🌐 Fireside chat with UN B-Tech

Hello. Welcome to Cloudflare TV. My name is Patrick De. I'm part of the public policy team here at Cloudflare in Washington, D.C. This morning, I am thrilled to be joined by Lita Wendland. As part of Impact Week here at Cloudflare, Lita is the chief of the Business and Human Rights Unit at the Office of Human Rights. She also directs the VTech project, which we'll talk about today, is an initiative that I'm thrilled at Cloudflare gets the chance to participate in. So, Lena, welcome. Thank you so much for being with us this morning. Thank you, Patrick. It's a great pleasure to be here. So we had we were chatting just before we came live a minute ago. And as someone who for those in Cloudflare and other places, one of the things that our team, the impact team does is we handle a lot of our internal human rights work. So using the UN guiding principles on business and human rights and implementing those into our operations. Lita was just mentioning and a point of personal privilege, just because I'm incredibly interested, you participate in sort of the drafting of the UN guiding principles and really for the first time, for those who are familiar, sort of integrating formal UN human rights requirements for entities in the private sector and businesses. And I'm sure you describe it more articulately than I will, but I would love to sort of hear about your experience sort of going back in time to that moment and sort of what stands out for you in your memory about where we are today. I thank you. Yeah, I know it was a complete serendipity. I was I had just started in the office of the UN Human Rights Office, coming from a very traditional human rights legal background. And human rights are really something about states. But in the early 2000s, there was a beginning recognition that maybe the human rights system that we had, the architecture that had been created since the Second World War, the Universal Declaration on Human Rights, states not sort of committing atrocities and violating the rights of people, that maybe there was a gap in the system, actually, because increasingly companies were recognized as someone who, aside from being able to do very positive things for human rights, also could do harm. But we didn't really have a framework to to address that or any clarity around what was expected of companies with regard to human rights. So it was a new human rights area. No one else in the office. I can say that we're particularly interested because business, this was something that was out there. So I was as the newcomer put on that file and had the great honor and privilege to work with the late Professor John Ruggie, who was appointed special representative of the UN secretary General, to sort out this issue, to sort of how do we bridge that gap in the in the human rights thinking? And so six years I spent with John on his team and consulting widely with widely across the world and with companies and other stakeholders, states and civil society. And he came up with the guiding principles and it was a real, really thrilling process to be part of that. But also in the 11 years since they were adopted to be to be promoting their implementation and help companies come to terms with what it means for them. So would your take you on a task of sort of that size in a completely unexplored intellectual area, both in terms of human rights law and the practicalities of sort of how businesses interact with the world separate from governments? Where do you start? I mean, how do you sort of is it is there a drafting discussion? I my previous life in government, I always turn to the drafting, but is it sort of a listening tour? Like what was that? Do you remember sort of what was the first sort of thing to get the wheel moving? Well, I remember it very clearly because there was actually at the time there had been another effort of a very traditional human rights approach. So there was a draft treaty, actually that had been developed by a group of experts at the UN that basically would have created the same duties on companies as states. And states just didn't like that. Companies absolutely hated it. So the first thing John, was to say, we need to start completely from scratch. So he threw everything out the window and really started as you saying, the listening to us. But the other thing that was important, I think, was that John Ruggie wasn't a human rights lawyer. And I think that was probably the greatest gift to the process. He came he was an international relations scholar and he understood that governance, power, you know, leverage, you know, what what affects societal change on a global scale. And he invested in that. He didn't come from a sort of traditional legal background where states have obligations that they are meant to enforce and people will just behave accordingly. He understood the relativity of. Of. Of governance. International global governance frameworks. And that was really, I think, the secret to the success because he realized the importance of talking and involving companies as well as the stakeholders, and not just sit with government lawyers and negotiate a text. So I think if there's any secret sauce, not so secret sauce, it was it was really the lens with which he saw what needed to be done. Fascinating. So I think to me, the brilliance of the whole document is sort of how simple the sort of the crux of the distinction is, and that states have an obligation to protect human rights, whereas companies have a obligation to respect human rights. Do you remember when that sort of key phraseology developed or that the sort of aha moment that we can make this succinct and clear and there is a distinction. Do you remember that, that sort of word of discussion? Yeah, I mean, quite it's actually so the in legal term states have the duties because they have legal duties through the treaties, they're ratified. So the say part was the easy one because we could just say, well, this is obligations the states already have and then articulate what is it they have to do in relation to non-state actors, in relation to companies. And there the core duty really is to protect people against harmful acts by companies in this case. So that was the easy thing. The new kid on the block was the corporate responsibility, and that was that. The state duties that denotes a more sort of legal content. And we couldn't create a new legal standard. I mean, that's for that is still for governments to create law. So as a soft law, more of a policy standard, it was the responsibility which is in legal terms, a lesser and so that was really that discussion. How do we need to say states still are the subjects of international law. They ratified legal treaties, companies don't, and they have very different social functions from states. So let's use different language. And then we looked at a lots we looked into I don't know how many hundreds of corporate statements already. So what do how do companies already talk about what they do with human rights and so many would have already back then in saying we respect the Universal Declaration on Human Rights, for example, or the UN Global Compact, the sort of CSR initiative of the UN, as it was at the time that those principles talked about respect for human rights. So we said, Well, let's use the language that companies are really using to develop this new standard that is different from what states have to do, but still something that is quite clear. Well, so I alluded to this earlier, But, you know, as a former legislative attorney, I think it was brilliant and I absolutely love it. But I also pull out of the weeds for our viewers a bit. So it's actually a great segue. So starting from that sort of defining the broad obligation and you mentioned soft obligation for businesses and with respect to human rights. Transitioning a bit to the Btech project, which is something that Cloudflare participates in, and then you also direct, what do you recall sort of what what was sort of the crystallizing moment where it occurred to your team that maybe it would be useful to have a project specifically focused on the UN guiding principles and sort of companies in the technology sector and sort of the Btech project, sort of what was the genesis there and what was the impetus that there might be sort of a separate discussion related but sort of distinct discussion? Yeah, And again, I can I can actually be quite specific because I went with the former High Commissioner for Human Rights, Zeid Ra'ad Hussein, and I went with him on a trip to Silicon Valley, to San Francisco, and we spent a week there meeting with companies and sort of doing an outreach to try to see. It was back in 2017 where the sort of the backlash the tech clash was beginning. And there was a sense from his side that that the human rights dimensions, positive and negative of digital technologies needed to have greater attention from our office. So we went there, had some great meetings with a number of companies, and we came back and said, okay, as an office. So colleagues working specifically on freedom of expression, on privacy, on assembly and all the discrimination, all the sort of human rights issues started having a greater focus on tech. Also, the colleagues working on investigations sort of using we talk about tech as a tool, tech as a challenge for human rights. So there was the challenge side, which is the sort of human rights impacts that I think everyone on this who watches this will be familiar with, but also very much clear about how useful tech can be for human rights work when we do interview witnesses, investigations of atrocities or whatever. And then there was the, well, what is it we know about tech is that the tech companies actually are very big part of tech of the tech and human rights discussion. So we started thinking, well, we actually why don't we, as part of the broader stepping up on tech that the office was planning to say, well, we actually do need to have a process that it quite is quite directly focused on what other human rights responsibilities of the companies. Because what we also saw at the time as part of that backlash was there were new initiatives and standards and processes. And when you need principles and that left, right and center and we were like, actually, that's not necessarily helpful because it was not necessarily at all in my mind. It was very reactive. It wasn't helpful for human rights. If companies are met with so many conflicting demands, depending on the latest atrocity or the latest scandal. So we were like, let's try to instead of thinking that we need whole new standards because there was the single tech is so different. And we were like, actually, is it? It is different. Every sector is different, but it's trying to use the framework that we have, namely the UN guiding principles to see how far can we address the concerns we have, and only when we can get as far as we can do, we know where the gaps are and then we can start thinking about creating new standards. So that was sort of the genesis of tech where we thought, well, let's let's try to use the lens of the guiding principles to address some of these challenges, both in terms of what companies are doing and should be doing, but also in terms of the regulators, like how can regulators be aligned with international human rights standards? So whether they do it nationally or regionally or internationally, that there is some kind of grounding in the existing standards that we have, instead of thinking that this is so special that we need something entirely different. So. Thank you. That was sort of a wonderful description. I was still in government in the time period you're talking about and then so familiar with sort of the tech reaction that you're talking about from a different side of the conversation and then coming to Cloudflare. And as we sort of to two and a half years ago starting to stand up a formal human rights practice, I think the company had sort of integrated human rights into decision making before that. But we haven't really had sort of a formal practice with due diligence policy and etc.. So as our policy team was standing up that process, I told you I had sort of gone back through the historical record that you all created, sort of starting with my favorite is the UN Secretary General, Kofi Annan's speech at the World Economic Forum, where he's announcing sort of the UN Global Compact or that initiative. And then through sort of Professor Rags testimony and his frameworks, etc., going through that process, not having worked on a business even writes previously, there was sort of an aha moment for me personally in that one of the biggest challenges for a company like Cloudflare is we're in so many jurisdictions, right? We have at least a network presence in, I think 270 cities, in 111 countries and within the cities, either multiple locations. And then we have sort of a global staff, all of which plays into human rights analysis, as you know. And sort of the really difficult thing is finding a standard or a framework that applies everywhere that's consistent, that includes all people. And it sort of was, as I was reading all of this sort of human rights development with respect to business, it was sort of a very obvious thing that this is much of this is what I feel like the discussion has been missing, at least in the early stage. I think human rights is particularly because I interact with some of these companies now here in Cloudflare, it's very much in the forefront of their minds. It's sort of trying to implement the UN guiding principles faithfully. But back to your point, in 2017, I wasn't aware of that conversation. It may have been happening, but at least it hadn't filtered its way up in sort of to the attention of regulators. So it actually is an incredibly valuable and useful tool around so many issues that we deal with as a company, at least on the policy side, to have that universality that all of these not all but demonstrably most countries have signed on to through the treaties that you sort of alluded to. So I find it incredibly helpful and even sort of going back through the special rapporteurs, freedom of expression commentary, sort of on applying the UN guiding principles to tech issues, sort of by year, you could see it. It's sort of the writing that we've heard in sort of popular discussion that companies are looking for a framework that's universally applicable, that they can apply to these types of questions. And it sort of says it's here, it's the guiding principles you. Should. To the extent we should adopt. So it was very much an aha moment that this was sort of the answer we had been looking for. Maybe we didn't know. And that was sort of the beginning of our human rights practice and it's been incredibly valuable to us since then. So shifting forward I guess a bit to be tech as an initiative today that Cloudflare now participates in the community and practice, which we have sort of regular engagement with the Office about topical issues associated with the UN guiding principles. But from your vantage point, is sort of the director, how would you describe the work that the initiative is focused on right now, either with companies or with regulators? What are sort of the main focus of the office as it exists and has developed over the years? Yeah, so it's a pity we only have short time because I could go on, but I'll try to make it brief. I think just to I think the real sort of benefit of the guiding principles is that it provides a framework, not just sets a standard. So in the past and John Ruggie was, was, was saying this several times, he would say in the past companies would say, yes, we respect human rights. But his question was, how do you know and how are you able to show to your stakeholders and to regulators that you do that? What are the processes you have in place internally in the company to allow you to know that you, in fact, do respect human rights across these 111 countries? So that's what the guiding principles bring, not just a clarity of standard, a universal standard, but also a due diligence process, human rights due diligence process that enables a company to answer these questions. So what internal processes do you have in place and policies to get the right information to know that the different parts of the company. It needs to do what they're expected to do to respect human rights, that they're actually capable of doing it. So in B.tech, from the beginning, we've had a big focus on direct engagement with companies in what we call the community of practice, which is about 13 large companies, tech companies until now, mainly in North American and then some European telecoms companies to have these discussions. What is it that goes on inside a company to know and show? And so the discussions we have had over the last couple of years have been like, what? How do you engage your colleagues? What how do you involve the development team? How do you prioritize where you if you are in 111 countries, you obviously can't do in-depth due diligence on all of those. What how do you prioritize what is most urgent, what is most severe? So it's those kind of really granular, practical discussions that is that is implementation of the guiding principles and that is being incredibly helpful for us also because we're learning and we then take out some of that learning that we hear and put that out in short notes that obviously are publicly available. The other workstream that we have focused this year a lot of attention on, has been around the role of regulators. We work in what we call a UNDP's U.N. guiding principles compass for regulators. So whether you're regulating AI or you're regulating for online content or regulating for privacy or whatever, that again, if you apply the lens of the guiding principles that obviously there's no tech in human rights regulation that will cover everything, but where you can embed the lens to ensure consistency with the core expectations you set for companies who are going to implement, whether they are doing AI or surveillance or whatever the case may be. So that's one thing we've been working on that will come out for piloting in the new Year. We've had a workstream. Another challenge that many companies are facing is their stakeholder engagement, engagement with affected stakeholders. It doesn't work. Patrick I don't know if you were in the community practice session where one of your peers said we need new rules of the road because this is just totally broken from both NGOs side and from company side. Companies said, Well, we consulted 70,000 people on our last whatever. And is that too much? Is that too little? No one knows. So how do you spend? Do you know if that's the best use of your time? So we've come up with we started a conversation. There are others that are working in that space as well, coming up with good guidance. But sort of what are the key questions you need to think about as you are deciding who to consult about your human rights impact? So that's another sort of workstream. And then finally, I'll mention our work with investors where the investors and tech as a community with potential leverage, they will all deny that they have leverage, but potentially leverage instead of what are the kinds of questions where the human rights risks are associated with how the company makes its money. So business model and we all know that there are some business models that will have inherent human rights risks. How can investors ensure that at the strategic level of company, these risks are being mitigated? It's not about saying, well, these companies can't exist, but it's like, what are the measures in place to effectively try to mitigate risks that are inherent to how you're making money? So we've come out early next year with just a short tour for investors about the types of questions to ask and how to assess the responses. Because again, investors are increasingly asking ESG related questions. But again, I mean, ESG, that's a whole other discussion, but sort of being quite specific now, using the accounting principles, talking about business model related risks. What are the kind of things what is it you as an investor would like to see in place to be confident that the company is seriously. Addressing the risk that they may have that are linked to how they make their money. So that's those are just sort of some examples. And then finally, don't know how we are for time, but 2023, we're going to do a big push in Africa and potentially also in Asia. So we're launching we started already, but we're launching in February at the Africa Internet Forum, what we call Africa. So it's a sort of a regional taking the Btech project in all its sort of different global iterations and then having a focus on engagement with stakeholders. So both the, you know, the tech companies, big and small startups and more established companies, civil society networks that are working on tech related issues as well as regulators from the African Union through to national stakeholders or national regulators. And then having sort of what do these conversations look like from the perspective of the tech sector in that region and that obviously also global tech companies that are operating in the region. So it's not just indigenous companies, African, but so we're really excited about that. And we have planned for, as I said, the launch event in Kenya in February. And then we'll have a bigger big Africa series of meetings in Cape Town in March. So really bringing it out there and getting those sort of practical discussions of what if you are a telecoms company operating in most of southern Africa, what are the kind of things you need to do to understand and implement the guiding principles? How do you apply that framework? How is it helpful? What is it you need to be doing? And then we'll we'll plan on replicating in India as well to have a Tech India offshoot. So we. are. We're spreading. Sort of struggling to respond to all the wonderful things that you're doing that I took. I don't know if you noticed, I was taking notes throughout that to just sort of remind myself some of the work that's coming out next year. I mean, it sounds absolutely wonderful. I was actually talking to, as I mentioned at the top, we're in our company Wide Impact Week, which is the week we sort of we stack a ton of announcements about things that Cloudflare are doing to promote human rights and sustainability and so forth, which is one of the reasons we want to have you chat today. But I was chatting with some of the folks on our infrastructure team who do our network development and choose our site selection where we sort of invest in and grow sort of our capability. And they were eventually. How much of their work recently has been in Africa and that one of our future tasks is to get together as two teams and sort of talk about that work and sort of figure out the breadth and the scope of it and make sure that we're coordinated. So I think it seems like that's the initiative in Africa is wonderfully tied to things that. We'll brief you in the next community of practice meeting on the plans because we really do want to have. So that partnership between the companies that are sort of headquartered, maybe not necessarily in the region, but have operations because obviously that's they are part of the sort of ecosystem of tech in you are part of that ecosystem. Yeah, that would be wonderful. I'm looking forward to it. The other thing the other two things I'm so glad you mentioned is that this is right back to the beginning, but it was one of the inherent values of the UN guiding principles is that it's not a standard per se. It's a sort of a methodology for making decisions that are informed by human rights principles. And I think that is something that we've tried to share with internally in Cloudflare sort of our human rights training that we started this year and in our engagement with our colleagues is that this really is sort of a guideline that doesn't necessarily lead to the same answer in every occasion. It's really to make sure that we are being considerate and sort of struggling to find the right words here, but to make sure that we are including that lens of human rights in all different types of decision making. So I think that is, I guess, back to the beginning part of our conversation. One of the enduring values of it is that they are so flexible they can be applied to so many different situations, even within the same business. So that's something we talk about sort of a lot. The other thing I'll just say as a thank you to the tech team is that we as I mentioned, we sort of stood up our human rights practice maybe two and a half years ago. And we're there's a significant learning curve even in a new in a new space that's still being developed. But the ability to sort of interact with experts at tech on if you think about sort of we're constantly expanding in new markets and then the tech sector itself. We're sort of constantly dealing with novel issues. If even if the framework for analyzing them remains the same. And that's sort of its value the way that the issues manifest themselves, whether it's in conflict areas in Ukraine this year or sort of new markets, new jurisdiction, new types of interaction with regulators. Maybe I'm wrong, but it seems like sort of the tech industry is inherently at the tip of the spear in those conversations. And just the ability as we sort of are new to the practice and have these sort of bucket of developing issues to be able to interact directly with the tech staff, which is incredibly helpful and their expertise on guiding principles, but then also with peer companies who are going through similar things, we're having similar conversation hearing from them. That kind of exchange I think, helps even for folks on our team who work on the principles and implementation almost on a daily basis. That feedback is incredibly helpful because you can read it, you can read the document only so many times hearing sort of how it comes to life for another similarly situated company or someone with a tech staff who's had experience in the area for some time. It's incredibly helpful. So that was just a very long and drawn out way of saying thank you and we really appreciate it. And we feel very fortunate to be part of that conversation. So unfortunately, we only have 2 minutes left. So I guess my last question for you and where I'll leave it. Given sort of your experience working with different companies or companies of all types and sort of how they've started to implement it, go on their journey with your guiding principles. For employees who are Cloudflare or others who may be watching this, who don't work with who don't have a background in human rights law, who don't sort of work with these issues top of mind every day. Is there something that stays on your mind that is instructive for them to think about that they generally interested? I want to include human rights in my decision making. I've taken the Cloudflare training. Okay. But what is just from your position of experience? What is sort of the best advice you have for them and how to how to make it real in their everyday work? Oof! Yeah. I mean, I think it's it's I mean, human rights. To quote Eleanor Roosevelt, who was one of the drafters of the Universal Declaration of Human Rights, that human rights have to live in small places close to home. And if they don't make sense, they don't make sense anywhere. And I think it's really about thinking of human rights as something that it's it's all of us. It's not, you know, the company. And then in relation to human rights rights holders out there, that if one starts to think about human rights is also us and what we enjoy and then think about what you're doing and thinking about, how would that impact what we're doing? Would that impact other people in a way that maybe wasn't so cool and, and doing I mean, it's really about going about business without harming other people. I mean, that's that's the essence of it. But thinking about human rights is something that we all own. And I think that can be instructive in terms of the approach to how we go about doing either our professional work or our day-to-day work. It's really is about basic respect and dignity for others. And if one instills those values in whatever task one is doing, one doesn't have to be a human rights expert. There will be other people that are experts that one can ask. But I think that's really the that's the that's what we always have to come back to. It is about all of us and the dignity and respect that we all enjoy and should enjoy it. And if we bring that that into our work, then I think it's that's a good start.