Big Data, Plainly Spoken (aka Numbers Rule Your World)

Know your data 42: an indicator of attitude towards password security

News came out that Ireland fined Meta (formerly Facebook) $100 million for storing user passwords in plain text (link).

The mystery is why they did it. Why even a big tech firm is putting its users at risk by not securing their passwords. Storing passwords in plain text is in itself not harmful to users; the harm appears when bad actors steal these passwords.

The lack of password security is frequently a feature, not a bug, of our technology landscape. Meta surely isn't the only culprit; they happened to have attracted regulatory oversight.

***

Let's ponder an uncontroversial use case: a support staff member needing to access my user account in order to service me.

For example, I might have called the support hotline because I couldn't figure out how to change the email address in my account settings. As often happens, the support person clearly sees the same account screens as I while she is serving me. In reality, she has logged into my account so she could replicate the steps I told her I took, in order to figure out what I did wrong.

Further, after she solves the problem, she can relay to me in minute details which buttons to click, and what to do. These steps should replicate perfectly because she simulated these actions in my account.

Now, the question is: how does she gain access to my account that is protected by my password?

The simplest way is if the website stores my password in a database, and the support staff just fetches my stored password from the database and log in in exactly the same way as I would have.

This use case is one (but not the only) possibility why Meta and other websites store passwords in plain text.

***

Let's assume they don't store passwords in plain text but store them in some encrypted form (including so-called "hashed" form). In this case, the user authentication system accepts the encrypted or hashed password as input. If bad actors gain access to the database, they can log in as me, just like the service staff, so I don't think it makes much of a difference.

The difference is that if a bad person who has stolen my encrypted password wants to know my plaintext password, they would have to work hard to decrypt or unhash it but why would they need my plaintext password if they could just gain access using the encrypted version?

***

Instead of mimicking user logons, the website could provide separate staff access to user accounts so that the staff members no longer need to know individual passwords. But these staff accounts are effectively master accounts with master keys.

The risk has arguably gone up. If the bad actors steal the master password, it opens up all accounts. Meanwhile, the user passwords are still stored in the database in whichever format.

***

That's the way technology works. Providing service staff tools to service users adds pressure on security. Storing passwords in plain text is a convenient way to enable this feature. Other ways create other problems. Not storing passwords in plain text only reduces the risk slightly. I suppose it has a signaling effect - if plaintext passwords are stored, it may indicate the company's attitude toward password security.

 

 

Know your data 41: the lesser evil

Long-time reader Antonio R. pointed me to an article about Firefox, which is my preferred browser (link). Apparently, in a recent update, users were quietly opted in to a new tracking feature known as "privacy preserving attribution" (PPA). Since Firefox's brand is about anti-tracking, this discovery has unsettled many users.

There are two parts to the grievance. Aside from the PPA technology, a second issue is the use of opt-out, rather than opt-in. The opt-out tactic has long been adopted by tech companies to force users to do as the companies want; and certain segments of users, such as Firefox users, are unhappy about it.

***

Let's talk about cookies first. It was originally a simple technology used by websites to remember user details so that the Web experience can be customized. For example, if a website pre-populates your user name when you attempt to log in, it's because it has stored your name from a previous log-in in the cookie (which is just a document).

Later, the Web was commercialized, and all the free things we get on the Web are funded by advertisers. The advertisers then seize on the cookie as a way to target people, since the cookies contain information about individual browsers. (Eventually, the websites that charge for things also adopt the same tracking technologies.)

For example, an advertiser could store the number of ads they have shown to me in my cookie. Each time an ad is sent to my browser, a counter in the cookie is incremented. When the count exceeds a maximum frequency, they stop sending me ads.

This use case is beneficial to the user, as it encodes the rational concept of diminishing returns to ad impressions. I don't need to see it yet another time. But most of the time, the advertiser is using the cookies in more offensive ways. One example is tracking past behavior. The cookie can store which ad you have clicked on, so that the next time they see you, they send you another ad that they think will make you click and buy.

Recently, there has been some momentum to get rid of cookies. The idea is to allow advertisers access only to aggregated data. This requires some way to define groups of users, and some way of classifying each user into one (or perhaps more) groups. Then, instead of the advertiser reading cookies to obtain individual data, it would read group-level data collected by the browser.

Over time, the browser has become another store of user data. Google, which owns the Chrome browser, has been doing it forever. So has Microsoft through its Bing browser. Recall, above, the original use case of cookies, that of storing user account names so that the users do not have to re-enter each time they log on. Over time, the browsers have taken over this feature - this is why the browser asks us for permission to remember the user name (or passwords, etc.).

If the user allows the browser to store user names, then any website the user logs on to can grab your user name from the browser's storage, instead of the cookie.

And yes, this makes the browser developer a holder of our personal data - which is one of the main reasons why data-famished Google and Microsoft started making browsers.

***

Now let's get back to the nice idea of not sending individual data to advertisers but sending aggregated data. Advertisers of course hate this because they believe deeply that the more granular the data, the better is their targeting. This story has made little sense from a statistical perspective from the start, but it's one of those fallacies that persist. It's an example of Kahneman's Law of Small Numbers.

Advertisers, generally speaking, may want to sell you the thing you're shown interest in, or some other things you're not aware of, but could be interested in. The latter is called cross-sell, and usually, cross-sell is supported by data from other customers like you who have done something you haven't yet.

For cross-sell, the natural thing to do is to place you within a group of customers who have similar behavior. This is the aggregated data. For regular sales, if they are chasing after you because you have clicked on two or more big-screen TV ads in the last week, it should make no difference whether they get the information about you specifically, or about you as part of a group of customers who all have clicked on two or more TV ads in the last week.

I can't speak to whether these advertisers have other use cases which require individual data but the marketing use case should not require it.

Here's the catch, and the real source of the controversy.

***

Someone has to do the aggregation. Aggregation means taking individual data and classifying people into groups. It means defining what those groups are. Someone has to do it.

Whoever does it must have collected individual-level data. So who do you trust to do this aggregation? At this time, I'd still trust Firefox, more than any of the following: Google, Microsoft, advertisers, "third-party" data aggregators appointed by advertisers whose only customers are advertisers, etc.

In my view, this backlash against Firefox is part of a fight to control our personal data. Firefox probably annoyed many of those big players because they may lose control of some of the data.

***

Another possibility is that Firefox attracts all of the people who are most sensitive to invasion of privacy, and they are looking at the issue in an absolute, rather than relative, sense. Thus, in the original article, they said:

In this sense, Mozilla claims that the development of “privacy preserving attribution” improves user privacy by allowing ad performance to be measured without individual websites collecting personal data. In reality, part of the tracking is now done directly in Firefox. While this may be less invasive than unlimited tracking, which is still the norm in the US, it still interferes with user rights under the EU’s GDPR.

By this worldview, they would throw out the baby with the bath water. Browsers would no longer remember anything from the past, so every time we log on to a website, we would have to re-enter all information. Also, advertisers would know nothing about users between browser sessions, and thus send even less relevant ads.

Given that advertisers pretty much pay for most of the free stuff we get online, it's hard to imagine that a company like Firefox can survive if it takes an extreme view on advertisers.

It's actually a miracle that Firefox is alive. The big advertisers can simply work with the advertiser-friendly browsers like Microsoft Bing and Google Chrome. This has already led Google to dump its previous effort to move away from cookies. The current controversy reflects one of the reasons why Google failed: if Google runs the new aggregation technology, it continues to hold all of the individual data; it consolidates its stranglehold on the data further since other parties like advertisers will no longer be able to get individual-level data!

***

Let's also parse this bit:

In reality, this tracking option doesn’t replace cookies either, but is simply an alternative - additional - way for websites to target advertising.

One part of this is surely true... that the PPA technology cannot replace cookies completely. I hope that it could replace cookies as it relates to advertisers, though. PPA can't replace cookies because it would fail at the original use cases, such as remembering user account names, for which the websites need individual-level data.

***

What PPA actually is (link) is something highly limited. It certainly can't replace cookies completely. It addresses a single use case for advertisers, i.e. "attributing" user purchases to ad impressions.

It's doubling down on a highly dubious analytical framework, which I have critiqued in the past (see this post).

Advertisers place ads on third-party websites such as Facebook and New York Times, which drives traffic to their own websites, from which visitors may make purchases. The purchases (outcomes) are wholly visible to these advertisers since the transactions occur on their own websites. However, their ads show up on third-party sites for which these advertisers don't have visibility. To work around this, they store information about which ads have been shown to a user in a cookie. So when the user makes a purchase, the advertiser can look inside the cookie to determine if the purchaser has previously been shown an ad.

Attribution, to say it bluntly, is the act of turning temporal correlation into causation. A typically attribution rule is if there exists an ad "view" within X days of a subsequent purchase, then the first such ad is regarded as the "source" of the purchase. More "advanced" attribution would dole out credit to a sequence of prior ad "views", rather than the closest one.

I put "view" in quotes because in this industry, a "view" is the same as an "impression" which only means that some server attempted to deliver an ad to a user. It does not imply the user has "viewed" the ad. It does not even imply that the ad has fully loaded.

PPA moves these analytically-challenged computations to the browsers (actually, to third-party "DAP partners"). PPA groups users by which ads they have been shown, and returns the aggregated count of how many users made purchases (or other desired actions) subsequent to those ad "views".

It solves the simplest problem marketers care about but they want more information, such as the demographics of those who made purchases, the time lag of action, etc. If the advertiser is more serious about causal inference, they recognize that such data must be combined with other data sources (external to browsers) to yield a better attribution model - customers could have been influenced by other marketing channels (emails, TV, etc.) instead of online ads!

So I agree that PPA can't replace cookies right now. With future developments, it might come close. But inevitably, the data collection duties would have shifted from advertisers to browsers. That's why there is a lot of resistance to change.

***
Now back to the other issue of opt-out. I think the reason why Firefox decided to implement PPA by default while offering opt-out for users is that if most users are not part of PPA, then it is dead on arrival.

I hate opt-out. In this case, if we take the perspective of whether the world with PPA is better than the world without PPA, then there is an argument that it might be. If we take a purist perspective of whether PPA solves the unwanted user tracking problem, then PPA is definitely not the answer.

 

 

Know your data 40: when they know where you are

It's finally happened. A big company said the quiet part out loud. PwC, the behemoth U.S. consulting company, is using surveillance data to monitor and flag employees for violating its "back to office" policy, according to a news report (link).

The article concerns the U.K. office. There are some possibilities:

• this is a pilot program, eventually to be implemented worldwide
• other locations may already be doing it but quietly
• other locations may have the same policy but the reporter focuses only on the U.K. office

***

What we're learning is that PwC has the surveillance technology in place to do this, and at least one management team has decided to exploit it to encourage compliance to the work in office policy.

According to the article, staff will be sent a report that documents their work locations. If an employee fails to be in the office three times a week as required, the manager will want to "understand" why.

***

This news reminds me of schools that have forced students to install apps that follow them around. See this previous blog.

 

 

Dead people, fake obituaries, and ad fraud

My friend Augustine, who's an expert in ad fraud analytics, sent me to this investigation by Verge, which is highly illuminating about how digital advertising attracts all kinds of unlikely fraudsters. The story involves dead people, faked obituaries, and advertisers.

***

Some people are discovering faked obituaries of their dead relatives online. These are AI-generated text, with partially correct information. Automatically generating such obituaries is possible nowadays as it combines two tech developments: the collection of data by apps and businesses, and the merging of such data with impunity. Starting with a list of newly dead people, a developer can obtain private information from any of the numerous companies that sell compiled profiles on everyone. Such information is only partially correct since data merging is inexact. In addition, large language models make up facts.

What is the point of producing fake obituaries?

Let's start with the digital advertising ecosystem. Let's say the local newspaper has a website (or mobile app) on which they publish obituaries. This digital newspaper is likely to use the only one business model that has been proven to work - advertising revenues. Advertisers may want to put ads around the content of their site, hoping to influence the site's readers. So, the first thing the newspaper management has to do is to generate traffic to the website. If the site had no readers, there will be no ads served to anyone.

This is where Google comes in. Google has a quasi-monopoly of search traffic so it can deliver traffic to the local newspaper. For example, someone may google for an obituary and land on the newspaper site. The newspaper managers can boost traffic to their site by paying Google to buy "keywords". Let's say they buy the keyword "obituary". Typically, the newspaper site pays Google by clicks (i.e. the action of clicking on a results link on the Google results page and landing on the newspaper site). Google thus has an incentive to send more traffic to the newspaper.

Next, the newspaper managers need to find advertisers. Instead of selling directly, they can also talk to (another division of) Google. Google will then develop relationships with advertisers, and then based on the amount of ads served to the newspaper website, share a proportion of the advertising revenue with the newspaper. Notice that Google double dips here, and it has every incentive to push lots of traffic to the newspaper which allows lots of ads to be shown.

***

The ecosystem has been seized upon by scammers. All scammers have to do is to put up some websites, then use google to push traffic to these sites, then put up some mildly relevant content (tuned to the search keywords), then surround the content with ad slots, then use google to push ads into those slots, then get the revenue share from google.

In the case of these fake obituaries, the websites that carry them make bank whenever google drives traffic to those pages. (Google also makes bank in the process.)

A key part of this ecosystem is automation, which removes the human from the process. Removing human participation also removes human scrutiny. Most advertisers won't be able to tell you where their ads were shown. The Google network delivers ads to so many properties, large and small, it takes a lot of effort to get and answer to that question.

Know your data 39: everyone's doing it

Techcrunch did an investigation which uncovered that USPS (US Postal Office) is sending some private data of customres to social-media sites.

This news concerns USPS's "Informed Delivery" service, which allows customers to view images of their parcels en route. The website uses "tracking pixels" by companies such as Meta, Snap and Linkedin. So when users log on, the website requests the pixels (tiny images) from the servers of those companies, and in so doing, it is instructed to send data over. Techcrunch found that the data transmitted include physical addresses, user ids, computer and browser versions, etc. Those social-media companies then use the collected data to service advertisers and other partners.

***

I'm glad Techcrunch brought attention to this type of data collection. It's a bit odd that they single out USPS which is a government agency for having these tracking pixels. Pretty much every website we visit has these pixels, if they have any relationship with those social-media companies. For example, if you schedule a doctor's appointment online, if the web form has these pixels, everything you type into the form might be captured by those companies.

When you visit a site, there may be a popup asking your approval for sharing data. It would say something like we work with [insert some large number like 948] partners. That tells you how prevalent this sort of thing is. If you haven't seen these pop-ups, your browser probably accepts everything.

It's also odd to point the finger at the USPS developers because it's the social-media companies that want the tracking, and they are the ones who direct the behavior of those pixels.

Know your data 38: the script of the data leak theater

Every American has now watched the same script in the same theater several times. You know, when yet another big corporation announced that they have lost customer data that should be private. Then, after much delay, they publish some legally-vetted mumbo-jumbo, which contains a lot of words but nothing useful. (The latest example is this masterpiece by AT&T.) This is a script without plot or character development: indeed, in this theater, all characters remain nameless, hidden from the audience, not even on stage.

The script will definitely say that they have notified customers (for AT&T, over 100 million!), which is akin to the security company sending you a note after a burglar took everything from your home (and all your neighbors). The security company will have washed their hands off of this fiasco by sending such a note while accepting zero legal, or moral responsibility (such is our politics!). The note will turn congratulatory, like a script needing a happy ending: it will let customers know they have been involuntarily enrolled into some third-party's credit monitoring service - which, mind you, does not promise to stop further theft, rather that they would also notify you after another burglar cleaned out whatever still remains in your home.

Think twice about that for a moment. It would have been hard to live in the U.S. without having already been enrolled in such a credit monitoring service due to prior data leaks. So, one of the following two scenarios applies to the recent case of AT&T: either the credit monitoring service notified the customer of the AT&T leak before AT&T did, or AT&T's note arrived first. It almost surely can't be the former since the entire post-leak operation is so carefully scripted - this just shows why the credit monitoring service is lip service: it is as if the home owner's association is sending a note to your emptied home, after the security company's note has already landed.

After the year of "free" credit monitoring is over, you realized that you have become a prospective customer of the credit monitoring agency. By this one act, AT&T has transferred the contact information of 100 million customers to some third party - to the absolute delight of the marketing division responsible for generating sales leads.

***

Here are some of my working assumptions about data leaks that I want to share with you. (They aren't in the official scripts, of course).

• If my data exist in any server not under my control, they have been, or will be stolen. If any of my data reside in the cloud, they have been or will be taken. If any business secretly moves any of my data (held on my devices) to the cloud, they have been or will be leaked. If I use any cloud-based services, what I do there are effectively public - regardless of logins, passwords, authentication schemes, encryption, https, or whatever other cosmetic countermeasures.
• Whatever you think these businesses know about you, they know more. (For example, when AT&T claimed the thieves didn't take contents of calls and messages, they have tacitly admitted that they have records of the contents. You might recall that some time ago, they denied that they held such records, claiming that they only gave our government access to "metadata" i.e. who called whom, in those controversial domestic spying programs.)
• Most (probably over 90 percent) of all data leak incidents have never been detected, and therefore, are not known or reported.
• The harms of these data leaks are inconspicuous. Thieves sell the data to others who use the data to influence our behavior or take actions (such as setting your healthcare premiums). By observing the actions taken, and/or their outcomes, you can't infer the source of the data. You almost never get a straight answer for what data were used (trying asking OpenAI what they used to create ChatGPT!) Because the dots can't be connected, we are vastly underestimating the harms of data leaks.
• If our data security were finally improved, then we should notice technologies becoming more inconvenient and less efficient. Conversely, if new technologies are more convenient or efficient, our data security has been further compromised.

 

 

 

 

A paradox of big data

One of the challenges in the age of big data is having too much information. Information paralysis. Not enough time to look at all the data. Too many contradictions in the data. And so on.

***

But there is something else that's been bothering me. The more information is collected, the less data we have at our disposal. This is a paradox of the big data age. What many of us face is not actually too much information but not enough data, and not the right data.

I have many examples of this paradox. Let me focus on one recent experience.

Recently, I tried using the OMNY card to ride the New York subway. This is a new card technology that will eventually replace the iconic swipe cards. It's a chip card that you place on a screen and if ithe transaction succeeds, the screen's border lights up green and you walk through the turnstile. The first time I used it, the green light didn't come on so I attempted again, and then the green light appeared.

At that moment, I realized that I wasn't sure if I was charged once or twice. Do I know fore sure that the first transaction didn't succeed? Other than the green signal, the new technology gave me zero information.

Contrast this with the existing swipe cards: for every successful swipe, the display indicates how much was charged, and how much stored value still remains in the card. The former confirms the transaction while the latter helps me plan when to refill the card's value store.

With the OMNY tech, I just have to "trust" the system.

The next day, I transferred from the train to the bus. According to the rules, the second leg should be free, since the transfer happened within a few minutes. With existing swipe cards, the display confirms immediately that I have used a free transfer.

With OMNY, I had no idea: the screen sent the same signal – green light – as for a paid trip.

I later checked the stored value on the OMNY card. I was indeed charged twice on that first trip while the transfer was not charged as expected.

***

What's the paradox? A lot more data are being collected by new tech, and yet users are provided less information than before.

This isn't hard to explain though. Businesses are aware that information has competitive value, and they are hoarding the data, even hiding them from the data's owners (you and I).

Privacy for me not for you

Two years ago, I described the saga about the college kid who put up twitter feeds that track private jets, thus revealing their movements (link). I said: "The right not to be tracked is poised to become a civil rights issue."

This prediction is one more step closer to becoming true, based on Business Insider's update on this saga. Apparently, hidden inside the FAA reauthorization bill is a provision that lets private jet owners obscure their tracks.

Who owns private jets? Not the average citizen.

By default, citizens will be afforded zero privacy, while the super-rich and well-connected will buy privacy from the politicians. That's where we're heading.

Jack Sweeney's jet tracking stunt is a precision-guided bomb, targeted at the private-jet class. It exposes the hypocrisy of tech leaders.

***

But such laws can't stop engineers from getting what they want.

Famously, Elon Musk banned Jack Sweeney's twitter feeds but he just moved his feeds to a twitter competitor.

Jack already has a response to the new law. "We can still figure out who's who via context clues."

These tech CEOs will discover that they couldn't escape the data-hungry, privacy-busting tech infrastructure they brought to our world. What are these context clues? Their homes, for example, are not easily disguised. The make and model of airplanes. etc. It may take more work but the determined engineer can figure it out.

***

When Eric Schmidt was CEO of Google, he infamously said "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place." (link)

The same Eric Schmidt some years later got into the military drone business, and he sang a different tune: "You're having a dispute with your neighbour. How would you feel if your neighbour went over and bought a commercial observation drone that they can launch from their backyard. It just flies over your house all day. How would you feel about it?" He was calling for a ban on civilian drones (link).

As far as I know, he has not retracted his earlier statement.

 

 

 

 

Waze user saying

Mark, a long-time reader of the blog, and fellow blogger, put up an interesting post about his experiences using Waze (link). He describes a gradual realization that when Waze sends him down some strange, indirect paths using side roads, it may simply be messing with him.

Not surprisingly, his first reaction was that Waze knows something he doesn't. This is the obvious value proposition of any navigation assistant: we think such a product should be utilizing information about road conditions that a driver inside a vehicle doesn't have. An assistant with better information can do better than a human driver. Therefore, if the traffic around Mark looks light, and yet Waze directs him to exit the highway and get on a side road, it must know something Mark doesn't. Perhaps there is a crash up front that resulted in a pile-up.

Eventually, he tried ignoring those impromptu diversions, and stuck to the main highway. He said: "I discovered that in pretty much every case, there was no slowdown, my original time to arrival remained more or less accurate, and I almost certainly would have lost time doing what I was told."

Mark wondered what the algos are doing. 

***

I don't have inside information about Waze's algo. However, we can still try to understand the possible causes of such inaccuracy.

The first possible cause is poor data quality. If Waze has bad data, such as road closures, traffic jams, and so on, it will make the wrong decisions.

Another cause may be bad prediction. It may not be obvious but any observed data (about congestion) are about the present. The routing problem is dynamic. The algo has to predict what might happen when the vehicle reaches some road segment up ahead in the future. It has to make decisions based on not just one vehicle but also all other vehicles in the vicinity. If these predictions are inaccurate, then the algo will suggest the wrong thing to do.

Not only must the algo predict the future trajectories of vehicles it knows about, it must also predict the appearance of new vehicles of which it has no present knowledge. It also must predict the timing of disappearance of existing vehicles from the road. In other words, the algo is making a ton of predictions, many of which may be inaccurate.

Another source of uncertainty is driver actions. The trajectory prediction problem transcends modeling the physics. A vehicle on the highway is not like a bottle floating down a river. Drivers make decisions that change their trajectories, perhaps drastically. These decisions may have been recommended by other navigation assistants. So a good trajectory prediction algo has to anticipate what other drivers might do.

I'm describing a rather complex model. But the modeler faces another challenge, the limited amount of time during which all computations must be completed and an action is suggested. Any workaround to reduce computational time is likely going to make the solution worse.

***
See also my prior posts about validating Waze's predicted time of arrival, from another friend who ran an experiment.

 

 

Know your data 36: the what and the why

In the unlikely place of a food blog (link), there appeared a feature article about restaurant data science, which provides a rare glimpse of the ins and outs of the data collection business.

The article describes pretty basic elements of data science that have been used by other industries for a while; evidently, restaurants have been reluctant to join this game until now.

***

Right from the start, the featured company is described as "stealthy." This description has a double meaning – it's a "stealth startup" although given the number of important restaurant groups mentioned in the article that already use its services, it's unclear whether this sense of "stealth" was what the reporter intended; the other meaning is that the company collects data "stealthily" and works behind the scenes with restauranteurs. I have never understood the secrecy in the data collection business when the industry leaders insist that they utilize the collected data strictly for the benefit of their customers – recall the recent fallout over Wendy's announcement to adopt adaptive pricing (link).

Perhaps these data collectors won't voice what they know, which is that raw data aren't all that useful. There is a question that lingers in my head as I read through the article: can we have at least one clear statement of the benefits arising from the collected data?

The article begins with what must be the elevator pitch of SevenRooms, which is portrayed as a leader in data collection and analytics in the restaurant space.

"Let's say you're dining at Lure Fishbar in Soho on a weeknight for dinner... kicking things off with a bottle of Champagne. As it turns out, without even going over to your table, owner... and managers know what you and and your tablemates are spending in real time, as you're spending it."

This leading paragraph is a bit anticlimactic. Restaurant managers have always known which table ordered what, and whether the table is a big spender – even without deliberate data collection. And the reporter didn't answer the question: How does SevenRooms utilize such knowledge? How do these actions benefit the diners?

"Based on your previous visits to any restaurant in the Mercer Street Hospitality group... they know your dietary restrictions and your wine preferences; how often you've visited...; how much you spend on average, per night, and per year."

This sentence also focuses on the what, but not the so what? Let's think this through.

What extra service do frequent diners get? Do the waiters come by more often because I'm a frequent patron? Compared to the prior state, does total service effort increase because more service is rendered to frequent patrons? Or is total service level fixed, implying that the waiters visit low-frequency diners less? If total service effort goes up, are waiters paid more? If so, does the manager expect that the higher service effort will induce frequent patrons to spend more money, thus paying for itself?

***

Next, let's consider the nature of data such as "wine preference". What SevenRooms actually possesses is the history of wine orders for each patron at the subset of restaurants that use SevenRooms, from which the diner's preference is deduced. The accuracy of this deduction depends on the individual. Some people may like only a single type of grapes but others may want a particular vintage from a particular winery of one type of grape if they order a particular dish at a particular restaurant but another vintage from another winery of a different grape when eating some other meal, and so on. If all those factors are included in the model of wine preferences, and we desire accurate predictions at the individual level, then we'd need quite a lot of data for each diner, beyond the amount that SevenRooms could have amassed.

From this discussion, you should realize that "wine preference" information is only useful if (a) the restaurant group is relatively large so it can capture most of the diner's wine drinking; and (b) the diner attains some threshold of loyalty to the restaurant group.

We have encountered this data science application before. Your Netflix movie recommendations won't hit the target if (a) you do a good chunk of your movie watching on other platforms; and (b) you've watched (and rated) only a small number of movies on Netflix.

***

Let's pretend that SevenRooms actually has a good model of people's "wine preference".

For a one-grape patron, it's easy to get "wine preference" right, and I'm sure the managers would have gotten it right, with or without data collection.

In the other extreme, a good wine list may have many wines that fit with a diner's history, and should the restauranteur impress the diner by sending the top recommendation - in lieu of the wine list - to the table? "Here's your wine for the evening. (And don't you dare say no)." If the restaurant doesn't send the wine directly, but arms the sommelier with the recommendation as an ice-breaker, is this materially different from the status quo?

***

The reporter gets more and more confused about the benefits of SevenRooms's data as she issued more words. The data could seemingly solve world hunger. The following miracles were mentioned:

"data can be key in the battle for luring diners"

"using customer data to tailor menus"

"should you choose to splurge on that $3,000 bottle... all hands on deck, with every manager getting an alert"

"can parse seating arrangements so that some tables are earmarked for Resy, some for OpenTable, ..."

"steps up service for VIPs"

"using it to plug and play among various reservation platforms quickly and on the fly"

"stitching together historical information on... needs and guidances"

"plotting tables on the floor plan to optimize the flow of service"

"tracking a table's stage in their dining experience"

"quote wait time"

"automated email campaigns"

keep track of which restaurant reservation channels are responsible for sending restaurants what numbers of diners

let restaurants send automated Priority Alerts to their most valuable guests about availability

"helps restaurants reward their most valuable guests to get them through their doors most often"

run a loyalty program "behind the scenes"

"improves customers' experience"

"and much more"

For each of these presumed benefits, one should consider how it changes the revenues and costs of the restaurants, whether the collected data really provide reliable insights to drive these actions, and how will the restauranteurs learn whether they yield the expected incremental gains.