From Law to Cybersecurity with Jonathan Steele

Get ready to discover some of the most actionable DevOps techniques and tooling, including performance and reliability for some of the world's smartest engineers. Hey, I'm Joe Colantonio, host of the DevOps Toolchain podcast, and my goal is to help you create DevOps toolchain awesomeness. Hey, ever wonder how a legal background can enhance a career in DevOps or cybersecurity? Well, our guest, Jonathan Steele has leveraged his legal expertise to to tackle a lot of complex security challenges. Stay with us to learn how. If you don't know, Jonathan began his career as a top rated family law attorney. Recognized as a rising star and leading lawyer in Illinois. He transitioned to cybersecurity and has become an expert in all things security related. He's also the founder of Steel Fortress, where he leverages his legal and technical expertise to provide comprehensive cybersecurity and privacy consulting services. You don't miss this episode. I think it's going to be really unique for things you probably haven't heard before, how legal things impact security, and things you need to know about as well. You don't want to miss this episode. Check it out.

Hey, if your app is slow, it could be worse than an error. It could be frustrating. And one thing I've Learned over my 25 years in the industry is that frustrated users don't last long. But since slow performance isn't sudden, it's hard for standard error monitoring tools to catch. And that's why I think you should check out bugsnag, an all in one observability solution that has a way to automatically watch for these issues. Real user monitoring. It detects and reports real user performance data in real time so you can quickly identify lags. Plus you can get the context of where the lags are and how to fix them. Don't rely on frustrated user feedback. Find out for yourself. Go to Bugsnag.com and try for free. No credit card required. Check it out, let me know what you think.

Hey Jonathan, welcome to the Guild.

Good to be with you. Thanks for having me on.

Awesome to have you. Really excited about this episode because you have a really unique background. So I guess to kick it off, everyone's probably dying to know why move from career in law where you seem to have really excelled and move it over to cybersecurity.

It's a good question. It's one that I've been asked quite a bit recently. And you know, I haven't dropped the law practice. I still do that to pay the mortgage, so to speak. But there's a lot of overlap between the specific field of law that I practice in and cybersecurity and privacy in general. A lot of times clients come in and they are looking for advice about how to unplug a spouse's access to their devices. They all come in with call it a paranoia or suspicion that, you know, my spouse has access to my messages, my emails, my photos, my device, they have spyware on my device. So just having the knowledge and the skillset to be able to guide them through, you know, helping them sleep at night and making sure that that isn't the case, or if it was, that it's no longer the case, has been an asset to clients. And so I've noticed just an overlap between the two.

Nice. So I work with a lot of companies, they develop software, DevOps, things like that. Do you see a rise in people companies be accountable for if for some reason they release software that causes personal information to be leaked or things like that because their security wasn't tight enough?

There certainly is more and more of that as the days go on. Every time I open my news app on my phone, I'm seeing more companies that are suffering data breaches and regulations getting a little bit tighter around the obligation to notify customers when data has been leaked. And you know, if you ask me, it's not gone far enough. I think there's too long of a time that companies have in which to disclose that. But you know, the law is slow to change and so it's just going to take some time to work its way through the system.

Gotcha. So in general, in general, not legal advice, but are there any guardrails companies or developers could have in place to maybe avoid any potential things down the road?

You know, if it were up to me, and maybe that's just me being a privacy enthusiast, I would encourage companies to collect as little data about their customers as possible. Because what you don't have, you can't leak. So you know, if you don't need your customer's home address or you don't need their phone number to give them service to something, don't collect it. Because when you suffer a data breach, you don't have it to give up. So things like that, you know, using end to end encryption for like an email provider, you know, if you don't have the content of your customers emails, you can't produce it, you can't leak it. So collect as little as possible. Which I recognize isn't the most marketable strategy for companies that sell their customers data. But you know, to your question of avoiding liability or exposure, it would just be to collect as little as possible.

Gotcha. So is that an easy case then? If for some reason someone came to you and said, hey, this company leaked my email, it wasn't encrypted, like how often does that happen? And likely is it that the company would be really liable for that?

You know, there's two questions there. There's can you prove damages for the leak and if you can prove damages, can you prove what's called proximate cause for the damages? So you need to be able to prove both of those things to fix liability to the company that leaked the information. So sometimes, you know, proving damages is a hurdle because maybe you haven't noticed the damages yet. Maybe they're going to sort of present themselves down the road and you know, it's going to take some time before that gets flushed out. And you know, then in the meantime the statute of limitations is running. There are certain statutes where, you know, if a company violates them, damages are presumed. And so you don't need to actually prove and put a specific dollar amount on them. But in most cases you need to be able to prove damages and then assign it specific to the company.

Gotcha. So Jonathan, are you aware of any tools that if someone's developing software they should have in place maybe to just right off the bat just avoid this? Let's say they do need to collect email addresses and sensitive data to just part of business. Are there things they could tools that they can use to maybe avoid leaking data?

I think there's various ways of anonymizing data in terms of how you're storing it. I think that obviously data encryption at rest is a good safeguard. And that's, that's nothing new. That's been in place for years and that's, you know, a robust method of preventing data leaks. And then there's also just nowadays there's more and more machine learning firewalls that have the ability to do network analysis, data inspection and look for anomalies in traffic that shouldn't be there. And so, you know, if you are mostly collecting data, if your server is uploading tons and tons of data and at hours that you shouldn't even be active, firewalls like that can be a valuable asset. They can jump in there automatically and cut off that access. So tools like that I think can be helpful in that situation.

Nice. How does someone know if the data's been leaked? How do they even know? Like, oh, it's been leaked, who did it, who knows? It's up there on the, on the web somewhere.

You know, there's various indicators of that. You know, if you start getting a huge slew of unsolicited text messages to your cell phone, that might be an indicator that your data's been leaked. If you start getting huge surge of spam emails, that might be an indicator that your data has been leaked. If you are seeing signs of identity theft, like somebody trying to open new lines of credit, things like that, that can be a sign that your data's been leaked. One method that I use to personally and with customers to help them with privacy is to use pseudonyms. So to use email aliasing services. And so basically at this point, I have a unique email alias for every service, every website, every app that I use. And then so for instance, if I sign up for Royal Caribbean Cruises, my email address will be specific to Royal Caribbean Cruises. And so then if I start getting, you know, spam from AMC movie theaters, it's a good indicator that it was leaked from Royal Caribbean, because how else would AMC theaters have my Royal Caribbean email address? So, you know, depending on your footprint and your cyber security posture, I think there's different indicators, but some of those first ones are just general, broad, broadly applicable ones.

Gotcha. So you talk about anomaly data. Email is probably kind of not easy, but the most common. I used to work in healthcare though, where even when you're developing software, you couldn't use real, real data. Had to be anomaly is that companies need to probably invest a lot in, because I would think that would be even a greater lawsuit if for some reason someone's using someone's real medical records to do testing and somehow gets in the hands of someone that has nefarious uses of it.

HIPAA is one of those statutes that has some pretty severe penalties. And so companies that are dealing with health care, companies that are dealing with medical records, they are well served to obviously anonymize data to, you know, use encryption in transit, encryption at rest, because the penalties that are associated with even an inadvertently are severe. And so if you're not taking all the proper safeguards, you've got a huge exposure.

So I would think a lot of these are known. But are there anything new coming up in cybersecurity that you think companies or people in general need to be aware of, security wise?

You know, AI is sort of the buzzword of the day. I mean, it will be for the foreseeable future. And I think, you know, companies are, they're Taking a very different approach depending on the company, depending on the industry. Some companies are very cautious, some are outright prohibiting any sort of AI usage. And then some companies are jumping right in without any regard for what exactly they're doing, what kind of data they are handing over to perhaps a large language model like ChatGPT or Llama, and they're doing it arguably, at least from a legal perspective, in a reckless manner because they don't really understand the privacy implications, they don't really understand who owns the data once they are using these tools. And so, you know, I think that that's certainly sort of the emerging theme across all industries right now is how to implement AI and how to do it effectively and how to do it safely.

So that just jotted my memory here. So if I'm a developer, I usually say I'm using GitHub, Copilot, which has been trained on all these open source libraries, that someone else's code basically. It could be, I guess it could be proprietary on top of it without you knowing. If I'm developing software and I'm using that, could I be open myself up for liability down the road? Is that something you see as possible? I know you're not a mind reader or a future teller, but fortune teller, is that something that people need to be aware of? Like, yes, AI is great, but maybe if we leverage it this way, it could open us up to legal action down the road if we're not careful.

You know, that's the million dollar question. And there's no good answer to it at this point because as I mentioned earlier, the law is slow to evolve, the law is slow to change. And you know, the way that the legal system in the United States works is until someone gets sued and they lose and they appeal. There's no case law that really deals with these kinds of breaches, these kinds of suits, this kind of liability. So it's sort of untested at this juncture, but it raises a good question about, you know, you can't really point the finger at a computer. And so if you have cybersecurity departments for enterprise use that are leaning heavily on machine learning, that are leaning heavily on AI network analysis and traffic analysis to make autonomous decisions about the cybersecurity for the company. If they make good decisions, no harm, no foul. But when they start making bad decisions, somebody with a real name and a face needs to be accountable for those decisions and just being able to say, oh, I used AI, so don't hold me accountable. I don't think that's going to fly. So, you know, it's going to take some time before that makes its way through the court system and gets tested. But I think at the end of the day, the courts are going to want a person, or at least a company to be accountable for the decisions. So I think that's going to apply to GitHub and any sort of implementation of that.

So you mentioned law is slow. It takes a long time to get a law in place and things like that via cybersecurity, things happen all the time. So, like, if someone is at a company, how do they know that they're at least compliant with the. All these probably new regulations or cybersecurity laws and regulations that are being released, especially from different countries. Is that something that should be in place for every company?

You know, that's why big companies should have in house counsel. They should have legal departments. If they don't, they should engage attorneys to review their practices, to review their privacy policies, to review every part of operations that the company engages in, because it's hard to tell. And, you know, lawyers are writing the laws and they write it, you know, if I'm being a cynic, they write it in a way that only lawyers understand to keep themselves in business. And so, you know, it's hard to navigate some of these. You know, HIPAA in particular, as you mentioned earlier, I don't know that you mentioned it by name, but you mentioned the health care industry. HIPAA is a real dense and long statute. And so as a layperson trying to read that and understand it without, you know, the assistance of an attorney, good luck, you know, if you're able to do that. Props to you. Maybe you've missed your calling in a different profession, but you really, you do have to, you know, employ professionals that do it for a living. And that's what lawyers are there for.

All right, so interesting. AI not only does it pack developers, but also law. I got a, a contract from a company and it looked kind of not sketchy, but a little bit out of the, out of the ordinary. I ran through AI and, and it flagged some things. I'm like, all right, I'm not going to trust AI, but I'm at least going to use it. So when I talked to a lawyer, which I eventually did, I was able to point out things. Hey, this pointed out this. Is this a real issue or not? Is that something you see? People can at least take the first step, maybe to help them before they contact, allow you to be more informed.

You know, it Helps, it helps to, you know, set an agenda for your meeting with a lawyer. It helps to outline sort of just general legal issues and then ask the lawyer to weigh in on them. Where I'm seeing more of this issue presenting itself is it's sort of an equalizer in a litigation process. You know, at one time, if you weren't a lawyer and you were up against a lawyer in a courtroom, good luck to you. You don't know the rules of the game, you don't know what you're doing. And so you're at a disadvantage from the start. But nowadays, with the assistance of AI, even a pro se litigant or someone that's unrepresented, they might be on equal footing with the lawyer. They might have equal access to the law and the rules of procedure. And so, you know, it's sharpening the tools of lawyers, certainly because they need to be able to, you know, keep up even with a pro se litigant that may have access to this kind of information. So, you know, as lawyers, we either embrace the new world with AI or I think we're going to get left behind. And so it's, it's important from the legal profession and certainly I think, to answer your question, because maybe I didn't, I think it does help to at least bring the issues to a head to have the lawyer weigh in on them. At the end of the day, I do still think there's a need to have a human decision maker involved in that process. And having the credentials of a lawyer to be able to weigh in on an issue that maybe you teed up with AI is still the right way to go.

All right, so another random question just popped in my head here. Is that so can you foresee if maybe this already exists? A large language model trained on law that a developer can bake into the system so when they check in code, they can at least say, hey, this violates this regulation. That violation something to be aware of. You may want to check with your legal department before proceeding. Is that something you see happening or is it happening already?

There are different implementations of, you know, like OpenAI is being the engine for certain legal applications of AI. LexisNexis, Westlaw, they're, they're both doing their own iterations of AI at this point, and they're mostly marketing themselves as privacy respecting so that law firms can use them without the concern of are we, you know, violating the attorney client privilege. But they're also offering the benefit of case law that they are trained on actual law. Whereas if you go on to something like ChatGPT and you ask it for a citation to law, it might hallucinate, if you're familiar with that, and it might just make up a case, and it'll confidently make up that case, and then you might go cite that and you might find yourself in some trouble. I have found in my own practice the ability to create my own GPT using ChatGPT, where I will create its knowledge base by feeding it actual law, by feeding it the actual rules that govern cases in Illinois and then prompting it with questions. And that tends to be much more reliable. So I think, you know, to answer your question, if you were to feed the knowledge that governs the industry in which you're going to ask the questions of AI, you know, does this code violate any regulations? As long as you're feeding it the knowledge that it needs to answer that effectively, it's. It certainly should be able to, and it should be able to make that decision for you or give you guidance much faster and much less expensive than asking that question to an attorney.

So that even you just planted a thought in my head here. So you said in Illinois. So even different countries have different laws, I assume different states have different laws. If I create a product that is worldwide or US wide, I guess, do I need to take into consideration all the different laws that may impact my software based on each state?

So the premise of your question is true. Every state, for the most part, has its own set of laws. Every country has its own set of laws. And you know, whether or not you need to comply with each state, each state's law. If you're going to sell your product in each state, you know that it goes back to the first year of law school about jurisdiction and where you can be sued and what you can be sued for. You know, can you only be sued in the state in which you're incorporated as a software developer company, or can you be called into each state in which you're selling your services? And most likely the answer is going to be that you can be called into litigation in the state that you are incorporated in, you shouldn't get sued in each and every state just because your product is being sold in each and every state. That would be a burdensome obligation. But, you know, it's important to make sure that you're not blatantly violating any, you know, privacy rules. You know, something that comes to mind is if you're familiar with, like Google Nest products, they have a feature facial recognition, and there's an Illinois Law that prohibits the collection of biometric data without consent. And so when you plug in a Nest product in the state of Illinois, the Nest product will recognize it is in the state of Illinois and that feature will be disabled. And so I think they're taking a proactive precautionary approach to be a state specific compliant version of their software. And so, you know, whether it's technically required or not, they have been sued in Illinois and so they're avoiding future lawsuits by doing something like that.

Wow. So I was just about to ask how the heck did Nest know? They only knew aft again sued. So I don't even know how you avoid that because who knows what Estates has on their books. But that's a, that's interesting. Something to definitely be aware of.

If you're a company like Google, you should know the answers.

That's true. You know, yeah, that's true, true, true.

They have the resources to do the research on state specific laws. It becomes more burdensome when you're a smaller shop.

Right.

Because you know, do you want me to employ a lawyer in 50 states to do research in 50 states and advise me on every state's laws? That would be burdensome.

Absolutely. So speaking of that, a lot of companies may not have in house, maybe they're small enough, they don't have in house legal counsel or know about cybersecurity. I know you, you have your own consultancy, Steel Fortress, I guess. Can you tell me a little bit more maybe about the type of services in cybersecurity and privacy that companies and clients go to you for sure.

You know, there's obviously no shortage of cybersecurity companies. I mean, if you hop on Google or your favorite privacy respecting search engine and ask, you know, what is a good cybersecurity company, you're going to get hundreds and hundreds of pages. I think what differentiates us in terms of our consultation services and some of our hands on services is the nod of a lawyer. So you know, some of the clients that we offer consulting to, they care enough about cybersecurity, they care enough about privacy to know there's an issue, to know that it's an emerging issue and it's only getting worse. But they don't have the knowledge and they don't have the skills to do much about it. And so they look at this service as more of a, an insurance policy, sort of a check the box and it's giving me some peace of mind, I can sleep at night. And some of them, you know, they may be concerned about Some of the frequently suggested privacy protection measures and whether or not they're dabbling in a gray area by employing any of those. For instance, you know, if you follow privacy at all, you might use a VPN on your mobile device, you might use a VPN on your laptop. But some executives that aren't, you know, super versed in cybersecurity and privacy, they hear that people use VPN for nefarious usage. And that's true, certainly. But like any tool, there's a good use and there's a bad use. And so just having a lawyer explain to them it's perfectly legitimate, go ahead and use a VPN gives them not only the peace of mind of knowing their unencrypted traffic on like a public wi fi might be a little bit safer, but also that they're not violating any laws by using that. Or when we suggest to them that they use pseudonyms for when they're signing up for services and they use as much falsified data as possible. That kind of advice to someone that knows a little, but not a lot can be concerning. And so hearing it from a lawyer that it's okay, it gives some peace of mind that people are looking for.

Nice. So, Jonathan, is that worldwide countrywide? Does someone have to build Illinois for legal advice? I never know for a lawyer. Does it, I guess you practice in Illinois, but does what you say, is that legally binding in all states? I don't know if that makes sense.

So, yeah, as an attorney, you're licensed in one state or you can be licensed in multiple states, depending on if you've taken the bar or, you know, whether or not you've gone through the licensure process in individual states. You can also practice in states you're not licensed in on a per case basis by permission, assuming you have a supervising attorney in that state. But I think the, to the, the more root of your question is we're not, as a privacy and cybersecurity company, offering legal advice. If you want to engage us as attorneys, you can engage us separately outside of the context of Steel Fortress. But we're giving privacy and cybersecurity advice. We're not really giving legal advice. And most of the services that we offer through Steel Fortress can be worldwide. There's, with one limitation that say we offer on site, physical premises assessments of security, you know, surveillance systems, access systems, physical access like deadbolts and, you know, fortification of your physical premise that can be limiting depending on where you are and whether or not you're willing to pay the consulting fee for travel. So that's really the only one. All the other features like the network protection, the account protection, the privacy stuff, all of that can be pretty much deployed anywhere.

So we were talking about Nest and how it does visual, you know, audio and video and captures someone's image and all that. And we talked about AI. There's been a lot around bias algorithms where it has issues or it's just bias. Maybe it's not able to recognize certain people of color or it flags certain, certain characteristics because of someone's ethnicity or whatever it is. Is that an ongoing legal thing that you think people that developing software need to be aware of? And that's being something that could definitely be challenged in the future.

I do. You know, one of the concerns around the implementation of AI in general is the data that's being fed into it. It's the expression that gets used often is garbage in, garbage out. And so if, if the data that's being fed into an AI model is biased, it's going to make bad decisions, it's going to make wrong decisions. And then back to the point of you need a human accountable, at the end of the day, it's concerning to whoever that human ends up being. If the data set that's being fed to a language model or to an AI model is biased data. So it's certainly a concern. It's certainly. It's not even just bias, it's just data that being fed into AI in general needs to be good data.

Jonathan, one other question. So who's liable? Say a company is creating software, but there's someone, there's a developer that's doing something nefarious. I guess you go after the company because the company is the one with the money. But could a developer be liable for something they may have done if they did it intentionally?

Most likely not. You know that the test is going to be whether they were acting within the scope of their employment or whether they sort of went rogue and what the terms of their employment agreement are. If they are a W2 employee for the company, if they're a 1099 employee for the company. But without getting too far into the weeds of that a legal nuance, the short answer is most likely not. The liability is going to rest with the company.

All right, Jonathan, before we go, is there one piece of actual advice you can give to someone to help them with their cybersecurity efforts? What's the best way to find or contact you?

If you go to steelfortress.com, there's ample contact information for me. You know there's a link to contact me on Signal, which was my preferred method. That's the fastest way to get me. Or there's email. So head over to Steel Fortress and you'll find my contact information there.

Remember, latency is the silent killer of your app. Don't rely on frustrated user feedback. You can know exactly what's happening and how to fix it with bug snag from SmartBear. See it for yourself. Go to Bugsnag.com and try for free. No credit card required. Check it out, let me know what you think.

And for links of everything of value we covered in this DevOps toolchain show, head on over to testguild.com p159 and while you're there, make sure to click on the SmartBear link and learn all about SmartBear's awesome solutions to give you the visibility you need to deliver great software. That's smartbear.com so that's it for this episode of the DevOps Toolchain Show. I'm Joe. My mission is to help you succeed creating end to end full stack DevOps toolchain awesomeness. As always, test everything and keep the good. Cheers. Hey, thank you for tuning in. It's incredible to connect with close to 400,000 followers across all our platforms and over 40,000 email subscribers who are at the forefront of automation, testing and DevOps. If you haven't yet, join our vibrant community@testguild.com where you become part of our elite circle driving innovation, software testing and automation. And if you're a tool provider or have a service looking to empower our guild with solutions that elevate skills and tackle real world challenges. We're excited to collaborate. Visit test guild.info to explore how we can create transformative experiences together. Let's push the boundaries of what we can achieve. O the tescill Automation Testing Podcast with lutes and lyres, the bards began their song A tune of knowledge, a melody of code through the air it spread like wildfire through the land Guiding tester showing us secrets to behold.