Simply Solving Cyber - Shelley Jackson

Thanks for tuning in to Simply Solving Cyber. I'm Aaron Pritz. And I'm Cody Rivers. And today we're here with Shelley Jackson. She's the partner at Krieg DeWalt. She's the chair of the labor and employment practice, heavily focused in privacy and security, and newly appointed chair of the AI task force. We're excited to dive into that and hear your perspectives as a lawyer in that space. So welcome, Shelley.

Thank you, Aaron. Thank you, Cody. I'm excited to be here.

Awesome. So let's get right into it with AI. So maybe from a law practice standpoint, how is AI or related technology coming up in your practice? Like what questions are coming your way or what issues are you having to deal with?

Well, I would say just like any other organization, both as a law firm and then also as a business, it seems that AI is suddenly everywhere and it has been coming for many years. This is not something entirely new, but it feels like it's really exploded and has advanced at a level that we haven't seen previously. And so we have lots of clients asking us questions, and those questions can range from a variety of things. They can be business-related questions like intellectual property rights as it relates to generative AI, for example. I get a lot of questions because I am in the employment law space about data privacy and security as it relates to artificial intelligence that may be used to make employment-based decisions. We have some guidance coming out from some of the regulatory bodies, like the Equal Employment Opportunity Commission has recently issued some guidance about using algorithmic decision-making tools, including artificial intelligence, in making employment decisions. So we're seeing a lot of that. I think also just entering into agreements and contracting with different organizations that are providing maybe software as a service technology. They're incorporating AI in various forms, whether it's generative or not generative. We're doing some deep dives into what exactly is this technology doing, what product is coming out of it, what risks or benefits are attached to that product. And that's really a consideration, like I said, not just for clients, but it's part of the business environment that we're all finding ourselves in.

Yeah. So linked to employment screening or making offers, I remember probably almost 20 years ago when I was in an internal audit function at a corporation doing some audits of HR providers that provided screening tools. So AI has changed, but algorithms and weeding through thousands or hundreds of thousands of resumes isn't new. I'm just curious, what's different in that space and what's changing? What do people need to think about or do differently or be aware of?

Well, I think one of the things that you've seen in that space is particularly an explosion of technological capabilities. Those capabilities allow employers to get more bang for the buck. In other words, I can go through a larger group of resumes. There are the basic sort of screening technologies that might be used to create— to screen out applicants based on keyword searches or things like that. That's been around for a really long time. Artificial intelligence is coming in to do things like profiling potential candidates, creating the profile of the ideal candidate, taking that one step further and creating new content based on harvesting information or pulling that data in in different formats. And I think that's one of the areas that's really important for employers to understand. On the outside, it may sound like just a slick new feature that can be added. But if it is adding, let's say, an artificial intelligence component where it is actually creating new decision-making about a candidate or perceiving information about the role that's open, let's say profiling a particular role, some of those behaviors and some of the data that it can be collecting, especially if it's in the case of about an individual, let's say a candidate or a current employee.

Sure.

There could be regulatory impacts in terms of how is that information being collected and used? Is it creating issues of, for example, reaching discriminatory results?

Yeah.

Not intentionally, The vast majority of these tools are not set up to create a discriminatory impact, but it is what we would call like a disparate impact, meaning that there's not a specific discriminatory action that's occurring, but because of the way an algorithm or a decision-making process or artificial intelligence is employed, you're getting to a result that results in a disparate impact or an increased impact to one particular group that may be protected under applicable law. So, that's one of the things that we're seeing.

So, let's, before we move on from this topic, let's flip the tables because we've talked about years. I've heard in the last 2 months from 2 companies, senior leaders, that they've started to see an influx of very similar worded resumes and cover letters and communications where I'm assuming that inputted their resume and say, make this better for Company A. And in both cases, I, I heard and discussed the outcome where they're like, flush them all. So I guess what, from your perspective, less of a legal issue, but on the employee side, as people are gravitating to how do I make this tool work the best for me, is there any impact from a legal standpoint as you start to represent yourself through what a bot is saying about you?

Absolutely. That's a great question. And I think it's something we all have to individually wrestle with, not even just as organizations. I think the bottom line is we have to remember what artificial intelligence and other technologies are and what they are not. They are not a substitute for human thinking and human discernment and human intelligence. They are artificial by designation. They are essentially a really sophisticated computer program that's been taught, that can teach or that can learn to predict right words, not even thoughts. Exactly. It has the perception of being very sophisticated, and in many cases it is. But what we also find is we find these pockets of inaccuracies or where the data somehow fails the process. In other words, it's pulled the wrong data, it's relying on the wrong data, it doesn't have the data, so it makes something up. This extends beyond candidates for a job. I think it's just professionals in general. You have to understand what is it that's being created and do you have a process to ensure that that's accurate? Yeah, there are a couple of higher profile cases right now where, you know, lawyers in my profession have submitted, in one case, an attorney submitted a brief that was written by ChatGPT, that ChatGPT, in its effort to give that person what they wanted, created fake case law. And now that blew up and it became like a little sensationalized news story.

The world's worst shortcut.

Exactly. When you're moving quickly through space, whether that is you're trying to submit lots of different applications for jobs, you're trying to screen lots of applicants, you're trying to get work product out the door for whatever your profession is, it can be a really great tool, but it's just that, it's a tool. It is not a substitute for the human element, which I think is a really key part of this. And if you do any work in this space, and I imagine you see this all the time as well, that there's not a substitute for a human being getting in there and using their expertise and their skill and their training and their education and whatever it is they've put together to create their professional, abilities. There's not a substitute for that. You can roughly approximate it. You can help the process. You can help prepare a draft, for example. There is no substitute to that individualized feedback from a human perspective.

Yeah. Think about putting Cody is 6 foot tall on all that.

Smart enough to say, uh, Cody, I don't think so.

I don't think it is, man.

We should see what happens. Yeah. Last thing on GPT and the fails is I went to a conference, a couple, a healthcare conference a couple months ago and Got a lot of follow-up emails just from being there. That's great. And one of the articles was HIPAA spelled like hippo, which is, if you're in privacy, like that's about the worst thing you can do to blow away your credibility. But it was spelled, I had somebody tell me the female version of hippo is HIPAA, like Spanish, which is not Spanish. But anyway, it was spelled wrong throughout. And after reading about half of it, I'm like, this is clearly written by a ChatGPT-like thing. To your point, Shelley, the— no human looked at it that was an expert to say, hey, this is wrong, or this basic spelling of the thing that I'm trying to be sharing thought leadership is way off the bat. So I emailed the company and they didn't acknowledge my feedback to update it, but they updated it within about 30 minutes.

Yeah, they did.

That was quick.

That was great. That was great.

That's impressive quickness.

I do have a question going back to employees and policies and them keeping up with AI. And what are you seeing around there as far as employees using it, employers using it, but then you've got these old policies that are written from years ago and are hopefully used but not always used. So what are you seeing there?

Well, I think one of the things that happens is that we have technology advancing at such rapid paces. This is not new to the AI discussion. This is part of, I think, just generally managing risk. Your policies, of course, are only as good as either the paper they're written on or the database that they sit in. If they're not living, breathing parts of your organization. So, when you're bringing in, let's say, a new technology, it's really important to think about, do we have policies in place that govern or that give instruction as to how we will use this technology and how we will make this technology work for us? And ask for the limitations. There's a lot of really sophisticated, great opportunity out there to, to use technology in a way that will really leverage information, leverage data, leverage time. It helps you create more time. But I think the policy piece piece of it is just being intentional about, do we have the framework set up to use this great new technology and make sure that we understand the risks that come with that technology? I feel like artificial intelligence and technology in general is parallel. There's huge risk, but there's also fantastic opportunity. And it's, as I view it, this is not, do we want to engage with AI? This is just, how do we do it? Yeah. And how do we grow our organization? How do we update our policies? Do we make sure that our employees are trained? Having Training sessions, doing tabletop exercises when you're looking at risk, putting together scenarios for people, testing people, giving them some sort of opportunity to exercise those decision-making skills that can be driven by policy. And then also staying up to date because at the same time, so you've got all of this innovation going on on the technology side, you've got lots of legal updates, you've got regulatory items coming up, and we have a new privacy law that will take place in the next couple years here in Indiana that just got passed. I think goes into effect 2026. And so, we're gearing up for the future. And again, there are ways to do this and it's just, no one's going to be perfect in doing this. Yeah. These are big issues and big items, but I do think being thoughtful and proactive can really head off a lot of potential challenges along the way, just because you're staying in front of it and you're thinking, okay, great, we've got this great new technology, let's figure out how it works for us. But let's also make sure that our work population, our employees, are empowered to use it. It's an empowerment issue, creating consistent policies that are tracking what the current legal landscape is and the regulatory landscape. It's an empowerment tool for employees because it gives them the boundaries they need to effectively leverage this very powerful technology that's available to them now.

Very cool.

Very cool. I'd like to pivot to a new segment of our show called And let's say it together. Fun facts. Yes. So let's start out easy. What was the first concert you ever went to?

Live concert?

I was thinking about this earlier, and I don't know if it was Debbie Gibson or Public Enemy, which is an interesting brand.

Those are the bookends of the options that you can have. And like we talked about when we warned you that this segment was coming, can you please recite one of the choruses from either song? No, I'm just kidding. I won't put you on the spot. That's okay. Let's think, any other fun facts? What do you do for hobbies? What do you do? Family?

Well, I spend a lot of time with my family. We are crazy about our pets. We have a dog and a cat, enjoy spending time with the dog and doing stuff with him. And, uh, but we recently as a family, none of us are golfers, but we decided that we would like to become golfers. And so the four of us, we have two adult sons and my husband and I, we go out onto the golf course and we are terrible at it. We choose the last tee time. And the golf course pro shop pro has taken, I think, pity on us. And so he's very kind to us when we come in. He helps get us set up with the golf clubs that we need and any of the materials. And we did that all last summer. And frankly, we did it in a very low-pressure environment. And it was just— it turned into this great bonding opportunity for our family. And we now, we like to do it every few weeks in the summer and just spend time together and not like worry about— we do get frustrated.

Everyone Does it golf?

Yes, we do get frustrated, but it's okay because we're all together and we're driving the golf carts and we're having a good time.

That's like a sport where you can have like 17 bad holes, but you get one good shot and you're like, I could do this.

We've seen some questionable techniques too. One of my sons decided he was going to do one-hand, one-armed golf swinging, which is a thing. I did not know this.

Really?

Apparently.

I didn't know this either.

Can't imagine that's going to help my game. Yes. Uh, give us a fun fact that maybe 99% of your colleagues would have never heard?

Well, I have like one recyclable fun fact that they probably all have.

They have heard.

So if they hear it, they'll be like, Shelly's using her fun fact again. But my one fun fact that I use when you're in an icebreaking scenario and they tell you, you have to say something interesting about yourself, but you have like 30 seconds to figure out what that is.

Yeah.

I always tell the story that back in the day, so this will age me, there were these commercials for OnStar, which was a very early form of— I mean, it's still there, but you basically could call for emergency help when you were in your car.

Yeah.

Yeah. And we had OnStar in one of our vehicles, and I actually had a collision involving a deer with my young son who was like, "Oh dear." Yes. Who was about 1 at the time. So it was really scary. Everyone was fine. I think there was a little damage to the car. Everyone was fine, but it was like maybe a couple of months later and OnStar contacted me and said, "We want to do a commercial." and we have a recording of it. Would you like to hear it?

Oh, was that an instant yes for you? Did you have to reflect a bit?

The recording was very embarrassing.

Okay.

Because it was semi-panicked. I got my little kid in the background. I've just hit a deer. I'm worried about the deer.

Did you say, show me the money and then press forward?

Well, we talked to them and they were glad to put together a commercial that's called Deer Damage. So that's the name of the commercial. And it aired a few times.

The YouTube right after this.

I've tried to find it. I have a recording somewhere in my house.

Have you asked ChatGPT? It if he has the AI to find it?

I have not asked ChatGPT.

So from a legal standpoint, the point in which you had the accident, is there now a deer crossing sign? Are there any precautions that would set the right framework of prevention?

To my knowledge, I do not believe there is a deer sign in the area.

Is there a lawsuit opportunity? Could you get paid twice?

I'm just kidding.

This is not your professional opinion. What's the term? Is the period of the statute of limitations— might be up—

expired many years ago.

Okay, got it.

We've got all these fun facts. We got the golfing fact. We got the OnStar story. Give us some— give us the Shelley story. How did you get into this practice here? What did you enjoy? You know, kind of your story. And then I think, well, let's start there.

Yeah, both attorney and the privacy technology side.

Yeah.

Okay, so the attorney side, which came before the privacy side, I was actually a teacher. I was an English high school English teacher and loved my students and loved teaching English, but I knew at some point that I wanted to go to law school.

Yep.

At one point, it made sense for our family and to make the decision to make the leap and try law school. So, I actually took a year leave of absence from my teaching position and in the idea that if law school was really terrible, I could just—

Come back.

Say, "Boy, I dodged that bullet." And I decided, I went into my first year and I really just have never looked back. I've been in the legal community now, it will be, oh gosh, like 17 years. And so, I've had an opportunity to build a career over that time that has spanned a lot of different things. But as it relates to privacy and security, what I found is as a young attorney, I intersected, maybe I would say, into incidentally with it. In other words, I would be working like I did some med mal defense, some pharmaceutical defense very early in my career. So we intersected with it in that it was a part of the litigations. We needed to be aware of that from like producing documents and reviewing information. So it started in a really incidental way. But what I found is over time, I really enjoyed the helping clients navigate decisions about information, personal information. And so it expanded from just healthcare-related items into a broader array of consumer data, employee data, all kinds of different data. And so I started to develop an interest in it. And at one point, I just decided that it was time. I'd been in a law firm for several years, decided that I'd like to explore that opportunity and became a chief privacy officer. So I decided to leave external legal practice in a law firm and be in-house with one dedicated client. And in that role, I was both an assistant general counsel who had responsibility over human resources and litigation. And then I also was the chief privacy officer, which was a global role. It was a really interesting, exciting, fun role. It's where I met Aaron and Tim and some of your team members. So that's how I first got to meet Reveal Risk. But it was a great experience. And ever since, it's just— There's a couple different things. First of all, it's about how we create opportunities to handle information and data in a respectful manner. So, I think it's at its heart, it's about being respectful in the way that we use information that we have about people. But it's also, it's a highly regulated area. It's an interesting area. Sometimes people like their eyes glaze over, like privacy? No. But if you dive in it, there's really interesting, I mean, how all of the different frameworks work together. It's an up-and-coming area. It's a rapidly changing area. We have new laws laws all the time. And then because I spend so much of my time in the employment space, privacy is so closely connected, both how you treat employee data, how you deal with candidate data, how you deal with your employee data, former employees, but also how those employees are empowered to treat data the way, in a compliant manner and in a way that really contemplates the best use of that data.

Yes.

So what happens on the AI task force? That was done with no filter, by the way. What happens on the AI Task Force and what are some of the top tips or good conversations you're having with clients about AI?

Well, we're looking for someone to do like voiceovers as we begin our meetings.

Sign me up.

He also plays the drums, so he put down his little snare build.

Like a whole entertainment segment. So one of the things we discovered at our firm, as I think is happening everywhere, we're doing a ton of this work. Our clients have really interesting sometimes very complex questions and issues that arise with respect to managing artificial intelligence and making sure that they are thinking about all angles of how to leverage and then also manage risk as it relates to artificial intelligence. So the idea of our task force is simply to make sure that we are serving clients in the areas that are important to them, also in the areas that maybe they're not as aware of, but we can help bring awareness and help them manage risk. A lot of times from a risk management standpoint, so much of what I do in a day is managing risk, right? There's the legal compliance piece, but a lot of times it's, we know the legal compliance piece, we just need to figure out how do we effectively manage that risk? Yeah. And how much of our resources do we devote to X activity versus Y activity? How much of a benefit do we get from leveraging this new AI technology versus simply using what we already have? And how much risk are we creating here?

Yeah.

So we're seeing it in every area. I see it a lot in employment and human resources issues. Certainly healthcare is a, is a big place because that's a highly regulated area. And you've got lots of apps that can tell you all kinds of things about you from a health perspective. You gotta think about how you're using that data and how that data is being processed and what is, how the inputs are set up to create any sort of artificial intelligence generative outcome. If there's, if they're generating new content, How is that being pulled? What's the security and the privacy controls? Business negotiations and discussions and who owns AI? There's some lawsuits right now that are pending about just talking about who owns something that's been generated through AI that was created based on examples of real artists. And yeah, is it a derivative work if that happens? So there's a lot of discussions happening in that area.

So what I'm hearing, or this is my kind of wrap up of that is you're letting— you've asked AI to come up with the agenda for your task force.

That is it. No, no, no, no. It's not.

No, we're client demand.

I will not lie, though, in any meeting that involves AI, it is not uncommon for someone to utilize AI in some way, use it as an example, because again, we are a business that is navigating really sophisticated new technology that frequently uses AI and thinking about as lawyers, what is our role in exercising that AI and using it? So I think it's very client driven. It's based on what we're seeing from our clients, but it's also what value can we provide to clients about maybe looking around a corner that they're not yet experiencing yet and staying ahead of it rather than all of us running to keep up with it.

Maybe we've got time for one more question. Give us some of your top tips for AI that you're seeing from a risks that are out there or guidance that you're giving.

Yeah, well, I think, and especially if I'm framing it and you do so much in the cybersecurity space, and when I think about it from like a data privacy and a data security space is there's so much sophistication that what is out there, there's so many new opportunities and they are incredible. Again, this is not do we utilize AI, this is not do we utilize technology, it's how do we do it and how do we manage risk. So when I think of the big picture issues, number one, what is the legal and regulatory framework that you're in and are you doing something, are you changing something about what you're doing that could impact that? Yeah. So, you know, if you're on top of that, that's going to help manage your risk at the outset. Rather than you implement something that seems super cool and then you go back in time and you think, oh, I wish I would have known that it was this issue. A good example of that is the EEOC is regulating the use of decision-making as it relates to candidates and employees and holding employers responsible for decisions that AI makes. If that decision turns out to have a discriminatory impact, even if it's not intended, if it's just an adverse impact that's created by the decision-making process or the generative AI, that can result in some additional risk. But if you're on, if you think about it on the front end and look at that and take a look before you're using the technology, you can help manage risk. Second of all, I think it's just to have conversations. And I always believe employees are your number one, your best weapon, right?

Yeah.

They are your best advocates. They are out there doing the work day to day of the business. And so thinking about what is it that your employees need from a business standpoint, what do employees need to feel empowered, whether that is understanding policies, staying ahead of policy development, clear communication of expectations, giving employees a voice to say, hey, I see this great opportunity here, can we explore this? And sort of outline what those risks are. So I think that's the second. And then the third, I think, is just to be curious. There's so much going on and there's so many opportunities here. And I think being curious, doing a lot of reading, staying up to date on what the opportunities are in your industry. There's so many opportunities to learn and you don't have to learn the hard lessons.

Yeah.

You can learn from other people who learned the hard lesson. So just being engaged in that industry or community.

So with AI, being careful in what you feed it, what the implications are, and how you're using what you're getting back.

Yeah.

I almost think that's like an analogy to like raising kids. Like accidentally said a bad word. What did I feed my kids? Whoops. What were the implications? Well, won't go into that. And then what did I get back from them? Well, a lot of crap. So that wasn't the word I used either. So All right, well, thanks for coming on, Shelley. It's been great to have you here and discuss these topics. Really appreciate you coming in and talk to you soon.

My pleasure.

Thank you so much.

Awesome. Thank you.