Motley Fool Money - Containing Big Tech

Episode Date: September 24, 2023

When your information is everywhere, is it possible to rein it back in? Deidre Woollard caught up with Tom Kemp, a cybersecurity expert and author of “Containing Big Tech: How to Protect our Civil Rights, Economy, and Democracy.” They discuss: - The implications of biometric data collection in a world where big tech runs rampant - Which companies are getting the privacy game right (and wrong) - Angel investing, and workarounds to weak links in existing cybersecurity systems Tickers discussed: META, AAPL, AMZN, GOOG, GOOGL, MSFT Host: Deidre Woollard Guest: Tom Kemp Producer: Mary Long Engineers: Dan Boyd, Kyle Carruthers Learn more about your ad choices. Visit megaphone.fm/adchoices

Hi everyone, I'm Charlie Cox. Join us on Disney Plus as we talk with the cast and crew of Marvel Television's Daredevil Born Again. What haven't you gotten to do as Daredevil? Being the Avengers. Charlie and Vincent came to play. I get emotional when I think about it. One of the great finale of any episode we've ever done. We are going to play Truth or Daredevil.

What? Oh, boy. Fantastic. You guys go hard, man. Daredevil Born Again, official podcast Tuesdays, and stream Season 2 of Marvel Television's Daredevil Born Again on Disney Plus. That tells you that there is a hunger for privacy, that people do not want to have third-party entities tracking them and selling the data to data brokers.

Do we really need to have all these apps leaking out our precise geolocation to conduct commerce in the United States? The answer is no. I'm Mary Long, and that's Tom Kemp, a cybersecurity expert, angel investor, and author of the new book containing big tech, how to protect our civil rights, economy, and democracy. Dieter Willard caught up with Tom to talk about biometric data and new frontiers in the battle for privacy, how AI regulators could find inspiration from the grocery store, and some perfect world solutions that balance data collection and personal privacy.

I really enjoyed the book, and I just want to start with the most basic thing, the title. So containing big tech, what is it and why is it necessary? Absolutely. Absolutely. So, yeah, as you mentioned, we have five big tech companies. We've got meta, Apple, Amazon, Microsoft, and Google. And they've certainly built innovative products that improve many aspects of our lives. But what we're now seeing is, and becoming more aware of, is that their intrusiveness and our dependence on them have created some pressing threats to our civil rights, our economy and democracy. And those threats include the over-collection of our data, the potential problematic way. ways that AI can be used and the stifling of competition and entrepreneurship due to their dominant marketing position. So with this book, I wanted to expose the consequences of big tech's digital surveillance, their use of AI, their monopolies. But I also wanted to provide solutions. And I think by containing the excesses of big tech, I believe we can ensure that our civil

rights are preserved. Our economy is competitive and healthy. And our democracy is protected. Well, we're having this conversation at a very opportune time. In the book, you talk a little bit about Google's acquisition of Double Click and their ad monopoly on both sides of the ad equation. And this week, we've got the big lawsuit between Google and the Department of Justice, which is all about Google's dominance in search. So what's happening here? And do you believe that Google's power in both search and in ads needs to be broken up? Yeah, you're right. There are actually two antitrust lawsuits.

The first one is happening as we record this. I think we're in day two. It regards search. The second one will be about their ad tech platform, which they got through the acquisition of double-click. But that's going to happen later. And so specific to the first one right here, U.S. versus Google focuses narrowly on the company's search engine.

And what the government alleges that Google's 90% market share, they're leveraging that to throttle competition in search. And what they are basically saying is that the government is arguing is that Google has maintained this monopoly by not making better products, but by locking down shelf space, basically, where the consumers might be able to find a different search engine. And so, for example, it pays out billions of dollars to Apple to become the default search engine. And then someone like Duck.com go complains, hey, it takes 15 clicks. on an Android device to switch over from Google to their browser right there.

And so basically, it's almost like a replay of the lawsuit that we had against Microsoft, the U.S. government had against Microsoft in the 90s where Microsoft was bundling the browser on the platform. And so to answer your question, you know, should be broken up, et cetera, I really think in the search market, I think you can do what you did with... the Microsoft case, which is say, hey, you can't have all these exclusionary agreements that basically take up all the shelf space and lock people in. You really need to give people choice by having one click to switch to another browser versus 15 clicks. And then in the case of the

ad tech antitrust, because Google is both the pitcher, the catcher, the umpire, they own the supply side, the demand side. Yes, I do actually think that they're probably warrant. it's a breakup right there. So in terms of the suit that's going on right now, sounds like then part of the answer is the relationships with Apple and Android and making it so that you have another option. Is that sort of what you're saying? Yeah. I mean, basically, Google will say, oh, you have options. It's a click away, but it really isn't a click away. It takes you 15 clicks to do that according to duck. Go. I'm just quoting them. And then in the case of the licensing agreements, Duck, Duck Go doesn't have $15 billion. The argument the government has is that if,

you know, if Google's truly such a great operating system, why do you have to pay so much money to Apple to ensure that your Chrome browser is the default right there? So I think probably what's going to happen is Judge Meta is going to probably ding Google in certain contractual practices they have, but I doubt that he will do what, you know, some people have called for, which is requiring the split up of the browser from Google. I think if there's going to be any splitting, it's going to happen on the actual advertising platform that they got through double-click because it's clear that Google owns all components in that market. And they're taking about 50% of every dollar being spent if you kind of do the analysis right there. And I think that is

really where they're going to probably face a bigger hammer as opposed to Judge Meta with the Google search lawsuit. I want to switch topics a little bit and talk about some other ways that tech is a little bit intrusive. One of the things I find fascinating is biometric data. We're starting to see more and more uses of this. I know Amazon has been testing out paying with your palm. How is this different from just typing in a password?

what makes this concerning? Well, the big difference is we can always change a password or pick a new one, but we can't pick a new fingerprint or iris, right? And using our fingerprint or iris or our voice can be faster, can be more secure than typing or guessing a password. And so I think everyone likes having with the phone to have the unlock happen with the face. I just think we need to be careful about using that technology and actually selling people's iris, selling people's biometrics.

And so I think there needs to be guardrails because, you know, like again, if your password gets stolen or someone buys your password, you can always change it, right? But if someone sells your biometric information, then you can't change that. and then they have the keys to your kingdom, because increasingly we will be using our face, our voice, iris, or fingerprint to access services. It's interesting because we are really trading ease of use for this privacy. One of the things I've noticed is that maybe there's a generational shift here because I've talked to younger people.

They don't seem as concerned about this as I am. And I'm wondering if this is something, the concern over privacy is something that varies maybe by age or demographic. Yeah, I think historically that's been the case is like the mindset of is like, well, I don't have anything to hide. So that's okay. They gather the information. And frankly, in the early days of big tech, the mining of data was all about sermonous ads. And we made this tradeoff. And so, yeah, it was pretty annoying that if I was looking for red shoes,

the red shoes followed us around for the next month, right? And maybe, Deidre, if you did a research on a topic, and then a friend of yours sees the ads being served, they were like, what were you looking at, right? You know, why are you searching for that right there? But the reality is, is that we're now actually in a post-abortion rights America, right? And I think people all of a sudden say, whoa, wait a minute, like the stuff that I used to do, the search information about certain topics, the places I visited, et cetera, can actually be used against you, right? And so I now think that there's actually going to be a shift, which also corresponds with the support for specific laws as it relates to reproductive health, because

people are concerned about their personal and sensitive data being collected and sold. And I think it's also going to get worse with AI because we now know that musicians and writers are concerned about their IP being scraped by AI. Actors and screenwriters today are actually striking because of AI. An actor doesn't want to go in, get paid 10 bucks to have some pictures taken of them and their voice taken, and they never can monetize their picture or voice or face ever again, right? And so to me that your face, your voice, your biometrics is your copyrighted material, and it's your personal and private data. And I think people will start saying, wait a minute, I didn't like how that person took my face and put it in a video, right?

I didn't approve that. So I think it's actually going to rapidly shift in the other direction, especially when generative AI kicks in and people are like freaking out about their face and voice being used in ways they didn't approve. So thinking about that from a policy perspective, I know you've done some work on. privacy policies and data policies. How do we, how can we enforce that? And is it, is it just fines? Is it, is it something else? What are what are the ways that it could go? Well, first of all, I think at the end of the day, we do need a federal privacy law. I mean,

it's it's ridiculous that we don't have basic rights over our data. I also think that now that one third of internet users are kids, that's where it's at right now, we really need to carefully look at, is it really healthy for our society and for the kids to continuously be tracked and have all their behavioral information be collected? If that happened in the physical world, that those people would be arrested as stalkers, but for some reason, we just allow the fact that all the kids sensitive information. And I think as we are very familiar with, that the personalization and leads down to rabbit holes and negative body images and other stuff that happens because of that. So I do think we need to have a rethink here, given what's happening.

And yes, as part of a federal privacy law, I do fully believe that we need some sort of agency, maybe the FDC or part of the FDC, that actually can provide some enforcement to give people the right to know what's being collected and the right to say no to the sale of their data. And I think that's really important for us to have. Well, I want to get into AI a little bit because you mentioned that, You talk in the book about AI bias, the wide-ranging implications of that. A lot of people for calling for AI regulations. But you also mentioned AI certifications, which I found fascinating.

Why AI certifications? Yeah, I mean, first of all, I want to be very clear that I'm not calling for, like, airline safety when it comes to privacy or AI where there's never a crash. I'm calling more for, like, car safety where you, you, you, you, you, you, you, you, you, you, you, you, You have to put the babies in the backseat in the baby seat. You need to have some basic emissions. You need to have airbags. And look at the innovation that's happening that's in the automobile industry right now with all the electric cars. So specific to AI, what I'm talking about is high-risk AI, right, which is AI that can impact people's lives.

I'm not talking about AI being used in a game or something like that. Now, specific to certifications, the finance industry has certified public accountants and certified financial audits and statements. And man, shouldn't we have something similar for high-risk AI where someone actually did some sort of basic auditing and the people are actually qualified to actually do the audit and have gone through some certifications themselves, just like a CPA. And then I also think we need codes of conducts in the use of AI, including industry standards. And so, for example, the international organization of standards should have, you know, certain, you know, qualities, codes and standards put forth as well. We do this in the real world, right, for different industries.

There are standards, you know, ISO standards and in the financial industry, we have financial statements, CPAs, et cetera. Well, we probably should do this AI, because AI is taking over that stuff, and we should apply that to that as well. Well, in terms of the AI bias aspect, of it with the large language models. Do you feel like there's a need to sort of examine what goes into those? Yes. So here's my take is that we just need transparency and food labels, right? Here's a story. A friend of ours, my wife and I, they have a high school kid, and she was told to write an essay, but the best way to get in college. She wrote an essay that said, I'm going to move to Montana and play the bassoon, kind of, you know, playing the demographics, you know, angle right there. And it was a funny essay.

And the teacher said, you didn't write this. This was written by chat GPT. Like, how can you prove it, right? Like, did she do it or chat GPT? She did really write it. And so from my perspective, we should, as consumers, have the ability to go to chat GPT with an image, a video, some text, and simply say, did you create this or not? Yes or no, right? A verification. That's it. or similarly, I'm on the phone, I should have the opportunity to hit 411 and say, am I talking to a human or a robot? Same thing on chat as well. So I think we should just have basic transparency.

Is it a human or is it a machine that we're dealing with? Or is this been created by a machine or 80% of this was created by a machine versus a human? So that's kind of the stuff that I'm talking about. It's like nutrition labels that we have for medicine. in and food. I mean, if we know how much, how many calories are in a whopper, why don't we know that, you know, if a certain image, you know, was created by A or not? I think this is just kind of basic rights. Yeah, that's fascinating. It was certainly change how students feel about chat GPT right now if they knew that it could be verified. I want to switch back and talk

a little bit more about advertising because, you know, things have been changing in terms of cookies and things like that. But I'm also seeing this increase in retail ads, companies like Walmart, Amazon. Kroger is now going to put ads on the freezer than the stores. So, I mean, the ad thing is just everywhere. Is there any good in this for the consumer? If we're being kind of sold to everywhere we go. It's good if we consent to that happening and we have the right to know our data is being collected and we have the right to say no. So it's just simply about having basic rights of saying, you know, there are some people that may go into a grocery store and they may want personalization

that happens based on their past purchases. And there are people that may want to get discounts if they give up their data. And that's perfectly fine. It just simply should be, I want to know what you're collecting about me. And at some point, I may want to say, say no, or I may want to limit that, yeah, you can use it, Kroger or Walgreen or Walmart, but that doesn't necessarily to personalize it. But that doesn't necessarily mean that you should have the right to go around and sell it to anyone with a credit card, right, to data brokers. And I just think in general, it does get a little scary if they start collecting sensitive data and selling it. So if I go into a Walmart and I buy over-the-counter

products, I don't know, if I buy adult diapers or pre-average. prenatal pills or things of that nature that may have some insight on my health, even though I may buy it for a friend or a relative or an elderly adult or a teenage kid or whatever. I'm not sure I want people having access to that information. So I still also think there should be limitations on the type of data that can be collected in Seoul. I don't want to walk into the pharmacy section and say, you know, oh, here's your, you know, something flashed on the screen and says, Mr. Kemp, here's your adult diapers you need, right?

You know, that's, that's crazy. So I think it's all about consent, knowledge, the ability to say no, and limiting the use of sensitive data about people. And I think it's interesting, too, that privacy is also now becoming a selling future. We've certainly seen it with Apple. Apple has spent a lot of money in their ad campaigns talking about how they're protecting your data. So is there a potential that it shifts back where you pay more for privacy or privacy becomes a selling feature, basically? I don't think you have to pay for privacy. I mean, it's like privacy should be an inalienable right, and we don't have to pay for freedom of speech and other rights that we have as well.

And again, the original business models of Google was contextual ads, right? They did great. And again, you can also do behavioral advertising, but do you really need to know my exact, exact, exact location, or can you kind of back it up by precise location by a zip code or an acre or something like that? That's kind of what we're talking about right here. And so in the case of Apple, they're doing a very effective job of differentiating against the other people. They came out with this feature called app tracking transparency or ATT, not to be confused with AT&T. And, you know, 96% of people turned it on. That tells you that there is a hunger for privacy, that people do not want to have third-party entities tracking them and selling the

data to data brokers. And Google should do something similar on Android. Do we really need to have all these apps leaking out our precise geolocation to conduct commerce? in the United States. The answer is no. You know, we don't need to know exactly within five feet where I'm at all the time. The scope of these companies is so massive. And that's one of the things you talk about in the book is the way that these companies have really squeezed out the competition. It's obviously what's happening with the Google case. Are there companies that are handling data in a way you admire and are there other ways that we can kind of encourage smaller companies, it's sort of a greater tech diversity?

Yeah, look, I think that the problems that we have with privacy and the problems that we could potentially had with AI bias and exploitation are exasperated by the fact that we have large monopolies who do not feel the competitive pressure to do things differently. For example, both Apple and Google charge 30% on their app stores, and they require you to use their transaction systems and charge 30%. In a normal market, the merchant pays what visa, 1%, 2%, you have to pay 30%. And so that is an example of a monopolistic practice that does not help innovation. And one way, in one area where innovation can occur is better privacy. Similarly, meta does not, and all the other ones, don't provide interoperability that they, once you're in their walled gardens, if you leave, you can no longer communicate with people that are in there as well. And so the motivation then becomes like, hey, you're kind of captive audience. So we're going to continue to

collect in mind more and more of your information as well. And so there could, be calls to mandate interoperability. Ironically, META scraped the crap out of MySpace, and that's how they got going. But if you try to do the same thing with META, they'll sue you big time if you try to do something similar to what they did with MySpace in the early days as well. So what I'm simply saying is that if we actually start having real competition, instead of being charged 30% for transaction fees and actually requiring interoperability, I think we will then see more competition that will lead to better privacy and cybersecurity for consumers. Well, you just mentioned the word that I want to talk about as we wrap up, which is

cybersecurity, you know, not just a big tech problem. It's a big everything problem. I mean, MGM, casinos had a cybersecurity problem this week. You're an investor in cybersecurity. What are you looking for as a cybersecurity venture investor? And what should investors that are invested in some of the publicly traded cybersecurity companies be looking for or be asking? Yeah, I certainly have ownership stakes in a number of public cybersecurity companies because I generally believe that protecting businesses and consumers from hackers is good. And also, I do small angel investing, right? tiny checks to two people in a dog, right? And so that's the size. So I'm not, I'm not a heavy roller venture capitalist or anything like that. I do what a lot of Silicon Valley people do,

entrepreneurs, which is, hey, my friend's starting a company, can you give them a couple thousand, $10,000 to get jump started right there? What I look for, when I do these small seed investments or angel investments, you know, I look if it's, hey, do they have great co-founders? Is the problem a, you know, is it a, how big of a pain point is the problem? Is it, are, is there a solution an aspirin or a pain killer? How big is the market, right? You know, you want to have a large market where if you make mistakes, you can still be successful. And how, how crowded is the market? Yeah, it's great to be in a billion dollar plus market. But if there's already 10 players that have already raised enough a lot of money there, then it may be very different. even if you have a better mouse trap as well. So that's what I look for in terms of my little tiny

angel investments. And then as it relates to the larger cybersecurity companies, I do think that if I were to give anyone of these companies advice, not that they're calling me up necessarily, I really think that they would, you know, they probably need to kind of more consider the fact that a lot of the attacks into corporations come from people's personal devices, their personal passwords. And so I think that the home network, because we're all working from home, and something that's on your kid's iPad could actually, you know, hop over into the corporate network or into your Salesforce or something like that. And so I really think that the shift needs to occur to also protecting the blurring between personal and professional usage of home networks, devices,

et cetera. And so I think that could be an interesting area. Oh, yeah, absolutely. It's fascinating to me how many of the big hacks start with exactly with something very small like that. Absolutely. I mean, look, 80% of breaches involve a password, like a stolen password or easily guessed password or someone was faked or fooled into giving their password. And then once they get in, then the hackers hop around. And so that is, you know, identity is the top attack vector. Because we're the, we as humans, are the weakest link when it comes to cybersecurity. Last question. I want to leave it on an optimistic note. In the five years in the future, maybe even 10 years in the future, how do you see data and privacy being handled in a perfect

world where you see everybody protected? What does that look like? Yeah, in a perfect world, we're able to use universal signals on our devices and browsers that pre-communicate as we visit a website that says, here's the security setting. So I don't have to go through. We're all sick of dealing with cookies, right? Like, do you accept the cookies? And it's like, blah, blah, blah, no, I just want to see that one article about my sports team. I don't want to spend two minutes like, do I want marketing cookies? Do I want analytics cookies, et cetera? So I'm hoping we can be in a world where we can have opt-out signals that express our desire for what we want to do. So that would be a great situation that we can kind of build privacy into the browsing as we go along. And I hope that we

continue to have greater awareness. Like we talked about cars, you know, before, that there is now a significant concern that too much data is being leaked out from cars. and there was even something about, like, hey, allegedly Tesla engineers were looking inside people's garages, right, and say, oh, this guy's got a really cool car next to the Tesla, et cetera. So I hope there's greater awareness. I hope there's a federal privacy law. And I hope that we start putting some guardrails around AI because I think this could spin out of control.

So I am on optimist in the book containing big tech. I actually provide things that people can do as consumers right now and then to protect themselves to reduce their data footprint. And then I also do provide specific roadmap for policymakers that they can follow to get us to a point where, look, we take advantage of the goodness of the large tech players, but we contain the downsides associated with it. And that's what I'm simply trying to get at with the book containing big tech. As always, people on the program may have interests in the stocks they talk about. And the Motley Fool may have formal recommendations for or against.

So don't buy or sell stocks based solely on what you hear. I'm Mary Long. Thanks for listening. We'll see you tomorrow.