opinion – Page 9 – Hello, I'm DK

Open Letter To Air New Zealand | Designing For Privacy First

Would you give an airline and their partners access to all your phones images and files?

Air New Zealand has the best customer flight experience I’ve ever experienced during my global travels. I feel very lucky to live in the same country where I fly often on this superior airline.

However, at the end of last year, a recent change to their very useful little smartphone app requesting a new permission created a small but massive privacy issue for its users.

The new update requests access to all images and files on my mobile (see opposite). Why?

Well, I tweeted asking for clarification and the reason: access will give me the user an opportunity to add an avatar and / or change background images of destinations (although the app will never see anything but those images selected).

So that’s full access to a users images and files on a users phone for a little customisation.

That’s like giving your house keys to a friend who has agreed to hang a painting for you. Although in doing you have to agree they never return your keys. They state it’s ok as they only will ever go in and do what they promised.

You kind of trust them although they have the keys to your home.

They can share these keys at any time with other people.

You won’t ever know unless you ask them.

That’s what Air NZ just did.

Of course this is probably a limitation of the software and operating system they are designing in although certainly not something to just accept without further exploration.

Lots of other tweets followed after my initial queries above which then switched over to Twitter DM discussion (which you can download and read yourself here) during which time I was given the email address of the Privacy Office to pursue further.

Here’s the questions (in bold) I posed with the airlines responses (in italic):

1. It’s been stated a couple of times that the app permission request ONLY sees the single image file used to create a new avatar not all files which is stated in the permission update. Please would you evidence this via a video or software workflow please (bearing in mind I’m not a coder or app developer).

The Air New Zealand android app does not access a user’s photos without their knowledge, and does not access a user’s gallery folder. In order for a photo to be uploaded to the Air New Zealand android app, the image must be saved locally within the app on a user’s device. The process required to save the image locally is declared by the Google Play Store as an ‘Access to photos’ permission, hence why the permission is sought during the update process.

The online team and the Privacy Office have confirmed that the image is only saved on a user’s device, and Air New Zealand has no access to user’s photos (including the image chosen by a user)

Due to the commercially sensitive nature of the information, Air New Zealand is unable to provide the position stated with a video or software workflow. We hope the detailed explanation provided by Air New Zealand in this, and your earlier correspondence suffice in covering your query.

2. In terms of future privacy, please legally confirm there is no future app development plans which will enable said app to access more than the stated one file as such action taken it would directly contravene the previously stated privacy policy (as described in previous conversation the danger here is that if users accept this permission without such assurances then it would open up future erosion of privacy without the need for future permission to be sought).

We are unable to confirm there will be no future app development, as our Privacy Policy is subject to change. Air New Zealand complies with applicable Privacy Laws, under New Zealand Privacy laws, any personal information collected by Air New Zealand can only be used for the purpose for which it was collected. Air New Zealand would therefore be required to notify customers and seek their consent if the purpose for which the Air NZ app requires access to the photos changed. Please refer to clause 13 of our Privacy Policy (below).

We will make changes to this Privacy Policy from time to time. When we make changes, we will update the Privacy Policy on our websites. We will also specify the date of the last update.

3. It was mentioned access to all information held by AirNZ could be gained although there’s no specific route for this. Would you please outline via a simple graphical workflow of how to gain this information plus the timelines involved (again, I have requested it through the means described in previous conversation and at time of writing still no response)?

The information for how to access your personal information can be found in clauses 9 and 10 of the Air New Zealand Privacy Policy found here. As per the Privacy Policy, a personal information request can be made by contacting Air New Zealand, our staff have been trained on dealing with personal information requests. Your personal information request acknowledgement should be sent to you within 20 working days as is stated in the Privacy Act. We endeavour to provide all requested information as soon as practicably possible.

We hope we have satisfied your query by providing an explanation of the process and timeframes. We are unable to provide a workflow on this process as we have referred you to our Privacy Policy which is where Air New Zealand provides information on how to make a request.

I can appreciate the intellectual property nature of some of the software stuff and hesitation in illustrating what’s happening openly, however, the option still remains that at anytime the app could change it’s function and then access the files / photos as no further permission would be needed or requested from its users (as that has been agreed to). Again, a future scenario which is probably not intentional, however, with foresight this should become obvious in terms of the privacy issue it’s creating.

As an ironic aside, the above response from the airline wasn’t signed and / or named. I requested a name so I could direct my response personally but they stated: “The Privacy Office email is a shared inbox, we do not disclose the names of individuals.”

As a further aside, I requested all information that the airline has on me on 19 December 2016 although at the time of writing this blog post I have yet to receive anything.

There’s is no actual process for this. There are statements in the Privacy Policy outlining users can request this information but no specific pathway. I ended up using a general customer contact form and it’s obvious that here’s a very simple area and opportunity for the airline to improve upon.

I finally got the names of those in charge of Privacy which are the GM Governance, Risk and Compliance and the Senior Manager Data Protection (thanks public affairs office as privacy office wouldn’t share). Can imagine they are good humans and interested in responding in the comments about the above and looking forward to them doing so.

So for any Air NZ customers reading this: did you allow the app update and think about the above? Did you think about the consequences and others I haven’t thought about? Would you like the options to roll back the update if it was granted?

UPDATE

Just before making this blog post live today I checked the update and permission request again on my mobile.

As you can see from opposite it seems someone else also challenged them about the above in the app comments.

Furthermore, it appears the airline has admitted it was a fault plus rolled back the permission requests.

Fantastic news and a wonderful surprise.

Obviously, there’s been a great amount of energy expended on all those tweets, conversations, emails (from myself and the staff at Air NZ) not to mention the crafting of this blog post, however, it’s so important to keep asking these types of questions related to personal privacy of companies with whom are requesting more and more data from us.

At the time of posting no-one has gotten back in touch with me personally to cite this mistake and reversal of requested permissions.

*all of the above related to using Android.

UPDATE 19.2.17

Had a personal email response from the GM Governance, Risk and Compliance, apologetic as to the delay in the airline sending through my requested data (it’s now two months since the original request). Someone else from the Privacy Office then got in touch requesting lots of data already held by them via my Koru membership. They also requested I email them a scanned copy of an ID or mail it.

The above citation for extra information is not anywhere online or explained as a process which a user has to go through. The data the airline already holds is enough to qualify the request.

Obviously, I welcome any instances where clarification of identity is needed to combat fraud, however, actions which undermine personal privacy should always be refused. I responded stating this and also offering two solutions: the first to show my ID to any of their colleagues when I fly for validation and then for that person to send an email or call any person to qualify it, or to take a phone call to answer any personal identifiable information held by them.

Still waiting on a response.

Am hoping also my pro bono offer of assisting them in the human centred design approach of them reimagining their current data request process will be taken up. Truly keen to assist in making this airline a fully rounded excellent company.

Also received the following response from Senior Manager – External Communications | Group Communications:

“Thank you for getting in touch with your queries around the photo permissions on our android app. Our developers have been working on an update to support the ‘avatar’ functionality without the need for the user to provide access to their files/photos and, as you may be aware, a new version of the android app (v 3.19) was released early this month. Installs of the updated version, or any new installs, will ensure that the user’s permissions will be updated and it will no longer request access to their files/photos.

Please be assured despite the relatively broad permissions with respect to photos on the app previously it was never our intention to collect any personal information from the files or photos on our customer’s phones and we certainly didn’t do so.

We take privacy very seriously and privacy is designed into all of our systems that collect, process or store our customers’ personal information.”

Good to have the reversal of the app design and it’s questionable permission requests validated.

Would be great to know if the decision was due to internal work on road mapping and realising it’s impact or users asking questions like myself and others via Twitter / app comments / other avenues (or maybe a bit of both)? Would also question if this case has created a new thinking about feeding back to those who have raised points which are now resolved (as again, I didn’t get any personal responses but found out of the changes after my own research)?

Don’t want to diminish the decision here, more keen to celebrate the impact of procedures which are at work here.

Brands struggle with these things. Of reversing decisions. Of getting things wrong.

We should celebrate the new decisions and actions which rectify mistakes. Show gratitude and humanise the instances (and encourage similar language from people representing the organisations). Because every company, no matter how large or small, are built and moulded by infallible and glorious humans.

Well done Air NZ for fixing an error in their app design. Looking forward to seeing the same rigour and simplicity applied to the personal data information request.

UPDATE 21.2.17

Got confirmed with a phone call I am who I am so hopefully the personal data request will be put through and all information received in due course.

UPDATE 22.2.17

Got my personal data via email from the privacy office. Lots to wade through although there’s nothing about app use.

Therefore, am wondering is there no way of knowing what data the airline is gathering through the mobile app from users OR maybe that data is not held by the airline and they don’t have to share it as part of the Privacy Policy?

2016 Darkens | 2017 Lightens

So here’s to another year to learn from.

A chance to reflect and build on the kindness and compassion already shared. To understand that to leave this world better than we found it is one of the better reasons to live by.

Even though it feels like 2016 is closing out with a general feeling of unease and darkness with a lot to be scared and sad about, just remember the simple power we all have in making it a fantastically light or shitty day for someone else (and focus on the former please).

My modest efforts of blogging this year produced the following:

See you in 2017 you lovely humans!

Collidering On | Refocussing On The Creative Purpose

Crafting creative collisions elsewhere.

Tomorrow is my last day managing Collider, a programme which is transforming the city into an internationally recognised Smart capital.

In fourteen months the project has notched up *nearly 200 events with over 5000 attendees averaging quality rating of 4.2 and above (out of 5).

An epic piece of foundational work—developed from a standing start with no precedent—focussed on raising capabilities and literacies via a plethora of tech, creative and digital seminars, talks, roundtables, meetups, masterclasses, workshops etc.

Due to managerial changes and iterations of the original aim, my personal purpose and values no longer align, so the time has come to allow someone else steer the ship for the remaining Wellington City Council funded initiative.

Huge thanks to my previously line manager, the collaborative Jessica for her guidance and steerage, the partnership of Caitlin for her tireless enthusiasm and spirit, the superb colleagues and friends, Monique, Jeff and Petreece, plus the wider BizDojo whanau (and of course all the facilitators, speakers, stakeholders, partners etc which made this a pure adventure).

Onwards…

…towards manifesting my purpose to shape more creative collisions of and for incredible humans.

Will be amplifying the curatorial nature of my skill set plus the cross-sector translatorial aspects of my talents. In the first half of 2017, that means:

launching a curative service of exclusive conversations whilst building micro-networks of creativity;
continue to produce TEDxWellington which will be the fifth and biggest TEDx event in the capital;
forge an offer to serve as professional development for those seeking to improve both their public speaking skills and to understand deeply the power of kick-ass storytelling;
attend TEDFest in NYC;
liaise on other smart city-wide / internationally focussed related endeavours.

The aim as ever is to make folks think and / or smile.

Add value where I can.

And forever reach beyond my grasp.

*not included are the mentor sessions created by both the Step Up programme and the InformMe (probably at least doubling the amount of ‘events’ in the final number).

Vulnerability As An Act Of Creativity | The Project 2016

project16 DK naked

Going naked (image credit).

The theme for The Project 16 this year was Creativity in Business and Beyond. Hosted at Auckland University of Technology, the speaker lineup was superb along with the topics tackled, plus insights shared.

After weeks of reflection on the topic I settled on the idea that creativity is an act of vulnerability. With this in mind, it was my intention to illustrate and demonstrate this rather than just talk about it. I decided to ‘go naked’ and present with no notes, slides or cheeky little stuff written on my arms / hands.

Listen to my ten minutes talk:

The silence after I am introduced by my brilliant pal Michelle Dickinson aka nanogirl is intentional—keep listening.

I had several stories to tell to demonstrate my point although the final three were chosen minutes before I went on to ensure they complimented and did not duplicate existing points made by the previous speakers. It was everything you’re taught not to do as a speaker and as you’ve heard, a mistake was made, and the final story was plucked from the recesses of the brain.

Lessons have been learned and there’s a hunger to explore more opportunities to experience this method and a desire to be able to use it more confidently. HUGE thanks to The Project 16 for allowing me to share and participate plus respect to my fellow speakers as gained so much from their talks as well.

project16speakers

“DK is an early adopter of new trends, technologies and techniques as well as a social risk-taker. As a presenter at this years AUT Project 2016, DK gave a very insightful talk about vulnerability, purposely w/o any audio-visual media support. DK’s presentation underscored how difficult it is to put oneself out there clearly, and with purpose, in order to achieve one’s objectives while simultaneously generating proactive outcomes. DK’s talk was most inspirational and I’d recommend him as a speaker at other conferences or events where an outlier perspective would help an audience better understand traditional ideas by stepping out of their usual day-to-day point of view.”
Hal Josephson, Program Chair for Project16

Special thanks to Hal for the invite to speak plus appreciation to BizDojo for the permission / allowance.

Image credit

Crafting Creative Collisions | 100 Starts

Reflecting on activating a Smart city.

Last week we held the 100th event under my day job as manager of the city-wide activation programme Collider.

Each activation has been an opportunity to learn, explore plus move closer to a concept of how best serve the digital, creative and technological ecosystem and transform the city into a Smart capital.

This three year (Wellington City Council funded and BizDojo delivered) programme, is a bold attempt at raising the capability of a region.

As we near the end of the first year the time to reflect seems appropriate and here are some learnings:

variety is key—the usual sage-on-the-stage presentations is now mixed with seminars, workshops, masterclasses, roundtables, one-to-ones, mentoring etc, ensuring all tastes and learning styles are catered for. It’s also a trial of see what fits and sticks, plus what formats can be morphed and realigned with others;
reframing was important—originally, many were describing the piece of work as an umbrella although the quick reframe as a scaffold (supporting existing good projects and initiatives whilst filling in the gaps to create a broad foundation) made it more accessible. It was also gentler as there’s a huge amount of good work in the city and moving forward with humility has been crucial;
trying is better than not—as you can read from some of the highlighted choices in this blog post review, there’s been some fun goes at changing the offer. Merging disciplines and styles is always a step into the unknown although excited we had the opportunity to try;
capacity is the biggest issue—a four-day-a-week (which is what I negotiated before I start to ensure I can still produce the most creative TEDx event in the world), does not leave a lot of time other than nailing KPI’s (which we are with a little added on top). Reflection is still needed although the accepted transition into a more quality-versus-quantity mode has ignited the creative possibilities;
hidden impact—the softer side of running an activation programme is in the connections made, the conversations had, the thoughts sparked, the ideas inspired etc. The stuff incredibly hard to monitor or track, however, can be found in the stories shared back and the side chats had. It’s the fabric which builds communities of practice and the stuff which amplifies opportunities.

Here’s the next 100 and year two with an emphasis on audacious activations which make the world take notice.

Email Gating | Blocking Versus Trusting

tim ferris email gating

An email signup pop-up which appears directly above an actual email signup form on the page itself (via Four Hour Work Week blog).

Imagine this:

You head to a restaurant that a friend has told you good things about, all hungry and keen. You arrive and the place looks good. As soon as you take a step inside though someone blocks your way and asks for your postal address, with a smile. It’s explained that it’s so the restaurant can send you notices of when there’s new items on the menu or special offers. Again, said with a smile and a trusting wink accented by the promise they won’t send any spam, just good stuff.

Now you haven’t tried their food or experienced their service let alone seen a menu, would you want to eat there?

When you have your own site there’s a huge amount of control of the experience you want visitors to have and the relationships you want to build. Email newsletters are an element of that potential connection and content distribution.

Unfortunately, the growing trend in the past few years is ‘gating’ access to websites via email newsletter signup popups which block the content either as soon as you enter the site or after you scroll a little.

‘Email gating’ is slowly eroding the web and illustrates the shallow nature of the reliance on numbers to prove impact.

Some of us can still recall those intrusive popup ads in the early years of the web and how there’s a collective understanding how obtuse this strategy is (so much so we now have the blocks built into our browsers). There’s no difference for email newsletter signup popup.

If you visit a site which is email gated, there are three decisions available:

sign up
leave
close the popup and continue surfing

Only one of them serves the creator and unless the website owner is using a system utilising cookies to track the closing of the message so as not to serve it up again plus the website visitor is not using cookie blockers or software which cleans these out, this will happen every time someone visits the site. Every visit corroding the experience and the relationship (potential or existing).

And why do so many organisations, companies and individuals email gate?

Fear!

They are scared they aren’t relevant. Scared the market or tribe will walk away and won’t come back. Scared that quantity rules over quality. Terrified of doing this (ironically you have to sit through or click the ad off to get there).

If website owners don’t trust both their story and the ability of the visitors / tribe / users to find a simple signup form which sits in the sidebar or bottom of the page, then what other message does that convey. There is no hope. No trust. No respect.

Do the opposite.

Have more faith: in yourself, and us (as visitors).

The visitor also has a role. These tactics will only change if we the viewers of this content reach out to the creators and just ask for a little respect. Request, politely, that we now how this stuff works and if we like what you have to say we will trade. Our time or even our email address for a continued relationship.

So content creators and website makes / designers / founders, learn to tell your story and we’ll stick with you. Please stop interrupting us. Please stop making us not like you. Please help us, help you. Stop email gating.

AirBnB Verified Human | Retaining Personal Information / User Bias

How personal information is something we increasingly have to make an effort to retain.

It’s been a year or two since I’ve used AirBnB and in that time they’ve introduced a verification system. To get validated everyone has to upload a government ID (drivers license / passport) and also give access to another online profile (like Facebook, LinkedIn). Until completed the platform and it’s service is not available.

Any effort to protect users (especially a peer-to-peer offering which potentially is open to abuse) is a good thing. However, the type of information requested plus the linking to another social account, raised questions in my brain around privacy and permission.

After a short email exchange with AirBnB’s help desk, the following were the main barriers for me:

this highly personal and identifying information (drivers license / passport) sits on a third party server which even though is cited to have great security, potentially could still be open to hacks / leaks (there’s a growing list here);
linking to another social account such as LinkedIn would give AirBnB access to my network (full names and identifying information) which simply wasn’t ethical (as I don’t have specific permission to share that information on);
there’s enough information / evidence / videos etc about me online to validate my identity anyway.

AirBnB are a $20 billion dollar company with over 500,000 users every night and now dealing with some guy questioning their systems when they were put in place to protect folks. So to be honest, I held very little hope in seeing any outcome other than a repetition of the policies and reasons.

To my surprise, instead of dismissing my counters and above statements the customer service rep asked me to create a video stating my name and “AirBnB” plus to hold up my passport (just the outside). They would then explore with management what they could do. I did as requested utilising Vimeo’s password protected option to host my video and forwarded the link / password on.

36 hours later, boom, verified and invited to continue using their service.

Thank you AirBnB for treating me with respect, for listening to my concerns and challenges, for exploring alternative ways to validate my identity and basically approaching this in a manner which verifies yourselves as humans. Appreciate it’s a longer process although one which could provide an exemplar for those who decide to protect their information but would still like to use your service. What you lose in time you make up for in respect.

Special thanks to Sam from customer service who fielded my questions and assisted in getting me verified.

This interaction and outcome serves as a challenge that maybe we should all not blindly agree to terms of service and keep asking those ‘better’ questions, especially if they are ones which protect ourselves and those in our network.

TEDxWellington 2015 | Daring Acts Of Trust

2015 TEDxWellington

Today we announced the theme / date / call for speakers & performers for this years TEDxWellington.

This will be my fourth as lead producer of a TEDx event (not counting TEDxWellingtonWomen which I’m the license holder for although only mentoring the team there). Each previous event has sold out and built on the success of the previous one in terms of quality, scale plus experiential design.

The TEDx event format has a great deal of rules governing it’s production. This, quite rightly, ensures continuity of brand quality and assures the ethos remains intact (that of, ‘ideas worth sharing’).

“When I have something to work against, it liberates my imagination”
Jørgen Leth

This year, with TEDxWellington, we’re trying something which has never been done before (to our knowledge): we’re not sharing the most important parts of the event. That being the:

location
speakers / performers
exact number of tickets
programme for the day
breakout session details

Why?

It’s an experiment. A journey. An attempt to explore the ‘what if’ which was thrown out to the team who then made it better and gave it back. To bank in some of the trust from the previous years events and believe in the adventurous side of our community.

Here’s to trying something daring!

UPDATE (27.5.15): Here’s some stats from the first 24hours after our announcement:

24hrs updated

TEDAche | Stretching, Compassion & Rebounding

TEDActive spontaneous dance party

The wonders / dangers of attending a TED conference.

A few hours ago TEDActive ended.

I’m currently sat in my Whistler hotel room even though the party goes on with groups of tremendous souls from all corners of the globe still hungry to connect.

Alas, I’m all talked out after six days of immense conversations, nearly 100 TED talks plus a variety of moments which truly remind you of the spectrum of experiences this world has to offer.

I feel stretched.

Full of compassion.

Ready to bounce!

For me, the themes taken away included these ideas of:

stretching—reaching beyond your grasp and changing your mind / body / habitat as an attempt to find new solutions or better questions;
compassion—embracing and empathising with suffering as a means of connection to discover new perspectives;
rebounding—the act of trying again or even using the negative as a reframing exercise to grow or carve out new paths.

Events like these are dangerous if you’re not ready to change (or commit). No matter what your expectations are, in the giving of yourself to the experience you lose something: some light stuff (like sleep and the yearning of solitude) although also the dark (as the stories curated and the organic ones shared with your fellow participants fuel the yearning to be more).

The aim now is to digest, deconstruct plus apply the learning (especially from the other TEDx organisers in attendance—there were 350 of them) to the future TEDxWellington events, and selfishly, my journey.

Onwards!

Picture above is of the TEDActive spontaneous dance party whilst Aloe Blacc woke us up:

The Reason Within | A Guide For All Creatives

Read by Dan Stevens, produced by Penguin Audio.

When did one letter ever hold more advice, challenging steerage and tantalising insights than this. Listen with openness, hunger and potential (you can also read it in full here).

Written by a 27 year old poet to a man only 8 years his younger.

If your everyday life seems poor, don’t blame it; blame yourself; admit to yourself that you are not enough of a poet to call forth its riches; because for the creator there is no poverty and no poor, indifferent place.