I am. I nap they them pronouns, and
you are listening to firewalls don't stop dragons.
Hello, everybody Welcome back to firewalls don't stop
Dragons. I'm your host Kerry Parker. Today we
have episode 384
for 07/08/2024.
And we've got a great interview for you,
we'll be talking with Io nap shortly. Before
we get into that, though, a couple quick
things.
First of all, I did confirm my Andy
and in of interview, I said that might
be a thing.
They have recently made some interesting moves, including,
new... Google Docs replacement
and also changing kind of the way their
company has structured to to to try to
protect it actually from
External influence. So we're gonna talk about that
with Andy. Probably
probably in August and you might not actually
hear it till September. But it's coming. I
promise that will be a great interview. Also,
the book surge is happening.
I've been talking about this for several weeks.
I finally got cut my...
My act together on this and figure out
what I was going to do.
I'm not gonna get into it all before
the interview or I don't wanna take away
from that. But Stay tuned, please. After the
interview, and I will give you the full
low down.
If nothing else, go to FDSD dot me
slash book surge, all 1 word. I changed
the name from book blitz. I thought blitz
sound a little bit like carpet bombing. Maybe.
So anyway, I went with book surge.
Fd s dot me slash book surge, where...
Or, of course, you'll find the link of
the show notes for the full details. But
I'm fully planning to do this for 1
week. So
if you wanna help out with that, and
I hope you do,
you definitely need check that out right away.
Alright. So let me preface the interview with
with Irene a little bit.
They used to work at Google in the
privacy department at Google.
And so I had to asked them a
lot of questions that. In this interview is
almost like a 2 interviews in 1.
The first part of this interview, we talk
a lot about what it's like to work
in the privacy department at Google.
Irene was there for 5 years in the
upper echelon of the privacy department and got
to see firsthand
what really goes on there, and I had
to ask,
I had ask about that. And it turns
out that there was a lot of turmoil
in that area of the company at the
time, a lot of strife with the employees
and upper management, which
affected Irene ability to actually properly
advocate for Google's users. In other words, probably
you. And Are eventually found that
they believed to be more effective that they
had to leave Google,
which is what they did. And then the
second part of the interview, we actually talk
about
privacy enhancing technologies or or Pet.
There's some really interesting technology out there where
a researcher basically trying to find ways to
process
a lot of potentially very personal data
in a way that doesn't violate
the privacy of the people
whose data that is. And that may seem
like an oxy moron. But there actually are
some interesting ways to do this. And Irene
and I discuss
several of these promising technologies and kinda where
they are now and where they might have
some use. I will also say that since
we had our interview,
Google's privacy chief
left, I don't know if they were fired,
but after 13 years with Google,
some of which time must have,
overlap I think with irene, has left in,
according to Google will not be replaced.
So
I don't know what to read into that,
but it it doesn't sound like it's a
good thing. So again, I've got some information
for you about the book surge that I'm
doing. I really love to get your help
on that. Stay tuned after the interview for
important information about that, but let's not waste
more time. Let's get to my interview with
Irene nap.
Our aim is an ex Google information privacy
x Burton now in the profit world and
an activist around topics including trans rights and
mental health welcome Irene. Thank you so much.
I'm glad to be here. Oh, I cannot
wait for this. So I bash Google pretty
much on the reg and you know, over
privacy in particular. And so I'm really interested
to talk to somebody who's actually work there
in the privacy space no.
So this this is going gonna be great.
But ironically, even though that you're from Google
and I'd bash. Them I'm I'm hoping today,
we can actually talk about perhaps ways that
we can use data in a positive way.
So a little bit of a little twist
on that. Why don't we start by you
telling us a little bit more about
Internet safety labs and the kind of work
you guys do there?
Sure. So we believe, you know, I...
In my career at Google, I felt that
I was holding the company. Accountable from inside.
I felt that that was what I was
doing was making things better for everybody,
But I no longer believe that change can
come solely from inside the system. I believe
there needs to be
external,
independent
oversight, and I believe that independent safety testing
is necessary. And we say safety, not privacy
because privacy is the company's framing. Right? They
want us to view this as an exciting
new thing. And I'm here to tell you
actually safety
is a boring thing that we should all
be routinely demanding.
Every
child's toy
you know, if you buy a toy teddy
bear, somebody has made sure that it's fire
proof material. Mh. There is nothing like that
for software. Nothing what.
Yeah. Except these like... Yeah. And and and
there needs to be. We need to live
in a world, you know, it it should
be clear to the... And to the public
these days that software can harm people.
And,
you know, we need the same mechanisms that
we have in every other area of society
to the companies want us to believe it's
a big ass, but it's not. Well, I
just read that point recently on a podcast
right where we've got liability
for every other industry I can think of.
You can't ship an unsafe car or unsafe
food or unsafe drugs or unsafe toys and
yet, for some reason, software has gotten away
with this terms of use where they say,
you know, use as is at your own
risk and how that ever came to, you
know, I why that's still the case? I
don't know. I think a lot of the
white has got traction has been, you know,
ideology that people perhaps accepted with
less critical of a critical mind, then they
should have, people including me in my past.
You know, I I want to stay on
partisan in here so I won't
you know, go into depth on that. But
I think that there's this tech ethos that
we all kind of bought into, like, Yeah.
We will make the world better through technology
whether you like it or not. But society
is a stakeholder if you're seeking to change
society. Right? Yeah.
Yeah. And and, you know, I think early
on, it was you know, kinda like the
the old Facebook, thing, you know, move fast
and break things, and I think they were
like, hands off at tool, you know, this
too Nascent. This is too early. You gonna
s this amazing thing that we're creating here,
You know, it hands off for a little
while, and I think we just never got
hands back on.
I tell my team at work moves slow
and be careful. I tell them do not
listen to Facebook. They are wrong.
Yes.
Alright. So let's get into this. How did
you come to work at Google? You know,
and then tell us, what was your experience
there and, you know, why did you ultimately
leave?
Yeah. So I had what is kind of
a traditional life path, but a pretty traditional
tech path in that I'm self educated
and I moved to the company that I
saw as the 1 doing the most interesting
work to truly advance the state of the
art.
Because I believe that I still believe in
making a better world by building things,
and I believed in the company's stated ideals
at the time I thought they did too.
What... If you don't mind asking, what what
what kind of time were are we talking
about here? I was there for 5 years.
What, like, when did you spend how long
it ago did you start? Oh, yeah. I'm
sorry. I I was there.
I joined in, wow. It's been so long
that I need to properly remember this. I
joined in 20 14.
Okay. I left in 20 19
through a sequence of events bound up with
what had become a labor movement at that
point.
So you got in there with ideals? What
did you find when you got in there
and what was it that ultimately lip caused
you leave? Well, at at first, I felt
I found a lot of people who seem
to share my ideals,
You know, I'm transgender right, and we are
disproportionately represented in the tech industry. More so
than any other industry, partly because many of
us screw up online, you know, for people
in my age. The Internet was the first
place we could be ourselves yeah without fear
of persecution. And so many of us became
very technically knowledgeable, and actually, many of us
specifically went into information privacy.
Which makes sense when you hear it, but
right. Right.
So, you know, I found a lot of,
like, minded people, some of whom I still
very much admire.
And, you know, who I kind of learned
my own activism skills from, like, I had
had events in my life, which had led
me down this path of feeling that we
should not passively
accept the world we are given. We should
seek to make it better.
But it was what... It was during those
first 2
years that I was at Google that that
really jailed for me. And at first, the
company seemed to welcome this criticism.
It had a culture of appearing to welcome
bottom up grassroots
leadership. Mh. And people I knew had made
change of various sorts through that sort of
bottom up
before, and they were always told,
this is good. The company welcomes this.
Bottom I I still believe that many of
us, you know, we did bring important perspective
to the privacy
conversations. And I'm sure we'll talk more later.
About the corporate narrative there and why I
don't recommend accepting it un critically. But I
believe that marginalized experiences are necessary part of
that because we're thinking
of dangers that other people aren't because of
our moved experience. It's it's a job qualification.
And not just to ourselves, but to other
marginalized groups who we talked to on the
regular and, you know, you know, I felt
rewarded for my privacy
work there. I have come to understand
that, like,
upper management, and that by that, I mean,
like,
Vpn level and above
views privacy as,
you know, it's revenue negative, but it's intended
to be, but they view it
through a much more cynical lens than what
the people I directly reported through,
led us to believe and
some of those people, I believe that they
believed it and some of them. I believe
they lied to my face.
And that's been quite a thing to unpack
over the years.
So did you find... I I don't really
honestly follow the other... When Larry Sergey we're
were kinda descending. III don't really follow it.
So was there Did you notice these changes
were kind of tied to upper management changes
or does it... Was it a company shift?
Or It was. Okay.
It it was, around the time of the
Alphabet restructuring was when things really started to
go south.
Now I have... It's not just that, like,
Sun is a different style of leader than
Larry and Sergey were.
He is. He's... You know, his background is
from the Kin, the consulting firm
which I don't think Highly of either the
kind of
very bleak
bureaucratic worldview that it em amaze or the
decisions that he made
and how he seemed to be a total
non entity from the from my perspective. And
remember, I had more visibility
up the Org chart than most people did
because privacy work is horizontal.
Meaning it touches everything the company does
necessarily.
So it was my job to know all
the company's damn secrets.
So what is the privacy organization like? Like,
how what what what is that structure like
within a company like Google that's... Who who's
an ad company. Right? Yeah. So 1 thing
to keep in mind, the reason these companies
have privacy teams is not out goodness of
their hearts. It's because they have at various
times in their history been sued by the
Ftc,
and in that consent decree resulting from that
lawsuit because they effectively lost.
They were required by law to hire a
privacy expert, And they chose, of course, to
hire more than 1 privacy expert.
Because they don't wish to be seen as
doing the bare minimum.
But, you know, they never actually moved back
and told the Ftc much later
when I was doing a bit of worker
shareholder On my, I was actually...
I briefly spoke to,
somebody from the New York State attorney general's
office who who informed me that as far
as they knew they thought they might get
Google the hire 1 privacy person. And as
far as they knew that must have happened,
but they never heard back.
Right. Mh. So they thought perhaps that 1
person was me.
Right?
Quite a thing.
Yeah.
Alright. So,
yeah know, what are some of the key
priorities or or principles guiding Google's approach to
privacy during
know, your time there, that you saw? And
maybe how did that evolve over the years?
And then, you know, we've touched us a
little bit, but how did that comp port
with your your
expectations?
Yeah.
At first, I saw the company willing to
take a real financial hit for what a
appeared to be, you know, moral reasons, and
I was happy about that. I no longer
really believe that the moral reasons were the
primary ones, and I can't talk about the
tales of this. I... This is something I
practiced over the years knowing what I can
and cannot say.
At first, I was relatively happy with that,
as time passed, I came to see that
they were
accepting pushback only to the 4... Only to
the extent that it didn't
challenged the stuff they had already decided to
do
effectively or that they had decided they needed
or that they had decided they felt entitled
too.
I also came to understand, and I told
my teammates this, but even as somebody who
knows it and is trying to correct for
it. It's hard. We're all biased,
when we're within an incentive structure like that
to view
management
dictates as laws as of nature. They are
not. They are things that humans decided.
But especially if it comes down from a
way up the chain as just a yes
or a no.
And you have no context on why it
was a yes or no. You start thinking
or what can we do within that constraint.
Right? And you start justifying it to yourself.
You start thinking
They must have had good reason for that.
The what the thing that really changed my
mind was a, like, highly politicized and reported
on thing. Is it okay to get into
that year?
Sure if you'd like? Yeah. Sure. It was
the James D incident.
And this was a this was a person,
by the way, I'm on it I'm a
autistic non binary person. This was a... This
was an autistic man from what I know.
I believe that was is how you would
self describe, but I don't
who
used his neuro divergence as an excuse to
write this
political piece expressing the view that women should
not work at Google.
And
so a bunch of us were quite upset
by this. Sure. And we looked into it
and what we found was that this document
appeared to have been written
to tow a very specific legal line.
Like,
things that get lit
that form test cases were always constructed. You
know, I know this speaks become an activist
in other context.
You never happen on those fact patterns by
accident unless you sort through thousands of people
who've all done something like this. It's always
like a plane who
went out of their way to create a
good test case by not having extraneous facts.
And and this document
appeared according to people we talked to who
I can't name to have been constructed to
be a test case for a legal principle,
which they appear to be going for the
argument
that saying that women shouldn't work at Google
is protected labor
organization.
Okay.
And we were deeply upset by this, and
it prompted us to read up on what
our labor rights are,
which we had never done before. In all
this
activism up to now, we had been perceiving
it as something welcomed to buy the company,
you know, which I no longer think it
really was. I think they had a variety
of strategies to make us
feel that way while diff confusing any real
change by making promises that will never be
followed up on
by finding
exactly what they can get away with by
breaking every moral decision down into a million
fine grained choices
so that you moves your concept of right
and wrong. It's
lost in the paperwork. So we we learned
that we actually had a right to talk
about politics as long as we did so
within the context,
of how we're working conditions. And certainly,
if somebody is saying that I should not
be working here, that is a working condition
that it's a hostile work environment.
And and so we we read up on
our rights and we realized that more broadly,
we actually even had a right to talk
to the press about our working conditions.
And that Google had, you know, through a
variety of internal policies designed to mislead without
saying any prohibit anything that they're not legally
allowed to prohibit.
They had met us to the belief that
it's very dangerous to talk to press. And
actually, I think press
or your ally as long as you know,
as long as you know who you're talking
to,
when when you have a situation like this.
And so when we began pushing in ways
that went outside the system and that we're
in danger of creating
real change.
Suddenly,
management was very hostile even to small reasonable
suggest.
Right?
Like, again, these are our legal rights. Yeah.
But they know more... And it's my job
as a privacy person or it was my
job as a privacy person. To identify things
about the products that could hurt people and
to make sure that they don't. Right? Right?
Suddenly, the company started its stonewall a some
stuff.
And sub diverting even some of its own
procedures
for certain sorts of decisions.
So it became clear over time that the
company had a very effective internal mess
strategy for def using this kind of criticism
and making us all kind of blame each
other for not raising concerns in the right
way or what have you
and that they had been doing this from
the very start anytime we tried to raise
anything
really big that really challenged their power,
especially, you know, the interest of marginalized communities,
both inside and outside the company,
very frequently do wind up at odds with
the profit interest. Oh, sure. Yeah. Yeah. And,
you know, so having studied our labor rights,
we had... And it was an all consuming
couple of years, which I will spare you
but suffice to say it became clear that
with the skill set I had acquired in
talking about all this, I could advance the
cause better from outside the company where I'm
more liberty able everybody to say critical things,
than I could from inside. And therefore, I
pursued a kind of
I I diverted the company's hostile attention toward
myself so that other people wouldn't take the
brunt of it and so that we could
test the limits and know where they were
so that people could make conscious decisions about
when to go over those lines.
And that, you know, IIII started going down
that path consciously about a year before I
separated from the company.
Oh, that sounds terrible. I'm sorry. You had
to go through all that. Oh, no. No.
I'm very proud of it. This is a
part of my life that I look back
on.
You know, I am horrified
at
everything the company
does and did, but I am very proud
of this, and
you know,
yeah.
Okay. Let me ask you this question. I'm
not sure how much perspective you've got in
this. But what is your sense for
how Google compares to some of the other
ad driven companies like Facebook or Twitter. And
some of these other companies that have these
quote unquote free services that
we are the product. How do you think
they they all compare? Who's who's the worst
day to collection you collect collects the most
stuff? I don't know. What... Do you have
a dev take on that? A hot take?
Oh,
well, yes.
If you would ask me why I was
working there, I would have said that, of
course, Google is the best because they have
all these privacy people. Right? I don't know
that I believe that. On the other hand,
the competition is bragging about their mel fe.
So Google kind of tries to play, like,
we're the good ones to regulators. And in
my role, I was occasionally the 1 responding
to regulatory inquiries by the way, through a
lawyer. Like I didn't get my name on
it, pleasure. Google tries to, like, control the
narrative by being, like, we do all this
privacy research. We have this groundbreaking math.
Right?
We're the good ones, you can trust us
to lead the way, but it's kinda tell
Dungeons and Dragons joke that play with your
audience. It's Are you kidding? It's called firewalls
don't up dragons? I thought it might be.
I thought it might be. So there's an
old joke, right? The party of adventurers is
in the woods, and they're attacked by a
dragon.
And and the party members are running from
the dragon. And somebody says,
what are you doing? You can't get away
from the dragon and and and the other
party members says, I don't have to run
fast than the drink. And I only have
to run faster than you. Right.
Right. It's... And that's what Google is doing
here. They're trying to look better than Facebook.
It's a very mobile. It's a very mobile.
Right.
And the trouble should not accept it. Right.
Right. Right.
Well, okay. So I wanna talk about, I
wanna talk about privacy and enhancing technologies today
and and maybe why how we please. You
could use some this data for the for
good enough for Evil. But and I use
that term specifically in relation to Google since
they used to be the ones who carried
that banner, But... Okay. So I don't know
how far this goes back and if this
is something you actually saw why you were
there, but
they have this thing they're calling privacy sandbox.
And they have... The the death of the
third party cookie, that bell has been
wrong many times or many years. They can't...
They just push it back again. But Google's
Had copy. They make the money off of
this. And so,
I guess, maybe, I don't know if it
was Gdpr the push of this or if
they just the writing on the wall or
maybe because every other browser is automatically blocking
third party cookies or maybe all the above.
But they have come up with. This these
technologies that they claim
is much more privacy preserving. And honestly, on
paper,
it kinda looks better
So I'm I'm curious. What did you see
around privacy sandbox in this topic Api, which
was flock before that or flock before that.
What what's your take on this
technology. And at least in theory, could this
be more privacy preserving than the behavioral tracking
stuff that we do now?
So I was involved in early strategy discussions
around what became privacy sandbox.
At the time I left Google, I had
material criticisms systems of it which I could
not share with the public. Fortunately, everything from
that time is now public information, and I
can talk about it. I haven't spoken out
about because actually Apple's privacy people jumped on
that and said everything I would have said
anyway.
Good on them. Right? They're playing this Vr
game also. They want to be sure. They
want to run faster than Google. Right. Right.
Right. Right. But at least when these, you
know, large scale power structures conflict with each
other, sometimes the public benefits,
Right. So my perspective is,
look.
As a member of a marginalized group.
I am a recent immigrant from the United
States to Canada
because the United States is becoming increasingly hostile
to trans people.
And I don't wish to be on the
receiving end of whatever happens there. Mh. And
I I have the wherewithal
to do that. Very few people do. Right.
Nowhere in the world will be far enough
if America really goes down the dark path,
but
So it's more question of where you stand
in fight, but
we are facing a potential reality where within
5 years, it could be a crime to
be trans in the United States,
which, you know, again, look, I'm old enough
that, like, when I was born, I could
have been institutional for being trans. Right? The
queer community has been here before, and we
will, you know, we will survive it again
this time. We will anything necessary to survive,
but
so I'm not saying like, poor us. But
I am saying, like, it's important that these
online platforms
treat
the demographics of their users with appropriate seriousness
and not leak that information everywhere. And it's
not just queer stuff. You know, They could
they could leak racial information. They could leak
religious information. They they could leak all sorts
of things that people would be subject to
discrimination if 4. Right. Right. And it's really
important that they not do that. And the
problem with the privacy sandbox
thing is right
you know, these technologies have changed over the
years, but I believe it's still fundamentally based
on this idea that it does client side
computation to classify users into about 10000 buckets,
possibly more possibly less, the number may be
debatable. The number I'm sure it'll change. And
I'm sure the company is would be happy
to change the number because they're like, oh,
we did the math, and this is better
now. We addressed your concern. But the point
is
it's enough. Right? Like,
all these marginalized groups are, like, several percentage
points of society
are from this background.
And so any reasonable number that's useful for
advertising purposes
is also going to be useful for identifying
marginalized groups.
And because it's a black box machine learning
system, you can't even know.
Did it do that. It probably did. It
probably
discovered
that people who buy rainbow sneakers are
more likely
to, you know, also by other products. Right?
Right. They probably discovered that proxy for this
because it's told to do that. It's told
maximize profit and it would be illegal to
use some of these categories
for targeted advertising,
especially I believe employment status.
For targeted advertising, if you knew that's that's
what it's doing. But because it's an una
unacceptable machine learning system it wander that bias.
Right. And that's... And I And I think
that's where a lot of this... A lot
of people
missed the boat on this is is that
a lot of these things. And I think
because I think even if when I remember
reading about topic Api. Like, they specifically, I
think said that they were not going to
allow or whatever.
Categories that would be, you know, the sexuality
and and and and religion and then we're
gonna kick those up, But you're right in
that. If you've got enough data, you could
find proxy
information that could get you right back to
a lot of that same stuff. It's it's
like location information. If you have 3 locations
spots for somebody, you could pretty much tell
who they are because you know, where they
are from 9 to 5 Monday to Friday
is probably where they work, where they are
every night is probably where they live and
where they go on Sunday is where they
worship, and if that that'll nail down a
lot of people just with those 3 data
points. Right?
Yeah.
Identify people or even though none of that
it had identifying information, and there's just a
lot correlation that we've done, especially now in
the age of Ai
with, you know, machine learning models. So, you
know, we're getting really good at finding patterns.
And so, yeah. I I I'd I certainly
understand that that is a a limitation and
I... How this data, even though it doesn't
directly
capture some of these more sensitive bits of
information. Can... You could still derive it. Right?
Exactly. And we should be assuming because the
model is given data that definitely contains this,
and it's given a goal.
That depends on this, and it is complicated
enough to find these patterns. We know that
the technology is good at finding patterns.
That is 1 of the few things that
it really does robust at this point. Right.
And that's why it's useful for making money.
And we should be assuming that it is
probably finding
these demographic categories
in the absence of a mechanism to prevent
it from doing that, and I am not
aware of any such mechanism.
Okay. Let let's see if we could do
a complete 1 80
Yeah. On data collection. Let's see if we
can somehow find this silver lining and all
this. So
Alright. So we we are surrounded
by smart devices that collect a crap ton
of highly personal information, either from built in
sensors, which we may or may not be
aware of or just by asking us foot
for us, like the know, signing up for
apps or signing up for accounts. A lot
of times they I ask us for all
sorts of information that we give up because
either we think we need to or because
they they require us to. And, you know,
we in the privacy space talk endlessly about
how revealing this information can be and and
how this could be used against us. So...
But is there some way
that we could process all this data or
some subset of this data privately so that
we could do good things with the 2.
You know, how might our rampant
data collection actually benefits society. And I will
say it as an engineer as a Devops
engineer in particular, at Cisco. We had devices
all over the planet, and we use data
to find out how they're doing it and
actually, we... 1 of my models was is
I wanna find problems before our customers do.
Because I have that capability with all this
you know, tele and telemetry and analytics and
things that are coming in. So I, you
know, for me, I was for a. And
of course, it's not quite the same privacy
things when we're selling things to the companies
it's a different ballgame game. But that is
an instance for me As certainly an engineer.
I understand how I'd want a lot of
data. And I could do some good things
for that data.
So can we... What what are some string
ways where we might be able to
do some good with all this massive amounts
of data that we're collecting.
Yeah. So you raise an interesting example with
a networking data. And I do believe that's
important although though it verge on, like,
the thing where I think we need to
be very careful as data that's about speech.
Right, because we're in an age of increasing
censorship, and I would view, like network traffic
as something to be very cautious about because
even the metadata who's talking to who is
highly sensitive.
Right?
By the way, I have the greatest respect
for the people who do large scale networking
working. That seems like incredibly difficult work due
to the many
organizations involved.
Certainly, you know, it's the same promise that
science has always offered if we understand our
world if we understand ourselves, we have the
power to make change. Right?
It's fundamentally.
I think
there there's a lot of
there's a lot of ways it can do
good. We saw this interest example early in
the Covid pandemic
with
actually a number of my friends were involved
in designing this
specification that was going to collect contact tracing
data. Yeah. Google App actually worked together a
little bit on that. Didn't think. They did.
They did. It was a, you know, a
number of people
who share my background and and skill set
effectively,
really got together and worked hard,
to design this protocol because they saw the
danger that if they don't do this, governments
are going to do this, and the thing
that governments are going to do,
as much as I love that governments can
hold corporations accountable,
they are also large power structures, which are
perhaps a little bit full of themselves sometimes
and assume that they can do no wrong
when they actually can hurt people
even just through collecting data because it's data
about every movement people make. So they designed
a protocol, which is kind of double blind,
which neither you
nor the server nor anybody you meet
knows that you have done that
until this kind of mathematical operation happens,
which combines all this data, and which only
succeeds
when all the parts are there
which means that you were in the same
place at the same time as somebody else.
And then the 2 of you are notified
that you were in the same place at
the same time,
so you can be like, hey, I had
Covid. Sorry. You have Covid.
Nice idea that peep that people care about
each other enough to prevent them from getting
deadly
illnesses.
Right.
Right. I thought I would have liked to
live in that world.
Yeah. That was a fascinating aid case study,
and I the fact that the Google Apple
worked together on that. I thought was actually
kind of, I don't know, heartwarming it away.
It was. It was inspiring and I want
to emphasize it was it was upper management
took P our credit for it, but this
was the hard work of the the individual
contributors
who... The people who are fighting for what
they believe to be right.
And who see moral dangers here that they
wish to steer the ship away from. They
dropped everything
and worked on this. They pulled everybody in.
Was this driven by the engineers and the
and the the employees as opposed to management
where did this come from? Well, I was
outside at that time. I was doing some
self searching in the period but when I
left Google and when I joined the nonprofit
world. So I don't know who initiated the
effort, but I can say there is no
way it could possibly have happened
without the engineers viewing it as a moral
duty.
Well, there's some other interesting things I've heard.
You know, what would people talk about,
all of our cell phones, for example, have
acc in them. And they Somebody was talking
about, what if we used everybody's cell phone
to get us tremors,
you know, small tremors that with... If you
had a million of these devices in an
area, you could maybe locate an impending earthquake,
or they were doing... You mentioned Covid. I
know that they were doing wastewater sampling at
the ways the water treatment plants they could
kinda see at a bulk level and a
what kind of viral load was in the
community and a lot of times predict when
they were gonna be outbreaks.
Drug.
Yeah. Yeah all... Yeah. Drug interactions are a
great 1 because that's a very data centric
because
most patients who have a complex medical situation
are dozens of medications.
And so it's very hard to dis
what caused to this interaction. You know there
was an interaction, but you don't know which
pair of medications caused it. And so, yes.
Aggregated data
could do a great job there, But at
the same time,
the mist of medications that somebody is on
is probably unique to them. Mh. And so
what you do about that. I think it's
a complicated question. I actually
I believe that health care privacy is an
area where the law needs
further advancement. Everybody,
I like to say the p and Hipaa
stands for portability not privacy. Which it does
by the way. Yes. It sure does.
People incorrectly assume that because there's a law
about this and because medical providers do take
law seriously
that the law must say the things they
wanted to say that our modern expectations and
fears about how this could be misused
are actually legally binding. They're not. I I
would like to break with the fact that
the, we... You know, we say that there's
a right to privacy and shrine to the
constitution the word privacy does not appear once
in the constitution or other the bill rights.
That is correct. Now I am not a
lawyer
like to bring up the rhetoric point that
Ro Wade was decided as a privacy argument.
Yeah. It is nobody's business what is happening
to your body. And I think that's
still morally the correct argument.
The word privacy often gets used as, like,
a catch all term for. I have some
reason not to tell you this, and it's
none of your business what that reason is.
I don't have to justify to it to
you.
Right Yeah. And I I love the students
quota. This. And I I bring in a
public too often. But, you, you know, you
quoted say I think this is not kind
a Reddit Ama where you said, arguing that
you don't care about right to privacy because
you have nothing to hide, is no different
than saying you don't care about free speech
because you have nothing to say. It's a
right. The whole point with rights is you
don't have to fight for them. They just
are. You you don't have to justify them.
You have them.
And and I... And that's different than a
lot of other area of law.
And I will say as somebody in my
professional opinion of somebody who spent every day
for 5 years,
identifying the ways that that that that software
can hurt people
everybody has something worth hiding. It's just most
don't know what it is until too late.
Yes.
Alright. So given that we care about privacy,
and let's talk about some of these privacy
preserving technologies.
There are actually several efforts underway. To do
this, which is really kinda really cool. And
I and I wanna make sure that people
are aware of these, because I don't think
it gets enough attention.
1 of them is call... And their call,
again, we're recalling them privacy enhanced technologies. It's
actually the term of art. It it's a
Pet or a pet. The pet sounds weird.
It's a Pet.
And 1 of the ones is called differential
privacy.
Let's start with that 1 Can you maybe
explain what that is in in simple terms?
And then, know, how does it work to
balance
the utility of all this data while still
preserving our privacy.
So that's a really interesting 1.
Differential privacy is for situations where you are
publishing some data, think like the Census records
or something,
but you want to protect the people who
are in the dataset set. So you want
to say
there are, like, 10000 people living in this
in this suburb
but you don't want anybody to be able
to identify who a specific person is.
And that is challenging
because there are sophisticated attacks these days
which can take. You'd think that, like, rounding
it off the nearest thousand is safe, but
it's not.
You can compare different versions of the same
dataset set, and you can
identify individuals track their movements across time Or
cross correlate with a similar set of data?
Or Cross Car weight with a similar set
of data exactly.
And so differential privacy gives you a mathematical
guarantee about
the extent of such attacks. You can never
prevent all such attacks. The only way to
do that is did not release the data,
but differential privacy kind of blur the data.
It adds noise to it in a very
calculated
way. It's a very
specific
type of noise that follows, I believe a
logistic pattern,
such that
these attackers can never gain
more than a certain amount of information that
you choose in advance and that you call
by the mathematical constant Epsilon. You choose your
privacy,
Epsilon that you're willing to lose this much
privacy,
and then you red your data
before publishing it.
They actually did this with a... Sorry. Go
ahead.
I was what are the examples I've often
heard quoted it explains this is like, okay.
Let's got to these 10 pounds of records
with 10000 people, and you've got let's say
you've got all their ages.
And so age is something that kinda narrows
it down pretty quickly. Right? We live between,
you know, 0 and 90 years old ish,
statistically,
you know, and if I knew what specific
age you were on this specific year that
might, you know, dial me in. But let's
say, I go through all 10000 records and
I fuzz
just a little bit. Everybody's age. Like, you
know, my age is reported as this is
not my age. My age report is 35.
But I'm gonna... I'm gonna say Carrie was
37 and Irene,
and I know this is is probably not
outrage. They are 25, and,
no. We're gonna say they're 20 they're they're
23. So they're both off by 2. But
if you took the average of everybody's ages,
you could still get the average age of
everybody in that 10000 thing and use that
average ages you know, for your data, but
any individual record was wrong. And therefore been
been holidays. I've quite flattered by that.
IIII
have not been in my twenties for long.
Long time.
No. No. Yeah. That's exactly right. It's a
very well shows an example that you just
adjusted a couple of years,
and that makes it harder to do that,
like,
cross
correlation. You can't eliminate this record when you're
cross car
because it could be this person or it
could be that person.
And therefore, you can't narrow down on other
people because you couldn't that 1. Right? And
so you only have to add a small
amount of noise usually.
Is there a particular place we've talked about
a census? And that is actually where I've
heard this particular technology
referred to a lot. So to not being
able to identify individual records within sets data,
But where else might this be handy? Where
else where else might this particular... It we're
where differential privacy be a good technology to
use where we to allow us to process
data and get some good, you know, statistical
data... Information on data without,
identifying individual people.
You raised the earthquakes you Scenario and I
do think that's a very useful 1.
Now location is a
very sensitive thing.
In a sense your location almost is your
identity. Right?
There was only 1 person who was where
you are at this time of day. There's
only 1 person who goes back and forth
from your home to your workplace every day.
Right. So it's difficult to make that private,
but know, but that's a mathematical parameter that
you can decide how much you're willing to
lose and
put that into the system, and it's very
likely that you could still get something
useful for, like, early warnings of earthquakes out
of it. Now I say they're very likely,
but I have not done the earthquake math
here. Right? I'm not a geo. Right. Right
Right. But from my background, it seems like
it should be possible.
You know, health care, like,
again, tracking, not just not epidemics, but tracking
emerging
outbreaks
right
is a scenario where could be very useful
because it can let you know, hey, there's
a cluster in this region. Maybe,
you know, look for any big events that
possibly didn't have adequate hygiene precautions,
something like that. And it's just a starting
point for the epidemiologist to do the work.
That until recently I would have talked up
at great length, how much work they do
to protect us.
Yeah.
So... Yeah. So it seems like what... Where
this particular technology really comes into play as
a situations where we can glean a lot
of important information from aggregate data and statistics
about the aggregate data where we don't... Where
we wanna protect the individual privacy of of
the all each record of data, but we
still might need access to those records. I
don't know. Move do follow up or something.
So different privacy works is, like, a a
set of data where you wanna do statistics
around that set of data. The differential privacy
is a prop... Is is a transformation you
make to an entire dataset set. Alright. It's
it's not suitable for situations where you might
look at individual records later
unless you applied in much more sophisticated ways.
That plan from the start for the fact
that you're going to be digging into details
later, and how many details you might dig
into. You have to set that down on
yourself
before you start, and you have to take
into account every
inquiry that will be made over the life
of the system. So it's much more fraught
and difficult to use it in that kind
of,
you're going to dig into this data case
by case
scenario.
I would think that researchers is doing that.
Or are not well served by differential privacy
and should be instead doing more to protect
the way the data is used
and who has access to it and things
of that nature. Which you should always do
anyway, but they should be more restrictive about
it. And so the next technology I wanted
to bring up, maybe addresses that issue, and
and it's 1 that's really bizarre. Almost sounds
too good to be true.
It's called homo warfare encryption. My understanding is
this basically allows you to do
computations on encrypted data
without first decrypt that data. This sounds like
something where I might be able to do
a process on, let's say, data from someone's
medical record without actually being able to see
what's in that record. But
this... I admit. This is something nice lot
less sure about. So what... Explain those what
this is.
It's a nice thought.
Now I want to preface this by saying
I am not a crypto
expert. I know more even than I think
most programmers about crypto photography, but I am
not a crypto
expert. However, I have worked with people who
are.
My impression
is that it is a long way before
homo morph encryption can deliver on those promises.
So it's a nice thought. Right? Like, we
don't have to trust the device. We we
can run them somebody else's computer. Like, we
could run then Google's computer and Google won't
see what we do.
That is not the reality of that technology
today. What happens
with most of these approaches is that
it kind of depends on what you mean
by
computation. First off. Right? Like, you can never
do, like, word processing this way. Right. Because
that has too many
control points in it, It's making too many
decisions. If you're putting it through a simple
mathematical
transformation, if you are a credit card processor.
And you want to
compare your data with a different credit card
processor,
but neither of you trust each other for
business reasons.
Because these companies are all terrified of each
other.
They they are.
Then then that's a scenario where some fancy
encryption technologies,
which might be described as partial morph, so
that's not how I would put it. Because
the term homo morph has been sensational,
and I prefer to avoid it. I would
have said something like comm crypto systems or
something
comp or private set intersection to refer to
the end goal that you're trying to achieve
there as the names of those technologies, even
though it's technically a homo,
when I say that people start
dabbling about blockchain.
Oh, blockchain.
It's been supplied by Ai in the news
at least for the most part. We don't
hear about it quite so much, but about
1 of my favorite
engineering flow chart diagrams was You know, you
you you ask a question. You go to
the choice point and you got 2 exits
at yes or no? And the question is,
do you need home... Do you you need
blockchain and and both both of them go
to know.
We I always I always love that chart
anyway, but you. III agree with that. At
any anyway.
Alright. So what about the other 1? There's
some other very interesting privacy enhancing technologies out
there. Let's let's rattle off a few of
of some of the other more promising What
what are some other things that are being
done out there to try to
allow us to process data without necessarily given
away people's information, private information? Sure. So I
touched on the moment ago. There are these
interesting things secure multi part computation. Mh.
Is this neat technique where you combine data
from 2 separate sources
it's some fancy encryption that I don't think
it's a good idea to go into.
I understand I understand this. This is 1
of those few topics where I can hold
my own. But I don't think that your
readers want to hear this math. Yeah. Just
give just give us the D.
Yeah. The short version of it is
I have some information about myself.
You have some information about yourself. We want
to find out what what we have in
common.
Right?
We've agreed on some criteria where, like, if
you and I both have the same favorite
flavor of ice cream, then we want to
know about that. Otherwise, I'd prefer not to
know about your terrible taste and ice cream.
Right. Sounds a lot like a 0 knowledge
proof. Is it is it based on the
similar concept?
It it is an analogous concept and I
believe some mechanisms for 0 knowledge proofs
are along these lines. We can get into
that in a moment.
But secure multi party computation,
we both encrypt our stuff in this fancy
way,
and then we
have a neutral third party,
combine it in a way where, like, only
only the third party
can see whether anything was the same,
Something to that effect, or there are other
protocols
where we don't have a third party
and 1 of us is doing the combining,
but we still only see the thing
that agrees. Okay. Don't. And any of, you,
It doesn't require us to have a trusted
at third party. You can work that way,
but it doesn't have to work that way.
That's an option that can make the for
these protocols easier to design. There's a number
of ways to implement this
which all have different constraints, different types of
properties we can set. Okay. Anything else like,
if we'd we'd briefly touched on 0 dollars
proofs. So let's go back to that rick.
I've actually tried to describe this myself before,
and it's it's tricky, but
how does that play into this? What how
is that a Pet?
0 knowledge proofs are very interested technology. I
have yet to see an application of it
that really fires me up for, like, this
is using its potential well, but it's a
cool thought. Mean, like 2 billionaires figuring out
who has more money than the other. That's
that's the classic example. Right? Right. That is
terrible useful for, yeah.
Yeah. Exactly. But it's like, I want to
know,
like, if you can
can afford to show up to this fancy
party or whatever, but I don't want to
know anything
other than did somebody pay for this party.
I don't even wanna to know who you
are. Right? A 0 knowledge proof is an
argument that let's
you convince me that you belong here. 0II
do know of a good. Actually, cloudflare. They...
They're the ones who applied this very well
and while back. They have this thing where...
And I don't know whether Cloud fire deserve
the public trust or whether this particular
technology is even sufficiently rigorous.
But it's a cool idea. We have to
not let the fact that it's cool blind
us to as that's hard for me to
do, but I I feel you. Go ahead.
I I am very subject to that bias.
As well, but it's important. Like, but it
is really cool. Like, Cloudflare has this thing
where it's like,
you have to, like, do a cap
to, like, view a website. Right?
And you get a cookie, but they claim
that they can't identify who you are
even though they set a cookie with a
unique identifier. Right. It's weird. Right. And what
they've done is they've constructed this proof that,
like somebody solved this cap, but they've swapped
your data with, like, 30 other people and
they don't know which 1 is you.
Right?
Somebody did a approve.
1 of those people
is viewing this site now. Right? But I
don't know which 1.
We're cloud for just know which 1. Sounds
like a crypto coin mixer.
It... It's analogous.
And
it's difficult to talk about your knowledge pros
because they are a genuine useful technology,
which
as of so many other things, the the
cryptocurrency people took this existing terminology and decided
this belongs to us now. Right? Yeah. It's
very frustrating because these technologies do have real
potential which it's hard to get to,
while while there's this
multi level marketing scheme in the way.
Yeah. Right.
Okay. Alright. So as we wrap up, looking
at some of these Pet, which which of
these actually do you feel have the most
chance of
of succeeding, You know, which 1 has the
best chance at widespread adoption and really helping
us. And then and then what's gonna drive
that adoption is what's gonna
bringing these things actually happen because the these
things slow things down and make things more
less convenient. These are all ivory tower things
Is anybody actually going to adopt these?
Well, many of them are adopted, and it's
because these companies are afraid of regulators,
and so they try to do proactive things.
The problem is the proactive things they do
were constantly broken and don't work, or they
have a carve out where we didn't cover
this corner case. You know, as programs we
have these things corner cases where it's like,
oh, you... You're this type of person, but
you're also that type of person at the
same time. I didn't know that was possible.
But it turns out there's a million people
a day. Who fall into that category,
and we didn't protect those people's privacy. Right?
Oops.
And so what to make it real. It
needs not just be something that companies talk
about, it needs to be something that they're
held accountable for.
And for that, we need regulatory scrutiny.
I firmly believe that we need regulatory scrutiny
because regulators
are independent
and they can. It's very similar to the
aviation model where we have this worldwide system
of, you know,
the Faa had and the Nt b have
in house
technical expertise and investigative authority. Perhaps not as
much as they should have, I've heard from
aviation people that they do like it to
be better.
But in in computers, we have none of
that, and we should be aspiring to have
even that. Right?
The companies should have to explain this to
experts, they should have to show how it
works. They should have to go into detail
on it. They should have to earn that
public trust.
Without outside truly independent scrutiny by people whose
paychecks don't come from the same organization
that cannot happen.
And it's not for lack of moral will
on the part of the privacy workers. It's
for, you know, it's your job. They'll fire
you if you push too hard.
Yeah. And and, you know, and III
I'd I make this argument been a lot
about regulation. A lot of people as soon
as you say the word regulation, you lose
half the audience, but I I'd there are
reasons for regulations. And and as you point
out, there are reasons why I don't have
to personally inspect my plane before I get
out and fly. There are reasons why
I don't have to poison test my food
before I eat it. There are reasons why
I don't have to do drug tests before
I take a drug. Someone's done that for
me, and that... And they did that because
they were required to do so by some
loss somewhere.
And that's that's regulation. I don't think everybody
in the world appreciates how often,
you know,
restaurants actually do cause food poisoning, but it
gets caught very early because of these regulations,
and so hardly anybody is affected. The problem
gets fixed.
And so it's very... You can't see something
that doesn't happen, so you don't see a
million cases of food poisoning because we prevented
them.
Right? But if you look at, like,
local news reports, or you look at any,
like, public records on this topic. It's very
clear that these are widespread problems.
The Fda inspect food before it goes on
sale in the stores.
They catch a lot of problems and a
lot of products get taken off the shelves
before people get sick.
Right?
And
the company made the case to us as
workers and at 1 time 9 life I
believed it, that they should be subject only
to what they call self regulation, they should
be judged during execution are. Mh. And they
made the case because they believe that rapid
innovation is only possible in that light. But,
no. This is
this is a bluff game. The company
intentionally does not
educate the public or regulatory authorities on these
engineering details.
So that they can then go to the
press and claim
that any criticism is not informed by the
technical realities of the situation.
So that they can then say, like,
Well, these politicians made this fall without our
input. Yeah. Because you refused to give your
input.
Right? Like,
somebody has to they're playing chicken. You know,
I want to be in a world where
there is engagement where there is back and
forth where it's a public discussion
because
First off, these things are very detailed centric.
We can't get to good outcomes by accident
or by hoping. Hope is not a strategy
as my former and player love to say,
you know, the public is a stakeholder in
these discussions and we need to understand and
care
about the details to of all this, and
we need to, you know, make sure that
the rules that we put in place are
rules that serve the public interest that actually
address the concerns we care about and don't
just en ent bad practices.
I'm not optimistic for the state of it
in the United States. I don't see the
political will here, but
Europe is moving in a helpful direction. I
was part of Gdpr
implementation. It was the only time
that I really saw what the company could
do when it was highly motivated.
Right? Why aren't it why aren't they doing
that all the time?
Right. Well, you know, I I don't wanna
be an ap a capital deposit. But I
I think a lot of this is these
companies are,
their shareholders demand return. And when they see
money on the table, they said, you gotta
pick that up. Mean, and that money in
this case is monetizing your data because there's
nothing saying they camps. So it's perfectly legal
for them to do so and the shareholders
like, well, you... Would you make more money
if you did that, They're lot Yeah. Well
then do that.
So, you know, I think I I I'd
be very interested to know what level of
some of the executive of these companies would
be happy to have regulations, so they wouldn't
have to bow to shareholders demands to do
this. I think they're at least some out
there. Maybe I'm a wide eyed.
I think there are at least some people
out there, like, please regulators this. Please because
I don't wanna do this anymore, but my
shareholders demand, and there's nothing saying I can't
so I will.
I don't know. I think that if that
is true, it's true in the company's whose
primary income is from something other than advertising.
Again, I had pretty good visibility upper management
because I was... Got very good at reading
the Tea leaves and knowing who was saying
what and so on. And because I talked
to people throughout the company
and got I
believe that executives want to believe that they
are good people,
and I also believe that when you have
billions of dollars,
you believe that being a good person is
something you can buy.
It's it's just distort.
Anyone who has that level of power to
you know, frankly spin up entire little organizations
to sell a narrative on their behalf anytime
they choose
just on the drop of a hat,
gets used to using it and starts to
believe that they deserve it. And,
you know, I don't want to, like,
dismantle
I I don't want to take an unnecessarily
ideological position here. I'm trying to make a
practical argument
that, like,
it almost doesn't matter what's in executive hearts
at the end of the day, although,
it... Because it matters what they do.
And they will do the right thing when
they are incentivized to do the right thing.
When we have some actual ground rules. Right?
And then perhaps none of us will have
to move too closely at what... What works
in the hearts of man?
Alright. So before we go, why don't you
tell us... What it was next for you
and what and in internet safety labs? What
are guys up to?
Yeah. You know, we are a tiny nonprofit.
We can always use funding as I'm sure
every non nonprofit Mh. Says constantly. It's my
job to say that. I'm trying to
Noticed I noticed.
But, we are a tiny nonprofit with I
think a really solid team. We're building out,
like, testing
methodologies so we can look at this software
and say, does it do these things to
what extent does it do these things? Who's
better and who's worse? And
in what ways are they better or worse?
We want to
inform, like, maybe if you're...
We have a focus right now in educational
technology because that's been an area with a
lot of very obvious problems at a very
vulnerable
population.
If you're, like, the person who decides for,
like, a school district, what what apps to
we use,
you can look at our research and we
will tell you which apps are better or
worse. That is all public
information free on our website for anybody.
We also hope that over time regulators will
pay attention because they're the ones who have
the power to take in here. Right? Technology
companies have the power to take action, but
in our experience, they don't want to hear
it, which makes sense. We're telling them about
some additional money that they're gonna spend to
fix a problem. They'd rather not spend it.
Right? It's cheaper not to.
So regulators are the ones who have the
ability to take action. And I think there's
a lot of, like, work to be done
over the next few years to, like,
bridge the knowledge from industry
to everywhere
where actual policy decisions are made and where
we can do informed
Nuance
protections that,
you know, protect innovation while
moving forward with protecting society as well. Right?
Alright. Well, good luck with that. We need
it.
So
I... I very much hope you succeed for
all for all of our sakes. Thanks so
much for coming out of the, Irene.
My pleasure. Thank you for covering these topics.
They're so important.
It was really great talking with Irene.
They had some very interesting perspectives,
and it was just so interesting to talk
to somebody who's actually been in the belly
of the beast who has has worked for
Google, a company that I
bash on a lot at least in terms
of privacy.
I mean, I I will say it and
I've said multiple times. They make some really
great products. Some of their, you know, tools
and apps and whatever are
best in class.
Google Docs is wonderful, but the privacy aspects
just ruin everything as far as I'm concerned.
So I was really glad to have the
opportunity to talk to somebody
who has fence a dime on the inside
about what things are like at Google and
how they work there. And doing a little
bit of research trying to find some links
for the show. I did run across an
article that,
Irene posted on medium.
When they left Google,
kind of as a plea to
their former employees about not giving up on
privacy and how Irene was not giving up
on privacy.
And how
frankly,
employees, tech employees working for these big tech
companies
have power. Have say, can
band together to push back from the inside
on some of these privacy invasive projects
and they have done so. Some of these
were government projects with, like, facial recognition,
and things like that, where they have been
successful. I'm sure there's cases where they haven't
as well. But if you are,
a tech employee,
and you are seeing your company, do some
things that you think are not right, You
do have some power to make change within
your company. I know it could be tough.
You might need to band together with some
of your other employees,
but you can make a difference.
Advocate for privacy where you can, push back
on, you know, privacy invasive technologies and over
collection of data,
and maybe take some of these privacy enhancing
technologies that we've been talking about and suggest
that to your employers that you try to
incorporate those into your products where you can,
for the benefit of all of us. So
as usual, there would be some bonus Q
and a with my guest,
for the patrons on the bonus podcast on
Thursday,
We talk a little bit more about what
it was like to work inside the privacy
department of Google. We talk about data mini
randomization. We talk about how to properly a,
modern hard drive, including
Ssds, which are kinda tricky you were erase
properly. So Patrons you will get that on
Thursday as usual.
Okay. Now it's time to talk about the
book surge. So again, you can get all
the details just by going to fd DSD
dot me slash book search or find the
link in the show notes, but here's kinda
of what's going on.
If you have a notice, I I really
don't like marketing. I'm not I'm not good
at it, and that probably says a lot
about, you know, where my book in this
podcast are at this point. I, they're doing
fine. But I mean, I always feel like
if I was better at self promotion,
that I would be
reaching more people. And I don't wanna be
famous. I don't wanna be rich. But I
do wanna help people. I'd wanna reach as
many people as I possibly can
because
Again, we can kinda build this herd immunity
of the more people that take these basic
privacy and security measures, being pick the low
hanging fruit. The better off we will all
be.
Because your privacy and security overlap mine.
You know, it's a we thing not a
methane thing as I often like to say.
And so,
If I believe that, and I do, wholeheartedly.
I want people to read my book, and
I want people to send the podcast and
the newsletter and all that sort of stuff.
So I... I kinda got inspired and I'm
trying to force myself out of my comfort
zone a little bit more
and and try to do some promotion. And
honestly, what I really need, which I also
don't often do is ask for help, specifically,
your help, my audience.
I want to crowds some of this stuff
where I can. And so, I thought of
a few different things, and the first 1
I'm going to try.
Is what I'm calling a book surge.
So on Amazon, there's, you know, millions probably
literally millions of books on Amazon and to
try to get notice that Amazon is really
hard to do.
So unless you come up in Amazon search
results
or unless you somehow pop up somewhere else
on Amazon, it's part of some top secret
algorithm that places your book on a web
page
within Amazon where they would see it. And
so while their algorithms are completely top secret
and proprietary,
you know, most people agree that to rise
to the top of search results
or to get featured somewhere on the website,
it would depend on things like how many
books you've sold? How many people are have
looked at your book, what the ratings are
for your book, How many ratings you have
for your book, And in particular,
every book on Amazon gets assigned to 3
categories
where if you look at the webpage page
may have just scrolled past this. But if
you look at any book on Amazon and
scroll down a little bit, it'll have the
overall ranking of how a book is selling
within all possible books. But right below that,
there's 3 categories.
And these are sometimes negotiated with the author
or the publisher.
It's it's actually quite the opaque process. Let
me tell you.
But there's these 3 categories. And they give
you a ranking for where you currently are
within that hour, I think. I think it's
an hourly updated thing.
Where you are selling within that category. And
then varies quite a bit. I mean, if
there's a rush on book sales, you know,
then not, you know, in your book doesn't
it sell anymore than normal, then it's gonna
fall down because A whole bunch of other
books are selling more. Or if it's a
really slow day. And for some reason,
your book has a few more people buying
it than normal, that might pop you up
a little bit. So it really varies quite
a bit. But that is 1 way that
people would see the book because if they're
clicking on a book category if they're just
kinda, I'll show me show me books in
the computer privacy area.
Then there's a list, and there's a ranked
list. And so what you really wanna be
is you wanna be on that first page
of results. And by the way, this is
just drives me. That's 1 of 1 of
the categories I'm in,
I was looking at. And, like, of the
top 10 books.
3 of the books
were all basically titled the same thing and
we're the same kind of book and there
it was wtf
is my password.
And so their their password journals. There places
for people to write passwords down. 3 of
the top 10 books,
anyway, it it is what it is.
If you wanna get seen, another way to
get noticed is to be in those, you
know, on the top search results in the
first page, usually of
any of those kind of book category lists.
So what can you help me? Okay. So
for the next week, here are some things
that you can do to help me
get more notice on Amazon to to raise
up in these rankings to to to hopefully
prime their algorithms to
get seen more more people. So first of
all, I would like to try to get
in the top 10 of what of the
3 categories that my book has been assigned
to. If you go to the article, you
can...
It'll take you to those 3 categories and
show you
what the current top listings are in those
categories.
And I think the main way to get
there honestly is this straight up book sales.
Some of these other things I'm gonna talk
about. I'm sure feed into this as well,
but this is where I've been saying. If
you were thinking about buying my book for
yourself, for someone else,
maybe
for a Christmas present, you can start your
Christmas shopping early. Maybe you wanna donate it
to your library or something like that. If
you if you were thinking about buying a
copy of my book for any reason,
do it this week. So between Monday, July
eighth and Sunday, July fourteenth.
You know, I'm trying to get this kinda
concentrated
so that this is all happening at 1
time, and hopefully focuses
the effect. Also, I really really need book
reviews.
Amazon really likes those book reviews to come
from people who are verified purchasers of that
book. So if you have purchased the book
on Amazon, I would very much appreciate if
you could leave a 5 star review. You
don't have to put any text with that
review, just putting the star review will be
very, very helpful, but a little text goes
a long way. Just a sentence or 2
would be great. This is the fifth edition
of my book and unfortunately, Amazon doesn't let
me carry forward the reviews from previous additions.
So all those great reviews I've gotten in
previous additions in my book are all gone.
That's a clean slate when I do a
new edition.
Despite the fact that I've sold hundreds of
these books on Amazon,
I've only got 27 reviews. Now I would
have like to get feedback. If there's something
you don't like about the book, There will
be a next edition.
But if you if you don't feel comfortable
giving it a 5 star review, then just
send me an email. I would I would
very much like to get feedback, set it
to feedback at firewalls don't dragons dot com.
But if you like the book, I would
love for you to put a 5 star
review on Amazon.
The other thing I wanna do is I
wanna get my book ranking up. Right now,
it's 4.4 stars out of 5. I would
really love to get that up to about
the 4.8 range.
And since there are so few reviews, wouldn't
take too many 5 star reviews to get
it up there. So if that would... That
that shouldn't be too hard to do if
we can get some more reviews. And there's
2 more things you could do that you
might not be thinking about. First of all,
if you've spent some time on Amazon, and
you've looked at a book. You've probably noticed
or actually probably any product. But if you
look at the book, right underneath that book,
they will often recommend 2 or 3 other
books under a heading and says, people also
bought this
And so
if you already have my book, 1 of
the best ways to get other people to
see in my book.
Is to go into 1 of the 3
categories. And again, you could find them on
my website or just go to Amazon. You'll
see in there in that little area I
just told you about.
Go buy 1 of the other top 10
books
in 1 of those other 3 categories.
When you buy both books
that increases the odds that someone else looking
at 1 of those other books. We'll see
my book. In my book honestly is really
not like other books, so I'm not really
in competition with the with these other books.
So really it helps both of us at
that point. If you see 1, you see
the other. So that's great. And the other
thing you can do, and I'm not sure
how much this factors into Amazon's algorithms.
But I have seen places on Amazon where
it lists, you know, like most wished for
books.
So a very simple thing you can do
is just add my book whether you've that
are not. Add my book to your Amazon
wish list. And you can do it on
private list wish list, It doesn't have to
be public. But just adding my book to
a wish list, I think will also
Feed into some of Amazon's cryptic algorithms
to hopefully get it some more attention. So
a couple more thoughts before we go. First
of all, I
I really want this to be honest
and sincere and as organic as it can
be. With me asking you to do this.
Please, you know, don't spam a bunch of
people about this, You know, don't just write
review if you've never read the book, be
honest and, you know, keep the right spirit
in mind. I I do not wanna try
to hack the algorithm
or do any weird search engine optimization.
Stuff that's not for real. I want this
to be real. Also as maybe a little
incentive, to say thank you to recognize people
that help me with this, I've got a
couple more things I'm gonna try, but over
the next, you know, couple weeks or months.
But basically, when this kind of campaign those
over.
I'm gonna look back and say,
who really contributed? Who helped me do this?
Who made it impact,
and that'll be a completely subjective thing on
my part, but I'm am going to gather
together those people, and put together a Zoom
call where we could talk to me live.
I'll do... I'll talk to you about the
book a little bit. We'll do a little,
maybe a Q and a a little, maybe
an Ama session and ask me anything session.
And just gotta hang off a little bit
and, you know, give me a chance to
say live and in person. Thank you. I
may also give away some swag or something,
you know, we'll see. But I do wanna
make sure that I, you know, say thank
you for helping me out with this. I'm
still working on some details, but I'm open
to ideas. And so all I guess I
ask is is you know, as you're doing
whatever it is you're doing, you know, keep
a record of it somehow, maybe save your
email, take a screenshot, something like that, and
just hold onto it for now.
When the time comes, I'll just ask for
people who want to be involved in this
to, you know, send me a note that,
here's here's what I did to help, and
I will invite as many of these views
as I can. To this Zoom party.
And I'll say thank you there. So that's
all I'm say about that. Thank you for
listening to Rush
go to fd DSD dot me slash book
surge for the full details. And again, you've
got 1 week to do this. But if
you miss that,
stay tuned. I've got a couple other things
I might be doing in the next weeks
and months.
So it's not your last chance. And by
the way, everything that I've mentioned today
help me no matter when you do it.
I'm just trying to focus it all this
week, in particular to try to bounce up
in those rankings.
So there you go. Thank you so much
for tuning in. Will Take care of everybody
stay safe out there. We'll have a new
show next week. And until then, don't get
caught with your driver's step.