Ross Saunders — Data Privacy and the big WhatsApp conspiracy

Once more it is what's involved. Good to have you along with us. Special guest tonight and he's kind of my go-to guy. If I have questions regarding weird and wonderful internet things and security and changes and everything. And over the last little while, there's been this huge big uproar about WhatsApp. And I've had all sorts of messages about this one's leaving to go here. And if I have WhatsApp on my phone, they're not going to be friends with me anymore, which has left me, well, unimpressed to say the least. Who am I talking about? He is Ross Saunders. Hello, Ross. - Hello. - Good to have you with us on the show. Ross has been on the show before. As I said, he's my go-to guy, but if somebody doesn't know who Ross is yet, let's help them out. Tell me a little bit about Ross Saunders, please. - Great, so yeah, it's great to be back. I'm always enjoying being on the show. From my side, I'm a data privacy specialist. So over the years, I've been working in the information security space with software companies, as well as other small businesses in getting them to a level of compliance with privacy laws, cybersecurity, security measures, things like that, as well as even physical security in some cases.

And that's really the space I've been playing in for a while. And with all the privacy things and awareness that's coming to people now, it's really coming to the fore and I'm having a lot of conversations, which is great. - Fantastic stuff. Now, what led you down a lot of this road is, and we've talked about this before, is you actually had your identity stolen online and you were effectively a non-person for quite a while. So you have extensive experience in this. So Ross, let's dive right in and start off with this whole thing about WhatsApp.

Okay. I mean, I just, you know, I'm not a sort of technically very clued up person and then I just got comfortable with WhatsApp and now they're telling me that they're going to use WhatsApp to mine my data and steal, it's pretty terrible. Have you seen this, obviously? - Oh yes. Early January, this was all that was in my inbox and all that was on my phone, ironically through WhatsApp as well. So yes, this has been a big thing, but at a baseline, I can probably say it's a bit of a storm in a teacup, but I think let's get into that. - Well, let's do that. I mean, I use WhatsApp to communicate with a lot of people. With MixFM, we have a WhatsApp group where the various presenters post bits and pieces, et cetera, et cetera. You know, it just, it seems a very, very quick, easy, simple, elegant way to get stuff done. I happened to, I was chatting to a lady the other day who has an orchid business. So she sort of sells orchids and all of this done is done on a WhatsApp group. And I saw recently, well, not so recently maybe, but WhatsApp for business has been launched. And then along comes, I don't even know where it started. Maybe you can help me out. Where did it start? Where this whole thing about, oh no, WhatsApp is suddenly not cool 'cause they're gonna mine your data.

Where did it come from? - Sure, so this has been around for quite a while and I think that's what a lot of people don't realize is WhatsApp was taken over by Facebook a number of years ago, 2014. And information sharing with Facebook actually started happening around 2016 already. Back in 2016, everyone who was using WhatsApp would have got a little pop-up saying, well, hey, we want to share your information with Facebook. Do you allow us to do that? And you had the option to opt in at the time or opt out of that sharing. I personally opted out at the time. I'm generally an opt out kind of guy. But it's been around for a long time and I think what's happened now is WhatsApp has made it public as to what's going on and that there's sharing that might happen and things like that. And we'll get into how disastrous their PR was around this. But it's more them now making it clear what they're doing and what they have been doing for a while as opposed to something that's new and suddenly going to be sharing information. And a lot of it is people are reading more into it than what is actually happening on the backend. - Well, that's the reason I wanted to chat to you. To find out. I mean, because if I have to now go and learn and hold another entire platform and some of those platforms I've heard some horror stories there as well, I'm not going to be happy.

I'm really not. It took me a long time to figure out this WhatsApp thing. So let's talk though in terms of privacy because I'm one of those people that I figure I live a fairly boring life anyway. And if anybody wants to sort of, you know, listening or scan my WhatsApp messages or whatever, they're not going to be terribly impressed by it. I'm also one of those people that unlike you, when it comes to things like Facebook, they're privacy terms and conditions. I took one look at those multiple pages and did what I think a lot of people do and said, "Yeah, okay, whatever." Facebook, WhatsApp, the same thing. So let's talk about this now. You say it's a storm in a teacup. My understanding is that it's exactly what you say and that they're not collecting horrendous thought on us, but where do you stand? - Well, I'm going to dive into exactly something you said there about your messages being interesting or not interesting and people not being interested in you. It's been categorically stated by WhatsApp, by Facebook that they cannot see your personal messages or hear your calls, neither can Facebook. And that's a good thing. And I think that's what a lot of people have overlooked. I think with this whole thing and the reason I say it's a storm in the teacup is a lot of people will go to the media and form their opinion from the media article that says, "Oh, well, this is crazy and bad and what have you." And what bleeds leads.

So a lot of these news outlets would kind of hype it up a little bit. And people read that. They don't read the terms and conditions, but then they freak out about the terms and conditions. Now, if someone had read the terms and conditions, there's a lot in there that's actually pretty clear that this is relating more to the WhatsApp for business services that are coming and that they cannot read your messages. WhatsApp uses something called end-to-end encryption. And I'm sure we'll get into this when we talk about the likes of Signal and Telegram. But end-to-end encryption means that the conversation I have with someone is on my device. It's on their device. And no one in between that chain can see that information. WhatsApp only stores the information while it's being delivered. So if you haven't got that second check mark yet, that's when WhatsApp has that information, but it's still encrypted. And once it's delivered to the other person's phone, it's only on their phone. WhatsApp doesn't keep it anymore. It would be impractical for them to do so. Just if you think about the amount of data it would take to store those billions of conversations. - Okay, all right. That makes sense to me.

I mean, I posted the "Ask the Christian" a little while ago. It's like, what on earth do you lot do on WhatsApp that you are suddenly so worried about? Are you sending some of those saucy pictures out that you perhaps shouldn't have? But so essentially, Ross, WhatsApp, as we would use it personally, is not a bad thing. But what data do they collect? - You know, exactly that. It's not a bad thing. And it comes down to sort of the volume of people that are using something. I mean, WhatsApp is convenient. It really is. I'm not getting rid of WhatsApp. I use it to communicate through a lot of things. And the kind of information they take, I mean, there's been this whole scare that people were worried that they were gonna take your banking details because that was something that was in the privacy policy, but people didn't read the policy again. So what they actually said in the policy was they were taking transaction details. And that is more, like you say, with the orchid business, someone doing business on WhatsApp. WhatsApp is introducing features where you can make purchases in WhatsApp. So you could go and actually make a payment with your credit card to a business via WhatsApp. They would have to keep that transaction information because it's part of the platform that you're using.

It's not your banking information that they're keeping. It is literally like you would be shopping on Take-A-Lot and putting in your credit card details there. So they are taking that kind of information, but then there's also other information around, which is perhaps where WhatsApp does fall foul a bit of the likes of Puppy and things like that because they do take things like your battery level of your device, which under Puppy is kind of like, well, why do you need that information? You don't need my battery level to provide the service to me. But it's battery level. It is your details around your contacts because you are signed up for their service. So you have a contact detail there. And it's a communications tool. There are bits of your contact list that you can share, but it's not necessarily the end of the world. And again, it's not what's in the content of your message. It's the metadata about you. - Okay, but now surely, I mean, if you look at us living in this connected world that we live in, unless you are not on Google, have never purchased anything via Amazon or Take-A-Lot, you're not on WhatsApp or any form of social media, surely that data, and I know there's a big discussion around it, but surely that data is being collected anyway.

I mean, I'm pretty darn certain that the likes of Facebook and Google and whatnot have got some fairly extensive set of data points on me and my habits. Is that what they're looking for? Is it effectively they are looking to see how they can market better and more effectively to us? - So that's an interesting thing. So yes, other companies and other places have tremendous data on us. And you know what, quite frankly, if you are using the Facebook app or the Instagram app on your phone, you've given Facebook way more information than WhatsApp is ever giving them. So if you've got those two on there, don't even worry about WhatsApp, it's a non-issue. But if you're, shall we say, off the grid, you might have concerns about certain information going out there, but a lot of what's in the WhatsApp sharing is again going back to the businesses that you may buy from. And what was in these terms and conditions is more that I am going to buy an orchid from the person you were referring to. They are going to get a copy of that chat because they are a business and they might share it with their marketing department or something like that. So that's the kind of sharing you're gonna see. And that's the kind of sharing that happens every day.

People must remember that if you're getting a free service of some kind, there must be some sort of trade-off. And often that trade-off is privacy at this stage. - Okay, fantastic. My special guest is Ross Saunders, data privacy specialist, speaker, author, whole bunch of stuff. We'll fill you in on all of that during the course of the conversation. We'll be back talking more about data privacy, about WhatsApp, and then also WhatsApp for Business I'm gonna wanna talk about, and then some of these other sort of platforms that people have suggested. This is what's involved. We'll be back in just a bit. And we're back with my special guest, Ross Saunders, data privacy expert. Okay, so before the break, we mentioned, Ross, that you were talking about WhatsApp for Business being a totally separate thing from your traditional WhatsApp for your mates and things like that and how you're going to get together for your next party or whatever the case may be. So where is it different? Because I would think with sort of WhatsApp being so pervasive, WhatsApp for Business, if you're running any form of a business, might be the next logical step. - Yeah, so I'm actually kind of excited for some of the features that WhatsApp is introducing, which is where this privacy policy came.

I do have reservations, like I said, about the amount of information that's shared, but they're bringing in a lot of convenience. So some of the stuff that they're looking at with their business side is, you're going to be able to get your flight information, if we can ever fly again, from WhatsApp and see when your flight might be leaving, things like that. But also you could, like I said, do transactions and purchases directly through WhatsApp. So you're kind of taking out a lot of the middlemen in this kind of thing, and it's connecting businesses to their customers more. And that's where it's really beneficial. So you may have seen that if you're having a WhatsApp conversation with someone, it'll say, "This conversation is with a business." That's letting you know that you're now chatting to a WhatsApp for business client on the other side, they were using the client. But that is now, you're dealing with a business, you're not dealing with an individual. It's now a different kettle of fish. You might make transactions, purchases, things like that. And that company would then, in order to invoice you, have that information and process and things like that. So it's actually quite exciting that there's some cool new features coming.

And part of that is they're securing it with Facebook. That's under that Facebook marketing platform as well. - Look, and I mean, let's be honest here, Facebook hasn't got the most squeaky clean reputation. And I think they're doing something, maybe it's just tokenism, but they're doing something to address some of those issues. So essentially Facebook for business, I mean, if I've made a purchase online anywhere, that transactional data is available to whoever I've made the purchase from, i.e. Amazon. I mean, I have a Kindle, I'm a voracious reader. So I buy stuff from the Kindle store all the time. So people have got that transactional data and obviously they can use those data points to figure out what kind of stuff I like. - Yes, yeah. So that's very much what's gonna be in it. And like you say, Facebook does not have the squeakiest reputation. And they are in multiple lawsuits at the moment as well. But yeah, anyone's gonna have that transaction information if you are doing business with them. Where it does get scary is where that kind of gets almost weaponized in advertising, where they're gonna direct it at you with pinpoint accuracy. And it does get uncomfortable when people have that much.

- Yeah, listen, I mean, that might be another conversation for another day, the whole concept of pixels and the way that they can, once you visited a website, it follows you around. And Facebook then shows you exactly those kind of apps. So yeah, you know, every now and again, just to mess with the algorithms, I do sort searches for pygmy indigenous art or something equally obscure. You know, it does nothing in the greater scheme of things, but it makes me feel better. So I do that. The other thing that- - The outlier. - The other thing that got my attention as well about this Ross, is that a lot of people are saying, if you look on your phones, and I can speak to the iPhone, for example, if you are at any stage transmitting any sort of data, there's apparently a little dot that pops up. And apparently they worried that when you're sort of, if you've got WhatsApp on your phone, then it'll be transmitting this data backwards and forwards all the time. I've spent days, days looking hopefully for a little dot on my iPhone and to no avail. Have you heard anything about that? - So I think what that's more referring to is the location usage on your phone. So I know on my iPhone as well, when my location is being used in the background, the clock on the top left goes blue, and that something is using location in the background of my phone somewhere.

And I think that's where people also had a lot of freaking out because in the privacy policy, it's we're gonna use your location, we process your location information. Your location information is not necessarily processed by WhatsApp or Facebook. It's because you're sending that information to a friend via live location or a pin or something like that. So it's used for that instant that you're using it and it shares it with the person you're sharing with. So I'm not too worried about that. If WhatsApp was constantly using all this data in the background, we'd run out of data on our phones very quickly as well. And I don't see, there's a lot of paranoia about this is gonna be used all the time and things like that. It's really not, I think. I think, again, speaking back to the storm in the teacup. - All right, so now we've covered WhatsApp and we figured out that storm in the teacup. So all those of you who might be listening who've deleted me or threatened me with deletion and becoming a social outcast because I still have WhatsApp on my phone and I'm still on Facebook. Now you know, okay? So you're overreacted just a little bit. But moving along now, in the wake of this came these other platforms that everybody's going, "Oh, let's use this." And one of them is Telegram and the other one you mentioned is Signal.

Now, I've heard some horror stories about Telegram about people getting added to groups and doing this and that and the next thing and they weren't signing up to these groups and suddenly getting messages. What can you tell me about those platforms? - Horses for courses, I think. Telegram, I think we're suddenly starting to see the demons coming out of Telegram now and that in South Africa seems to be where a lot of folks have moved to. It's like, "Oh, well Telegram is secured. "Let's go over there." It's a knee-jerk reaction. Telegram is good. It's a good platform, but it's a good platform for different reasons. Telegram does allow messaging. It is encrypted. It's encrypted in a different way to WhatsApp, which is very important to note and we'll touch on that in a moment. But it also, Telegram has a fantastic API for programmers and people working with data and things like that. So for example, Telegram has bots where you can ask questions and it can respond in a sort of AI kind of way or programmed kind of way. And you can use it to control things. So for example, we've discussed before that I've got a smart home. I get status updates about my home on Telegram because I can use that programming interface to send messages.

I'm also a member of groups that are for community safety and things like that. So there are very much usages for it. Telegram is great with groups, but it's not necessarily as encrypted and as secure as WhatsApp actually. And the other side of it, the demons that we're seeing coming out of it now is that people can go anonymous on Telegram and you can join groups in your nearby locations. And if you go and turn that feature on, which is really easy to do, it's horrifying the kind of groups that are around in the areas and within 10 kilometers of you. And there are some very, very adult groups out there that would be dangerous for children and for even adults, I think, to be members of it. There's some crazy, crazy stuff on there in the anonymous spaces with it. So it can be dangerous there. - Yeah, you see? You see, for a simple person like me, WhatsApp remains the option. Yeah, that's one of the things I'd heard is that there's like hectic stuff available on Telegram in this anonymous sort of space. Where do we stand with Signal? I mean, 'cause I'm just worried that I'm gonna have to have all of these apps on my phone at one stage to talk to people and that's gonna just be a pain.

Tell me about Signal. - So Signal, interestingly enough, was kind of born from WhatsApp. And WhatsApp itself runs on Signal's platform or at least the technology behind Signal. So what happened when WhatsApp was bought out by Facebook is one of the co-founders of WhatsApp had serious reservations with what Facebook was going to be doing with the data, what their plans were moving forward, how they were gonna start marketing to people potentially. And he left the whole merger, Facebook, things like that. And there was the Signal Foundation that was formed shortly after that. Now, Signal is based on an even earlier messaging platform that was designed to be secure and free and all of that. And with the co-founder of WhatsApp joining Signal, they really formalized it into a fantastic platform. Now, Signal is built from the ground up with privacy in mind in that you have that end-to-end encryption. So the conversation I have with you, David, over Signal means it's on my phone and your phone and nowhere else. No one else can access that information. You'll see Signal also doesn't have web clients and things like that. That's for the extra security. Now, what they have that's a bit different as well because a lot of people say, "Well, oh, Signal's just gonna go the same way as WhatsApp and get bought out and marketed or commercialized and things like that." Signal has not been designed as a commercial entity from the start.

It's part of a nonprofit foundation that works with privacy. And the significant cash injection that they received from the WhatsApp co-founder should see them going for a number of years without needing to be commercially viable. - Okay, all right. That makes sense to me. This is what's involved, by the way. My special guest is Ross Saunders. He is the data privacy expert. I say "the" because Ross is really up to date on this kind of stuff. When we come back, though, let's go back a step then, Ross, because I wanna talk about WhatsApp for business and find out where some of the pitfalls there could be. So we'll discuss that when we come back. This is what's involved. We'll be back in just a bit. Now we're back, my special guest, Ross Saunders, data privacy expert. So Ross, let's talk about this WhatsApp for business, because on the one sort of side, it looks like it's gonna be a brilliant thing. Make our lives easier. I can talk to my customers. We can have our own little WhatsApp groups, et cetera, et cetera. Is there something we need to be worried about? - You've kind of hit the nail on the head. They're just in the sentence that you used. There is WhatsApp for business, which is the business side that they're doing.

And then there's communications inside your business with WhatsApp groups between people and employees in your business. WhatsApp for business is, I think, going to be a really excellent platform for that initial engagement with your clients. If you're selling to consumers, like business to consumer B2C, WhatsApp for business could be a really, really good entry and direct contact with the people you're trying to sell to because you have that instant in their pocket engagement, which is great. When it comes to dealing with a internal group of people where it is employees or particular teams or things like that, then it gets to be a little more hairy because remember what I said previously is it's always a trade-off between your convenience and between privacy on these free services. And you have to ask yourself as a business and as a business owner, are you prepared to use a public service that you have no control over to have your internal business communications running through? And generally the answer is no there because one, you've got no control over it and two, it's starting to tie into things like the Poppy Act and it's starting to be a gray area into a, well, no, don't do this.

- No, I'm not sure I entirely get you there. So, show, draw me a picture. Give me an illustration of where people could be on a group, an internal group, whatever. What sort of, what is the actual danger? Give me a sort of, for example. - Okay, so let's say you are a software company. I work with software companies a lot and perhaps your support department have a WhatsApp group that they have on their phone. So everyone in the support team can chat to each other, can exchange information about a certain case or a call that's come in or something like that, ask for advice between each other and that's great. They can get the information very, very quickly on WhatsApp. The trouble with that is you as the business don't have sight of that. If you as a manager are not invited into that group, you'll never see it. If you have new staff members coming, they might be in that group without you knowing it. If you have staff members leaving, they might not be removed from that group and then they can see confidential information. You also then run the risk of the people that are running that WhatsApp group are not necessarily supposed to be administrators of communication. So you as a business lose sight of all of that.

It just becomes quite a significant risk from a cybersecurity point of view as well as a privacy and confidentiality point of view because information might be shared without you realizing it. - Yeah, I mean, particularly if you got in your example now, I mean, if you've got a difficult customer that you're talking about and sort of say disparaging things on the group and somebody at some stage gets disgruntled and leaves or whatever, they've got that information on their phone and they can go to Mr. Jones and say, hello, Mr. Million Rand a month customer. This is what people really think of you and that could be devastating if I understand correctly. - Oh yeah, that's one of the avenues and that's something I see a lot of and I've dealt with a lot of our clients where conversations have happened in WhatsApp and WhatsApp. You know, I think we have this cognitive bias that because we're using WhatsApp, these people are our friends and we can say whatever we want. And then we go in and call Mr. Jones a bleep, bleep, bleep. And someone goes and takes a screenshot of that and sends it to Mr. Jones. And that happens regularly. It happens with CFOs, it happens with MDs, it happens with clients and we see it a lot.

That's one of the risks there is that you're out of control. Whereas if it's an internal business system that's paid for to work on like something like a Slack or a Teams, you are now still in the business sense. And you've got that feeling that, you know, well, my boss can still go and look at this at some point. And this is an official business communication tool much like my email. And it's a different feeling within your mind and feeling within the team as well. - So in terms of this, let's say businesses are using this, which they are and they're embracing this. Do you have suggestions, et cetera, that they should implement in terms of that? Or should it be a ban on using WhatsApp or Telegram or Signal for anything business related? Where would a safe place be to go direction wise? - If it's an internal business, I think you need to use tools that are designed for internal business communication. So if you look at the likes of the Microsoft 365 suite that has communication tools built in, it's got Teams. And Teams has an app for your phone and your employees can go into the app. They can access conversations. They can access documents related to clients. And it works just the same way WhatsApp does, but it's internal and it's managed by you as the business.

And because it's not necessarily a free service, and it's actually quite affordable for a business, you have that control. You're not trading of privacy for it. You are having this enterprise grade solution that works really, really well for you. And I know a lot of folks aren't perhaps fond of Microsoft 365 or anything like that. There are other tools in the space as well. Like I mentioned, Slack is a really good tool that also has phone applications that people can hop into chat and it really works well. - That's always amazed me is just the name they chose to give it because the connotations, particularly in the South African contents, is very, very strange. Russ, we're running out of time. I think you've answered most of our questions though. We're gonna come back and wrap it up with Russ and find out if you are now sitting and you have got yourself in an absolute knot about data privacy and the poppy act, et cetera, et cetera, we'll talk a bit to Russ about that and see how he can help you. It is what's involved, back in just a bit. And we're back with my special guest, Russ Saunders, Data Privacy Expert. Okay, so Russ, we've sorted it out and you've agreed you're not leaving WhatsApp.

I'm certainly not, I wasn't terribly worried about it. As I mentioned, all my mates and everything that have unfriended me and marked me as unclean and besmirched. Tough luck for you, I'll see you back on WhatsApp. And I think we've given people a very well-balanced view of it so far. However, this does fall into the larger realm of data privacy, data security and those kinds of things, which is, that's your wheelhouse. That's where you play. You are a speaker, you speak on that. Do you also help businesses in terms of this data privacy and the poppy act, et cetera? I do, and it's become so important now as of last year where the president signed poppy into law that it is now coming. It's been coming and we've had this poppy fatigue for about seven years and now suddenly it is here. And it is here in full force as of the 1st of July this year. So you don't have a lot of time to comply. And I don't think people realize that it's a lot of work. Something as small as talking about chatting in a WhatsApp group affects your poppy compliance. So very, very important. Okay, now let's assume that we've suddenly gone, uh-oh, we can get hold of you. This is what you do. So where do we go to get into contact with Ross Saunders?

The easiest way to get in touch with me is via the website. So it's www.rosseonders, S-A-U-N-D-E-R-S dot com. That's the best place to get hold of me. I'm also incredibly active on LinkedIn and I'm quite happy for folks to reach out to me there. - Okay, yeah, that's probably a great idea as well and have a chat. You are open if somebody sort of says to you, I just need some advice that maybe you would be able to give them some advice. And then obviously for the bigger stuff, that's where you come in as well. Ross, in terms of talking about this kind of stuff, is this something you do? Do you do keynote presentations about privacy and security? - Yes, I do. So I do keynotes on the privacy side, talking about Poppy, things like that, but I also blend it with cybersecurity and awareness, both on the individual level and in a business. So what do you need to look out for social engineering, identity theft, data breaches, things like that. And I like to think that I make it interesting as well. - Well, I've heard some great reviews about what you do. So yes, you do make it interesting, but if you are sort of a medium to large corporate and you're listening to this, and Ross is a great person to get in to speak on this, to speak to these subjects.

He's incredibly knowledgeable. He does his homework. So check it out. That website address is rossgsonders.com. Ross, before I let you go though, one very important question for me, and once you start following along and chatting to Ross, you'll understand this question that I'm about to ask. And that is, how's Cleo doing? - Cleo is doing wonderfully. She is currently, I think, still in bed though, because it's way before her get up time, which is normally around 11. - Okay. Let's just, I can't just leave it hanging there if you don't know yet. Ross is this amazing, she's a dog, but she doesn't act very doggy most of the time. She's a whippet, isn't she? - She's a cross between an Italian greyhound and a whippet, yes. - Yes, and her name is Cleo. And Cleo is incredibly famous, both on Facebook and on Instagram and everything. And I just, that's actually one of the reasons Ross and I first started talking was because of Cleo, because I was more interested in what Cleo was doing and how she was playing with her ball through the lounge window than anything else. And then got talking to Ross through this and that's how we ended up there. But yeah, go check it out, man. Can connect with Ross and follow the antics of Cleo as well.

She's not gonna give you terribly much info on data privacy, but she is very entertaining and incredibly cute. Ross, thanks, man. I appreciate you taking the time out and having a chat to us. I do hope that people reach out to you and I hope that we've laid some of those fears to rest about these various social media platforms, et cetera. - No, thanks for having me. It's always great to be here. - There we go, wraps it up for this edition of "What's Involved." My special guest there is Ross Saunders. Once again, get hold of him at rossgsaunders.com. Until we speak again, look after yourselves and thank you for listening.