Magazine menu Close Magazine menu

In business we trust

According to 2022 Edelman Trust Barometer, customers have greater expectations for business to lead as trust in government and media declines. How can we improve transparency and ethical data use to instill a trust culture?

In business we trust

Selected articles

earning customer trust

Earn customer trust with ‘inside out’ business values

  • Transparency
  • min read
    • I've particularly noticed two business trends since the pandemic. First, people aren't rushing back to work – whether it's called the Great Resignation or Great Reshuffle, we're thinking hard about where and why we work. Second, we've become more dependent on, and aware of, technology and how it's shaping narratives in society. Tech can earn business gains in efficiency and productivity, but there's no shortcut to earning trust. Fuelled by mistrust in media and government, public trust is declining. There's an opportunity for businesses to lead in regaining public trust, and I believe they should start with their employees. Distrust has become the default The pandemic sparked fears about personal and societal issues. There are existential concerns like climate change and growing worries about personal freedoms and economic security. This anxiety and insecurity make it hard to trust. The Edelman Trust Barometer surveys 36,000 respondents in 28 countries on their relationship with business, government and the media. The 2022 Barometer shows distrust has become the default, especially distrust of government and media. Who people trust has become more local, like co-workers and neighbors, and distrust of outsiders has risen. The business of raising trust Trust has long been weak in media, but the Edelman Trust Barometer showed trust in government has fallen around 25 percent between 2020 and 2022. Trust in business meanwhile stayed at about the same level. People are looking to business to tackle big issues rather than their governments. It's an opportunity for business leaders, but not those who picture nothing more than trust-promoting marketing operations and communications ploys. Cutting through the fake The public sees CEOs and business leaders with a wary eye. Between 2021 and 22, those who said they worry business leaders are intentionally misleading people went up to 63 percent. Similar concerns about journalists (67 percent) and government leaders (66 percent) have risen too. Build trust from the inside out The Edelman Trust Barometer found employees tend to give credence to their CEO. But what about your employees? It's worth doing an anonymous internal survey to find out how much they trust your company. Internally, transparency is an excellent way to earn confidence. Show faith in your employees and give them accurate information about your strategy and intentions. There are, of course, limits to how transparent businesses can be. You can't divulge intellectual property secrets or make big announcements before an earnings report as a publicly-traded company. But the way you operate and communicate internally must be consistent with how you want customers and stakeholders to see you. I call this the 'inside-out' model: What goes on at the core radiates out through the value chain. The core is your executive and employees. Moving out from the core are your ambassadors, distributors and suppliers. The next level is customers. Demonstrating consistency over time – from the inside out – will mean greater trust. Gain trust the old fashioned way: Earning it I have seen these three leadership attitudes matter when it comes to instilling trust throughout your organization and value chain. First, when possible, under-promise and over-deliver – for example, in marketing promises, delivery dates and product performance. Second, have a karmic attitude – giving without expecting anything in return. A transactional approach, based on equal exchange, means no margin for 'extras,' and can rapidly decline into an adversarial relationship. A karmic attitude builds up credit. Marcus Sheridan built a successful swimming pool business by giving away relevant and honest content. Credit is important over the long haul if you need forgiveness for an error. Unexpected things happen, and there are unavoidable, big-picture issues like global supply chains breaking down and wholesale price rises. Third, bring your company's purpose to life and ensure it impacts your behavior, language and decision-making. The most important audience is your employees: Ensure they clearly understand and experience the company purpose and vision – many employees say they don't fully understand theirs. However, avoid overselling your purpose – it's better to understand your limits than to promise something you can't deliver. Strive to live up to what you say. Admit mistakes and be honest about your failings. This will help build trust and engender loyalty. Overcoming the challenges of tech and trust As businesses grow, they need more tech to help manage many customers and workflows. Many organizations are starting to use artificial intelligence (AI) to support customer relationship management (CRM,) customer service and eCommerce. While there are great uses for AI, issues around data privacy, invasive personalization and bias are legion. You need a solid ethical framework to manage these. Using empathy to understand the employee and customer journey better is vital. And to be trusted, especially with AI, you must have a firm grasp on the outcomes you want. For example, when using chatbots to augment customer service, tell your customers what kind of agent they're dealing with (bot or not) and be alert to when a human agent must step in to ensure the best customer experience. There's no shortcut to building trust. It takes a concerted effort across the organization. If you've built a loyal and trusting partnership with your employees and stakeholders, they'll be your best ambassadors and be more forgiving of your mistakes. Be vigilant when trust starts to erode: Trust is hard-earned and quickly lost.
trust management

Businesses need trust, and trust management is here to help.

  • Data and privacy
  • min read
    • Trust is crucial to personal and professional decisions. It determines which brands we'll share our data with or work with and allows managers to let employees work flexibly. But could trust help us make better decisions about sharing corporate information and IT network access? Workplace mental health expert Dr. Joti Samra says pandemic life has given us "new co-workers:" Those we live with 24 hours a day, seven days a week. My partner Dr. Theo Dimitrakos is a world-leading expert in trust management, currently working in the Trustworthiness Theory, Technology and Engineering Lab, Huawei Europe. He's a much-cited author, Professor of Computer Science at the University of Kent, where he chairs the advisory board of Kent Interdisciplinary Research Centre in Cyber Security and founder of an international trust management research community. Between lockdown chores and deciding who should load the dishwasher – while we wait for Samsung's futuristic new kitchen robot – we had a cup of tea and chat about trust management. Dr. Theo Dimitrakos Susi O'Neill: Trust management, from what I hear between the walls, seems complex. What are the basics – how would you explain it to your mother? Theo Dimitrakos: Before retiring, my mother ran an olive oil business in Greece. I learned many skills by helping the family business. In the 1980s, I installed an Amstrad computer in our Athens shop window, showing 8-bit animations to amazed passers. My parents would produce print packaging slips giving measurements of the olive oil's pureness from the state chemical analysis agency. This was before standard classifications like 'virgin' and 'extra virgin' olive oil. Central to trust management is reliability assessment, so parties can trust each other to share data. If I claim my olive oil is 100 percent unrefined virgin oil, you need to be able to check my claim. It helps if I give you a trust statement, like the oil purity label. You need to validate the assessor – in this case, seeing proof from the state agency who is an authority qualified to assess the oil. I can verify your mother's olive oil is delicious. What are some more key concepts in trust management? In the olive oil example, recognizing authority is a key concept which underpins trust assessment. Different methods of measuring trust are also important. My colleague Professor Audun Jøsang, who invented subjective logic, created a calculus for computing in trust networks. It's now combined with decision networks to measure trustworthiness in neural networks. Trust-based decisions inform how an intelligent agent program makes final purchasing decisions using data. Professor Harrison McKnight, my co-editor for Trust Management VI, developed a cognitive model to explain the process. Another fundamental of trust management is trust negotiation: Incremental information disclosure. Organizations must take care of what they disclose, to whom and how. Releasing information over time can help reach a trust level to share more valuable data for a common goal. Trust negotiation can help decide how to share credentials to achieve the least-privilege principle (users can only access the parts of the system or data they need for their job) to implement the zero-trust security model. Trust negotiation algorithms do this and more. Before you let someone have privileged information, you may want to check their security clearance. In an IT system, you may want to share as little information as possible for the task, then let the system ask for more information when you need higher-level access. How did you become interested in trust management? After gaining my Computer Science Ph.D. at Imperial College, London, I worked at a UK government computing lab. We experienced the first dot-com bubble crash around 2001. People lost trust in tech businesses. I felt I had to take action, so I got involved in an international partnership between government, academics and industry to improve trust between customers and companies. In 2002, with the late Christos Nikolau (IBM and University of Crete,) we established iTrust, an interdisciplinary network including experimental economists, philosophers, and cybersecurity and access management specialists. Trust management previously meant identity and access management for IT networks. We broaden it to include models for measuring and increasing trust and consumer confidence. I found the experimental economists' research particularly interesting. Microeconomics Professor Claudia Keser wanted to look at giving incentives for supplying data. We now see that in practice as people trade their data for free online services. In 2004, I led an international applied research project that developed a framework for managing trust when sharing sensitive data between organizations. The research informed web services trust protocols in use and created a start-up that's now a market leader in dynamic authorization. My interest in trust management continues. At the forthcoming IFIP conference, I will present new methods to authorize and change a person's access depending on their situation. For example, if they're working at home and others are present who shouldn't have access to sensitive documents, or they're trying to evade detection when taking photos of confidential documents on their computer screen. How has trust management evolved since then? There have been significant developments and new identity verification models, virtual organizations and consensus-based decisions. There are now more decentralized ways to create digital identities, share and verify them without violating privileges, nor the identity provider needing to track who's used them. How does this relate to decentralized data models like blockchain? Blockchain's decentralized trust model has distributed credentials and verifiers. It can be used to implement a trust model, but it's not the only way to implement trust management today. Credentials verification is a model promoted by W3C – the community that sets global open web standards – for verifying web information. It has nothing to do with blockchain but can be used alongside it. My colleague Professor David Chadwick, a co-editor of the standard, highlights this distinction. Blockchain or not, it means someone can prove your credentials without assuming a centralized authority, the party and identity provider issuer know each other. And you could use someone's credentials without the identity provider tracking what you do – for example, when you share your identity documents to open a new bank account or use a trust-led community like Airbnb. If credential verification becomes popular, big tech firms like Google will be less able to track us. How can businesses establish a suitable trust management model? Knowing your business means understanding its processes and data flows with suppliers, incentives for users and which authorities regulate your data or services. Understand your relationships, model them, design your system, then make it secure. Apply security from concept to deployment. How can businesses use trust management to improve IT security? Trust management predates zero trust and will probably outlive it. Zero trust integrates different decentralized trust models. It's becoming popular because of how technology has evolved: Our work environment has become more decentralized with cloud computing, remote working and data sharing. Zero trust is about decentralized trust models, fusing trust authorization and verification versus reliability. It means you need to check your assertions about someone rather than rely on another authority to validate them. You need to examine the subject and score them, then use that score and the outcome of your trust algorithm to decide what systems and information they can access. Now we can measure trust, so your decisions must be calculated. You can have verification like digital signatures, behavior analysis, biometrics, or a combination. This creates a trust score for each entity that should be linked to your access management policies. Authorization becomes dynamic and continuous. This is often overlooked when considering zero trust strategies for security and access control that only focus on prevention. As trust values change over time, authorization levels and access must change. You may need to increase, reduce or revoke authorization previously given. With Dr. Fabio Martinelli, Vice-Chair of the European Cybersecurity Organization, we recently developed a lightweight enabling technology for network gateways and consumer internet of things (IoT) devices that combine dynamic authorization with an evaluation of trust levels. I hope this helps zero trust models go beyond corporate networks to smart homes and data usage control. Excellent! Now I feel suitably informed about trust. So in place of the dishwasher robot, can I use a trust management model to make sure you do this? Yes, but we first need to set up an algorithm and scoring method, agree on incentives and maybe a consensus protocol. Perhaps technology models can't solve all our challenges yet. Opinions are those of the interviewee and do not represent his employers (corporate or academic).
data transparency center

How transparency centers and open data processing practices help your business

  • Data and privacy
  • min read
    • Data processing centers are already a crucial part of digital business, and transparency centers – although less widespread – are becoming part of that picture too. But the two can be confused or poorly understood. Enterprises wanting to make sure they're protecting their security in the best way possible will want to get to the bottom of this. Here, we'll take an in-depth look at both, examining their different purposes and what your business should consider when using each as part of its security practice. What data processing centers do Data processing centers hold servers and computers that process your business's information. Increasingly, data processing centers are separate from the data-owning business's premises for safety, security and cost-effectiveness. According to Market Prospects Insights, "Data center operations include installing and maintaining network resources, ensuring data center security, and monitoring systems responsible for power and cooling." Speaking of power and cooling, more businesses are now thinking about the environmental impact of data processing. Thankfully, data processing needn't cost the earth. You can seek out data processing centers powered by renewable electricity, either in a country where grid power comes mostly from renewable energy, like Norway, Brazil or New Zealand. Or, process your data with a company that powers their data center by buying electricity only from renewable sources. Why data center location matters Regulation can also impact where businesses choose to process their data. You'll need to know how laws in the territory you and your customers are in could affect your data security. A third factor influencing where you process your data may be company values. At Kaspersky, we use two data centers in Zürich, Switzerland to store all threat-related data from our product users in Europe, North and Latin America, the Middle East and several Asia-Pacific countries. We chose Switzerland because of its long history of neutrality, as part of our Global Transparency Initiative (GTI.) What transparency centers do Wondering what next-level trust between businesses looks like? You may soon have the opportunity to examine your software supply chain in a new level of detail. Outside the open-source software movement, software source code is usually a closely guarded trade secret. But increasingly, front-runners realize that finding ways to safely and securely let partners and clients inspect their code helps build the trusting relationships businesses need to thrive. Communications giant Huawei established its first transparency center in Brussels in 2019. Huawei explains what they hope to achieve with their center: "Through the Cyber Security Transparency Centre, we plan to increase communication and collaboration with security professionals, governmental agencies, customers and other industry stakeholders, in order to develop a secure and trusted digital environment." Microsoft opened transparency centers in Brussels and Redmond, Washington in 2014 to 2015 as part of its Government Security Program (GSP.)  Matt Thomlinson, Vice President of Microsoft Security highlighted how transparency centers can contribute to better economic outcomes for all: "Only by increasing confidence in digital solutions […] can Europe ensure that every citizen, business and government feels the benefits of the digital revolution." Kaspersky started creating transparency centers in 2017 and now has seven, in Zürich (Switzerland,) Madrid (Spain,) São Paulo (Brazil,) Woburn (USA,) Tokyo (Japan,) Singapore and Kuala Lumpur (Malaysia.) We welcome customers and partners, including authorities responsible for cybersecurity, from anywhere in the world to visit these centers. How Kaspersky customers can use our transparency centers We suggest clients visit a transparency center if they want to know more about our data security, privacy and management practices, encryption methods or supply chain risk management. When customers visit our centers, we have experts on hand to give any technical information about our source code and technologies. We have three levels of access, like the beginner, intermediate and advanced slopes on a ski field – designed to allow a broader range of client visitors to get something out of the experience. They could rebuild our source code to ensure it matches publicly available modules, and read what independent auditors – including a Big Four accounting firm – have said about us in recent security reports. While few businesses have transparency centers today, others are adopting similar ideas. Showcase centers, for example, let customers try out the firm's latest tech and in some cases, securely review code. UK-based telecommunications multinational BT established a showcase center for its financial services products, where their customers learn more about their products – especially security features. Today, businesses must understand where and how their data is processed and ensure processing conforms with regulation and their organization's values. Find out what opportunities you have to better understand what's happening with your data. If you have an opportunity to visit a transparency center or other facility that lets you get up close and personal with the code of organizations in your supply chain, take up the offer – regardless of which ski slope you're on.
digital trust

How can we solve the crisis in trust in business?

  • Opinions
  • min read
    • "There is a crisis of trust in American democracy." So begins a 2019 report from the Knight Commission on Trust, Media and Democracy organized by the Aspen Institute. It lays blame on the nation's political discourse, racial tensions, and the technology that gives people greater access to commentary and news. The report concludes that since 2018, "unwelcome facts are labeled as fake." Rising cybercrime reduces trust Part of the problem with trust in the technology industry has to do with the ease cybercriminals now have to ply their trade. Once relegated to a dark corner of the internet, now many criminals operate in the public view. On the dark web, you can buy various pieces of technology such as ready-made phishing kits to seed infections, carders to collect credit card numbers, botnets and web stressors to deliver DDoS attacks, and other malware construction kits that require little to no technical expertise beyond clicking a few buttons on a web form. A 2019 report from CheckPoint shows that anyone who's willing to pay can easily obtain these tools. Forget 'software-as-a-service': we're witnessing the growth of the 'malware-as-a-service' industry. At a recent RSA forum in London, UK, I interviewed numerous experts who've spent their careers examining cybercrime and understanding how to combat fraud. It was a somewhat sobering picture, to be sure. RSA's president, Rohit Ghai, spoke about how the largest facet of risk today is digital risk, and how businesses need to better integrate risk management and cybersecurity methods. "This is a team sport: security, IT, operations and risk groups all need to work together," he said. "Our goal is not just about protecting apps or data, but about protecting our trust assets. We trust strangers to share our homes and cars because tech brings us together and drives the sharing economy." Ghai believes we need to replicate this trust system in the B2B world, just as Airbnb and Uber have done for consumer-based businesses. Trust at an all-time low? Ghai agrees with the conclusions of the Knight Commission report: trust is at an all-time low. Some have become so distrustful of our digital lives that we now have a new acronym, LDL ('let's discuss live'). But we can't, and shouldn't, turn back the clock to the analog era: we need to be able to trust each other again to fuel our growth. He mentioned that to be trustful, "an ethical company should do the right thing, even if no one is observing them." I liked that idea: too often, we hear about corporations that are causing damage, like polluting our environment, before denying any responsibility, or worse, covering up the details when they get caught. Part of the challenge for IT professionals is that cybersecurity is really a business problem, not a failure of technology. "Breaches and intrusions will occur," says Ghai. "We have to move beyond the shame of admitting a data intrusion and understanding its business impact. Our goal should be maintaining 'cyber-wellness', not trying to totally eradicate threats." Taking better care of customers' privacy is also good for business, as numerous reports have concluded recently. Almost half of the consumers surveyed believe there are ethical ways companies can use their data. How much do you value your data? Another issue is that what we say and what we actually do about maintaining our digital privacy is often at odds with each other. In a 2017 MIT privacy experiment, they found that student participants would quite readily give up personal data for very small incentives, such as a free pizza. And the same casual value exchange played out when Kaspersky offered up freebies in exchange for personal data in this storefront stunt. This dichotomy is seen even with IT security pros. Another survey by Yubico found that more than half of IT managers who have been phished have still not changed their password behavior. If they don't change to improve their own personal security, who will? The same dichotomy can be said about transparency: sadly, there are few companies who are actually as transparent as they claim, either by wilfully misleading the public (Facebook is top in this regard) or by just doing a poor job of keeping their IT assets under appropriate controls (British Airways is a prime case study here). Trust is fragile Where do we go from here? Security expert Bruce Schneier says that trust is fragile, and transparency is essential to trust. The Knight Commission report carries a series of recommendations for journalists, technology vendor managers and ordinary citizens. Recommendations include being better at practicing radical transparency, for journalists to disclose information sources as a rule, and making social networks step up and take responsibility for protecting their users. I hope we can implement many or all of them to make for a better, mutual and trusted future. All of us need to work together if we want to turn this around and improve customers' trust in business. This article represents the personal opinion of the author.
brittany kaiser interview

After Cambridge Analytica, Brittany Kaiser has a solution for personal data privacy

  • Opinions
  • min read
    • In 2018 she hit the headlines as the whistle-blower exposing data privacy violations between Cambridge Analytica and Facebook. Trained as a human rights lawyer, Brittany Kaiser since testified at the UK government's fake news inquiry. Kaiser has now established a foundation helping the next generation live a safer digital life to experience the benefits of technology, and has explored her experiences in her book, Targeted, and the Netflix documentary The Great Hack. I spoke with Brittany about how personal data use could shift from harming to saving society, and what business can do. Brittany Kaiser, Co-Founder, Own Your Data Foundation Susi O'Neill: How can legislation best protect our data rights? Brittany Kaiser: There's a dichotomy in the privacy community: Many say data rights should be human rights. But we've had human rights protecting privacy enshrined in law for decades. During my legal training, I was frustrated by how hard it is to uphold human rights law in court. People can't easily get compensation for human rights abuses. Privacy isn't real – suing to protect it under human rights has never worked. A legal framework won't help when data is the world's most valuable asset class. It's a multi-trillion dollar industry – we can't stop it from functioning. Access to data makes organizations more effective. We should legislate so people are protected from bad actors and abuse, but in a way that lets artificial intelligence, data science and the internet of things (IoT) help us solve the world's greatest problems. How can we change the status quo of organizations, rather than people, owning our data? The framework I like to work with is data ownership. Property is the most potent form of law. If someone damages your property, you'll win compensation, even with fractional ownership. If I own 20 percent of Facebook's data about me, I should get 20 percent of the revenue from it. Data ownership as a business model could look a lot like Airbnb. If data is my property like my house, if you want to use it, I say how you can use it, for how long, and we agree a price before I hand over the keys. It should be transparent. Perhaps I give a license for six months or a year. Then I get compensated, either upfront or as a dividend based on use. This solves the world's most significant human rights problem: Extreme poverty. Many supply chains are damaged after the pandemic – the United Nations says 270 million are at risk of starvation. If everyone owns their data, some could earn enough to feed themselves. Zuckerberg (Mark Zuckerberg, Facebook CEO) says everyone's data is only worth 17 US dollars a quarter. I think it's worth far more and that's just Facebook data, but let's work with this figure. Two billion people live on less than 2 US dollars a day, so 17 dollars every three months would make a huge difference. Data could solve poverty. It's a bold and far-reaching idea that personal data could be turned into personal value. How can we improve privacy standards at the same time? Right now, data protection and privacy legislation is an ideal. It's new, and we're in a pandemic where some countries have given exemptions, so laws haven't been fully ratified. We're heading in the right direction to provide more transparency and rights. The goal should be, once people are educated, we have the legislation in place and technologies to secure our data. After that, no one should access it until we give consent. And we consent because we're incentivized. Now we have no incentive, so people shout about privacy. There's no benefit except to open ourselves up to abuse. Business and government have exposed us to this. What if we flip the incentive structure? I could share my data with a diabetes research company, earn money and help cure diabetes. People would opt-in. How would a personal data market work in practice? Personal data is the world's most valuable industry, but we can't see or participate in it, even though our data is in these markets. We should control and decide which data markets to take part in and what to consent to. Like sharing your data with the government so they can help prevent a terrorist attack. Or a pharma researcher, so medicines work better on women and minorities, rather than the 18-year-old white guys that sign up to medical trials for beer money. You could consent to smart cities and IoT (internet of things), so there are fewer traffic accidents. You could use your time to do surveys or watch targeted content for a universal earned income. Most policymakers propose a universal basic income as a handout from the government. The income from your data you've earned from its value – it's not a handout. It could pay for a few groceries, or in some economies, for your apartment. A 'data wallet' could show the data you're producing and opportunities to join different marketplaces or research. You decide which opportunities to participate in. Thousands of companies are building solutions to solve parts of this problem – digital identity management, smart contracts and automated monetization like token rewards or digital money. Soon, we'll see enterprise-level solutions that we can use reliably. After your experience with the Cambridge Analytica scandal, you've talked about data being used as a weapon in democracy. What does this mean? Data weaponization means using data to target people for purposes they didn't consent to. It could be considered violent. Data has been used to target people who break social norms, to incite racial hatred and violence, and by political organizations to suppress voters. We need to solve this problem in a more systemic way. Put pressure on big tech companies who are doing too little, too late. We need to pass regulation that demands they invest. With the money they make, they could invest more in solving this problem. Zuckerberg says he's got thousands of people working on it. Why don't you have hundreds of thousands of people solving it? It's nothing compared to efforts made towards shareholder profits. What role can regulation and cyber standards play in safeguarding our data? I'm doing legal work about the custodian responsibilities and standards expected of those holding our data. If they prioritize fiduciary responsibilities before obligations to shareholders, there will be more ethical practices. Right now, the greatest responsibility is consumer protection, but organizations have little incentive to protect your data. Facebook has already been fined over 5 billion US dollars for failing to protect its customers. But it isn't enough. We need stricter legal protocols. In 2019, Senator Elizabeth Warren put the Corporate Executive Accountability Act bill to the US government. It's proposed that if a company allows a data breach or hack through negligence, its executives are criminally liable. It's a vital step. If Zuckerberg or Sheryl Sandberg (Facebook COO) thought they were going to jail or lose their job, they'd have more incentive to protect people. In both the Cambridge Analytica and Equifax scandals, it's gross negligence. It's nothing to do with cybersecurity protocols. For Equifax, 3,000 security certificates weren't updated, then they got hacked. And their business is holding and sharing personal data. I was an expert witness in the case against them. A lawyer said not installing the update was like leaving the house with the doors open and lights on, then being surprised to get robbed. We need to enforce higher cybersecurity standards if you want to hold personal data. If you've shown good practice and have upheld standards, then no, you shouldn't be held criminally liable as you've done everything you reasonably can. Some hackers are really good, and some vulnerabilities too hard to predict. What can governments and regulators do to help businesses comply? I believe most businesses want to do the right thing. We need to make it easy and affordable for them. That's one of the most important things about California's Proposition 24. They've established the first data protection commission. 50 staff will use their expertise to help companies comply, so it's not a burden. We need more of this worldwide, particularly as many businesses and economies have taken a hit with the pandemic. What advice would you give an employee if they see a potential data breach in their company? Always raise the red flag internally first. Your company may not know they're doing something wrong, or it's a decision by one rogue employee. They could fix it. But if you continually raise flags and suddenly you're being cut out of meetings, getting cold-shouldered, or you get fired, it's time to go public. A whistleblowing lawyer is one path, or you could directly approach a data regulator. Hold the company to account to make sure they comply and can't misuse their power. What's the philosophy of your Own Your Data Foundation? I co-founded the Own Your Data Foundation in 2019 when I realized it would take time to get the right data protection legislation, and the enterprise-level tech isn't yet available. The sustainable way is to empower people to protect themselves. We give digital literacy training for the Digital Intelligence (DQ) curriculum, which this year became an Institute of Electrical and Electronics Engineers (IEEE) global standard. Leading technology universities, government ministries, think tanks and Microsoft developed it. It's supported by UNICEF, the World Economic Forum and OECD. It begins by assessing your digital intelligence and giving you a DQ score – like IQ or EQ – to improve upon. Training topics include your data rights, cybersecurity protocols and media literacy. Tests include spotting fake news and phishing, how to show emotional intelligence online and protecting yourself and others from cyberbullying. We also explore mental and physical health and stop device addiction. After I'd trained to be a human rights lawyer with Amal Clooney, my first paid job was at Amnesty International in London. Over ten years, they implemented a human rights education program through 13 countries' education ministries. For the DQ program, I'm excited as the IEEE standard was only released this year. The Kingdom of Saudi Arabia announced at the G20 Summit they're adopting it and will include it in their national education curriculum by 2022. In ten years, I hope every country is teaching this. What problem does the DQ curriculum help solve? This year we've been thrown into a new digital life unprepared, with far more screen time and more platforms. Many people aren't yet digitally literate. We have to educate fast. That's why we're delivering our courses low-cost, or free in some cases, with virtual classes and resources to make it accessible across the world. DQ is essential. It should be part of everyone's education – whether you're a child, parent or worker. Older people are also vulnerable as some are using this tech for the first time. Our foundation delivers training of trainers, supporting the teachers, to establish good habits early for young people. Many companies' most significant cybersecurity risk is a staff member who doesn't recognize a phishing attempt. At work, HR should deliver professional programs, training new staff to protect themselves and your organization. To find out more about digital intelligence (DQ) training, contact Own Your Data Foundation. Comments represent the opinions of the interviewee.

Could this voluntary charter fix data ethics in big tech?

  • Digital transformation
  • min read
    • We know some people and businesses will, given the chance, use personal location data in unethical ways. When automotive cybersecurity experts Karamba Security posted a fake vehicle control unit online, they saw 25,000 attempted breaches in three days. Stalkers have used AirTag, Apple's coin-sized device for finding lost keys or other property, to track victims. Regulations like the EU's General Data Protection Regulation (GDPR) define minimum standards of data ethics, but the case for going further is strong. To that end, what can help those tech businesses who want to stay ahead of the data exploitation curve by upholding the highest data ethics standards? Learning to foresee the unforeseen International non-profit the Locus Charter promotes a higher standard of responsibility for professionals and businesses when it comes to location data. They want to avoid unforeseen privacy breaches by working out what can go wrong and pinpoint big problems before they're exploited. They champion public interest by showing businesses how to prevent unintentional harm. The charter is based on ten principles that balance moral behavior with economic benefit, like realizing opportunities and understanding impacts. Location data is one of many frontiers. As veterans of data policy in and out of government, the charter's founders want to be part of all kinds of data discussions. Automation challenging data ethics "The most important focus in data ethics is exploring the power granted by the accumulation of data so everyone can recognize how that power can be used and misused," Ben Hawes, Technology Policy Consultant and co-author of the Locus Charter, told me. He continues, "There's an assumption automated systems and digital technologies are always better. Economic pressures mean companies prefer the promise of greater productivity at all costs, which can be alarming when people are unaware of many potential data misuses, accidental or deliberate." "Some risks in business going digital crop up in all sectors," said Hawes. "We often see 'designer biases,' where developers center their own experiences, leading to alienating people who don't fit the same racial, economic or physical profile. Another issue is automation making back-end processes more complex until they're opaque. There are also sector-specific issues." With the digital world's size and potential, regulating the space is an uphill battle. New ways to exploit data are appearing faster than lawmakers can address them. Is self-regulation enough? Hawes doesn't support a relaxed approach to data ethics. "It's unwise to avoid oversight and critical regulation in the hope self-regulation may be enough, as it rarely is." A 'wild west' model is attractive for short-term gains by freeing emerging markets from red tape, but loose protections don't create conditions for long-term growth or stable markets, especially in an age of social pressure on brands to be ethical. Can whitewashing be cleaned up? With limited regulative authority, a non-profit trade initiative likely isn't eager to bicker with companies they're working with. Organizations like Locus may be better placed, approaching economic ethics from a collaborative angle. Of course, some companies are only interested in the PR boost of appearing ethical by whitewashing their marketing because they don't want to be the only ones following the rules in a competitive arena. They end up paying lip service alone, without taking the issues seriously. Hawes thinks despite this, there's still benefit in working in good faith. "To get ethically reluctant companies to behave well with data, is it better to give them the benefit of the doubt or be critical and accusing? I think, better to have a company aspire to a good standard, even if it's empty promises, because they can at least be held to those standards in some way." Less direct ways of influencing A cooperative strategy may create the best conditions in a self-regulating atmosphere. When ethics groups collaborate with business, they influence thousands of staff members, creating internal pressure for higher standards in the boardroom. It's also worth championing an ethical company for consumers looking to do the right thing with their money. Though strategies like these can't do it all, they have worked, motivating large companies to produce net-carbon zero plans and banks to create green investment options. But data misuse is not the same as pollution. "It's harder to see and analyze compared with other high-profile scandals, so it's hard to translate into a common grievance that can unite people," says Hawes. Will something have to go badly wrong for the world to take it seriously? Hawes considers, "If authorities avoid developing solutions until a problem causes substantial harm, they'll still need about a decade to develop tools that would be effective in this complex market. Governments should be working on this yesterday." In other words, have a fire extinguisher ready when playing with matches, rather than trying to invent one as your house burns down. Reforming data use culture The task of reforming fast-evolving data industries is daunting. Hawes' recommended method involves slowly, steadily establishing ethical practice as the norm. "The UK has the Digital Regulation Cooperation Forum for sharing information and approaches. It lets regulators gain knowledge of the risks data and digitalized business generate, so they can manage them sector by sector. We need a forum like that on an international scale," says Hawes. "Understanding risks like explainability, transparency and bias creates a foundation for building standards that address the problem and brings stability to the data economy." This pressure can also come from outside industry, and often flavors the expectations that filter into business. "More public debate on how we can avoid driving digital inequalities would go a long way," says Hawes. "This is particularly important in social media, which is the frontline of data ethics in many ways." While data privacy issues haven't seen the emphasis Hawes and his peers would like, they're eager to change the culture. Business can choose to be part of the solution and be heralded as ethical data use champions for their efforts.

KASPERSKY’S GLOBAL TRANSPARENCY INITIATIVE

We enable the cybersecurity community and our stakeholders to validate and verify the trustworthiness of our products and operations.

Learn more
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries