Simplify for Success - Conversation with Heidi Saas
Heidi Saas was on #SimplifyForSuccess, a podcast series presented by Meru Data and hosted by Priya Keshav.
Heidi spoke about the Metaverse and the challenges around data and privacy in the Metaverse. She also discussed the privacy and safety issues arising within the Metaverse. Music Courtesy of Fesliyan Studios.
*Views and opinions expressed by guests do not necessarily reflect the view of Meru Data.*
Transcript:
Priya Keshav:
Hello everyone, welcome to our podcast around simplifying for success. Simplification requires discipline and clarity of thought. This is not often easy in today's rapid paced work environment. We've invited a few colleagues in data and information governance space to share their strategies and approaches for simplification.
Our guest today is Heidi Saas. Heidi is a former practice manager at a national consumer rights law firm. Today, she works primarily in data privacy and technology areas as an outside chief privacy officer and as counsel for startup founders and small business owners. And we'll be talking about a very interesting topic, metaverse and privacy in the metaverse. But before we get started, few disclaimers: the information covered does not and is not intended to constitute legal advice. All views expressed are those of individuals in their individual capacity and not of the firm they represent.
Hi Heidi, it's really nice to talk to you.
Heidi Saas:
Hyperia, thanks for having me on.
Priya Keshav:
Yeah, welcome to the show and today we're going to be talking about a really interesting topic- Metaverseand privacy in the metaverse. Most of our audience probably already know what a metaverse is, but it would probably be nice to talk about what is metaverse. We hear Mark Zuckerberg talk about it, Satya Nadella talk about it, but what is it really?
Heidi Saas:
I think that might encapsulate part of the problem is that you're hearing Big Tech define what the metaverse is and I disagree with that premise, because I believe the metaverse is the Internet for the rest of us. So white people came in and built the Internet One to produce content and then Big Tech came in and started monopolizing all of our data. And they've made so much money and there's so little room for the real creators to get involved. And there, the discriminatory practices that we have everywhere else in our society are also very evident in the Internet industry as well, and so web3 is an idea. The metaverse is the idea that we're going to build a place for the rest of us, for everyone, It's based on inclusion. It's based on people who know how to build tools and connect each other and create content and want to share that with each other, but they don't necessarily want to be tracked and surveilled all the time.
Some people in fact want to use these services so that they can remain anonymous, so that they can enjoy the engagement that they're having with other people and maintain some sort of distance from their real life There are a couple of challenges that are presented in Metaverse. It's not truly decentralized and it won't be for a while and we can talk about what some of the other challenges are, but I think Teddy Pagava gave a great Ted talk and explanation about why the metaverse is so important. Because I think that really is a chance now that we have innovation, we understand how it works and we have people of color represented in developers, ethicists, lawyers, all of the key parts of building the Metaverse. And so they're moving forward to build a new space that wasn't designed based on capitalism. It's designed for the free exchange of ideas, so that's where I'm at on the metaverse. I'd be interested to hear your take on it.
Priya Keshav:
Sure, you brought up a lot of topics so maybe we can kind of parse through one by one right. Yes, obviously you see Facebook rebranding as Meta and they are investing heavily in the Metaverse and the Metaverse as they see it is going to be a place where you can have a digital identity and you would have an alternate universe where you can go create, buy, sell goods, right? So it's maybe taking the video games and sort of making that part of your normal life and creating an alternate world where maybe more e-commerce is possible. You brought up Web 3.0 and obviously Web 3.0 is another. topic that we should probably introduce as well, so we are currently in Web 2.0, correct? And then Web 3.0 is supposed to be more blockchain based and decentralized, where instead of the data being stored as it is today with all the technology Companies, it's going to be stored in a decentralized fashion, so which means we keep our data as opposed to Google, Apple and Facebook and others who control the Internet storing our data, correct?
Heidi Saas:
Yeah, that's the idea, but we technologically can't get there yet.
Priya Keshav:
Yes, we need our infrastructure to change. And Web 2.0 took about 10 years, so who knows how long that will take for us to get there in terms of web 3.0 so, but ideally you want Web 3.0 and Metaverse to play nicely with each other where we are able to sort of create a Metaversethat is decentralized as opposed to the centralized version of Metaverse that you are seeing today with the Facebooks of the world.
Heidi Saas:
Yeah, I think it comes down to data ownership. So the Metaverse and web 3 idea is that you own the data and you grant access to whoever you need to grant access to your data, but they don't get a copy, they get access. So you have the data ownership rights, the way Facebook sees it is they're collecting all your data and they have all your data. And they do what they want with your data and you just need to trust them with that. So that makes business sense, it absolutely does, but theoretically, it doesn't make sense with the mission behind the why of the metaverse. Now, our devices aren't ready for this. That's one of the reasons why we just can't jump in transition quickly because our devices were built to stream data back and forth from the cloud. And until our devices are able to handle all of our own data and granting access to others, and that's where we store our data instead of in a cloud or with a trusted
intermediary. We have to change the way we build our devices and the infrastructure around those devices because we're going to be using the Internet differently from the way that it was currently built.
So the foundation here, I think, is privacy. And if people are building technologies with privacy in mind, then they're going to get a much better chance of building a better product because trust is key into moving into the metaverse. I just wrote an article about this, it's coming out soon in a fashion tech magazine, but the basic idea is privacy and trust should be part of your brand messaging as you move Into the metaverse. Because you're creating new digital assets and those digital assets are having a hard time in the media today because everybody likes to point out the failures. But I think people are forgetting that technological innovation requires failure. You get to see what doesn't work and then fix it and then keep moving forward or abandon it and find a new idea, but failure is a required part of the process. It's how we learn so once we get some foundational rights in privacy, hopefully soon here in the US, then we'll be able to move forward and tell people you don't have a choice in how you build these tools anymore, you have to operate this way. So it is better for people to get more aligned with a strong privacy program now before they try to enter the Metaverse and build new experiential spaces that includes children, biometric data. There's so many landmines in this new area that if you go into it without the proper advice and guidance, then catastrophic losses are possible.
Priya Keshav:
I totally agree. In the ideal version of the Metaverse, it can be more privacy-preserving, but let's talk about the current version of the metaverse as it stands today or as it's being built today. Obviously, there are some versions of the Metaverse that is already in existence within the gaming industry, like the Second Life, Fortnite and Sandbox, and obviously with Facebook. investing billions of dollars in this space, we're going to see a lot of new innovations with respect to Metaverse. But as it's built today, the way we are looking at privacy, there are a lot of privacy issues that can come from the Metaverse that would be a lot more problematic than the privacy issues we see in our current environment. Am I right?
Heidi Saas:
Oh absolutely, oh yeah, all of the societal ills that we have here, they're definitely going to show up and generally leading the pack when it comes to new technologies, pornography and gaming. So, and they're definitely leading the pack there, so will be pointing you to the side here, we'll talk about gaming because I think there are some worthwhile technologies involved in gaming. You brought up Fortnite, and that's built on the Unreal Engine, now that is a promising bit of technology that people need to pay more attention to. As far as Facebook is concerned, I listened to a keynote speech from the general counsel at Meta when she was speaking at Stanford Codex 10th annual whatever and she went on and on, talking about how important privacy was to them and that one of the key things she said was that interoperability was going to be a part of what they were building and that was surprising to me because they can't just build castles in the metaverse. You’ve got to have interoperability because if people are owning their own data, you've got to have that just to make it work in a technological sense. But it was important from a standpoint for them to accept the fact that they are going to have to work with others. Now, what disappointed me about her talk was that she acknowledged that there are issues in Horizon Worlds and sexual harassment, and unsupervised children, sexual predators. And she said that they are giving themselves a 10-year timeline to get things worked out on privacy. And I almost fell out of my chair. 10 years to figure out privacy, I can tell you how to fix that right now, so I don't have a lot of faith in how they're going about building this if they put privacy on a 10-year timeline. And they're building the product now. It's privacy and as well as adding privacy is not an add –on, it is by design so that's where Facebook or Meta is on Horizon Worlds.
Priya Keshav:
So let's talk about some of those things right? You brought up interoperability, so why is it important? Because we are talking about buying clothes, wearing clothes, buying a car, maybe buying real estate, whatever it is, in the virtual world, and living a completely different life in the virtual world, and so if we are doing that, we should be able to take it from one platform to another without it being disruptive because that's logical. But today as it stands, it's not possible. But it's nice that Facebook is thinking about interoperability because that would be possible if interoperability was possible, right? But coming back to privacy itself, you brought up some issues, right? So part of it is as if you are adopting a digital identity,, I saw a New York Times article about bullying and sexual harassment and some hate speech, all kinds of issues are rampant in the Metaverse and in virtual reality games because it's much easier to. First of all, it's not trackable, and it's very difficult for anybody to do anything about it and plus as a person who has a digital identity, you probably feel like you could, I don't know, somehow, do things that you wouldn't normally do in because there is no policing. Maybe that's what it is in the normal world. But we are already seeing that happen today in terms of there is a lot of violation, but it's just something that is very difficult to track and there is no policing and there is no repercussions for such actions, correct?
Heidi Saas:
Yeah, absolutely. I mean, it's an unregulated area and so people see opportunities so they're going to go and capitalize on that unregulated area, and that's just normal behavior. The societal ills that we have out walking around still exist, bullying and sexual harassment, all of those things exist in the real world. There's no reason to imagine that they wouldn't exist or even be enabled further by anonymity, empowering some to speak out where standing face to face, they may not have the courage. So yeah, the societal ills that we have in the physical world translate over to the digital world. That's why content moderation is so important, so it's got algorithms to go through that to try to find out what's going on and that is content moderation for our own benefit. Now, who decides what's fair? Who decides what's free speech? Who decides what is allowed? That needs to be a collection of voices representing as broad a section of our society as possible so that we can come to something that is more fair on content moderation, but it is necessary and it will be necessary in the Metaverse as well.
Priya Keshav:
So, coming back to privacy and the collection of data, right? The VR headsets can collect a lot more information about us than just, let's say, the mouse clicks that you see.
Heidi Saas:
Wildly here, Oh my gosh, they can identify you by your eye-tracking movements.
Priya Keshav:
Yeah, and they can know your emotional state, they can look at a lot of physiological responses, right? So, it knows me more intimately than when I browse the Internet because right now all they can see is what I click, but now they start understanding your body movements and be able to track them pretty
much, which is actually a lot more intrusive than what we have today and what we have today is fairly intrusive in itself so. But you talked about designing the metaverse with privacy in mind, you brought up some great things, right? Thinking about children, protecting children’s rights, looking at biometrics, but what should a compliance strategy, or even if it's not, it should be actually more than compliance, not just a compliance strategy. So how do you kind of approach privacy by design in a metaverse or when you are trying to enter the metaverse?
Heidi Saas:
When I'm working on a project like this, I want to bring together the team first because the team building is the largest part of it because they need to have the company mission in mind, but they also need to have the skills to bring about your goals, so the people on the team I refer to as a think stack. Because they're thinkers and I need different kinds of thinkers on the team. I need data scientists, I need ethicists working on the AI right? I need other people, any proxy professionals, right? Not just the proxy lawyers, I need people with blockchain developing tools. The cybersecurity concerns are different than web 2 and so I need all of these people lined up because those are all of my areas of exposure. So in mitigating risks, which is what lawyers tend to do, I want to set up the right team before we start building the project and then privacy by design is making sure you listen to all the people that are on that team so that you can accomplish the goals of transparency, accountability, basically privacy by design is a FIPP in a more faster-streamlined fashion. It's nothing new, it's just the basics, but I think it changes when you're asking a room full of CPOs, what they think, or if you're asking a room full of data scientists what they think. You're going to get different answers from all of them, so it's important to have the right team together before you embark on building one of these projects so that you can get as many perspectives before you start the build. So 'cause, I've run into projects where they've gotten the build underway and they've had to go back and redo things because they finally had enough money in the budget to bring in one of these key players like a data scientist or someone ML engineer or something and then once that individual arrived, they said, oh no we can't do it this way if this is your goal. We should have built it this way and they had to rebuild and then move forward. That's an expensive mistake to make, and I understand how they get into that situation. So that's why I'm trying to get the message out to people as soon as I can. But if you are going to build in this space, please make sure you have the right people on your team to help you build it. Those people may not be the same people that you used for your web 2 strategy. Those people don't understand Web 3 the right way, so I think that's how you get privacy by design, by making sure you have the right people on the team to help you build the design.
Priya Keshav:
Yeah, I think the points you raised in terms of it's very complex? Anonymity can be an issue when you're looking at crime in the Metaverse , but tracking everything can also be an issue when you're looking at privacy violations in the metaverse. So being able to kind of make the right kind of choices right so where you have to make sure that people are protected from bullying and other kinds of issues that can happen with the anonymity that the metaverse brings. But at the same time, you don't want to be tracking everything because more tracking just means that a lot of privacy issues. And I was just reading an article about how Metaverse is one big deep fake. So with the Metaverse more and more looking like the real world, now you can't say which is real and what is fake, and so the only way to distinguish between the virtual world, which is the real world might become biometric. So it's important that the
biometrics is even more protected as you kind of think about deep fake. So it's just a very complex issue and finding the right balance is going to take a lot of skill sets.
Heidi Saas:
Yeah, the good news is there are great tools out there. One of my favorite privacy-enhancing technologies is tokenization. So if you are going to collect some data like that, you need to tokenize that data so that if there is a breach that data does not get exfiltrated and your insurance company will be glad to help you In that situation, if you are employing that kind of privacy-enhancing technology. The problem is that's kind of expensive, so you've got to look at the risk-benefit analysis here and I would recommend that it's safer because biometric data can't be changed by the individual. It's hard to calculate the damages and economic loss if someone's biometric data is stolen and used. These are new issues that we're confronting and I would recommend that people don't even get into that situation if you don't have to collect biometric data, then you shouldn't. If you are going to collect biometric data, you need to use white-glove treatment on that, similar to children’s data, you've got to do everything you can to protect that data.
And you've got to remember that blockchain is different. Watching transactions are immutable, please don't put personal information on the blockchain. So small, little things like that before people go rushing into this area. It gives cause for concern because we do need to advance privacy rights and not just because it's the right thing to do, but because our personal safety is at risk now. So, when it comes to anonymity, I want to remind people that in cryptography, cryptocurrency, and blockchain, you may think you are anonymous, but technology has caught up to you.
So recently the FBI and the IRS got together with Chainalysis, a blockchain technology company, to do forensic reviews of a website that was exploiting children all over the world, and they were able if just one website visit without using the Tor browser, they were able to identify the perpetrators and then go and issue warrants and arrest people all over the world because these people were transacting in crypto and they were on the dark web and they thought that it was anonymous, and that's just not true. So as the dark side of the Internet grows in their capabilities, so does the capability of the good guys. So anonymity is not as possible as people think, so I think if society starts to understand that it may curb some of that behavior that people think they're getting away with because the more people we catch in show that you're not getting away with it, the more people understand that you're not anonymous online.
Priya Keshav:
So overall, are you positive that Metaverse is coming, or are you cautiously optimistic? Or are you pessimistic?
Heidi Saas:
I'm all in. It's coming, it's definitely coming. It's going to be a bunch of flops, we've already seen a couple of luxury brands go in there trying to sell $10,000 dresses that are Jpegs and like that kind of a flop. But also from a data standpoint, 'cause those things that's like a petaflops worth of data just to design a dress. It's ridiculous. Platforms are like “no, thank you”. So, it's coming, it's going to stumble forward. It is going to be driven somewhat by the big tech companies because they have the money to do this, but working with founders and people who are trying to get into this space in an organic kind of way, I see
so much happening, especially in specialized areas such as this one is for women that want to empower other women, or this organization is for black people who want to get into the cannabis industry. Or these sorts of specialized safe places for people to gather and do what the metaverse was intended to do without being tracked and surveilled by the big platforms. So I see founders and VCs that are working on social justice, especially. They're trying to invest in these ideas to try to bring forward the true metaverse as we believe it to be.
And on the other side of the field, so to speak, is big tech and all of the advancements that they're making. If you want to see where the strength lies in the future of these technologies, please watch the patent filings from these companies. Because they're filing patents, it takes a while, but they tell you what they're doing with their patent, how it works and what they intend to do with it, with their new technology. So they're giving us little nuggets of information about the future, but you've got to go to the USPTO to find that information out, so there's too much money been invested in future patents that are going to be utilizing glasses instead of the whole VR headset. They're working on technologies to reduce motion sickness for women 'cause they finally understand that women are not small men. We react differently in these environments. And they're working on better identification verifiers to work on the children’s issue as well 'cause kids know how to fake their birth date, that gate doesn't work. So, I see encouraging signs both in the investment from the big tech side, but also on a grassroots level from the true believers who are trying to do things in this space, for what it is intended and I have hope so I don't know, how about you?
Priya Keshav:
No, I agree I think it's going to come and it's going to be embraced, if not our generation, the next generation is going to think that it's just normal. Because I already see that with my kids, right? I see that they believe their virtual world is just as real as the real world.
Heidi Saas:
They want to go shopping in Roblox. My kids have never been in Roblox, but they've got FOMO from their classmates and they said I want to go shopping in Roblox.
Priya Keshav:
That makes sense, yeah, and I can't end this show without asking you this question so. What will your avatar be?
Heidi Saas:
Oh my avatar? I have a client who's building one for me right now, just as in Omashu. And she kind of looks like Jackie Brown from Shaft. With the yeah right with the big Afro and like a big powerful black woman, but they changed her skin to green so that I am an ally and not misappropriating because the rest of the NF collection is all strong black warriors and so they had to make a green one for me 'cause they are aware of my whiteness but they accept me. Anyway, so I'm interested to see what that avatar is going to turn out looking like. But I don't know I don't know that I need one for myself. Yeah, I how about you?
Priya Keshav:
Well, I have been thinking about it a bit, I created one last year as part of a virtual world that I was a part Of. But there weren't too many choices, so I don't know whether it represents me or it's just more of what I had to pick one from the choices. But I've always been intrigued about what would I want to be if I had the entire world to kind of design me completely differently. So it's just I can tell you, my kids would probably want to be dragons, so.
Heidi Saas:
Oh, now that's Awesome, see if we could do animals that would be cool.
Priya Keshav:
Well, it was really nice to speak to you I totally enjoyed this show and I'm hoping that our audience is just as well.
Heidi Saas:
Yeah, I love your show. Thanks for doing this show and thanks for having me.
