insights! episode #101: Between data protection, AI and digital sovereignty: what you really ought to understand now

Joubin Rahimi

Wonderful that you are with us again for a new episode of insights! My name is Joubin Rahimi and today's guest is Christian. Hello Christian.

Christian Bennefeld

Hello Joubin, greetings to you.

Joubin Rahimi

It is incredible. We got to know each other through a webinar, and we really hit it off in the panel discussion and had a great exchange. So it is wonderful that it worked out and you are with us. And as I also learned, back then you developed a tool, eTracker, which I used myself in my own online business. And you said you have now switched to the other side of the force, and that is of course extremely exciting to begin with – we will be shedding light on data protection and AI today, but first tell us a few words about yourself.

Christian Bennefeld

Yes, told very quickly: 56 years old, married, no children, living here in Hamburg. That is the personal side. I have a degree in mathematics, I also studied computer science and actually come from IT security. I used to hack computer programs myself, if I may say so, and was very active in the CCC in my youth, back when I was still below the age of criminal responsibility. Later I actually turned my hobby into my profession, went into IT security as an IT consultant for a Hamburg software company, and also set up their US subsidiary. And then came the part you just mentioned: in the year 2000, I went into business with an old school friend and founded eTracker. A web analytics system, as it still is today. Many people know Google Analytics. Our idea back then was a bit different from Google's, but maybe we can go into detail in a moment about what drove me there. And today, exactly, I have switched sides and do the exact opposite, the blockers. But maybe we will take a look at that in a moment as well.

Joubin Rahimi

Yes, gladly. But first those youthful days, those were wild times, when you said you were testing security. Yes, you could put it that way.

Christian Bennefeld

On the one hand, of course, there was always the ambition. Back then computer games were just coming out, or PCs were just coming out at all. Sometimes they had copy protection on them. If you dug a little deeper, you could remove that copy protection. And then things slowly started with DATEX-P. Most people today only know the internet. That was, so to speak, the German predecessor of the internet, run by the Deutsche Post at the time, a packet-switching service. You could access it with a terminal server or with a terminal. So you only had letters and text and could access the mainframe computers connected to the DATEX-P network. And it became a hobby of mine and of others I was with in the CCC to take a look behind the scenes and see what you might be able to open up. Where can you grab passwords? How well are the systems protected? And I really took IT security to my heart, and with it, of course, to some extent the topic of data protection – but that came after my, let us say, after my wild days, when I learned how important it actually is to protect personal data, because you can do quite a lot of mischief with it, as I later learned at eTracker.

Joubin Rahimi

Yes, I would like to get into that too, because I have an anecdote as well. I was not in the CCC. I am a few years younger, but not really. We are more or less the same generation. And my first job – I did not study, I went straight from my apprenticeship, which was also drastically shortened, into a start-up, and we ran, that is, implemented and operated, other start-ups that scaled up. And of course we also had exactly those kinds of people who said: “Let us see whether we can get onto the servers.” We were always well prepared, but we also had denial-of-service attacks. I remember we had a customer with ten huge boxes. We were really well set up and then they fired from all barrels and noticed, okay, the line was the bottleneck rather than us, it did not bother us. And then there was an email saying “We will keep going and take you down”. There was really a fairly large multi-million business behind it. And then we shot back once. That was quite funny, because of course we knew where it came from. And then they were flat out and we put an email with a trojan on top of it, and of course we also reported it, but that was wild, because the police were there – that was 25 years ago – and they did not understand a thing.

Joubin Rahimi

It was like the Wild West. Really wild. And we only found out a little bit there, but with personal data you can of course do far more, if you think about it. And maybe you can first talk about that switch from eTracker to eBlocker. Something must have clicked somewhere. That is exciting, because it is a fundamentally different direction.

Christian Bennefeld

Yes, you are quite right. Before that it was about helping companies build a data-driven business. And our idea, when we founded the company in the year 2000 – we actually started, how shall I put it, without venture capital, without any backing. I always say, as a living-room company, because my partner sat in his living room and I sat in mine. He developed the software. I built up marketing and sales, so to speak. And our idea was: now everyone is going out and building websites. How can we help those people design their websites so that visitors feel better next time, so that they feel even more comfortable, drop out less, maybe push bigger baskets to the checkout and things like that. Our ambition was to provide statistics on visitor behavior, entry and exit pages, which campaigns we are running successfully and so on, in order to optimize the digital business.

Joubin Rahimi

That sounds good so far.

Christian Bennefeld

Exactly, that is what we built, and always with the focus on protecting the data of consumers, of the data subjects moving around on the websites, of course, and making this information available solely and exclusively to the website operator. In other words, we ourselves had and still have today – I am no longer with eTracker, but eTracker still does it that way – no rights to the data collected.

Christian Bennefeld

That means it is not linked across multiple websites, so that you could see: well, he was in the sex shop over there and then he bought something at the pharmacy that itches a bit less, or other things, and then merges all of that. And that is of course what came later with Google – overall, Google came much later. They bought Urchin in 2003 and developed from it the Google Analytics we know today. And Google's approach here is of course a completely different one. For the customer it looks similar. They get web statistics about the behavior of their visitors, but Google has one thing in mind: they want to profile the visitor precisely. They want to know exactly about every single individual: what are their circumstances in life? What are their personal relationships? How rich, how poor? What are they interested in right now? What is their purchase intent? What does their family status look like? But also questions like: which religion, which political leanings do I have? Which health challenges? Google records all of these things by building cross-site personality profiles with Google Analytics. That is of course the basis on the one hand for personalized advertising, but on the other hand also for manipulation – and we saw that manipulation in particular in the last-but-one Donald Trump election campaign with Cambridge Analytica, where microtargeting was used to address target groups very precisely, in order to move voters with very specific messages to vote for Donald Trump.

Christian Bennefeld

And that works entirely subconsciously. And those who say: “Well, no, that does not affect me. I do not even look at any of it.” You do not notice it at all. And that is exactly what defines the big advertising corporations today, this manipulation via personality profiles. And that annoyed me, because as a data protection advocate I also have a very strong … I consider democracy to be the most important asset we humans have. And I believe democracy can easily be influenced and manipulated by manipulating us, the people who use this democracy to exercise political will, through advertising, but also through certain things that appear in my timeline or are fed to me somewhere else. And that worried me, and it already worried me back when we founded eTracker, because you can believe me, many people come up to you and say: oh, you have interesting data there. We would be interested in that too. Would you sell it to us? And of course we turned that interest down every single time and said: no, that is not our business model. We do not sell data. And I consider the model driven by the big advertising corporations to be incredibly dangerous.

Christian Bennefeld

And that annoyed me. That was exactly the reason, when I then left eTracker, to say: well, how can I actually use my knowledge of how tracking works and what dangers tracking brings for us, for our democracy and for our society, to create a counterweight here? And that is how the idea for eBlocker came about – and you told the eBlocker story quickly too, but maybe you want to slip in a question in between.

Joubin Rahimi

This is really exciting for everyone. There is already a lot of information in there.

Christian Bennefeld

But eBlocker is the exact opposite. The idea behind it is to have a device that I simply plug into my router at home, and from then on I am no longer tracked and no longer get any advertising, and that on all devices – essentially a network filter that filters out the evil spirits, let us say, at network protocol level. In other words, all tracking systems, including eTracker of course, even though it is one of the good guys, but also of course advertising, personalized advertising, malware, all pests, everything bad is filtered out at network level, so to speak. The nice thing is that because it happens at network level, it works on all my devices connected to my home network. I do not have to install any software or anything at all. I surf everywhere free of tracking and advertising. That is a lot of fun and that was the basic idea. The three of us launched it with old buddies from my security days, if I may say so, and we founded the company anew. That was in 2014. And we got off to a very, very successful start, ran successful crowdfunding campaigns and so on, but then ran into challenges with a financing round. Our second financing round failed shortly before signing and then unfortunately everything went down the drain.

Christian Bennefeld

eBlocker went insolvent once, and the insolvency administrator still thought the idea was so good, and so did we. He said: “Well, guys, do you not want to carry on with this?” We said: “Actually we still find the idea sexy, but we may have to change the conditions, because a hardware business is expensive and complex. And as a small company – we had 20 employees back then – that is hardly manageable, you have to say, you have to deploy a very great deal of capital.” And that is why we turned it around, made a pivot, as you say in modern jargon, and today we do it as open source technology that anyone can download. You can put it on a so-called Raspberry Pi, which is a mini computer in credit-card format, costs less than 50 euros, you can load the software onto it and then have your own little eBlocker at home – just like the device back then, which we sold for over 200 euros, you can build your own eBlocker free of charge today.

Joubin Rahimi

And in effect it is like a firewall. You probably put it between the router and your home network, right?

Christian Bennefeld

Exactly, it is really only connected to the router, so to speak. It does the rest completely automatically. That is, so to speak, part of the technology, which we also filed a patent for, but we could no longer pursue the patent due to the insolvency. But in principle it is complete automation, and you are right: logically speaking, you sit in between, even if physically you are only connected to one port on the router. Logically, the eBlocker sits between the outgoing, or rather the incoming traffic and the end device and filters out the traffic there just like a firewall – but unlike a firewall we are very, very specific, we do pattern matching, so not just plain domain blocking. So what we do there is not trivial, it is actually quite sophisticated, if I may say so myself. But it is fun and eBlocker is still alive, I can only say that, and it enjoys, how shall I put it, a lot of users. Today we do the whole thing with volunteers. So nobody gets paid for it, me included, and the whole thing is funded by donations and, let us say, it is an ambitious hobby. But one that is a lot of fun.

Joubin Rahimi

Great. And I also find that exciting. The insolvency does not surprise me – not because of you, but because of the circumstances. Because you have no friends, do you? How do you make money? Who really wants that? Telekom does not say: yes, great. Vodafone does not say that either. The big Amazons and the like do not say: awesome, I am delighted that customers are no longer visible. I think that is difficult to begin with. You probably faced a lot of headwind there, I assume.

Christian Bennefeld

Absolutely. Of course, how shall I put it, at some point a 7-1 venture comes along and says: well, we have seen you ran a very successful crowdfunding campaign, somehow with 600,000 euros in just four weeks. What is it that you are doing there? And when you explain to them: oh, by the way, we do ad blocking and tracker blocking and then you will not get any more data – then of course they think twice about whether that is an interesting investment. But we had investors from the IT security world, and the due diligence and everything went well too. I do not know what in the end made the investor … We had even booked the notary appointment. So 14 days beforehand he cancelled, for what from my point of view were rather thin reasons – whether the liquidity was not available at the investor himself or whatever the problem was, I really cannot say conclusively.

Joubin Rahimi

The market changed, it had nothing to do with you.

Christian Bennefeld

We hit all the numbers. The company was really, how shall I put it? Green on all sides, I cannot say otherwise. All the signs were green as well; what ultimately led to the cancellation I really cannot say in detail, but it was sad, because of course, how shall I put it, when you are in insolvency like that, things move very fast and suddenly the doors are closed and all the employees are gone. And I always compare it like this: looking for and finding a new investor while in insolvency is a bit like a sprinter lying in hospital with two broken legs looking for a new sponsorship deal. You may find one or two brave sponsors who say: oh, he will get back on his feet. He will manage it again with his broken legs. But at the end of the day many will first wait and see how the athlete gets on. And that is more or less how we experienced it too. In the short time available it was simply not feasible for us to find new investors of the size we needed to continue our business. And unfortunately it then, how shall I put it, still came to a fairly good end.

Christian Bennefeld

By the way, we also had no creditors. We also have a settlement rate, if I may say so here, of almost 96%. The employees were all satisfied too. There were essentially no losses. We are, how shall I put it, not proud of the insolvency, but we are proud that we wound it up cleanly and to the satisfaction of all customers, because the customers are all still with us today. And now they get it free of charge.

Joubin Rahimi

It is not a nice story, but it is good that it turned out that way, also with the open source idea. But I think everyone listening and watching now knows: we are talking to someone who has really experienced data protection from the ground up in many different facets. And what is exciting about data protection – and on the one hand, when it comes to security, I am really fussy, at least about my own security, because I know what is possible. I do not have a standard router at home either, and so on. So right from the start I did a lot of things differently from others. But I do give away a fair amount of data. I am present on LinkedIn and so on. Of course a lot can be picked up there, I am aware of that. But what I find exciting is this triangle between personality, personal data protection, or also the protection of company data. Especially with AI it is yet another level. Then, how do revenue and value creation come about? And personalization is often a topic there, or data is the new oil, that is important, and then regulation in the EU and Germany. This triangle is incredibly exciting, and I even put on something special here. Basically Shape Future.

Joubin Rahimi

Because ultimately everything we are doing now is shaping the future, which is changing drastically right now. And I would first like to know where you position yourself, and let us say, where I then position myself in this triangle.

Christian Bennefeld

Where do I position myself? I am not a nerd, let me put it that way. I am not someone who obstructs business; on the contrary, I consider data-driven marketing and data-driven enterprises in general to be very, very important and also right. And what you just said – I believe there are always two levels, namely the public level, which I curate myself and where I present myself, whether on LinkedIn or in other social networks or the like, and there is the level where a profile is built about me, about my behavior. And that is of course a completely different level, one that can find out far more things about me, perhaps also on a psychological level, and can get to know me in a completely different way than I might want my public image to be. And then there is regulation, and everyone always complains about regulation, whether it is the GDPR on the one hand or, on the other hand – we will come to the topic of AI, the AI Act. I think there is a very, very great deal of complaining instead of simply getting on with it. Because if you really engage more closely with the regulations, with the laws, then it is not all that bad.

Christian Bennefeld

Unfortunately, from my point of view, there is a lot of polemic on the part of companies. Data protection – which cannot defend itself either – is always the first thing to be blamed, and they say: we cannot do that because of data protection. None of that works because of data protection. A big stumbling block. But if you really take a closer look, that is not the case at all. So where do I position myself? I would say I see myself more as a facilitator, let me put it that way, as a doer who knows the importance of data, but who is also aware that you do not necessarily have to collect all data in order to run your business, and who looks very closely at how companies – advising them at this point – can shape their own future with a data-driven strategy without violating the legal rules and while maintaining respect for users' privacy. One thing is always the legal rule, and when I read these cookie banners: “We respect your privacy”, then that is already something of a farce. That has always made me a little – excuse me – somewhat annoyed. Because it is usually exactly the opposite of respect for privacy, since otherwise I might even do without such procedures altogether and could save myself a cookie banner.

Christian Bennefeld

But that is the field of tension I move in, and I do consider regulation, as I think I have already expressed, to be good, important and right. And I believe we have to look, for all the envy that many entrepreneurs may have when they say: oh, in America I am allowed to do that, and there it is seen quite differently. Yes, we are in Europe, and we should be proud to be Europeans doing business in Europe. The current administration in the USA is showing us again right now that it may be quite a good thing to have the focus of “Make Europe Great Again” once more and not always look right and left, whether towards the USA or towards China or anywhere else where regulations might be lighter. I believe regulations are good, because in the end they serve the protection of us citizens and ultimately the protection of our democracy as well. Exciting.

Joubin Rahimi

I would like to mirror back where I stand. We also have a tool with AI. I have not even told you about it. It is called brytes. And that is why I know this triad really well. brytes captures digital body language on a website. So for customers who use it, it captures the digital body language of a session and in real time we give feedback: this person is unsure about buying, or cannot find their way around the website, or they are about to buy – do not do anything, just leave them alone, you do not need to play out anything now. But we do not link that to any CRM data or to returning sessions. It is simply that every session is new, and afterwards we know nothing more. That is more or less our ambition. But it also has – I mean, in terms of data protection that is absolutely great, because, exactly as you say, you then forget it. But of course it also has a completely different … Well, if you go to a website and it tracks me, and for example – we have a bicycle shop as a customer – and I am looking for something for myself, then I search quite differently than if my daughter says my rear light is broken. And those are then two sessions, completely different stories, and you cannot mix them at all.

Joubin Rahimi

And there is very often this situation where we said: no, in this moment we only do this session. But that is how I know the whole subject, and towards AI I have to say, with the AI Act, typically German or typically European, it already cost us a lot of time ourselves, and I even wondered: shall we just drop the whole thing? And I found that exciting too, because it did something to me. It was not about what else I can do, but: how can I avoid getting a penalty? Even though in terms of our approach we are in pretty good shape. And that, I think, is always a problem. That is why I sometimes find regulation really difficult. Regulation for people, that is, personal data – I think that is good, because individuals have no way at all of protecting themselves. Take the Schrems rulings, which you probably know inside out, and the fact that EU law said: well, the Privacy Act and Schrems do not fit together. That is how it is now. And that data sovereignty is of course not given for individuals at all. There I find them apt, but for companies – they have to protect themselves and be clear as well.

Joubin Rahimi

There I sometimes find it blocking. So in that respect I sometimes think it is too much. And companies that want to – I find that exciting too – I know an acquaintance in Dubai who builds AI companies for other large enterprises, where they are not directly involved but can take stakes, and they go full throttle first. And there they have no laws at all. That is the Wild West, exactly what we said at the beginning. They go full throttle there and then, when they say, okay, now we want to distribute or use it, then of course they layer governance and the like on top. But first they have the mindset: we do it and see what we can do with it. And that is what I feel is a bit lacking. That is roughly my situation or my positioning in all of this. But we have to protect individual people, because otherwise there are no other options.

Christian Bennefeld

I share that 100% as well, whether, how shall I put it, the regulation, which in my view is necessary so that we can also develop AI in a good sense – if we look at AI – or ultimately the handling of data in a good sense. Whether the idea of regulation as such has been implemented well, there I would cautiously put a question mark. The AI Act in particular is a behemoth with its 200 pages, and at the end of the day, yes, here the EU Commission and the Parliament are of course trying to set up a framework to protect us from the greatest risks. If you look at the regulation closely, then, let us say, 85% revolves solely around high-risk AI systems. Hardly anyone will operate those in a normal business environment, unless I am perhaps in the military field or in, I do not know, predictive policing or something like that. Then I may have those obligations, but there is a lot of polemic being made there too, is what I want to say. Yes, the regulation is thick and in large parts it is – I also think it is not well done. It is not well coordinated, but unfortunately that will sort itself out.

Christian Bennefeld

That is always how it is: when I issue a new standard, a new law, then it has to be polished a bit. And there I would wish that this polishing actually takes place, unlike with the GDPR, which came out in 2018 and since then there has been no polishing, if I may say so. Since then it has not got better, nor has it been improved in the places where questions may have arisen. Yes, a lot has come through court rulings. One, or rather several, were fought out by Schrems at the highest level before the European Court of Justice, which I personally consider right and good. Of course, industry finds them anything but good, because it is of course difficult then to say: oh, now I am not allowed to transfer any more data to US companies. What alternatives do I have? But there I can really only say: people, that is home-made, so orient yourselves today, because Schrems – or the other way round, the data protection agreement, the Data Privacy Framework, which was put in place by President Biden and agreed with the EU Commission – that will fall, and very, very soon. Because President Trump has already dismissed three of the four Democratic members of a committee.

Christian Bennefeld

And with that this committee no longer has a quorum, and so we as Europeans, if we currently have complaints against US companies because they may potentially not have processed our data correctly under EU legislation, can no longer properly pursue the complaint. And with that we have a fundamental breach of the transatlantic agreement that was concluded as the Data Privacy Framework. And with that, from my point of view, it de facto no longer exists at all, simply because the institutions to enforce it are missing. And in that respect all of us as Europeans can prepare ourselves: there will be trouble again here. There will be sparks flying again. And anyone who wants to avoid that is well advised to focus more on European market players and to look at which things coming from the USA are really essential? Which ones can I not do without? But how can I mitigate that? How can I counteract the potential collapse of the data protection agreement, so to speak? There are a few technical or legal tricks, if I may put it that way. I do not know how deep we want to go into that.

Joubin Rahimi

I am curious about that. I can also mention a few things that we do, then we can complement each other.

Christian Bennefeld

Yes, as I said, you can, so to speak, if I now … Let me finish my point, so to speak. So what I also wanted to add: the data protection agreement will fall, and I believe everyone is well advised not to repeat the mistake over and over and say: oh yes, it will work out fine with the USA, but rather to say: how can we – I do say “Make Europe Great Again” – how can we actually put Europe front and center and how can we bring the service providers and partners on board in our companies that come from Europe, in order to avoid exactly these difficulties in the future, whether with the General Data Protection Regulation or perhaps with the AI Act and with other regulatory topics? Because within Europe we will have no problems, and as long as I rely on European service providers and build on them, the world – or at least the data protection world, but also the other regulatory world around AI – is fine. What can you do if you absolutely want to – you can bring out your tips later – use Microsoft 365? Well, that is not quite so easy.

Christian Bennefeld

But shall I give my tips or do you want to bring yours out afterwards?

Joubin Rahimi

Yes, you go ahead and then I will add to it. Exactly, yes. Then we can play a bit of ping-pong.

Christian Bennefeld

So what you have to do in any case is standard contractual clauses. Corporate binding rules are the somewhat weaker or different form of that. Choosing standard contractual clauses is a particular legal construct that ensures that the data is processed by the service provider I hand it over to in a similar way as in the EU, even if it may in fact operate in a transatlantic alliance outside the European Union. But that does not always help, because I have to take additional technical and organizational measures to actually make sure that US authorities cannot access the data I transfer. One part is the legal side, standard contractual clauses. On the other side, technically, you can for example use so-called encryption. So let me give a simple example: how can it be solved? If I now want to use Dropbox, for example, as a US cloud provider, and I put my personnel data with salary tables in there, then that is not such a good idea to begin with if I have managed it with Excel, for example, or however in the database, because that data is more or less directly accessible in plain text and could be intercepted by any US authority either in transit, if it is not encrypted, or at the latest on the server, if they approach the US company with a court order, which is exactly what they do.

Christian Bennefeld

What can you do here? Use encryption. Those are the technical measures. I could encrypt my Excel file with the salary tables beforehand. Only I as the company have the key, I put the data into the cloud, it is then stored in the USA, but nobody can ultimately decrypt it there, and with that I am safe again in that I have taken measures ensuring that US authorities cannot access it and that data protection is safeguarded accordingly. However, that does not always work. So of course I cannot always encrypt all the data I store somewhere, especially if it is stored in a database, for example, in order to run analyses on that data. Let us take the Google Analytics example again. I cannot encrypt the data beforehand – if I want to encrypt my page name or whatever and then send it encrypted, well, then I cannot run any analyses on it any more. That gets very, very difficult. So you then have to use other techniques or simply choose European service providers. That is, at the end of the day … I want to ring the bell loudly for companies here: think of the European partners and take a look, so that you make things easier for yourselves in the future, stop being polemical and complaining, and instead look at which partners here in Europe might be suitable to deliver the same service that an American partner delivers.

Joubin Rahimi

Yes, that is really exciting, because when Trump was elected the first time, I think I once put out a podcast about it and asked: which mail provider do we take now? There are of course always alternatives, but the gap in functional scope and so on is huge. And we also differentiate in terms of what we do ourselves. After all, we operate internationally every day, including in America. That is why it is a bit difficult one way or the other as a global corporation versus customers. And there you would rather go into it when customers say: this is really important to me. Then there is, for example … Some customers say: I do not care. I think AWS is great, they have lots of services, fancy, or Azure or Google, but it all ends up … It is always all … The NSA has access to it. I always say: if not now, then at some point something will come along with quantum computing, and then encryption simply will not matter any more. That is going to happen. Not this year, not the year after next, but at some point, and then it will be real time as well, and then we will have completely different discussions. But if you really want to make sure you look after your data, that is, be data sovereign, then we looked at various things.

Joubin Rahimi

Stackit, for example, from the Schwarz Group, which from our point of view is still rather at the beginning. Sure, Telekom Cloud is a familiar name, but what has really impressed us as synaigy is OVHcloud. A French service provider with a very technical approach: they develop their motherboards themselves, they do the cooling themselves. Gaia-X founding member. I think that sounds nice, but Gaia-X is not worth anything any more from my point of view if you say the big hyperscalers are all fine too. And there we really built up stacks, all the way to a CDN that is not Cloudflare. Some like to use Cloudflare, but there are also Swiss providers, which is not the EU of course, but Swiss alternatives that pay a lot of attention to security and data sovereignty. There we simply built up stacks where customers can say, this is important to me. And funnily enough, sometimes things are more expensive, sometimes they are also cheaper. OVHcloud is, in terms of price, significantly cheaper compared to others, we found, but in the CDN space it is suddenly significantly more expensive if you care about it. But in the end that does not matter. It always balances out somewhere. But that is what we see, and we are in the e-commerce business and we have also seen – not directly with us, but an attack was foiled in North Rhine-Westphalia, and there was a tip-off from the Americans that the individuals had bought things in large quantities in German e-commerce shops that are hosted internationally, things that are not good when mixed together.

Joubin Rahimi

And I find that exciting too. It was not the BND that noticed it, but the Americans, who then pass it on to the BND, which one is grateful for, first of all, so that no people die and an arrest can be made. But it is also just plain wild. That you simply say, this is being monitored continuously, and of course you tend to forget that a bit. George Orwell says hello.

Christian Bennefeld

That is exactly – you are speaking from my heart there, so to speak. So first of all, exactly the strategy you just described, namely to look at where things fit with European companies, I think is exactly right, and that is exactly the strategy I also recommend in my consulting. Where is there a bridge you can build to European partners, where you may sometimes have to bite into a somewhat sour apple, and sometimes, as you say, on the cost side it is even a bit sweeter than you expected. I think so too, I share that entirely. And what you just said as well – all the attacks, I believe, that have been foiled in Germany: the information always came from friendly intelligence services. It was very rarely the BND or the domestic intelligence service or German services, but as a rule they were services, presumably the Americans, that it came from. And that all of us here are being scanned and observed is completely beyond question. The question is, of course, sure, nobody has anything to hide. We are none of us criminals. How far does this passing on and use of data go beyond those bodies? And of course there is also the topic of false positives. So will I perhaps be turned away at the border because I exchanged messages with the wrong people or discussed the wrong information or discussed the wrong topics – that is of course always difficult for members of the opposition, and that is what worries me so much.

Christian Bennefeld

Especially those who belong to marginalized groups and minorities, who are then observed and potentially excluded. So either from participating in a country or, how shall I put it, there have also been worse cases, when people suddenly disappear – Khashoggi and the like – where you also do not know exactly where the information came from about where he happened to be and things like that. And there I really do worry. I think everyone should see that. This influencing will probably, and I always hope so, not come from the NSA or the US intelligence services, but a Google and the like are of course very, very powerful with these volumes of data, and they will of course also pass them on to the NSA. But here, as an ordinary citizen, I actually worry more about the topic of manipulation, and by manipulation I really mean the subconscious, the subliminal, exactly as it worked with microtargeting at Cambridge Analytica. We do not notice it at all. We, the people affected, think: yes, why? A perfectly normal message. But it is played out in such a way that it very deliberately channels and aligns our opinion in a certain direction. And there I worry that this can lead to a shift in democratic opinion-forming, that shifts can occur towards perhaps the wrong parties.

Joubin Rahimi

Exactly, two thoughts on that first. First on the first point: for a while I was in America very frequently, and conferences were the typical reason. So before 9/11 and afterwards as well, and my first trip after 9/11. Well, I am from Hamburg too, I have a technical background. The name is Iranian. My father is Iranian. So I also have Iranian citizenship, even if I do not have a passport, you simply have it. And then I also got personal attention at the border, as I like to call it. And that was the moment – it was annoying, it was a few hours, it is not nice. Funnily enough, everyone travels afterwards, and I would bet I am simply in some Palantir-type system where you are monitored – it was totally smooth. The people do not even ask anything, either automatically or at the counter. And I know other people who were not there or who are more or less just German, that is, do not have this background, they go through a longer process, and I would assume, I do not know, I would assume that background checks are simply running continuously. And I do not think that is bad or good.

Joubin Rahimi

That is simply how it is for now. That is how they protect themselves. I find that – I can even understand that well. On the other hand, and now I come to the point of “exploiting all of this”. You can of course say the state can exploit it, as China does towards certain ethnic groups, but parties exploit it too, individual people can exploit it as well, and I find that really difficult, because especially with the mix with AI, where you can generate content automatically, with the possibility of specifying microtargeting through AI and data collection as well, you can very deliberately look, with little use of resources. So almost anyone can look closely at which messages to play out to whom, especially on Insta or TikTok, and how to target the whole thing and how to influence entire population groups through bot farms in the end. Now we are on a completely different level, that is a really big topic. Sure, companies can do that for themselves and their products too. So, Valentine's Day, Mother's Day, Christmas. That started even earlier. Sugar is healthy, fat is harmful. We know all of that too, but it has become much more subtle. And that is something where I have the feeling we should start with children, so that they learn that these messages are not always genuine, and not only genuine, genuine …

Joubin Rahimi

By genuine, genuine I mean: these are genuine messages, but the content is not genuine. It is not written with a genuine, clean intention; rather, the outcome was already fixed and then things were moved towards it. So, we are living in exciting times. Are you also active in that context? So still from the old CCC days, so to speak. The CCC has also changed a bit, warning about the electronic health record before it went online, already hacked.

Christian Bennefeld

Yes, so I think let us start with the last topic. The CCC has changed a great deal, from the very nerdy thing back then – and we were, I do not know, maybe 100 people in the CCC, a very small circle – to a large conference with several tens of thousands of participants by now, which takes place here in Hamburg. It is still a bit nerdy, but it has become considerably more professional, and the focus has of course shifted a little from earlier: come on, let us swap a few passwords and a few how-tos on getting into this or that system, more towards an institution that warns about changes, and about technological changes in society in particular, when those technological changes are perhaps not so well made from a security point of view, like the electronic patient record, but also like many other things that the CCC or people in the context of the CCC uncovered. So in that respect, I think the CCC is fantastic, the achievements that are made there. But I want to come back once more to what you said earlier, because I was in the USA for a year too, building up the subsidiary for a German software company, and even though my name is Bennefeld, which many people do not know, I also have two citizenships: I was born in Venezuela and also have Venezuelan citizenship, and it actually happened to me on every domestic flight that I always had, at the bottom of the boarding pass – back then it was still paper.

Christian Bennefeld

SSS. Exactly, triple S, special security screening. I then asked – you know it too, right? Yes, of course. I always had triple S at the bottom. Then you have the privilege of being able to skip the long queue at the normal security check and go into the somewhat shorter one, but in return you are examined a bit more closely, right down to wiping the iPod that existed back then, to see whether I had explosives or drugs or whatever on it.

Joubin Rahimi

Drugs? Venezuela means drugs, obviously. Yes, yes.

Christian Bennefeld

With my long hair, which keeps getting shorter, all the more so. Must be a hippie who probably smuggles drugs from Venezuela. No, but the same thing happened to me, and I am somewhat on your side and also on the side of the American security authorities. Security is important and screening at that point may have to happen to a certain degree. It becomes dangerous, as in what you also said in the middle part, when companies or individual people take advantage of it and turn it against the people affected, against the individuals. And I actually deal with that a great deal, especially in this AI environment. There is a lot of new research there. For example, I find one piece of research from the ETH in Zurich very, very exciting. Under LLM minus Privacy.org, anyone can take a look at this study and try it out for themselves. I do not know whether you know it. Totally exciting. They took anonymous Reddit forum posts. So there, where on Reddit you get something like hasimausi27. I have no idea whether that is a man, whether that is a woman, how old, from which country and things like that. And they took this data from 500 authors.

Christian Bennefeld

All anonymous data, nowhere recognizable where these people actually come from, and then on the one hand they set humans on it to try to derive personal characteristics from it. Namely, how shall I put it, what status: are they married, are they single? Do they have a family? How many children? Where do they live? What household income do they have? Where do they work? Where do they go on holiday? Et cetera. So a great many personal characteristics through which – data protection people who look into this a little know this – individual citizens can of course be identified immediately. And the humans actually did quite well at that, but of course it took them a great deal of effort. They ran a test with students who were supposed to implicitly derive these characteristics from the forum posts. And they did the same with an LLM, that is, with a large language model along the lines of ChatGPT. ChatGPT was among them, but also open source models. And the point is that the AI was just as good in all cases, or almost as good as the humans – I believe it had a hit rate of over 90%. But on the cost side, and that is what I wanted to say, of course a fraction. I do not remember what the factor was, but there were orders of magnitude between the costs and the time an LLM needs for it compared with humans, of course.

Christian Bennefeld

That is where it starts: if I can suddenly generate personal data out of data that is actually anonymous, then things get difficult. Or there is also Kosinski – and then I will stop bothering you with all this – but there is Kosinski, the person who ultimately developed the algorithms behind the Cambridge Analytica scandal. Namely precisely for microtargeting; he is very interested in subliminally influencing people, and he did something very interesting. Using AI as well, he ran an analysis: can I derive political orientation from a standard facial portrait alone, one looking straight into the camera? And yes, that works, and in a very, very good way. So I can determine political orientation with a very high hit rate – am I more left- or right-leaning? – from the facial expression, and not from a momentary one, but simply from a standard picture taken without a smile. And how shall I put it? The research is of course going further, doing that not only from a standard facial expression, but from anyone who happens to be captured out there in the street somewhere. And when everyone then knows what I would potentially vote for and can influence me on that basis, that does worry me a bit.

Christian Bennefeld

That really does go a bit far, and Kosinski is a clever man, you have to say that, and he does cool research. And there are a few more things in that direction which, I have to say quite openly, really worry me in the AI environment, even though I am also a big fan of AI. But I can also see the whole thing critically, I can also find a critical angle in it.

Joubin Rahimi

Yes, I think what is exciting is that AI … So, now, while I wanted to speak, for the first time. I say: with printing, with Gutenberg, knowledge was democratized. Before that it was only accessible in elite circles. With the internet, paired with social media and the smartphone, the distribution of knowledge was democratized, that is, also from one person to many people. That is how knowledge and information could be distributed, which again and again changes the landscape. And with AI, in effect, the generation of anything and the doing of anything is democratized – where before companies said, I will hire four employees there who do research and develop something, everyone can now do that within a certain scope with very little money. And because of that, of course, you can also use it harmfully, as you say. And I see the next step. I believe we will all have digital bots that then do things for us and protect us like a firewall against being read out so quickly. Although of course you always give things away. I have already given a few things away now, and so have you. But that is what we can control.

Christian Bennefeld

Exactly, that is what we did actively.

Joubin Rahimi

But the question is of course, within that construct, that does not go away any more. That does not go away. But that is how this relationship is. But that is, yes, I share that. It is really impressive how quickly things will change there.

Christian Bennefeld

Absolutely. I believe our perception of, how shall I put it? I think I gave a talk where I really wrote about it: the end of privacy. And there I listed exactly such tools and possibilities. That was already last year, where I went into research findings where you would actually say, I cannot read from your face whether you vote more right, center or left. But you can, with the help of AI. And that is what I find so astonishing. And there I think you really have to rethink, and I am curious whether what you just said will come. First of all, I am convinced that we will use AI assistants en masse. The topic of agentic systems is, so to speak, a big driver in AI this year. And of course there will be the good agents on the one hand, who perhaps do the optimal travel planning for me and book the hotels and do great things, but I had not thought at all about having agents – I find the idea quite exciting, agents that in turn protect me and my data and make sure that nobody perhaps finds out things about me that I do not want them to find out.

Christian Bennefeld

I had not thought about that at all. That is another exciting impulse. Really, absolutely. I find that totally interesting, because it may be something I could develop as well. No, I have founded enough companies, but no, I really find that a very interesting approach, to say: why does an AI not actually protect me from data being siphoned off? And which data is it that actually needs protecting? As I said, the facial expression – I have just grasped that here. Have you actually ever searched for yourself on ChatGPT? That is of course always the first thing you do. Most people do that on Google and the like too, first search for themselves. Yes, of course I did that right at the beginning, and if you search for my name today, then a phenomenon will probably occur. I do not know whether you have done it. Then ChatGPT refuses to say anything about me at all. Yes, exactly. Same with me. Same with you, and that was for the following reason.

Joubin Rahimi

No relevance, and now they have collected so much data that they apparently block it by person.

Christian Bennefeld

No, I actually filed a complaint, because I had the experience of asking ChatGPT: who is Christian and what has he done in his life? And then the answer came: he founded the company eTracker with X, Y and Z. And I do not know X, Y and Z at all. So the names mentioned there were not co-founders at all. Then I asked: well, has Christian founded any other companies? And ChatGPT says: no, that was the only company. Which is also not quite right. There have now been five in total that I have founded. And then ChatGPT went on inventing things. Apparently I had been very active as a consultant in the mobile and telecommunications industry. I have worked in many industries, but never in the telecoms and telecommunications or mobile industry. So really a lot of nonsense, and when asked about my father, the system tells me: “Yes, the father died in 2015.” My father is still alive today. So those were the points where I said: this really will not do. Now we have the GDPR, which also applies to ChatGPT, including the right to have corrections made to our data. But I did not even attempt it, because I know how AI works.

Christian Bennefeld

I cannot just quickly correct something. I cannot just delete the weight in the model that says Christian founded a company with Sven Walter, that was his name. As I said, I do not know any Sven Walter. I cannot delete that. So what did I do? I directly prohibited ChatGPT from further processing and further distributing my data. That took a while. I do not know whether it is back in the current version. It sometimes still worked if you asked in a roundabout way and said: so who founded eTracker? Or who founded eBlocker? And do not go directly for the name but approach it implicitly. Then you still got answers from ChatGPT. However, I have to admit I have not checked again in recent months, but I was told by people who tried to get out of ChatGPT – as it may be called today – what ChatGPT knows about me, that ChatGPT refuses to say anything at all about me. And that is how it should be. But that is deliberate, so to speak, and also good, so that …

Joubin Rahimi

Funny. eTracker was founded in the year 2000 by the computer scientists, Christian Benne - I cannot generate a response. Done.

Christian Bennefeld

That is obviously a “post-generation filter”, so to speak. That means that after generation the first filters kick in and hide again what may already have been written, or interrupt it somewhere. That is quite interesting, how ChatGPT tries to get this problem, or compliance with the General Data Protection Regulation, under control. I find it at least a very exciting approach. It gets interesting, of course, when people who now perhaps – Christian, I know only one other Christian, and I am not even related to him, he is Vice President of Ricola, the cough drops from Switzerland. He may now find it really annoying that Christian is blocked. But now I am thinking about what happens if an Adolf Hitler decides that he would prefer to be found less on ChatGPT, or a Helmut Schmidt – names that probably exist several times over. Then of course we have a change in our historical perception, perhaps in the future with AI. There I do not know how that will be solved by OpenAI and the like in the future, when more such blocking requests come in from people who have a less unique name, I would say.

Joubin Rahimi

I am curious about that. That will be exciting. Mine is very unique too.

Christian Bennefeld

Yes, absolutely.

Joubin Rahimi

I just checked in parallel. Now it even gives something out, with the question: what did I found? If I only entered my name, it refuses and gives out no information.

Christian Bennefeld

ChatGPT has of course changed that, because they of course notice that when you search for people, personal data is potentially processed and output, and then they are of course, in Europe with the General Data Protection Regulation – I do not want to say with one leg in jail, but facing a sanction, so to speak – and they are certainly worried about that. So I have noticed that too, that ChatGPT in particular, when I ask directly about people and they are not necessarily celebrities, I do not want to deny you that status, but …

Joubin Rahimi

I am not.

Christian Bennefeld

… are not well-known public figures, that then the statement is refused or it says: well, who exactly is that? Do you have any further clues? And even if you then give clues, not much comes after that. But with me it actually breaks off directly, as you saw too, and after that the chat is over as well. Then it does not want to any more. ChatGPT does not accept any more prompts after that.

Joubin Rahimi

Yes, exactly. Yes, quite exciting, and it will change again next month. There will be a new version again. We also have an LLM chooser, as we call it, where we compare the LLMs with each other so that customers can then say: this is important to me, for example: I want to use it for marketing, or for my area of responsibility, marketing or product data optimization, you could say, and also: how important is data sovereignty to me? And depending on how important, it plays a role: where is it? Who offers it? And could you also run it yourself in your own cloud or on your own machine? We are going to market with that so that you have a bit more choice and it is not always ChatGPT straight away. And I think Claude, what the French have built – or the French, well, what now comes out of France – I think, yes, is great to begin with.

Christian Bennefeld

You mean Mistral, I think, don't you?

Joubin Rahimi

Exactly. Yes, sorry.

Christian Bennefeld

Joubin Rahimi

Exactly.

Christian Bennefeld

Exactly, they are good. I think they are fantastic, and you also have to give the Chinese, how shall I put it – everyone complains a bit about DeepSeek. Because of course there is a lot of censorship in there too and the political opinion-forming of the Central Committee is reflected in it. But at the end of the day I think it is good that we are getting counterweights to the big American players, and we can see that not everything, so to speak, always has to – and here we are almost back to what we discussed at the beginning – not all good technology always comes from America. There is also a lot of good technology you can obtain elsewhere or, as you say, that you can also run yourself, in order to take a lot of conflict potential out of it, including out of the regulatory topic. I had a similar project last year as well, not with an automatism like the one you described, where it was also about a customer who, let us say, holds highly sensitive data – I must not say anything wrong about the customer – but for extreme trade secrets that he absolutely did not want to put into a cloud system, he tries to run as little cloud as possible. And the choice then actually fell on running it himself, because at that point in time there was no reliable data center in Europe for such AI topics at all.

Christian Bennefeld

In the meantime a few things have happened there too, but there I completely agree with you. There you always have to look – how does the saying go: to someone who only knows the hammer, every problem becomes a nail. So do not turn every problem into a nail, but look closely at which tool is actually right here for all the constraints I have to meet, and those can also be regulatory constraints or constraints regarding trade secrets or whatever. It is not always ChatGPT or Claude or Gemini. Sometimes there are good and in part simply much better alternatives than always reaching for the nearest and the biggest.

Joubin Rahimi

You have already thrown out one tip about what you can do. But maybe you also have one, two, three recommendations for our digital community in particular, which is really doing the splits. Mostly I have either an investor – very few are managing partners, they always have someone pushing, looking at the numbers and saying: more revenue, more EBIT – all the way to the CDO or the head of the e-commerce department. They are always doing the splits: what can I really do? How far do I stick my neck out? Do I go into the gray area or not? That is a question too. Versus: how do I achieve my targets? But maybe you have two or three approaches there where you say, you do not have to go into the gray area at all, because there are other great approaches in this construct, also with the eTracker knowledge and with the philosophy. This is not rehearsed, by the way. Let us see what you come out with.

Christian Bennefeld

Yes, so in principle I can only repeat to some extent what I have already said. I would always look at which service providers there are at all. So which tools, to stay in the metaphor, instead of always just saying: oh yes, there is the hammer, I have to take that now and we all take it. Instead, I would always look in a very differentiated way at what actually fits the current stage of development I am in, because the same tool is not always, how shall I put it, the right one for every maturity level of a company. And what I would really advise against is what you called the gray area, cleaning it up afterwards, because when the trouble is there and, in the data protection area, the supervisory authority is at your door, and only then do you start paddling and sweeping – it is not even the sanctions, it is actually the loss of focus on your own business that can be so severe, because you then have to act very, very quickly when the supervisory authority is there, so that you really start to skid and to some extent abandon your own core business. So I would always look, with good judgment of course, but I would try not to violate the regulations, in order to steer clear of conflict potential here, and to look at which service providers there actually are.

Christian Bennefeld

And in particular I would always look at whether I really need – especially when we talk about data, and it is mostly about data – which data do I really need? Not to go and say: I will first take everything I can get. That is the old and, in my view, completely misunderstood strategy of better to have than to need. Some people say that – first hoard everything and as much as possible. Instead, I would take a strictly restrictive approach and rather say: less is sometimes more. Which data can I actually act on at all? Which data is decision-relevant for my business, for my strategy, for my management? And that is where I would start, first building the minimum set and then looking at which data would also be interesting and how I could potentially process it within the regulations anyway and achieve my goals with it. But those would be the tips I always take as my approach, and always approach it with good judgment. So I would not go about it too dogmatically and say: oh dear, oh dear, none of this is allowed and everything is forbidden. On the contrary, you can do a very, very, very great deal, and I would not let myself be deterred by regulation at all, even if it is thick and looks intimidating.

Christian Bennefeld

That may be in the nature of the mathematician. He is not deterred by a lot of paper and things that look complicated anyway, but I really mean it: do not let yourself be deterred. It is all manageable and it is all manageable in Germany too. You do not have to resort to tricks and do something different under the hood from what you show on the outside. It can all be mapped out cleanly, and in case of doubt you have to bring in the right advice. If you do not have the knowledge in house yourself, you are well served to turn to one or another expert who also, how shall I put it, does not take a dogmatic approach and say: but you have to, and instead takes a rather pragmatic approach with a certain sense of proportion as to what is, as I say, sufficient for the respective stage of development you are in, let me put it that way, so that the business runs well and you do not spoil anything for the future. But always the greed – and I want to say this as the last point – always the greed to say: the others are doing it too and now I want it as well. From my point of view that is the completely wrong approach. Instead, look at: what can I do better by perhaps precisely not using the same tooling as the others? Because if in a car race everyone drives the same cars, sure, then it still comes down a bit to the driver, but then of course, how shall I put it, in the end it is a game of machines. But I believe that if I have chosen a different car and I know it has different acceleration or tire temperature or whatever, then I may actually be able to

Christian Bennefeld

Catch my competitor that way and accelerate at exactly the right point so that I even overtake him. So I would not always look too much at what the others are doing, but rather at how I can move my own business forward, what is relevant for me and how I fit that into the regulations, or classify it accordingly – that is how I would put it.

Joubin Rahimi

And that is a really nice closing note. Ask a professional with good judgment, and also: what are you doing all this for? I mean, I now have the feeling that people just collect, or have no plan at all, and then it does not help either way. This idea of saying: what do you need something for? What do you want to do? That already plays a big role, and I think that is simply a great pointer. Christian, thank you. If there are any follow-up questions, I assume we will happily comment away under the posts, and otherwise you are always available for direct contact, I assume, through the channels.

Christian Bennefeld

LinkedIn is always good, if I may interrupt you there, to stalk me. There are not that many Christians, apart from my colleague from Switzerland, and I always have an open ear for everyone.

Joubin Rahimi

Yes, you two certainly sound different as well, and he always has Ricola with him.

Christian Bennefeld

Probably. We actually only know each other via LinkedIn, but that is another topic.

Joubin Rahimi

Yes, then many thanks. Many thanks for the really entertaining talk. I can see we are already over an hour, and for all the insights. I am looking forward to us meeting in person some time, and that can happen, I am a Hamburg lad too and always happy to be there. So thank you for your time and all the best until next time, dear Christian.

Christian Bennefeld

Yes, thank you. Many thanks for having me, Joubin, and then I look forward to us meeting in Hamburg for a beer some time.

Joubin Rahimi

That is what we will do.

Christian Bennefeld

Great. Many thanks. Thank you.

Joubin Rahimi

Thanks. Bye.