{"id":63288,"date":"2018-04-17T06:35:41","date_gmt":"2018-04-17T06:35:41","guid":{"rendered":"https:\/\/www.biphoo.com\/bipnews\/?p=63288"},"modified":"2018-04-17T06:35:41","modified_gmt":"2018-04-17T06:35:41","slug":"meet-woman-leads-nightwatch-googles-internal-privacy-strike-force","status":"publish","type":"post","link":"https:\/\/www.biphoo.com\/bipnews\/technology\/meet-woman-leads-nightwatch-googles-internal-privacy-strike-force.html","title":{"rendered":"Meet the Woman Who Leads NightWatch, Google’s Internal Privacy Strike Force"},"content":{"rendered":"

Meet the Woman Who Leads NightWatch, Google’s Internal Privacy Strike Force<\/span><\/strong><\/h2>\n

Lea Kissner is back at her alma mater, the University of California at Berkeley, armed with a crisp gray blazer, a slide deck, and a laptop with a \u2018My Other Car Is A Pynchon Novel\u2019 sticker on it. Since graduating in 2002, she\u2019s earned a PhD at Carnegie Mellon in cryptography and worked her way up at Google, where she manages user privacy and tries to keep things from breaking. She\u2019s here to tell a hall of computer science students how she did it\u2014and also how to create privacy-protective systems at a scale that you won\u2019t find outside a handful of massive tech companies.<\/span><\/p>\n

When privacy breaks down at a tech company, especially one the size of Google, it inevitably leads to countless headlines and congressional hearings. The word \u201cEquifax\u201d or \u201cYahoo\u201d is more synonymous today with hacking than with any service either company offered. If its exploitation by Russian intelligence was not enough, Facebook\u2019s reputation has been battered over the past month as its years-long negligence to protect user data from Cambridge Analytica has been revealed.<\/span><\/p>\n

It\u2019s a fate that Google, of course, would very much like to avoid. And making sure that Google products protect the privacy of users around the world\u2014and that Google accounts for individual users\u2019 varying definitions of privacy\u2014is Kissner\u2019s job.<\/span><\/p>\n

Kissner\u2019s responsibilities include making sure that Google\u2019s infrastructure behaves the way it\u2019s supposed to, transmitting user data securely and not leaving bits of data hanging around in the wrong spots. If someone sends an email, it needs to not leak in transit. If that person deletes the email, it has to actually go away without leaving a residual copy on a maintenance server. Another part of the job is making sure Google\u2019s products behave the way users expect them to. This also involves considering how someone with malicious intent might take advantage of a Google product and patching up those holes before they\u2019re exploited.<\/span><\/p>\n

Kissner leads a team of 90 employees called NightWatch, which reviews almost all of the products that Google launches for potential privacy flaws. Sometimes, products just need a bit of work to pass muster\u2014to meet the standard of what a former colleague of Kissner\u2019s, Yonatan Zunger, calls \u201crespectful computing.\u201d<\/span><\/p>\n

The fundamental challenge for a team like NightWatch, Zunger says, is making computing systems that people feel comfortable using. \u201cThey don\u2019t feel safe, they don\u2019t feel trust. They look at companies and they don\u2019t know: Does this company have my best interests at heart at all? If you don\u2019t deeply and intuitively understand the company\u2019s business model, you can assume the worst,\u201d Zunger explains.<\/span><\/p>\n

Being respectful of a user can be as simple as giving her a way to respond to a product that bothers her, whether its an ad for a chicken recipe that\u2019s not relevant for her because she\u2019s a vegetarian or an abusive message that she wants to report. Sometimes, products have privacy failings at their core and they don\u2019t get NightWatch\u2019s signoff\u2014and so they don\u2019t launch.<\/span><\/p>\n

\u201cI\u2019ve had a fair number of teams come out of that and they say, \u2018We need to find a new project now because we need to cancel our project,\u2019\u201d Kissner tells me. \u201cI heard a rumor that I\u2019m scary when I go into these conversations, which I find very surprising because I don\u2019t think I\u2019m a very scary person.\u201d<\/span><\/p>\n

Kissner has even had to hit the kill switch on her own projects. She recently tried to obscure some data (which exact data she won\u2019t say; Google is cagey about going into detail on its sidelined ventures) using cryptography, so that none of it would be visible to Google upon upload. She was looking forward to whiteboarding it out for Google\u2019s lawyers\u2014\u201cTrying to explain crypto to lawyers is always exciting\u201d\u2014but it turned out that making the feature work would require more spare computing power than Google has in all of its data centers, combined.<\/span><\/p>\n

\u201cI\u2019m keeping an eye on the crypto conferences in case something comes up that we can use,\u201d Kissner says sadly. \u201cI hope somebody else figures out how to solve a problem if I can\u2019t solve it. One of the advantages to working at Google is that you have choices that would just be considered completely out of the question anywhere else. Even so, I can\u2019t always get the answer right.\u201d<\/span><\/p>\n

Kissner is here at UC Berkeley to pitch paranoia\u2014paranoia as a career asset, a life skill, a North Star. \u201cThere are a number of ways system failure can get really really tricky. Paranoia is awesome because then you can find them!\u201d she cheerfully declares.<\/span><\/p>\n

It turns out that implementing privacy at scale isn\u2019t very captivating, at least not to this group of students gathered in a lecture hall after dark. I can see several of them chatting with each other on Facebook Messenger, one playing online chess, and another livestreaming a sports game. The problem with getting students\u2014or anyone, really\u2014excited about privacy at scale is that, when everything\u2019s working as it should, it\u2019s not exactly thrilling.<\/span><\/p>\n

\u201cSecurity is a basically adversarial thing. You are studying failures deliberately introduced by hostile actors. Your job is paranoia\u2014literally, that is your job,\u201d Zunger tells me.<\/span><\/p>\n

The thing is, Kissner is not a naturally paranoid person. Kissner, who started programming in elementary school by mocking up elaborate password schemes in Basic on her dad\u2019s calculator, spent her childhood as an amicable, trusting geek. She played a lot of mahjong and was part of her school\u2019s band and worked on a Mars rover the summer after graduating from high school.<\/span><\/p>\n

Kissner gave up her early fascination with robots to study cryptography instead, which she jokes was a decision owed to both the toxicity of solder fumes and a fascination with difficult math. \u201cI have a lot of feelings for combinatorics and for group theory and for number theory\u2014that stuff is beautiful,\u201d she says, then corrects herself. \u201cSorry, number theory is cute. Abstract algebra is beautiful.\u201d<\/span><\/p>\n

I laugh, but she\u2019s not kidding. \u201cI\u2019m serious!\u201d she exclaims. \u201cAbstract algebra is very, very, very elegant. Number theory, it\u2019s just like all these cute things fall out when you do abstract algebra with actual numbers.\u201d<\/span><\/p>\n

Getting a read on people and gauging their trustworthiness was a skill Kissner learned later in life, she says\u2014an uncomfortable experience, but one she immediately applied back into her work. \u201cI am extremely aware that not everybody experiences the world the way I do. I\u2019m actually surprised when I meet somebody who experiences the world the way I do,\u201d Kissner says. \u201cIt took me a lot of work to be able to understand other humans at all\u2014not at all, but reasonably well.\u201d<\/span><\/p>\n

Intimidatingly, precisely focused and eager to drill into complex topics, Kissner talks me through the finer points of building robots before breaking down the particulars of the European Union\u2019s General Data Protection Regulation. She\u2019ll spend the next several months painstakingly preparing Google\u2019s products for compliance with GDPR\u2014regulation that sets sweeping new data-privacy rules and requires companies to comply if they serve customers within the EU\u2014but the company is fortunately in pretty good shape already, thanks to its prior commitments to data portability.<\/span><\/p>\n

As a grad student, Kissner attended her first CRYPTO, one of the largest academic cryptography conferences in the world. She\u2019d gotten a paper accepted to the conference\u2014a career-making opportunity.<\/span><\/p>\n

But the trip was soured by a run-in with another conference attendee, a man who followed her around the conference making remarks about how he\u2019d been dreaming about her. Kissner won\u2019t say who he was, just that he was influential enough to have his own Wikipedia page.<\/span><\/p>\n

\u201cI didn\u2019t know whether they would directly be able to influence my career. But I didn\u2019t want that to be the thing people knew about me when I went to go look for a job in a few years,\u201d she recalls. \u201cThe best case would be, \u2018Oh it\u2019s that girl that that guy did that creepy thing to,\u2019 which is not really what I wanted to be known for.\u201d<\/span><\/p>\n

Kissner certainly isn\u2019t the only woman working in cybersecurity who would probably prefer to be evaluated on the merits of her work. But even when you\u2019re not thinking of your gender, cybersecurity is one of those industries that will remind you, often abruptly, that you are practically alone in the room. When the massive security conference RSA announced its keynote speakers earlier this year, there was just one woman in the lineup\u2014which prompted women in the industry to spin up a conference of their own. OURSA, a one-day conference taking place on Tuesday, is the result of that work. The entire event was planned in less than five days and sold out in under 12 hours, indicating the high demand for diverse conversations about security and privacy. Kissner will chair one of the conference tracks, Practical Privacy Protection.<\/span><\/p>\n

Kissner has worked to make sure that diversity is reflected not just at OURSA but at NightWatch. The team recruits people with as many different skill sets and backgrounds as possible so that they\u2019ll be better at recognizing privacy problems that others might not see.<\/span><\/p>\n

Still, though, there are limits that NightWatch can\u2019t recruit its way out of, Kissner concedes. For instance, the team won\u2019t be able to have members that are currently experiencing unemployment, obviously, since they would need to be employed by Google to review its unreleased products.<\/span><\/p>\n

\u201cI think it\u2019s incredibly important to have a lot of different ideas when you are designing security and privacy,\u201d Kissner says. \u201cYou are taking care of the incredibly diverse set of people in the world and it\u2019s hard to understand what they need and take care of that unless you have voices from all different backgrounds and skill sets.\u201d<\/span><\/p>\n

It seems like the Berkeley students aren\u2019t buying into Kissner\u2019s paranoia\u2014until the end of the lecture when a student asks whether Google actually deletes data when it claims to and how long that process takes. Never mind that Kissner has just walked through exactly how Google deletes data\u2014in moderate technical detail, no less.<\/span><\/p>\n

\u201cWe really delete the data, like for reals,\u201d she replies. But she can\u2019t say exactly how long it takes for the data to disappear, even when the student presses the point.<\/span><\/p>\n

\u201cI want to tell people things we\u2019ve learned. I want to build the world I want to live in, and the world I want to live in includes things like products being designed respectfully of users and systems being designed respectfully for users. I don\u2019t think everybody has to learn everything the hard way,\u201d Kissner tells me later. Then, the mathematician in her kicks in and she adds, \u201cIt\u2019s very inefficient if nothing else.\u201d<\/span><\/p>\n

Source:-https:\/\/gizmodo.com\/meet-the-woman-who-leads-nightwatch-google-s-internal-1825227132<\/span><\/p>\n

\n\t\t\t
\n\t\t\t <\/div><\/div>\n\t\t