You lucked out to have an afternoon session when you could be wide awake after lunch and everything. Today we're gonna talk about GDPR. So if you're not looking for GDPR topics, then this isn't the right presentation for you. Wanted to mention first off that there's some contribution sprints happening this Friday and this is, it's real exciting to take part in sprints if you haven't done it before. So if you're around this Friday, definitely check it out. And there's actually something for everyone. So even if you're not a developer, there's documentation that needs to happen, other things like that. So if you just show up for the sprints and ask for help, the community is always willing to help out and get involved and help first timers and that sort of thing. So feel free to take part in that. Also wanted to mention the upcoming Decouple Drupal days. This is August 17th through 19th. And this is an exciting event focusing a lot on decoupled. But just kind of the future of that part of Drupal. And so look for more information to come out on that soon as far as submitting your sessions, but also just attending, registration, that kind of thing. So it looks like an awesome event. So my name's Dawn Alley. Both Shrop and I work at Media Current. Media Current's a full service digital agency. We work on helping our clients get the most ROI out of their website. And my team, as the digital strategy team, we focus on the content, the data, and the growth part. So GDPR is near and dear to me because I'm one of those people that, I love to chew through data. Like the more data somebody can give me, the more personalized and experienced it can be. So this has a huge impact on the day to day of my team. And I'm Mark Shropshire and I'm the open source security lead at Media Current. And because there's open source in my title, I really have a passion for open source things. Is he first the title or the passion? Maybe both. Okay. It might be a little bit, but I really do have interest in GDPR, other regulatory type things that we have to all work with on our applications and websites. So this seemed like a natural thing for Dawn to kind of take this forward and chat about it today. So two different perspectives, but hopefully it'll give a well-rounded picture of the things that we're gonna look at moving forward. So some disclosures. Y'all, the GDPR is a really, really long document and trying to smash that into an hour is not really possible. We're also not lawyers. So our job today is just to talk about the scoop about the GDPR, some key concepts, talk about the spirit of the law, but we don't replace your lawyers. Like you still have to go talk to the legal side of things to get the full picture. Okay. And today we're gonna kind of just brief through the agenda. We're gonna talk about the guiding principles of GDPR. So just at least a nice outline of what GDPR is about, creating a positive privacy experience, security by design, those some of those concepts, advanced marketing strategies in a post GDPR world. So how do you take these things that you apply to GDPR and how do you actually still do the jobs that we all have to do, the take the tasks we need to do that's important with marketing? And then really important is to make sure that we don't freak out. The deadlines coming, but that we actually have some tips and stuff to help on how to plan for it and how to start today. I'm sure everybody's ready to get to work today after the con. Don't forget our after party though, but we'll talk about that later. But... The action plan second. Exactly. So there is, if you just step back, there's some definite things you can do to move forward from today. And so we'll kick off in the guiding principles of the GDPR, the general data protection regulation, which sounds really fancy. I'm very serious. So who's heard of the GDPR? Who's read the GDPR? Oh, nice, that's awesome. So you can think about the GDPR as a broad set of rights that really focus on protecting the data of EU residents. And that's gonna replace the 1995 data protection directive. So it's known as one of the most important changes to data privacy in the last 20 years. And we're thinking it's gonna impact at least thousands if not more of organizations worldwide. The spirit of the law is really to give users rights to their data and put that ownership back in their hands. So this is greed upon back in April 2016. And you may be asking yourself, why are people talking about this today? And why are things really heating up now? Besides procrastination being an answer, because it is, we have to be compliant by May 28th of this year. I think a lot of businesses were just waiting to understand how the regulatory process would work, how the enforcement would work. And like with anything, there's a broad spectrum on how you can interpret these kinds of regulations and laws.  Will there be more data coming? And there's still a lot of unknowns, but there's a lot of things that we can take a step forward with today that we do know about. So who's at risk for compliance? If you can say yes to at least one of the following, you should be thinking about GDPR. Do you have international traffic on your website? Do you have CRM or marketing automation platform? Does your site use analytics like Google Analytics? Do you have cookies? Does your website collect personal information? And that could be a contact form or it could be a credit card. It could be very deep. And can users log into your site? And I swear, these are trick questions. The long story short is, yeah, this could impact just about everybody in some way, shape, or form, and should at least take a look at it. So the GDPR isn't just an IT discussion either. So some stats that I pulled through, 89% of companies believe that their competitive advantage is gonna be based on the customer experience, and a strong privacy experience is interchangeable with customer experience in a lot of ways. Consumers are managing 85% of their relationships with enterprise companies without talking to a human being in 2020. So data becomes a huge part of that. In 2015, 43% of cyber attacks targeted small businesses, and then 3.8 million is the cost of a data breach for the average company today, and we anticipate that going up in 2020 to 150 million. So this is one of those topics that it really transcends just IT, it transcends just legal. You have to bring your marketing team, your sales team, your content teams, everybody involved in the conversation. To create that strong privacy and customer experience. All right, so now we can talk a little bit about some GDPR specifics. If you read, so I didn't see anybody that said they read it. I'm sure some people have read part. Okay, some people read it, awesome. I wasn't looking, obviously, I just said a statement. Yeah, so those of you who did, one of the things I noticed when I read through it was immediately there was a lot of information about you see supervisor, authority, controller, processor, data protection officers. So who are these people? Who are these roles? I think it's good to have a little bit of a basis for this. So the data subject at the center, that is the person whose data we're talking about, the person who is gaining rights in GDPR. It could be, it's an individual, so it's the person that you're trying to protect with GDPR here. And then supervisory authority, that is an appointed public authority for an EU member state who you have to report to for breaches and things like that. For a controller, this is the person who actually is responsible for the data. And basically they're kind of the boss of determining who is gonna actually process the data. They kind of document all those pieces. The processor is anybody, so one thing we step back, not only do you need to be GDPR compliant with all the things that Don just talked about, but anybody who processes data for you, so if you send data through a third party, that would be a processor. Even if that, let's say that person or that third party service doesn't really do anything with the data, they don't change the data, maybe they don't even store it, they still have to be GDPR compliant, even just the fact they're involved in the process. So that's really important, I found that to be very interesting. The data protection officer, we'll talk about that a little bit more, but that's a leadership position, kind of like a compliance officer in the organization. So it's real important to have a person who is an expert and this is where it can get a little bit, this is where it's gonna get interesting, I think, to define who is the privacy expert and how do you hire for that, but having somebody... But the CEO of the company doesn't tell this guy any orders with which to accept this as a protection officer, maybe as part of the... Well, and listen to your attorney, so I think that's important, so they're the ones... So with this said, they're the ones who are assessing risk, so if they say, do or don't do that, I think that's good, because everyone's having to assess risk, but yet, so similar to a compliance officer, and I think key to that and what you're getting at right there is real important is that you don't wanna have somebody that can create conflicts of interest within an organization and that's the avoidance, probably where that's coming from is to not set that up. So we'll talk a little bit more about this later, but it's good to read into that, it'll help when you read the document to say, who are they talking about here exactly? So as far as from the overview standpoint, user rights and requirements, there's a few sections here, this is outlined on the actual GDPR official website, but we'll talk through each of these, breach notification, right to access, right to erasure, data portability, privacy by design, and again, the data protection officers are key. Okay, so breach notification, this is kind of an interesting one because all of a sudden 72 hours are mentioned and having, if there is a breach of data that would affect, and this is primarily to affect a, where someone's personal identifiable information is affected in a breach, 72 hours, within 72 hours, there has to be a notification to the supervisory authority. So this means that you have to have everything in order and process internal and your policies and procedures in the company of how you would do the notification.  So have a plan for when a breach happens, how do you deal with that? Who's responsible, how does that work? And individuals need to be notified if they're impacted. So there's also, like all these, there's a little bit of gotchas and... Shrop, I feel like you just told the future, that a breach will happen. Well, I just believe breaches happen and so it's better to prepare. It'd be great if they don't, right? But it's better to prepare so that you know what to do in case they do. But definitely, this is part of transparency and we'll talk more about that, but you just wanna be open with everyone and make sure that they know what's going on with their data, it's about user rights. So next is the right to access. So what I took away from this section is that EU citizens and the data needs to be owned by them. So they have the right to access their personal data that an organization is maintaining on them. They've got the right to request a copy. I'm sure you've seen some of this in the news and like Facebook updates about get your copy of the data. And then citizens also have the right to know how their data's being processed, shared and how it was originally acquired. So it's giving them a lot more knowledge and power around where that's coming from. You can also have the right to be forgotten. So you can request your personal data to be erased on a number of grounds. So first, if that personal data is no longer necessary, you can ask somebody to erase it. You can ask it for a race for a compliance of a legal requirement or if somebody is not using your data in the right way, you can also ask for it to be erased under those grounds. So the next piece here is data portability and the key points that I like for this section is really to focus on the fact that users have the right to take their data, move that data, export it from one system and be able to provide it to another provider. It could be a competitor, but to another provider and import that data. The key here is to make sure that that is done through a process that is standardized. It's not, this is not a time for vendor lock-in concepts. This is not, I mean, this is an open source conference. So we're not talking a lot about that kind of stuff, but this is not a time for vendor lock-in. This is a time to say, hey, the person wants to leave, they have a right to leave, we're gonna let them export and it's in a format that's a standard, hopefully some open standard, that is easily imported into another system. So, privacy by design, there's a lot of by designs happening today in this talk, but I think the key here is to talk about the fact that we need to think about privacy throughout development of applications, websites, systems that, you know, privacy is one of those things like security, like UX. It's one of these things that we need to think about all the way through and the point here is to not wait to the end of a process, deploy something and go, oh yeah, we're gonna think about some privacy here because at that point, you've probably started collecting data, how your storing data has already been decided, it's too late, I mean, it's not that you can't fix things later, but it makes it much more challenging. So, I really like the concept of a privacy by default stance and that's really to make sure that you are only collecting what you absolutely need to have. So, the days are gone of just kind of collecting everything and just, hey, let's just take everything because we might need it someday. I'm sorry marketers, I both love and hate this too. It is tough to swallow, but when you think about all the benefits to users, and we'll talk more about that, I totally agree, it's a challenge, but you also don't wanna hold onto personal data any longer than you need it. So, you get to a point and you're like, you know, we don't use that data any longer, that's when you start having the conversation, how do we remove that data, how do we archive it, or actually complete removal because archive is taking on another risk that you probably don't wanna have. Yeah, and you know, you can back up that thought about privacy by design even to when you're starting to set big goals for your marketing campaign, taking that into account can set some expectations that have to shift and we'll talk about that a little bit later on, but that's what you reminded me of when you're talking about it. Yeah, it definitely all applies.  The reason we're not really focusing on it so much, that is true with GDPR, and that's an important thing to understand, we believe that GDPR has a lot of great ideas and these concepts, you ought to apply to all of you. Let's just start thinking about this for all users. We'll talk about that some more too, but so here's, so let me jump to the next slide. I got you. Okay. Oh, thanks. Data protection officers. So, this is again, similar role to compliance officers. They need to have expert knowledge of data protection laws. That's the part that's kind of interesting, it'll be interesting to see how entities and organizations standardize on what that means and how that looks and so there are some, like most of these points, there are some places where you may not be required. So, your lawyers may say, well, we're actually not required to have that position. So, mostly here it's for public authorities. So again, more definition has to happen and read into that, but it is important to know that every point we've talked about so far has usually inclusions and exclusions type things that have to be considered. So, we've got some key challenges ahead. Now that we've gotten through like the bulk of the foundation of the GDPR, we could talk about what to do with it. So, some challenges ahead. The implementation requirements are super vague, so is enforcement, compliance and continued process improvements is gonna cost time and money. And then there may be other consequences beyond this, but what we're reading as fines could be up to 20 million or 4% annual global turnover for non-compliance. And I think, well, we don't know how exactly it'll be interpreted or enforced, but my hope is that there's gonna be a spectrum of gross negligence is one thing. Against somebody who's really trying to do the right thing, tries to improve and iterate. But we'll see, there's a lot that we're just gonna find out at the end of May. No anxiety. So, everybody's heard of UX and creating a strong user experience. Today we wanna talk about how to create a positive privacy experience or PX. And I think people hear privacy and data in the same sentence and think of really nefarious activities and we have to change that perception. Data and privacy, it doesn't have to be a scary thing. It doesn't have to be something that happens. The only thing we talk about when something goes wrong. So, some key principles to a strong PX experience. Aim to be transparent with your users. Tell them the full story as much as you can. Don't use lawyer speak. Make sure that the language is easy to understand by anybody. Aim for like a fourth grade reading level. Consent has to be given and not assumed and most cases, if somebody gives you their data, try to protect it to the best of your ability. And don't collect more than absolutely necessary. Empower those users if they wanna be forgotten to be forgotten and then follow those best practices in terms of security and design methodologies. All right, let's talk a little bit about personally thanifiable information. So, on the screen here we've got some examples from this Wikipedia article on what can be considered PI. And you'll see that list. I just said PI, but if you see that, that's just something that in this world it's talked about quite a bit. Here's the challenging part. Not every one of these is always PI. So, this is another interesting thing to deal with. Another risk assessment that has to be handled with your lawyers and with management to say, okay, we look at, so it has a lot to do with how the data's being used. Like full name might be PI as an example, but in certain contexts it may absolutely not be if that full name is publicly known and is all over the place, it may not be. So, what you wanna do is be able to take a list like this and this isn't necessarily exhausted, but it's a good start. But look at anything that might be PI and we'll talk more about that as next steps, but you wanna identify and document and know. I think a lot of people over the years have built applications and sites and they just, somebody wants a new field, marketer says new field, sorry, Don, but. I love seeing new field. New field and no one, other than the field kind of showing up, it's easy in Drupal to add a new field, right? So, other than the field showing up you don't really have any documentation to say that's actually PI or any other classification, frankly, if that matters. So, that's something that you wanna be able to do. So, we'll talk more about how to protect that too. And there are some nice side benefits. Like once you know how you're working with your PI for the GDPR, that'll translate really nicely into the work that you're doing with Google Analytics. So, for example, you shouldn't be passing zip codes or an actual email and a URL into Google Analytics. So, if you're compliant there, you're kinda compliant in a couple other places. So, we wanted to pull together some dos and don'ts in regards to positive PX experience. So, on the dos, the takeaway really is that this is their data. So, you have to know what you're collecting, keep it only for as long as you need to and protect that data with encryption. On the don'ts, don't collect stuff you don't need. And then allow, don't let anybody access that data, really keep it to yourself unless there's a true, legitimate reason to pass it over and you've gotten approval and consent on those things. And that may mean that developers, in my opinion, do not need access to production data. So, if developers have access to production data that has PI, then take a pause, think about that and what that may mean. So, I think that's an important point. So, as far as transparency, you want to really make sure that your policies, your privacy policies are very clear. Don talked about that a minute ago, just having, take out the lawyer speak, that sort of thing. You have to be really clear about with users why you wanna collect data, what it's used for, all the way through the process. And that's not just opinion here, this is getting into GDPR specifics. And users, they have the right, they have the right to opt in. This is not like we've collected your data and now you have to opt out, which has been nice in certain cases in the past, but as you can see, that puts the user first in the situation. And you want to, and again, you just wanna make sure that from a language standpoint that it's easy to understand those policies. We're gonna talk a little bit about blanket consent in a little bit, but that is a thing of the past in a lot of ways. Just because somebody consents one time to one campaign, us as marketers, we can't take their email and campaign and send them other lists too. We have to be very careful about getting consent at each step of the way. So I think we've talked a lot about data portability already, but it's on the dos and don'ts. And then on the don'ts, don't make it hard for users to export their data in a standard way and don't drag your feet and helping them out. That's all you, Shrop, thank you. This is Shrop time right now. Security by design, I love talking about this stuff. And in the past year, I've been talking a lot with some other folks in the room on that. So it's super exciting. But you really, again, I promise the by design, you don't want to wait till launch time and then all of a sudden say, oh yeah, we've gotta think about all these things now. You want to think security from the beginning. So this is the kind of a formal definition of that. But again, it's just to talk through thinking through security from the very beginning. And in my opinion, this needs to be driven by your security policies. So if your organization who owns the web and digital properties, if you don't have like a section of documentation that's actually part of your process plan and review plan every year, and it's really a security plan is what we're talking about. If you don't have that, I would definitely look at, that's a step forward. Talk more about that in a bit, but let those policies and procedures drive your requirements and how you build your applications from the beginning is real important. And so privacy and security software development lifecycle. So anybody that's been inside development projects, application projects and things like that, familiar with SDLC, but the point here is just to say that, again, these are the stages that you would apply security by design through, and you could probably insert some other terms and process that you want. But planning and implementation, testing, all the way through documentation, which is really critical, and then deployment, and then maintenance cycle. So after that, when you're maintaining applications, that's where it can get really challenging because people get excited about new features, stakeholders want this new feature to do this thing, and most new features wind up, there's a lot of new features wind up having some web form that says now we want to collect more information. And so, and that's a great time to talk about a place where your organization stores all content in your content management system. I'm just throwing that out there. It's very challenging, I'm not being, I don't want to make it sound like it's easy, but it's easy to sign up for SaaS services and other things and store data in different places. But I think having those central repositories where you know the data is, and you've got it defined is very helpful. It also means bringing on new systems is something you have to take under advisement there. Next big bucket is messaging and consent. And so this can impact, in these steps, if they're not specific to Drupal, your website, you can rinse and repeat on any platform or tool that you're using. So opting in on a website is different from opting in from an email, but it's still opting in, right? Privacy policy and legal documents definitely need to be updated. If they sound too legally, it might be a good opportunity to talk to your lawyers to see if maybe they can put it in human language and not just lawyer language. Not that lawyers aren't humans, we love lawyers. And then something that I don't think everybody talks about, but it's important to note, there should be some internal messaging that goes out. So if you're on the marketing team, your goals may be different than in the past. And when you're talking to your boss who has these certain goals around, you need to grow the list by this much or this many conversions, or we expect this level of tracking, but you have to set expectations and talk about the value of the PX and the GDPR experience too. As far as user control, again, just that data portability, having plans for that, what does that mean, what data? So once you've defined the data and the data collection points and those integration points, when I have to do an export because of request of data, when we have to revoke consent, we have to follow a racial rights and be forgotten type concepts. How do we plan? How would that work? What fields are affected? What does that look like? So as far as the next steps from here. It's nice when you create a little package for your legal team. So if you do the legwork of tracking down like here's all the integration points, here's all the data, here's what it means. It'll make it a lot easier for them to go through and assess risk. Because a lot of times these are unfamiliar concepts to legal teams. So they're learning the website and the legal side and everybody's interpreting the GDPR. So there's a pretty even playing field. Yeah, they don't need your help to understand the systems that are in place and those audits you've done of your systems and fields and PII. They need that to help make decisions. You can't just say, here's the GDPR. Best of luck lawyers. Because they need to know what does that apply to and your organization that's real important. I think as far, we talked about creating and updating policies enough, but that's definitely important. And you want to, from the findings you have and the decisions made from risk assessments, the outcome should be a list of issues and issue queues and a plan for how you're gonna remediate any issues. How you're gonna deal with encryption. How you're gonna deal with those automations or those exports and data changes. So I think that's important. So it didn't implement those remediations too. So once you've got everything documented, next steps, you gotta rinse and repeat. It's not just the Drupal website, it's really across the board with any kind of technology platform there is today. So it's pretty easy to see the difficulties transforming your company to be compliant with a GDPR but shifting to a focus on a strong PX. I think it's gonna do wonderful things for your relationship with your customers for the positive. And we really feel like this is how the web should work. PX is the new golden rule. It should be how we work with each other, it should be how we treat human beings. So it's a good step in the right direction. I know we had to get into a lot of the legal technicalities and then it can be easy to get stuck in the, oh God, there's so much to do, so much to figure out. How much is this gonna cost me in time and effort? But I think it's gonna really pay off if you embrace the spirit of the law. All right, so I had to talk a little bit about Drupal to wrap this in, because it's DrupalCon and the Shrop is excited. I just wanted to mention there's some progress already happening with GDPR in the Drupal community. And so I think it's important to, we didn't have time to go through all of these, but the deck's gonna be out there and the links are all there in the deck. But there's a really lively discussion about privacy concerns as GDPR compliance. They even got a node number up there, so it's ultra DrupalGeeGee. But that's a good discussion because people are talking through what is PI and how does this affect core Drupal, like the other users tables and things like that in Drupal. But there's some modules here where people have already worked on how do we deal with GDPR in commerce? How do we export? Also the encrypt module, and there's related modules to that, so it's not just that module, but that's important on how do you encrypt that data. And of course, I'm involved with the Garter Security Distribution, which is fun and so we're wanting to incorporate more GDPR in there into that work. There's also a GDPR module that looks like it's making a lot of headway towards addressing concerns and having an API even for some audit type things within your site to work on. I'd like to mention too a shout out to Drush SQL Sanitize for developers that use Drush. That's a great way to put it into your continuous integration workflow so that the developers working on development in lower environments don't have all that data. And of course you may have to script other things to clean things up in your databases, but you really wanna have development happening and when people take laptops away to conferences that they're not walking around with production data with thousands, millions of users and stuff like that. The really important thing here though to end with this is as you come up with solutions around how you're addressing GDPR, even if it's not Drupal specific, but as a company someone's determined that this is how they wanna operate or they've got some ideas around implementation, I just encourage you to give back to the community here. This is the give back part of this presentation where you say I'd like to contribute back to one of these modules and help make it better. So there's tons of opportunity if you've ever wanted to get involved in contributing in Drupal. This is a great opportunity to dive in. And it's not just on the technical side. Media career, we work with a lot of different clients and I can tell you all of the marketing clients we're working with, all of the legal teams, they wanna talk with each other because they're debating internally how to interpret these things and I think putting out your approach in the community at large, not just Drupal specific or not just IT specific would go a long way to helping improve and move things forward, save time. So that's our talk. We definitely wanna hear feedback. We have seven minutes but we're gonna be right after this if we run out of time for questions we're gonna go back to the booth at 525. So come see us for sure. And the after party, 7-Eleven, where you can party away your GDPR concerns. Yeah, find us there, we'll be there. Thank you. I just want to know offhand, do you have an idea whether or not there's like a uniform system where somebody is like an achievement badge and they say that their GDPR compliant because whenever I run a relatively big site and it's the sum of all the third party data tracking software that how GDPR compliant we are, it's very dependent on the third party software. So do you have an idea? I don't think there is one yet. Yeah, I don't know of one. I didn't mention this earlier. There are lots of third party, there's certainly contractors and companies that specialize in GDPR compliance that can help with that. And, you know, but I don't know of anything yet. Tell me else in the room, I know that's like ISO 270001 or something like that where you can put something on your site and say that we are. That's a good idea. Yeah, that probably will come after the end of May. I'm sure you could start a business doing that. I have like a million questions actually, but two, can I fit two? And so the first one is, how does something like Google Analytics tracking users count against this? Is that in a separate world or are we accountable for actually providing GA tracking on from our site to the user? Yeah, so I'm not a lawyer and I've had different lawyers of my clients interpret that on like two ends of the spectrum. So I have one client who says, Don, you cannot fire any Google Analytics cookies whatsoever until somebody says yes, I support you doing that. And that does crazy things to their data. On the other end, I have a client that has said that this is okay to be passive consent, that as long as we're not pushing anything, PII in any way, it's okay to collect general usage data. So it's talk to your lawyers to see where level is risk. Yeah, they want to take on. So the second question briefly is, it has to do with cookies and it's been explained to me perhaps incorrectly that there are three categories of cookies in GDPR. There is what's called required. There is, which is like your login cookie. There's something called functional and there's something called advertising. It's really nice to put that in your package for your lawyers. So what's happened in my company is that the marketing team has decided that everything is required. Problem solved. I mean, not everything's required. So someone's gonna, if there's ever any action on GDPR, then they're gonna look at that and they'll tell you where you're wrong or where the person made the decision. I wish they would give us examples up front. They may say, well, good try, but so it's probably good to look at those. Like session cookies, for instance, are different than marketing tracking cookies and things like that. Right, well, we have our own types of marketing and tracking cookies, which are not third party, but they're for personalization. Gotcha. Yeah, personalization is huge in this, for sure. And so it's a good reason to talk somebody into opting in. Right, yep. Well, I'm guessing, yeah. It's, yeah. That'll be a fun conversation between you and marketing. I understand you're not lawyers, but I'm curious to- It's good to see you again. Hi. I was wondering if you could share Michael's opinion on where PII stops or how far it extends, rather, you know, it's the GDPR is intentionally vague with things like anything directly or indirectly that can identify a user like physical location. Well, address, that counts as address because it's address states count. Because states count, does that mean time zones count? If time zones count, does that include time stamps? If we could collect peak usage time of users? I was wondering if you could expand maybe where you currently stand or how you understand how far that extends. It's like, my concern is like, are our Apache access logs? Do those fall under GDPR? They could. Logs can, IP addresses. You didn't mention IP, but I know that was probably next on the list. I feel confident IP addresses are. Yeah, that's a good call. But like, how far can we- Like, are our time stamps and our database records, are those subject? I mean, so here's what this is about, in my opinion, not lawyer. Is it's about taking those independent pieces of data? Can you build a profile and really identify who that is? That's where it gets into the play. Now, time is obviously a factor that can help identify people. In a log, personally, I don't see that usually in a general sense as much of an issue, but I definitely see like IP, I see, I see, you know, URLs, I see things like that showing up in logs is definitely an issue. Something we didn't talk about a whole lot, but something that's on my mind a lot is backups. Right, that's terrifying. So what are we doing for backups? That's something we need to figure out because, you know, it's great. As a developer, I like to be able to just say, I've got backups way out there, but that's holding stuff. It goes back to the encryption and being able to, you know, delete keys. But we still have to deal with things that don't have those implementations. So it really depends on every project. So just like Don was talking about, PIs is determined in conjunction with, for us, our clients, what we recommend and their attorneys to say this is what we think, because it really comes down to how is it used, how can it be combined? Encrypting this really does help a lot because you're worried about breaches, you're worried about if someone else gets their hands on this. So you may not be doing anything with the IP address or the URLs or some other piece of data, but if someone else gets their hands on that, what can they do with it to put together a profile of somebody? That's what bothers me a lot from a breach standpoint. The encryption's a really good point. I think the less data points you get them, the less of a profile you could build. Yeah. Thanks. Sure. I think this has to be our last question. When do we get kicked out? I think, I don't know. Very soon. Okay. I'm curious about the scenario if your site isn't targeting the European users, maybe if it's not targeting humans at all, you're making for like aliens or robots. Do you still need to be GDPR compliant? So I think it's a good thing to do for other human beings. We have some clients whose legal teams say we can only absolutely do business in the United States, and we are going to scrub. If somebody from Europe comes in, submits data, we're not gonna save that data anyway because we're not gonna use it. So that makes them kind of comply it, right? Because they're not keeping the data, but you have to take the steps to do that. And then I think it comes down to that level of risk that you want to assume. Would the aliens hear you? I mean like extraterrestrials, like extraterrestrials. It's hard to have, it's a website, it's on the internet. So my thing is like, how are you not gonna ever have somebody from EU member state involved with your site? That's, I'm having trouble coming up with scenarios. I guess there probably are, but. But the likelihood of that site being the first one, somebody audits maybe slim. So again, like that risk thing. Got it. Thank you. Yeah, you're welcome. That was a fun question. Yeah, that was good. I liked the UFO action. One more, we'll make it last. Yeah, I would just like to say thank you. First of all, it was very good general overview, but there's a mistake that it said EU citizens, and it's not for EU citizens, it's for EU individuals. So I, as a resident in Europe, even though I'm from the US, my data also has to be compliant with GDPR. That's exactly, you're exactly right. And just a quick advertisement. We created the GDPR audit module. So if anybody would like to talk to us, these two here, or myself. What's your name? Riley. Riley. We're from Brainsome, from Budapest. And we'd be happy to help anybody else. I love the chat, because I'd love to get something like that in garter. And this is crazy complicated. So yeah. Okay. Thank you. Appreciate it. Thanks everybody. Hey, Jim, how you doing? Good to see you. Yeah. Oh, it's nice. So, we didn't want our situation to be like this. Yeah. We had a lawyer committee give the GDPR. Oh, cool. At a recent overseas event. Listen to them more than one. But what about cheese roll? Okay. I had a big problem with it. Okay.


Thank you, thank you, LJ, and a good evening, I guess, I should say, and Ambassador Lauber, Geneva, is the place to be. Wonderful to see a full room as we start to wrap this up. The time has come, I would say, somewhat unfortunately, to bring this summit to a close. And I want to, of course, thank all of you that have made this possible. Of course, so grateful to the Swiss, the Swiss government for co-convening this event with ITU. And of course, a huge thanks to our UN partners, over 40 partners strong. Thank you as well. Thanks, of course, to our sponsors, our speakers, and you, the participants here, physically and also joining us virtually. I think you have helped us to take another step forward towards building an inclusive, a safe and responsible AI. Thousands came to Geneva, thousands joined us online, and of course, that includes our robots. I hope you got to meet and engage with the robots. I would say engagement more than numbers really tells the story of what we have experienced over the last two days. It builds on a wide range of perspectives, ideas at different stages of maturity, but I think it's fair to say there's certainly one thing in common. That would be a commitment to finding practical solutions together. In particular, when it comes to global AI governance frameworks. So let me share some of them with you. We have heard, as we just heard in the great panel that Jennifer moderated, we have heard calls for new bodies modeled on existing ones like CERN, like IAEA, like IPCC, as well as proposals to empower existing organizations. We had conversations on things like how a registry of new or anticipated AI applications might work. We also heard calls for a global observatory, how an AI observatory could look. And I think we have some great ideas to start to think about and move forward. So where do we go from here? And picking up on some of Gary and Wendell's comments, Jennifer, in your session, it's about making the right choice, right? We have to make the right choice. And I think it's really, it's time, it's time for us to roll up our sleeves and we need to analyze what's feasible, what's already available, and of course, what can be done. And that's what you've called on us to do. And I think it puts us on a path. You mentioned that, Jennifer, we need to have this path. So it really puts us on a path to be able to create a roadmap for the short term, for the medium term, and also, of course, for the long term. So the UN group on AI, we have this interagency group, I won't get into acronyms. It's a group led by ITU, by UNESCO, and it's geared up, ready and charged to help move this dialogue and conversation forward. But of course, the work doesn't stop here. I think it's fair to say that we're really just getting started and that we must continue to push inclusive dialogue. Inclusive dialogue, we've heard that from so many on AI governance. We need to engage with stakeholders to develop these ideas further. From the ITU perspective, of course, we will continue to do our part. We will continue to focus on AI standards development, policy assistance. We will also be integrating AI capacity support into our digital transformation offerings together with partners like UNDP and others, especially in countries with low technological capabilities. This is another thing, even Ambassador Lauber mentioned that as well. We have to focus on that piece. We will also be complimenting UNESCO's efforts on AI readiness by doing sectoral deep dives. We will advance, as you heard yesterday, universal health through our new initiative with WHO and WIPO on AI and health. And of course, we will support responsible AI development and deployment at the country level and we will work to drive strong collaboration with other parts of the UN. And Gary and Wendell again, hearing you well, we have an incredible opportunity as a UN system to pull together and help to support this process. So ladies and gentlemen, yesterday we kicked off with an opening message from the UN Secretary General who made a strong call and he urged us to continue to explore the practical applications of AI to advance the sustainable development goals, that normative framework, Ambassador Lauber, that you just mentioned. And I think that what we saw over the past two days, I think it brings us a lot of hope and I guess we wouldn't be here if we didn't have hope. And I'm an optimist by nature and I think it really, it does give us a lot of hope. We saw how robots can go into situations that might be too dangerous for humans. We saw them bring comfort and support and interact with us and also with each other on a whole new level. We had the world's first robot press conference and diplomatic meet and greet. We saw how AI can help farmers to adapt to climate change. We saw how AI can transform and tailor education. We saw how AI can unleash a whole new wave of personalized healthcare and how AI can help us to use outer space peacefully over the long term and for the benefit of all. I think that's where the opportunities lie. They're tremendous and each and every one of those SDGs can benefit. That's one of the scenarios that I described yesterday and I think Wendell, you pitched it a different way but it was obviously very complimentary to what I laid out yesterday and that's the scenario where AI lives up to its promise and where we managed to put the right guardrails in place. That was the future I chose and most of you I think if I heard you said you were with me. It's now time for collaboration. It's time for co-creation. It's time for stakeholders and disciplines and Gary that includes scientists because this is the AI moment. This is our moment. Let's put human values first. Let's stay true to our core UN values and let's show the world. Let's show the world what an inclusive, a safe and a responsible AI can do for humanity. Thank you very much. Thank you. Thank you. As ever. Amazing.


Welcome to the meeting, everyone. This is an excellent opportunity for us all to get together, and I'm glad everyone could come. The first thing I'd like to bring up is the issue of staffing. I know it's not on the agenda for today, but I feel it's important enough to be included. Could I suggest we remove item 2, the pay rise, to make room? We can easily set up another meeting to discuss that. Now, I'll try to put across my ideas as clearly as I can, but please stop me if you don't understand anything. Just a minute. I'm afraid I can't go along with this. I think it's really important that we discuss pay. It's a topic that everyone's most concerned about at the moment. As you know, we're supposed to discuss it at a last meeting, but that had to be put off until next week because of a typhoon, and now it's in danger of being caught off completely because of the summary says. Quite taken. Why don't we move on to salaries after we've talked about staffing? Would you go along with that? Well, as long as you can assure us that it won't be put off until an other meeting. I agree. You have my word. Now, let's get back to staffing and let's remember the two topics are interrelated. The question is, by how much do we need to expand the current workforce?


Good afternoon, cyber traders. Welcome on back here this Wednesday, February 23. Great to see Chuck, Norman, Michael and all of us otherwise live inside the cyber group trading room. Great to see all of us once again rejoining us on social media, Facebook, Live or YouTube. Let's hop to it folks. Right now we have the AU stock on the screen. Probably one of the only stocks or symbols collectively that's moving up right now. Whole markets dropping off, right? We kind of noticed that upon the open today, at least heading into the early afternoon, we ended up just seeing the spy begin to break a bit lower and since. Hey, it's been a short day, right? And if you're not short, perhaps like Brian wrote inside the chat board just now, you know, hey, it's not a stock, right? So I still stand by AU saying, you know, AU is one of the only stocks that's moving up right now. But with the market dropping off, we're gonna have UVXY making a nice move up as well. So, you know, Brian, I'm assuming is already in on this UVXY trade, you know, at the highs right now up over 5%. So, you know, hey, we normally don't tend to treat ETFs inside this live trading room, mostly because it's very difficult to apply level three to it. But hey, with the market dropping off, UVXY is moving up on days like this. Of course, we're gonna follow UVXY in particular. You could say the same with the other VIX ETFs or inverse ETFs in general. So here's VXX. We can likely look at VIXY here. I think I think SQQQ became pretty expensive. So, you know, not really gonna focus on SQQQ as much. But you know, I'll just put UVXY on the main watch list to symbolize, hey, markets are dropping off and all these inverse ETFs are moving up here. Otherwise, Nugget is the only other, you know, bullish ETF that's moving up right now. Just like I'd said before, it seems like all of gold is moving up right now inversely to the market drop off. So here we have Nugget, gold mining ETF, bullish ETF that is. And we have stocks like AU, which are moving with gold altogether at the highs here. Numont, a little expensive, but that one also at the highs. We have other gold stocks like SAND and EGO, which are a little bit cheaper. But those aren't really making as sharp of a run up perhaps. So we're not as particular about those trades just yet, but we'll see what the afternoon finds us though, folks. All right. What we'll do is just go right from top to bottom here. Otherwise, you could assume that I'm in a short trade if the markets are dropping off. I am. And we'll get to that stock in just a bit. I'm actually in two trades. I got both my stocks set at least. So we'll catch in on both those stocks in just a bit. But for right now, we'll start at the top of the gainers list here. The 10 trade, actually, I didn't even mean to click on this one. We're just going to skip over. It's a buyout. I didn't want to waste anyone's time today by trying to follow that. The ENSV, wow, this one ended up making a nice run by 11 o'clock when we were kind of in the middle of our class, right? The phase two stock course curriculum started earlier today. We're going to continue this afternoon. Lesson number two later on at 305 Eastern Time. We'll be talking all about determining a stock's range and its increments in this afternoon's class. The morning class, we were talking about indicators. It's just to say at least we missed out on this ENSV run from 60 to over a dollar. Ended up making a phenomenal move from there. But right now, just lower high, snapped down to break support doesn't seem to be moving much right now. So we'll pass. IMPP. This was one that we, I think, had on the morning watch list today, at least, albeit kind of towards the back end. It took a little while, but shortly after 10 o'clock Eastern Time, we ended up seeing this make another nice move. So for what it's worth, this could be a good stock to keep on your side list. Just check in with it, just for the remainder of this week, just to see where it's at early in pre-market. If it's on the losers list, if it's tanking, then obviously we're not going to be as particular about it. But hey, it kind of reminds me of KAVL, right? Really quick, you just go back to KAVL, you know, look what happened to this thing across the last three weeks, right? We were talking about this yesterday afternoon. So, you know, that's where I come from there. Just keep IMPP just on your side list going forward. What's this one here? Skin, the Health and Beauty Company. Interesting. Ended up making a nice pop after the market had opened up 15 to 17, then grinded on up to 18 bucks.  It's trading a lot of volume per minute for this time of the day. It's trading about 20, 21,000 per minute. Like that's really good. Spreads are relatively tight. Not the most liquid order book, but the spreads are good. I can just keep this on the side list for right now as well. I'm actually more particular about this trade compared to the IMPP. But let's see what else we got though. First, you know, I'd rather commit to something that looks a little bit more steady in a direction here. Overstock, hey, this one ended up making a nice pop leading into the market open and it continued pushing up after the opening bell 46 towards 51 and then from there just really started dropping off. So, you know, hey, I could say this on overstock as I would on any other trade folks. When the volume dies off, much more often than not. So does the stock. So, you know, after the open, we had this little extra push up to 51 close to it and then from there, the volume started to wane back down quite a bit. So, all right, let's see what else we got though here. First, AUD, I don't know, just pretty flat right now at least cheapy. It's kind of near the highs, but for right now, I want something looking a lot better. QNGY here inching on up. I wouldn't expect for there to be a whole lot on the gainers side folks as the markets are dropping off, right? We're just talking about that to begin this meeting, but I got to go through it here pretty quick. I just want to skim through seeing if there's anything looking all right here from the side. Here's the REVB trade. We have HMS from earlier in pre-market. I think we saw this early on.  It's made a good move for us after the opening bell, but you know, we were focused on the KOD trade first. We were focused on the AMC trade. We're focused on a couple of these others. STRN, another one that we were also focused on going into the market open today. Unfortunately, though, hey, this one had a nice little pop to it at first, but once the selling kicked in and once the volume dissipated from that point, well, it's just been flat. All right, let's see what else we got here on the gainers side here folks. We have a couple of familiar names, at least TAL. BTU had a nice day today. I forgot about that. BTU ended up making a nice big pop from 17 up towards 19, broke a higher high heading into the early afternoon, right?  This is one that we'll pretty much keep on our side list on a day-to-day basis. Doesn't really trade a whole lot of volume pre-market. That's the only gripe I would have on this. I wish it traded more volume pre-market, but otherwise, though, it's a stock that trades nearly 6 million shares on average day-to-day, which is definitely a lot. So, you know, hey, if you've done well on the stock previously, you know who you are. If not, then, hey, keep this on your side list going forward. This could very well, you know, produce a nice trade for us. If not this afternoon, then, you know, we'll check back in with it tomorrow morning. All right, let's see what else we got here, folks. I don't see a whole lot else out there on the gainer side. I got to move this up a bit, perhaps, but that just about wraps it up at least as far as I see from any of the familiar names here. Maybe Lumber Liquidators. It's not even trading a million shares right now. It's just kind of dropping off a bit. All right, let's hop on over to the loser's side, folks. KOD, the kiss of death. It ended up getting crushed after the market opened up today. One of the two trades I am currently in now. Now, actually, I am long on this right now on a small smaller position. I have my stop set right at 988. So, hey, if it snaps from here, I'm going to take a loss. But if it snaps from here, well, not only do I take a loss, but the stock is still shortable. So this would actually be a really good opportunity. If this does begin to break under that 990, we had a lot of selling there from consolidation across the early afternoon. So, you know, I'm going to put this on our watch list not only because a minute, but just it provides great opportunity in both directions. From this morning, it was a great short. It ended up holding underneath a big resistance that we had called out off of 1085. Then from there, 1070, I think, was the next big level. But from that point, hey, you know, if I don't get my squeeze up, then this could easily be a great short to work with heading into the close. So KOD definitely going to put on our afternoon list. And let's see what else we got here. GMBL. This thing got smoked today, too, didn't it? Geez, I didn't even notice how much down this gamble trade was today. I saw it on the top of the loser's list going into the late morning, but truth be told, it was a little ignorant of it. I kind of just skipped over it with my eyes and just said, let's keep going on KOD, AMC, etc. It is shortable, actually. It's just pretty odd to see for a dollar stock like this. So let's see the news out on eSports Entertainment. That's the name of this company. GMBL shares trading lower after the company reported quarter two earnings results along with that HC, Wainwright and Co. They lowered their price target to six. Six.  Oh my God. All right. Well, either way, GMBL took a huge dive here after the market opened up roughly from like 225-ish all the way down to like 140 and even lower here. This might not make for a huge trade, folks, because it seems really flat. You could say the same on a KOD, but there is a bit of a ways to go to get to the ground level floor on KOD where GMBL is a dollar stock. So, you know, that's got a little less room to travel down to hit that zero mark. And we're not trying to do that. And in fact, that makes me less interested in trying to short GMBL at least, but it's down enough to where you could hope for a dead cap balance. Now, hey, it's down 60%, 59%. So, you know, if the shorts begin to cover, I feel like this is down enough to where it can make a pretty decent move. So we'll see. VRT. It's trading a lot of volume per minute, about 50, 52,000 shares per minute. And that's excluding these spikes here. So that's pretty telling. Stock's trading a lot of volume right now. So I like that. It's shortable. So if it drops off and goes, you know, comes back down, that could be a pretty good opportunity. It's down 38, 39%. So maybe not down as much as the GMBL or KOD. But you know what? I don't mind slipping this just on the very back end of our watch list here. We only have four symbols in total folks so far. This makes it four. We have three stocks, and then UVXY, which is not even a stock. It's an ETF. All right. So let's see what else we got here otherwise. We got a couple of other familiar names or otherwise stocks that are just shortable. Easy to borrow. So we'll check out the RXT trade. This one was on the top of the loser's list early this morning. But hey, this made the DCB. This made a bit of a dead cap bounce upon the market opening up. Continue to squeeze up higher heading into the late morning. But you know, right now it's not down enough for me to look for another squeeze up. And it's just really flat here. So I feel like this one, if anything, we're going to kind of move away from. Vips. Well, it's trending down a little slowly perhaps. But you know, hey, there's a trend to it dropping down pretty close to the lowest of the day for right now. VIPS. I'll add this. This one looks all right. All right. Let's see the second trade that I'm in right now. I got to make sure that I don't blow the profit here. But I'm short on AMC. Now I'm going to actually explain my reasoning for taking this exact trade in the phase two course coming up at 305 Eastern time.  And obviously that played in part with it. But folks, we were talking about Fibonacci's earlier today and that's all safe for right now. But we're going to talk about this trade as a whole later on in class. All right. So, you know, hey, AMC is a sideless stock. I'm not going to put it on our main watch list for the close. I mean, I'm in it. And I'm in from 1597. So hopefully this thing ends up dropping off a lot more for me. But let's see if there's anything looking even better as a sideless stock that we could add to our list. For instance, I'm not short on NEO right now. I sure wish I was short on NEO right now. It's down over 5%. This is at the lows here. So I like this even more than the AMC trade to be honest. So I'd rather put NEO in particular on the main list. You know, of course at the same time as we have NEO, we have some of the airlines dropping off right now. Cruise lines are taking a hit right now to it seems like. So, you know, this is where I could almost put like pretty much every sideless stock on our watchlist here. And you know, I don't want to do that. Like for instance, Palin tears at the lows, but it's not down nearly enough. Chuck calling out the YNDX. That's right. Good heads up again. Chuck on this. So Chuck pocketed like 50 cents on a short. I thought just a moment ago on the YNDX trade. Actually more than that. I don't want to short change him 65 cents. I thought I was rounding up Chuck 65 cents. He got on a short. He was in from 3665. So, you know, hey, this one's definitely down enough. I think I simply skipped over this as I was just quickly skimming through here. YNDX number 36 on the losers list, but looking great. Right. So, of course, we have to add the YNDX. Ron going back to the American Airlines, which I just had a briefly for a moment. So, yeah, the airlines and cruise lines are dropping off collectively.  Albeit it's down four plus percent. We have the AMC trade. We have Neo. There is one. Oh, DraftKings. Yeah, but DraftKings is not nearly as close to its lows compared to some of these others. I would actually be more particular about DraftKings than like the airlines, cruise lines or other sideless stocks that aren't moving as fast because truth be told over the last like two weeks, three weeks, DraftKings has been moving really well for like a $15, $20 stock, roughly. We'll talk about that coming up in class actually later on where we talk about the average true range, the ATR on my daily chart. I'd be a little bit more particular about DraftKings even here. On Facebook, great to see Jerry, one of our longtime students now joining us. I think today, at least on Facebook, he says, hope all as well. Same to be said Jerry. I hope you're doing well here. Ashton says, good afternoon. CEI is under a dollar, but big volume is coming. And then he calls that pizza, PZZA. Let's see. So CEI, we've, we've done really well on CEI, right? I mean, just look what happened going back into the end of September.  This was a halt where it ended up reopening up down 88%.  I like to call out Ashton.  It's up 12 plus percent. We're not as particular about the stocks below a dollar because normally, or I should say more often than not, they don't make as concise of a move compared to these stocks that are over a dollar consistently. I just got stopped out on KOD, by the way, folks. So, took my tiny loss there. I'm going to keep it on our list though because, hey, if this fails to break lower and if this was right place, wrong time for me, I'm still not ruling out the dead cap bounce, but right now, though, we got to really begin to see some good buying coming in in order for that to happen. PZZA also from Ashton really quickly, a little expensive. This one, you know, hey, it's at the lows. So, I appreciate these callouts, both of them from Ashton, the CEI and PZZA in relation to the chart or in relation to where it's at on the chart. I'd say they look all right, but one's a little expensive. One's a little too inexpensive. You got to make sure the shoe just fits. So, for right now, folks, hey, I'll tell you, I think that we have a decent list already. I'm going to slip DraftKings on here at the back end.  So, I'm sure you'll be more particular about your side list stocks than anything, but you know we can't put out a 50-stock watch list, folks. So, I'm going to tell you this first. Just stick with this list to begin, unless if there's anything else that makes a giant pop, giant drop, if that's the case, then call it out. But, I like what we have here to begin, folks. I don't want to overwhelm the 95% of us here otherwise. All right now, folks, I'm going to post and tweet this list, and then I'm going to make sure the link is sent for class coming up right at 305 Eastern Time. So, as soon as I finish up right now, I'm going to jump into the class and just get my last looks of prep in. For all of us on social media, Facebook Live, YouTube, I appreciate you sticking with me each and every day, each and every afternoon. If you have any other questions that you would like to send over my way, feel more than free to do so. My email address is always is Josh at C2Trading.com. But otherwise, though, for Brian Norman Chuck, Ron Kathleen, and all of us otherwise, at least inside Cybergroup, I look forward to talking to you right at 305. Take care. Today, you are invited into the world of Fausto Pugliese, who battle some of the best traders in the world to win the real money world trading championships not once, not twice, but a jaw-dropping 12 times. Fausto is opening up his private members only Cybergroup to you in this incredible opportunity. What makes Fausto so different, you ask? Some might say it was his upbringing. Others say that he is a family man through and through. But the story goes that when Fausto made his killing in the markets, he reached a pivotal moment in his life. He could continue on the path of so many of the greats. Or he could make a hard right turn.


Great to be here, especially, you know, seeing David, Dennis, Mike in the flesh. We have been really good, you know, great followers. We're really inspired by the work that you're doing. And it's really great to be here and talk about this. What I'll be doing, you know, in this talk today is. First, we looked at a lot of these programs, which talk about customers, customer centricity, digital, a whole lot of things that everybody's talking about. And there are so many different ways to really tackle this. And what we thought was, see, while enterprises have been doing it, we actually looked back and said, what could be the ways to really enable this? And there are certain realities in terms of how we see this digital world evolving. I think that's the focus of the, you know, topic that we have. First, you know, I'll put the context or how we see customer centricity in this digital economy, and then we are going to set the stage for how we see FIBO coming in and then what other complementary aspects do we need? And that's where we see the banking industry architecture network, the buy-in coming in, and we see both as very complementary in achieving this. And that's what I'll quickly talk about. So just as an overview of the topic, we've been hearing a lot about customer orientation, almost every organization that we speak to. They have a program, they have had programs, they have planned programs. I think they all say that, yes, we are customer centric, but I think in the end, still we're having a lot of talk or probably the concept is still around orientation, customer, they're still not centric. I think that's one of the first topics that I'll start off. And then I think key element is when we look at a customer's journey, that is very different from how we manage life cycles of customers in organizations, especially banks and financial services. So that's a different element. How do we really envisage a customer's journey and what are the implications on banking and financial services? That's the second element. And given this context, we see the only way probably to realize this, to understand and be relevant to a customer and the customer's journey is interoperability. And we'll talk about what interoperability is, how we see it and how it will mean that organizations need to go beyond their boundaries into working with other organizations in collaboration. And that's the stage at which we see Fibo and Bayan really as key elements of achieving this customer centricity. So to put it in a context, everybody probably would be familiarized or be familiar with this concept of personalization, contextualization. And I think almost every organization, bank, financial services organization, they say, yes, we have this, but we're looking more on these elements. So it's always colored in the way the enterprise looks at it. So how can I offer to this customer in terms of what products I have? What can I offer to this customer in terms of the services that I do? But the ability of the enterprises to see the customer in their own world, that is what is not, we don't see that yet. And I think with digital, there are key elements that are really becoming important, that data is becoming more democratic. The customers, the people in their real world have access to more data. That particularly the access to the data, the fact that they can view various things like the financial products, how I can really invest my money, how I can probably make use of certain elements of money, who can I approach, those elements are becoming much more open because the customers are more connected. I think that's what is changing because that is where customers are saying, I am empowered, I need to do this, I no longer need to go to a bank. I'm actually want, I want to see, do you really understand what I say? Do you really understand me rather than I going to you for an account? I going to you for a loan, because these are all individual elements at which these enterprises and the customers intersect. But the real world of a customer is much beyond that. I think that's a key element. So just to put this into perspective, how we see evolution of customer centricity. If you really look at it, the point of departure was every line of business system had their own version of customer. You call it a customer ID and then they said, yeah, this is not really working. We need to have an integrated view. So what they did, I think most of the organizations, you may have a different view, but at least the organizations that we worked with, they said, yeah, you have all these transactional systems, but when we aggregate data, let's slap together one more. So there is one more customer identification, and that's the identity. That's the element that is enabling integration. But is that really customer orientation? Single view of a customer within an enterprise, it's post facto, right? And that's what is actually you're saying. I identify a customer using ABC in system A. I identify a customer using one, two, three in system B. And then I define another customer ID and then I integrate that because then that's just an attribute in these systems. So ability to aggregate data for a customer is that a single view of a customer? I think the state of the art, at least, in terms of the way we see it, just able to see the data for a customer is really not customer sentiment. Because to what extent is it driving? To what extent is it empowering you to take decisions? To what extent is it really enabling your agents to talk in an integrated way? I think that's where we're seeing limitations. We have achieved it, we don't really know what to do about it. That's something that we've seen. I think to that extent the dotted elements are where we're saying in effect customer centricity is about saying it's not about taking an ID and then shipping it off to various systems. It's about all these systems really coming together and working in the context of a customer. I think that's where really the customer centricity is really coming together. And in a networked economy, you are seeing a whole lot of intermediaries coming in. There are a lot of intermediaries who are offering or aggregating data. So those intermediaries are in between how you offer wealth services to customers. Those intermediaries are in between how you offer your retail product.  And at a different point in time, I want a wealth product. It's actually all these intermediaries who are actually coming together and saying, these are the banks, these are the options. You no longer having a direct relationship, you're having an intermediary. And I think those are the key elements of digital where we're seeing intermediaries playing a role. So that's where we're saying centricity in a networked economy. That's one element of it, probably just to give you a different perspective on it. If you look at it, the whole financial services, banks, capital markets firms, they have been interconnected in a way. To the left, we've had all these banks interconnected through the payment networks. We've had these capital markets firms integrated through your markets, your market infrastructures, et cetera. But they have always been a separate world. The financial world has always been a separate world to a customer's world. A customer's world, a real world, is where he actually has an identity as a person.  And I think those key elements relevant to a customer are very different from the way financial services organizations, they're all organized as a club. I think that's interesting because the only interaction that happens between these two is where financial services organizations say, you are my customer and you are identified by, let's say, you in a set of accounts, set of loans that I have. What that means to a customer? In the end, if you look at it from a customer's world, he's actually trying to buy a house, make a payment and live alone.  What does that mean to a financial services? It is a very narrow context. Buying a house requires a mortgage. Yes, we have a mortgage product. I think those are the key elements. We are not really talking in that world. I think that is what is changing. That is the context that we see as really changing. We have moved from where customers really came to us when we said mobility. We're actually saying the channels instead of a branch. We're actually giving branch in a particular device called a mobile. So that's becoming accessible, but it's still a branch. When you say, yes, it's an account, we're saying, yeah, we'll give a proxy, your mobile number can become a proxy, but it's still that particular mobile number linked to an account. The moment I have different accounts, I still need to link them. So it's all these, the artifacts, the financial services, artifacts are still playing a role in the customer's world. The customer still has to deal with accounts. The customer still has to deal with mortgage products, specific APRs, etc. But at the end of the day, he's actually saying to really make sense of it. He really needs that guidance of that particular institution because it's only the institution which knows the specifics of those products. So we're still having customers really trying to understand and make sense of this financial world and financial world is actually saying, you really need to talk our language. And I think that is what is changing in digital. The financial world needs to or is looking at talking the customer's language. And that's where a huge shift is happening. The shift of control, the shift of information. I think that's really the key from where we see the customer center city really evolving. And of course, there's a whole lot of talk. Some people might say, you know, it's very futuristic. But we see this as coming. There's a lot of talk around IOTs, the immersion, the very fact that the mobiles and the devices and social, there are a lot of aggregation of information. But these are really big minds of information. I think I was in a session where Sue was talking about a very interesting case where somebody calls up and then they have the whole information about that guy, he calls up for a pizza and they say, you have these health issues. You have this recent problem, so it will probably charge you a bit more. We'll probably charge you a bit differently. And we have, by the way, we have these products, other products, etc. So the aggregation is definitely a problem. If you don't view it as in a context. So if you really look at it, a customer's world today, it's really about usage of all these devices. They're generating a lot of events. And banks are now trying to understand these events in terms of saying, how is it relevant to us? What can we do about it? How can we react to it? It's almost like saying, rather than waiting for a customer to come to me and say, I have this need, can I infer it from the data that is available? That is really the key. I think that is where the promise of all this social, IOT, the mobile, etc. and having to understand the data is. So really, it's about understanding their world, understanding their journey elements, not really waiting for them to actually click or waiting for them to say, I need this. So even before they see it, even before they say it, we are actually saying that banks are trying to understand what can we really do? What are they going to do? I think from that perspective, a customer's journey is clearly beyond a concept of a customer and concept of a firm. Really. If you think about it, banking and financial services, capital markets, they have always been an information arbitrage models just because I don't know what's the best way for my money. I actually deposit the money with you and then you give me a rate because I don't know who else to lend it to or get a better return for my money. And banks are saying, we have this, don't worry about it. We have this whole model. We know about a whole lot of people. We can actually do this wedding for you. And that's the whole information arbitrage. That's for banking. Capital markets also do the same thing. When you're connecting buyers and sellers, where the capital markets firms, the market infrastructure is actually saying, yes, we have an understanding of this market. We know these players. We will let it, but we will keep both these sides differently. Banks and capital markets firms, the models are different, but they're all centered around information arbitrage. Now, the customer needs, I think, with the information becoming more open, these models are definitely under question. Saying, for example, when you're looking at crowdsourcing, crowdfunding, whole lot of things, they're completely changing the way customers really approach, the customers really satisfy their financial needs without necessarily going to a bank, without necessarily going to a financial services firm. So this is really changing. Now, what does it mean for a financial services firm? To be integrated in a customer's world, we really need to look at it differently from an aggregation of products and services. It's no longer about saying that we have defined this product because it's an arbitrage between your savings and your loans. We actually need to really look at what is that customer really looking at. The customer wants to buy something. How can I facilitate that? So it's not about offering a customer a savings account. What is that customer doing in his life? What does he really need for his money? He just needs his money to be safeguarded till he needs it at a later point in time. But we're saying it'll be a combination of savings and you probably can do an investment. There are a whole lot of complexities there. I think that is definitely going to change. I think that we're slowly seeing that in terms of customers' preference for alternate channels of funding, etc. So in short, what we're looking at is from a customer's centricity, the key element, the key message is we are going beyond organizations. The organization boundaries are different. We are no longer looking at organizations as a set of having a clear boundary, having a set of different products and saying, this is the clear boundary I have. The boundaries are becoming fuzzier. And when we say the boundaries are becoming fuzzier, it's in terms of the scope of the services and it's also about the data. It's no longer about the data that I control within my organization. I have to ingest data beyond my organization. So that way, both from the way organizations are looking at structuring the services, defining their scope and ingesting data, which is under their control, which is within their organization and outside their control, which is ingesting data from your social mobility, etc. All these need to be integrated irrespective of how I define my organization. So that's why this is beyond an organization. And it's not just about one particular customer. It's about looking at a customer in his world and looking at a customer as a network. So he's a customer, he's a parent, he's related to a set of his spouse, he has children, he works for an employer. All these are important elements rather than looking at him as one customer and having that record and then dealing with that record. So we have all these reactive models. I think that is also key element that is changing. So for that, I think from an operability perspective, that's where we see a very important relevance of the context. We're saying, how do we really understand data? Because it's not just about data, how we really represent within our organization. It's about how we ingest data, which is out there. So that understanding the context, that's where we are really excited about FIBO and the efforts of FIBO in terms of saying data is becoming very impersonal. It's no longer organization specific. You don't talk about account at Bank A. You don't talk about account at Bank B. It's an account and interpretation of that cannot depend upon a particular organization. I think the impersonal nature of data, that's what is really interesting to set the context. I think beyond that, when we have set the context, how do we really address that need? I think many of these we have seen very interesting thing about the UPI. You must have heard of the UPI in India. It's about the universal payment. How do we really enable universal payment? How do we really ensure that customers don't really depend on a particular bank? We don't really have to depend upon the way a particular bank functions because I go to Bank A, Bank A asks me certain set of documents. I go to Bank A to transfer. It has a very different way. I go to Bank B, it has a different way. And I need to really understand, if I have a relationship with two or three banks, I really need to understand each and every bank. Though the bank says, I have done a whole lot to make it easier for you. It's still me. It's still Bank of America.  And I think that's what is changing. We're saying it's becoming impersonal. It's no longer saying, I as a Bank A have these processes. I as a Bank have process, period. It's a bank and a set of processes. So I think that's where the complementary element of interoperability, which is impersonal nature in terms of how I offer my services. That is where Bayan is coming. If you're not familiar with Bayan, I think the banking industry, architecture network, I don't know how many of you have heard it. But we're really excited about that particular element because it's about saying the way you structure, the way you scope your services, what you offer to your customers. It's no longer an exercise that you do by yourself. It's something that is collaborative. Lots of these banks realize this problem saying we spend a lot of time in plugging vendor products because the way they look at definitions of services is different from the way we look at it. We spend anywhere between six to 18 months.  So all these banks came together and said, let's not do it. We don't have to do, all of us don't need to do this every time. Let's ensure that we have a standard in terms of how we scope. And that's a big, big leap. They tried to do SOA, but I think SOA didn't really get to a level where they could interoperate. Everybody said SOA was specific within an organization. They really didn't share that in terms of the scoping. I think that's where it's changing with Bayan. It's saying how we scope, how we define our services, that needs to be standardized across. I think that's where, if you understand the context that FIBO is trying to standardize, make it impersonal. If you look at the way I structure my services, my business capabilities, that becomes impersonal. If these two come together, it's no longer about a particular bank. It's no longer about the services of a particular bank or a particular financial institution, it's about a service. And then the whole paradigm shifts to saying, this particular institution does it this way to the customer saying, I want it done, who can get it done? So it's almost like a bidding war, literally. I think that's where we are truly becoming customer centric. We are not expecting the customer to align with a particular set of processes of a bank, we're expecting the banks and the whole network to align to a customer. And that key element of enabling that is becoming impersonal. You're no longer saying that I as a bank work this way. You're no longer saying that I as a bank have these set of services. I think these two are very exciting elements of customer centricity in terms of saying, I understand what you want to do. And you want a particular product. I may not be able to have to define it, but I'll be able to collaborate. I think that's where new revenue streams are also possible for banks. And I think a lot of these conversations that we are having with banks, they're saying today, so many new things are coming. So many new players are coming. We're absolutely no idea how we are going to operate. One year down the line, we are really worried about what kinds of services we could offer at a reasonable price point. What is that price point defined by? That price point is defined by the cost that I have to maintain my own infrastructure, cause that I have to define and manage my own set of services. And my peers there, they also manage the same thing. And they do it differently. Of course, it's a great job for vendors and consultants. But in the end, banks have that huge cost base with all these new firms coming in, new intermediaries coming in, new startups coming in. They're saying our cost base is not really reflecting the ability to really become relevant or be relevant. And that's because our cost bases are all based on my way of doing things. It's no longer my way of doing things. It's about a way of doing things, which I agree with my peers. So that consistency in terms of how I define my data, how I define my information, how I manage my knowledge, and how I structure my services in terms of any organizational landscape that we look at, they have arbitrary level of complexity, arbitrary. And that really varies. There's no consistency. It's just that the only thing that is common probably is they're all complex. They don't talk the same way. When does define products, it takes a huge time for them to align. And that's also within a particular line of business. So this is what is changing the impersonal nature of my landscape. How do I really move from where I am in terms of my own data dictionaries, my own way of working? I think many of the times the interesting thing about banks is we're saying our transactional systems, we cannot change it. But maybe post facto for aggregating data, when somebody asks me for AML report, I'll be able to use this. So that's a huge step. That's an interesting step. That's a necessary step. But really that is not helping them align their systems because they are going to repeat, keep on continuing their investments in their own systems, they're not able to really reduce or probably address their cost base. So what's the other way of really looking at it? We're having conversations with some of these banks where they're saying. Can I really do anything about this particular system now? I have the option of either continuing it, replacing it with a product. And what should I do about it? Because I don't even know if this particular business line is relevant to me anymore. Many of these financial services firms, they're saying blockchain is coming. Is my line of business relevant? I do a whole lot of things on corporate actions. My whole revenue is coming from these corporate actions with blockchain and the flattening of information hierarchies. Will my revenue source be preserved and what do I do about this huge system? So there's an interesting, lots of uncertainties that financial institutions are facing. I think all these at the root of it is preserving the way they work and then probably looking at aggregating data as a post-facto thing. That is what I think is a key element which is influencing their continued set of problems, their continued set of systems. I think that's what is really changing. And quickly, this particular slide is essentially reiterating what I was talking about saying as the ownership of information, how I want it served, what is it about, that is shifting to a customer. The customer is actually demanding, he's actually dictating that. So when organizations need to align to that, they're saying, I have to invest in a whole lot of translation things. I'm doing a whole lot of things where I'm offering or rolling out mobile services, I'm doing a whole lot of things where I'm actually collaborating and probably bringing new sets of services. But in effect, they're all doing the same one common thing, which is adding another translation layer, adding another channel, but still preserving their way of working, not collaborating enough in terms of saying, am I doing the same way as other organizations? Because it's no longer the fact that the customer is only interacting with me. It's no longer about one payment. But today, I think some of the conversations are saying, you know what, the audit tape was something that I thought of as a burden. But if you really look at it, that particular data is very interesting for me. If I understand where something is coming and where something is going, I really can reposition myself because today I'm stuck in the kinds of products and services I'm offering, how can I really be relevant to understanding and making sure that that particular flow when something when a broker gets a particular order, it goes down and there's a set of executing broker and then it goes down. I'm really trying to understand how I can really play a role there. So it's opening up a very different perspective where compliance was a parallel set of activities. Now it's becoming more integrated to somebody saying, can I really get some benefit out of it? And that is changing because I no longer want to see compliance as a cost base. I want to see that as a new revenue source and not just because my revenue sources are secure, my revenue sources are no longer secure. Every conversation almost is saying, none of my revenue sources are secure. Most of my trading revenues are falling. I don't know my deposits, my deposits are falling.  That is because we're still looking at it as a set of products and services. I think that's where it's interesting, the whole concept of being able to understand, integrate data beyond your organization and realizing that to be relevant to a particular customer, it's going beyond your organizational boundaries, it's being able to collaborate. And for that collaboration, I need to speak the same language, not just in terms of data, in terms of services too. I think that's where both FIBO and BIAN, we see we're actually having a set of cases that we're working on. I'm not able to show that yet because it's still work in progress. But we see that as key, we're really working out in some of the cases that we're seeing, though they are just kind of play models for now. But we are using that to have conversations with the institutions saying, is this our imagination context that you can relate to? And they're saying, yes, maybe. I'm not able to really appreciate that at the moment, but maybe I can really look at it probably in the next few months or probably in the next 18 to 20 months. So that's interesting. To just summarize this, I think key elements that we talked about. Enabling, I think FIBO from its ontology perspective, it's actually enabling the shift where we are saying the terminologies that we typically associate with financial institutions, accounts, investments, securities, payments. These are all financial networks. It's like the language that we use in a club, the financial services club. But how do we really translate that into something that means something to a customer in his own world as a person? It's about ownership. It's about transfer. It's about affordability. It's actually looking at, can I own something? I just want to experience something. But for all that, I need to understand what this payment is, what this instrument is, what these specifics are. I think that translation is a key element. And I think FIBO is key for enabling that particular translation. And then when we move on to services, the key thing that we are seeing, I think many of these regulatory initiatives, when Europe is talking about the PSD2 where they're saying open API, we're actually looking at opening up and I think the API world will probably see a more uptake in terms of how services are used and become open. I think that way another transition is happening where we're saying account opening at Bank A, account opening at Bank B, account services, KYC, they are no longer specific to a bank. They're becoming consistent in terms of how you define it, what is in it, how you execute it, it's up to you. But the way it looks to a customer, the way it looks to an outside person, it's consistent and that gives a flexibility to a bank saying, is KYC really a core of my business? Do I really need to do it or can I have it off to a utility? You already see that. Some of the banks are actually setting up a utility saying, this is not core to me, but it's not possible for me to do today because I'm not structured that way. I think that's where Bayan is coming in terms of helping, structuring of your system so that all those non-core ones can really be hived off, so you become more cost efficient. I think that's the way FIBO and Bayan really are exciting initiatives. We are really invested in it, we're inspired by it and we hope to have some more use cases for validation with the FIBO team as well as Bayan team.


In order to understand what is going on in and around a black hole, we need to cover the twisting effect of rotating masses on the space surrounding them. The name given to the twisting is frame-dragging. The space is literally dragged along with the rotating mass. The effect was derived in 1918 by physicist Joseph Lenz and Hans Thering. It is known as the Lenz-Thering effect. They predicted that the rotation of a massive object would distort the spacetime metric, making the orbit of a nearby test particle precess like a gyroscope. This does not happen with Newtonian gravity, where the gravitational field of a body depends only on its mass, not on its rotation. It wasn't until 1963 that a mathematician named Roy Kerr discovered the significantly more complicated metric for rotating bodies that made it possible to calculate the precession one can expect from a given mass and rotation of an object like the Earth. To test this effect, NASA developed a satellite called Gravity Probe B and put it into orbit 264 kilometers above the Earth in 2004 where it operated for a year. It used a set of super-sensitive gyroscopes to measure precession due to frame-dragging. It also included a non-gravitational drag identification gyro and compensation micro thrusters to maintain a non-gravitational drag-free environment. It compensated for solar radiation drag and atmospheric disturbances drag. By 2011, data analysis had confirmed that frame-dragging did occur and measured it to within 15% of the amount predicted by the Kerr metric for Einstein's field equations.


Welcome to the Endnotes, where I put all the fun facts I can't fit into the main videos. Today, some extra bits of information from my video about music, and if you haven't seen that yet, click on the card. In that video, we looked at the word Museum, which comes from the ancient Greek Muses, goddesses of inspiration, referring originally to the temples of the Muses. The most important of these was the Museum of Alexandria, founded either by Ptolemy I or Ptolemy II. This museum was really more of a center of higher learning, more analogous to a modern university than a modern museum, and contained the famed Library of Alexandria, the greatest library of the ancient world. The idea of collections of antiquities and other artifacts can be traced back even further to ancient Mesopotamia, to the collection of antiquities compiled by the Babylonian princess Enigaldi in Ur, modern day Iraq. This collection, seemingly intended for educational purposes, included artifacts from a variety of periods, neatly arranged in rows, with clay tablet labels for each written in three different languages. Sounds a lot like a modern museum, doesn't it? But the big difference here, and with later iterations of this idea, is that it was a private collection. Indeed, when we get into the early modern era, such private collections of artifacts, both cultural and natural, were very popular, often known as cabinets of curiosities, though often much larger than a simple cabinet. One such cabinet of curiosities, known as the Ark, and collected by the Tradescant family, contained a variety of antiquities and oddities, later further bolstered by the American artifacts and natural specimens collected by botanist and gardener John Tradescant the Younger. Tradescant then either bequeathed to, or was spindled out of the family cabinet of curiosities, by antiquarian and early Freemason, Elias Ashmole, who then in turn bequeathed the collection along with his own collections of manuscripts to Oxford University, which then became the core of what became known as the Ashmolean Museum, the world's first university museum, and perhaps the first museum in Britain accessible to the public. Europe-wide, the first museums open to the public are generally held to date back to Renaissance Italy, specifically the capital line museums in Rome and the Vatican museums, both kicked off by donations from popes. The British Museum was founded in 1753 after botanist and physician Hans Sloane bequeathed his collection to the nation. And indeed, it's in the 18th century that many other countries started national collections that we would recognize as modern museums. By the way, Sloane's other claim to fame was, perhaps, inventing chocolate milk, though there is some debate on this point. Sloane picked up cocoa in Jamaica, but decided to mix it with milk rather than water. As for the word museum itself, it continued for some time to refer to institutions of learning before eventually the modern sense of museum as a collection for public display became the more common meaning. As always, you can hear even more etymology and history as well as interviews with a wide range of fascinating people on the Endless Knot podcast, available on all major podcast platforms as well as our other YouTube channel. Thanks for watching!