Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/742 Thanks!
A British mathematician once said
that data is the new oil.
Our data points are collected
and analyzed, they're utilized
en masse.
Our swipes, our purchases,
what we're interested in, how we move,
how we hold our phone, anything
can create material
for analytical companies to make
extensive profiles of us
for the purpose of selling those.
So in these in the so-called economy
of surveillance, a lot of actors
make a lot of money,
maybe not the user, him or herself
so much, but how
this works in detail.
That is going to tell us what Crystal
today.
Beaufoy Krista is a technologist,
researcher and activist
from Austria and together
with the privacy scholar Sarah
Speakman, he wrote Networks
of Control. This report has been
published this year.
In October.
He has also developed a
game called Data Dealer that some
people might know, which is about privacy
and surveillance.
Today he is going to tell us,
give us a talk about corporate
surveillance, digital tracking,
big data and privacy.
Please help me welcome BofI Krysta.
Thanks a lot.
Can you hear me?
Yes.
Hi, everybody.
My name is William Kristol.
I'm from Vienna, Austria.
And first of all,
I'd like to modify the title of my talk a
bit and get rid of the big data.
To be honest, I only use it because it
always helps to get some people
to listen to me.
I mean, big data can mean everything
and nothing, so let's just
get rid of it, OK?
Nevertheless, during the last few years,
we've seen the birth of a large scale
surveillance economy.
Today, thousands of businesses are
monitoring, profiling, categorizing,
raiding and affecting
the lives of billions across platforms,
devices and live contexts.
In my presentation, I'll talk about how
networks of these companies are
collecting, analyzing and utilizing
our data, often hardly
without effectively informed
consent and even largely
without our knowledge.
I will also talk about how personal data
analytics is already being used
in fields like marketing, retail,
insurance, finance, health care,
employment and so on to
make decisions and people.
I'll take you on a small tour through
examples, many examples
of corporate practices.
And I'll also address the question
what could possibly go
wrong?
But beware, I will use some more bullshit
terms because I have to
if you want to discuss all this marketing
data sphere and so on,
we unfortunately have to dove into some
marketing data bullshit
terms as
well. I'm sorry. And I also will use
the big data term again.
And this is likely, many of you
probably know it, a browser extension
which shows who is watching us
when we are surfing the web.
I visited five websites here,
a large health website, weather site,
dictionary dot com, the New York Times
and what magazine in
the background these five sites connected
to one hundred and eighteen
other third party services and told
them about my visit,
only five websites, and it was recorded
by more than 100 companies.
Let's have a look at it a bit more in
detail.
The five websites I visited are
represented by the circus,
the third parties by this
many small Trangie icons
you can see.
So why do these five
websites transmit information
about clicks to other companies?
Because they actively put some small
pieces of code into their websites.
And who are these third party companies
represented by the small Trangie
icons, ad networks,
analytics services, consumer
data brokers, and, of course, Google
and Facebook and many others?
As you can see, some of the third parties
are connected to two or more websites
visited.
That means they're able to monitor
and track me across several
websites.
Now, imagine what happens when I'm
surfing the web for a day,
a week or a month.
This is how thousands of companies
and companies are able to compile
profiles of other online behavior.
I know there are some
tools to block some of these trackers,
but most people outside the privacy
bubble are still very surprised
when they see this.
And beside of that, some of these anti
tracking tools became part of the
tracking ecosystem as well.
Of course, it's not only surfing the web,
there's also our smartphone,
a powerful small computer,
even if it's a bit broken, even
now and then, like this
one, containing lists of our
contacts, our friends, our calls, our
messages, it tracks our movements, lots
of very private information.
And who is able to access this data?
Many apps if we give them permission
to access it.
And what's the business model of many
app developers collecting and
selling our personal information?
The interesting thing is that most people
would not hand over detailed information
about all the contacts, addresses and
movements to other people
they don't know.
At the same time, most people don't
seem to care to
hand it over to thousands of companies
they don't know.
Back to the five websites I visited.
Let's have a look at some of the 118
third parties which received information
about me surfing the Web.
Let me introduce you to look
at this and look
at these two domains.
Tracked my visits to the weather website
and to W magazine.
I'm sure you've seen at this
already they offer website providers
to show these tiny little.
Social sharing patterns, modeling,
looking similar to that and blue
sky, you
won't see it on the website you visited,
this is a typical data collection service
and both at this and blue sky
belong to orecchiette,
one of the world's largest database
and business of the providers.
Irakly hasn't been known as a consumer
data broker until recently,
but in the last years they acquired
several data companies, Blue
Sky and Online Data Marketplace.
They are Logic's, which has partnerships
with stores who offer membership
or loyalty cards, collecting
purchase data from 1500
large retailers, and
their logic's is able to link those
purchases to the digital world.
And Oracle acquired at this,
which is harvesting behavioral data
about website visitors are more than 15
million different websites.
Orica has now integrated these companies
into its data cloud.
Very nice name.
This is a nice slide about it here.
The company explains that the record
that they record, what consumers
do, what consumers say and
what consumers buy.
Great threat.
According to Iraq's own statements, the
aggregate three billion user
profiles from
the 15 million websites which have which
have at this installed, but also
700 million social
messages daily.
They claim to do that and
billions of purchases in order
to target people, personalized content
and to measure how people
are interacting across platforms,
channels and devices
from online mobile email,
social media to TV radio,
direct mail and even in-store.
They also try to monitor and link
offline purchases.
And in the center you can see
the Iraqi identity
graph, which allows them to link
and match user profiles across
platforms, devices and company
databases in order to
create one addressable
consumer profile as they right
to identify customers
everywhere, to
unify addressable identities
and so on and so on.
Here can use here you can see the
different ideas from the cookie
idea into email at Deposal and
Mobile, the set
up idea. This is the
set top boxes for TVs.
So they also try to link that information
and probably also from other devices
and platforms.
Irakly also provides a wide range of
data from partners.
This is already a data directory.
Quite interesting document already
provides shares and combines
data from data brokers like Axium
Inter-Group LIFESTAR,
also from Experian, TransUnion and
Equifax. These are the three big
credit reporting agencies
in the US and many others.
They also provide data from credit
card companies like Visa and
MasterCard and of course, Oriente,
also partners with Google and
Facebook data.
Large Data Logic's, one of these
companies already acquired, was
even one of the first data brokers
which started to partner with Facebook
back in 2012.
They connected their offline data about
purchases, financial behavior, credit
cards and home value, net worth income.
And along with Facebook's
rich user profile
information, of course, platforms
like Facebook or Facebook, as
I'd like to call it,
is collecting vast amounts of information
itself about the everyday
lives of one point eight billion
people and still one point two billion
people use it every day.
Facebook puts these nearly two
billion people into thousands of
categories and lets advertisers use
these categories in order to include
or exclude people from ads
on an individual level.
A few weeks ago, the US based nonprofit
ProPublica was able to purchase a
housing it on Facebook
that wanted to address people who are
likely to move
and are interested in houses
and so on.
But if you look at the bottom,
you can also exclude people who met
specific criteria.
In this case, people who are categories
categorized as Hispanics, African
or Asian Americans are
excluded from seeing
the EBT.
Beside of that, this is probably
illegal discrimination.
The US, how do they know
about the ethnic affinity, how they call
it of someone?
And are these classifications accurate?
Basically, we don't know,
but maybe they use similar methods.
As in this Berkeley study, an academic
paper, the researchers
try to predict these
private attributes of users just based
on the Facebook likes.
And those were the results
they were able to successfully predict
ethnicity, sexual orientation,
political and religious views
just based on data.
About 170
Facebook likes per user.
The study had 60000 participants, and
as you can see, ethnicity can be
predicted quite accurately.
In Europe, Facebook doesn't offer
to directly categorize people according
to their ethnicity, but they still
support people in many different
categories.
For example, you could purchase an ad on
Facebook targeted on people
living in Norway.
My last talk was in Oslo.
So this is not where
25 to 40 years old speaking
a specific kind of Norwegian language and
then excludes people
who are interested in
Arabic language Islam,
multiple sclerosis, online gambling,
personality disorder, plus size
clothing, stomach
cancer, trade union,
wheelchair and so on.
These are basically protected
categories of data
in Europe.
So ethnic profiling isn't directly
available in Europe, but you can still
use proxies.
However, relax.
After massive criticism and
media coverage, Facebook told us in
November that it will build a system to
prevent advertisers from bank credit,
housing or employment ads that
exclude viewers by
race. So take it easy.
Read then
wait only about ads.
Who cares?
Also, a few weeks ago, when the large
UK insurer ADM announced to introduce
to Price car insurance
based on Facebook posts, Facebook quickly
reacted and blocked the insurers
app Perfect Red.
On the other hand, Facebook itself
registered a patent about credit
scoring based on Facebook data.
The right. When an individual applies
for a loan, the lender examines the
credit ratings of members of individual
social network.
So from your friends,
if the average credit rating of
these members is at least a minimum
credit score, the lender continues to
process the loan application.
Otherwise, the loan application is
rejected.
It's Facebook planning to provide credit
scores based on data about our Facebook
friends.
We don't know Face will probably
say it's just a patent.
We won't do it, but
can we trust this company?
In 2014, when Facebook acquired WhatsApp,
they said, don't worry, your WhatsApp
data is safe, we won't share it with
Facebook 2016,
the company announced to start sharing
WhatsApp data with Facebook.
After continued criticism, Facebook told
the Europeans that
it won't combine Facebook and WhatsApp
that data for now,
whatever it is, I see it.
Like many data companies, Facebook mostly
acts in a way like two steps forward, one
step back and so on.
We'll see. Of course, it's not only the
web, smartphone apps and
Facebook. There are many ways of how
personal data is being collected and
utilized today.
Let's have a look at visual DNA.
They use data from online quizzes
to create personality profiles about
users.
They say that the quizzes have been taken
by 40 million people already
altogether. Visual DNA provides
digital profiles, about 500 million
consumers, for example, for marketing
and online targeting purposes.
But also and that's remarkable
for credit scoring and
risk assessment.
Therefore, we DNA partners with
MasterCard, the credit reporting
agency Experian and
ADM, the large UK
insurer.
You remember me from before?
This is remarkable because they cross the
line between the context of marketing
data on the one hand and risk management
data, credit scoring on the other
hand.
And if you remember or against data
directory, IRAKLY also offers
data from visual Vicini.
As you can see, although we've got
some large players, we're talking about a
landscape of many interlinked
commercial databases about people.
This is what I call networks
of corporate surveillance.
For example, have a look at segment,
a company which says Collect all
of your customer data and send it
anywhere.
It provides tools for website and app
developers to easily collect data from
their users and then automatically
send it to more than 150 other
companies from
ad networks, data brokers and analytics
providers to CRM system and even
fraud detection services.
This is only one third of the services
that companies can automatically sent
their user on customer data to a nice
logo wall.
And by the way, this one,
Eloqua, also belongs to Oracle.
So networks of corporate surveillance.
But which types of data about people
do companies collect and trade?
One way to group it
would be on how personal data is being
obtained.
First, volunteer data, which
is created and explicitly shared
by individuals, at least in theory,
for example, address information in
online form
or maybe the qu'est data from visual DNA.
But I'm not sure if people were really
aware what will happen with that
information.
Second, observed data
consumers generated passively
after it gets recorded completely without
their knowledge.
For example, when a company tracks the
receipt, the receipts, the websites
we visit and finally
inferred data, which is based on
the analysis of volunteered
our observed information
another way to group it, based on the
contents of the data
companies directly or indirectly collect
financial information about people,
for example, about their income or credit
ratings.
Of course, contact data, demographic
attributes like age, gender or
ethnicity, transactional data
such as purchases and the price is
paid, contractual information
like service details and history, for
example, by utility and mobile
network provider.
And by the way, this categorization
is from a data broker point of view.
Information collected also includes
location data, not only from
mobile devices, behavioral
data like the websites visited, rap
usage, technical identifiers
such as IP addresses or device
I.D., and not least
communication contents like social media
posts or email, text and social
relationships.
Information about your contacts and
your friends to just take one
of these, especially location data,
is very popular in
corporate surveillance.
Even mobile network providers
are increasingly selling insights
into their location databases.
This chart is from an industry report
which carefully investigates which ways
of utilizing location data
could be the best for a mobile
network provider,
maybe based on apps and chips, location
or on network cell location.
What about in their location tracking
or even use the emergency
services location?
Look at that, they even think about
selling the emergency location,
which which which would have many
advantages if you look at the green
fields, for example.
No need to install anything on the device
to get the emergency location,
correct?
Yeah.
However, I don't want to explore this in
detail now. It's also a very small and
no.
Instead, I want to show you a part
of this marketing video of factorial,
a company providing a product
which is called observation
graph.
They've got such nice
names of the products,
they are combining geographic information
and meta metadata about events in places
with mobile location data of users.
So here we go.
This observation graph technology is a
revolutionary way of understanding the
real world behavior of mobile users.
With products powered by observation
graph, you can deliver intelligent mobile
experiences.
Observation Graph is built on factual,
proprietary Global Places data,
which includes over 90 million local
businesses and points of interest in 50
countries, and is integrated into leading
applications such as Apple Maps,
Facebook places and Microsoft.
Bing observation graph also
uses demographic data, event
data and other geographic data
to fully understand the physical world.
All of this data, combined with signals
from mobile devices, enables factual
to catalog real world user behavior
each day. Observation graph generates
billions of discrete observations
globally.
Observation that powers products that
enable advertisers to create highly
accurate mobile audiences by describing
specific real world behaviors.
OK, enough
user I.D. nine, eight, seven, one,
two, three activity.
Bocking sounds
so innocent, right?
What about activity protesting?
I guess the Eastern Germany
Chairman Stassi would have been really
happy to have it to looked at
as you may be. US police departments
have already used data feeds containing
location data from marketing analytics
companies to track protesters.
But location data is just one of many
different types of personal data
companies are collecting.
Another way to group the data collected
by companies is to distinguish
between first party and third
party data, while first
party data is collected by businesses
which have a direct relationship with
consumers.
For example, the shop you've bought
something your mobile network provider
are the app you've installed on your
phone.
Third party data is either purchase
or licensed from a first party,
or it is collected from publicly
available sources.
However, as we've seen, third party data
collection can also be invisibly embedded
into websites, mobile apps
and other first party contexts.
Finally, data being collected by
companies could also be grouped into
actual and modeled
data, where actual data
is straightforward information about
individuals.
For example, the postal address,
the date of birth, or the fact
that they've been at a specific location,
or that they've bought a specific product
and model. Data, on the
other hand, results from
drawing inferences about personal
attributes or predicted behavior
in marketing. For example, at your
segment, segmenting
people into groups with shared
characteristics and likely behaviors
already dates back to the 1970s.
For example, segments could be
segments.
Data brokers could be rich posers who
will likely buy an expensive car
or old woman who will
likely donate for a loan.
Some animals are
simply valuable customers
on the one hand, and waste
and the other. Hence, data brokers have
really used the waste
to categorize people in financial
difficulties.
But while earlier consumer segmentation
was mainly based on large scale
information like census data
or surveys with small
sample sizes, today, segmenting
systems can use detailed
individual level information about
billions of consumers in real time
and then are somehow related.
Concept is scoring, which
emerged more on the risk side
of personal data.
Business credit scoring has been around
for decades.
A credit score is a number
which claims to describe your
creditworthiness or to
predict predict a person's
future payment behavior
on an individual level.
The FICO score, still one
of the most important credit scores in
the US, is based on the consumer's
payment history, the amount owed,
the length of the credit history and
other information.
Even though this is a rather conservative
mix of data compared to
many other of today's scoring
machines, credit scoring can still
destroy lives
in the US and in other countries.
A bad credit score can not only mean
that the person doesn't get access
to financial services, but also
that this person doesn't get an apartment
or a shop anymore.
So when somebody who is already in
financial trouble doesn't get a job
anymore, situation can get
even worse.
This way, a bad credit score can become
a self-fulfilling prophecy.
In addition, a credit score
may be based on flawed data
in someone's credit report or unflawed
prediction algorithms.
The latter are typically completely
secret.
Today's current products are often based
on a much wider range of data,
and they're used in many other contexts,
not only in the field of personal
finance.
If you look at trust in online fraud
detection company, they
seem to be rather open minded.
On the website you can see which kinds of
data they process to keep
fraud out while letting good customers
through.
What they're doing is a kind of fraud
scoring, which can decide about
which pay.
Shipping options you get in an online
shop or whether you're accepted
or not as a customer in general,
they use many different types of
information phone numbers, email,
postal addresses, browsing antibodies,
fingerprints, credit checks.
Transaction is the IP address is mobile
carrier details, cell location and much
more of its
parent company, TransUnion.
One of the three large credit reporting
agencies in the US has data on one
billion consumers globally
obtained from 90000 data
sources.
Frascati, another example of a company
which provides scoring based on personal
data completely out of context to signify
a US company which calculates credit
scores for individuals from phone
call records.
They explain to allies called durations
of the time calls are made,
who is frequently called and so
on. And they say four weeks of
calling history is enough for
us to predict the creditworthiness
of someone.
The partners include large mobile
network providers like Telefonica
and Equifax, one of the three largest
consumer credit reporting
agencies in the US.
But how does Signifier calculate their
credit scores from phone call records?
The answer is we don't
know, but maybe they use
similar methods.
As in the following academic
study, researchers found that they are
able to predict someone's personality
just from someone's smartphone
metadata like call dates, frequencies
and durations.
They use offline personality,
personality questionnaires recorded
to participants phone data
and found statistical correlations.
The prediction accuracy is far from
perfect, but still significantly
above chance.
Michael J.
So maybe companies like Signifier just
use similar methods.
We simply don't know.
So what is this all about?
It's all about data mining involving
methods from mathematics and statistics
to machine learning.
Machine learning algorithms learn
from existing data.
They get trained to find correlations
in large datasets, and they're able to
more or less find connections
between variables where human
beings really give up.
Another example in credit scoring.
This is Test Finance, a company which
has been founded by Google's
former chief information officer.
They're combining thousands of data
elements to calculate credit scores
about consumers, which data
from how people use smartphones
and social networks to dispelling
somebody uses in an online loan
application form.
In 2016, Test Finance
announced a partnership with Baidu,
China's largest website search provider
like Google in China, test
finances that by Rich uses
search data will be valuable for loan
underwriting and assessing
credit risk and a website this state.
We believe that more data is always
better,
and the founder once said all data
is credit data. We just don't know how to
use it yet.
All data, there's lots of data about
us out there today.
Virtually everything we do is recorded,
monitored, attract in some way.
All kinds of collected data end up
in huge clusters of databases,
data mining technologies, how to find
the relevant information in these
massive amounts of data.
And then there's one US company
which is always mentioned when it comes
to consumer data brokers.
It's called Acxiom, who
has heard of Acxiom already.
So quite some
extreme is one of the largest of these
companies and says, is that up to three?
It has up to 3000 attributes
and 700 million people.
For example, they have the credit
history, driving history,
criminal history, residential history,
employment history, education history,
information about income
and so on, purchase behavior.
They don't collect information
about illnesses of people, but about
health interests.
By the way, this is a marketing
new form of information has sought
enlightenment. I think we don't need to
sound. What I really like is how they use
the X in the name.
Now it's yeah, it's appearing.
And now just wait a few
seconds.
It's the slow targeted.
Oh, my God, XM is a
kind of old school data broker.
They started 40 years ago
or longer with sending personalized
letters for the Democratic Party
in the US during elections
later. They also sold voter profiles to
the Republicans and
they became a consumer data change
for all business fields since
2014.
They've also got data partnerships with
Kouji, Facebook and Twitter
and other large data brokers.
LexisNexis Risk Solutions,
also a very nice name.
Coming up, more from the risk side of
personal data business.
They've got a similar amount of profiles
on consumers and the really impressive
range of offers on the website.
They're not only selling data on problem
renters, they also
offer their employment
screening enterprise edition.
And they've got offers for health care
here. They say social network analytics
reveal hidden relationships
and their rates right.
Somewhere on the website, we help
predict the likelihood that the consumer
will become delinquent in the next 18
months.
And of course, they also have offers for
governmental agencies and law
enforcement.
Look at this nice black helicopter
or whatever this is.
But at the same time, they also provide
some marketing solutions.
And this is a general trend, the
same data, the same analytics.
Technology is more and more used in
completely different contexts,
from marketing to banking, insurance
and even law enforcement.
Take Pelletiere, this Silicon
Valley data mining company founded by
Peter Thiel, the first Facebook investor,
co-founder of PayPal and currently a
member of Donald Trump's Trump's
Transition Team,
Pinetti. It provides products for
companies in the fields of health care
insurance finance
like kind of big data analytics.
The software is based on people's
fraud detection algorithms, and
they've got partnerships with the German
business software provider SAP,
the US Department of Defense and with
the CIA, or
Take FCL Group, a company
that sees itself as working on the
forefront of behavioral change.
They provide data driven marketing
for commercial purposes,
but also information operations for
defense and intelligence.
And at the same time, they see themselves
as a global election management
company.
Uh, FCL groups US
branch is called Cambridge Analytica.
You probably heard of it.
Of them, they claim to have a national
database of 220 million
US citizens containing five
thousand data points about every
person, according to The
Guardian. The company has also harvested
data on millions of Facebook users.
But what are they doing with
this data?
This sort people into different
categories, for example, alongside
the political views on issues like pro
life, environment, gun rights,
national security or immigration
in order to target and address
people differently.
This way, they can communicate different
messages to different small
groups of people according to their
political views, and based on vast
amounts of personal information
on an individual level.
And by the way, uh, Cambridge Analytica
also contributed to the
Brexit campaign and also to Donald
Trump's election campaign.
And Peter Thiel
is on the board of Cambridge Analytica.
OK, voter targeting.
There are many other companies like that
also for the Democratic Party.
And there are many other fields where
personal data analytics is being
used. For example,
cheesiness, health, healthcare,
a US company calculating individual
health risks from a wide range of
patient data, including from canonic
genomics, medical records,
lab data, mobile devices
and also consumer behavior.
They offer to identify people likely
not to participate in
interventions to
predict progression, progression
of illnesses and intervention
outcomes, and to rank
patients by how much
return of investment the insurer
can expect.
If it targets patients with
particular interventions,
it may be to just exclude
the hopeless cases.
I'm sure not
OK with health care being.
Insurance, election campaigns, law
enforcement, and
not every field I mentioned is already
completely connected to the consumer data
ecosystem, but they're working
on it.
What if our data would
be only used for marketing?
Based on my research, marketing has has
been it still is the major driver
for pervasive corporate surveillance.
In 2007, Apple introduced
a smartphone and Facebook app, just
30 million users.
Also in 2007, online advertisers
started to use individual level
data to profile and target
users.
Four years later, it was around
100 relevant companies in the
field of so-called marketing technology,
or ad tech, which
are largely, largely based on personal
data collection and profiling.
And 2012, it was already 350
companies, then
thousands, then 2000.
Now in 2016, we've got nearly
4000 relevant companies in
marketing technologies.
The logos are quite small
here.
So today, less than 10 years after 2007,
we've got thousands of online platforms
etcs, app developers, analytics
companies, data brokers and many other
kinds of companies which are constantly
tracking, profiling, categorizing,
rating and scoring as
a time.
Have a look at TellApart, a so-called
predictive marketing platform.
Their slogan is Turn Our Silence
into your sales.
They claim to provide a so-called
TellApart identity network,
which incorporates massive amounts
of data from both online and offline
sources to create a TellApart
identity, Keat
for each and every shopper, and then they
calculate a customer value
score.
For each shopper and product combination,
a company, a compilation
of the likelihood to purchase
predicted order size and customer
lifetime value.
A kind of score about
how profitable or valuable
or not valuable a customer
is. As a result,
some customers get personalized offers
based on their online and even offline
behavior.
Uh, last year, TellApart
was acquired by Twitter for about
five hundred million dollar
personalized pricing based on real time
customer values.
Course and the like
could soon be everywhere.
Large global online shops already show
differently priced products for different
users or even the same products
at different prices based on people's
online behavior, location data
or the devices they use.
A research paper from 2012
already showed that personalized prices
differed up to one hundred and
sixty six percent.
The problem is that it's difficult,
if not impossible, to prove price
discrimination based on individual
attributes or user behavior.
For individuals, it's completely
nontransparent,
and maybe personalized pricing will soon
not only happen in online shops or travel
websites, but could appear
in the form of many smaller
or bigger differences in how consumers
get offers, discounts and personalized
communication from companies in
general.
It clearly won't be a problem for
somebody to miss a single at or
discount. Often we are even
happy to miss those,
but it could be a problem on
a structural level.
Imagine someone experiences many of
these small disadvantages,
disadvantages every day,
perhaps without being aware
of it.
Michael Fertik, US privacy advocates
said the rich see
already a different Internet than
the poor based on personalization,
based on digital records about their
lives on a much more general
level.
Personalization based on our data is now
nearly everywhere and often it's a good
thing.
But it's nontransparent and bears
the risk of reinforcing
discrimination or even increasing
it.
And the more invasive the data
sharing between companies and the
decontextualized usage of
the record information gets,
the more Apakan nontransparent
the whole system becomes.
A key concern for me is that the data
companies are increasingly
using unique identifiers
across different companies,
devices and contexts which they pretend
to be anonymous,
merely identifiers derived from email
addresses and phone numbers.
This way, a person can be recognized
again as the same person as soon
as he or she clicks swipe spies
or does some other recorded interaction
any time across
networks of data companies.
And in fact, those identifiers
are not anonymous at all.
Their site on
Facebook also uses those
identifiers and calls them
the identified, I think.
In addition, we've got the identifiers
from Google, Apple and Microsoft on
the mobile mobile devices
and so on, which
are more and more replacing the hardware
device. It is.
And several companies have introduced
their own persistent identifiers,
unique identifiers for people,
for example, Oracle, Axiom,
VeriSign, Experian and
many others to
match and link names, email
addresses and postal addresses,
phone numbers, kookie these
devices, these set top box
I.D. and many more
across the data providers
and clients, companies and
both Oracle and Axium run
so-called data management platforms.
A data management platform is a kind
of Real-Time online data marketplace.
It acts as a central hub
used to aggregate, integrate,
manage and deploy disparate
sources of data.
Is a consulting company summarized
it.
A DMP offers
clients to important data,
for example, their customer
relation, customer database,
email addresses, purchases and so
on, then match
customer IDs.
Uh.
New data by putting text and the websites
in their e-mail, newsletters
and so on, they
offer access to other data vendors,
sometimes to many other data sources,
and they offer to analyze and categorize
people.
The marketing guys call these
segments or audiences.
I would say it's categorizing people.
They also offered to find similar people,
then the people that
the customers of a company so called look
alikes and
they offered to send instructions
who to target and which device,
how to personalize content or messages
or ads or websites or whatever.
And sometimes
apps also allow to categorize and
enrich the company's own customer
databases.
This way, companies can sort the
customers into valuable and non
valuable customers and
into risky and non risky
people and so on.
Examples of companies running the piece
include Acxiom and Oracle, but also
Salesforce.
Maybe somebody heard of it.
A CRM vendor
and Adobe also runs the data management
platform.
Another example is Lotame
Me, which provides access
to, um,
three billion cookies and two billion
mobile device I.D.
And by the way, they also tricked me
when I was visiting those five websites
I showed at the beginning of my
presentation.
It's a very interesting domain name,
crowd control, dot net,
wonderful.
But let me explain it on its website.
It's your data you have to read to
control it, share it and use it how
you see fit.
Sounds nice, right?
But of course, they don't speak to
consumers.
They speak to their corporate clients.
I really love that.
I think it's a good representation
of today's information technology
landscape.
While we as individuals became more
and more transparent, practices
of corporate surveillance remain
largely obscure.
Today, each of our interactions is
monitored allies and assessed by a
network of machines and software
algorithms operated by companies
we rarely have ever heard of.
It's not balanced at all
without our knowledge and often without
our consent, our interests,
weaknesses, illnesses, successes,
secrets and purchasing power
as a weight.
And companies increasingly use
the collected data about our
lives to make decisions and us
from which ads and products we see
which discounts in prices we get,
how long we have to wait when calling
on the phone hotline, which payment
methods we get to massive decisions
in the fields of personal finance,
insurance, housing, employment
and health care.
While we as individuals and human beings
and as a society mostly don't even
know who is tracking us,
how our data is being used, and how this
could impact our future lives.
The companies took control
of our data.
So what has to be done?
One option could look like this.
No, I love
information technology
during the last few years, I tried to
find out how to beat this challenge.
My first try looked at that.
I was asking, worried about your privacy,
forget it, turned the tables
and find out all the details about your
friends, your neighbors and the rest of
the world.
Together with a small team from Vienna, I
created a data dealer, an online game,
browser game and even a Facebook game
about collecting and selling personal
information. You can still play it
online, and
I promise that we won't sell your data.
Trust me.
Since then, I did lots of research about
today's personal data ecosystem, I wrote
newspaper articles, contributed to
documentaries about this show tracking,
and recently published an extensive
report about these issues.
It's called Networks of Control.
A report on corporate surveillance this
year, tracking big data
and privacy.
You can download a PDF version
for free,
but also by it is a printed book.
I wrote it together with Sara Speakman,
privacy researcher and university
professor, also from Vienna.
In our report, we basically tried to
explain how today's companies are
collecting, analyzing and selling
information about our lives
and 160 pages with
900 references.
I've been working on that for a long time
without any budget.
So if you want to help, please read
it, spread it
or even read about it.
It was published in October,
but I guess it could still need some more
attention.
Yeah, and of course, I'll continue with
my research on these issues and
will soon start with another project
working on a prototype for an
online research platform called Tracking
the Trackers.
It should become a comprehensive online
knowledge base about the topics I've been
talking about today.
The main target groups for this will
include academics, journalists, activists
and policy makers.
So it's planned to be a research tool
for kind of expert stakeholders
in the medium term.
It could also evolve into a collaborative
community platform.
We'll see if you're interested in this
ad anyhow.
If you're interested in collaboration,
please say hello to me after my talk,
OK? This is what I will do.
But I still didn't really answer the
question.
What has to be done
in general? I think what we should
not do is things like blaming
people because they're using Facebook
and telling them they're guilty and it's
their own fault that their personal
information is being abused and so on.
Of course, everybody should use
alternatives to the dominant services
and apps and browser extensions
to avoid some of the most invasive
tracking and so on.
But I think there is no easy way to
completely opt out of today's
surveillance economy at an individual
level without opting
out of too much from modern life.
For example, if a non-technical person
wants to use a normal state of the
art phone today, this person
has no other choice than choosing between
using it with a Google, Apple or
Microsoft account is a disaster.
It's not an individual problem.
We have to solve this on a societal
level, I think.
And that's why I'd like to present a
quick summary of basic policy
recommendations which resulted from
my research.
I think the most urgent challenge is to
make corporate data collection and
utilization more transparent.
This could happen by supporting research,
also by developing developing technical
tools to examine
the black boxes from the outside.
But, of course, also by regulation,
which quickly leads me to
the never ending story of the European
data protection reform.
I hope that European
data protection regulation to GDP
are and the EU Privacy Directive
will make things at least a bit better
from 2008,
if not much better.
We'll have to carefully watch how
it will work on a practical level
and if necessary, we'll
have to further update it.
In addition, I think that also other
fields of law, such consumers such
as consumer protection,
anti-discrimination and also competition
law could help to rebalance
the current information technology
landscape.
But even if we get the best regulation, I
am afraid that this won't
be enough in the moment.
Companies are not only in control of
our personal data, they're even trying to
shape our future information
society at all.
And during the last 10 years, they were
successful without much
democratic debate or discussion
or whatever.
They've got billions and billions of
financial resources and they're moving
ahead very fast.
I think we need much more support of
decentralized privacy where technology
or maybe even a completely
new industrial policy and billions
for open source components and frameworks
which help creating a different kind of
innovation, which is respecting
our privacy, for example, and the
European Union level.
And not least there is already
a large group of people committed
for this kind of a different Internet,
which is not dominated by corporations
building centralized services,
for example, here,
the Congress.
This is why I think it's also crucial
to make digital civil society
much stronger.
I mean, many organizations and
individuals are doing amazing
work, fighting hard to get some 50000
years.
That's not clever from a society
point of view, I would say.
And yes, we need much better and
much better level of digital
literacy.
We need well informed citizens
for a Democratic Future Information
Society. And I'm not talking about
just knowing how to use Microsoft
Word.
It's about better knowledge of what the
digital age really means for
us as individuals and
as a society
beside of this.
I think the worst thing that could happen
would be if we get desperate or even
cynical, like the
NSA is collecting every piece of data
anyway and everybody's using Google.
So fuck it,
why should we care?
Actually, quite the opposite.
And that's why I'd like to finish my
talk like always
with a major recommendation
by a major guy.
Google's Eric Schmidt said in 2013,
you have to fight for your privacy or you
will lose it.
Friendly advice or a serious
threat?
I don't know.
Thanks a lot.
Thank you so much. We do have time for
questions, so if you do
have questions, please go to
the for one of the four microphones.
For those of you who are leaving
right now, the room, please do
it as quietly as possible so we can not
get interrupted or disrupted in the
rest of us. Talk.
Let's just take a moment.
OK, we have a question on the microphone
to my left.
So know any any kind of studies
made how we know how this all just
makes cell phones itself so good?
Neera, can you speak into the phone?
Yeah. Yeah. So do know how these
tracking technologies influence
self-censorship of how people
start to change their behavior
online and restrict
their communications in
order not to leak someone's private
world view to to the trackers?
Yes, I didn't talk about that now,
but this is a crucial point,
this kind of chilling effect.
When you know that you're
constantly being watched,
then you will behave differently.
We know that since a long time,
there are many studies about that.
And I think the crucial
point today
is that in many cases we
really don't know.
For example, we see some
ads and we think
it was that because of
that interaction, that website with it,
or was it not
did they check my location or
didn't they do it?
So I think this really
leads to an uncomfortable feeling.
And in general, the
situation is a disaster because we know
the governmental surveillance, which is
also accessing the corporate databases,
is omnipresent.
So, yeah,
I think this is a crucial point.
And I also addressed that a bit more
in detail in my report.
We have a question from the Internet.
Yes, we do.
There is the rather cynical
point of how do they categorize people
that are trying to hide their data
or mostly white male
earning above average?
Is that not just an actual data point?
Again, sorry,
people who are hiding
their data.
Can you repeat the question people that
are trying to opt out of
the cookies and everything?
Yes, I think people who don't
participate, sometimes
they are.
They consider this suspicious
from the beginning.
Also from the marketing, from fraud
detection companies and from many other
companies, I think this is also a
problem.
So we don't really have the choice to
just solve this on an individual
level, to just use encryption
and browser extensions
and digital self defense and so on.
That's why I'm talking about that.
We need really a societal
solution for this.
And then I take a question from the
microphone in the back on my left.
It's it's you. Yeah, I
am.
Do you have any individual tools to
support, like Ghostery or
start beads and stuff
like that? That will help because
there is a tool that tries
to block trackers and that
is an alternative search engine that
does a search through Google but
claims to hide your
personal data.
Am I the first part of the question?
And the second is, do you really trust
governments that governments could
actually impose rules on how
data is used, that what
governments with laws could
actually provide
a good framework?
Yeah, the first question, of course, I
would strongly support recommend to
use stop or search engines,
which are not based on individual
profiling and tracking,
of course, but it's
getting a bit more difficult when it
comes to browsing tangents like Ghostery
because they started
to to participate
in a tracking ecosystem
now itself.
So I'm not sure if
we can trust companies like
Ghostery.
I think we cannot.
Also Adblock Plus,
it's the same story, so it's really
difficult.
Currently, we have U.
Block Origin and privacy
BETCHER from the EFF, which are working
quite well. But yeah,
they are not the solution for for the
whole problem.
We should use it.
It's good, but they are not the solution.
The second thing is, I
don't know.
I know many people don't trust
governments and I also don't trust
governments.
But I don't think if we are talking
about governmental surveillance,
law enforcement, intelligence authorities
on the one hand and on the other hand, we
have some we still have something
like a democratic
parliamentary system
with a balance of power.
And if we have
there are interest groups, different
interest groups in in governmental
sectors and also on the European level.
So these are not the same
people who
are
fighting for better data protection
regulation than the people who are
running the government, the intelligence
and the data collection, law
enforcement and intelligence agencies.
So I think, yes, it's important
to use
the regulation and law
approach to address
all these problems.
We want to make it.
We thought, OK,
time is up.
Unfortunately for those who still have
questions, I'm sure you can reach Vafa
afterwards. Yeah.
Yes.
Thank you so much, Paul.