E304 - Damnjan Jovanovic, Tech Educator, Explaining Privacy Tech to Lawyers and DPOs
[00:00] Debbie Reynolds: The personal views expressed by our podcast guests are their own and are not legal advice or official statements by their organizations.
[00:12] Hello, my name is Debbie Reynolds. They call me the Data Diva. This is the Data Diva Talks privacy podcast where we discuss data privacy issues with industry leaders around the world with information that businesses need to know.
[00:25] Now I have a very special guest all the way from Germany, Damnjan Jovanovic. He is a tech educator for legal folks.
[00:38] Welcome.
[00:40] Damnjan Jovanovic: Thank you Debbie for inviting me. I'm very honored.
[00:43] Debbie Reynolds: Yeah, well, I'm excited to have you on the show.
[00:46] I think when I learned about you I was very interested in what you do because part of what you do sort of overlaps with what I do. So I'm an educator,
[00:59] a tech educator for like a lot of people. But I've also done it for legal. So I think to me that's a very unique thing to do and I think it's a very important role that you do.
[01:10] But tell me,
[01:12] how did you get into doing this type of work?
[01:17] Damnjan Jovanovic: Yeah, I mean nothing in, in the life is a consequences. Right?
[01:22] So this, this has happened as, as like a stream of events. So I've been a developer for, for 20 years and in my last job it happens that I, I work in a banking and it's very regulated industry, especially here in Germany.
[01:37] Right. So we had the trainings every now and then and like we had like these repeating trainings about the data security and data protection.
[01:46] At some point I realized that the lawyers which coming to our company to train us about this issue don't receive the trainings themselves about the tech behind the legal.
[01:58] And then that idea start to roll in my head.
[02:02] But it wasn't that obvious until I run a pilot when I had a friend of mine in this like a pilot course and I saw how, how much she were amazed when she actually discover how the cookies works, like fingerprint works and all of these things.
[02:20] And then I realized okay, there is a gap I research a little bit over the Internet. I found out that there is no many things happening there. Like there is some businesses which doing this type of education but no one is doing that like a very structured or it's not like a full time job,
[02:38] it's more like a side hustle. So I just decided to be my full time job and I'm very happy about that decision so far.
[02:46] Debbie Reynolds: Well, I'm glad that you decided to do that. I think that there is a gap definitely. Right. Because I feel like people who spend their career in legal or other domains,
[02:58] they haven't had the time or the experience that you've had in technology.
[03:05] So being able to really explain that to them and connect it to the work that they're doing I think is really important.
[03:13] One thing I want to ask you about is being able to.
[03:16] You're saying you're a developer.
[03:19] I think sometimes people assume and that a person who's very technical can't break down a concept in a way that a person who's not very technical can understand.
[03:33] But tell me, how do you do that?
[03:35] Damnjan Jovanovic: Thank you so much for this question. I was laughing a little bit because this comes every now and then as a question because yeah, it's a stereotype but it's very well known stereotype.
[03:45] Tech people are so much into that they almost forget the beginnings, you know, like, like the basics and the concepts.
[03:52] I was lucky enough that I started my career in 32004 as, as an educator in a computer school. So I was teaching all kind of people, all kind of professions and all kind of ages about how to use the computer A and B, the programming languages, then the other softwares and that that was like very popular.
[04:16] So that's where I actually crafted my skills for education.
[04:22] And always like in this business you have to always stay sharp with this sort of educational or presentational skills because you always have to remember that people do not have all this context you have so you are progressing over your career but people simply cannot catch up always with you.
[04:44] So you always have to remember that. So for that I was using for example the internal presentation in a company when I would present the technical issues to the like non tech folks, for example going to the conferences.
[04:56] And this is how I actually stayed sharp in that matter. Like to still be able to breaking down the complex things for like in a simple term.
[05:07] Debbie Reynolds: Right.
[05:08] So basically your focus definitely explaining tech to lawyers, but especially explaining privacy tech.
[05:16] Exactly, to lawyers. So let's get into that a bit. How is that different you think than just explaining other types of tech to lawyers?
[05:26] Damnjan Jovanovic: Well the, the privacy tech is something which definitely makes their eyes, you know, grows bigger.
[05:34] Like they paying so much more attention to that because this is something they can basically relate. Of course there is a little bit of tech which I have to teach them which is not necessarily related to the legal questions.
[05:48] Like for example, what is the back end, what is the front end.
[05:51] But all of these kind of like make sense at the end of the story. All of these help us to better understand.
[05:58] So in general I found out that many of these people nowadays having the language Having the terminology in their hands. So that's not a problem. That was a problem. For example, 15 years ago,
[06:14] if I would ask a lawyer to examine HTTP request, they will probably look at me like I'm an alien. What I mean, so it would be.
[06:23] Nobody would expect a lawyer to know race vocabulary, but today they know it.
[06:29] So that part is not a problem. So I'm. Right now what I'm doing is I'm showing them examples, like live examples, a little bit of code, a little bit of browser behavior.
[06:40] So we go into the examination of the browser fingerprints and cookies and what's not. So they basically just connecting the vocabulary they already have with the actual execution. And then that's the moment which I love the most in every of my lessons.
[06:56] This like aha moment. Like, and I'm just structuring my lessons to always have this like a slow learning path and then like these aha moments every now and then.
[07:09] So it is live. How to sort of say like it's engaging, it's interesting. So. So you never, never go into the sleep.
[07:17] Debbie Reynolds: Yeah.
[07:17] Damnjan Jovanovic: After like a, like a 30 minutes of theory.
[07:19] Debbie Reynolds: Right. One of the things that really frustrated me about like cookies,
[07:24] the whole cookie thing, is that to me, the privacy issue,
[07:29] it's not just cookies. It really is people having technologies that can take people's data or do things that they hadn't consented to or agreed to.
[07:40] But how do you explain that? Because I think it's bigger than.
[07:42] Damnjan Jovanovic: Yeah, I mean that's the first lesson when we actually have to fight against the stereotypes.
[07:50] Because my first slide, I don't have many slides, you know, for my presentation because my presentation more like live coding. But the first slide of the cookies,
[07:59] starting with cookies are not bad,
[08:03] period.
[08:04] So cookies are not invented to be bad. So this is just the technology we invented. So you can log in nowadays without cookies.
[08:13] Like if you would like to log into, I don't know, your, your LinkedIn account, there won't be a way. Like you could log in once, but your browser won't remember the session.
[08:22] Right.
[08:23] So the cookies were invented to help us. And this is the first stereotype which we have to break down.
[08:30] Unfortunately,
[08:32] because of the nature of that technology,
[08:34] it won't pass long time till the marketing agencies, right in the 2000s, especially in the early 2000s, discover that they can put something in a cookie which can then track you all the way down.
[08:48] And they said, oh, so I can right now identify someone by cookie. Okay. Even though the person is not logged in.
[08:55] And then the third Party marketing agency discovered that and said like, oh, can we place a cookie on your website? And then the whole things start, started to get this like a negative rhetoric.
[09:06] But in a nutshell, there is a lot of this technology which is insanely useful. We have to repeat that. So for example, the fingerprinting itself,
[09:15] this is just one of examples.
[09:18] When I teach people fingerprinting, like at some point they all be like, oh my God, they are tracking us through our browsers whatsoever.
[09:26] And then I explain them that we used in the banking fingerprinting to actually prevent scam because the fingerprinting is giving me identification without cookies.
[09:37] So I'm able to see does the transaction coming from the same device or not, for example.
[09:43] So there is a lot of these things which have like a negative connotation and you know, like a negative tail behind.
[09:50] But they are basically invented there to help us to make our life easier.
[09:56] Debbie Reynolds: I like the way that you explain that. Right, exactly. So the intent initially was not to do these negative things, but as we're seeing, especially with new technologies that are coming up,
[10:08] people are giving more or sharing more information about them. Right. And that can become a privacy issue because they may lose control over the data that they have or not be able to make choices that they need to make.
[10:23] How are you introducing how AI, artificial intelligence is changing how people think about privacy and tech?
[10:33] Damnjan Jovanovic: There's that meme which says like generation which decline all the cookies right now, putting the darkest secret into the AI model,
[10:44] which I think it's somewhere true probably because the first problem which I see, and I'm explaining to the people, is that AI is not a black box as they sees it.
[10:56] So the cookies is much easier because you can do a right click if you're skilled enough, you can do a right click. You go to into the inspect. I know storage, for example, depends on the browser you're using.
[11:07] And you can see the cookies with your own eyes, Right. You can delete them and say like okay, goodbye, you're not tracking me anymore. With AI is very different story.
[11:16] Debbie Reynolds: Right.
[11:16] Damnjan Jovanovic: So we're looking like especially non tech people looking at AI as a black box as search engine used to be. Right. So you go to Google, you don't think about Google storing your search results or search queries.
[11:30] Right. And associate it with you. And at some point you just give up and say like okay, Google, you know my interest and you obviously serving me like a targeted advertisement.
[11:40] And I'm fine with that. But with AI it's another layer because what is the problem that's what I try always to explain to the people.
[11:51] Neural networks. Every neural network is cutting the information into the small pieces and then analyze them as a small piece. This is what we call the tokens. Right? Right. So for the simplicity of this example, I will just say that the one token is equal one word.
[12:07] Okay. And then let's say that I'm, I'm chatting with the ChatGPT and I say like okay,
[12:13] Debbie from Chicago, talk to me. And then I send that chat to ChatGPT and ChatGPT breaks it down. And right now words, Debbie and Chicago is sitting next to each other in that imaginary space forever.
[12:29] And that's the thing which people don't understand.
[12:32] So all our chats which being using for the model training stays there forever.
[12:38] And unfortunately the every new model is just stacking up the information on top of each other. So if someone at some point,
[12:49] for example chat with the chatgpt and uploaded my bill,
[12:54] where is my like bank details? That's staying in chatgpt forever.
[12:59] So right now if some hacker for example would ask ChatGPT, hey, can you give me an example of Damian's bank account?
[13:08] It will probably come up my actual account.
[13:11] As I said, the biggest problem with the AI is that people do not understand,
[13:17] you know, like the prediction mechanism. They don't understand the neural network and they just look at it as an old school search engine and just type anything,
[13:26] expect to be run against it and then they get result while it's very different.
[13:32] So our chats, especially the free versions are very used for the training of the model.
[13:37] I'm not convinced that they anonymize anything.
[13:41] Debbie Reynolds: Right, exactly. I always say digital systems are created to remember data and not to forget it. Right. And so these models are very good at remembering.
[13:53] Damnjan Jovanovic: Absolutely, absolutely.
[13:56] Debbie Reynolds: So what's happening in the world today in you know, privacy or tech or data that's concerning you most
[14:06] Damnjan Jovanovic: all right,
[14:08] definitely at the moment is wearable cameras.
[14:12] When I say wearable cameras could be implemented especially in so called smart glasses nowadays.
[14:18] Even though I'm slightly advocating for distinguishment between the smart glasses which is like so called perv glasses, you know, and the smart glasses which can potentially help people with disabilities, you know, like, because I would expect in the near future that we will have smart glasses like from the,
[14:39] I don't know, some, some sort of like medical producer versus the one from the, from Meta for example, in the recent years.
[14:48] So I see that as a biggest threat at the moment, like both for a privacy in general,
[14:56] because people could Be recorded without knowing. But that's not something new.
[15:02] Again, like, if you think about it,
[15:04] I don't know, like,
[15:05] did your behavior change? But mine definitely did. I was, for example, before 2000, I've been dancing a lot on the parties, you know, like just feeling free to do so.
[15:16] Nowadays I'm not doing that nowadays. I'm always looking. If someone is recording, you don't really feel free to do whatever you feel like because yeah, someone can pull the, pull out the phone and all the phones have great cameras on it.
[15:29] And with the smart glasses, it's just amplified,
[15:33] right? So this is the one thing,
[15:35] the other thing is that what they want to do with this data, and that's the big problem because text is being used to train the text models and they make it very, very successful.
[15:48] Right? So basically stole the whole Internet.
[15:51] They trained the model on all your emails, on all your probably the private messages in Instagram and what's not. And they right now have like a human like response, of course, because it's trained on terabytes of data.
[16:08] With these classes,
[16:09] they will have another layer of context,
[16:12] right? So they have a visual context. Because the AI models, the visual models are very bad if they don't have a context. So you can teach them to tell apart cats and dogs,
[16:25] but they won't call it cat and dog by themselves.
[16:29] Right. Because they need some sort of like a context to understand.
[16:32] And with these glasses is just like basically a solved problem for them.
[16:38] And of course, yeah, then like connecting to that, like to answer your question, about the biggest threat is that I see that potentially authoritarian regimes, and not just authoritarian regimes like we traditionally think when we say that, like a North Korea or something like that,
[16:56] like this, like a semi authoritarian regime, even in Western countries,
[17:02] I could imagine that they will use such a technology very soon.
[17:06] Debbie Reynolds: I agree with that and I share your concern with smart glasses. And I've actually been talking about this topic for many years. Right. So a lot of it is about what is captured and what is retained,
[17:20] right? So if you have a, a glass that's not retaining something or not capturing something, then that is not a problem, right?
[17:31] Especially I feel like a lot of times these technologies are created in a way where they're trying to push it as a positive for people. They're assuming that people are going to use it in good ways.
[17:47] But we know that people don't.
[17:50] That's just not realistic, I would say,
[17:52] to assume that everyone's gonna use things in positive ways. And so we saw this with deep Fakes as well,
[17:59] where people are like, oh well, you know, you can make a video, you're a filmmaker, you wanna make a video or whatever,
[18:05] a movie. Okay, yeah. But then what we start to see is that they start creating like non consensual images of people and really damaging things. And actually they say a lot of deep fakes are non consensual central images of people.
[18:20] And so I think you're right. That smart glass kind of add like another layer so you're capturing even more stuff like you say, more stuff that can be,
[18:30] not only can be put out of context, like you were saying,
[18:34] like let's say you're in a club dancing, you know, they could take your image and you're dancing, like in Mexico,
[18:42] you're dancing with a celebrity or something. So I think it's just a really crazy time right now in terms of how people are using technology.
[18:51] So I think privacy, to me,
[18:54] a lot of privacy is about context, right?
[18:57] So whether someone consented to certain things,
[19:01] what people want, their,
[19:04] how they want the data about them to be disseminated.
[19:08] And then also,
[19:09] and I want your thoughts about this. You know,
[19:12] certain, like let's say within an organization,
[19:15] let's say a hospital.
[19:16] So let's say a hospital has people's medical information is very sensitive,
[19:22] right.
[19:22] And so the doctor having access to that sensitive data is okay, because that's his job, to know that and help the person.
[19:32] But let's say someone works in the coffee shop at the hospital,
[19:36] they should not have your medical information.
[19:40] So that context really makes a big difference in terms of, of privacy. But what are your thoughts?
[19:47] Damnjan Jovanovic: Yeah, first, if you allow me to comment on something you said about the retention which,
[19:54] this is the question which come very often in my courses about the AI AI models and retention policies.
[20:02] Just to be clear, AI as a software. So AI is actually product of machine learning, right? And once we finish machine learning, the AI is a standalone software. So it's just standing somewhere on the server.
[20:16] It's a, it's a program. So we put an input. The AI needs our input only for a fraction of a second because then it's analyze it and gets the results and that's it, that's it.
[20:28] So they never have to store our chats.
[20:31] So this is the, this is the big misconception because people thinking like, oh, they needs a retention, but no, I don't need any retention policy.
[20:39] They always trying to sell us to us actually the retention policy as a benefit.
[20:46] So they say like, oh, but our AI have a Lot of your context and they call it context intentionally while it's basically a memory like however we call it, it's basically a memory.
[20:58] So your chat is written somewhere so you can call it context, internal memory, chat history, however you like. It's basically saved somewhere in a file,
[21:08] end of story.
[21:09] So. Yeah, but in general we can have ethical AI software which just gets your input, spills the output, that's it. Don't remember anything that could be example for like Google Translate or any Translate.
[21:25] I don't believe they don't save the data. But just imagine the Google Translate when you type something in English and then you get your results in Spanish and you forget about it and they forget about it.
[21:34] So everybody. So that could be also implemented in smart glasses or whatever you would like, but it's not what they're doing.
[21:43] That's the thing. Yeah, sorry to jump. Your question was about the context. Right. And you basically wrote a good example about the hospital.
[21:54] I was working in a different systems, so to say the one which is like more like relaxed when you can imagine that the guy in a coffee shop in a hospital would be able to somehow sneak a peek into the medical records.
[22:10] And I was also working in Germany when these things. It's not impossible to happen per se, but it's very, very regulated.
[22:19] So how it's regulated, right, it's regulated who exactly with which account can access what information.
[22:26] So not absolutely not more than necessary of course.
[22:30] So that's. I think that's. That's very important to.
[22:33] For people to be aware of that.
[22:36] But for me the second thing is like even more important and that's to be accountable.
[22:43] So I remember one of our training in online banking was like if you make any sort of a crime like a money laundry or something like that,
[22:54] you are responsible for it.
[22:56] End of story.
[22:57] So you will probably go to jail. Like there is no.
[23:01] That's what I hate in like not hate.
[23:04] That's what I don't like.
[23:05] Nowadays narrative people focus too much on a high company level, which I think that they should be responsible for everything. But we also have to think about the people who are working there.
[23:17] They also should share the responsibility about how they access the things.
[23:23] If they spot anything unethical, if they spot anything which is breaking the rules. So for example, if I was legally obliged by the German law and the police certificate had whenever I see something which look like money laundry to me, I have to report it.
[23:42] And then I read in news where the meta engineers knew about all sorts of things happening to don't use some swear words. And they would be like, oh yeah, we just spot it one day.
[23:54] Yeah, we had an internal discussion. Like that's. For me, that's unacceptable.
[23:58] So I think the responsibility should be also shared, not be on the same level, but should be also shared among everybody. So everybody, the guy in a coffee shop also should understand that he or she should not probably access this information.
[24:14] I don't know if that answered the question you attended.
[24:18] Debbie Reynolds: I agree. Right. So even with the smart glass example that we gave,
[24:23] right. If you're the person wearing the smart glasses,
[24:28] you really are responsible for the things that you are capturing. Right.
[24:34] And the bad downside of it is that not only are you capturing it, but you're uploading it to another company.
[24:42] Damnjan Jovanovic: Exactly.
[24:43] Debbie Reynolds: So it's like a double thing. So it's you taking the information and then also the information being shared somewhere else without the knowledge or consent of the person whose data that you're taking.
[24:57] Damnjan Jovanovic: Yep,
[24:58] exactly. And if we are talking about meta in particular, I can give you one interesting example about how much they pay attention to our privacy is that I was testing once.
[25:10] So before they officially killed the end to end encryption for the Instagram,
[25:15] I was testing with a friend of mine, do they read our message,
[25:20] for example, to train their model?
[25:22] So I created a secret website with a URL that nobody knows.
[25:27] So something very scrambled, so nobody knows. And I sent that site to my friend, I said, just don't click on it, just don't do anything, just don't open the message.
[25:37] I will just send you a message.
[25:39] And inside that website I put a script which records if someone clicks.
[25:45] Right.
[25:46] And you can imagine what happens. Like at the second, at the very moment I sent that message, the two metabots immediately accessed the link, which means A, they can read the full message.
[25:58] B, they did,
[26:00] they basically read the message, they scanned the content.
[26:04] So afterwards after that, like periodically the metabots will visit that link to see I don't like if there is any changes or anything.
[26:12] So that's what I wanted to send as a message to the people who are, as you said, like not just recording the things but also sharing with other companies. Like to always be aware that there is someone down there.
[26:28] Like Cloud is just a computer in someone else room. Right. So you don't always keep in mind whenever you share something with,
[26:38] I don't know, big companies or small companies, whatever,
[26:41] someone will have access to it.
[26:45] Debbie Reynolds: Right. So I think people think, oh, my email has a password so only I can look at it or Ah, yeah. Or I didn't do it. Right.
[26:54] So I was like, they gives people the idea that your things are private or secret or that it's not being shared in other places. That's totally not the truth,
[27:04] of course.
[27:05] Damnjan Jovanovic: But then the spam filter works if they don't read your email.
[27:09] Debbie Reynolds: Yeah, right.
[27:13] That's so funny. Oh my gosh. Oh my gosh.
[27:17] Well,
[27:17] Damnjan, if it were the world according to you and we did everything that you said,
[27:23] what would be your wish for privacy anywhere in the world, whether that be human behavior,
[27:30] technology or regulation?
[27:32] Damnjan Jovanovic: Hmm.
[27:33] Okay, I have to think a little bit about that because I mean, I do remember the time when we had our computers and computing power with us.
[27:48] Right. You probably also remember that you would go to the store, I don't know, you will buy your MacBook for example, and then you will have a CD drive and everything is yours on your machine, all your photos and everything.
[28:01] And then we slowly starting to outsource all of this to the big techs. Right? So sort of we had that time when we were like private in a digital world, because the digital world was literally on our desk.
[28:17] However we think about it. And then as soon as we start to outsourcing this, like today I see all my devices, like a phone and the computer as like just a viewport.
[28:27] So I'm basically all my files and everything is somewhere there and I'm just looking at them through my laptop. I don't even care about the processors, you know, nowadays. And I don't know like all of these numbers because like nobody's doing computing anymore.
[28:42] They're machines.
[28:43] So. So yeah,
[28:45] I'm talking about this with a little bit of nostalgia because this is the time when we had that.
[28:54] I think there is no way back because the big companies created the mega machines and megastructures, which is definitely more powerful than our computers. So we want to use that.
[29:06] Regulation helps a lot.
[29:08] Regulations is something which we talked inside the IT circle for a very long time,
[29:14] even before the gdp, GDPR and all of these regulation, which really changed the landscape of the it.
[29:22] Before we were talking about that because we knew that we are collecting so much, we are doing so many crazy things and people have no idea, like literally zero idea about how these things works.
[29:35] So we knew that something is going after us and definitely it comes. So regulation helped.
[29:41] But I think that the education is still the only way to bring the people to the level that they understand and they doing the informed decision sort of. And I don't believe that Cookie banner is informed decision.
[29:56] Like the cookie banner is like, it helped because it pushed companies to actually be open about it. So, yeah, we are using or not using cookie, whatever,
[30:08] but at some point people just start to doing what they are doing with the next finish, like accept all just going for a default button and accepting whatever it is.
[30:17] So they're still not doing the informed decision at the end. I think. Yeah. Everything somehow gravitated toward the education of the mass.
[30:27] For example, my son, he's third grade and in his school he had classes about that. I think that's a very, very good first start.
[30:36] He had classes about the deep fakes, about the fake news propaganda and these things.
[30:41] And I would love to see that
[30:43] Debbie Reynolds: more broad sort of say,
[30:46] oh, wow, that's incredible. Yeah, we need that.
[30:51] I think kids do need that education because they're interacting with technology every day and they may not understand what it means in a way that maybe an adult,
[31:00] even adults don't understand. But I think just having that education layer is very important.
[31:06] So. Excellent. Excellent. Well, thank you so much. I really appreciate you being on the show and sharing your insights. This is incredible.
[31:14] Damnjan Jovanovic: Thank you, Debbie. I had such a great time. Thank you.
[31:19] Debbie Reynolds: Me too. Me too. Well, we'll talk soon. Thank you. Thank you so much.
[31:23] Damnjan Jovanovic: Thank you. Bye.
