Full Transcript

George Kamide:

Welcome back to the Zero Hour brought to you by SafeGuard Cyber I'm George Kamide.

 

Ashley Stone:

I'm Ashley Stone.

 

George Kamide:

And today's guest is Amy Worley. She is the managing director and associate general counsel Berkeley research group where she helps to advise clients to develop track and report on meaningful KPIs and to monitor the effectiveness of information governance and data privacy programs. And she is a powerhouse.

 

Ashley Stone:

Yeah, she's incredible. Incredible journey. She's taken from civil rights lawyer to data privacy expert gave a lot of really great insight into how to think about privacy, even if it's not a revenue generating arm, how to actually value those KPIs and the impact it has on your organization, because data is an asset.

 

George Kamide:

Yes. And I think to that point, it was useful getting her thinking around the value of that asset, including when that asset can be toxic. So without further ado, let's get into it with Amy.

 

George Kamide:

All right. So before you joined the Berkeley research group, you had built a global privacy program for a pharmaceutical company effectively from scratch, but covered over 28 countries. So we deal with a lot of companies that are having similar issues, whether it is data compliance or, or data privacy. So where do you even start when you're talking about programs of that scale?

 

Amy Worley:

So I think it really depends on the company, but what, what we did was first identified where we thought the highest risk was. So privacy is unless you are doing what I'm doing now, where you sell privacy services, it is not a revenue generating piece of the business. And I think for any compliance professional, you need to be cognizant of that. And so what we did is we started with identifying the geographic areas where we thought the risk was highest. And we then built out a very, very detailed project management plan based on the risks of the company. And we got the compliance committee to sign off that they agreed with our risk assessment, and we went very methodically step by step, putting the program in place based on the risk of the business. And then the other thing that you have to do, and this was surprising to me because I, before I went in-house, I had just my experience was entirely as a lawyer in a firm.

 

Amy Worley:

But you've got to sell what you do, because if the business doesn't understand the value to them, then you won't get the buy-in and asking people to take additional steps for compliance and risk purposes adds to their workload. And it adds friction. And so I spent a lot of time. I pulled out my old trial lawyer skills and I knew all over the world, I am a million miler and I got people to understand why it matters. And then once I had them on board and because we took this risk based approach and we didn't try to boil the ocean they did it. And I have to say, I'm really proud of the program that is still going strong at my former company.

 

George Kamide:

Yeah. I think you raised a good point about boiling the ocean. I think where we see most of the obstacles are teams kind of consider it an all or nothing approach and they kind of hamstring themselves in the decision process. So that, that's interesting that you should bring that up. And also we play around with this concept of like the minimum viable governance, which I think sounds sort of what you were doing, which is establishing the risk framework and then imagining how it scales rather than taking it piece by piece element by element.

 

Amy Worley:

And we spent a lot of time with the audit committee getting an understanding and a real sort of algebra level what risks are they willing to take? And then we looked at the authority decisions for the various geographies and said, okay, I can put together, you know, it's still subjective, but I can kind of put together a math problem and tell you what the risk looks like in these places. And then I'm very comfortable with giving a business that feedback and the business saying, okay, I'm willing to take 40% of that. And me looking and saying, okay, so you need like a C minus program. We can build a C minus program. Like we, we can do that. And as long as I feel like everybody's informed and we've considered all the variables and that is the way the business wants to go, I think that's fine.

 

George Kamide:

Oh, that's interesting. And I, well, I want to, I don't want to challenge you personally, but I want to challenge the thinking here. So I, I get what you said about, you know, this is not a revenue generating part of the business, but I think especially in light of COVID, is that a lot of the people who approached us about automating compliance in some capacity or other, yes, it's not revenue generating, but one, there can be a tremendous cost savings, which obviously affects P and L, but in some regards, if they do take a proactive approach and they, it allows them to turn on new technologies that they hadn't before you do in a way get compliance and privacy to be part of the engine that eventually drives revenue in and of itself. It doesn't, but it is a very integral part to an innovation that will lead to greater revenue.

 

Amy Worley:

Yes, I agree with that. And when I was doing my roadshow and selling I talked and I am a absolute convert about this about the, the advantage that you get as a company. If you start to see your data as an asset, you would, and, you need to manage your data using the same conceptual tools that you manage cashflow or any other assets that you have. You want to hedge against risk and you want to be able to put it to work for you. And the way that I talk about privacy compliance is that my goal is to get the business to, yes, it may be a yes and yes, and we need to do it with guardrails in place, or yes, and we need to do it in this slightly different way, but I want to be a partner in helping the business innovate and push the market. And, and I think, I don't think so. I, you know, as a privacy professional, I am very, very much believe in protecting individual information for lots of reasons. So I don't want to give the impression that I'm giving the farm away. I just think that you, especially, if privacy is included in the design phase, you can build innovative products. You can use your data to your advantage, and you can still protect privacy, but as a privacy professional or a compliance professional, you've got to earn your spot at the table.

 

Ashley Stone:

That's great. I'm gonna shift just a little bit. So the new normal is no longer new. I thought we've heard people say that a lot. We're all talking from our home offices right now, but what are you seeing in the larger business community as organizations adopt practices and technologies to meet these business continuity challenges?

 

Amy Worley:

So it's very interesting. I think there's kind of two sides to that one. We're saying that businesses can be more agile than they thought they could. There's nothing like necessity, right? Necessity is the mother of invention, forcing mechanisms. It's a when I'm not doing this, I'm a lawyer or excuse me, when I'm not doing this, I'm an artist. And when I am approaching a piece, I actually like to have constraints because it shapes the creativity. You know, there's nothing scarier than a blank page or a blank canvas.

 

Amy Worley:

So, before this occurred, I had a lot of clients who were just afraid to "go" with some technologies that they have now implemented really quickly. And I think ultimately that's going to be a win for example. We're now on Zoom, we're looking at each other, talking from our home offices. I used to spend so much time on airplanes, traveling all over the world because I couldn't get people to understand how you could do this in a way that you can still have value to the meeting and still communicate clearly. And I think now we're gonna see more people willing to do this sort of technology. So I think, I think the constraints have been helpful on the side that's concerning to me. I do worry that because of the need to keep revenue going and keep businesses stood up. If companies aren't willing to put a contract around tools if you don't provide your workforce with a tool, they'll find one on their own and that can be very risky. So I, I, I encourage clients, pick your tool, pick what you're going to do, do your due diligence, get it out there, get people trained on it, let them use it because if you don't, they will use something else and something else could be a problem.

 

George Kamide:

Yeah, that's a good point. Yes. We often talked about bringing, shadow it into the light, like reduce the stigma of it and legitimize it, and then you can actually cover it. But if you just sort of pretend it's not there. Well, I issued a notice and told everyone they can't use WhatsApp. So I'm just going to pretend that the reality is not, not a very safe way of doing business, but so you, you do bring up a good point here, which is the alacrity with which a lot of new tech has been adopted. And I believe I've said it on this podcast before, but we had global 100 banks and pharmaceutical companies. The last companies you would think to say WhatsApp with any true authenticity, come to us suddenly, you know, gee in January, it was all like pie in the sky and digital transformation. Maybe it's in 2022. And then March, it was like, I need a thousand licenses because none of my field force in Brazil can meet with doctors. So how are they supposed to communicate? And I was like, wow.

 

Amy Worley:

Funny before this podcast, I was on the phone with the field sales force in Brazil. That was having this exact conversation. I feel like you were just in my office.

 

George Kamide:

Oh yes. Well, speaking of data privacy. So I guess let's kind of couple that speed with what we were talking about before, about being a revenue generating or, or earning your seat at the table part of the business. Do you think that this forcing mechanism also demands kind of a rethink about this approach? I know we've talked about bringing sort of shadow IT into the light and, and pick the tool because if you don't, it will be unsanctioned. But I think maybe this is a, a watershed moment for what was traditionally a boring part of the business is that risk and compliance has a real part to play here in enabling technology, because let's be honest, if you are a huge pharmaceutical company and you buy a thousand licenses to protect WhatsApp, you are not tearing that technology out six months from now, right? It's like a strategic investment.

 

Amy Worley:

Yeah. I, I completely agree. And it's a, when we build programs for clients, we set up a privacy impact assessment process. That's agile. And we have, it's been, this has been obviously an unplanned proof of concept that I've been really happy with the way that it's worked, because we build out the tool, we build out the questions, we built out the risk tolerance with business. It's bringing in a tool it's just plugging in input and we have some standard intervals that we recommend and we revisit it every 12 months or so. So, you know, it's a living thing very similar to in the cyber space. So we have clients right now who are looking at WhatsApp. So we're looking at Zoom Teams, all of the different ways of communicating. I had a very interesting discussion with some clients about using web based AI to do some some healthcare filling in the telehealth and you know it, and I think I think the important thing is if you don't already have an agile compliant, risk assessment process in place, you need one because it's not going to work. It's not going to be credible anymore to tell the business they're going to wait five years for this. Cause they know they didn't have to, when COVID came around

 

George Kamide:

And more importantly, you'll have learned that your competitors did turn on WhatsApp and you were left behind and now you're stagnant in some markets where they have been able to have conversations.

 

Amy Worley:

Absolutely. Yeah. And I, you know, I have had that, the what's that question specifically, we get a lot. And I always, so there's a thing that happens to you in law school. You asked the question and the professor will look at you and say "moo", and it's not a calendar, it's a philosophical, you've asked the wrong question. And the can I use WhatsApp is the wrong question. The right question is how can I use WhatsApp? And I, I hope that this process is getting people to think more in terms of how, as opposed to whether

 

George Kamide:

That's a great Zen Koan approach. Break some compliance mind's.

 

Ashley Stone:

Yeah. I love, I love the thinking. So, speaking of law school you practiced 16 years before moving into the industry, how did you get into data privacy issues?

 

Amy Worley:

I I've told this story so many times. It's like most things in life. It was totally unplanned. I just happened to come out of law school in 2000 as the internet was happening. And I started out as a civil rights lawyer doing fourth amendment search and seizure cases.

 

George Kamide:

Like physical data privacy.

 

Amy Worley:

Exactly. Right. And so that constitutional framework I had and the internet was happening and I just sort of developed them together. When I was in law school. There was no such thing as a privacy class. You learned it as you, as you came out. And and, and I was not full time data privacy until about halfway through that time, that 16 years and the ads it really made for online commerce. And if you go back and you start looking at when did retail really move online? It was, you know, the mid and that's when we first started having questions about it when the internet was slow, privacy, wasn't a problem, honestly, before we walked around with, you know, our geolocation trackers it, it developed organically. And it's also very interesting to be raising kids right now. Cause I'm doing a lot of teaching them. We talk about how the internet has a tail and you drag it behind you and it picks up stuff as you go

 

George Kamide:

Very useful. It's a useful lesson for grownups.

 

Amy Worley:

Yeah. Nothing you do online goes away. So and, and before the Edward Snowden revelation occurred, when I would tell people what I did, they were just sort of, their eyes would glaze over. So that was useful just for me personally, to be like, okay, so you know, that thing that Edward Snowden was talking about, that that is what I do.

 

George Kamide:

Yeah. And then, then came Cambridge Analytica

 

Amy Worley:

Then came Cambridge Analytica. Yeah, absolutely. And I it'll be it'll be very interesting to see this next election cycle. How do we deal with the privacy issues?

 

George Kamide:

Yes. And for sure, I think we're contending with it with contact tracing apps as well for COVID.

 

Amy Worley:

I've worked with some app developers and it's talk about the attention of a real public need to to process personal data, to transfer it, to share it, but also the stigmatization and potential for discrimination and having developed those two things together. I've been real impressed with the way that Apple and Google have approached their app development. They, they have absolutely been doing the best they can to have privacy in the forefront of that conversation.

 

George Kamide:

That's good. Yeah. You had mentioned yeah, privacy by design. I think we've also talked as a company about security by design. If you can come into the questions rather than trying to just duct tape it on at the last second, like this is a box that needs to be checked because that always ends up being a more expensive approach anyway, because you have to do all this like backfill or you get a fine and you have to pay that first. So given your experience as great that you're have talked to some of these app developers w what is the, one of the more surprising trends that you've noticed when, when you are asked to come in and work with these privacy and records management programs,

 

Amy Worley:

They don't know why privacy matters.

 

George Kamide:

Okay. That is shocking.

 

Amy Worley:

I have a little speech, I guess, about how privacy is just another way of talking about free speech. And that helps. I think, you know, we talk, you, you can't have democracy without privacy. You can't have people without privacy. So I do, I've been shocked that I've had to sort of go back to privacy 101. The other thing I'm hearing sometimes is, well, no one cares about privacy in the middle of the pandemic. And I will say people care differently about privacy in the middle of the pandemic. And so doing a lot of teaching, you know, for example, there's, you know, Bluetooth technology can do a lot of what geolocation tracking can do, but you can do it in a much more private way. And that we're privacy. You're always weighing what is the purpose and the benefit and what is the privacy impact. And with COVID obviously your purpose and benefit are higher. So you're willing to tolerate a little bit more privacy impact, but I also will really push back on, are you using this technology because it's cool or because it's better.

 

George Kamide:

Yes, that's it, we've talked with some heads of innovation, [inaudible] is pretty clear, even from a marketing standpoint, that just because you can collect certain data doesn't mean you should, because, you know, you can turn on the faucet and just let the water run, but that may not get you to your goal. And then you're just sitting on a whole bunch of user data. That's not really your business. That's that is, that is interesting. And it's interesting, I think, because what that question means, or I guess this misunderstanding of why privacy matters seems to be some kind of divorce between the people you're talking to as individuals inside of a company or an app development and then as individuals. Right. It's kind of the golden rule is like out in the world when they're not talking to you as part of their business, do they want people, you know, looking at all their preferences and just you're right.

 

Amy Worley:

Yeah, yeah. That's, that's right. And I've had some clients. And this is the, one of the challenges obviously with COVID has been, as security issues have happened. It can be harder to respond your tabletop exercises that you've done before are different when you're not in the same room. And we've had some clients who experienced ransomware and the exfiltration piece of that, some of the data that got pulled wasn't data that they ever needed. And now they're in a situation of having all of the data breach remediation in a patient responsibilities, and they never got any benefit from the data because they didn't have a purpose for it. They were just scraping it. So it's all downside.

 

George Kamide:

Yeah. That's a very interesting point.

 

Amy Worley:

So we, we encourage them to really think about it has a cost it's easy to talk about. Well, you know, you can store on the cloud, you can store a terabyte of data for cheap, but if you think about it as intersecting lines on you know, the usefulness of the data and the risk of the data, you want to get rid of it right at the middle, where the risk is not higher than the usefulness and bringing in data that you're not using, you're, you're already out of balance on your start.

 

George Kamide:

Well, and going back to data as an asset, there are toxic assets, as everyone has learned from 2008, like it can be a net negative to be holding that that's interesting as well.

 

Ashley Stone:

It's interesting. It sounds like you have to be expert in many different topics. We can try to stay up on trends like ransomware and how data privacy issues are involved. So I'm curious in all of the things that you're experiencing in advising with your clients, are there any topics or trends that you see popping up that you maybe want to dive into or learn a little bit more about?

 

Amy Worley:

I want to get better at security. So I, I am a privacy expert and we partner, we've partnered with Reveal Risk. I know you guys have had spoken to, and we absolutely partner with security experts a lot. But in terms of thinking about the data and thinking about compliance controls I've used some of my time at home during Kevin to do some CISSP classes, not to get the certification, but just to get the knowledge. It's a, it's a very compatible way of thinking. And I also like to be able to help the help my clients spot an issue where they need to go get expert advice, you know, I'm not a technologist. And so having been comfortable enough with security technologies to say, you know, I think you might want to look at it encryption at rest here, or this would be a very interesting use case for blockchain not to do it, but to tell my clients that they need to get someone who can do it.

 

George Kamide:

Yes, that's interesting because I think privacy risk and compliance have sort of always, well maybe in the popular imagination, connoted towards the legal profession, whereas security has always been kind of the domain of technology, but when you talk about a data breach or inappropriate conduct which we've caught inside of like a Microsoft Teams instance, I mean, that touches both of those things. And those teams sometimes don't talk to one another until such an event happens.

 

Amy Worley:

Yeah. So where we actually have a client, a global pharmaceutical client that we're just starting a new engagement with. And the first month of the engagement, we're just listening. So we're going around and virtually and and letting people in, in IT and in the business, talk to us about what they think privacy looks like, and also what their experience is in terms of data breaches, whether personally or professionally. And then when we go in and build a program, we ask for IT to provide us one of their security team members to be a part of the program build out so that because they are so related and, and you know, we do a lot of talking about data classification, which I know you guys do to make sure that we're not reinventing the wheel and that we're aligned with what they're already doing. And if we recommend that they need IT, security support, that that person is in the room and can be a part of the development, but you're right. They are traditionally siloed and privacy 101 is security is a component of privacy. You know, you can't have privacy without security.

 

George Kamide:

So that raises an interesting question. I had to answer some questions this morning from a reporter. So I'm going to pose it to you before I give you my answer is how would you advise companies who are trying, how would you advise them to prepare for the next either pandemic or the next wave of COVID that is strong enough to merit a lockdown scenario like we saw in March and April?

 

Amy Worley:

So it's a really interesting question. I, the first thing that I'm doing right now with the clients that we've worked with the whole time is saying, we need to pull together a lessons learned document and make sure that everyone agrees that this is what went well, and this is what did not go well. And from there that I think gives us information about whether we need process improvements or tool improvements or both. I will say it so much that it's a joke with my theme, that a tool without process is just an expensive non-solution.

 

George Kamide:

Yeah. I like it. Wait, we were just talking on our side about something that we've just acquired to do something. And I was like, if we don't have the process on the back end, we're just going to have a whole bunch of shiny object syndrome.

 

Amy Worley:

Yeah. Here's kind of expensive methods. So I think we start with, what have we learned? And then I think apply your basic risk modeling. Right now the, what we're hearing is that we should expect this new normal to continue to the outside of the two, two year horizon. And I had as much as I am such an optimist at heart when I'm, when I'm risk remediating. And so plan out your modeling, reallocate your resources you know, just because something was on your roadmap going into COVID doesn't mean it should stay on the road map. You may need to be nimble and adjust. And I think we are going to see a lot more investment in communications video conferencing and, and other you know, messaging apps. And one of the things that this I'm sure it won't be a surprise to you, but one of the things that we see that drives lawyers crazy is people using email like instant messenger.

 

George Kamide:

Yes.

 

Amy Worley:

Yeah. That in this environment in particular is so dangerous because everything is being done. And then the litigators will tell you, and you've just created a record of all of those communications that you didn't intend to be corporate records. And so getting folks to who businesses that haven't done it to really start looking at, you know, a Jabber or another tool that is an instant message tool and get out of email. Yeah. So that's probably a long answer to your question, but start with what happened.

 

George Kamide:

Yes. And I think so that's sort of good. I'm glad that we essentially said the same thing I was telling this reporter that it was you know, you should take it as a learning opportunity. I mean, IT teams were under great stress. It was like you had three days to stand up a virtual workforce and you can kind of like pout about that. And now we're past that. Or you can also look back and say like, okay, well, I think one of the key lessons is, you know, what we've talked about here is companies suddenly realizing like maybe they do need WhatsApp. Maybe they do need Microsoft Teams. So you should take that time now to go around to those different stakeholders and say, what is it that you need to not operate on, you know, just a simple business continuity basis, but what would you need to do it well to do your job well, and let's talk about how, but I think that comes back to that expedition journey is going to require both legal and security kind of going around all the teams so that they do that. And then to your point about email as a record, you know, we have one client that was 5,000 employees and it was 60,000 Slack messages a day, and then work from home it's now 150,000 a day. So just the sheer volume and velocity of the communication is, you know orders of magnitude larger.

 

Amy Worley:

Definitely. Yeah. And I I've seen some people and I think it could be a good solution. Some, some businesses, instead of setting up a Zoom call having a video window open for a team that's used to working together and they're working and they're also talking and it's, it's sort of learning how to be virtually together in a way that's similar to the way that it used to be in the workspace to kind of get out of the typing all the time. Now there are bandwidth and security challenges around that too, but I think we're going to have to be creative around how to do that. And the other piece is training people remotely in a way that is effective. I know that no one on this podcast has ever pulled up a training while doing something else clicked there periodically, but we're starting to put together like 90 seconds, draw, shot videos and pushing those out and phishing campaigns where when you click on the phishing email, it pops up a 30 second video to teach you, you know, much more real time based on your actions. Here's the, you know, here's what you need to know right now.

 

George Kamide:

That's interesting. Yeah. That's yeah, I think that's very effective. Ashley and I both come from an organization that shall remain nameless, that we were subjected to the usual security training, which I think everyone is. And it was always running on this monitor and trying to do the other stuff.

 

Amy Worley:

Totally. They're the, in North Carolina, all lawyers have to do a substance abuse training, which is good given the the prevalence of substance abuse and the legal, if I'm hearing you, but when it's online, there's like jokes of people sitting there with a glass of wine, sort of like having the opposite effect that you wanted to have.

 

George Kamide:

Yeah. I would say the, also the immediate downside of having an always on video cameras you definitely need to make sure you're not wearing pajama pants.

 

Ashley Stone:

Yeah, yeah. The nighttime pajamas and yeah, I'm really interested in that program cause I'm sure you can also measure how effective engagement or intervention are, which is always, you know, you want to be able to quantify the impact of what you're doing. And I'm curious when it comes to information governance and actually measuring how effective these programs are, what kind of KPIs do you look at and monitor?

 

Amy Worley:

So I can nerd out on this for so long because I love, love this topic. We actually game-ify it. So we look at several different KPIs. So for privacy programs, we look at how many reports of suspected data breaches are you getting? And we, we, should be getting like for, let's say your'e a thousand employee organization, I'm going to expect one a day. Somebody has clicked on a phishing. Somebody has lost their iPhone and some, you know so we, we're not looking necessarily at are all of those reportable incidents. We want to see that people know what they're supposed to do and that they're using it. You know, like they should.

 

Amy Worley:

Risk assessments. How many are you getting per quarter? How long is it taking you to get them through? And you know, just tracking that the process itself is being followed training. So we track training as a KPI, but we don't track it in the traditional way. We track it in terms of engagement. So when we send out one of these 90 seconds you know, videos, how many people watched it all the way through, and then we'll have a little survey question at the end, but you can, you know, answer what, how do I notify somebody of a database, boom, you put in the email address, then we can track that. Then when we train executives we actually use smartphones or iPads to build scavenger hunts, then all kinds of different ways of learning. Then we'll take the back end information of that and show them what they already know and what they need to know. So sort of the questions will be increasingly difficult until we exhaust their knowledge of it. And then we'll turn around and focus our education on that piece.

 

Amy Worley:

Um and then with privacy, we track data subjects or consumer requests. So in the post GDPR CCPA world, how many people are reaching out to the privacy office with questions, how many data deletion requests, that kind of kind of stuff. So we, we look at, and then, sorry, the last thing on information governance is we look at your total data that you're storing before we come in. And then we do some data disposition exercises and try to get people to businesses to start getting rid of that low value data. So we'll gamify, deletion gigs. Are you getting rid of yeah.

 

Amy Worley:

And then take that to finance, but the hard numbers on it. So this is what you saved in storage costs sometimes, you know, 70, 80 grand, but then we use kind of on studies for each discovery cost. And the last one I looked at, it was like $3,100 a gig or a lawyer to review in the event of litigation. So then we show the cost avoidance. So here's what you were paying a store, right? Here's what you would have paid if a lawyer had to review it. And that gets executives to pay attention cause that's dollars. So in people we've had clients where employees got like cutthroat about the gamification, like nine and a half gigs in the last 20 minutes.

 

George Kamide:

Well, I mean, you are talking about executives in corporate America. It's just built into the DNA, has to be the best at whatever.

 

Amy Worley:

And I'm like work with that, right? Like if you've got very competitive executives, then let's give them a competition.

 

George Kamide:

That's great. I did want to, something occurred to me when we were talking about data privacy, before we started recording, we were talking about the dilemmas that school systems are facing. I wonder if in these virtual school environments that you have either as a parent or you have seen as a professional, any similar privacy concerns. So for example we are securing the Microsoft Teams environment for K-12 private school. They have 1200 students and I think to them, it was like, great. Now kids can talk to one another, they can share assignments, they can collaborate on a book report, whatever. And we were able to show them in the first 10 days your students produced 125,000 messages. The scale just was like alarming to them. Right.

 

Amy Worley:

I watched happen. I've seen him sit there and, you know, yeah. They're excited to see each other. Yeah.

 

George Kamide:

They're also surprised that kids are logging on at two in the morning. And I was like, I mean, what do you expect? And then but more importantly, the balance between the privacy of those communications, but also, you know, we found instantly 2000 messages that had high risks involved, cyber bullying, inappropriate conduct, drug use, plans to bully and other individual. And so we were talking about, if it's a virtual school yard, you have just as much responsibility to create a safe environment for learning as you do in a physical environment. So I just want to put that out there. We've been talking mostly about corporations and P and L sort of driven initiatives, but I'm from a public goods standpoint, have you entertained any of those questions?

 

Amy Worley:

They were struggling as you know, I have a 10 year old and a soon to be 12 year old. And they did two very different types of school. One's in private school, one's in public school and one was Zoom was on Zoom or four hours a day just like classroom, but his classroom is really small. So that, that worked for them. My older son is in a public school with 30 kids and they didn't try to do video interaction much because when they did exactly what you just happened, all of the messages started going. As a mom, I have worried that you know, we've been pretty conservative on internet access and screenings with our kids, just shocking given what I do. And it's been much harder to keep tabs on that now because you know, he's out researching a paper or he's looking at a near pod [inaudible]. I have actually talked to some schools and suggested that they do some monitoring start looking at those messages, looking for the bullying, looking for the inappropriate conduct. Also on the contracting side, you know, make sure that they it's really clear who's responsible for what, on these technologies.

 

George Kamide:

Yes, the stressor, because we talked about how hard it is for IT and privacy to cooperate. When you talking about a school system, it's usually like a two person IT department and they are expected to touch anything that plugs into a wall, right? So they're not a compliance team by any stretch of the imagination.

 

Amy Worley:

No, I, you know, I really continue to worry about that. Kids, especially in the early and middle grades are, have such different technology values and you'll have some families that have been very comfortable with kids who have had computers for a long time and they, they knew how to deal with them and they act appropriately. That is not always the case and especially in a school environment where you may have kids with disabilities, but you're trying to accommodate. I think it's really, really hard. Our local school districts, I think really did the best they could in terms of, they decided that until they had time, which, you know, we were just talking before the call. I think it will change starting in late August when they go back that they were not gonna let kids do what we're doing right now. They just didn't feel like they could protect everybody. But when we go back, they have, I don't know what the technologies are yet, but I know that they have the infrastructure to try to allow more discussion. And I have had some inquiries about, you know, what are the rules around monitoring? And it's absolutely a yes and things you can monitor, you just have to monitor the right way. And I think that will be very interesting to watch how that evolves.

 

George Kamide:

Also, I mean, not to be too cynical about it, but just from a record standpoint, right? If you, a parent who comes to you and says, my child has complained that, you know, these other students are bullying her and what are you going to do subpoena Slack. Like if you, like, you have no recourse to, to mediate a problem.

 

Amy Worley:

I mean, we did a lot of being present in the room all with happening because we felt like on the parent's side, it was way more realistic for us to be able to control it on our end than to think that the school could handle it on their end. So, but obviously, you know, as we're [inaudible] families have to work, and I think all of this will, will spawn more innovation, but it'll be sticky until we get there.

 

George Kamide:

Yes. I mean, as a, as a parent you know, kids going back to school, it was like, yay. But as somebody who's friends with a lot of teachers, it's like, oh, they're on the front lines of like massive infection. Because even if the third grader doesn't exhibit symptoms like you as the 40 year old teacher might very well catch Coronavirus.

 

Amy Worley:

Yeah. So right before we got on this call, I was looking at the school board, came out in the County, and said, you know, one week on two weeks off ABC. So they're going to rotate through. And you know, everybody said that they were never gonna it's unprecedented, who knows what that's gonna look like? You know, we just don't know. But they, I, I will say one thing that school system has done here is for families who do have a very high risk individual they have an entirely online curriculum that is done with telehealth technology and that has been operating for, they know how to do the monitoring. And and so there, there used to be a tuition associated with that, and now they're making it available which I think is smart. You know, we've got something that's working, let's make that available.

 

George Kamide:

Yeah. It comes back to, to yes-and well, very much want to thank you for taking the time. It was a very fruitful discussion really gave us a lot to think about. That's very helpful.

 

Amy Worley:

Absolutely. Thank you guys for having me. I will talk about this stuff forever. I love it.

 

George Kamide:

I think, I mean, I think you will have no shortage of opportunity. It feels like we're as much as humans want stability. I think we are in a period of constant learning right now.

 

Amy Worley:

I agree. I I was talking to my son who gets to do middle school like this. And I was like, I swam competitively for, for years. And I was like, you know, it took a long time. I could choose to say to me, just got to love the suck. We're at a point right now where you're just going to have to embrace the suck and be like, this is pushing me and stretching me and I'm growing and I'm sometimes gonna fall flat on my face and that's okay.

 

George Kamide:

Well, that is an excellent lesson to leave off on. So we will, we'll conclude there, but thank you again for taking the time to join us.

 

Amy Worley:

Thanks for having me.