Privacy and Security: The Six Words Project [podcast]

Sol Bermann
Chief Information Security Officer
Executive Director of Information Assurance
University of Michigan Ann Arbor

Michael Corn
Chief Information Security Officer
UC San Diego

Gerry Bayne: Welcome to the EDUCAUSE podcast. I'm Jerry Bay issues. Number one, and number two on the EDUCAUSE 2020 top 10 IT issues list are information security strategy and privacy. And the discussion around these topics can be critically important. How do you deepen the conversation with users around cyber security and privacy? Our answer focuses on a strategy being implemented by both the University of California, San Diego and the University of Michigan Ann Arbor. Here's Michael Corn, Chief Information Security Officer at UC San Diego.

Michael Corn: The origin of this really is owed to EDUCAUSE. When Michelle Norris gave her keynote, I think it was last year, I walked out of that presentation, just in awe of what she had done with the Race Card Project.

Bayne: The Race Card Project was started in 2010 by author Michelle Norris, to foster wider conversation about race. The idea is to submit a six word essay, initially written on postcards, that shares your own candid feeling about race. And whether the message is thoughtful, funny, heartbreaking, brave, angry, or hopeful, the brevity of it distills the notion into a core starting point for honest conversation. After hearing Norris speak at an EDUCAUSE event, Corn wanted to use a similar strategy on his campus.

Corn: And Saul was one of the first two people I ran into.

Bayne: Saul Berman is Chief Privacy Officer and interim CSO at the University of Michigan Ann Arbor.

Corn: And I said, Saul, "We got to do this at our schools. Let's both do the six word campaign." He wanted to focus on privacy, initially. And I thought it would be fun to start with cybersecurity here and that we would share and go back and forth and talk about how we might do this.

Sol Bermann: One thing led to another, and as I was gearing up for data privacy day, this is an endeavor I partner with a faculty member in our school of information on, I broached the topic with him. I was like, "Wouldn't it be cool if we could engender some conversation around privacy, because it is so personal. It is so difficult. What if we boiled it down to six words?" And he's like, "Yeah, let's give it a try." And so we did and so we developed a postcard and a website that very much looks like a lot of The Race Card Project materials and that was the origin. And Mike is in the process now with rolling this out for what does security mean to you at his home and UC San Diego.

Corn: It was at first, a hard sell because people were like, why are you doing this? What's the point? And how many people do you really expect to respond to this? We have 30,000 staff and 35,000 students and what are we really going to do here? But we persevered. Our communications guy, I got to get props out to Doug [Bonillo 00:09:06]. He did a beautiful job on our website and we worked with Michigan and shared templates for the little cards that we mailed to people. And then we launched it, it was very simple. We have not to this point in time, done a big push on marketing on it, but we wanted to see what would happen, what we would learn.

Bermann: So the sense I've gotten from our submissions to date are it's not about law. Most of the responses we've gotten have been, I would say there's two themes. One, that privacy is a thing that is important, whether it's around growth and development, preserving our civil and individual liberties, that privacy plays a role in that. And the other overarching sentiment has been, boy, I'm really worried about the future. I am worried about the present and where things are going in the future.

I think if you read news stories of late, we're starting to move away from the sensationalism of data breaches, which people often associate with privacy in many ways. [inaudible 00:00:03:50], there's privacy components, but there's IT security components, but you're seeing a lot more about privacy itself, whether that's privacy and the internet of things, that could be your phone, that could be your smart home assistants It could be the doorbells and their cameras or things like Cambridge Analytica, where there's been mass data collection and reuse that profiles people. We're seeing a lot more of what I would just call, the meat of what privacy is about. That to me, is a positive step and I think that's reflective perhaps in some of the comments we've gotten back in the Six Words of Privacy.

Corn: It's been fascinating. Some of the responses we've got have been cybersecurity is too hard. And what we're trying to understand is when we talk about security with our community, how do we connect to them? And obviously, the way you connect with people is you let them talk about what they care about, right? It's a standard approach to human interaction. So we wanted to have people talk to us and tell us when they think about cyber security, does it mean passwords are too hard or does it mean, boy, I'm worried about identity theft or is it about privacy?

I mean, privacy and security are so deeply entwined in the public mind. What I found really fascinating as the responses came in, is a surprising number of people actually had extended stories to tell. They would write a paragraph and upload a photo of themselves or something like that. And I was a little surprised to see how many of those we got, especially given that we haven't pushed this aggressively to the broader community yet.

Bayne: Pushing to the broader community is the plan for both Michael and Saul. They hope to work with marketing, to launch a more widespread campaign and they have aspirations on how to view the responses they receive.

Bermann: We are going to try to figure out how do we make this more sustainable? I have aspirations of, can we build this into a classroom experience or can we build this into an incoming student experience? Perhaps all incoming students of the University of Michigan are asked to say what six words about privacy means to you, and that'll help build critical mass.

If we can create a movement in this space that helps breed education and awareness, that would be a wonderful outcome. I don't think we already have good conversations, particularly in the privacy space, without some raising of consciousness and awareness. And that's really what this is designed for.

Corn: It would be interesting to quantify each of the responses by where it sits on some sort of emotional spectrum, to get a sense of, are people scared? Are people encouraged? I would like to think that security practices are things of comfort to people, but I don't think that's actually what people think. I want to harvest this information and analyze it and have it steer our messaging and communications. We could have town halls, we could have governance groups where we talk about these issues. We could see is it possible for us to actually modify people's vision of information, security and privacy, based on what we learn from this.

Bermann: We have plans to do a larger scale, random mailing, to do a lot more interaction amongst faculty and students to get their input. Maybe we can gamify or perhaps provide rewards for those, incentivize it a little bit more. Even in the small scale though, it has made it a lot easier to have a conversation about, wow, this is, in a nutshell, what privacy has meant for me. And I can relay that, whether it's to faculty or staff or students or executive officers that here's some of what we're hearing.

Probably in the longer term, we have aspirations of, if we can get critical mass, is this something we can actually use as a research tool. And our faculty, plum the responses, and certainly put a pulse on what privacy is meaning, at least at the University of Michigan in a very short, succinct manner.

Corn: Now that we've gotten quite a few responses, we need to make the flow through the responses, more elegant. We're following up with one or two people a month that would say, please contact me or feel free to contact me, and we're interviewing them. And they will end up with a single page each on the website for more in depth stories. Why'd you respond? What does cyber security mean to you, et cetera, et cetera. And then we'd like to add some material around what we're learning. If people find cybersecurity, daunting and terrifying, I want to say, this is what we hear you saying. People are much more thoughtful and engaged in cybersecurity than I think the average person realizes. And the responses we're seeing are different than what you might anticipate and it's worth browsing through them to see what people are saying. It's very eyeopening.

Bayne: Michael Corn is Chief Information Security Officer at UC Diego. If you would like to visit his six words cybersecurity site, you can find it at sixwords.ucsd.edu. Saul Berman is Chief Privacy Officer and interim CSO at the University of Michigan Ann Arbor. His six words campaign on privacy can be found at safecomputing.umich.edu. And if you'd like to visit the project that inspired both of these efforts, you can find it at theracecardproject.com. I'm Gerry Bayne for EDUCAUSE. And thanks for listening.