Magazine menu Close Magazine menu

Leadership

Latest stories

insight story, ethical and ai, robot communicates with people

As AI’s influence rapidly expands, here’s how business ethics must keep up

  • min read
    • We live in a world where algorithms can make decisions and data fuels innovation. It means ethical considerations are more critical than ever for business. They must balance using new technology to increase competitive advantage while preserving integrity and protecting customers. In our podcast Insight Story, experts Tomoko Yokoi (Switzerland,) senior business executive and researcher at Global Centre for Digital Business Transformation, IMD Business School and Andy Crouch (UK,) consultant and co-founder of ethical-AI natural language processing company, Akumen, outline how AI biases can impact business and what steps they can take to ensure its fairness. Kaspersky Global Research and Analysis Team's Dr. Amin Hasbini expands on the privacy and responsible data use implications. Not all AI is created ethically equal Andy's company Akumen found a problem that needed solving. "Scores out of five are useful, but we wanted insight from written responses like product reviews, and there was no way to do it. The team created an AI solution to identify meaning like topics, emotions and sentiment. Sentiment measures opinion – positive, negative or neutral – but emotions drive behavior. It works on text feedback anywhere, which might be about consumer goods, healthcare or anything else." Their approach uses AI differently from generative AI tools like ChatGPT. "Our AI is rule-based, human-created and human-curated. It's completely transparent and there are no algorithms as with large language models. We can dive in and make rules more nuanced if we recognize bias. With large language models, that would be complex and expensive." Andy expands on generative AI's limits for truly understanding people. "We asked ChatGPT how many emotions humans experience – it said 138,000. That doesn't help us understand what drives behavior. Our platform has 22 emotions – enough to see what drives behavior. Through our partner, Civicom, we're helping the UK's national health service (NHS) to understand what patients and staff experience." And that understanding can improve lives: Larger language models use big data pools, but there are also more contained, enterprise-level tools like ChatGPT Enterprise that businesses can furnish with their own data and control how they use it. Tomoko sees enterprise-level tools as useful but notes they can't do what big data can do. "Organizations are developing new functions around AI, like data annotators, who clean data before it goes into models. But is it foolproof? The beauty of using data from everywhere is it gives you insights you otherwise wouldn't get." Choosing ethical suppliers Luckily for companies using AI ethically, more businesses are adopting digital responsibility policies and choosing ethics-first suppliers. Tomoko gives an example. "Deutsche Telekom has been a pioneer in AI ethics. They've trained all employees to ensure AI ethics are distributed throughout the organization. At the same time, they have about 300 suppliers and ensure it's in all their contracts. So it goes beyond the boundaries of the company." But many businesses don't know where to start. Tomoko says, "Over 250 companies have committed to AI ethics, but codified mechanisms only help if they change behavior. How can we live these principles and ideals? External experts can help, and there's a case for individuals taking responsibility, which will have a collective impact." She suggests how companies frame AI ethics matters. "You can see AI ethics as value or as compliance. If it's compliance, it will be cost- or risk-driven. But AI ethics could also be a competitive advantage." Andy compares AI ethics to health and safety. "If you have a health and safety director, it's only one person's responsibility. Change won't happen unless everyone understands health and safety's importance, and especially that it drives productivity and revenue." The competitive advantage is real. McKinsey research found 72 percent of customers considered a business's AI policy before making an AI-related purchase. Tomoko highlights the importance of backing up policies with action. Which AI issues should companies care about? Tomoko outlines three places to look. "First, consider the software development lifecycle. If you're considering developing an AI product, think of how it's designed. Look for bias in the data. "Second, once it's being developed, although many companies say they're implementing AI ethics, people developing AI-driven products don't know how to apply those principles. So, look at how people use ethical principles in day-to-day software development. "Third, we test products in controlled environments. Once it launches, ask who is monitoring it and how we ensure it doesn't gather bias and that people use it correctly." Tomoko is part of IMD Business School and knows that what future executives learn about AI ethics will shape future companies' ethical behaviors with AI. She says, "First, we say everyone has a responsibility to these issues that goes beyond the company. You need to be aware of this responsibility, but also be able to make others in your team aware." Secondly, "What type of organizations do we want to build? We coach people to be able to handle multiple goals – not only profit but also social, environmental and ethical goals. We want them to walk away thinking of the future." Andy drills down into the data AI is using. "Understand how the AI model is built. Is the data you're analyzing through that AI model ethically sourced, and are you using it ethically? The lack of transparency over large language models is rife for ethical risk and bias." AI training data bias can have life-threatening impacts. Poor AI translations have been found to be jeopardizing asylum claims. Andy sees retrieval-augmented generation (RAG,) which uses more proofed datasets, as part of the solution. Can we have secure and well-regulated AI? Dr. Amin Hasbini. Head of Research Centre, Middle East, Turkey and Africa for Kaspersky Global Research and Analysis Team, thinks AI ethical standards are needed. "AI won't self-define its ethics. They must be programmed with ethical standards." Since there is almost no way the public can evaluate, critique or improve AI ethics, regulation must play a part, according to Amin. "We need security and safety by design, and continuous verification of it. That would require transparency, especially from big tech vendors, and letting the public influence how these technologies develop." He likens the challenge to that of regulating social media. "We're asking people to adopt technologies that can do much damage without giving them ways to ensure that doesn't happen. The same has happened before with social media, with it being used for data leaks and fake news. European Union regulation is moving fast around AI, but AI could be much more dangerous than social media – we need rules now." For improved ethical data use, Amin recommends asset management controls. "If well deployed, asset management controls allow data to be classified, including which is available to AI, which can be shared publicly and which needs to stay inside the organization." Andy says regulation is hard in this fast-moving space because no one knows what's coming next. "I question anyone saying they know what will happen in the next six months or beyond. But there's a lot of fear and lobbying going on – so go slow. If your AI-driven capability can't deliver because it's non-compliant, ethically or otherwise, it will be damaging." However, he believes regulation is necessary. "It will be interesting to see how they regulate something that's not easily defined and morphs quickly, but we must protect those who need protecting." Kaspersky has recently proposed six principles for ethical use of AI in the cybersecurity industry with transparency at the core. Getting started with AI ethics Our experts have straightforward advice for those business executives yet to approach AI ethics. Tomoko says, "As a mindset, remember the analog and digital worlds are the same. Your analog-world values should extend into the digital world." Andy highlights the need for both widespread knowledge and deep expertise. "Get your whole team conversant with AI, but have a well-informed friend who lives and breathes this stuff to call when there are challenges." With headlines about AI taking our jobs and AI founders like Geoffrey Hinton sounding the alarm on unregulated AI perils, it's easy to write off AI ethics as a problem too hard to fix. But these complex issues need priority. There are green shoots of change. In December 2023, the AI Alliance launched to focus on developing AI responsibly, including safety and security tools. Its 50 members include Meta, IBM, CERN and Cornell. The message may be, 'Let's not move too fast and not break things.' With OpenAI, creators of ChatGPT, not invited to the party, could the tortoise of collective corporations beat the nimble hare of innovation? AI gives business potential for great gains but comes with great risks to reputation, security and privacy. With strong ethical AI policies translated into action and widespread knowledge among employees, businesses can have more confidence to take advantage of AI's many benefits.
cybersecurity champions

Cybersecurity champions could be your secret weapon in raising employee cyber-awareness

  • min read
    • Cyber incidents continue to rank as the top risk for Financial Services companies. With 57 percent of banking executives saying their primary cybersecurity concern is phishing attacks targeting employees,  cybersecurity needs to be everyone's business – not just the IT department's problem. A cyber-secure work culture will make businesses more resilient to threats. According to Forbes, business-reported cyberattacks keep rising each quarter. Meanwhile, "The cyber skills gap continues to widen, with 3.4 million vacancies for cyber pros globally this year, up from 2.7 million in 2021." Employee behavior is one of the biggest factors behind cybersecurity incidents. Change how your employees understand cybersecurity with a cyber-aware work culture, and you'll substantially reduce the risk of compromise. One way of raising cybersecurity awareness at work is through a cybersecurity champions program. Forbes reports phishing, malware-spiked emails, social engineering and compromised credentials account for nearly 30 percent of cyberattacks. As all these are linked with lack of employee cyber awareness, everyone getting up-to-speed on today's cyberattacks could prevent many attacks. Why cybersecurity champions change business culture Lena Smart, Chief Information Security Officer (CISO) for MongoDB, calls cybersecurity champions the "cheerleaders and supporters of security" across an organization. MongoDB is a database platform to build web and mobile applications. It powers everything from popular online game Fortnite to dating site eHarmony's real-time communication system. The company is headquartered in the US and has 2,000 employees globally. "We need to assure customers we're keeping our applications secure and we want to show our internal customers they're working in a secure environment," says Smart. MongoDB's cybersecurity champions program was one of Smart's first initiatives when she joined the company last year. A 20-year industry veteran, she implemented two similar programs in previous CISO roles at international electronic trading platform Tradeweb and another at New York Power Authority. Smart says security experts inside an organization may have a limited perspective because they're looking through a tight lens. Weaving security through software development Security champions schemes are adopted most in software development, particularly with the trend toward DevOps. DevOps means combining software development and IT operations teams and processes to speed up development. As the need grew to scale DevOps projects faster while minimizing software vulnerabilities, organizations looked for ways to embed security into the development process. They called the approach DevSecOps. "Security champions programs aim to build a better security culture and get DevOps to create secure software more reliably," says Dan Cornell, Chief Technology Officer (CTO) with US application security company Denim Group. Cornell is a big proponent of cybersecurity champions and has helped many organizations launch programs. He says their aims vary depending on the industry, regulatory environment and company culture. For DevOps, he says, champions make security knowledge more accessible to the development team. Having run successful security champions programs outside of software development, Smart says the rules are transferable. "There's no difference in how you set it up from one company to the next." The champions are colleagues from different roles, teams and departments. Smart particularly wants participants who don't have "security" in their job title or responsibility. "The champions want to learn and understand security and how they can help the company to be more secure," she says. At MongoDB, the program is voluntary and relatively informal. Champions are encouraged to attend monthly meetings with ideas for training and other things they want to do. Building cybersecurity culture from the bottom up While the C-Suite's involvement is crucial in setting the tone and providing resources, the real strength of a cybersecurity culture is in the entire workforce's commitment and enthusiasm. Robust protection against cyber threats means building a cybersecurity culture from the ground up. Within a good security culture, people engage with cybersecurity, leading to growing awareness which reduces business vulnerability to attack. When staff feel invested in the organization's security, they become its first line of defense. When you foster a sense of joint initiative, employees at all levels help build the culture and security becomes ingrained in their daily practices. UCL Department of Security and Crime Science lecturer, Ingolf Becker, says a security champions program works because it's a two-way street. "It promotes security at all levels, but it's also an opportunity for management to get feedback about what's happening on the ground." Smart says sometimes the best ideas for improving security comes from people who "don't live under the scrutiny of the CISO every day. It gives you, as the CISO, a view you wouldn't otherwise have." Champions making cybersecurity communication clearer Smart measures the success of a champions program by how much feedback she gets on initiatives and efforts. For example, a new data-retention policy for a communication app the company was using: "Data-retention policies can be disruptive. We wanted to make sure we were asking the right questions and giving the right information to those affected," she explains. She put the champions to work. They met as a group and reviewed the draft memo. The champions took it apart, discussing what could be improved, what needed more information, and so on. That input, she says, saved her security team a lot of angst. "We finessed what was going to be a disruptive piece of communication," she says. She knew it worked because emails came in thanking them for the clarity of the message. People appreciated the efforts put in by those outside the CISO's core team. How to implement a cybersecurity champion program Becker says security champions must not be security people. "They're employees who are 'one of us,'" he says. "I think most organizations could benefit from having this local expertise about what security means to an organization." He says at organizations he's worked with, the program was often organic – started by people or teams who took it upon themselves to promote security. In those instances, formalizing the program helps to provide training and resources to develop it. To start a program, Smart recommends CISOs get executive support. At MongoDB, she started by pitching the idea to her manager, the company's CTO. "He loved the idea," she says. "Support from the top is fundamental, or it won't be a success." You must also work out what kind of commitment participants need, based on how often the champions meet and other tasks they do. The next phase is to promote the program and recruit volunteers – an online survey is a good way. After pitching her idea to the CTO, Smart enrolled the company's communication experts to raise awareness, including the benefits of the program to the organization. When employees stepped forward, their supervisors had to sign off. Smart had conversations with the managers who were uncertain and explained how volunteering could fit around the employee's day-to-day role. "Because it's voluntary, some months you may have five people in the room and some months 20," Smart says. "Don't be disheartened if the numbers go down. They'll come up again." To grow the program, look for ways to promote the champions' work and impact. MongoDB includes "day in the life" stories about the champions in the company's security newsletter. Championing security helps develop careers Gartner says cybersecurity champions programs are a zero- or low-cost way to accelerate your security message. Some organizations may offer incentives, and in DevOps scenarios, being a champion may become a full-time role. At MongoDB, the champions aren't there for perks, but there are benefits. They learn things and serve as leaders to their peers. Smart, too, found an unexpected benefit: Two of the champions later joined her team. "They're now a bridge between the old and new ways of security," she says. Becker believes just about any organization could implement a cybersecurity champions program. But there's one caveat. "You must be willing to listen and change based on the input of champions," he says. Smart notes the champions share a common goal. "We're all trying to solve the same problem: Keeping the data safe and the bad actors out," she says. The program lets her talk to people she rarely speaks to about ways to improve security. "It's a linking of the groups and a linking of the minds," she says. If you want to improve your security culture – and are willing to listen to employees with diverse perspectives – a security champions program is a great way to bring about long-lasting change.
IT executives 2040

8 ways Generation Z will transform the future workplace

  • min read
    • Generation Z (Gen Z) – those born between 1997 and 2012, now in their teens and early twenties – is making an impact on the world. Many brands have aligned their products and communication with the generation's tastes and preferences. Employers are adjusting their business processes to accommodate their arrival. Kaspersky welcomes hundreds of Gen Z interns annually, sparking curiosity about what tech industry leaders might be like in 2040. Here's how we think Gen Z will transform the future workplace. 1.   Exploring vast information efficiently Gen Z is the first generation surrounded by tech and the internet since birth. Information on smartphones is their natural experience and knowledge. They effortlessly navigate and integrate torrents of information. They don't mind not knowing things because they can swiftly find the answer. 2.   Developing deeper analytical skills The inclination to dive into pools of information may also lead to shallow and fragmented thinking. Without a critical approach, it could challenge Gen Z as future tech industry leaders. Gen Z must balance leveraging vast information with deep, analytical thinking to become well-rounded and effective in their work. 3.   Moving away from vertical hierarchy As future managers, Gen Z may establish companies with horizontal management structures. In these organizations, transparency, trust and teamwork will take center stage. By prioritizing these principles, Gen Z leaders will build businesses that empower employees and promote collaboration, where each individual's voice is heard and respected. This shift towards more inclusive management could pave the way for more innovative and progressive workplaces. 4.   Valuing own and others' personal boundaries Gen Z places high value on healthy work-life balance. They firmly believe work should bring similar satisfaction to socializing or leisure. It's crucial to allow distance and dedicate time for relaxation. One way to achieve this is refraining from sending messages outside work hours and respecting their boundaries. 5.   Ever-evolving leaders with backgrounds in multiple career fields These young people don't show the same rigid preferences or brand loyalty as previous generations. They can imagine more possibilities, so they fearlessly explore new opportunities and embrace change. They don't hesitate to switch companies and even transition between different career fields. While the average person may change professions three to seven times in their lifetime, Gen Z may have some 10 to 15 different careers over their working lives. Wide expertise and experience open the door for innovative approaches and the creation of novel cross-platform products across different industries. 6.   Being proactive Many managers observed that Gen Z's proactivity stands out. They readily propose creative and innovative ideas that transcend the boundaries of their roles and departments. 7.   Building unique tech startups What's more striking is their willingness to embrace mistakes as part of learning. Unlike previous generations, Gen Z won't wait for the perfect moment to launch a product. They act in the present and don't fear making mistakes. Gen Z will likely lead the charge as CEOs of numerous tech startups, fueled by unconventional product ideas. 8.   Becoming the youngest generation of leaders This boldness and decisiveness will mean a significant drop in the average age of startup CEOs. Young people and even teenagers are already proving successful in running businesses. Generation Z is the future of the IT industry. The hundreds of young people we welcome into internships at Kaspersky each year gain an opportunity to unlock leadership qualities. They already possess the essential traits – we nurture their potential, refining soft skills and technical know-how. Participating in international student competitions, like Kaspersky's Secur'IT Cup or education and internship programs, can be instrumental in the journey of these young people. With determination and support, they will shape the industry and leave a lasting impact on the world.
IT economics report

Guess who’s leaking as much data as cybercriminals

  • min read
    • New research by Kaspersky finds employees are causing more data leaks. So much so that employee action and cyberattacks are running neck-and-neck. What's behind this growth in employee-initiated data leaking? And what can business leaders do to turn employees from cyber risk to cyber asset? Why are employees causing more data leaks? More than 3,000 IT security managers in 26 countries contributed views to Kaspersky's 2022 IT Security Economics report. The research found that in 2022, cyberattacks caused 23 percent of data leaks, while employees caused a close 22 percent. This growing proportion of leaks linked to employees may follow work-life changes since the pandemic. The report says, "IT security teams are now battling data leakages caused by employees […] following the introduction of new staff laptops or tablets, and Virtual Private Networks (VPNs) to enable remote working." And it's not all innocent mistakes. Most employee-triggered leaks involved ignoring cybersecurity policy, but security managers also reported more than a third (36 percent) were deliberate acts of sabotage or espionage. How employees cause data leaks Small, almost mundane actions often lead to data leaks. Usually, the employee is tricked by a 'social engineering' tactic or practicing poor cyber 'hygiene.' But what does that mean? Social engineering Cybercriminals use manipulative tricks known as social engineering to fool employees into giving them access to systems or giving out information they otherwise wouldn't. A common approach is 'phishing' – emails or messages containing links that give cybercriminals access to business systems when clicked on. Phishing is getting more sophisticated – mimicking, for example, emails announcing sales or discounts from household brands so well they're hard to tell apart from the real thing. 'Spear phishing' is more targeted and personalized. It might, for example, target those in an organization most likely to take the bait, or mimic a target organization's internal newsletter or email format. Cybercriminals also engage in social engineering one-on-one. For example, they may phone employees saying they're from the IT support desk and try to persuade the employee to share their login and password details. Cyber hygiene Maintaining good cyber hygiene means everyday practices that make it harder for cybercriminals to access systems. The actions that make up cyber hygiene will hopefully be familiar, for example: Having complex passwords, always using a VPN when working remotely and deleting digital information you no longer need. How to stop employee leaks Cybersecurity awareness training aims to teach cyber hygiene alongside the broader education employees need to notice and avoid falling for social engineering tricks. Earlier Kaspersky research in partnership with Longitude, a thought leadership agency within the Financial Times Group, found businesses confident in their cyber skills programs also report better overall cyberattack preparedness. While cybersecurity experts should upskill regularly, the research highlights the importance of training all staff – beyond the IT department – to create a company-wide cybersecurity culture. One-off training is also not enough: staff need to absorb ideas and practice skills to make new habits. Heathrow Airport's innovative employee cyber awareness program aims to change behavior long-term with 'little and often' education targeted at those who need it most. Heathrow uses mock phishing emails to identify employees at risk of falling for cybercriminals' tricks, so they're not wasting time educating employees whose cyber awareness is already strong. Cybersecurity awareness training should also aim to encourage 'cyber pride' – building positive motivation for good cyber behavior rather than stoking fear. What about preventing employee sabotage? Comprehensive cybersecurity education may not be enough to prevent the 36 percent of employee-generated data leaks done by disgruntled employees. Examples of how employees have deliberately leaked data abound – from sharing customer data online to handing access keys to cybercriminals. Regular user access reviews – checking who has access to what and keeping all system access to a minimum – are important, but nothing surpasses the value of maintaining a positive workplace culture. Leaders need ways to 'temperature check' their organization beyond relying on the Personnel department or peers in senior leadership to thoroughly report concerns. Affected departments have a 'dog in the fight,' so to speak, and may not share everything they should. Ways to temperature-check include 360-degree feedback mechanisms – where all staff give anonymous feedback about their manager. Writing in Forbes, founder of Rungway workplace advice platform, Julie Chakraverty, says, "To… uncover hidden attitudes and views, you need to ask your employees how they feel. Lead by example by being fully open and transparent… [and] empower your employees to share their opinions and give honest feedback." The change in how data leaks happen, with more employees triggering them, should give every business pause for thought. Bringing leadership focus back to workplace culture and employee wellbeing has always paid dividends across the business, but we now understand its crucial importance in keeping data safe. Regular, targeted cybersecurity education, strong cyber hygiene and understanding how everyone in your organization is feeling should be central to your data protection strategy.
cyber future interview

How business can use cyber futurism to see what comes next

  • min read
    • With new technologies like the metaverse arriving regularly, how can business leaders and cybersecurity professionals know what new threats to expect? Futurism – analyzing future scenarios to inform today's decision-making – is one way. Victoria Baines is professor of information technology at UK's Gresham College and a former Facebook executive and Europol officer. She uses future scenarios to understand technology today and how we should prepare for threats to come. We chat about what these scenarios reveal about our world today, what might happen with new technologies like the metaverse and what business can do to keep users safe. Gemma: What does it mean to explore the future of cybersecurity through scenarios? Victoria: Scenarios are not predictions, but if you do them right, they tell you as much about your situation now as what might happen in future. It's not just threats – it's how the world's changed, and what the tipping points may be. The pandemic was a tipping point for remote and hybrid working, but many find hybrid work just means doing all the things, all the time – the expectation they'll be available constantly for online and physical meetings. We'd been working up to that for a long time. Reliance on email was a compelling signal we needed to find something better, quieter, with less churn. I think we'll see something like that with the metaverse. We've now got the ultimate business case for it because Zoom and Teams aren't enough to feel like we're really working with people – we're still just on a call. Futures methodology is as much about exploring our present and spotting things in the past. What have you found out about the metaverse through your cyber futures work? Although there's hype and uncertainty around the metaverse, we have certainties about how it will develop. For example, Apple will probably bring out, or at least announce, a mixed-reality headset next year. However expensive, people want to use whatever Apple brings out. So we'll see people wanting Apple's mixed-reality headset in a way they haven't wanted other virtual reality (VR) headsets like Hololens or Oculus. This will significantly speed up metaverse adoption. The metaverse is less of a tipping point and more of an evolution. Roblox, Fortnight and Second Life are already metaverses. They use the feeling of presence and co-presence, and there's old research on this – academics like Mel Slater and Ralph Schroder showed us that being together virtually is emotional – it brings about positive reinforcement. We'll need AI-powered synthetic individuals to bump into in online social spaces because we need to feel like we're interacting with people – shaking hands, having sex and so on. We'll probably need 6G to power and connect all that technology, particularly if we want to use it when out and about. What security implications have you identified in the metaverse? Nothing's 100 percent secure – we must assume there'll be technical and human vulnerabilities in every aspect of VR, augmented reality (AR) and other metaverse-enabling technologies. In these scenarios, we look at all those vulnerabilities. We have signals already, like the panic around 'zoombombing' – hackers interrupting video conferencing with obscene and violent material. It happened because people shared their passwords on the open internet. We needn't panic – basic security measures would deal with it. But it shows that exploitation and infiltration will also play out in VR and AR. Are there new cyberthreats for the metaverse and related immersive technologies, or is it the same threats in new spaces and technologies? Much of it comes back to basic digital hygiene like patching, updating, and installing antivirus software. Basic 'handwashing' can do much to prevent ransomware infections. In that way, the new stuff isn't new, but we haven't given it enough attention. We've viewed online harm as less impactful – as it's not physical abuse, we treat it less seriously. With metaverse technologies, you can physically sense resistance and impact, which means opportunities for physical assault. That has an operational impact for information security and cybersecurity. What implications do these threats have for cybersecurity leaders today? Technical information and security aspects become more important in addressing psychological and physical harms in these connected spaces. Pacemaker interference with medical internet of things (IoT) signals that. We already have people walking around with internet-connected medical devices like defibrillators, insulin pumps and continuous glucose monitors. If those don't function properly, and if somebody dies, the question of responsibility arises. If it hasn't already happened, Chief Information Security Officers will be asked, 'What did the data say about any interference with that pacemaker? Was the firmware up to date?' We can see something similar playing out in the metaverse. Everyone will say it's someone else's responsibility – those who make the hardware will say it's the experience developer's responsibility, they'll say it's the user's responsibility, and so on. People used to thinking only about data security and network security must now consider users' physical safety.
data ethics interview

How data ethicists are helping tech business be better

  • min read
    • Using data responsibly is a hot topic. Tech companies must ensure they don't cause harm, for example, by breaching consumer privacy or reinforcing bias through automated decisions. It's a moral and legal question, but it may be unclear how businesses and governments should approach their data responsibilities despite increased regulation. We still see egregious data use practice. Alice Thwaite is technology ethicist and responsible owner for ethics at OmniGOV, MG OMD, working with the UK government on communications and advertising. We chat about what data ethics means in practice. Gemma: What does it mean to be a data ethicist today? Alice: Ethics is the study of how to live. An ethicist takes a theory of how humans want to be treated and how we should interact with the wider world, and thinks about how an action or technology could contribute to that goal. We use ethical methodologies and knowledge about the consequences of a technology or business model to transform the business into one that prioritizes ethics. Businesses have always operated in the realm of ethics, but usually without a systematic approach. Ethicists co-create frameworks with stakeholders like customers, colleagues and wider society so that an organization's values become critical in business decisions. What does that look like in practice? First, we help organizations understand where they're making ethical decisions and show how they'll need a more systematic process to reach their ethical goals. Second, we educate organizations on ethical methodology and issues. Third, we assess practice to understand what the company wants to prioritize and how current practice meets ethical goals, making suggestions like 'ethical pilots.' Finally, we implement and measure ethical pilots so they can become policy. We don't work in a vacuum – we must be in constant contact with various communities. For example, before establishing diversity, equity and inclusion (DEI) initiatives, a company might think racial equality is important but have no roadmap to get there. With an influence campaign, education, auditing and an implementation program, they may still have a way to go. But they're now measuring ethnicity pay gap and thinking about inclusive work environments for different people. They can keep following the 'influence, educate, assess, implement' process to fruition. Where do organizations start? What tips do you have for those keen to start doing ethics? Hire someone to build an ethical program and link them with a sponsor who can ensure the organization implements their recommendations. They may have a degree in philosophy, international relations, social science or community work experience. Ensure they can learn as much as possible about business ethics and support their attempts to transform the culture. Those in data security or compliance should recognize an ethicist has different processes. The goals may be similar, but the process aligns more with social science and humanities methods. What questions should organizations wanting a data ethicist ask? Are we committed to change? Do we want a world prioritizing human values like democracy, dignity and freedom? Are we prepared for the discomfort that comes with changing procedures? If you're prepared to change, write a job description incorporating things I've mentioned and encourage your team members to apply. Opinions reflect those of the expert. Interview edited for clarity.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries