Online Privacy Attracts Entrepreneurs
A conversation with Rob Shavell, co-founder of online privacy company Abine
If you’re an ad-supported website owner or a marketer using the Web, then you know the value of online user data. Web tracking and online behavioral targeting have transformed the ability of advertisers and marketers to connect with likely customers, and helped pay for a Web that offers tremendous content value and personalization to consumers. But with proposals for increased consumer privacy controls, that may be about to change. Not since CAN-SPAM has there been the potential for such a tectonic shift in the world of online marketing. Microsoft and other browser developers are responding with new privacy functionality. And entrepreneurs are seizing the opportunity to find innovative solutions. Benchmark recently chatted with Rob Shavell, former venture capitalist and one of three co-founders at Boston startup Abine, Inc. (“A Bit Is Not Enough” when it comes to privacy), about the current state of online privacy, the debate over regulation, and what it means for users and marketers – a valuable perspective on the privacy debate and what it means for your enterprise.
Benchmark: Why we should be concerned about privacy and what specifically should we be concerned about?
Rob Shavell: Our opinion — the people that founded the company with myself — is very simple: all the social networking, everything that’s been going on over the last five or six years is great. It’s a wonderful way to connect with people and to share information about ourselves and our lives.
At the same time, for thousands of years before Facebook came along people have been very carefully managing big information about themselves and their families and their small groups of friends. That’s hard-wired in us, almost an evolutionary biological concept.
So we love to share, but at the same time we are very concerned about who knows what and when they know it and why they know it. We started the company to try to address that and give people, in a very simple sense, what they think they already have when they go online in their own room in front of their own laptop screen or their own computer and nobody’s looking over their shoulder, and they go search, visit websites and register and log in to places, and buy things.
They have a basic expectation about who knows what about them, but that’s not really what’s reflected on the Internet today.
Benchmark: Okay. So we’re being watched, we’re being tracked. Other than the violation of privacy, inasmuch as the average person sitting in front of the computer probably has no idea whatsoever they’re being tracked, is there any real danger other than getting super-targeted ads and maybe targeted content delivered as a result of all this?
Rob Shavell: There’s a tremendous impact that tracking can have, and it really has nothing to do with targeted advertising. We get asked this all the time. We’re not in business to stop advertisers. We don’t believe that ad blocking is an appropriate part of the tools we’re providing. We know that on the Web, it’s an important revenue model for Internet providers and for the ecosystem. There’s nothing wrong with targeted ads per se at all. In fact, if an ad is really well-targeted, it’s beneficial to you and it becomes information rather than advertising.
But you asked about the dangers of tracking and they are many and they’re really important. One is identity theft. Certainly when there’s more information about you out there, it can be easily accessed and used to impersonate you.
And in fact, thieves are getting pretty sophisticated about this. If you know the right people, you can hop onto a website right now and find tens of thousands of accounts with users’ full names in the United States broken down by zip code, broken down by bank account, broken down by how much was last in the bank account, mother’s maiden name, everything else. And they’re all for sale.
This information has a currency, it has a value and there’s a market for it. And so identity theft is one problem, but we believe that the problems are much, much deeper than the bad guys getting hold of your data and using it against you, because that only happens to 1 in every 100 or 150 Americans every year.
Benchmark: So what are those deeper concerns?
Rob Shavell: The kind of information that’s being gathered about you and correlated can be used for all kinds of things, and really the best analogy that I have for it is the credit bureaus.
We’re all familiar with employers, landlords, auto salespeople and others checking our credit for various things that we want to do. And while that’s a very useful tool — for a business to be able to rate the risk of you being able to transact with them — at the same time those companies are carefully watched by the government. There’s only a small number of them, and they’re regulated by the Fair Credit Reporting Act, by the FTC and so on.
But once you let that kind of information out into the wild — if every business becomes a credit bureau and has access to all kinds of different versions of data that could be used to discriminate against you because you searched for something related to a health problem, because you registered at a particular site or visited somewhere at some point in time that wasn't to the liking of this counterparty — it’s a very slippery slope into a world where you never know really why somebody’s making a decision about you one way or another, whether the data that they have is fair and accurate, whether they should even be legally allowed to use it, and whether they are responsible to some regulatory body.
So really the big concern is how easy it is to begin to build up data sets like this, aggregate them and everything else. We’re not arguing that you have to stop living your life online. But at the same time, you should have some protections against data being used against you.
Benchmark: OK, so give us a sense of the tracking problem your company is tackling.
Rob Shavell: We just did a survey of the top one thousand websites. Our crawler visited the home pages — just the home pages — of the top one thousand websites. Our software looks at all of the requests that go out from those websites when you visit the home page.
Keep in mind you haven’t clicked on anything. You haven’t indicated that you want to read an article, that you want to register at the site — you haven’t done a thing except go there. Now out of those 1,000 sites, we found 38,633 requests silently going from those sites to third parties — in other words, different domains on the Internet than the site you’re visiting. So that’s really a good numerical example about how much the Web has changed. The average person can’t see all this stuff happening when they visit a site. It’s astounding.
The average site is calling 38 other people without you knowing it right when you visit their home page. Now some of those are to get a graphics file or to display a Facebook "Like button," or other content calls. Others are for tracking them and sharing the fact that they, their IP from their town, visited this site then, and they also visited these other sites — it’s impossible for people just to figure out what’s going on. There’s just so much activity.
Benchmark: Are website users aware that they’re being tracked?
Rob Shavell: They have no idea. When they download our software, one of the things it does is just display where your data’s being shared and with whom when you visit a site. And people are just astounded. We constantly get users saying, ’I cannot believe it — I go to all these places and there are 10, 20 different ad networks sharing my information when I go to read the news in New York — if I go to The New York Post.’
I’ll tell you another interesting factoid that we just found out We took the top ten credit card companies — Discover, Chase, Citibank, etc. —and we looked at their sites and what they were doing. You would figure, ’Gee, the one place that doesn’t need to do any tracking is the credit card companies’ because they already know everything about what you buy and what you shop for, right? What more could they need to know? It’s your entire purchasing behavior. But they’re using a ton of this technology as well. Sometimes it’s mind boggling, the extent to which this is all happening.
Benchmark: We came across a report that said one particular website has more than 200 third parties tracking visitors that go there. Is that typical?
Rob Shavell: I think there’s a lot of sites that are doing just what you would assume they would be doing, which is nothing really bad. They’re just trying to target you with more effective ads. They use that to drive a higher cost per thousand for their display advertising. In the case of a lot of legitimate companies, there’s really nothing nefarious about it.
But the real problem comes in when you step back and you understand that there’s sites like the advertising networks, which the consumers also don’t know about, that sit in between all of these sites.
I mean, who cares if you get an ad that you’re interested in on dictionary.com, unless it’s something offensive to you based on your gender or your health or something like that, which I would assume dictionary.com, being a legitimate business, is going to take precautions to not do if they care about their user base.
But what’s concerning is that the advertising networks and a bunch of these other companies know that you went to dictionary.com, they know what you looked up on dictionary.com. They’re sharing that with hundreds of other sites, and some are able to build up a picture of you that might be a little bit more than, say, your mother knows about you currently.
And it might contain some information that you might not really ever want to share with different people in your life, and yet it’s there, and unfortunately, once it’s there it’s very hard to get rid of it. It’s very hard to get it removed because the cost of a hard drive and storing information is continuing to fall, so most of these companies have an attitude of, ’why would I ever delete information?’
Benchmark: So where’s the money here? What’s in it for Web publishers?
Rob Shavell: They’re a part of the ecosystem. They get more money for their advertising because they allow tracking and targeting, and they get more clicks on the ads, ostensibly. They wouldn’t be doing it if they didn’t make money. But if you really want to follow the money, it’s all in the middle, that hidden middle set of what the industry calls advertising networks.
Now these are companies that venture capitalists — and I used to be one and so I can validate it —venture capitalists are pouring money into these advertising networks, and in fact they’ve probably spent, I'm just going to guess upwards of $10 billion on startup advertising networks in the last two or three years. So it's a huge, new bet that these companies are going to revolutionize and completely change and make lots and lots of money around online advertising.
Benchmark: Have they all just been watching Google and how much money they’ve been making, and then trying to figure out ways to get a piece of that?
Rob Shavell: Yes, and unlike the Google they can live everywhere you go. They can watch you across the Web and that’s what they’ve done. Google had to do it the hard way — they had to offer a great search service that you came to and used. These ad companies just put cookies on your computer and then track you everywhere you go.
Benchmark: Right. So when you go to a website that is putting cookies on your computer, conceivably dozens or scores of organizations are tracking everything you do now because you looked up some word.
Rob Shavell: Correct. And that's precisely the problem. Maybe they're just a bad speller and they don't know that Hawaii has two i's in it. It's hard for computers to interpret data the way that you're using it, and that's the concern. If I look up a much more important example on dictionary.com, like a disease, and it was simply because we wanted to figure out the spelling of that and not because we had some kind of relationship to that disease, that's where these things become so problematic, right?
Benchmark: Or because you’re writing an article about it.
Rob Shavell: Or because you're writing an article about it, exactly. It used to be that we were the ones doing the interpretation in the context of our conversations and our business dealings. Now that all this data exists, the advertiser's job is going to be to convince people that no, most of this data is accurate and they have very empirical ways of going through it and telling you who's really got this disease and who really doesn't, and in reality I think that's very hard to do.
So the danger again, is that all this data gets aggregated and correlated, and the technology just keeps getting better and you wind up with lots of people using it, and lots of times using it for the wrong reasons.
Benchmark: And if you read the business press lately you find that the top driver of performance and growth in companies is analytics. They’re getting that data from somewhere.
Rob Shavell: That's right. There's incredible, incredible amounts of data being transmitted around and it's just like you said — people don't quite yet understand that every time they go and do anything, whether they're on the phone or on a computer, that data is now being logged.
And it's not just being logged by the site that they're on, which is fine, people have that expectation. If you went back ten years ago and you logged into a site, you maybe figured out that hey, that site probably can track which pages I'm going to and what I'm doing and if I bought something. That was okay. We understood that.
Benchmark: It was a deal.
Rob Shavell: Yes, it was a deal. 'Hey, I like your stuff. I'm going to buy from you. Okay, now you can send me a coupon. Great.' That kind of innocent, one-to-one relationship is gone, killed, dead, buried. And it's never coming back.
People need to catch up. That's what the journalists have been doing a good job at. And I think that's why the FTC is concerned about Do Not Track, and in Canada and Europe you're seeing a lot of legislative behavior and interest in this area.
There's a role for government to step in and help, along with the media, to educate people as to what's really going on and try to push the industry in a more responsible direction, rather than just using technology everywhere they can, at every point in time that they can, for any purpose, and then just seeing afterwards what the effects are.
Benchmark: Okay, so the argument from the other side from the people like the Interactive Ad Bureau and others is that if you put Do Not Track in place, you’re going to squash this huge industry that’s making the free Internet possible. Do they have a point?
Rob Shavell: There’s no chance of companies going out of business because they can’t appropriately track and target messaging to consumers. We’ve got 500 million people out there every day surfing every different kind of site, clicking on every kind of button. Keep in mind any site that you log in to, any site that you go to and use can know everything about you. That’s not what Do Not Track is about. Do Not Track is about the hidden, secret sharing of that information so that other companies can use it to market you other things. That’s a segment of the advertising industry. It’s one that’s growing quite quickly — but if it was growing at a slower rate would it make much of a dent in the industry? Not tremendously. What it would probably do is hurt some of these new startups that were funded in the last couple of years specifically to do this.
Benchmark: So you’re OK with the FTC recommending Do Not Track?
Rob Shavell: At the end of the day here's how we feel: We welcome the government's role in enlightened intervention. It's good that they're paying attention to this. It's good that the chairman of the FTC is interested in this concept. The Do Not Call list works very well in the U.S., at least according to some interpreters of it. One hundred fifty million people put their numbers on it and they'd like to have that success and give people that kind of control.
Again, obviously, we're a startup and we get concerned when government comes in and tries to be too heavy-handed with things. We think the FTC needs to focus on results and outcomes rather than on specific technologies. They should create a more level playing field and let the ecosystem in the marketplace compete and innovate to give consumers what they want.
That's all we want. So we think it's generally a good thing so far, and all we want to do is have a fair, level playing ground so that, as the technology quickly moves and the advertisers use new ways to track you, we want to be able to keep up with them and give consumers a choice.
Benchmark: The only thing the FTC has actually done so far is say, ‘we think it would be a really good idea if browser developers included a Do Not Track feature.’
Rob Shavell: That's right. They've just said, 'hey, we think Do Not Track as a concept is a good idea. We think the industry should figure out ways to promote it.' And keep in mind that their concept of Do Not Track is exactly what our solution and others in the marketplace are giving consumers today, which is the ability to opt out of targeted ads from these ad networks that we were just talking about.
It does not mean two things. It does not mean that consumers don't get advertising. They still get ads. They're just not targeted to all that data that's been secretly shared. And it does not mean that the companies need to stop collecting that information.
Even if this legislation were promulgated, the companies could still collect all the data. They just couldn't serve targeted ads using the data to the people that say 'don't track me.'
Right now the concept is, when a consumer says, 'don't track me online,' under the concept of the FTC's Do Not Track and under the Microsoft IE9 list concept, what you're doing when you raise your hand as a consumer is you're saying, 'hey, do not serve me ads using the data that's been collected.'
It doesn't stop them from collecting the data about you. It just stops them from putting one and one together to make two.
Benchmark: So if they're still following what site visitors are doing, that's not protecting them from anything other than ads at that point, right?
Rob Shavell: That's right. Which, as we talked about in the very beginning, really doesn't seem to be that much of a problem. At least it's not that much of a problem for me. I like some advertising and it doesn't seem to be that much of a problem for other people.
The real concerns are what data are you aggregating about me, and who are you sharing it with and what's it going to be used for in the future?
Benchmark: That brings us then to a more robust solution, which would be something like what your company provides, where you are actively blocking the tracking.
Rob Shavell: That's right. We have two things that we do for our users. It's really as simple as, we help you get privacy before your data is taken away from you and you're tracked and you give away your phone number and email address and all that other stuff. So we help you before — we do a bunch of things to retain a level of privacy that you're comfortable with.
And then we help you after, if that data gets out somewhere in public, with a service that we just launched called Delete Me, which serves like a 'delete' button for the Internet. It allows you, with our help, to get information removed that might be coming up in a publicly available database or a search result or a blog post or what have you.
So, as the online privacy company, we want to be the company that you can rely on to protect you before your privacy is lost, and then help you get it back if, indeed, you find something online about you that you're not exactly comfortable with.
And all of our solutions are designed to help give you that peace of mind that yes, indeed, you have a reasonable level of control over your own privacy, and you can draw the boundaries that you're comfortable with when it comes to being online and doing business and socializing and all the great things that we do.
Benchmark: It sounds a lot like the virus protection industry inasmuch as those companies are out there trying to stay ahead of the bad guys who are trying to harm your computer. Abine has to be constantly honing and refining and developing its technology to stay ahead of them.
Rob Shavell: It’s the same cat and mouse game. It’s the same arms race the antivirus vendors have been playing for years with the bad guys — the hackers and the virus creators and all of them. And now history is repeating itself with regard to privacy.We believe that Symantec and McAfee and the antivirus companies are eventually going to figure out that this is an area that they need to be aware of and help their users with. And we expect them to be our eventual competitors here.
Benchmark: There are statistics that indicate that as early as 2014 in the U.S. more people are going to browse on mobile than they are on the wired Web. Isn’t there more of a threat there with the geo location data, in addition to the rest of the tracking concerns?
Rob Shavell: We're very, very focused on what's happening in mobile. Geolocation data is always a threat. I'm sorry I didn't bring it up earlier when we talked about the real threats posed by tracking.
And by the way, another point that I should make is that, when these companies say the data is anonymous, it is a lie. It is a lie. It is a lie. They don't even have the computer science acumen within their staff and their teams to understand how to make data anonymous. It's harder to do than it looks, and this concept that any company can go out there and collect any amount of data they want, and remove the IP address column in the database and call it anonymous, is absolutely ludicrous. They have to be better at telling you what's really anonymous and what's not, and most of it is not.
But back to the mobile point — your location is a very dangerous thing to share, right? Well, if you're tweeting from somewhere and you're checked into somewhere or if you suddenly show up from a different location, you're obviously not at your house. Forget about identity theft. How about regular theft? So physical security is one aspect of this.
The other point to make about phones is, it's a very closed world versus the Internet's open world. The vendors need to be involved in order to give users the power to help themselves and to give users control. If the vendors don't get involved in enabling that, then you've got the situation that we have today where we, Abine, cannot make an app for your iPhone that clears your cookies for you, or bring some of the other technologies that we have to help you limit tracking while you're browsing on your iPhone, and limit the collection of your geolocation data. We as application developers can't access that.
So either I've got to get involved and the phone vendors need to get involved, or they need to open it up so that there can be innovation.
Benchmark: Is that an Apple-specific problem?
Rob Shavell: No, it’s not. It’s across a lot of the competitive landscape. Of course, Android is by nature more open than Apple is, and I don’t think we expect that to change. We have actual prototype solutions in place on Android, iPhone and BlackBerry today, but we are not ready to take them out into market until the vendors help us create more effective versions of those solutions.
Benchmark: What about the concept of merging online data and offline data to create profiles, which some people are getting alarmed about?
Rob Shavell: That's I think part of the same broader point that I was trying to make about this data collection. Once the data exists, anybody can be a buyer of it.
When you ask the question, 'who buys credit bureau data?' it's just financial transactions, right? It's very limited to a certain category of things — whether you've made payments and whether you've used a credit card. But it's not like the credit bureaus are limited very strenuously in who they can sell that data to. They want to sell that data to as many businesses as possible. Believe me, the CEO of Experian wants his sales team to sell as much of that data as possible every year. They're a public company and that's their shareholder duty.
But we don't want to be in a situation where we've created 10,000 Experians. With all of this new data —remember that 38 calls to different sites every time you visit one? — this is what's happening. Do you get the scale of what's happening? We're creating 10,000 Experians. Every time you visit a site, 38 other sites are called and information is flying around everywhere —and it is being tied back to you.
And it does mean that the offline world of loans and hospitals, your automotive insurance provider and god knows what else — everybody can have access to this data and it will be very competitive and there's going to be results that people really don't like.
And the business that we find ourselves in when we have conversations with the media is often trying to get them to understand that this isn't about seeing a more relevant ad. That’s a good thing generally speaking. It’s about limiting and being able to see the vast amount of data that’s being collected about you.
Benchmark: OK, so to wrap things up: if users haven’t adopted your product and installed it in their browsers, what’s your best advice to them, other than good luck?
Rob Shavell: My only advice is to be aware that what you do online is not private unless you’re actively doing something to make it private. So think before you do something that you wouldn’t be comfortable with other people knowing about. If that means you don’t want to go to a cancer survivor’s website and discussion group until you install some software, or maybe you use a proxy server — the average person should think about that. Or if you surf inappropriate content or what have you, you should think about that, because that may go on your permanent record, so to speak.
About Rob Shavell
Abine co-founder Rob Shavell has an extensive background in online security, Web start-ups and venture capital investing. He co-founded IdentityBreach.com, consulted with Identity Force, co-founded group travel portal TravelTogether.com, and was the fist angel investor in Wikispaces, a platform that has attracted several million users. At LRN, he designed, managed, and brought to market a solution now used by millions of Fortune 100 employees. He has been an associate at Softbank Capital Partners and Softbank/Mobius Venture Capital. Rob holds a BA form Cornell University; outside of work, he serves as a volunteer teacher, contributes to inner-city youth development programs, and, with whatever time is left, he skis and reads.