All these companies that are claiming to be so innovative cannot figure out how to market a product to
you unless they can spy on you all the time. That to me is like the opposite of innovation.
Our guest today is Melanie Enzen.
Melanie is here to help us cut through the marketing and legal speak that large companies and organizations
use and help us discern from the outside what might really be going on inside and how they view our data
and their responsibility to us as customers.
Melanie is the founder and CEO of Discernible, a consulting firm that helps security and privacy teams
learn how to communicate effectively with other parts of the company, including leadership, to increase
their influencing company policies and projects, as well as ensuring privacy and security aren't just afterthoughts.
She's also well known in the hacker community for her decade-long leadership of the press department for
DEF CON, the world's largest hacker convention.
Before Discernible, Melanie managed security, privacy, and engineering communications for major global
brands, including Facebook, Uber, and ATT. Without further ado, here's our interview with Melanie and Sung.
Melanie, thank you so much for taking the time to come and talk to our audience.
I'm really excited because uh in the privacy space, I think we deal with a lot more formal companies than
people realize. Uh I'm thinking like Proton, Signal, Red Hat.
But we've never interviewed someone who's so deeply entrenched in that world before.
And I think you have some really cool insight and perspective having been on that side of things.
So first question, having been on both sides of the company curtain, so to speak, what surprised you the
most about how companies talk about privacy internally versus what they tell consumers?
So if we back up like a little bit, I think it may be helpful to have some context about how I got into
privacy because I kind of I kind of got voluntold to take on privacy in in a role when I was working in Silicon Valley.
My initial kind of thinking about privacy was as a consumer, right?
As a consumer of various technologies and you know in the world.
And I had very strong opinions about my privacy and about privacy in general.
And then when I was, you know, assigned to take on the privacy communications role at one of these companies,
I realized that even just my definition of privacy was very different from the company's definition of privacy.
And I think one of the things to keep in mind for folks that are not on the inside of that curtain with
with these techies compan is that a lot of these companies see privacy as a function of compliance meaning
everybody inside the company who says that they work on privacy, they're not really privacy advocates,
even if they see themselves that way.
What they are actually advocating for is how do we enable the company to do what the company already wants
to be doing in a way that doesn't run afoul of any regulations or like legal limitations.
They're always trying to get away with as much as they possibly can.
I have a number of good friends who still work at those companies.
And again, they they see themselves as privacy advocates. I certainly did.
But the reality is, I think of a lot of these privacy teams as like tax attorneys.
Companies don't hire tax attorneys because they're trying to pay as many taxes as possible.
So, you know, we a lot of these tech companies that have huge, huge privacy teams, regardless of how the
individuals see themselves as privacy advocates or privacy professionals, they are working within the
constraints and kind of shared reality of the organization that you know this is what the company wants
to do and within those constraints can they think about privacy.
And so I don't know that I would say it was something that surprised me.
I think it was something that was deeply disappointing to realize that they weren't asking me to help
with privacy because they respected my my expertise or my ability to drive change.
You know, they they weren't really asking me to be a change agent, right?
Despite what they say in all the the job interviews.
Like there's some really smart, really wonderful people in these privacy teams. And they have been sold a bill of goods.
In terms of, you know, the company, company, these companies are very good at flattering you during the
interview process. They make you think that they deeply care about privacy.
And in all fairness, if that were true, they would already be doing it. Fair enough.
So on that note, well was there a moment or incident that made you realize that how we talk about security
and privacy is just as important as privacy and security itself?
Yeah, so working inside this company, so my I was on the corporate communications team with inside uh
in inside these companies so my I reported into like the PR and marketing folks but my my remit and what
I was responsible for was helping the security and privacy teams with their communication needs. Right.
And so I sat with the engineers and the GRC teams and the legal teams and you know the that whole cross-functional
kind of cohort that actually works on security and privacy initiatives.
I was part of that organization, part of that um kind of dotted line reporting i don't think that there
was just one specific moment but that this series of kind of death by a thousand cuts where i saw my very
smart very, capable, very empathetic and compassionate colleagues getting shut down time after time after
time with other engineering teams, HR teams, marketing teams, product teams, you know, when they would
try to advocate for you know something that was more respectful of individual privacy.
And what I realized was that a lot of these colleagues who otherwise were very capable were not good at
advocating for themselves or their projects.
And so you know again with I mentioned a couple minutes ago that, when companies see this as compliance,
they look at it as what's the bare minimum that we have to do so that we can move forward.
And I think every privacy professional inside these companies who goes along with that framing does a
huge disservice to themselves, to the function, and to the concept of privacy in general, because we're
allowing the company to define that pri privacy is about legal requirements rather than privacy is about
treating people with respect and not trying to exploit them.
From your experience, what's the single biggest misconception the average person has about their digital privacy today?
So there's gonna be two. I was thinking about this earlier today.
The first I is that they think that the I hear from a lot of people that toothpaste is out of the tube,
so to speak, right?
That there there really isn't a point in trying to claw things back because it's all been, you know, stolen,
sold or you know, leaked anyways. And the reality is is that data has a shelf life.
Data that was stolen, sold, leaked, whatever, five years ago, it doesn't have the same value that it does today.
It's one of the reasons why these companies are constantly sharing data with each other because the most
recent data is the data that's most valuable to them.
And so a lot of the data that may have been lost in the past is already in the graveyard nobody's fighting
over that so there still is a reason to you know want to protect your current data and your future data
because that is what's most valuable. And you know, we we have not completely lost this.
The only thing we can do to completely lose is to give up.
The second thing that I was thinking about is that I think even some of the companies who you might think
are the most privacy preserving, they're doing privacy because they have to, not because they want to.
There is this level of pressure, I think, that we have to keep on them externally, particularly in the
United States, where we don't have comprehensive privacy laws, right?
So it's not an accident that companies, because companies see privacy as a regulatory issue, they are
putting so much money into preventing regulation from being written and being passed. So those are the two things.
It's one, like don't don't give up.
There is still reason to fight and to try to do what you can and to learn about what these companies are
doing and how they're exploiting you. But then on the other hand, you just you have to check everything.
I know that you know some of the conversations that that we've had have been about marketing and various
other things and how do you actually really know what's true based on what these companies say.
But the truth is you just can't take their word for it. Can't.
Especially I like the first point because I've long ago I wrote a blog post about like why you should
care about privacy even after years of like not protecting your data.
And that was one of the things I pointed out, is like, yeah, you change, you grow.
Like, God willing, you're not the same person you were five years ago. Hopefully you've grown and that data's stale now.
So and the the technology changes and the world around us is changing, right?
There's a lot of people who used to not worry about their privacy, who are now worried about their privacy
because we have AI now. We didn't have that 10 years ago.
So, you know, as things change, it does actually change the calculus of what's at risk when it comes to
our privacy, right?
I think a lot of us are watching things happening in the world and are very concerned about who has access
to our data right now and what they could do with it.
So, you know, even if you yourself don't ever change, but I agree with you, I think most people do change.
But even if we never did, the world around us is always changing.
And that changes the value as well as the risk of any data about us.
You mentioned marketing and that does bring us to our next topic.
So all companies have to market and to oversimplify it, I know marketing is complicated, but basically
the point of marketing is you want to highlight the good things that the company does and kind of downplay
the shortcomings. But some companies really go too far. I'm thinking of like a lot of VPN ads on YouTube, for example.
So I think this is a debate I see a lot in the privacy community is how how can we tell when like a company's
gone too far versus like they're just marketing?
We should cut them some slack, even if it's not technically 100% accurate. Do you have any thoughts on that? Yeah.
So, and and I will say this as somebody who I've never been on the marketing team. I'm marketing adjacent.
So I'm kind of like the cousin to marketing, so to speak, from my past life, right?
So I have not done all the things that marketers do.
I'm just watching them do it because their desk is next to mine, right?
And I think first and foremost, in general, this is a very, very broad statement, but I think from consumers
to industry groups to policymakers, we give marketing way too much slack.
Most of the things that they think they need our data for, or at least that they say they need our data
for, are bullshit. I have this conversation with um like founders and startups all the time where they they get obsessed
with these like metrics that come from social media because social media platforms are one of the biggest
privacy offenders and they're like oh we need to be able to track this I'm like do retweets pay your bills?
Like this, why is this a number that we're tracking?
And why did we decide that it's worth exploiting people so that you can see how many times someone liked the post?
Right? And and to be fair, a lot of these analytics are possible without all of the invasive technologies.
You can't actually count how many people like your posts without tracking them across the internet.
But so I do think that the marketing function in general deserves a lot more scrutiny than they're getting.
I have testified for some state legislators who are working on privacy laws, and they often ask me specifically
about marketing because they're like, oh well if we if we can't collect this data or we can't sell this
data, then marketers will marketers don't need to be doing that.
They don't like that's a made-up metric that they gave you because they're addicted to this data.
And so they're trying to think of reasons to hold on to it because it it's less about the performance
of marketing the function and it's more about the performance of the marketer who has to put together
a presentation at some point with numbers on it and who is going to have an individual performance review
where they need to show lines going up and to the right.
I'm sorry, I would rather work on fixing that problem instead of just saying they get you know access
to whatever they think that they need.
And so from a marketing perspective, that first thing is, you know, just because a company says that they
need something for marketing, I don't think we should give it to them, you know.
To me, marketing is not a good enough reason for a lot of the abuse that we see.
Secondly, when a company uses privacy in their marketing. My spidey sense goes off for another number of reasons.
And these are the things that I'm like clocking as I'm reading through the materials. Is the product built for privacy?
Or does it look like they threw privacy at the end because they thought perhaps people would be concerned
about things that were up higher up on the list? Right?
Is it, for example, are you an advertising company and you've realized that you know it's a bit out of
vogue at the moment? And so now you have a bunch of language on your website about how you care about privacy.
In all fairness, if that were true, you probably would not have started an advertising company.
And so we do think that it's worth thinking about how close is the privacy to the core product of the
business versus is this just like you know a label that they've slapped on the website because they've
been getting questions about it, right? Well said.
So on that note, do you think that there's a a fundamental tension between a company's growth incentives
and consumer privacy?
Like could a for-profit company ever actually prioritize privacy or are those just fundamentally incompatible?
Yeah, I I I don't think that they are fundamentally incompatible.
I think where we run into the tension between the two is when you have a company that believes that growth
is worth hurting people over.
If you think it's worth exploiting people to grow or to make more money, that's not a privacy issue, that's
a character flaw, right?
And so, you know, we've had this debate and these kinds of discussions in other parts of consumer protection,
whether it's environmental issues.
You know, we're having big debates on this right now when it comes to data centers and the pollution and
the energy costs and you know the water usage and all of that.
Like the question is not should you be allowed to grow as a company, but it but at what cost, right?
And in all fairness, all these companies that are claiming to be so innovative cannot figure out how to
market a product to you unless they can spy on you all the time. That to me is like the opposite of innovation.
If you actually are the one controlling my checkbook, then you you didn't really sell me on anything, right?
So I don't think that tension has to exist.
And I think in other parts of consumer protection, we have successfully fought really hard for the companies
to either pay for the cost of those consequences or actually learn how to innovate so that those products
and services are safer, right?
We don't have seatbelts and airbags in our cars because the manufacturers prioritized safety.
We had to fight for that and force them to do it.
And so again, this is it it's another reason why I think it's so important that people don't give up on
this because we're the only ones that are actually going to be able to to force them to change.
I like the car example because I'm thinking in my head now too that I don't know what the regulations
are, but I know that now a lot of cars have like side airbags and under-the-wheel airbags and like it
it almost became I guess I'm not much of a car guy, so I could be wrong, but it seems to me like once
that enforcement came into place, it became like then it became a feature like, oh, our car is safe.
Yeah, well our car is safer and it just kind of built from there.
Wouldn't it be great if people didn't have to die before we decided that save products were important?
Like how how many people have to be hurt for us to decide that this is important? For sure.
Actually, on that note, my next question is: in the past, you've drawn parallels between the tobacco industry's
playbook and what's happening in tech, specifically around consent and safety.
So especially for maybe younger listeners who were not around when there was a smoking section in the
restaurant, can you explain that comparison and how they're similar?
Yeah, so I I I have to give give a shout-out to my friends over at uh Internet Safety Labs because they're
they initially introduced me to this comparison which I latched onto you almost uh instinctively because
there's a part of this comparison that rings true for me as a former public relations student.
Like I I have two degrees in this discipline.
Kind of the worst stuff that was happening from a marketing and advertising perspective with the tobacco
industry, the origin of a lot of that is an individual who's kind of considered the father of public relations.
So I have very strong feelings about what the function of public relations could and should be doing today.
But our origins, in all fairness, they're not without scandal.
And so this is particular individual was hired by the tobacco industry to help market cigarettes to women.
Like this is the person who's responsible for the campaign of like freedom torches.
Like, can you imagine convincing a whole bunch of women who because we were already being oppressed by
society, felt like we we we were so eager for independence and for autonomy that we were, you know, easily
persuaded, and I'll say easily just in general terms, but we became a persuadable population for something
that kills you, you know, that causes cancer.
And you know, one of the most widely used tactics of the tobacco industry, which a lot of these tech companies
are doing today, is that they actually do opposition research and try to discredit scientists and experts
who are saying this has a negative effect on our health.
And so then, you know, the tobacco industry, you know, would do their own research and be like, actually,
like like do you remember when we all thought that like wine could be good for you because it had antioxidants in it.
Like these are the types of things that the tobacco company was doing and was really trying to convince
people that there weren't any negative side effects.
Now, I think we could have a intelligent debate about whether or not products like tobacco should exist, right?
Do these companies have a right and should we give them the opportunity to sell these products that are harmful, right?
But in all fairness, vehicles are also harmful.
There's a lot of things that could cause harm, and this is why the this like rules and regulations are
so important because it helps minimize the potential negative effects of these various products, right?
And as a society, there have been times where we've decided, you know what, there is just not enough regulation
and enough like guardrails that we can put around this business model to make it safe, we're just not
allowing these types of businesses, right?
Human trafficking comes to mind as an obvious and extreme example of that, right?
There are types of businesses that we are saying this is just not allowed there's no way to make this
okay right and i think a lot of companies particularly data brokers right now are really fighting hard
to not get added to that list. But in all fairness, a lot of them are causing more harm than good.
So, you know, if the regulation does in fact put them out of business, well, maybe that was the point, right?
If you can't run a business that doesn't hurt people, we're not obligated to, you know, to concede that.
Not every business has a right to exist.
That's there's no constitutional right in the United States that businesses get to exist.
And so the tobacco industry was the PR campaigns and the marketing and just they didn't have the same
types of regulations that we have now in terms of how close you you can get to lying without getting a
call from the FTC?
So the tobacco company, I think, was able to do a lot more just blatant lying in their official communications
than what some of these companies can do now, right? They're very careful.
The words on their website, the words in their terms of service, these things are very carefully crafted now.
But it doesn't stop their executives and their spokespeople from, you know, misleading people.
And so I know a lot of people in the tech industry that are on, you know, the communications teams, the
marketing teams, the public policy teams, they think they're so smart that they have found ways to persuade
policymakers and customers and other like, oh weren't we so sneaky that we're getting away with this thing?
And I'm like, you didn't invent it.
It was invented by the guy who was trying to kill people a hundred years ago with cigarettes.
That's whose playbook you're using. My next question is about uh companies and communication with the public.
When there's a major data breach or a privacy scandal, what is the first thing that the internal team
usually gets wrong when they try to communicate with the re with the public? It's a good question.
I think the first thing that they get wrong is God, everyone's gonna hate me.
Starting with the lawyers and asking, what do we have? to say The lawyers need to be in the room 100%.
I am definitely not advocating for lawyers to be cut out because it is important for them to be there.
However, when you come from a place of what do we have to do, you are actually cutting yourself off from
all of the opportunities of how could we demonstrate that we're better than this? Right?
Everything you see coming from a company that looks like it was written by a lawyer was written by a lawyer.
And that's exactly how it reads to everybody. Right.
I don't know if you've ever read anything from a lawyer and thought, wow, this person really cares about me.
You know, this organization like really gets what's happening and how I'm impacted by this, right?
No, that that's not how it comes across.
And so a lot of times they don't think about what they're going to communicate until something happens.
And now they're scared and they're worried and they run to the lawyers because the lawyer is the only
one with enough confidence to fake it till they make it in terms of how do we communicate with humans.
So a lot of the communication that's coming from these organizations, it maybe, maybe it meets a legal
requirement, but it's counterproductive to building trust, preserving a reputation, and demonstrating
credibility in the moment, right?
Unfortunately, the one thing that we Is that bad things will happen by accident, even sometimes, right?
I can't promise you that nothing bad will ever happen.
What I should be able to promise is that when it does happen, I will care and I will walk you through it.
And you're not going to have to go through that alone.
And I should be able to promise that I'm doing everything I can to minimize the times where that happens
and to minimize the impact of each incident. And that is not a legal conversation.
I'm happy to have conversations with the attorneys about how do we communicate that feeling in a way that
doesn't violate the law, right? I'm not advocating for breaking laws.
But there is a an outcome from all of this communication that really needs to serve a higher purpose other
than avoiding litigation. Because let me tell you, at least in the United States, you're going to get sued anyways.
The lawsuits are coming. There's not a standard of merit before something gets filed, right?
So maybe it won't actually end up in trial, maybe the judge will throw it out.
There's a number of reasons why it could die before it actually sees courtroom, but it's still gonna get filed.
You're still gonna have to spend time, money, and energy dealing with it, even if it gets dropped or thrown
out, like you're you're still paying outside counsel to deal with it.
And so the question is who do you want to be as an organization showing up in that moment?
Do you want to be seen by a judge or a jury or mediator as a company that's trying to hide something,
a company that wasn't doing the right thing to begin with?
Or do you want to be seen as the company that actually cares and tried to be honest and try to really
demonstrate what you're doing to prevent this from happening and what's going to happen in the future. Right.
The legal requirement really is the floor in these conversations. It's not the be all end all.
And the second thing that I will add, the second most common mistake that I've seen, and this truly breaks
my heart because it's just, it's so sad. It's almost comical. But don't let AI write your incident comms for you.
Because it it has that same kind of icky feeling when you read the lawyer statement, but now you know
that the organization didn't even care enough to ask the lawyer to write it.
You put it into a website, and that's how much you care about this relationship.
I've been getting a lot of emails lately from people.
I mean, I I always get emails from people that are like, hey, you should list my thing on your website.
But over at my project, The New Oil, I've been getting a lot more lately that are very clearly written by AI.
And it's so frustrating because even if it is a project that makes sense to be on the website, it's like
you you didn't even care enough to like actually write me. Yeah.
It it it's very it comes across as very almost condescending. But but like disrespectful, right?
Like just you weren't actually concerned about me. And people can see that.
So that actually uh ties into the next question.
You touched on this a little bit, especially with the AI one, but how do we tell a good PR response from a bad one?
How do we know when a company is like taking a seriously, owning the responsibility and trying to make
it right versus just reassuring the investors and trying not to get sued and all that? Yeah.
So a couple of things is a company that's really taking this seriously first and foremost is not blocking
materials from getting indexed by search engine. I was thinking about that, the no index tag on disclosure pages.
Oh, that pisses me off. That is that's particularly interesting to me because it's it's counterproductive.
It's not helpful. To be fair, the only people I've ever heard advocate for doing this are the attorneys.
And And uh I'm I am not allowed to give legal advice. I'm not a lawyer.
Um, but lawyers love to give PR advice all the time.
And the thing is, is if there is somebody looking for information about your company and an incident,
a breach, a leak, something, wouldn't you want them to hear it from you on your disclosure page, like
to get your side of it, to get your explanation in the context that you've written.
I don't understand why you would want to hide that so that people who are searching for it only get everybody
else's commentary on it. So yeah, hiding disclosures is is one thing.
The second thing is can they actually articulate what happened.
And there's varying degrees of this depending on the type of company, right?
If it's a B2B company and it's very technical, they should have a technical postmortem. They really should.
Because if nothing else, their enterprise customers are going to need that in order to do an accurate
risk assessment with the vendor relationship.
Now, if it's a B2C company and depending on the company, like for example, you may not expect to have
a full technical disclosure from a granola bar manufacturer, right? But maybe it depends, right?
There really is no one size fits all.
It depends on the culture and the relationship these organizations have with their stakeholders.
But for a B2C company like that, you may not get all the technical stuff on the website simply because
there aren't that many people interested in it. But there should be a way to get the information if you are.
So, you know, if if for example it's like, hey, we do have a technical, you know, document, here's how
you can reach out to us if you're interested in it.
Um I've seen a couple of companies, particularly if they have really valuable proprietary information,
that they can only share some of those details with their customers and sometimes under an NDA if it's
not already covered in their contract uh with with their customers. But it should be available to whoever wants it.
And if you can tell when people are like, okay, they're either intentionally not telling me, which is a problem, right?
Because they're not trustworthy.
Or the other thing that I find most often is that they don't know they're doing it wrong.
They don't have the experience expertise to competently communicate in this moment.
And so I've heard from a lot of companies that things went as well as could be expected because they truly
just didn't know what good looked like.
And that also concerns me because if I can't trust that you know how to handle this incident, likeike
we know where incidents are coming.
So, you know, the it's it's not just the transparency and the honesty, honesty piece, but also the competency.
Have you proven that I can trust you to handle these types of situations.
So sometimes companies get caught breaking the rules or you know getting a scandal, and they usually get fined.
I've heard conflicting answers on this from experts, but do you think in your expertise, are these finds
meaningful or are do companies just treat them as like a cost of doing business? This is a cost of doing business.
It's just a tax.
To be honest, for better or worse, I think the meaning of the fines is for constituents to see that their
government is doing something.
I don't think this is the most effective thing the government could be doing, but it is important for
people to see they're doing something.
And so I don't think it's meaningful in the sense that it television really convinced companies to change.
And for the largest companies who are often the most egregious when it comes to these kinds of exposures,
it doesn't hurt them. They barely feel it, if at all.
But it is important for people to see that their government gave a shit. So it it's not that there isn't any meaning.
It's just not I don't think that they're accomplishing what they hope to. Gotcha.
So some companies love to show off certain certifications like ISO, I don't know what the numbers are,
or privacy shield, which for listeners, that was actually invalidated by courts a few years ago, but that's
neither here nor there. What are your opinion of these? Are these helpful I would say heuristics?
Like obviously they're not an end-all be-all, but can those be helpful heuristics for consumers or are
they just compliance checkboxes that consumers shouldn't even bother paying attention to?
I think they are only useful for enterprise customers.
I don't think they mean anything to consumers and I don't think that consumers should put a lot of faith in them.
The reason for that is because a lot of these certifications aren't actually checking the things that
consumers care about. A lot of if you think about the worst offender in privacy.
I promise you they have all these certifications.
And so the certification does does tell you that they're doing some good things in certain areas.
But for consumers, it's usually not the areas they care about. Now, for business customers, it is different.
And this is primarily why those certifications became so popular because they were a bunch of consumer
products and services back in the day. Maybe I should have prefaced this for anyone listening who was born after 1990.
This is story time.
That you know, when these companies they wanted to move into the enterprise space, they wanted to start
selling their tools and their software to companies.
They make more money off of companies than they do on consumers most of the time.
They get really, really large contracts, and it gives them a more stable recurring source of revenue compared
to like individual monthly subscriptions that they might get from you or from me.
And so as these companies were trying to move into becoming a tool or a product that companies would buy,
companies have this very complicated process for assessing their vendors and understanding how much risk
are they introducing to the company by choosing certain tools or certain software.
And there's varying degrees of risk depending on, you know, how much data does that tool need access to,
how connected they're gonna be to other systems at the company, like all of those things can actually,
you know, increase risk because if something happens to this tool through this product, it's gonna impact
other products of our business. So one of the things that enterprises ask about are these certifications?
Because it's kind of a shorthand to be able to say, okay, do you have an access control system?
Do you have a process for managing vulnerabilities in your software?
And so a lot of these certifications have become that shorthand of if you have this particular certification,
then yes, we do have these programs, we do make these types of investments, all of that.
What it doesn't check for is whether or not it works.
And so you can have a privacy program that gets you a certification, but what they're not being audited
on is does this company care about privacy? And when given the choice, do they choose privacy over something else?
So So it is valuable for enterprise customers. It helps us skip some steps in the evaluation process.
And for a lot of companies, it's a must have if you want to get their business.
But for consumers, I I would not be I would not be putting any meaning into that certification as a consumer.
So at the time of this recording, we covered a story, uh, we being privacy guides, we covered a story
last week about Apple's private relay. There's a bug that exposes IP address.
And the researchers went public with this immediately instead of doing responsible disclosure.
And the reason they gave is they were worried that Apple was basically just gonna keep burying it and
not actually fix it, and this was gonna hopefully force them to do it.
And uh I remember when you heard that story, you kind of disagreed with their choice to skip the responsible
disclosure phase. So uh why do you still champion responsible disclosure?
And how do you think in a situation like that, a researcher could kind of get the best of both worlds
of still do the responsible disclosure, but also make sure that the company doesn't just bury it and they
never get it get to publish it. Yeah.
So first I just want to caveat for everybody that I don't actually know what happened between the between
this company and Apple, right? All I know is what everybody else has read on the blog.
But based on that, and you know, my 20 years of experience working specifically with security researchers
and bug bounty programs, I have a very strong sinking suspicion that either one or both sides of this
equation is not effective in communicating.
And I see this all the time between external researchers and the internal security teams.
They often talk past each other. Emotions can get really high. A lot of this communication is happening asynchronously.
I don't think any of these people are gonna win awards for their writing abilities.
Like it's a really difficult communication environment.
And if you don't have the skills to do this effectively, it's so easy to get frustrated.
I have seen security engineers get really frustrated at researchers, in all fairness, because they're
just reading the emails incorrectly.
Like I've sat down with researchers, I'm like, that's not actually what they're saying.
You're mad about a thing that they never actually said.
But like they their interpretation of it, like you know, determines how they make decisions about this.
And the same thing is true on the researcher side.
I have written several blog posts about the communication issues that we have on both sides here because
there's asynchronous communication a lot of the times, and there's an imbalance in terms of information.
Both sides do not have the same amount of information about what they're talking about.
You know, the external researchers do not see what's happening inside the company, and the folks inside
the company are off their judgment is often influenced and impacted by the way they think as employees, right?
In order, like their loyalty to that organization.
And in some cases, they may be the one who built the damn thing and they're feeling very possessive about
the fact that you found a problem. No one likes when their baby is called ugly, right?
And so they this is just a hotbed for communication missteps in general.
Now, I don't know for sure if that happened in this case.
Because like I said, I don't have any knowledge of the communication that went between these two groups.
I just feel like it because I have been involved in disclosures with Apple and have had both positive
and negative experiences. So I feel like any one of these is actually possible.
But it's really important to be able to say for your own credibility and your own reputation, it's really
important to be able to say that you tried.
Now, just because you disclose something to a company does not mean you have to play by their rules.
If they're dragging their heels, if they're not fixing things, you don't work for them, you can disclose
something, and if if they're taking an insanely long amount of time, and you decide that the best thing
for protecting the users, and this is the part that I think is so important, the priority has to be protecting
the users. It's really obvious when your number one priority was getting publicity for your research.
But you know, if you decide that the thing that's most important for protecting individuals is that this
needs to be disclosed because this company is being irresponsible and not fixing something, then you need
to be able to say, We've really tried, we tried to warn them, they didn't listen, and we've taken this
extraordinary step because our priority is protecting the individual.
That is really important from a credibility perspective.
Because now we are sitting here wondering why, why wouldn't you have done this?
And in all fairness, I have spent my entire career working with analytical, logical, rational, technical thinkers.
And so many of them are scared to have awkward or difficult conversations. That doesn't mean we get to skip them.
It means we learn, we develop the skills and we learn how to navigate those situations.
And when I see situations like this, again, totals like this is a speculation.
I don't actually know what happened between these two groups, but I have seen it so many times where we
could have avoided getting to this point if we had the appropriate communication skills on both sides.
Because even within a company, oftentimes the thing, you know, the people you're reporting the issue to,
they're not the people who do the fixing.
They're just the report takers and they do the analysis and they're like, okay, yes, this is in fact a real thing.
They've got to now go convince somebody else to actually do the fixing.
Well, that somebody else has existing priorities and a different boss.
And maybe they're trying to build something very quickly because they've got a release date coming up, right?
All of this becomes a communication challenge that you've got to learn how to overcome regardless of which
side of the issue you're on, whether you're the researcher or internally.
And this is an area in security where you know we have seen communication failures over and over and over
again for many, many years.
I'm sure you love this video, but it reminds me of the um the Key and Peel sketch where they're texting
each other to hang out. Yeah. It's just, yeah, you want to go right now? You wanna go right now? You wanna go?
Oh, this guy. Yeah, uh viewers should look that up if they haven't seen it. There is a moment I will never forget.
This was in a previous life when I was uh still working in Silicon Valley.
The thing that I was working on with the security team at the time with their Buck Bounty program was
teaching them to focus on the objective and the long-term outcome that they wanted from this engagement
rather than trying to win the conversation.
Engineers love to win conversations and it destroys relationships and it destroys trust.
And so the head of product security at one point actually told me that the lessons they learned through
working with me on bug bounty communications improved their marriage.
Because now they knew how to communicate with somebody in a moment of disagreement.
And that person always knew that the relationship was valuable, right? That I'm we're having this disagreement.
This is an awkward and uncomfortable communication, but we're having it because I want to preserve the
relationship, right?
And when you stop trying to win the conversation, it helps diffuse a lot of the emotions and it de-escalates
a lot of the the assumptions that we make about the other person that we're talking to. Yeah.
I'm not an expert on that, but I am married and I always tell people it's like you and the spouse versus
the problem is a lot more productive. Yeah, exactly.
And if you companies have bug banning programs because they want to solve that problem with researchers.
In fact, it's one of the things that I tell clients is like if if you're not prepared to be on the same
team as the researchers, do not launch a book bounty program because that's what you're promising. You know?
So what would a consent model that actually serves consumers look like?
Would it be like a regulatory fix, a technical fix, or a cultural shift?
I don't think there's a consent model that solves this problem. I don't think we can solve it with consent.
What we have right now is consent, which has been diluted to disclosure.
So all these companies have privacy policies or privacy notices. Those are not contracts.
It is not there to tell you how much they care about your privacy.
It is there to disclose, often in very vague terms, intentionally vague, because they're going to change
soon, to disclose certain things that they're doing to avoid regulatory action.
So they can't be um they can't be accused of lying to you about what they were doing.
So they put in their privacy policy with very vague language. So they're like, well, we told you what we were doing.
We told you we were drowning the puppies, like it's right here.
You know, you just you can't save the puppies through disclosure.
You have to tell the company that killing puppies is unacceptable.
So again, they there are certain business models and there are certain business practices that we as a
society and that we as a country and even as states or cities or whatever jurisdiction and regulatory
body we're talking about, we have decided there are certain practices that are not okay. We don't allow them.
Fraud, for example, right? You could make a lot of money doing fraud.
We've decided we don't want that in our market and in our society. And so that's illegal.
We could make a lot of these things illegal.
And then you wouldn't have to read the very, very long privacy policy that was written by a lawyer for a lawyer.
But you know, it's again, it's it, I don't think consent is the problem number one because i don't think
these companies actually care about how they get consent if they truly cared again the concept of consent
is about you should know so you can make your make a choice based on what works best for you.
If companies really cared what worked best for you, they wouldn't try to get you addicted to a product
or a platform or any kind of technology.
If they really cared what was best for you, they would be giving you different choices in the first place.
Or they would realize that this choice is just clearly messed up and we should never inflict that on anybody.
So I just I don't think consent is the fix here.
Um, because i i i don't think we have a way for it to be truly informed consent because if if we were
truly informed we would not we would not be in this situation we're we're not truly given the information
in the moment we're making the decision, nor are we being given true choices.
We're being given manufactured artificial choices because the choices themselves have been chosen for us.
I agree about the uh it's not really informed consent and if people were informed things would look very
different and if we were actually given the option of choosing what we actually want right if you're choosing
between like red and green well I don't consent to do either one of those, you know?
So yeah, I I could rant about that all day. I agree.
But actually on that note, people say they care about privacy, but they still use apps that track them everywhere.
And your work deals a lot with human behavior.
So from your perspective, would you say that this is like a failure of education or, are things just designed
to be too addictive to resist, or are there not enough good alternatives? Like what's your take on that?
If you're finding this interview insightful and interesting, please consider supporting our work at Privacy
Guide so we can continue to bring you more like it.
Privacy Guides is a nonprofit that researches and shares privacy-related information and facilitates a
community on our forum and matrix where people can ask questions and get advice about staying private
online and preserving their digital rights.
You can sign up for a membership and get early access to bonus videos, bonus content, a private signal
chat with other privacy enthusiasts, and more at privacyguides. org/slash donate.
So there's a couple things happening all at once that kind of creates this perfect storm, which the companies
love to talk about because they think that the gap between what we say and what we do somehow gives them
permission to keep doing what they're doing. So there's a couple things I want to know.
Is number one, I think our mechanisms for getting people's feelings about feedback are deeply flawed.
I don't know many people who wouldn't say they care about privacy if that's the way you ask it.
And so the the actual mechanisms and the instruments we're using to get this feedback, I think, is really important.
And a lot of it is either funded or done by these companies. And so it's it's unhelpful on purpose.
The second thing again and this touches back a bit on what we talked about with consent is that if the
choice is either use this uh map app on your phone or not know where you are right now that that's not
really a fair choice right and the fact that so one of the there's a really popular like growth strategy
at these companies, particularly when they're small, or if it's a new product, they try to get it in as
many places as possible where you don't have to choose. Right.
So like things like bloatware and things that are like automatically done like on your phone when you
buy your phone, right? Like those types of things. Like did you really choose to put that up on your phone? No.
Your phone came with it.
And if you don't want it to trap you you have to do the work to figure out how to turn that off right
so it's like those types of things where it's like it's not really you don't really make that choice.
So again comparing like I care about privacy but I have this app on my phone that I may not even know is on my phone.
I may not even know what it's doing. Those that's not comparing apples to apples, right?
So the so the research methodology here is something that I think we need to be really mindful of first and foremost.
But you know, again, the if you're not really given a choice, I mean like think about like when you go
to the doctor, I don't know if you've ever had to go to like the ER or urgent care or something, you're
filling out these forms. The choices fill out the forms or sit in that chair and no one will help you.
These are not situations where you can really say that I don't care about privacy because I chose to fill
out the form because I was bleeding internally, right so I again it's mostly it's mostly the offending
companies who keep pointing to this perceived gap between attitudes and behaviors hoping that no nobody
looks under the hood on the research side, but then also on the behavior side and say, well, well, do
people really have full autonomy to choose whatever they want? No, they they don't.
So I think it's a manufactured dilemma. It's a freedom torch, if you ask me. Nice callback. And yes, very accurate.
You mentioned that you've testified in in front of a few different uh state legislatures.
Uh, specifically here, I've got Vermont written down for state bill 71, arguing for privacy as the default.
So, especially this year, privacy guides has been focusing a lot more on like getting people involved
in in legislation and stuff. So for those people, a couple of questions.
What was the experience like engaging with lawmakers who may not deeply understand this technology or
not understand it at all?
And can you impart any advice to listeners who may want to get involved more on the legislative side of things? Sure.
Um so I I have I have some good news, which is that there are more and more legislators who do actually
understand the technology.
So one of the reasons why I got involved with Vermont is because they have people in the state legislator
who are former software engineers who actually do understand what is happening here.
And they have done a ton of outreach to experts and other members of the industry like myself to get these
different perspectives, right?
The technical perspective, but as well as how does the culture how does this whole like organism function
because in some cases you know like we're we're fighting a monster so we need to understand where the
weaknesses are right so so that is good news. We we do have some fresh blood coming in, so to speak.
And they do have technical experience.
And so if you if you are lucky enough to have somebody like that in local government, reach out to them.
They will be thrilled to hear from you.
They'll be thrilled to hear any expertise that you may have or even just your concerns as a constituent.
In Vermont in particular, I was testifying as somebody who was, you know, again, marketing adjacent and
I I know all these tricks that the companies use to try to make you feel bad as a uh policy maker for
wanting to to uh put regulation on them. But I'm also a small business owner.
And I have such a visceral response to these very large companies going into local communities and convincing
local chambers of commerce and local business owners that they can't survive without them.
We're being used as small businesses, we're being used as human shields so that very large tech platforms
and data brokers and other like multi-billion dollar companies won't have to pay the price for the consequences
of their products on our society and on our communities.
And I have worked really hard as a small business owner to try to eradicate as many of those platforms
from my business as I possibly can.
Like we recently just um I had been hunting and hunting and hunting for a place to put our website that
you know didn't have all these trackers.
The the platform we had been using previously had like a toggle where you could turn off the trackers,
but the dormant code was still on the site, and that really bothered me.
Number one, it's sh code quality, but number two, I was like, what who's gonna believe that I've just
turned off this toggle? The code is still here in the source code, everybody could see it.
And so we we moved our website to to an open source platform where we can audit the code.
Everyone on our site can see the code. Like if I don't want tracking, it's not there. Right?
These kinds of options were not always available to small business owners.
And so they were manipulated by these big platforms where it's like, you know, you either advertise here
or you host your website here or you're invisible and nobody will ever find you on the internet.
That's not true anymore.
We have tools and we have platforms that will allow us as business owners to be respectful of our customer privacy.
And that scares the big guys.
And so, you know, I I love speaking on behalf of small businesses and the things that I have done to market
my company and to grow my business that didn't require me to use all of these, you know, really exploitative platforms.
And you know, the policy makers needed to hear that just as much as they hear from, you know, the big
tech lobbyists that are like, you know, if you if we can't collect all this data, then all these mom and
pop shops on Main Street will will close. And that's not true.
There are certain things where I think, you know, if if we're going to put stricter restrictions on everybody,
then, you know, let's think about can we give grants to small businesses, right?
Like this comes a lot with um some of the things that we want to do to preserve privacy and also to increase
security may require some additional technical investments.
Well you know what if you're a small company and you're running a health clinic? Like hygiene is not optional.
We don't cut out small clinics from our you know sanitation regulations.
You know, but what we can do is offer some assistance to help them meet that standard.
Because the size of your organization shouldn't determine whether or not you're allowed to hurt people.
So, you know, particularly when I've been talking to Verm Vermont, it's been as a small business owner
to help them understand where they're being lied to by the big companies.
Yeah, when you put it that way, the the whole like, oh, they the mom and pop businesses can't survive without us.
And in my head, I'm like, they were here way before the tech companies. What are you talking about? Yeah.
And and in all fairness, like they're wasting so much money on those platforms.
Like that's they they've convinced these small businesses that they can't survive without some of these
advertising platforms and you can. Totally can.
You're involved in efforts to bring more women and minorities into cybersecurity.
Why does representation matter in this field and how does it benefit everyone?
We all have a limitation in our experiences and the way that our minds work.
My brain is wired a very particular way, for better or worse. It's what makes me who I am.
But sometimes I don't see the complete picture on something or sometimes actually I use this analogy with
my partner all the time.
I'm a I love doing jigsaw puzzles and there was there was a a moment where I would I was on vacation so
I didn't have like my whole like old lady puzzle setup and uh I I was like pulling pieces out of the box
and trying to like find where they fit on the table and my partner was like why don't you just put all
the pieces on the table so you can see all of them at the same time.
And I'm gonna be really honest with you, that thought had not crossed my mind. But it seemed so obvious, right?
But the moment where I was in and what I was focused on, I was kind of being myopic in my thinking and
having different people with different lived experiences and different backgrounds helps us find better
ideas it helps us find better options.
And in all fairness, like I mean I think a really obvious example that people might already be familiar
with is the like motion activated like hand dryers in the restrooms, in like public restrooms that weren't
tested appropriately for people of color.
And so it was not recognizing people's hands when they were trying to dry their hands in the restrooms.
And you're like, what? What what good is a hand dryer that only works for a percentage of the people using the bathroom?
And so you can see how just like having, I don't know, basic levels of diversity are important just to
make sure your product works and that it's usable by more people.
Especially think about like if you're at a startup and like your number one priority is growth why why
would you build a hand dryer that can't be used by everybody?
That's going to limit how many people you can sell it to, right?
So, you know, if you're not going to do it for altruistic reasons, at least do it for competency reasons. Right.
Do it because it's the smarter choice, not just the right choice. All right. Last question.
Where can our audience go to learn more about your work? Ah, that is a good question.
So you can see all of my writing on my website, which is discernibleinc. com. All my blog posts are there.
You can subscribe if you want to, if you want to get you know those sent directly to your inbox.
We also run weekly in So every Wednesday we run a live scenario for subscribers who want to jump in and
participate and practice and, you know, develop their skills on different communication aspects of incident response.
If the timing of those drills doesn't work for you, you can also sign up just to get the the debrief.
So you can still get access to the library of all of our various scenarios.
You can run through them on your own if you want to. You can run through them with your team if you want to.
But going to my website is the easiest place to find me.
We'd like to thank Melanie again for being so generous with her time and speaking to us.
If this topic interests you, definitely be sure to f We also have a bonus video for our supporters where
we ask Melanie some more questions about things like the terms of service, her hobbies, and even a question
from one of our supporters. You can sign up to see that at privacyguides. org slash donate.
If the policy side of privacy is what interests you, then perhaps you would be interested in our interview
we did earlier this year with Cindy Cohen, the former executive director of the Electronic Frontier Foundation.
