>> Announcer: From San Francisco, it's theCUBE! Covering RSA Conference 2020 San Francisco. Brought to you by SiliconANGLE Media. >> Hey welcome back, get ready, Jeff Frick here with theCUBE, we're at RSA 2020, here at Moscone, it's a really pretty day outside in San Francisco, unfortunately we're at the basement of Moscone, but that's 'cause this is the biggest thing going in security, it's probably 15,000 people, we haven't got the official number yet, but this is the place to be and security is a really really really big deal, and we're excited to have our next guest, I haven't seen her for a little while, since data privacy day. I tried to get Scott McNealy to join us, he unfortunately was predisposed and couldn't join us. Michelle Finneran Dennedy, in her new job, the CEO of DrumWave. Michelle, great to see you. >> Great to see you too, I'm sorry I missed you on privacy day. >> I know, so DrumWave, tell us all about DrumWave, last we saw you this is a new adventure since we last spoke. >> It's a new adventure, so this is my first early stage company, we're still seeking series A, we're a young company, but our mantra is we are the data value company. So they have had this very robust analytics engine that goes into the heart of data, and can track it and map it and make it beautiful, and along came McNealy, who actually sits on our board. And they said we need someone, it's all happening. So they asked Scott McNealy, who is the craziest person in privacy and data that you know and he said "Oh my God, get the Dennedy woman." So, they got the Dennedy woman and that's what I do now, so I've taken this analytics value engine, I'm pointing it to the board as I've always said, Grace Hopper said, data value and data risk has to be on the corporate balance sheet, and so that's what we're building is a data balance sheet for everyone to use, to actually value data. >> So to actually put a value on the data, so this is a really interesting topic, because people talk about the value of data, we see the value of data wrapped up, not directly, but indirectly in companies like Facebook and Google and those types of companies who clearly are leveraging data in a very different way, but it is not a line item on a balance sheet, they don't teach you that at business school next to capital assets and, right, so how are you attacking the problem, 'cause that's a huge, arguably will be the biggest asset anyone will have on their balance sheet at some point in time. >> Absolutely, and so I go back to basic principles, the same as I did when I started privacy engineering. I look and I say "Okay, if we believe the data's an asset," and I think that at least verbally, we all say the words "Yes, data is an asset," instead of some sort of exhaust, then you have to look back and say "What's an asset?" Well an asset, under the accounting rules, is anything tangible or intangible that is likely to cause economic benefit. So you break that down, what is the thing, well you got to map that thing. So where is your data? Well data tells you where it is. Instead of bringing in clip boards and saying "Hey, Jeff, my man, do you process PII?" We don't do that, we go to your system, and when you go on DrumWave, you're automatically receiving an ontology that says what is this likely to be, using some machine learning, and then every single column proclaims itself. And so we have a data provenance for every column, so you put that into an analytics engine, and suddenly you can start asking human questions of real data. >> And do you ask the questions to assess the value of the data, or is the ultimate valuation of that data in the categorization and the ontology, and knowing that I have this this this and this, or I mean we know what the real value is, the soft value is what you can do with it, but when you do the analytics on it, are you trying to get to unlock what the potential, underlying analytic value is of that data that you have in your possession? >> Yeah, so the short answer is both, and the longer answer is, so my cofounder, Andre Vellozo, believes, and I believe too, that every conversation is a transaction. So just like you look at transactions within the banking context, and you say, you have to know that it's there, creating a data ontology. You have to know what the context is, so when you upload your data, you receive a data provenance, now you can actually look at, as the data controller, you open what we call your wallet, which is your portal into our analytics engine, and you can see across the various data wranglers, so each business unit has put their data on, because the data's not leaving your place, it's either big data, small data, I don't really care data. Everything comes in through every business unit, loads up their data set, and we look across it and we say "What kind of data is there?" So there's quantitative data saying, if you took off the first 10 lines of this column in marketing, now you have a lump of data that's pure analytics. You just share those credentials and combine that dataset, you know you have a clean set of data that you can even sell, or you can create an analytic, because you don't have any PII. For most data sets, you look at relative value, so for example, one of the discussions I had with a customer today, we know when we fail in privacy, we have a privacy breach, and we pay our lawyers, and so on. Do you know what a privacy success is? >> Hopefully it's like an offensive lineman, you don't hear their name the whole game right, 'cause they don't get a holding call. >> Until they put the ball in the hole. So who's putting the ball in the hole, sales is a privacy success. You've had a conversation with someone who was the right someone in context to sign on the bottom line. You have shared information in a proportionate way. If you have the wrong data, your sale cycle is slower. So we can show, are you efficiently sharing data, how does that correlate with the results of your business unit? Marketing is another privacy success. There's always that old adage that we know that 50% of marketing is a waste, but we don't know which 50%. Well now we can look at it and say "All right," marketing can be looked at as people being prepared to buy your product, or prepared to think in a new, persuasive way. So who's clicking on that stuff, that used to be the metric, now you should tie that back to, how much are you storing for how long related to who's clicking, and tying it to other metrics. So the minute you put data into an analytics engine, it's not me that's going to tell you how you're going to do your data balance sheet, you're going to tell me how dependent you are on digital transactions versus tangible, building things, selling things, moving things, but everyone is a digital business now, and so we can put the intelligence on top of that so you, the expert in value, can look at that value and make your own conclusions. >> And really, what you're talking about then is tying it to my known processes, so you're almost kind of parsing out the role of the data in doing what I'm trying to do with my everyday business. So that's very different than looking at, say, something like, say a Facebook or an Amazon or a Google that are using the data not necessarily, I mean they are supporting the regular processes, but they're getting the valuation bump because of the potential. >> By selling it. >> Or selling it, or doing new businesses based on the data, not just the data in support of the current business. So is that part of your program as well, do you think? >> Absolutely, so we could do the same kind of ontology and value assessment for an Apple, Apple assesses value by keeping it close, and it's not like they're not exploiting data value, it's just that they're having everyone look into the closed garden, and that's very valuable. Facebook started that way with Facebook Circles way back when, and then they decided when they wanted to grow, they actually would start to share. And then it had some interesting consequences along the line. So you can actually look at both of those models as data valuation models. How much is it worth for an advertiser to get the insights about your customers, whether or not they're anonymized or not, and in certain contexts, so healthcare, you want it to be hyper-identifiable, you want it to be exactly that person. So that valuation is higher, with a higher correlation of every time that PII is associated with a treatment, to that specific person with the right name, and the same Jr. or Sr. or Mrs. or Dr., all of that correlated into one, now your value has gone up, whether you're selling that data or what you're selling is services into that data, which is that customer's needs and wants. >> And in doing this with customers, what's been the biggest surprise in terms of a value, a piece of value in the data that maybe just wasn't recognized, or kind of below the covers, or never really had the direct correlation or association that it should've had? >> Yeah, so I don't know if I'm going to directly answer it or I'm going to sidewind it, but I think my biggest surprise wasn't a surprise to me, it was a surprise to my customers. The customers thought we were going to assess their data so they could start selling it, or they could buy other data sources, combine it, enrich it, and then either sell it or get these new insights. >> Jeff: That's what they brought you in for. >> Yeah, I know, cute, right? Yeah, so I'm like "Okay." The aha moment, of course, is that first of all, the "Oh my God" moment in data rarely happens, sometimes in big research cases, you'll get an instance of some biometric that doesn't behave organically, but we're talking about human behavior here, so the "Aha, we should be selling phone data "to people with phones" should not be an aha, that's just bad marketing. So instead, the aha for me has been A, how eager and desperate people are for actually looking at this, I really thought this was going to be a much more steep hill to climb to say "Hey, data's an asset," I've been saying this for over 20 years now, and people are kind of like "Yeah, yeah, yeah." Now for the first time, I'm seeing people really want to get on board and look comprehensively, so I thought we'd be doing little skinny pilots, oh no, everyone wants to get all their data on board so they can start playing around with it. So that's been really a wake-up call for a privacy gal. >> Right, well it's kind of interesting, 'cause you're kind of at the tail end of the hype cycle on big data, with Hadoop, and all that that represented, it went up and down and nobody had-- >> Michelle: Well we thought more was more. >> We thought more was more, but we didn't have the skills to manage it, and there was a lot of issues. And so now you never hear about big data per say, but data's pervasive everywhere, data management is pervasive everywhere, and again, we see the crazy valuations based on database companies, that are clearly getting that. >> And data privacy companies, I mean look at the market in DC land, and any DCs that are looking at this, talk to mama, I know what to do. But we're seeing one feature companies blowing up in the marketplace right now, people really want to know how to handle the risk side as well as the value side. Am I doing the right thing, that's my number one thing that not CPOs are, because they all know how crazy it is out there, but it's chief financial officers are my number one customer. They want to know that they're doing the right thing, both in terms of investment, but also in terms of morality and ethics, am I doing the right thing, am I growing the right kind of business, and how much of my big data is paying me back, or going back to accountancy rules, the definition of a liability is an asset that is uncurated. So I can have a pencil factory, 'cause I sell pencils, and that's great, that's where I house my pencils, I go and I get, but if something happened and somehow the route driver disappeared, and that general manager went away, now I own a pencil factory that has holes in the roof, that has rotting merchandise, that kids can get into, and maybe the ceiling falls, there's a fire, all that is, if I'm not utilizing that asset, is a liability, and we're seeing real money coming out of the European Union, there was a hotel case where the data that they were hoarding wasn't wrong, it was about real people who had stayed at their hotels, it just was in the 90s. And so they were fined 14.5 million Euros for keeping stale data, an asset had turned into a liability, and that's why you're constantly balancing, is it value, is it risk, am I taking so much risk that I'm not compensating with value and vice versa, and I think that's the new aha moment of really looking at your data valuation. >> Yeah, and I think that was part of the big data thing too, where people finally realized it's not a liability, thinking about "I got to buy servers to store it, "and I got to buy storage, and I got to do all this stuff," and they'd just let it fall on the floor. It's not free, but it does have an asset value if you know what to do with it. So let's shift gears about privacy specifically, because obviously you are the queen of privacy. >> I like that, that's my new title. >> GDPR went down, and now we've got the California version of GDPR, love to get your update, did you happen to be here earlier for the keynotes, and there was a conversation on stage about the right to be forgotten. >> Jennifer: Oh dear god, now, tell me. >> And is it even possible, and a very esteemed group of panelists up there just talking about very simple instances where, I search on something that you did, and now I want to be forgotten. >> Did no one watch Back to the Future? Did we not watch that show? Back to the Future where all their limbs start disappearing? >> Yes, yes, it's hard to implement some of these things. >> This has been my exhaustion with the right to be forgotten since the beginning. Humanity has never desired a right to be forgotten. Now people could go from one village to the next and redo themselves, but not without the knowledge that they gained, and being who they were in the last village. >> Jeff: Speaking to people along the way. >> Right, you become a different entity along the way. So, the problem always was really, differential publicity. So, some dude doesn't pay back his debtors, he's called a bad guy, and suddenly, any time you Google him, or Bing him, Bing's still there, right? >> Jeff: I believe so. >> Okay, so you could Bing someone, I guess, and then that would be the first search term, that was the harm, was saying that your past shouldn't always come back to haunt you. And so what we try to do is use this big, soupy term that doesn't exist in philosophy, in art, the Chimea Roos had a great right to be forgotten plan. See how that went down? >> That was not very pleasant. >> No, it was not pleasant, because what happens is, you take out knowledge when you try to look backwards and say "Well, we're going to keep this piece and that," we are what we are, I'm a red hot mess, but I'm a combination of my red hot messes, and some of the things I've learned are based on that. So there's a philosophical debate, but then there's also the pragmatic one of how do you fix it, who fixes it, and who gets to decide whose right it is to be forgotten? >> And what is the goal, that's probably the most important thing, what is the goal that we're trying to achieve, what is the bad thing that we're trying to avoid, versus coming up with some grandiose idea that probably is not possible, much less practical. >> There's a suit against the Catholic Church right now, I don't know if you heard this, and they're not actually in Europe, they live in Vatican City, but there's a suit against, about the right to be forgotten, if I decide I'm no longer Catholic, I'm not doing it, Mom, I'm hearing you, then I should be able to go to the church and erase my baptismal records and all the rest. >> Jeff: Oh, I hadn't heard that one. >> I find it, first of all, as someone who is culturally Catholic, I don't know if I can be as saintly as I once was, as a young child. What happens if my husband decides to not be Catholic anymore? What happens if I'm not married anymore, but now my marriage certificate is gone from the Catholic Church? Are my children bastards now? >> Michelle's going deep. >> What the hell? Literally, what the hell? So I think it's the unintended consequence without, this goes back to our formula, is the data value of deletion proportionate to the data risk, and I would say the right to be forgotten is like this. Now having an indexability or an erasability of a one-time thing, or, I'll give you another corner case, I've done a little bit of thinking, so you probably shouldn't have asked me about this question, but, in the US, when there's a domestic abuse allegation, or someone calls 911, the police officers have to stay safe, and so typically they just take everybody down to the station, men and women. Guess who are most often the aggressors? Usually the dudes. But guess who also gets a mugshot and fingerprints taken? The victim of the domestic abuse. That is technically a public record, there's never been a trial, that person may or may not ever be charged for any offense at all, she just was there, in her own home, having the crap beat out of her. Now she turns her life around, she leaves her abusers, and it can happen to men too, but I'm being biased. And then you do a Google search, and the first thing you find is a mugshot of suspected violence. Are you going to hire that person? Probably not. >> Well, begs a whole discussion, this is the generation where everything's been documented all along the way, so whether they choose or not choose or want or don't want, and how much of it's based on surveillance cameras that you didn't even know. I thought you were going to say, and then you ask Alexa, "Can you please give me the recording "of what really went down?" Which has also been done, it has happened, it has happened, actually, which then you say "Hm, well, is having the data worth the privacy risk "to actually stop the perp from continuing the abuse?" >> Exactly, and one of my age-old mantras, there's very few things that rhyme, but this one does, but if you can't protect, do not collect. So if you're collecting all these recordings in the domestic, think about how you're going to protect. >> There's other people that should've hired you on that one. We won't go there. >> So much stuff to do. >> All right Michelle, but unfortunately we have to leave it there, but thank you for stopping by, I know it's kind of not a happy ending. But good things with DrumWave, so congratulations, we continue to watch the story evolve, and I'm sure it'll be nothing but phenomenal success. >> It's going to be a good time. >> All right, thanks a lot Michelle. She's Michelle, I'm Jeff, you're watching theCUBE, we're at RSA 2020 in San Francisco, thanks for watching, we'll see you next time. (techno music)