BSides Vancouver 2015 - VEC Panel - Entrepreneurial lessons learned and best practices

check check one two choke one two chat checked check one two two check one two two two

all right welcome back we're just going to have a few minutes with our one of our silver sponsors paul security who just wants to give you a little bit of awareness of who they are what they do and what they're thinking here's dan great thank you alex i just want to thank the b-sides team for the opportunity to be here today and tomorrow with you all i just wanted to introduce paul secure to you pulse secure is a new company but many of you may know our products paul secure was formed out of the acquisition of juniper network's ssl vpn and knack solutions we purchased those in october 2nd of 2014 and we're headquartered in san jose matt and i are

based here in canada so come on over we've got our booth we look forward to speaking with you further on october 2nd we also purchased a company called mobile spaces to help secure applications and data on the android and ios devices as well so thank you very much everyone look forward to enjoying the rest of the conference with you have a great day thank you dan all right one uh one announcement we do have a lost phone it is a huawei wind phone so if anybody knows who's this is it keeps on vibrating my pocket please find me and i'll return to the happy owner all right uh so for our next it's actually a panel um our premier partner

vancouver economic commission helps tech startups get into the market and we thought you know i know a lot of the geeks in the community that have really great ideas but don't necessarily know how to articulate that into turning it into a product or into a business so we thought it'd be a great idea to have some people from the industry discuss how to take your idea and turn it into a product so i'll introduce sean from the vancouver economic commission

hi everybody again my name is sean and i'm from uh the city of vancouver's economic development agency and we're working hard every day to promote vancouver as a global destination for innovative creative and sustainable business these are some of the areas that we support the technology industry the digital economy and the green economy if you're at all interested in in learning more about what's going on here i would absolutely love to talk to you guys we have a booth out uh afterwards uh so why is the city's economic development agency at a hacker conference uh well you know we're actually here to tell you that something special is happening in vancouver and something that you guys

are a part of vancouver's startup community and the technology sector here is thriving in fact it's booming we're starting to see this being recognized in the media we're starting to see an explosion of entrepreneurship and some of our smaller companies are growing into international superstars and that is not done in isolation that is done with people like you the security technology industry is growing and thriving in vancouver you guys know some of these companies but they're really starting to make waves and it's when we see stuff like this that we know that we need to support what's happening at the grassroots level with the security technology industry here so you see a visual on buying the

former telus building i mean that's a that's an amazing acquisition of real estate two-thirds of the real estate in vancouver that's coming online this new real estate that everybody's worried about filling are being filled by technology companies that's a really exciting fact and nobody seems to be talking about it i wanted to read you a quote from the ceo of absolute software he said there was a technology presence in vancouver when he was building his company but he felt quite isolated and then he goes on to say and now we're at the something we're at the center of something very exciting fortinet who's here today in the back they're recruiting smart people like you they

they've just been recognized as bc's number one technology company by the bc technology industry association and then now as employer of the year so there's fantastic opportunities to build your career in bc and in canada and uh you know the message on that front is that you don't need to leave this city to build your career and i think a lot of you already know that but this is really tangible now so these are some of the companies in our space some of the companies that are on our panel here today to talk to you about uh building a company here so i'm going to show a brief uh video uh that we've put together that

really highlights some of the exciting things that are happening here in our technology industry and i hope you guys enjoy this and start to feed off some of the energy of what's happening here

want to change the world want to be a leader break something we've been told don't break what is broken if it's safe it doesn't need fixing but those who build those with vision know that there is no distinction between creation and destruction everything that ends in the beginning of something new watch how the quickest of an idea tears at the seams give it a name let it live in another form sometimes rebirth can be violent but no one says transformation was gentle break something crack open the surface of what could be rediscovered curiosity vision is the cases for innovation passion is the fuel that builds momentum imagination is the blueprint for manifestation so break something

create within a cacophony of brilliant thinkers this is where inspiration converges with capital where we shatter the limits of what we thought could be pushing boundaries is the backbone of the city dare to be dynamic wear innovation like a second skin move fast in a community of movers as breakers and a mac of a global game changers your place is here your time is now so break something

thanks a lot guys i want to introduce our panel here it's going to be moderated by a good friend of ours jeff fox of nrci ramp he's going to introduce all the folks and i'll hand it over to jeff uh thanks john um so um we thought it'd be a good idea to have a little bit more of a interactive session today so if you have any questions just put your hand up uh i'll try and repeat uh your question and you can direct it to one of our panelists so i'm happy to be moderating today i have with me um a group of entrepreneurs that are have built are in the process of building or

are getting ready to uh lead their next startup in the area of uh security technologies payments um financial technologies also known as fintech uh so a lot of good a lot of good background here that uh that have been brought together that uh should make for a pretty good session today so to my last left i'll introduce catherine lowen catherine is the founder and ceo of control which is a management platform for the payments industry control allows merchants to manage and monitor their payments from ios android and the web a little bit of background on catherine she started her career with citigroup europe um developing one of the first online banking systems uh citydirect she's worked in the world of

online gaming and has been um a director of product management in e-commerce and risk management applications welcome catherine to catherine's left is nick badminton nick is a futurist and authorist and is currently regional managing director of freelancer.com the world's largest online freelance marketplace uh nick has a over the past 18 years has been has worked with a lot of different companies from huffington post techwa tech vibes linkedin pulse um he where he curates events related to tech he is also involved with cyborg camp yvr product yvr and dark futures uh welcome nick uh to nick's left is uh bernd pitak uh bernt is a seasoned entrepreneur uh he's been with uh alex ventures slash mobio here

in vancouver in an executive management role um as cfo uh he's got a strong technical background and over three decades of professional experience he's provided professional consulting advisory services in a whole variety of different industries including including fintech he's done emerges and acquisitions analysis and opportunity analysis and a whole variety of different advisory services in healthcare games and technologies welcome parent uh debra's left is peter luong uh peter is the cto and founder of fusion pipe here in vancouver fusionpipe develops enterprise security mobility solutions that solve uh authentication problems for medical telecom and utilities customers peter brings 12 years of experience in the area of um authentication and technologies network security carrier network deployments he's been involved with cibc government

alberta nortel ibm canada and he's currently in his role as cto for fusion pipe involved in driving for the intellectual property and and patent portfolio that fusion pipe is delivering as part of their as part of their initiative so thank you and welcome uh peter uh to kick things off i'd i'd like to um ask each of the uh panelists to say a little bit about uh about about what this panel is all about in in your experience what have you um what have you uh done or what are some of the pitfalls of starting your technology company or past technology company um uh share with the group and uh and as i mentioned before if you have questions

put your hand up after we talk to each of the panelists and we'll try and get a lively discussion going over the remaining hour so in no specific order i'll start off with um with nick badminton so um no pressure nick um that's okay yeah um hi there um just quickly uh a show of hands in the room who's ever used like freelancer.com or another sort of online resource uh marketplace yeah i've been chatting to quite a few people and i think this kind of community to get stuff done quickly kind of uses it we're uh we're currently about seven years old we went public about a year and a half ago we're at 4.14.7 million users and what's really

interesting when i was asked to speak on this which was this morning um thinking about security and privacy and authentication is actually something at the very heart of what we do and it's at the heart of what we do because we operate in 247 different countries around the world and we connect people you know in places where they've got very low tech infrastructure but they still need to use an online platform in in the collaborative economy we're actually seeing uh even even things like mobile going up by 81 percent year-on-year traffic uh mary meeker from klein klein perkins talks about the re-imagination of everything where we've got uh wearables implantables um the internet of things and and

everything coming to bear but what's really exciting about um the world um digital economy and and the digitally connected is there's only about three three and a half billion people actually on the internet so there's about there's there's a difference of about four billion people that are going to be coming online and they're going to be coming online in the next sort of five to ten years and what they're going to do and what are we going to do as companies as well so we operate um with a huge bandwidth of projects every day lots of people are authenticating paying each other around the world from many disparate countries in every single configuration as you can

can imagine we're managing fraud we're doing everything there's actually something really interesting um that i just wanted to bring to the table with this is that you can't just think about systems you have to think about the humans that are actually using the system so some of the talks that we've actually seen earlier have been really great when you talk about the human element so actually thinking about you know the people process tech governance and information that exists in everything that we're doing is something that we take very very seriously and we measure and we optimize and we're very transparent as an organization so i i think i don't want to keep going on but um what we do is we

connect people we connect a new economy where we help entrepreneurs get going so you've got an idea you can jump on on our platforms but the one thing to think about if you're thinking about building any level of technology think about the empathy that you need to build into it think about the empathy that you need to build into your your operations as a company and that you're actually making a difference to people's lives as well and i'll leave it at that thanks nick peter a little peter a little bit about what fusion pipe is doing and what you've seen over the past few years in in growth and challenges okay great yeah i i definitely wanted to uh share

my experience in terms of uh starting a company especially in the enterprise security space uh so coming on to this panel is actually it's a great event for us to be able to kind of share some of our pains and the great things of starting a company so i i personally moved to vancouver after the olympics so i came here for personal reasons but in terms of my career i worked in large enterprise for most of my life whether it's network security or working at large enterprises on security related projects um i definitely saw a big opportunity in terms of when apple released the ipad and i thought okay there's some opportunity here to turn this into a

business tool so that's kind of how i started off the company here but literally i came here i didn't know a big group of people so i had to actually develop and build together a strong team to be able to um execute on where we are as a company as today so i've been very happy with what vancouver has brought to us in terms of the ecosystem for tech entrepreneurs looking at starting a company and it's with bcic uh nrc iraq vancouver economic commission bctia they've been great for entrepreneurs just really to to put that seed together and start a real company here thanks peter uh catherine and control's been been been pretty active and uh yeah

we're pretty busy i want to show hands who here uses stripe or at the very least has used has heard of stripe okay so so quite a few few of you so that's cool so um i as as jeff mentioned i worked in the world of online gaming and nick and i were just discussing this uh before the panel started so at freelancer they use about uh five different payment methods so they accept payments using world pay a little bit of stripe paypal um in online gaming we were using at any point anywhere from 30 to 40 different payment methods because we had customers from all over the world and it's a north american bias to

presume that everybody around the world shops online using a visa or mastercard um so working online gaming one of the biggest challenges that i saw from uh being on the management side of having to work with my dev team to integrate all these different apis and such was all of the overhead involved with trying to get relevant and real-time data from all these different payment methods and also applying to get merchant accounts with all these different payment methods so there is a whole process involved with what the banking industry calls kyc or know your customer so having to go through these very lengthy application uh documents and processes and then getting all these apis and you know

varying different languages and and standards and such um so every new payment method we had to integrate um created an administrative burden and a technical burden for us um so when stripe came along with a standardized set of apis with apis built on restful services with a automated and streamlined application process that could do all that those kyc's in the background without any friction um to the merchant experience i knew that stripe was going to be big i knew they were going to be revolutionary they were going to revolutionize the payments industry at the time i was working for sap and i was actually i'd gone from building and managing products for the e-commerce industry to i finished my mba

and thought i'd do a career transition into selling e-commerce products and we were building um or sorry selling e-commerce platforms and i liken it to magento with a million dollar price tag so enterprise systems for the likes of burberry and adidas for large companies that need an omni-commerce strategy and we've done a lot of work on optimizing the mobile experience for the consumer exp from the consumer side so if you're adidas and you wanted to be able to sell your sneakers online or to somebody that was accessing your site from a samsung or iphone we provided a set of sdks or responsive templates so that your site could resolve to whatever browser the consumer was coming from but what was really

interesting was our own customers our own enterprise customers were asking for our business applications our business management applications to be in a mobile format as well so there was it was kind of a springboard for me um you know number one i wasn't very satisfied with with working in the corporate environment i'd always had an entrepreneurial spirit um and you know this the stripe thing and monitoring what was going on there and then seeing this idea to start building b2b apps was the catalyst for me to actually start my own company so i actually initially launched android product for stripe there was nothing in the marketplace that existed there was an ios product for stripe uh it ended up

taking off really really quickly it was enough motivation for me to actually quit my my job at sap with a good salary and benefits and go head first into the startup world i actually ended up working with invoke labs so if anybody's familiar with the invoke legacy so ryan holmes and a a couple guys started invoke media um they had a number of clients out of new york that were looking for better ways to manage social media and then you probably all know the what happened there they spawned hootsuite out of that so i joined invoke labs uh as one of their companies in residence um i became a stripe partner uh along the way and it's been a short journey i

only started the company in may of 2014. i ended up acquiring my ios competitor um so i now am the uh preferred stripe partner for um ios and android management of stripe accounts uh along the way i found out that our customers are also you know that that problem of having to have different payment methods depending on where you're operating our customers were asking for paypal and then we started getting asked for for bitcoin so since then i've revamped the strategy what we're trying to do is become the like the hootsuite of payments so we're building a platform agnostic platform that can effectively manage a number of disparate sources of payments data and it's not ironic that ryan holmes

actually joined as an advisor and investor because he's solving he solved the same problem with social media seven or eight years ago when twitter and facebook open up their apis that we're doing in payments and it's a really exciting place to be because stripe pioneered the idea of open apis in the financial services industry and now everybody's following suit so paypal now has a set of open apis uh coinbase dwola etc so it's a really exciting space for us to be participating in right now thanks catherine uh bern your background thanks very much jeff uh maybe uh i'll take a slightly different approach than than the rest of the panel just so that you get a slightly different perspective

i'll start with two seconds about my background um i started as an engineer and uh my sense is besides attracts a pretty uh pretty technical audience so a lot of you are gonna kind of understand what that means i had an eight year career uh and decided to go to business school and join one of those very large prominent consulting companies where you learn 25 times faster than you do in normal life but they make you travel like crazy and so on some of the discussions that we had before the panel um at the end of that like a good consultant i came up with a nice matrix and i said you know where do

i want to settle down yes i want to come back to canada uh how brutal a winner do i want well not very brutal being a winnipegger so you know vancouver bubbled quickly to the top of the uh of the places that i wanted to settle down afterwards it's a place i'd visited many times um and i came back with that large consulting firm and i started here uh but i knew maybe like katherine that at some point i was going to get out of the corporate world and i was going to do my own thing and i suspect looking around the room that there's a more than double-digit percentage chance of people that either have done that or

are going to consider doing that in the future that was 2002 and let me tell you there was uh you know no one could spell vec there was no sean taking care of us in the tech business there was there were no meetups there were no great conferences like b-sides there were no kind of hip hoppy videos to hype you up on why vancouver is such a great place to do this i came back directly from the bay area i was velocitized by the community that they had down there and i decided to come back to vancouver being a good loyal canadian and wanting to be here in a place where people don't keep guns in

their glove compartments um remarkable kind of off-ramp to take to come from the bay area back to vancouver it's a good thing that my first startup in at the beginning of 2003 was in the game business because at least uh we had ea here and there was one meetup that i could find which of course it wasn't organized online it was organized the old-fashioned way with it with the telephone and we got together once a month and talked about the development of games and it was a bunch of game geeks which was just getting going in the city at the time but there was none of the kind of resources that you would all have

available right now if you wanted to start the kind of business that we're talking about here and that many of us have been involved with but boy what a change i don't think there has ever been a better time or a better place than vancouver to get in you know to exercise your your uh your entrepreneurial gene and decide that you want to do something on your own and do something very interesting on your own this conference is about security and authentication and fintech and things like that and there is absolutely no industry i'm more excited about there's no industry in its broad sense that i think is is more staid more conservative more regulated has more bits and pieces

and spaces in it that still have not been disrupted that are waiting for people like you and i to come along and say there is a better way to do this um i i just have trouble thinking back even to 2002 and say how the heck did i do my first business with absolutely no one to call up and say hey i have a problem how have you solved this problem before and what options are available to me and what assistance can i find in the community all of that exists here now i think you can use that as an entrepreneur inside the organization you're in now if you're working somewhere you can use that

community as an entrepreneur if you want to do something on your own you know and many people end up doing both at different times in their careers but i am super excited first of all to be an entrepreneur and be very active in vancouver second of all i'm very very interested in the particular industries that are of interest at this conference where there's so much yet to be done so many interesting things to do and it's hard it's hard to be secure it's hard to do things well it's hard to work for the user instead of for yourself these are difficult things and you know that's the hallmark uh where i think smart people can be very successful

thanks jeff thanks bernd so this panel has some very good background and it's uh certainly many of you may be in the throes of doing a startup in the area of security authentication is there any questions anyone want to ask the panel and kick us kick us off here before i dive in um i'll look for any hands up i'll try and repeat the question all right going going and jeff gets to ask the first question um so what i what i wonder is i you know i look at the um i look at the payments industry and payments has um aspects of of how different sites and different companies architect how they how they do payments but what

i've always wondered is how secure is the information being being collected and a number of the other presenters this morning um raised uh raised the concern well you should you should you should uh uh you should not be concerned with security you should trust um what's being done with your information mainly because you have no choice um but if your information is misused then you have you have the option of of speaking up and saying something about it so uh to kick things off nick what what you reflect on my words how do you feel about how information is being protected in the era of payments and security and and and and really what it comes down to

online privacy and production of that information so so when you've got a two-sided marketplace very much like what freelancer.com has uh just just a very quick pricing you can post a project you can get someone to do your project for you so we collect money from the side of the project poster and the side of the person doing the project as well it's not just the collection of that and we actually do do institute like know your customer very much like banks as well and a number of the other online economy companies like airbnb have started doing it a lot more and there's a lot of there's a lot of fuzzy logic and a lot of human logic in there as

well as some hard and fast sort of rules and regulations we're actually a public company in australia and that helps with a lot of um stringent regulations around our business as well because we're basically building a country online right um when when you think of it from from that perspective and thinking about security and building that into the systems that there's it's not just the technology solution as well it's um we've got about 400 people worldwide and i'd say a large majority of the the company that we've actually built is uh is around support and um dispute resolution because in these new economies people well they didn't do quite what i said and you know we set up

milestones in our system and such like but um the dispute resolution and those processes are equally as important as the the tech that comes comes into it as well and also the transparency of uh i'm an employer you're going to give me that yes i absolutely know that you've delivered the work here's the money now or there's some really unscrupulous people right and i think that that's that's that's the challenge in the modern economy is is the people that still want to game the system and you know we work very hard to stop that gaming from happening so we're very much like running a national economy of 14.7 million people right peter comments on this topic or nick's

next words yeah it's um actually sorry just kind of building on that question again um but i i think just kind of talking about like some interesting technology that's coming into the marketplace something that from for myself that's very interesting is really around wearables and how that affects privacy security and a variety of other things when you get into enterprise as well looking at authentication you know apple is coming out with a new watch that's coming in the marketplace and how do you use that as a business tool we definitely see the demand for you know wearables in terms of fitness types of devices but now you're taking like really personal data and whether you're storing in the

cloud service and what you're hearing apple is doing in terms of working with some of these healthcare providers is now you're taking some of this consumer information that's stored in let's say health kit on your on your iphone and how do you hand over that information to a health care professional and now making you know critical decisions about your personal health and who who actually owns that data and that's that's pretty interesting for us but also at the same time it kind of ties into some of the things that we're doing in the enterprise which really ties into wearables and where things are going i'm running a couple interesting projects at ubc that ties into the mile arm band and i'll get a

chance to talk and talk about that in a little bit anyone else comments catherine yeah so we're pretty fortunate in that we're working with one of our partners that pioneered the use of of oauth in in the in the fintech industry and i think they're one of the first that did it so stripes version of oauth they're actually using oauth version 2 oauth2 um so they've actually branded it as stripe connect and it allows uh applications third-party applications such as control to securely access data on our merchant's behalf before stripe pioneered this in the financial services industry you'll see you know some of our competitors are still using this antiquated method of authori authorizing access by doing a

copy and paste of the api key and i'm sure some of you are familiar with uh having to do it through that antiquated model so much like you know hootsuite was able to build a better marketing management platform around facebook and twitter because facebook and twitter also used employed oauth around 2007. so the great thing for us is that through using oauth all of the merchant data is still managed by stripe so it really offsets a lot of the compliance and security burden from ourselves onto them so we're able to securely access that data um and unlike a a you know a money service where um a payments company that's actually managing the data we don't have to actually uh absorb any

of that compliance responsibility there's a certain amount we are still we rely on on stripe to to manage that handshake for us you know we are still managing people's emails a little bit of biographical information but a lot of that compliance uh overhead and burden is actually offset to um to stripe and as i mentioned we're seeing it become more standardized so paypal for instance recently just launched oauth so our application is going to be able to access our merchants data using this new newish secure protocol thanks catherine uh a question a comment um on the current topic or or another question uh speak loudly if it if it doesn't i think the acoustics are pretty

good in this room but if no one can hear you i'll repeat the question just to follow up on that catherine it sounds like you may have answered is i'm curious on the any money laundering at kyc side um when you're offsetting the responsibility for compliance is that feeding every transaction from stripe and paypal in these providers through fincen and fintrac or is it only under the conditions that kyc and aml is required like at certain trigger points such as you know ten thousand dollars or five thousand dollar transaction yeah so again all of that sort of burden is managed by by stripe so stripe and paypal they have got i can't even imagine the the weight

of the compliance button that they have to be responsible for so they're going to be managed and regulated by fintrac and securities law and by the suburns oxley act and pci compliance and a whole number of different things that have come into play around security and privacy related to the payments industry so the cool thing about us working with stripe is that our customers it's a prerequisite to even use our product that you have to be a stripe customer so stripes handling that vetting process on our behalf you can't actually do anything uh useful with our app unless you have a stripe account so that's kind of the first step is actually connecting your stripe account

so all of that kyc burden all of the um you know the the anti-money laundering acts and regulations happens on the stripe end we actually never have to see any aspect of that as a straight partner though however there is some onus of responsibility on us to report um suspicious activity um so you know one of the benefits of stripe is that it's very easy to get a merchant account uh but it's also one of their disadvantages they actually have quite a number of of fraudulent companies that sign up for a stripe account maybe they've created a dummy site saying that they're selling flowers or what have you but they're actually involved with a number of illicit black

market activities um when we see a company that uh you know they they say that they're selling custom dog leashes but they're doing 150 000 a day in volume it is our responsibility to say to stripe hey i think these guys aren't actually who they say they are they might be up to some illegal activity but again it's not our legal responsibility there's no regulatory body that's actually enforcing that on us um i just want to add to that because we're the opposite of that we we kind of have to we we've got certain rules and and as soon as you hit certain certain levels yeah you will get a phone call from from our team in the

philippines or from down in sydney or wherever uh in our offices um but typically from the from the philippines um they'll call you they'll verify that you've just submitted that money um you will go through the kyc kind of regulations um we have to do it all on our own backs because we are this sort of economic force in the world we've got the regulations we can't just say hey paypal you can deal with that that doesn't work for us right hey worldpay you can deal with that that doesn't work for us it doesn't work for them either right um so you've got a lovely situation um and and uh um it's really hard it's

really really hard to to be able to manage that and and some advice if you're going into this space is define your process and don't think that once your process is defined that that's the end of your process being being really secure because the nefarious characters in the world will will be on you every day trying to break the system and act in ways that the system shouldn't be used so um we're very active um from that perspective and and you'll probably see exactly the same behavior with people like airbnb and the such like as well because you know it's changing the way that economics works online as well other comments uh burnt yeah i i think it's worth remembering

that there are two fundamental approaches that you can take for security and concepts that you can have um one of those is i think what we're largely talking about here and the other one catherine i think you were hinting at and i just want to make sure that we get back to that one in a second approach number one is collect the information and then protect it very very carefully protected from people who shouldn't read it protect it from loss or or incorrectness and so on and so forth that can be a huge huge burden and i think the message you're hearing from all of us is be really careful about taking that on uh do it if you have to but there is

another approach and the the um the best way to summarize this is uh uh talk about my experience at mobio i was asked by some investors to step in as cfo you guys know that cfo has another name it's called mr no it's the guy who has to say no to an expanded shirts the person who has to ask the hard questions around the management table and what we found ourselves the situation we found ourselves security wise at mobio is that we were beholden to the new copper regulations in the united states the copper regulations are intended to protect consumers 13 and under and they have taken the exact opposite approach it's not know your customer it's don't

know your customer and that's very interesting because it is it is a mechanism and a thought process that's available to a lot of startups whether they know it or not if you choose not to collect the information you are not responsible for for protecting it you may not need everything that you could possibly collect and i think it's a perfectly reasonable thought process for you to go through to say should we even be collecting this you know do we want to be known as you know zuckerberg light collect absolutely everything we can and then have the thing either blow up on us or incur the enormous expenses that some of these organizations have to incur

there's a very very reasonable other path and that is to say what do we really need for us to do what we want to do with our service the value that we want to create and let's not collect anything extra and when it comes to financial information and so on and so forth this is a very very important thing i think catherine that's what you've largely done by going off as you've you've outsourced that process to someone else it gets more challenging if you're serving young consumers in the united states and you fall under copper because you are not allowed to collect that information period so you have to create your value and monetize that value

without knowing who that individual is and in fact without anyone being able to subpoena information from you and reverse engineering it and finding out who those consumers are so just think as technical people in this space how difficult that actually is these days when the device is collecting information and the carrier is collecting information and everybody's collecting information and you literally as the organization have to say no we will make sure that none of that ends up in our database anywhere in the case of copper you're legally not allowed to do that you have to prove potentially with a code review that you're not collecting any of that information so i think there's a broader

implication to that catherine i think you're kind of going down that road by saying let's only do what we actually have to do but i think it's worth all of us thinking about is do we really want to take on that burden of controlling that information or is there another way i i almost uh just just feel that we should get to the point where where we actually give people a choice to actually uh to actually own and use their own data even if even if you submit it to a system as well gerald lanier um a very famous guy in the vr world and a futurist around uh information the information economy uh talks about we

we've become uh we've become slaves of an information economy so we give all the data away and we sign away our rights but um he also talks about an alternate reality where potentially in the future we can actually have organizations that do do hold the data but they hold it for you it's your responsibility and you can monetize it and maybe they take a cut like under different rules and regulations as well so i love that point but i also think that there's a progression that every company needs to start thinking of around why can't i have a facebook account and facebook pay me for the use of my data right uh other questions on this topic or new

topic so in in in my background as an engineering manager uh the gentleman down here introduced that uh well it's a common term in the banking industry and financial industry know your customer uh i worked for hsbc as an engineering manager for many years um before my my current um gig with nrci rap and and i talk to a lot of companies and i usually ask them what what what are the trade-offs that need to be made in efficiency and how you are how your system authenticates your your customers um peter in fusion pipes company they're they're going with bluetooth bluetooth low emission where it's proximity based authentication um uh which is which is very leading edge

especially relevant in the medical and uh and military environments what's um what's what's the panel's feeling on how many hoops must be jumped through to authenticate a customer or or or an unknown uh person to an organization before you allow them in and start collecting data burn well i guess there's there's there's two questions there is is who are you jumping through the hoops for okay to use catherine to use your your service as an example i mean you're providing a certain level of value to the customer there's certain information that you need to provide that value but then stacked on top of that is a regulatory regime that also wants information for their own purposes

good bad or indifferent and the question is who really do you want to be the information gatherer for and understand that in certain businesses when you step into that line of business you're taking on a burden that that that doesn't add anything to the value of your product but you may just by virtue of being there have to collect uh information on behalf of the nsa or csis or or uh fin fin track or whoever it is you're doing it for so i think there's an additional question is is who are you who are you collecting it for uh you know i would i would be in favor of ideally collecting only the information you need to provide the

service uh your current and your future kind of imagined service and leave it at that and just be very very careful sometimes by adding one extra feature to your product you can expose yourself to uh the collection of information and the adherence to regulation that you had no idea and it could be just one little feature thanks so your view is gradual gradual collection of information over time depending on the longevity of the relationship between a company and their and their prospect or customer sure every every piece of information you collect is a responsibility that you bear and an opportunity that you have and the question is you know is the does the does the value

of the opportunity for yourself and the consumer outweigh the cost of that um my my own personal experience with a number of fintech startups that i advise and have been involved with is be very very careful with that i don't think you want to be spuriously collecting additional information especially personal information and financial information my general advice which doesn't apply in all cases is is collect what you need collect what you have to collect nothing else catherine agree or different perspective yeah i absolutely agree so i've got two perspectives on this so in online gaming um so we were deposited or we were handling a large volume of deposits on a daily basis so um

we were you know handling bats right before the super bowl and we could see deposits of 10 15 million dollars per day happening and our policy was to remove as much friction as possible we wanted to you know if you put a a three or four million dollar ad before the super bowl you want to be able to get sign ups as quickly as possible and with as little information uh requisite as possible however where we did then apply uh more of the the kyc rules was when it came to then the funds being deposited out or transferred out um in online gaming you are exposed to all sorts of different types of of fraud risk because

it's all digital there's large volumes of money that are being transferred about um so for instance we would consistently get hit by fraud rings that would set up a scheme that kind of looks like this so we'd have we were using all sorts of different fraud detection tools such as um ip sniffers and the ability to create a matrix of related computers using the machine ids but there's frauds that are so sophisticated they would go into an area they knew had never been sniffed out by any of the the the negative databases that were sharing information about uh fraudulent area areas or behaviors they would go into a warehouse and outskirts of berlin they'd set up

30 or 40 computers they'd be using a list of um credit cards stolen credit card numbers that they gotten off the black market and they'd be going in and they'd be depositing um you know fairly reasonable amounts of money say 300 400 500 um using stolen credit cards and then they would go into a poker room online poker and start deliberately losing to other players within that room the players they were losing to however had developed a profile at the site they actually had a bit of reputation they'd made some successful deposits they'd made some successful withdrawals um they're being with withdrawing funds to um an account that had been verified we'd actually done the kyc scrubs on it

and over a course of three or four hours they were able to effectively launder 50 60 70 100 000 plus using this fairly well concocted scheme by the time that the original card holders knew that their credit cards had been compromised and they had the series of fraudulent charges racked up against them that fraud ring would actually had decommissioned the whole operation packed it up and headed off to the new location to do the exact same thing so we started to actually having to get you know develop different algorithms and rules around how to even predict this behavior before it's it started but our policy remain the same remove as much friction as possible on

the actual deposit process when the money comes in get those accounts get people to sign up easily but when the funds start moving the other way that's when we started really locking things down thanks catherine okay we've reached the end of our time so i'd like to thank peter nick and catherine for for their time if you have questions for them they'll be around for next uh period of time just don't be shy come up and grab onto them and uh and ask them your question thank you very much

thank you very much

you've teased us with always attending our hacker meet us every month yeah

thanks

you