51:43

SUMMARY KEYWORDS

data, people, privacy, cameras, technology, twin, security, device, literally, smart cities, cities, traffic, access, talking, digital, smart, iot, absolutely, understand, intersection

SPEAKERS

Debbie Reynolds, Bill Pugh

Debbie Reynolds  00:00

Personal views and opinions expressed by our podcast guests are their own and are not legal advice or official statements by their organizations.

Hello, my name is Debbie Reynolds; they call me "The Data Diva". This is "The Data Diva" Talks Privacy podcast where we discuss Data Privacy issues with industry leaders around the world with information that businesses need to know now. I have a special guest on the show, Bill Pugh. He is the Co-Founder and Managing Partner of Smart Connections Consulting LLC. So he works in strategy and technology advisory and digital transformation in IoT Smart Cities, Smart Grid and the use of digital twin technology. Welcome.

Bill Pugh  00:51

Thank you. And thank you for having me. It's an honor. I follow all the things that you do and watch how you move in the whole privacy space. And I think it's awesome. So thanks for having me.

Debbie Reynolds  01:07

Well, thank you. Well, you're going to drop some knowledge for us on cyber in IT and stuff like that. And I'm really happy to have your quiet voice on this show. You bring a great, great radio voice.

Bill Pugh  01:26

Awesome. Yes, yeah.

Debbie Reynolds  01:30

Well, yeah, so we're connected on LinkedIn; I love your posts and the comments that you make; you stand out a lot to me because you really cut through a lot of the BS; I think that people sort of talk about so it is a kind of rainbow, a unicorn, like, look, this is what's happening. This is what we think about. And I feel like, I don't know, I guess I'm really attracted to people like that because I can tell that you lived, you have some real lived experience, right? It's a real-life experience that you can impart to people to really help them get from point A to point B without the fluffy talk.

Bill Pugh  02:11

Yes, yeah. Well, I mean, I think that it's extremely important to do that. And you're right. I mean, I've gone through the fire and probably still have the burn marks to prove it. I just don't; we don't make advancements by toeing the line; we really don't, right? I mean, we, and there is no one person that has all of the answers. So it's a community of us that share common ideas and weigh in on things, you know, to the best of our abilities, which is what I found, you know, really interesting about what you were doing, and it complements everything that I think that the rest of us are trying to do. So whether it be you know, a vertically integrated solution, such as, you know, traffic monitoring, where everyone kind of thinks, oh, they're watching me. And these are truly just detection cameras, or whether it's, you know, what? Well, I'll tell you one thing, what that data you're giving away in this microwave society today, my kids, they want to get an app. They're like, accept, accept, accept, accept. And I'm like, no, don't do that. So I kind of look at it, as you know, having gone through breaches, having gone through having my identity stolen, having gone through working with companies and building solutions, and then having to think about how we prevent those things going forward. I just think that it's a community's things that you do, things that I do, there's a number of other folks that I think, you know, do tremendous things as well. And I'm a student of technology across the board. You know, it's the continued learning that I think drives me to say some of the things that I say, irrespective of what others might think.

Debbie Reynolds  04:06

Yeah, of course, it is fascinating. And this is an area I work with as well, on the privacy side. I would love to know your trajectory in this area, and then also want to make a comment and what's your thoughts on this? So I feel like I tell people, I feel like cybersecurity needs like a PR campaign because people don't really understand it really well. So the analog to this is let's say someone says they're a doctor, and people are like oh, well what type of doctor right? We are cybersecurity; they think you do everything, right? And we know that that's not true. So tell me a little bit of your thoughts about that mismatch around how people think about cyber and what people do, and then how you ended up in kind of the Smart Cities, the Smart space, the IoT space.

Bill Pugh  05:06

So my background is I started in wireless point to point point to multipoint style companies like Harris, they were doing things and you know, from five gig up to 38 gig. So I mean, I started, you know, really doing hardware design for those radio systems. And, you know, I continued to always look for, you know, I shifted, you know, jobs from a design engineer to a project manager to working for a, you know, a chop house, you know, any anything that was going on with, how do you put the technology together, I wanted to understand the manufacturing process and everything. Once I felt like I had gathered, you know, a broad array of tools, that was right around the.com, boom era. And so startups were just going crazy. And I landed in the Smart Grid space with a company by the name of Silver Spring Networks. And they were one of, or actually, they were the first ipv6, you know, Smart Grid solution company. And for me, when they said, ipv6, I was like, oh, that's awesome. I mean, you get IPsec built into that. So I know that there's going to be security end to end, as long as it's on the transport side. I hung out there for a while; they'll be in a startup, they, you know, allowed me to wear different hats, and I built out the distribution automation line of business. So that was another step that I got to take and as well as working on the implementation of their ERP system. So it was just, you know, moving around in areas that you would not think you normally would jump into. And I was always looking for an opportunity for a challenge. I left them right before they went public. And I joined a street lighting company; they were basically retrofitting streetlights. And had the idea that hey, well, you know, we can use this for other things. So this was right, circa 2010, 2011. Where, you know, they were doing this and this company was Sensity Systems. And I got to, you know, I wanted to see, you know, what I did over at Silver Spring. Was that lightning in a bottle? Or did I really have something that, you know, that kind of pushed the envelope and would address things in a different fashion? So we did and, you know, built out, you know, parking solutions, and my other monitoring solution, follow me lighting, and a lot of the things that you hear in terms of the applications for, for smart cities, they were acquired by Verizon. And then I kind of just hung out for a while, stayed at home playing video games and everything like that, you know, just taking downtime until my wife was like, you know, you're not done. So you need to figure something out. And that was where I said, you know, I kind of know Smart Grid space, I kind of know, Smart City space. And I'm like, and the biggest gap that I saw at that time was cities, were being inundated by OEMs, OEMs walk in, they're like, what's your problem. And I didn't have to be that I figured I said, I can sit, I can straddle the fence, and literally help the cities understand where the gaps are and what they needed to do currently with their existing data, as opposed to generating new data, and trying to gain insights from that, like your current data, can be used. And that was the premise that Smart Cities was kind of, you know, going after, in the first place, cities had a lot of data and they didn't know what to do with it. The end of that was Jonathan Reichenthal. He and I met at a conference. And he told me, you know, we kind of hit it off, we, you know, connected well, and he said, hey, you know, we're doing this thing over in Palo Alto, would you be interested? And I was like, sure, what is it? And it was a traffic modernization exercise. And, you know, I asked a bunch of questions about it. And, and it came in that you know, what we're going to do this whole thing about opening up the data to app developers. We got to look at that. It was a challenge. Traffic data is extremely fast, and it's a lot of it; I think for 120 intersections, they had like four terabytes of data per day. And if you're going to open this data and let app developers get it, they're not going to know what to do with it; there's no, there's no context to that database voltages. And so he gave me my first shot. And that is where I think I built the first digital twin, for traffic, you know, have an ecosystem of partners, I have software developers that I work with, and, and we, we put the whole thing together. And he saw it and was blown away. took that off. Now, I say that to say that a lot of education took place in terms of what digital twins were. And now there's a proliferation of, of digital twins, as you well know, all the way from the buildings to, you know, 3d models and everything of that nature. But we were, we were really focused on real-time streaming data and the insights that can be gained from that. And Jonathan kind of helped launch that in a real way. So I went from one to five to 20 cities over the course of one year. And I'll pause here and say digital twins in and of themselves, whenever they're out in the built environment, are an attack surface. Right, they don't natively have security built in. So they are indeed an attack surface. Especially if you're looking at distributed systems. So that then drove me into all right, I need to understand this whole cybersecurity thing and where the threats are. And you know, what are the modern approaches? What are the old approaches? And bridging?

Debbie Reynolds  11:56

Yeah, excellent. I would love for you to describe and let people know I know what digital twin is. And actually, there are so many different industries. So digital twin and your IoT are very different. Like, there's a digital twin and identity as well, that's totally different. But explain to people what a digital twin is in IoT.

Bill Pugh  12:17

So the way that I've kind of explained it is and everyone kind of says, well it's a virtual representation of either a physical object device network or what have you, which, which in essence is true, it you know, the differences are you have CAD drawings that are 3d models. And that is a digital twin. On a different level, you have layers, and I've kind of started to say you have layers now, because what I, when I say real-time streaming data as the digital twin, then I literally show a replicate of, or we'll say a device twin, of a traffic light, or controller, where the data is kind of landing. And then we visualize that in such a way. So imagine now that you can literally see any given intersection and understand when the lights are going to change. The twin side of it will allow you to perform a what-if analysis so the data is still flowing through the living management model. And I can take a replica of that and continue to receive that data but not impact anything on the built environment side. So I can run a lot of what-if analysis, an example would be that while I'm taking the traffic data, I can also take the environmental data, and I can start to align these to a corridor and demonstrate from a baseline what the Co2 emissions were. And then as traffic improved, what the Co2 emissions are now, and that is probably one of the best ways that I can demonstrate what you know, what I do with digital twins. Another one I will say is there is no single digital twin that does it all. We're all still figuring out how do you layer all of this together to actually get, you know, the real, full benefit of all of that. And when I started there was no digital twin consortium; there was no Industrial Internet of Things consortium that was addressing, you know, how to do digital twins or how to, what digital twins mean and everything like that. So I think it's great. I think it's great information sharing. But there's a bunch of us, Rob Tiffany's, another one that has been doing this stuff for an awfully long time. And, you know, I think it's an ever-evolving thing. thing, the more we learn about data and how data moves and where it needs to go, and who has, you know, the ability to get to it, the more that we have to secure that. And an example would be if an intersection is talking to another intersection, who has access to that data? How is that data authenticated? And how frequently is it authenticated to start making localized decisions? So that's why I say, you know, digital twins in and of themselves are attack surfaces.

Debbie Reynolds  15:32

Absolutely. That's a great description. It's like SimCity basically?

Bill Pugh  15:40

Yeah, exactly.

Debbie Reynolds  15:42

Well, let's go deep into IoT for especially a Smart City. So I think people understand that there's technology in things like traffic lights, right, just make things run and stuff like that. I think what people don't understand is that there's more happening on that pole than you think. There's more stuff to that, that cities are collecting. Because the technology is getting so much more advanced, in addition to managing the technology around how people move around cities, these technologies can also collect personally identifiable information of people, right? So let's say people walking around the street; maybe there is a solution for crowd management where they have the capability to do facial recognition and different things. So, tell me a little bit about that part of Smart Cities and IoT.

Bill Pugh  16:47

So, I think that's a good example. So I think there were, there's a bit of confusion in terms of whenever someone sees a camera at an intersection, they'll see that, and they'll say, oh, well, you know, that's a, you know, that's a speed camera, you know, you're going to go through there. And if you're speeding, it's going to do license plate recognition. Not necessarily; those are more or less what you call detection cameras. So they now, they've become a lot smarter over time, but their main purpose is to replace what's known as ground loops. So ground loops are, you know, they dig up the ground, and they put these inductive loops in the ground, and they're able to count the vehicles as they cross an intersection. Over time, what known as green wave, and, you know, there's a number of names associated with it, they wanted to reduce the number of fatalities at these intersections, so they needed more information. Well, those cameras now are able to give them, that they can tell now the velocity of a vehicle, whether or not a vehicle just left the intersection, time to arrival, and all of these other things, but what they cannot and do not, in a lot of instances, do the whole, you know, well, we know that car, we saw that car over here. And now we're correlating that to the direction that is going now. And a lot of that is governed by the City Council. So whenever they go out, and they say, we're going to put this technology in the field, and in a lot of instances, you know, if there's an element of privacy associated with it, the City Council has to approve it. The cameras that actually monitor speed now, part of that is they have to let you know; if there are cameras involved, they got to put up those signs and say, you know, hey, you know, cameras are over here. And this is the purpose that they're there for. But I think now I mean, tamped down in terms of the data that they can collect. In North America, I think it's far more strict than it is, of course, in Europe. And Europe, if I'm not mistaken, there's one camera per 11 people. And and they know that it's being watched; they know objects are being detected and things of that nature. But there's, you know, just because that we have these quote-unquote policies and bases lined up in the cities does not mean that they're being followed. No, there are indeed cameras that are, if they're in the city, they're governed by the city; if they're on private property, that's something entirely different. So are they identifying vehicles? In a lot of instances, yes, they are. Is there license plate recognition? If you see that camera down low? Yes, it is. And then they're capturing that data and what the question that we need to be asking is, what are they doing with that data? How long are they keeping that data? And where else are they sharing that data? And, you know, nine times out of 10. People don't ask those questions. They don't care; they want to get, they want access to where they want to go. If you're going to capture my license plate, go right ahead and do it. But I think the biggest piece of IoT equipment that is monitored that you don't think about is your cell phone. You know, there are accounts all over the place. There are companies that you know that they make their business by monitoring cell phones; now, they'll say they'll anonymize the data. And you know, they won't, you know, we don't know who it is. I'm sorry, if you have a MAC address, you have an IMEI. They know who it is. It's not that difficult.

Debbie Reynolds  20:52

It's accurate. Exactly. Oh, wow. So you had talked, I want to talk a little bit about I guess the Sci-Fi elements, you probably laugh at this, when you see movies, when you're talking with a, you know, they have the technology up on the screen, and they're like correlating the stuff in real-time. You know, it's just not really like that, right? It's like, it's not quite like that. But we are seeing a lot more movement in fusion, where, for example, a lot of things that were kind of military-grade technology is kind of coming into commercial spaces and city spaces, where they're trying to create technologies that will put, you know, collect all these little disparate areas of data and put it together in a way that people can make those types of Minority Report, you know, we're not there yet. But tell me a little bit about that area because I feel that's like really emerging.

Bill Pugh  21:57

Yeah, so that's the whole AR piece of everything, which, you know, again, this is the problem that I have across the board is that you know, there are technologies out there. And in a number of instances, we address a problem tech leading, as opposed to okay, so what is the problem we're trying to solve? That's the first question. And then what are the use cases around that? I mean, I've always been a huge proponent of Smart City isn't something that happens to you; it should be something that happens for you. Right? And, and so, you know, all of the neat things that we had are being demonstrated in terms of, you know, for example, some of Smart Glasses, and they can literally make a phone call to the ops center. And the ops center says, okay, I see you're looking at that device right now. And they can pop up the instructions for what you need to do to resolve that problem. That technology does exist. Is it where it needs to be at? No, not at all. But the future of it is, is that I mean, now, is that the metaverse? No, I don't know, someone's going to say, well, that's the beginning of it. Nah, no, it's not. It's an extension of having, you know before we used to have to go out and we still have schematics and you actually looked at things and then you'd have to follow the schematics and find out that you had the down rev version, and then all of a sudden, it got tied to a tablet. And now you have a tablet with Internet access. And you can make sure that it's the latest, and this is just the next progression where you can have, you know, someone remotely looking at things. I mean, you know, I still say that we've really got to tie it to the real use case and the benefit that's going to be provided. But the tech enablement, again, is the easy part. From my perspective. The difficult part is if I'm out there, and someone has dropped their, you know, someone has dropped their glasses, they misplaced their glasses, and I pick these glasses up, can I do what they were doing? Right? Can I access that network? If I can access that network? That's where for me it gets to be a conversation around all right; if a device is trying to make a call, it should be authenticated, right? Not once but continuously authenticated, right? You know you get access. All right now, where are you? What are you doing? You know, are you still the same person that had this before? And you know, and then by role-based access, you cannot get to certain information. You're just not allowed to. And I think it's the same thing for these other devices that are coming on board. So the whole data fusion thing is a big deal to me because right now, when we talk about edge computing and everything like that, we're talking about devices that are sitting at the edge that can talk to a lot a multitude of other devices, irrespective of the transport, right, the data is aggregated there. Now, I think that there has to be an underlying notion of, you know, if a sensor is trying to send data to this edge device, there needs to be an exchange of authentication certificates and what have you. And even before that device comes onto the network, it's, you know, who are you? What is your role? What are you What data are you going to be looking for? Let me check to make sure that you're authorized to actually do all of that. So I'm going to put you on pause until I verify that you are who you are. And I feel like every single sensor ought to have that level of authentication and secure access.

Debbie Reynolds  26:02

I agree with that. I agree with it. I'd love to talk about something you pointed out that I wrote down, and I would love for you to chat about the connection between IoT and IT. Or maybe the disconnect there, right? It's like people want the fancy, cool, flying robot thing; they don't want to do the basic stuff. So what are your thoughts?

Bill Pugh  26:30

That is part of the problem. All right. So pre-pandemic, in the Smart City Initiative that was being driven was nine times out of 10 being driven on the OT side, right? So outside of the IT environment of the city. Now, you're going out, and you're putting out all of these devices, you're saying, you know, we're going to get all of this data, we're going to pull this stuff back, alerts, events, monitoring, management, all of that data. It goes where, I mean, if your IT environment, if your foundation on the IT side has not been solved, then you're only compounding your exposure by continually putting out these devices. So I have a tendency to start on the inside; it's not sexy or anything like that. But we've got to get the inside to the point where one, you want to do that data fusion; you got to have a way to securely share that data. All right, so now you got to get these vertically integrated organizations kind of focused on, you know, again, I'll use the traffic situation; if traffic has insights that would be beneficial to me as sustainability, then I want to make sure that I get access to that data. And we got to figure out how do you know what data do you want. What data sets? How frequently do you want that data? Where do you want it dropped off and everything like that? You've got to fix the inside before you can actually drive a foundation for the outside, which is where, you know, you look at you know, if someone hacks on the outside, do they have access to the inside now? And how are you stopping that? So I see this quite a bit, where you'll have a solution company, they'll come in, they'll say, you know, look, we've got this tremendous edge-based camera. And, you know, we segregate the video, and we only bring back the metadata. And now you have all of this tremendous insight. And, okay, where do you bring it back to? Is it a video management system? If you're bringing it back? No, no, it's in the cloud. Okay. All right. Now, that's a whole other conversation. Right?

Debbie Reynolds  28:08

Exactly.

Bill Pugh  28:58

What security and don't tell me about your security framework; I know your model, the security model, because any standard is great. Any framework is great. Implementation can expose things you didn't intend on. So I think that you know, you've got to have for Smart Cities to actually pick up and take off, they now have the opportunity with the infrastructure bill, to really fix things end to end. And we have to, we had to put a binder on what end to end means to me, end to end is that sensor all the way over to the end person.

Debbie Reynolds  29:40

As you're talking about this, this is so inspiring. So I don't know about you. So when I read some of these proposals for Smart Cities, almost all the time, there is talk of frameworks, right? And we do these you know, we use this framework, we do whatever. Hardly anybody talks about the end part. So they've never talked about, so what about data retention? Like they never talked about that? They never, you know, if you press them for that, they don't really ask for that question. And to me, that's kind of where your biggest risk is kind of near that in part.

Bill Pugh  30:20

Yeah. And I mean, I just think it's the little things right? You know, well, it was just an email that was leaked out, okay? That's all just an email. It wasn't meant to go, no, that's, that's exposure, and you have to do something about that. It's like, you have to do something about that immediately. So for years end to end. And that makes the job quite a bit more difficult. Because, again, if you have locked down on your IT side, and you have rules, and you have roles, and you have, you know, continuous authentication, and you have immutability, and all these other, these are the same things that you push out to the, to the field. I mean, that's just how you do things. And don't, you know, don't tell me about your encryption. That's not security, right? encrypting the data, yeah, that's great. We'll use the same encryption that the banks do. It's not what I'm talking about.

Debbie Reynolds  31:28

Right, exactly.

Bill Pugh  31:29

Talk to me about the time, the first time that I power this sensor; what's it going to do? What device is it going to connect to? Where are the certificates? Is there hardware security, right? Because a number of these things are sitting in NEMA enclosures and things of that nature? Is there hardware security? Is there a tamper? Where are the alerts go? How do I get the alerts? Who acts on the alerts? How I mean, there's just so many just basic things that I think you have to you know, kind of think about and it has to be end to end. 

Debbie Reynolds  32:13

Right.

Bill Pugh  32:13

And I just don't think we're there yet.

Debbie Reynolds  32:15

Yeah. And then also, who serves up the data? And whose responsibility is it? You know what I'm saying? So the person implementing it, you know, who is it? Are you going to have a joint responsibility? Is it all on the municipality? You know, how are you writing your service contracts? And who's responsible? For what?

Bill Pugh  32:35

Yes, right along with their SLAs? Right. So I mean, you know, if a device is found to be tampered with, or rogue or, you know, anything like that, is it quarantined? How is it quarantined? You know, there's a number of things that I think that from a security perspective, have to be addressed. And so I'm a huge proponent of zero trust until you prove yourself.

Debbie Reynolds  33:10

Right. Well, I saw a statistic not long ago, that said that IoT devices are attacked within minutes of being put on a network, right? So you know, they are a vulnerability that people need to deal with, especially if their network isn't up to snuff. So their network has these open gaps and holes, and IoT devices can help expose that in a bad way for companies.

Bill Pugh  33:44

Yes, I think that Line Jansen just did a post recently, when she was at RSA, and said, hey, there's a vulnerability right here. And I was like, I was like, wow, that you're at RSA, you find a vulnerability. And that was an ultimate teaching moment, right there. The ultimate teaching moment, I was like, that's just perfect. It's, you know, and I think that literally means, it's almost like, I would use that as a, just a wide open use case for why, you know, what minimal security would have been x would have prevented these things. It's a perfect use of best practices.

Debbie Reynolds  34:42

Absolutely. And then too, I think consumers you know, we're talking about Smart Cities spaces, you know, they may see something that they can literally buy off the Internet, right? Go to Amazon and buy this thing. You plug it in and do all types of crazy buck wild things you have no idea about. I tell people well, a lot of these IoT devices it's like computers without screens.

Bill Pugh  35:04

That's it. It really is. I mean, a lot of hobbyists use Raspberry Pis. Well, you know, if they used a Raspberry Pi, and they said, I think I got a product that Raspberry Pi made its way out into the field. And, I mean, most cities are not going to say, hey, you know, we want to look at that and see exactly what that is. You know, we want to understand the device, we understand what, you know, the operating system you're running there. What is, you know, what version? Bigger than that how do you deal with critical vulnerability exposure? You know, who's managing that for you? All, I mean, there's, it just goes on and on. And just as I was saying that I was like, oh, yeah, that's another reason why I'm huge on SBOM. They just, you know, there's just things that are, that are transformational and necessary in order for us to do some of these more advanced things that we're talking about. But it literally comes full circle, I have this technology that I want to use for these applications, and this is why it's good. And then you know, you go okay, well, your transport layers, what, how are your handshakes done. And certain technologies literally have a transport that by nature is not as strong from a security perspective as others. Wi-Fi itself is just not. it's just not as strong, it's as, and I think your network at the end of the day is only as strong as your weakest link. And so, in some instances, you know, you've got to look at, you know, what level of security are you using? How are you doing that? That's why I think it's important for cities, which right now, I think cities have a technology gap in terms of people, the skill set that's there. So it's tough for them to get a solution that's jumping them from, you know, Windows seven, up to, you know, a full Linux operating system that isn't running on a Windows box. And so there's a number of things that you really have to address there. But I think that security by design is the only way because in the past, it's only been an afterthought.

Debbie Reynolds  37:49

Yeah. How do you think privacy is ending up playing in the space? I feel like, in my view, the way people used to think about it, it's like, oh, well, the stuff that we're doing is not collecting personally identifiable information. So it doesn't really matter about privacy, but we know that that's not true. And we know that these technologies are getting more advanced. So the more advanced technologies are, the more data they collect, you know, Smart Cities, people live in cities. So it should be more people-centric; it should be to help people at home, who live in cities, but what are your thoughts about privacy in the space?

Bill Pugh  38:28

I think it's sorely lacking. I also think that the fear around, so the lack of education drives the fear. So if you know, if citizens feel as though their privacy is invaded, if you're taking my identifiable information, personally identifiable information, and you're doing something with it that I don't know about, that, to me, is the crux of it. So there's a level of education that has to happen, and it needs to be a continuous thing. It's, you know, privacy is, and attacks and all of these other things are continuing to evolve. So education has to continue to evolve. And I feel like that's where you start in the city is with the people for the people, and allow them to have a voice in really what's going on. So you need to reduce and ultimately eliminate that fear factor before we're able to actually move forward into that point. That's one of the reasons why a number of cities will not use cameras in the city. Like no cameras. We're not going to do that. Then if we don't do that we don't have that problem. You have the data still being picked up in different ways. You didn't solve that problem. You solved the problem of being able to see something at that particular time, which is still beneficial, especially if you're looking if your traffic group has a Vision Zero initiative, having cameras is great because you can literally understand what happened at any given time. But I think that privacy is almost lagging behind security. Because, you know, I think that people don't fully understand the gravity of that, you know, they associate it with, oh, well, you know, I was just literally I had my phone sitting here, and I was talking, and then when I go to my, you know, Facebook, or Instagram feed or any of that stuff, the same thing that I was just talking about shows up there. Oh, it's just the algorithm? No, that's a privacy thing, right? It's not that or, you know, from even, you know, because this whole proliferation of strong and really strong passwords, you know, Google's kind of saying, Well, look, don't worry about that we'll take care of your single sign-on, just sign on with you. Well, you just gave them all of that there, right? And we're not doing anything with it, and we're really not doing anything. It's like, no, this is 100% of the battle for the data.

Debbie Reynolds  41:19

Absolutely. I know. And it's like consent is actually the whole thing about consent. So because when you consent to something, a lot of companies want you to consent because you can consent to things that aren't in your best interest.

Bill Pugh  41:34

Absolutely. But that's reading the fine print, right? It's like, well, you know, if you want this, why do you, why does any app want access to all of my contacts? Right? No, right? So it's like, why do you want access to my microphone? Why do you want access to my camera? Why do you want access to this and that and I'm like, wow, there's, you know, we don't even look at, if you looked at the data, if you just open up one app, and went through and did whatever it was that you're going to do. And if it included, if that application included you using photos? Where were you at? You're giving up all of your information. So this is the application I'm using; I'm giving you pictures of a place where I was at this time. And you signed up for that. Right?

Debbie Reynolds  42:33

Exactly.

Bill Pugh  42:35

I think it's not about you know, well, if you have nothing to hide, it has nothing to do with that. No, no. It's my data. And if I'm doing something like that, literally, it should be between me and that service.

Debbie Reynolds  42:49

That's right.

Bill Pugh  42:52

And that's it.

Debbie Reynolds  42:53

That's right. Common sense is what you call it. If it were your wish, Bill, for anything in the world around privacy or security in any realm, including, you know, Smart Cities, what would be your wish?

Bill Pugh  43:15

You know, to be honest, I think my wish would be that there was true equity, across the board, that there was true equity, that there was, you know, there was no such thing as underserved communities. So, you know, I'm not saying that you need to give, you need to give these services to underserved communities and never, you know, understand the business aspect of it. But I think it needs to be rethought if it were anything that I could have, it would be true equity, true access to everyone, for everyone. And you know you didn't have to worry about your data being jacked in and used elsewhere, your identity being stolen and used for nefarious purposes. You know, you really did not have that worry because I think if we had that, then the rest of these markets and opportunities would just blossom and grow.

Debbie Reynolds  44:29

If people feel like they're really getting a benefit from something, they'll be happy to share data. But I think the issue is if I give it to you, you shouldn't give it to someone else. Or you know, you shouldn't use it in some other way other than what I said you should use it for.

Bill Pugh  44:48

Well, yeah. And I mean, you know, I think it would also do away with the need to have these third parties, right, because that's the other thing is that people don't they don't understand when you're using these applications, there's a host of third parties that are sitting under there. So if I don't purchase the full version of something, then I'm going to get all these advertisements and everything like that because that's the deal that they made. But as long as I'm getting those advertisements, these advertisements have access to my data as well. It's weird. I mean, the way that I look at it is like, yeah, and if I pay for it, then you just turned off some of them. Right? Because there's no way that you're going to turn off all of it. So now I'm paying you, you're taking my data, I don't get to do what I want to do. And that I yeah, I just think that if we made it equitable, made, and did it for the people, then, you know, one of the things that I've said before is that, it's not always about how do you monetize that data. I hear that question so much. And it's if I give you a way to improve your operational efficiency. What is that worth to you? Right, as a city, municipality, or any other company, if you have now a way to pump, I just saved myself, you know, $10, $15 or $20 million a year by not doing things the way that you did them in the past and letting the data and the insights and the data fusion and everything else like that work inside of my organization. Now, I can take this money and reinvest and improve and continue to improve in other areas. If you do this across the board and make this, you know, an equitable thing for society as a whole. There's a lot of good that comes out of that people become less worried, and less scared, and you will then get the data. It's about building that trust. Right now the citizens have zero trust in what's going on. So they're like, no, you know, you're just trying to get, you're just trying to take something from me. And you're just trying to make it, you know, you're just trying to make a dime off of me.

Debbie Reynolds  47:17

Right. Yeah, so we're backwards. So right now we have citizens who have zero trust, but we want networks that have zero trust, right?

Bill Pugh  47:26

Exactly. Exactly. It's the network should really be built that way. And, you know, and I mean, and I think that instead of, I think the cities need to start looking at themselves as the platform. Everyone else is a player. Right? A participant.

Debbie Reynolds  47:46

Cool. Wow, this has been great. Thank you so much. These are really great insights. I love talking about Smart Cities and stuff. So I'm sure we'll be able to find ways we could possibly collaborate this be fun.

Bill Pugh  48:00

Absolutely, absolutely. It's been such a blast. It's all again; it's always good. You know, I still think that you know, we're still in the infancy across the board in so many different ways. You know, I think I think one of the other issues that we have is we, you know, sure there's talk and there are monitors and everything Smart City, Smart Grid, Smart Region, you know, I mean, regionality is hugely important. Absolutely. I don't see how we get there. Because everything is so fragmented, right? So you can only do things in a little, you know, in a little step-by-step fashion. But there are other challenges that I think encumber the progress. You know, one of the things that I'm faced with, on a regular basis is I get a new city contract, or I get a new city agreement, and it's only as good as the elected officials that are there.

Debbie Reynolds  49:12

Oh, absolutely. Right.

Bill Pugh  49:13

If they're gone, I'm back to square one.

Debbie Reynolds  49:16

Right. Yeah. They start over again.

Bill Pugh  49:18

Yeah. Yes. So there are so many dynamics that are tied there. And you know, it's just interesting. So I'll be very interested to see how all the rest of how the rest of 22 plays out and going into 23. You know, how we not only start to really take a lot of the cybersecurity and privacy aspect of it seriously. It does not have to impede the progress of anything else. It needs to be a part of it. And it needs I think it'll be written in that way. You know, just as you start to see new RFPs come out and how everyone's thinking about these Smart Communities. Smart Communities is another one that I've seen, especially out here in Texas. You know, there are three or four communities that they're building from the ground up that are walkable and all of that and they're looking to be self-sufficient across the board. And I'm like if you're doing that, now you're talking about, you know, who the citizens are that live in that community. Right, and whether they should be there or not. Your privacy policy got to be very, very strong.

Debbie Reynolds  50:40

Exactly. Absolutely, absolutely. Well, I would love to chat with you more at some point. I think this is fascinating. But thank you so much for being on the show. This is amazing. 

Bill Pugh  50:55

Thanks for having me.