Welcome to Tech Talk. Bye.

Hi.

Thank you very much. They put the hold on with carpet tape, which is surprisingly painful to take off.

them? No. This is a funny thing. So, I live in and burlesque here is a huge deal. It happens once a year. It's called the hottest show in town because it sells out in four minutes. And we have five shows. Like, it's not it's a big deal here. And part of the deal is we have these professional, and they're for social media, they're for the program. They get put on these like really big beer bottles or like our little souvenir. And so I posted these because right after the show had happened. As soon the show was over, I posted the ones you're talking about with the tassels. And I did it public in part because I got such a great response from the show. So I was really nervous. It's my first time doing burlesque, and I did a tap dance to postmodern jukebox's jazz version of song song. And I was really nervous about it, but I got this, like, amazing response to screams and the cheers. I got a standing ovation. It was pretty rad. Congratulations. I thought to myself thank you. And so I thought to myself, I'll post post in public. Most of my friends and people are now on ice, but just because I was off this wave of, okay, this is fine. We can do this. And it was a couple weeks later, maybe like a week, week and a half, that I just one afternoon at, like, 04:30 and on a Tuesday, I got this message on my Instagram that some kid who I don't know had found it and had posted hashtag of these week.

Yeah. It was it was now I put some hashtags, some body positive hashtags on the photo. Okay. Not too many, but, like, a couple. And I think that's how they found me. So this is somebody who had it was a private profile, but but it did have enough clue to figure out who it was. Okay. It's not somebody I know. It's someone I've never met, who has no connection to me or anybody I know. So it's not even a friend of a friend. As far as I can tell, it's somebody who was going through hashtags purposely to troll. So they went out looking for body positivity hashtags

Well, I have this habit, and it started a few months ago. I have this habit of when I get, abusive comments or when I get messages, like, an unsolicited dick pic, which I get way more than I wanna talk about. I have a habit of just posting in public. Because in my mind, if someone sends you that kind of stuff, usually they are anonymous profiles. And so let's bring it to their house. Let's make them own this. And generally, what happens is you do that, and then it goes away. It's it's often an apology immediately. There's sometimes begging, but it goes away. And so that's what I do. This kid, this one comment I posted up being like, let's talk about Dan Girl on the internet for a second. This guy kinda sucks. There. Don't feed the trolls. Right. Well, this morning, I woke up though, and I had dozens of Instagram notifications because this troll had gone away. And he found other trolls, and they come back. And over the course of the evening, had spent had gone back through years within my photos. Wow. Really serious comments on all kinds of stuff. And they wasn't just hitting ones of me. It started with the photos of myself, and they had, really misogynistic comments. They were calling me a feminist like it was a bad thing on photos of me from the women's march. They were making comments on a video I put up of a turkey at Christmas dancing to fat bottom girls because I make turkey dance every holiday. I mean, what's this really awful stuff? And and in the middle of that, one of the comments was, you should kill yourself and eat your own blubber. And it was a sort of the sense that I should never eat again. I didn't have a right to exist. I'm disgusting. I need it to go away. And that's when everything kind of went down. So I woke up, and I was like, this is overwhelming. And before I even could kind of figure out what I wanted to say, my glitter army had arrived. And this is the great thing about burlesque. Burlesque has introduced me to the community of women who are deeply supportive and are into it, and wanna make sure we feel safe and protected. And it's and we are covered in glitter. Like, legitimately, that's a real thing that happened. There was even glitter in my act, and I'm still finding it all over my house. Oh, I I hate to admit that I have had glitter experience as well, and that is gonna be with you for a year, at least. Oh, no. No. The bar we do, and we do it at the top night in Yellowknife, and the top night is permanently imbued with glitter. It will never come off. So we are literally dripping glitter all the time, like we've dunked ourselves in molten unicorns. And before I even could think of what I was gonna say, these women had shown up and done this. And then it kinda spread. It wasn't just my burlesque friends. It was people I knew in high school. It was friends of friends. It was people I knew when I lived in Qatar. It was all these other people getting together, and they weren't just kind of tearing this person down, although that was happening. They were also making sure to remind me that I was okay. That these photos are great. My performance is awesome, and I'm fine. And that was a really cool thing. But then in the middle of this, one of my friends, who's sort of a dark wizard of the Internet, messages me and says, hey, so I know how to Google, and I found this kid. Do what was it, what you will. So she had on one of the troll profiles, I understand there's three trolls actively involved. He had his name, and she had gone and found him on Facebook. And then from there, we found his dad, and from there, we found his dad's work email. And some comments they were saying, we figured out they were teenagers, we figured out what school they went to. And so I crafted an email, very professional email to his father, at his father's work account, and to his headmaster.

Well, the guy got right back to me. And first of all, I was really conscious of not wanting to dox this kid. And doxing is when you kind of spit on the Internet all this personal information, and you just sort of sprayed on it everywhere. And that's a really negative thing. So what I did was that email has done that email has said master and said, listen, this is happening. This is who I think it is. Are you connected to this person? I can send you screen grabs. And they both got back to me and said, please do. And initially, the father was very supportive, and then it kind of he doubled down. It was almost he made this comment about how he really thought nobody's parents be impressed by this bread. As if the reaction of my friends and myself to this bully was equally a problem, that we were somehow being mean, to this this person even though they thought me out, they tell me to kill myself. And then because I didn't take screen grabs of everything, it was overwhelming. And so now I've learned something. Screen grab the crap out of absolutely everything you can because I only taken a couple of screen grabs. And by the time I realized this was gonna get so big and went back to get pictures of the really expensive post, they've been taken down. Because we've reported Instagram and Instagram had taken the countdown. So I didn't have post of who had said what exactly. I didn't I wasn't sure who had said what. And so that was from saying, you know, you should keep your Instagram private if you don't want this kind of comment. On the other hand, the school took it very seriously. And this is we said something about online behavior having real world percussions. Well, the thing is, if you're bullied online, that has a real world percussions repercussions for you. So I'm gonna say that again. The thing is, if you're bullied online, that has real world repercussions for you. You you have to live with it. It's in your head like a horrible mind ninja. I'm 32 years old actually today.

Back thank you. It's still in the back of my mind. But, oh, god. If I perform at the Ice Castle in March, people are gonna laugh at me. People are gonna call me a land whale because that's what I've been seeing on the Internet. And so for me, why do we let that happen? Why do we say the only person who gets a real world repercussions from this is the person being bullied? And more importantly, this is a teenager who's doing it. He's 15. He is doing this to other people. What if he did this to a 15 year old girl? That's who the school needs to know about. Because those kind of repercussions are not just gonna be a moment of pause, or am I gonna get my boobs out again and world them around. It's gonna be if I was a secure, if I was younger, it's going to be, I might actually kill myself, or I might actually hurt myself, or it's gonna change how I do my life. And so that's what we contacted the school, and they were really great. They came back and said we're having an investigation, which they did, and they found it with three boys involved, because they've been suspended. And they took their phones off them, and all of the accounts have been deleted. And the school is taking it very, very seriously,

No. I was gonna say it wasn't quite the end of it because in the middle of this, I knew that the boys something had definitely been there had been a repercussion because I started getting threatening emails. So I got a couple of emails from somebody threatening to dox me, because I've done this. And the point they're making was because I didn't have quantifiable proof of absolutely everything that was said, because I didn't have that death threat or that the the plea to kill myself in a photo that I could show them that everything I said was a lie. And the extension that was that if that was the only thing that was so offensive and everything else they said was fine, and because I couldn't prove every single comment from every single account, then clearly, I was a liar. And that's what it was really troubling. The idea that we're gonna put the onus on somebody who had their entire Instagram blown up with abuse to prove it. And that's just been very awful that the mindset of that person, and and because where we're going as a culture that says, they feel confident that anonymously they can go back to the media outlets who picked this up and accuse me of lying, and they believe that. Yeah. On their on an anonymous note, I whatever I said, whatever a woman said, whatever the victim said, wouldn't matter.

Yeah. Just to remind yourself, like you said, this isn't how it has to be. I think, now I did read some of the comments, and then I realized it was really bad for my mental health. So when I started going around, there's been a lot of comments, and most of them have been incredibly supportive. And I've had so many private messages from people saying this made them feel better, saying this made them feel stronger and supporting me. And, yeah, I have lots of troll, but I've also had a lot of people kinda going, oh, you know, the world is a mean place. The Internet's a mean place. Like it or get off. It doesn't have to be that way. We get to decide what kind of world we live in. We get to decide how what standard behavior is acceptable on the Internet. I am a proponent of free speech. I think Visa is wonderful for its opening up of information, for its opening up of discourse at the same time. If all we do is if all the decent people block, delete, and make their accounts private, what we're doing is we're saying that the trolls of the world, the pepe's of the world get to run it, and they get to that they've won. What we've told them, and here's my issue too. If you don't say anything about it So I have advice. If you are being bullied, I think you need to understand it's not about you. It's about them. This is about power. For me, I was attacked from my I was just my very last service. And I think what it was doing was you're saying, I wasn't gonna play this game that says, I am not allowed to like myself. That I have to get someone's permission to not hate myself. Being a bigger body in our culture and not actively hating myself is an active resistance. And what that does is it shifts the power balance. It's saying to somebody else that maybe they don't get to control some else's behavior. They don't get to set the terms, and that's really scary to them. So what even about me? I would have gotten these if I was skinny, if I was fat, if I was tall, if I was short. It didn't matter. So that's the number one if you're being bullied. It actually isn't about you, it's about them. Number two, I also have this thing, if you're seeing it happen, the amazing thing about my little army was that they supported me. They came and told me I was okay, and that's what we need. Because if you're silent, that helps but doesn't help the oppressed. It just helps the oppressor. If you're silent, you are passively saying this is okay, and you're taskly condoning it. Even what you're saying is, you know, I don't wanna get engaged with this. The puppy is it's awful. Trolls will be trolls. Boys will be boys. I'm just gonna go away from it. What you're saying is that you agree with it. By not disagreeing actively, you are condoning it. And so I give you a responsibility as adults particularly and as forward thinking adults with people who like things like equality to actively make a point of going out and drowning this stuff out with glitter. You just need to, yeah. Like, delusion. I love that. Yeah. Wonderful goodness and happiness. And that's possible. It does happen. And I think, wouldn't it be amazing if if you're being bullied online, you could hashtag glitter army, and a bunch of strangers you don't even know will come down and tell you you're awesome. It is much easier to ignore the horrible bad stuff when we're reminded of the good all the time. I'm reminded of that mister Rogers quote about always looking for the helpers, and that's what we need. We need more helpers. And so my biggest advice isn't to the bully. My biggest advice is to people who stand by and watch it happen. We have to get up, and we have to get loud. And I say that goes into the bullying. I feel that way about any political issue. We're in a very scary time. I'm north of the border, and we're still in a very scary time. We have to start saying what we want, not just being silent on what we don't want. That's a great point.

Well, a crappy Instagram code, you see. So if you just if you just report it, you got nothing. You might have a couple days. I know when I reported a few abusive accounts on Twitter, it took forty eight hours before I shut them down before they got rid of them. And that's a problem because in forty eight hours, this person can do a whole heck of a lot of damage. Instagram, if you repost and tag Instagram, it's it's gone within minutes. I did have social security, the whole account to fact shame me and, like, all of that. I reported it within, I think, ten minutes it was gone. But again, this is a thing. In order to force Instagram to pay attention, you have to be willing to own this. And there's a lot of shame attached to that. I think admitting you're bullied is a really hard thing. Absolutely. Because you're secretly worried, like, what if people agree with it? What if other people side with the bully? It it just never occurred to them that I'm fat, and maybe now that the troll has pointed it out, I suppose a hard thing to do, but if you can, that's the trick. And I think it's not just for shaming the bully and making them own it. Because, again, nobody goes home at the end of the day. And sits around the dinner table and gets back, you know, what did you do today, honey? Well, today, I told somebody to kill me. So it's on the Internet. Pass the piece, please. Like, that doesn't happen. So we have to make them own it, but we also have to make these platforms own it. Because these platforms are not consistently enforcing their their rules. I look again at the great nipple gate. So that the female nipple may never ever ever be on Instagram, but boys can have them every which way. I look something that happened with an Inuit up here in the North recently that she posted a picture of a sealskin parka with a hashtag suck pita. And she she had a whole Facebook account taken down and had to have it reinstated.

It's America. Here pretty regularly. I would like to wear a seal if I could. So my point in here is that it's not actually that seal, but yes. My point is that just as we have to make the trolls own it, we have to make these platforms own it. Because I think, again, they are tacitly this behavior and this kind of action and this kind of thought. And it's a very slippery slope. It starts with fat shaming. And before you know it, we have people who run Breitbart and calls of power. And these are issues we need to talk about. It's not alternative

Oh, gosh. Yes. So, Oscar, come on. We'll hopefully be dancing at the ice castle because we build that. Every year, the Snow King build the ice castle on Great Slave Lake out of ice made from Great Slave Lake and for the whole month of March is a big festival there. So I will hopefully if they can manage a way to let me tap on ice, I will be dancing there, followed by I will probably be hopefully dancing at in the summertime, burlesque gayer cousin.

Thank you so much.

Not true. It's because he's brilliant. It's also the best way to know what everybody else in the organization is working on. That's a good point. There we go. So data deletion. This is a topic that probably most companies don't wanna talk about. But why do we think it's important? Well, so, a, I I think you'd be surprised. I think a lot of companies actually do wanna talk about this, but they wanna do it at something like a a 10,000 foot level. Okay. Like, the issue is the real challenge is that your deletion practices and and your thinking around deletion, it really varies based upon your business model and what type of information you're collecting. This is something that a lot of companies are having a lot of trouble with. We've we had no shortage of conversations with companies that have these sorts of things, and then you try and get them to go on the record or say or say what they're doing, and they get really sort of squeamish because there's a lot of complexity from a technical level and then just a lot of legal and policy complexity. I I guess I should say that this effort sort of emerged out of work that CT was doing last year with Fitbit, around ethical r and d, and, you know, the wearable giant that they were also interested in what they should be doing around all the information they collect. And you can sort of imagine that, you know, they're collecting health data. They're collecting consumer data. And then, you know, as a company, they're just collecting a lot of information in the course of their day to day business practices. So I guess and and I I I I I suppose the reason deletion is really important, and and hopefully, I don't get in trouble for saying this in a digital the digital world we live in. The fact of the matter is not all information is worth keeping. And I I guess I sort of wanted to give a quick little anecdote that didn't get into the paper. So the National Archives and National Archives and Record Administration, which gathers all of the information from the federal government, if you think about all of the information that the federal government collects and it or creates its agencies, this is millions, billions of different documents. And of all of those documents, of all of that material, it really only saves one to 3%. One to 3% is all of the information that ever gets stored permanently with the archives. You know, and, you know, for a long time, this was just a matter of space. You have to put the information somewhere. You're going to have Indiana Jones esque, like like, storage facilities full of things. And now we live in a digital space where everybody can collect and save everything. And so deletion is just important not because I think there and I think if you read our paper, there aren't right or wrong answers here, but it's just really important to be thinking about.

The maybe. Yeah. There there's plenty of other things. So one of the issue is and this is sort of interesting as a lawyer is there's actually a lot of legal incentives to keep information. So, you know, if you think about it, a lot of compliance activities nowadays require you to have records of x, y, and z. Sure. And and so that sort of just incentivizes companies to keep things forever and ever and ever. It's also frankly sort of hinted this at the top. In our digital world, it's cheaper and easier to just collect everything. You know, this is I I hope not too folksy, but I think about sort of when I was a kid, you know, all of my book reports were on paper. You know, I wrote them down. At the end of the year, my parents only let me keep the ones I was most proud of. Everything else got thrown away. Now you think about just our our day to day work product. I keep a 100 different drafts of a blog post I create at CDT.

really implement strong data deletion policies and practices? So I come at this, and and I I have to say this was a team effort. Vijay and Michelle did a lot of work on this paper. They're also on our privacy team. And I think we all came at this from slightly different perspectives. I come at it from a law I'm a lawyer, so I come at it from a legal perspective. And at the same time as laws have sort of encouraged companies to keep information, law also creates a lot of risks and costs. One of the one of the real concerns that came up over and over again with companies, is just sort of ediscovery costs. There was a RAND study that sort of suggests that the average cost to collect, process, and review one gigabyte of information is $18,000. Wow. Most companies, as you imagine, have more than have many, many gigabytes of data. And if you get involved in litigation, you're going to have to produce that. The lawyers are going to have to look at it in six minute increments. So that's really problematic. Then and this is probably more familiar to to listeners of the podcast. There is the, you know, the world of data breaches, data security. You can't lose as the FTC has has said many, many times, you can't lose what you don't have. And, you know, an example that we sort of highlight in an addendum to the report is is the infamous Ashley Madison case now, where, you know, this was a company that had many, many problems, but they actually, you know, promoted the fact that they had a deletion service, and that, you know, if you wanted to get your information out, you could. And then they actually didn't back that up with, policies and technologies to actually get rid of the data. That that's really problematic. I think, unfortunately, we sort of live in this universe where, again, everybody's been incentivized to collect everything, but not enough thought is going into deletion. A more recent example of this that's really interesting and just sort of shows the oversight that it can exist, is if Uber Uber got in a lot of trouble, for, you know, during after the the, Trump administration's Muslim ban, there was, there was a transit strike, and there was a suggestion that Uber was breaking that strike. You we can argue about that, but it created this hashtag delete Uber moment that got people deleting their Uber app, which is with you know, for better or worse, is should be within the right of of a user. When people tried to go ahead and delete the Uber app, they found that there was no automated process for doing this. And in fact, Uber had to manually go in and to have someone delete their accounts. Yeah. That you know, I can understand why Uber would not want its users to be easily able to easily delete things. I can understand why, you know, it's a wonderful service. Why would anyone ever wanna delete your Uber app? But when the day comes that people want to leave and people, like, expect their information to be gone, Uber found itself unable to do that easily. So are there different ways to delete? I mean, you kind of started to touch on it there. You know, can anything ever really be deleted deleted? You know, and this whole, like, there's third parties with access. You authorize this thing. Right. Is it easy to delete? I mean, if one company deletes data, is it really gone? Or No. No. And that's part of the challenge. I mean, again, I I think I I feel like we should make one thing think here, and I hopefully, you'll get yelled at for saying this. But I will yell at you. Well, I'm saying I'm saying so read viewers of this or listeners to this podcast, when they're trying to delete it, once they've listened to this wonderful back and forth between you and I, they have to understand that that information has not been removed. It's simply been deindexed. You know, when you're emptying your trash can on your desktop computer, that information hasn't been deleted. It still very much exists, on your computer. And as a fact, like, it's actually gotten much, much easier to get that information back. There's sort of, documentation from the Department of Education's privacy technical assistance center, that's sort of just warning that modern data storage technologies are incredibly resilient, and the ability to get information back, is is is much, much easier. So, you know, how do you ultimately get rid of of information? Well, in our paper, we go through a couple of different methods. There's, you know, what's called soft deletion where you're d n d n indexing files, that's not really deleting the data. Alternatively, you can do, overwriting, which tends to be the the general process of of think about it in terms of, you know, you have a white wall, you paint it red, to get it back to white. You're going to paint white layers over and over again. So overriding is a is a general practice that I think anybody involved in the data deletion game, if you will, is aware of. But then you get into what sort of overwriting is good enough. One there's there's many different methods and algorithms that are deployed to, you know, overwrite your data with a certain combination of ones and zeros. The the Gootman method, for example, overwrites information 35 times. Wow.

Yeah. It is a lot. You know, there's a lot of argument about whether that's a you know, whether at that point, you know, you've gone above and beyond. There's questions about, however, if you're overwriting just once or just twice, is that good enough? But the more you know, obviously, the more times you overwrite, the more effective it is, but you're adding costs and time and the ability to actually get rid of this stuff. Another obviously option is to just destroy something. You know? You can you can, it it's tough, but you can, you know, destroy your hard drives. One thing that we talk about in the paper and an idea that that I I think we should pro people and people should be promoting, is the notion of deletion by encryption. That is, you know, you should offer your users and companies should get, as a matter of course, be deleting their information or sorry, not deleting their information. Yes. They should be deleting their information, but encrypting their data and then throwing away the key.

Please do. So I guess our our top one is and this and I almost have afraid that this is maybe too simple of a suggestion is basic auditing. Auditing is really, really important. And in in some respects, I think a good data deletion practice is in many respects like spring cleaning. What we would love to see and and, frankly, what we've heard, some internally from some companies how they go about this is, try and categorize inventory your information. And then when you have a dataset, try and figure out try and ask yourself, a, what's the value to this dataset? If your only answer is, well, there's a hypothetical use case, there's a potential value, that's not really concrete, and that sort of suggests that maybe you don't need to keep that. You know, if all you have is a a big what if, maybe the information really isn't that valuable. Alternatively, what we thought what people repeatedly suggest was an interesting idea is simply evaluate how long it's been since your information has been accessed. If you haven't looked at certain datasets for a certain period of time, that's also suggests it's not valuable.

You know, again, encryption, please. Pretty please just do it. Internal access controls, and this is both a technical and policy an administrative thing. You know, we talk in a paper about employee training, and everybody talks about employee training. You know, employees everywhere can be the source of data breaches and all sorts of problems. At the same time, we sort of found that there's there's a lot of skepticism. And as a practical matter, I think even, like, CET, we're a lot of tech minded folks. If you if we were to do an internal data deletion training at CET, the amount of things I think people would take away would be pretty minimal. So you really have to think about it from a technical capacity. Another idea that was that people suggested was think about having an archivist archivist and explore what your data deletion policy is from from getting a wide range of internal stakeholder input. So, you know, not just the lawyers, not just IT. Get a lot of people into a room thinking about what data is valuable and then have an archivist position that actually sort of thinks about this further. And then I guess I would just say sort of say, finally, it's really important to be thinking about this on the front end, not the back end. You know, we think about in the paper and in general, we talked about data life cycle management, and deletion comes at the end of the life cycle. You're deleting the data. The problem is it's much easier to think about how, why, when, where to delete the information if you're thinking about it at the beginning when you're collecting it. And, again, maybe that's maybe that's simple advice, but that's that is advice that came up over and over again in our consultations, and it's something that we hope to sort of inject into the paper. Great. Well, I asked for one or two. You gave me five or six while I've done it. Cheated.