Digital Opportunities & Risk During COVID Times

The pandemic has forced a rapid change in daily life. Tune in as experts across the enterprise discuss the evolution across the digital landscape.

The fourth installment of the Marsh & McLennan Advantage podcast examines three areas where the pandemic has led to a broader engagement with technology. Tamara McCleary, Thulium, Bob Parisi and Thomas Reagan from Marsh, first discuss the cyber and privacy risks in health and contact tracing apps. 

Followed by Kavitha Hariharan and Ben Hoster, from Marsh & McLennan Advantage, Insights, who consider the best practices for firms evaluating and deploying tools to track employees’ health. 

Finally, listen in as Leslie Chacko, Marsh & McLennan Advantage Insights, Rob Bauer, Marsh and Hunter Williams, Oliver Wyman, discuss the way that the pandemic has shaped the way goods reach consumers and innovations in last-mile delivery.


Ben Hoster: The pandemic has forced rapid change in all aspects of our lives and our homes, social spheres, work-life and in virtually every sector of the economy. We have had to adapt on the fly, technologies that were just emerging in recent years have become integral, indispensable facts of life. In many ways, the virus has brought the future-forward.

I'm Ben Hoster and welcome to the Marsh and McLennan Advantage Podcast. In today's episode, we'll examine three areas where the pandemic has led to a broader engagement with technology, we'll discuss what that means for businesses trying to adapt to our new realities. Like Last-mile delivery, some of the challenges and implications associated with cybersecurity and whether we can expect these transformations to last. For our first topic, we'll delve into the challenges of using tech to monitor the health of our population while still safeguarding our digital privacy and security.

Tamara McCleary: The number of health-focused apps has exploded in recent years, from platforms that support telemedicine to contact tracing for COVID-19. You know it's fair to assume the use of these apps are going to continue to expand. And in just a few short months, we've seen this technology emerge as an effective tool for monitoring and managing the pandemic. But like any tech-based solution, there are inherent data security risks that should be considered as these tools continue to expand in use.

I'm Tamara McCleary, tech futurist, and CEO of Thulium, a global digital social media marketing agency and innovator in digital communications. I'm joined by Bob Parisi, Managing Director at Marsh and Tom Reagan, Leader of Marsh's Cyber Security Practice to discuss the cybersecurity implications of the growing contact tracing app market. Bob, Tom, I'm so glad you both could be with me here today.

Bob Parisi: I'm excited to be part of the discussion.

Tom Reagan: Thanks very much for having us.

Tamara McCleary: This is such a great topic, you know for those that may be unfamiliar, could you guys give us a sense of what some of these health and contact tracing apps are and how they're used? Tom?

Tom Reagan: Sure. Well, look, I think in the past couple of years we've seen along with the explosion of the use of smartphones and personal devices, is this real revolution in health and contact tracing apps. The amount of information that can be gathered from these personal devices, it's really extraordinary. And they're increasingly finding ways to use that for public health benefits. I know that Apple has done a lot in terms of launching some of the largest public health studies around things like heart disease and other indicators of general public health using the iPhone, the Apple Watch, things like that and now in the year of the pandemic, we're seeing a move towards these contact tracing apps. And if you think about it, it's a really important public health purpose. The idea is to support contact tracing so that if you end up becoming exposed to COVID-19, we can help identify everyone you've come in contact with them and notify them so they can take appropriate steps, or conversely, if you've come in contact with someone who's been exposed, you can be alerted so that you can protect yourself. And so this is really amazing because this would not have been possible 10 years ago.

Tamara McCleary: Bob, wider adoption of these apps, what are the cyber and privacy risks that the public sector needs to be aware of?

Bob Parisi: No one really understands exactly what details or what data will be collected, what will be used for, and more importantly, who will have access to it? This means that there's a danger that people are going to distrust some of these apps. So if we look at the risk in a more positive way, there are ways that companies and the technology can be configured to overcome those fears.

The first is decentralization. The real fear is that all of this information is going to go into one big data lake and people are going to be able to mine it for whatever they want. Most of these data apps are now set up on a framework that will be decentralized, so there will not be one major holder of the data. The other is open source and this is as important as decentralization. What we're talking about here is there's got to be transparency in the algorithm, it's got to be transparency in the software so that no one feels that, Yes, okay, you're decentralizing, but you've got some really clever software that's going to allow you to get all of this information it wants and deals with how it actually is being used.

Tamara McCleary: Well, what you're talking about is really the trust landscape here and I'd have to say that most people are a little skeptical about really what's happening behind the scenes. So that makes me think of what are the legal and regulatory issues that companies need to be aware of as we see wider use of these apps?

Bob Parisi: So there are a lot of regulatory issues and legislation that has come down around privacy and I think you're not necessarily going to see any new legislation with regards to wearable devices or contact tracing; but you are going to see things like GDPR, CCPA, and BIPA, be used very aggressively in this arena. I think you're going to see it be very geographically delineated. So if the contact tracing is coming out of Silicon Valley, you're going to see that the California Consumer Privacy Act, CCPA, is going to be the default standard. If we're dealing with apps that are developed in the EU, obviously the GDPR will apply.

Now that becomes problematic because of a recent decision that came down from the EU, which struck down the Privacy Shield. Privacy Shield was the means with which data was shared between the EU and the US. If you're dealing with a global pandemic and you're dealing with contact tracing that is meant to use that law of large numbers to be helpful, the inability to share data between the two geographies becomes problematic.

Tamara McCleary: We know this is not a clear-cut subject, there's a lot of gray in here; and it's easy for me to answer this question in a very spooky way because I write a lot of science fiction in my futuristic pieces. Catching and knowing glance around the corner, we have to look at how can this data be used to cause harm if it lands in the wrong hands. What do you think about that?

Bob Parisi: Yeah, so there's a lot of pop culture references that kind of immediately spring to mind, Minority Reports, a good one where people are locked up based upon an algorithm and some freaky people floating in water; but when we're dealing with data getting into the wrong hands and what kind of harm can be caused, I think you need to look at it in a couple of very discrete ways. First, I think the question about harm starts even before that. I've got kids who are going to be going back to five different schools and all of those schools are going to be using contact tracing apps. So now, you're dealing with the collection of data around binders and children, and any time you're dealing with collection of children's data, there's a heightened concern.

Now add to that, the fact that we're dealing with healthcare data; and health data is not neutral, it's embedded in political context, can be shaped by politics, and its collection and use and decision-making has real life or death effects.

Tamara McCleary: You mentioned, Bob, something that I wanted to bring back up to Tom, and that is, Tom, the security considerations. What should consumers keep in mind as they record and share personal information when using these apps?

Tom Reagan: Sure, it's a great question. I think, first of all, the traditional best practices around device security, use of multifactor authentication and password rotation, making sure you don't reuse passwords. Those things are really particularly important when you start exposing personal information that otherwise the device has been pretty expressively designed to protect. Similarly, things on the internet have a very long shelf life and so I think the same old maxims about social media: if you don't want something out there for a very long time, possibly forever, you probably need to be careful not to put it out in the first place.

But the other part of it, as Bob said, there's a lot of data that comes out of these devices and it can be used in really interesting ways. We hear a lot about, in policy issues this discussion around metadata, it's just metadata, it's not your actual biometrics, it's just demographic information about you. But put together in complicated ways, you can actually learn a lot even from the metadata. So, the information you're sharing is very powerful and I think that we need to recognize that there's a lot of power in this data.

Tamara McCleary: This has been such a wildly exciting topic to discuss with you, Tom and Bob, thank you both for such a great sharing and being willing to be so open and talking about both sides of the coin. I really appreciate that and I cannot wait to go back. I hope I get a transcript of this and thank you so much for your time.

Bob Parisi: Thanks so much.

Tom Reagan: Thanks, it's been great to be part of the discussion.

Kavitha Hariharan: Digital tools have the potential to help employers get staff back to work safely, but these digital tools also come with significant risks, technology-related risks and trust risks. So it's important for employers to think about the limitations and the risks and the trade-offs, and put in place the right governance that will make it possible to implement these sorts of apps successfully. My name is Kavitha Hariharan, I'm a Director at Marsh and McLennan Advantage, and I lead the Healthy Society team.

Ben Hoster: My name is Ben Hoster; I'm with Marsh and McLennan's Advantage Insights Group. Kavitha, I was reading recently in a Mercer survey, more than half the US company survey were planning to implement contact tracing programs in workplaces. About 3% we're looking at digital contact tracing as well. Can digital tools to monitor employee health, really facilitate safe return to work? What risks do these tools bring and how can businesses mitigate those risks? That's what we'll discuss in this segment, drawing on our recently released report on digital health surveillance, a balancing act for business. Let's start with the opportunity, Kavitha, what is the potential for digital tools to help companies and staff get back to the workplace safely?

Kavitha Hariharan: Thanks, Ben. Let's take a step back and think about what's contact tracing and what does contact tracing app do? Contact tracing is basically a way of finding people who might've been exposed to an infectious disease and who might pass it on; and contact-tracing apps can do three things. First, they can estimate and keep a record of the proximity, the duration, and potentially locations of interactions between people carrying smartphones or wearing devices that are running the app. Gutman's are already putting some of these sorts of apps to use and businesses can do that as well.

Second, if a user reports that he or she has tested positive for COVID-19, then a contact-tracing app can quickly identify other users who might've come into close contact with this person during the incubation period. And the speed matters because contact-tracing apps can identify close contacts faster than human contact traces can do on their own. So, if you can quickly isolate just the people who've been infected or exposed, then you can reduce the risk of a bigger outbreak and office closure.

The third thing that contact-tracing apps can do is notify people if they're exposed to risk and potentially tell them what to do next, get tested or quarantine, etc. Beyond this, businesses can potentially bolt on other features such as pulse checks of staff wellbeing to help support physical or mental health needs. Apps can also provide status updates and facilities, alerts about high-traffic checkpoints, hygiene and distancing reminders, and so on.

Kavitha Hariharan: And going beyond apps, augmented reality tools can help employees maintain safe distancing in high traffic sites, such as manufacturing shop flows, distribution warehouses, and so on. Still this sort of monitoring might make some employees and perhaps even employers, a bit nervous. They might have concerns about data exploitation; they might worry about how surveillance meshes tend to stick around long after our crisis. So businesses and governments that are implementing digital tools to contain the spread of COVID-19, they need to strike a balance between public health and individual liberties. From a technology perspective, then this one's a question for you, what can businesses do to build trust in digital tools?

Ben Hoster: I think there are a few angles to consider here, Kavitha, data minimization and purpose limitation. Those are key to reducing the risk of employers reaching too far, whether the use of sensitive information for purposes other than those intended. Instead of casting a wide net to capture what might prove useful, just collect only what is necessary to achieve the set objective or what we're really trying to do, which is curtail the spread of COVID-19. And make sure to set limits on how long that data can be stored, so that it's not used for a different purpose down the road. Even when trusting relationships exist between employees and business leaders, there can still be the concern that the sensitive information that is shared could be compromised by cybercriminals, especially when it is transmitted using this kind of new hastily deployed technology.

One way to mitigate this is through the use of decentralized storage and processing. The approach protects privacy with data processing for each individual and it's performed locally on their device. Typically very secure devices from Apple, Google, and other big tech players. While this may prevent the business from having a comprehensive view, the full view of what they're looking for and control over the outcomes, it still confers a measure of trust and authority to the tool. And that's really the key for adoption. So sufficient adoption is critical to the success of these tools.

So also take into account, how this technology would be administered. To avoid spooking employees, it may be useful to consider a voluntary approach mandatory or otherwise coercive methods can create these reputational challenges and even a whole host of liability risks down the road. When businesses incorporate the employee perspective in the solution, they improve the chance that there'll be uptake and compliance with the app and the overall health surveillance regime. So even well designed digital tools, won't be silver bullets, Kavitha, they need high levels of adoption and compliance from users. So, how do you think businesses can encourage employees to use the tools and shared data?

Kavitha Hariharan: There was an Oliver Wyman survey earlier this year, Ben, that found that most people are actually willing to share personal health data to protect their own health and that of other people. The survey also found that most people are comfortable sharing data with health care providers and public health authorities. But less so with employers or app developers.

Now, since the time of that survey, trust in Apple and Google might've actually gone up after they collaborated on a privacy-protecting solution for digital contact tracing by governments. So I think there are a couple of things that businesses can learn from these recent events. One is that if businesses go ahead with digital tools, make sure the tools balance people's health and privacy needs. Then build trust with a transparent and compelling case for why the digital tool is necessary, exactly what it will be used for. What protections are in place against anything going wrong; and try to foster a sense of reciprocity by pointing out how the tools will help both staff and the business. For example, how the tools can help protect the health of staff and their families and friends. How the tools can help keep workplaces open, sustain jobs and incomes, and so on?

I think if employers get this right, they'll gain enduring trust and loyalty from employees. If they get it wrong, the risks of virus outbreaks, office closures, workplace liabilities, brain drain, a host of risks, really. To mitigate those risks, employers are going to need very good governance, effective governance across the digital tools life cycle. So Ben, what would you say good governance looks like?

Ben Hoster: See, it's funny, Kavitha, I think we can build all of these incredible tools and have all of these wonderful processes for kind of instituting this and create the faith with an interest of our employees. But unless we have the governance and oversight to tie this all together, it can all fail.

So first I would say to safeguard against errors and abuse, businesses need to establish discipline, precautions and controls. Like for example, a business could impose limits on data collection and processing with sunset clauses to dismantle the system down the road. Restrictions on the sharing of individual's data without their consent complemented by transparency mechanisms for feedback whistleblowing, and penalties, would also go a long way to kind of engender trust from the workforce.

Ongoing oversight is also be critical. It is best to constitute an oversight committee, make sure it's empowered to monitor and manage risks, listen to concerns and take corrective action when needing. To ensure kind of a diversity of perspectives, this group should be comprised of business leadership, human resources, legal counsel, and almost equally as importantly or if not more, employee representation.

Lastly, I think consistently honest and transparent communication is fundamental to building trust in and use of these technologies. It is essential to build the case for why the digital tool is necessary, what it will be used for, how it will help business and employees and what protections are in place to guard against the potential pitfalls. Employees that must have access to the oversight team, who should then acknowledge and act on that feedback. So those are the elements kind of governance and I think if you put all those in place and have the discipline and routine to sit over the top of it, you take big steps to really make this a successful, getting back to the workplace effort and a technology-enabled one. Thanks for the time, Kavitha that was a great discussion, very helpful.

Kavitha Hariharan: Thanks, Ben. Always good to work with you.

Leslie Chacko: The pandemic has accelerated changes in virtually every corner of modern life, and the way that goods make their way from point to origin and the consumer is no exception. I'm Leslie Chacko, Managing Director for Digital and Cyber at Marsh and McLennan Advantage. In today's segment, we're going to cover the shift in business strategy and operations from last mile delivery, innovative practices and emerging implications for business and society. I'm joined by Rob Bauer, Head of Marsh's Sharing Economy and Mobility Group and Hunter Williams, a partner in Oliver Wyman's retail practice, to discuss the current state of Last Mile Delivery.

Rob and Hunter, it's a pleasure to meet with you today.

Rob Bauer: Good to be with you.

Hunter Williams: Pleasure, Leslie.

Leslie Chacko: All right, well let's get started. Rob, my first question is for you, what some of the most important recent changes in Last-mile delivery, given the situation with COVID and what role has technology played in informing the current landscape?

Rob Bauer: The first fact to realize, I believe, is that people are not moving quite as often lately as packages or pizzas are; and if you think about that, think about how many times the Amazon delivery person has knocked on your door now compared to pre-COVID. We actually did an informal poll of executives at Marsh to ask this question and got answers anywhere from four times a week these days or four times a day.

And so the biggest change during COVID, really, is for businesses that previously relied on customers coming to them, meaning stores, restaurants, or grocery, something profoundly changed. Now, businesses have to figure out how to go to customers. What does that experience look like? What does that experience look like at the door? What does that experience look like in terms of customer service? What does that experience look like after a cumulative 10 or 15 deliveries per delivery individual have been done for instance, over a day? What can we learn about customer behavior over time?

And so, because the relationship with the places we once went to, and now those places need to figure out how to come to us, has profoundly changed insurance for last-mile delivery has needed to change as well and look forward to talking about that.

Leslie Chacko: Hunter, what are some of the challenges that businesses have to face given the move to last-mile delivery, especially trying to make last-mile delivery profitable and sustainable and how does the pandemic interplay with some of those challenges?

Hunter Williams: Well, I mean, I think some of those challenges are old and have been part of the story for the last decade, really and some of them are either new challenges or kind of exacerbated with the pandemic. Yeah, profitability once taking into account last mile costs, is an old challenge for many to work around. The smaller, lighter, and more valuable a product is the less hit from last-mile costs for the overall economics of the basket. You want a large basket size with a lot of dollars and something that's easy to move from point A to point B. And that has been a challenge for a lot of businesses to just make the economics of the increasing share of eCommerce work out for them.

In particular, for legacy businesses, with roots in brick and mortar, which we're trying to kind of, fit their customer behavior and business models into new realities with those last-mile costs. It's slightly, maybe, easier for a digitally native eCommerce business who has built their business model around the realities of last-mile delivery costs. I mean, what we've seen with the pandemic to your question, is a lot of the development of eCommerce has just been brought forward and accelerated by years. And that's brought a lot of these challenges to a head and made them a lot more immediate to address. I think a lot of businesses struggled with throughput, especially in the early weeks and months of the pandemic. And there's been a lot of emphasis on finding alternatives, people are less willing to go out, but it's to avoid interaction.

So obviously one answer to that is to have it delivered directly to your door, but other answers to that are to have the customer actually do the last mile themselves with BOPIS, so buy online, pickup in-store or curbside pickup, which we're seeing being embraced by a lot of businesses, whether it's retail; or food service, as a way to provide alternatives to last-mile delivery as a service.

Rob Bauer: So Hunter, I love where you went on economics, I'd love to talk about that a minute as it relates to insurance. So here's the fact, insurance for this category is broken and it's broken in several ways, I'm going to focus on two here today. One, it's expensive. Only about five insurance companies say yes to writing what's called hired and non-owned auto insurance. Which is effectively bring your vehicle to the store or to the platform or to the delivery network company, and bring the stuff to customers. And these insurance companies do it sometimes begrudgingly; they do it as a package of other coverages that they're providing for the company because of profitability issues. Historical profitability issues.

Eight years ago, this category of insurance companies were brave and they said yes to insuring ride share. And they priced it the best they could, but here we are eight years later with some loss history. And some of the insurance companies are effectively taxing delivery network companies for the sins of their own mispricing of rideshare. And so there is this balancing of costs on a balance sheet level, at an insurance company, that customers are feeling the impact of.

The second thing that's broken in last-mile delivery insurance is what we call an old school rating base. And previously, insurance for owned automobiles, meaning that delivery van with the logo painted on the side was priced on the basis of the number of automobiles. Why? Because that's what we could count. Then the innovation became projected or prior revenue. Revenue doesn't work because should it cost more to ensure the delivery of 10 pizzas as opposed to one or should it costs more to deliver a case of wine as opposed to a sandwich? When really you're doing the same thing, you're bringing a vehicle that the company doesn't own to the store, putting it in someone else's car and driving it to you and so prior or projected revenue doesn't work.

Then the innovation became the number of deliveries or the number of trips. And that doesn't work because if Hunter and I live on the same street and we order a pizza from our favorite store, eight blocks away. What likely happens is the pizza delivery professional will put both pizzas in the back of their car, deliver Hunters first and deliver mine second, as opposed to going back and forth to the store in the middle. And if you're charged on the basis of number of deliveries, you're charged double. As opposed to what we're proposing, which is usage-based or mileage-based price, which is really the unit based costs for exposure. How could we offer usage-based mileage price insurance for Last-mile delivery? Well, technology had to be invented in order to count the number of miles and luckily that exists today.

Leslie Chacko: What does it mean from a talent standpoint, especially if you're traditional business and you're trying to stay relevant, you're trying to innovate. Especially to keep up with a lot of these digital natives, how do you think about the balance of talent from a last-mile delivery perspective?

Rob Bauer: In this labor market, the labor themselves can fire the company three times a day and rehire them that afternoon. Think about it that way.

Hunter Williams: Or it'd be working for two at the same time.

Rob Bauer: Absolutely. Yeah, absolutely. And so if you are a marketplace and you need to attract this talent pool, you're thinking about what does this talent pool need in addition to income? Which I'm providing a means to create. Well, I'm also thinking that this marketplace might need tax preparation help. This marketplace of labor also might need online education; they might need something, a version of portable benefits. And so how that mark is created is being invented right now.

Leslie Chacko: I have one last question for both of you. We are all hoping that this pandemic is going to pass us by, hopefully in about 12 to 18 months, hopefully, sooner. What are your thoughts on where demand is going to be for Last-mile delivery? Do you see it returning to normal or is last-mile delivery here to stay and grow?

Rob Bauer: I'm firmly in the camp of Last-mile deliverystaying and growing, for a couple of reasons. Safety, security, and convenience. COVID has taught us a couple of new behaviors, a couple of new tricks. And one new trick that it's taught us is that we can fire up our smartphone and have a pizza or coffee or toilet paper as is needed, as we hear and experience ourselves, come to our door. I think some of these new behaviors are going to stay.

Hunter Williams: Yeah, I agree. I mean, thinking about it from a supply point of view, necessity is the mother of invention. And there have been a whole lot of innovations out of necessity over the last several months that have moved the ball forward on how to fulfill these needs in an inefficient and safe ways. And that means it's going to be easier to do so on a continuing basis going forward. From the demand point of view, a lot of folks who would have been late adopters, whether, age, familiarity, access have tried eCommerce options for the first time. And once you've made that hurdle and especially when you've done it three times and it becomes a habit, then you're much more likely to stick there. And so yes, people will go back to restaurants and people will be more comfortable going into grocery stores. But in five years, we're going to look at this as a point of time that was a massive acceleration of trends that were already underway, that it brought the timetable forward several years.

Ben Hoster: As evident from the discussions you've heard, the business community has developed new tech and strategies and repurposed old ones to meet our present challenges. And as with any innovation, it will take time to identify and address pain points like health privacy, and delivery profitability that may arise. If we continue to innovate and solve those new problems, we are likely to find that some of our ad hoc solutions stick around and improve our lives. Once we are through this difficult period, we may see that some changes for the better have come out of the struggle. I'm Ben Hoster and thank you for listening to the Marsh and McLennan Advantage Podcast.