Motley Fool Hidden Gems Investing - Containing Big Tech

Episode Date: September 24, 2023

When your information is everywhere, is it possible to rein it back in? Deidre Woollard caught up with Tom Kemp, a cybersecurity expert and author of “Containing Big Tech: How to Protect our Civil Rights, Economy, and Democracy.” They discuss: - The implications of biometric data collection in a world where big tech runs rampant - Which companies are getting the privacy game right (and wrong) - Angel investing, and workarounds to weak links in existing cybersecurity systems Tickers discussed: META, AAPL, AMZN, GOOG, GOOGL, MSFT Host: Deidre Woollard Guest: Tom Kemp Producer: Mary Long Engineers: Dan Boyd, Kyle Carruthers Learn more about your ad choices. Visit megaphone.fm/adchoices

Stop wasting your nights on a mattress that doesn't get you. Experience the most comfortable mattress in the world. The Sleep Number Smart Bed. At the touch of a button, you can personalize your comfort. Choose firmer or softer. Adjust cooler to warmer. And right now, save up to $2,500 during our massive Labor Day event. Hurry into your local Sleep Number store today.

Because we have your number. That tells you that there is a hunger for privacy, that people do not want to have third party entities tracking them and selling the data to data brokers. Do we really need to have all these apps leaking out our precise geolocation to conduct commerce in the United States? the answer is no. I'm Mary Long, and that's Tom Kemp, a cybersecurity expert, angel investor, and author of the new book containing big tech, how to protect our civil rights economy and democracy. Deidre Willard caught up with Tom to talk about biometric data and new frontiers in

the battle for privacy, how AI regulators could find inspiration from the grocery store, and some perfect world solutions that balance data collection and personal privacy. I really enjoyed the book, and I just want to start with the most basic thing, the title. So, Containing Big Tech, what is it and why is it necessary? Absolutely. So, yeah, as you mentioned, we have five big tech companies. We've got Meta, Apple, Amazon, Microsoft, and Google. And they've certainly built innovative products that improve many aspects of our lives.

But what we're now seeing is and becoming more aware of is that their intrusiveness and our dependence on them have created some pressing threats to our civil rights, our economy, and democracy. And those threats include the overcollection of our data, the potential problematic ways that AI can be used, and the stifling of competition and entrepreneurship due to their dominant marketing position. So with this book, I wanted to expose the consequences of big tech's digital surveillance, their use of AI, their monopolies, but I also wanted to provide solutions. And I think by containing the excesses of big tech, I believe we can ensure that our civil rights are preserved, our economy is competitive and healthy, and our democracy is protected.

Well, we're having this conversation at a very opportune time. In the book, you talk a little bit about Google's acquisition of DoubleClick and their ad monopoly on both sides of the ad equation. And this week, we've got the big lawsuit between Google and the Department of Justice, which is all about Google's dominance in search. So, what's happening here? And do you believe that Google's power in both search and in ads needs to be broken up? Yeah, you're right. There are actually two antitrust lawsuits. The first one is happening as we record this. I think we're in day two. It regards search. The second one will be about their ad tech platform, which they got

through the acquisition of DoubleClick. But that's going to happen later. And so, specific to the first one right here. U.S. versus Google focuses narrowly on the company's search engine. And what the government alleges that Google's 90% market share, they're leveraging that to throttle competition in search. And what they are basically saying is that the government is arguing is that Google has maintained this monopoly by not making better products, but by locking down shelf space, basically, where the consumers might be able to find a different search engine. And so, for example, it pays out billions of dollars to Apple to become the default search engine. And then someone like DuckDuckGo complains, hey, it takes 15 clicks on an

Android device to switch over from Google to their browser right there. And so, basically, it's almost like a replay of the lawsuit that we had against Microsoft, the U.S. government had against Microsoft in the 90s, where Microsoft was bundling the browser on the platform. And so to answer your question, should it be broken up, et cetera, I really think in the search market, I think you can do what you did with the Microsoft case, which is say, hey, you can't have all these exclusionary agreements that basically take up all the shelf space and lock people in. You really need to give people choice by having one click to switch to another browser versus 15 clicks. And then in the case of the ad tech antitrust,

because Google is both the pitcher, the catcher, the umpire, they own the supply side, the demand side. Yes, I do actually think that there probably warrants a breakup right there. So in terms of the suit that's going on right now, it sounds like then part of the answer is the relationships with Apple and Android and making it so that you have another option. Is that sort of what you're saying? Yeah. I mean, basically, Google will say, oh, you have options. It's a click away. But it really isn't a click away.

It takes you 15 clicks to do that, according to DuckDuckGo. I'm just quoting them. And then in the case of the licensing agreements, DuckDuckGo doesn't have $15 billion. The argument the government has is that if Google is truly such a great operating system, why do you have to pay so much money to Apple to ensure that your Chrome browser is the default right there? So I think probably what's going to happen is Judge Mehta is going to probably ding Google in certain contractual practices they have, but I doubt that he will do what some people have called for, which is requiring the split up of the browser from Google. I think if there's going to be any splitting, it's going to happen on the actual advertising platform that they got through DoubleClick because it's clear that Google owns all components in that market. And they're taking about 50% of every dollar being spent if you kind of do the analysis right there. And I think that is really where they're going to probably face a bigger hammer as opposed to Judge Mehta with the Google search lawsuit.

I want to switch topics a little bit and talk about some other ways that tech is a little bit intrusive. One of the things I find fascinating is biometric data. We're starting to see more and more uses of this. I know Amazon has been testing out paying with your palm. How is this different from just typing in a password and what makes this concerning? Well, the big difference is we can always change a password or pick a new one, but we can't pick a new fingerprint or iris, right? And using our fingerprint or iris or our voice can be faster, can be more secure than typing or guessing a password. And so, I think everyone likes having with the phone to have the unlock happen with the face. I just think we need

to be careful about using that technology and actually selling people's iris, selling people's biometrics. And so I think that there needs to be guardrails because, you know, like again, if your password gets stolen or someone buys your password, you can always change it, right? But if someone sells your biometric information, then you can't change that. And then they have the keys to your kingdom because increasingly we will be using our face, our voice, our iris, our fingerprint to access services. It's interesting because we are really trading ease of use for this privacy. One of the things I've noticed is that maybe there's a generational shift here because I've talked to younger people. They don't seem as concerned about

this as I am. And I'm wondering if the concern over privacy is something that varies maybe by age or demographic? Yeah, I think historically that's been the case is like the mindset of is like, well, I don't have anything to hide, so that's okay. They gather the information. And frankly, in the early days of big tech, the mining of data was all about sermonous ads and we made this trade-off. And so, yeah, it was pretty annoying that if I was looking for red shoes, the red shoes followed us around for the next month, right? And maybe, Deidre, if you did a research, uh, on a topic. And then you're, you know, a friend of yours sees the ads being served. They were like, what were you looking at? Right. You know, why are you searching for that right

there? But the, the reality is, is that we're now in actually in a post-abortion rights America. Right. And I think people are all of a sudden saying, Ooh, wait a minute. Like the stuff that I used to do, the search information about certain topics, the places I visited, et cetera, can actually be used against you, right? And so I now think that there's actually going to be a shift which also corresponds with the support for specific laws as it relates to reproductive health because people are concerned about their personal

and sensitive data being collected and sold. And I think it's also going to get worse with AI Because we now know that musicians and writers are concerned about their IP being scraped by AI. Actors and screenwriters today are actually striking because of AI. An actor doesn't want to go in, get paid $10 to have some pictures taken of them and their voice taken, and they never can monetize their picture or voice or face ever again, right? And so to me, your face, your voice, your biometrics is your copyrighted material, and it's your personal and private data.

And I think people will start saying, wait a minute, I didn't like how that person took my face and put it in a video. I didn't approve that. So I think it's actually going to rapidly shift in the other direction, especially when generative AI kicks in and people are freaking out about their face and voice being used in ways they didn't approve. So thinking about that from a policy perspective, I know you've done some work on privacy policies and data policies. How can we enforce that? And is it just fines? Is it something else? What are the ways that it could go? Well, first of all, I think at the end of the day, we do need a federal privacy law. I mean, it's ridiculous that we don't have basic rights over our data. I also think that now that one-third of internet users are kids, that's where it's at

right now, we really need to carefully look at, is it really healthy for our society and for the kids to continuously be tracked and have all their behavioral information be collected? If that happened in the physical world, those people would be arrested as stalkers. But for some reason, we just allow the fact that all the kids' sensitive information, and I think as we are very familiar with that the personalization and it leads down to rabbit holes and negative body images and other stuff that happens because of that. So I do think we need to have a rethink here given what's happening. And yes, as part of a federal privacy law, I do fully believe that we need some sort of agency, maybe the FTC or part of the FTC that actually can provide some enforcement

to give people the right to know what's being collected and the right to say no to the sale of their data. And I think that's really important for us to have. Well, I want to get into AI a little bit, because you mentioned that you talk in the book about AI bias, the wide-ranging implications of that. A lot of people are calling for AI regulations, but you also mentioned AI certifications, which I found fascinating. Why AI certifications? Yeah. I mean, first of all, I want to be very clear that I'm not calling for airline safety when it comes to privacy or AI, where there's never a crash. I'm calling more for car safety, where you have to put the babies in the back seat in the baby seat. You need to have some

basic emissions. You need to have airbags. And look at the innovation that's happening that's in the automobile industry right now with all the electric cars. So specific to AI, what I'm talking about is high-risk AI, which is AI that can impact people's lives. I'm not talking about AI being used in a game or something like that. Now, specific to certifications, the finance industry has certified public accountants and certified financial audits and statements. And man, shouldn't we have something similar for high-risk AI, where someone actually did some sort of basic auditing and the people are actually qualified to actually do the audit and have gone through some certifications themselves, just like a CPA.

And then I also think we need codes of conducts in the use of AI, including industry standards. And so, for example, the International Organization of Standards should have certain quality codes and standards put forth as well. We do this in the real world, right, for different industries that there are standards, you know, ISO standards and in the financial industry, we have financial statements, CPAs, et cetera. Well, we probably should do this AI because AI is taking over that stuff. And we should apply that to that as well. Well, in terms of the AI bias aspect of it with the large language models, do you feel like there's a need to sort of examine what goes into those?

Yes. So here's my take is, is that we just need transparency and, and food labels, right? Here's a story. A friend of ours, my wife and I, they have a high school kid and she wrote, she was told to write an essay about the best way to get into college. And she wrote an essay that said, I'm going to move to Montana and play the bassoon. Kind of, you know, playing the demographics, you know, angle right there. And it was a funny essay. And the teacher said, you didn't write this this was written by chat gpt like how can you prove it right like did she do it or chat gp she did really write it and so from my perspective we should as consumers have the ability to go to chat gpt with an image a video some text and simply say did you create

this or not yes or no right a verification that's it or similarly i'm on the phone i should have the opportunity to hit 411 and say, am I talking to a human or a robot? Same thing on chat as well. So I think we should just have basic transparency. Is it a human or is it a machine that we're dealing with? Or is this been created by a machine or 80% of this was created by a machine versus a human? So that's kind of the stuff that I'm talking about. It's like nutrition labels that that we have for medicine and food. I mean, if we know how many calories are in a Whopper, why don't we know if a certain image was created by AI or not? I think that's just kind of basic rights. Yeah, that's fascinating. It would certainly change how students feel about

chat GPT right now if they knew that it could be verified. I want to switch back and talk a little bit more about advertising because, you know, things have been changing in terms of cookies and things like that. But I'm also seeing this increase in retail ads, companies like Walmart, Amazon, you know, Kroger is now going to put ads on the freezer than the stores. So, I mean, the ad thing is just everywhere. Is there any good in this for the consumer if we're being kind of sold to everywhere we go? It's good if we consent to that happening. and we have the right to know our data is being collected and we have the right to say no. You know, so it's just simply about, you know, having basic rights of saying, you know, there

are some people that may go into a grocery store and they may want personalization that happens based on their past purchases. And there are people that may want to get discounts if they give up their data. And that's perfectly fine. It just simply should be, I want to know what you're collecting about me. And at some point, I may want to say no, or I may want to limit that, yeah, you can use it, Kroger or Walgreens or Walmart, but that doesn't necessarily mean to personalize it. But that doesn't necessarily mean that you should have the right to go around and sell it to anyone with a credit card, right? To data brokers. And I just think in general, it does get a little scary if they start collecting sensitive data and selling it.

So if I go into a Walmart and I buy over-the-counter products, I don't know, if I buy adult diapers or prenatal pills or things of that nature that may have some insight on my health, even though I may buy it for a friend or a relative or an elderly adult or a teenage kid or whatever, I'm not sure I want people having access to that information. So I still also think there should be limitations on the type of data that can be collected and sold. I don't want to walk into the pharmacy section and say, you know, oh, here's your, you know, something flashed on the screen and says, Mr. Kemp, here's your adult diapers you need, right? You know, that's crazy. But so I think it's all about consent, knowledge, the ability to say no, and limiting the use of sensitive data about people. I think it's interesting, too, that privacy is also now becoming a selling feature. We've certainly seen it with Apple. Apple has spent a lot of money in their ad campaigns talking about how they're protecting your data. Is there a potential that it shifts back where

you pay more for privacy or privacy becomes a selling feature, basically? I don't think you have to pay for privacy. Privacy should be an inalienable right, and we don't have to pay for freedom of speech and other rights that we have as well. And again, the original business models of Google was contextual ads, right? And they did great. And again, you can also do behavioral advertising, but do you really need to know my exact, exact, exact location? Or can you kind of back it up by precise location by a zip code or an acre or something like that? That's kind of what we're talking about right here. And so in the case of Apple, they're doing a very effective job of differentiating against

the other people. They came out with this feature called App Tracking Transparency, or ATT, not to be confused with AT&T. And 96% of people turned it on. That tells you that there is a hunger for privacy, that people do not want to have third-party entities tracking them and selling the data to data brokers. And Google should do something similar on Android. Do we really need to have all these apps leaking out our precise geolocation to conduct commerce in the United States? The answer is no. They don't need to know exactly within five feet where I'm at all the time. The scope of these companies is so massive. And that's one of the things you talk about in the book is the way that these companies have really squeezed out the competition. It's obviously

what's happening with the Google case. Are there companies that are handling data in a way you admire? And are there other ways that we can kind of encourage smaller companies to sort of a greater tech diversity? Yeah. Look, I think that the problems that we have with privacy and the problems that we could potentially have with AI bias and exploitation are exasperated by the fact that we have large monopolies who do not feel the competitive pressure to do things differently. For example, both Apple and Google charge 30% on their app stores, and they require you to use their transaction systems and charge 30%. In a normal market, a merchant pays, what, Visa 1%, 2%? You have to pay 30%. And so that is an example of a monopolistic practice that does not help

innovation. And one area where innovation can occur is better privacy. Similarly, meta does not and all the other ones don't provide interoperability that they they once you're in their walled gardens if you leave you can no longer communicate with people that are in there as well and so the motivation then becomes like hey you're kind of captive audience so we're going to continue to collect and mine more and more of your information as well and so there could be calls to mandate interoperability. Ironically, Meta scraped the crap out of MySpace, and that's how they got going. But if you try to do the same thing with Meta, they'll sue you big time if you try to do something similar to what they did with MySpace in the early days as well. So what I'm

simply saying is that if we actually start having real competition instead of being charged 30% for transaction fees and actually requiring interoperability, I think we will then see more competition that will lead to better privacy and cybersecurity for consumers. Well, you just mentioned the word that I want to talk about as we wrap up, which is cybersecurity. Not just a big tech problem, it's a big everything problem. MGM Casinos had a cybersecurity problem this week. You're an investor in cybersecurity. What are you looking for as a cybersecurity venture investor? And what should investors that are invested in some of the publicly traded cybersecurity companies be looking for or be asking?

Yeah, I certainly have ownership stakes in a number of public cybersecurity companies, because I generally believe that protecting businesses and consumers from hackers is good. And also, I do small angel investing, right? Tiny checks to two people and a dog, right? And so that's the size. So I'm not a heavy roller venture capitalist or anything like that. I do what a lot of Silicon Valley people do, entrepreneurs, which is, hey, my friend's starting a company. Can you give them a couple thousand, $10,000 to get jump-started right there? What I look for when I do these small seed investments or angel investments, I look if it's, hey, do they have great co-founders? How big of a pain point is the

problem? Is their solution an aspirin or a painkiller? How big is the market? You want to have a large market where if you make mistakes, you can still be successful. And how crowded is the market. Yeah, it's great to be in a billion-dollar-plus market, but if there's already 10 players that have already raised a lot of money there, then it may be very difficult, even if you have a better mousetrap as well. So, that's what I look for in terms of my little tiny angel investments. And then, as it relates to the larger cybersecurity companies, I do think that if I were to give any one of these companies advice, not that they're calling me up necessarily. I really think that they would, you know, they probably need to kind of more consider

the fact that a lot of the attacks into corporations come from people's personal devices, their personal passwords. And so I think that the home network, because we're all working from home and something that's on your kid's iPad could actually, you know, hop over into the corporate network or into your Salesforce or something like that. And so I really think that the shift needs to occur to also protecting the blurring between personal and professional usage of home networks, devices, et cetera. And so I think that could be an interesting area. Oh, yeah, absolutely. It's fascinating to me how many of the big hacks start with exactly with something very small like that. Absolutely. I mean, look, 80% of breaches

involve a password, like a stolen password or easily guessed password, or someone was faked or fooled into giving their password. And then once they get in, then the hackers hop around. And so identity is the top attack vector because we, as humans, are the weakest link when it comes to cybersecurity. Last question, I want to leave it on an optimistic note. In the five years in the future, maybe even 10 years in the future, how do you see data and privacy being handled in a perfect world where you see everybody protected? What does that look like? Yeah, in a perfect world, we're able to use universal signals on our devices and browsers that pre-communicate as we visit a website that says, here's the security setting.

So I don't have to go through, we're all sick of like dealing with cookies, right? Like, do you accept the cookies? And it's like, blah, blah, blah, blah, blah. No, I just want to see that one article about my sports team. I don't want to spend two minutes like, do I want marketing cookies? Do I want analytics cookies, et cetera? So I'm hoping we can be in a world where we can have opt-out signals that express our desire for what we want to do. So that would be a great situation that we can kind of build privacy

into the browsing as we go along. And I hope that we continue to have greater awareness, like we talked about cars before, that there is now a significant concern that too much data is being leaked out from cars. And there was even something about like, hey, allegedly Tesla engineers were looking inside people's garages, right? And say, oh, this guy's got a really cool car next to the Tesla, etc. So I hope there's greater awareness. I hope there's a federal privacy law. And I hope that we start putting some guardrails around AI, because I think this could spin out of control. So I am an optimist. In the book containing big tech, I actually provide things that people can do as consumers right now, and then to protect themselves, to reduce their

data footprint. And then I also do provide specific roadmap for policymakers that they can follow to get us to a point where, look, we take advantage of the goodness of the large tech players, but we contain the downsides associated with it. And that's what I'm simply trying to get at with the book Containing Big Tech. As always, people on the program may have interests in the stocks they talk about, and The Motley Fool may have formal recommendations for or against, so don't buy or sell stocks based solely on what you hear. I'm Mary Long.

Thanks for listening. We'll see you tomorrow.