering targeted advertisements as some people prefer to see ads that are relevant. This isn’t a bad business model, and it looks for the most part that Facebook is being reactive when encountering new unforeseen issues. A lot of methodology is placed on a positive experience for the users in the creation of applications and platforms through the usability experience (UX) stage of development. It is known that companies gauge dopamine reactions of users and for some business models this is great. For example, if applied towards devices that offer health tracking in order to give incentives towards achieving a certain milestones.

Hypothetically, the alternative for these companies, if the majority of users choose not to share their data with advertisers, these companies could potentially be pay-per-play, a subscription service, or an alternative more creative solution.

If the trust was to remain with what they call ‘edge platforms’ through self-regulation, other tech companies that fall into this category would also need to follow suit, such as Instagram, Google, Amazon, Twitter, Netflix, and many others. To be specific, it would definitely affect every Ad-based business models. I suspect that these sessions will continue outside the realm of ‘edge platforms’ as politicians look at technology companies to determine if acts of treason were committed such as in audio being listened to on devices with Amazon’s Alexa and Google’s Android.

It wasn’t all doom and gloom for Facebook. There were incentives presented to Mr. Zuckerberg, such as the Senator from West Virginia who referenced a need for rural connectivity. Mr. Zuckerberg was quite eager and chomping at the bit when presented with these incentives as this is an area the Facebook is actively pursuing using drone technology.

The question remains of who to trust with online governance. On the other side of the spectrum is the Federal government holding this trust. The politicians self-admittedly stated that they did not want to impose government regulations. Also, the track record of the Governments doesn’t seem to be any better in having the trust of the people be broken by tapping phones of ordinary citizens.

I would prefer that Facebook leads this charge towards an online bill or rights, as the strongest power is not ruled by force but by vision.

No comments: