The #1 Reason Organisations Must Continually Judge Employee Trust

Hello everybody and welcome to the virtual pub, episode 13. I'm Boss Fisher and we have Shauna Fear and a wonderful guest, Edward Barker, who's the CEO of Clean Life Vetting Agencies. So today's discussion we're going to answer why organizations need to judge trust on an ongoing basis. So welcome gentlemen. But before we get down to business, today is the anniversary of the Australian Air Force 100 years. That's quite amazing given the fact that we've been flying since 1903. So fun fact for today. So before I get you and answer lots of questions, I'm going to get Sean to set the scene and specifically where we are next.

Yep, thanks Boz. And hello everybody. So the topic today we chose to talk about is how or should organization trust or judge the trust they grant their employees one off or constantly. And let's start with talking about what is it employment or what are the employment relationship. It is the link between employers and employees. It's the mutual belief and the trust when a person perform the job he was tasked with and in return he will get the salary. Many organizations believe that the simple contract, the basic contract between employer and employee is a contract and a salary. So once employees are hired, they're expected to be good because they get salary. But there is more to that. The relationship doesn't end just between contract and a salary. There are expectations that need to be met. Employees are expected to display positive and respective or respectful attitude. They need to work with honesty, integrity. They need to take care of the business interests, follow its values and policies. And employers the employees expecting them to provide them with safe workplace fair treatment. But also they are expecting to get appreciated, be heard, maybe to get development programs and opportunities such as promotions. So this basically describes the employment relationship to you, Boaz. Great.

So that's a great start to setting the scene. And I'm going to turn it over to Edward. Edward, before I ask you the first question, get you to briefly tell me a little bit about yourself and a fun fact because I know how much you love doing that. Well.

I'm a father of two and have a beautiful wife, so a bit of a family man if you like. We've been doing suitability screening for the Commonwealth government since 2010. So 10, 11 years now. So just really enjoying those elements of people risk and looking at how is that trust measured and how is that trust managed. So today's events are pretty interesting fact, personal fact or professional fact?

No, you've already done that.

Oh, okay.

All right, thanks. Now I just wanted so people know, get a little bit who you are. So here's my first question. So now that we've hired a candidate, now that they become a trusted employee, what are the challenges or what are the. Some of the challenges that organizations are facing today in ensuring that employees stay trustworthy? And if you want to call it good.

Yeah. Okay. Can I give you another fast fact, professional?

Yeah, you certainly can.

So Deloitte just came out recently with research that talked about organizational reputational risk. And so it was about concerns of trust. And the term they used was ethics and integrity, which causes fraud, bribery, and corruption. And they said this Deloitte survey said that was their biggest concern. The concern was reputational risk. And so in other words, the surveyed companies considered that the lack of integrity, bad apples that taint a trusted workforce, is a bigger threat to their reputation than any. Get this. Any security risk or any IT risk. And that's huge. Right, because data breaches, I just heard yesterday, I think it was that 2020 had the more data breaches than the last 15 years combined. Do you hear what I said there? So Data breaches in 2020 were largest by 15 years combined. Right. But then you put that on top and say, actually our reputational risk is more important. The ethics and integrity of our company is even more important than those things. And so that just when I saw that and tried to put that into context in terms of the discussion we're going to have, it is so important. And so the challenges. Coming back to your question. So the challenges of organizations today are literally trying to judge and assess and evaluate a person's level of trust continually in some sort of systematic way. It's really, really difficult. And that's, I guess, the challenge. So I guess, I don't know if you remember, there was a president that once said, all we need to do is trust them, then verif. And I know that that has been quite a mantra. Let's trust our employees and we'll verify them somehow in some way along the line. But I don't know if that really happens. Well, and I don't think that really happens appropriately most of the time. So I guess that would be the challenge is trying to educate or to reevaluate that kind of slogan.

Great.

Excellent. Sean, did you have a few comments that you wanted to add? Because I know the next question is about trust by default, but I just wanted to step backwards and answer that first question. If you've got any things that you want to add, I think I can.

Just add to what Enid said You know, you talked about the reputational risk and it's all about. When you talk about data breaches.

It.

Is a mantra that we say all the time. Data doesn't leave the organization by itself. It's always about people. While organizations know their systems quite well, they know how to protect against risks. They know how to identify the risks on their infrastructure, facilities and data. Their people are quite mystery. They know certain things about people, but they don't know everything. Most of the motivation that drives people to do stuff is still hidden and not revealed and it will not be revealed by interviewed or quarterly briefings. So I think this is the major challenge. A lot of blind spots on the biggest assets of organizations.

That's so true. That leads me to the next question, which is basically, why do organizations give trust by default? Edward, your say, your comments.

Yeah. So I guess the key one is because they got the job, they got hired, they went through this whole process of candidates from 100, 200 people down, whittled down to one, and they got the job. So they proved that they could win the position. So give them access, give them access to the crown jewels, they must be okay.

Correct? Correct. So now the question is, Sean, is why should we continuously judge trust?

You know, I'll give an example. Nobody can drive a car on our roads unless they have a driving license. So they learn how to drive, they learn the rules, they pass all the exams. And then finally, when the state or the government, country decides they are qualified, the country grants a trust in a form of a license, driving license. So now we trust you guys, you can drive on our roads. But does it end there? Obviously we know it's not true because we get the driving license. But from now on, that trust is being monitored all the time. So if we fail to follow the rules, if we fail to demonstrate or to justify the trust, we get punished. So there is enforcement, but also there is a lot of deterrence to look at our behavior because unlike systems, people are very dynamic and we are subject and our behavior is subject to changes. So we can't accept, we can't get an employee and grant them with a trust. And from now on, throughout the entire employment period, it could be one year or 15 years, they are trusted. And so the trust is if their behavior is changing, we need to measure, engage the trust all the time.

Correct. All right. So Edward, do you have a. Did you want to add something to that?

No. That's right. So people do change over time. Sometimes those changes are good and mature and they're moving on, they're learning new capabilities, they're getting more resilient. But you can't just assume that there are changes in people's over time because of different stresses in their life, different motivations come into, you know, their world falls apart. Covid hits whatever the case is, there's things that come into people's lives and to be able to watch that person's risk profile go up or down or become more susceptible to or vulnerable to violence in the workplace or anything else, you can't just go, okay, change over time. It's going to have to be good. Because that's just not the case.

Correct. So let me be somewhat of a devil's advocate there, Sean. There are those that said that we are constantly being judged, we're constantly being martyred. So why should employees agree to the proposition of being continuously judged like Big Brother in some ways?

Well, I'll just shift to another side. I mean, instead of looking at that as spying on people or looking at people and try to, you know, help them to fail, let's look at them the other way, on the correction way. Any organizations who hire people wants to make sure that these employees are reliable, engaged and taking the best interest of the organization. That's why this is their responsibility to make sure that they're happy, to make sure they know trained and doing the right thing. And if they're doing something wrong, if they are failing or doing mistakes, it's their organization responsibility to correct them. And we can all. It's like when we as parents we discuss about us being parents. We correct our kids behavior even if they misbehave. It's our responsibility, parents to correct them, to show them the right way, to guide them. And in that way we also make sure that we reduce the risks to the business. Look, systems are, systems are fixed. It's either 01, okay? But these systems are monitored all the time. If something happened to the company's server or the entrance boom gate or the Lyft, if it doesn't work, it's monitored. If something happens, it will fix immediately. What about the people? The people are the greatest asset to your organization. They operate the organization. Without people there is no business. But still, if people are failing or if people are broken, shouldn't they be fixed?

Yep, that's what the employee assistance programs are designed to do. Someone is hurting and mental health is an issue. There's an employee assistance program that can be reached out to, to be able to help them to fix and to repair that person at that time. And that's a great attention by the organization to assist their staff. So it's a good example.

But the problem is totally correct. Many of these characteristics, elements or emotional elements are not seen and they are very difficult to expose or identify unless the person is willing to come and talk about that. People don't like to talk about the problems. People don't like to reveal their personal issues, especially if that can, you know, put their position in a risk or it could be fired or sacked. So the way we should look at people behavior, it's a bit different. Not at the behavior itself because sometimes there are unseen, you know, people come with goals, aspirations, agendas, ideology. It can be changed. Someone can be good and then the next day it can be bad because he saw something on the TV or he saw a movie that changed his mind. So we need to look at their results, the results of their actions. This is how we can learn about their behavior.

That's makes sense. Yep. Certainly in the previous session that we three of us did, we talked about trust being a function of character and capability. So the result is part of the capability. What you also early indicated that we don't really have visibility, especially when you're talking about the motion side of things about the actual character. And that's something we're going to be talking about very soon. But for those of you that haven't seen it, please go and watch episode 12 where we talk about trust and why it's important. So Edward, should trust be dynamic or static?

Dynamic for sure. Humans are dynamic. They come in, come to the workforce with baked in and even below the surface weaknesses. You know, you can't see it on the resume, but there's weaknesses, there's foibles, there's vices, and so really there's no such thing as a set and forget.

Yeah. So Sean, what's the challenge for organizations to provide trust by default to a new employee?

First of all, let's describe what's trust by default. Trust by default is a trust that you provide or grant another person or entity when you don't have the ability to change the results. So if you don't have the ability to impact, you trust. It's the same like when you're on board the plane, you don't really qualify or ask the pilot whether he knows how to fly the plane. You just trust them. You trust your doctor when he give you prescription medicine and you trust the waiter when he provides when he gets you the food. Right. You don't check whether the food is poisoned or not. You Trust you trust even the coffee shop when they give you that $4 coffee because you don't have the ability to impact. But at workplace organizations, they pick their employees. So first of all they qualify them, do all the processes before hiring them to make sure they're picking the right people. But when they're picking them, although they're getting them into the trusted layer, into the family, still there are a lot of controls in place to make sure they're doing the right thing.

Right.

If they were trusted them by default, obviously they wouldn't have any logins and restrictions and policies. Right. We have a lot of controls and policies and regulation in place to make sure that people are aligned to do the right thing, to do what they supposed to do. So I think that in workplaces the trust is very dynamic. It's been judged not enough, not enough. So that's why we have a lot of inside the risk and inside the threats, incidents, people are breaching trust when they steal data, when they harm the organization, it's a breach of trust. That's the right term.

Exactly. So I want to raise an interesting topic to you there, Edward. We know that. Well, should I say according to Carnegie Mellon University and the insider threat division of cert, they're basically from their database they've seen that those that commit inside of fraud have been in an organization five to six years and that's when they typically start committing fraud. So the question to you, why that long?

That's a good question. A bad hire is usually detected much earlier than that. Right. So that's why some recruiters offer a 90 day replacement guarantee. Because something may not work, it may not be the right fit, they may might have been just bad apple. So yeah, that sort of, that aside, in terms of that five to six years. Yeah. Passenger time happens, they get familiar with the work environment, they're trusted in the organization, their personal life changes. I mean we talked about it last week about, sorry, last episode. About being 15 years between a security clearance at a baseline level to the next revalidation. And obviously 15 years is a massive amount of time and going on. But you know, maybe it's you know, five or six years, you feel really strong in there. An expression of interest comes along to get a promotion and you know that you are hands down the best person for it. So you get promoted or you didn't get promoted, there's changes in your life that give you an opportunity to do harm. And so if you look at the traditional fraud triangle, I don't know if you, I Can, Yeah, yeah, yeah. Can I, can I just share that with you?

Yeah, yeah, go, go ahead.

If I can get that. So the, the. Let me see.

While you do that, make sure you have a beer today, because that's why it's called the virtual pub.

All right, now that didn't come up.

So we can see.

Yeah, that's, that's, yeah, that's the next question.

So you can leave it there, but you can describe. Or I can describe the fraud triangle.

Yeah, so the fraud triangle is essentially sort of a. Whoops, where is. It gives people the ability to, to recognize. So it talks about the different between opportunities. So there's internal controls that are going on, or none of the controls. Maybe it. Perspective when these things aren't going on. There's rationale that's going on in terms of fraud and then there's a pressure, there's motivations that are associated with it. And so there's debt, there's greed, there's lifestyle needs, there's life pressures, there's gambling, there's drugs, there's internal pressures, so pressures to perform. And all those types of things are happening inside that threat. Sorry, that fraud triangle. So if you take a static approach, you're never going to be able to look at any of those three in any reasonable way because you just won't, you won't sit there. So it's sort of like that perfect storm of this pressure. There's no one watching what you're doing. And then there's the rationale. Well, I didn't get that promotion or the boss does something dodgy, so why can't I? So that's kind of like that perfect storm that's going on. And that's where you'll find when coming along that hostile act to a critical path to the hostile act. And so that's sort of what we're looking at there.

Beautiful. Okay, which leads me to the next question.

Oh, sorry.

You have something you wanted to say?

Yeah, I think just to summarize what Idris said, it's all about a tipping point. A tipping point. It's like when you look at the roller coaster, it goes up and down, but before it goes down, there is a tipping point where the energy is setting on a different direction. A tipping point is a trigger. Well, a tipping point is the point where triggers are triggered. And yeah, that simple. It is. So you're right. When people, when we talk about fraud, we talk about confidence. When people are confident enough in what they do, they have enough confidence in the systems. So they can manipulate it. They have confidence in the system because they know they are trusted. That's why usually inside the risk, they come from the trusted layer. Right? These are the trusted people. So their motivation, the drivers, the, that drive them to do such a thing, it varies between money, revenge, any financial benefit, espionage or any other element that could trigger maybe a day before. So the intervals of monitoring people behavior or looking at tipping points, we can't set intervals. It should be constant because we are dynamic, we change every day. And you know what? The more people are trusted, the more risky they are, the more risk potential they pose to the organization. It's a paradox, but it's true.

Yeah, Yep, yep, that's true. So Edward, you, you just, just a few moments ago you shared a screen which is called the factors along the critical path. Could you share that again? Because I think that's a very relevant discussion and just explain it briefly to the viewers of what it is and why it's important.

Yeah, sure. So you've got essentially four columns there on the far left hand side. You've got personal predisposition. So psychiatric mental health conditions, personality issues, previous rule violations, even predispositions, some potential. And social networking risks as well. Who you hang out with can also be a factor, whether you're talking OMCG or a boyfriend of an OMCG member or members, what have you. So as an example, and then the second column there on the left is stressors. So that's what we talked about, the change of circumstances. So there's personal stresses that have come on to you, there's professional stresses that have been, that are now impacting you more than five years ago, let's say, or financial stresses. You bought a brand new home and you're underwater now because something's changed in the marketplace. So all these stresses are coming upon you and then it usually does bleed out. And that's what Sean was saying was it bleeds out into your behaviors. The user behavior does change. And so lots of different ways that happens. But there's interpersonal changes in terms of you're more short with your colleagues. It could be technical behaviors. You're now working on Saturday night when you normally don't, but now you are. And what are you doing at Saturday night when it doesn't normally happen? There's financial behaviors. You may be asking your colleagues for more money or help me get through until payday. Those things happen. And this is probably where we have to start looking. And that's on the fourth one where it says problematic organizational Responses. That means that this isn't just a personnel issue. This is an organizational issue. And that's where it talks about inattention. Even though people have seen those things, you've seen red flags go up in the workplace. There's nothing that's done about it, or there's no risk assessment process that happens, or there's no adequate investigation about how that person's doing, or they're just fired, which can cause, obviously, data exfiltration as they're leaving the organization, which is what we call the hostile act, which is that far right hand side. So this is like the perfect storm, right, where there's something that happens in someone's life and it begins to impact their lives and their world. And it needs to be addressed in lots of different ways, not just a simple set and forget.

Yeah, can you show it again? Because I just want to raise an interesting topic, please.

Yeah.

All right. You might want to make it bigger. This is the challenge that majority of organizations have. They don't know the first two columns, which is the personal predisposition. Because a lot of these situations, if a person is going through a divorce or has got some health issues or money issues, that is hidden, which is what Sean basically alerted right at the beginning when he set the scene. The stresses, they do appear, and the concerning behaviors are not being picked up because no one wants to actually approach and say, do you have a problem? And so the first three are predominantly left underneath the carpet. And then you've got something that we're missing in this picture, which is what sometimes happens within an organization, a catalyst for the person to become. To commit an insider incident, which is, let's say the person was promised a bonus, they didn't get it, or there was promotion, promised a new role and they didn't get it. Or the person was let go. And because of what's happened through his predisposition and his stresses and so forth, the organization completely missed it. And the catalyst was like the cream on the cake, the icing on the cake that has set the situation going. So the challenge with an organization is they don't have the visibility right now to. To see what. What's going from a physical perspective of how behavior is taking place within an organization. So I just wanted to raise that. That. That topic.

Excellent.

So. So what is, from your perspective, Edward, what is then the best approach or the best practice for ongoing suitability? How do we mar. How do we identify whether a person has changed? How do we identify these red flags? If you want to call that.

Yeah, Our background is in security clearances. And so managing a national security clearance is highlighted and explained in what they call the Protective Security Policy Framework, the pspf. And so what we're now talking about here is the ongoing. So it's called the ongoing suitability of a person. And this is where it gets tricky because it's called, that's technically called the PSPF 13. So again, you can dial in there and check that out. But the idea here is that there's some of that shift. So, yes, the security clearances are either one time, and they're done by the Australian Government security vetting agency here in Australia. So the AGFA issue a clearance to say this person is judged suitable and then it kind of devolves back to the organization. And so just last year we saw the Defence Industry security program stood up, which is basically. And all the government departments as well have to now take responsibility of the PSPF 13, the ongoing suitability of a person. And this is a brand new concept, right? So 3000, defence industry, their supply chain, all of that. And it's causing a headache because not many are aware of or attuned to these risks that we're talking about, the human risk elements. So to answer your question, what we've seen, if you looked at the Protective Security Policy Framework, I call it the ITABR letter I, T, A, B, R. So I can quickly go through them if you'd like. But basically there's an induction. So you're providing briefings about security, briefings about what is expected. Here is the policies, here's the plans, here's what happens, what's an emergency, what happens if there's a security incident, what do you need to do? All those types of things that you can't just given, you have to actually explain that. And so there's the eye for Induction, the tab is the mandatory training. So as a security clearance holder, you're going to go through security awareness mandatory training courses at least annually. There's a basic document handling, there's classified document handling courses, and if you're involved in ICT at all, which most people are, then there's a thing called the Cyber Security Awareness course. But that's again, training components to it. So they're probably. That's the I, the T, the A is the awareness. So it could be a social media cyber security awareness. You know, everyone, you know, not everyone, but you know, there's training on spam, there's training on phishing, spear phishing, whale phishing, the whole lot, right, because there's A all that is the access and the gateway into damaging from a cyber perspective, not from a malicious perspective, but the most frequent form of attack is on government and defense is through that cyber means. So you need to kind of protect your people. Don't click on that bad link, et cetera. So that's another thing we do. The B is for briefings. So as a security clearance holder, if you're traveling overseas, you may be traveling to a high risk country. And so we give you a defensive briefing about what that would look like in that country, what you should say, what you shouldn't say, helping with official travel components as well, and then debriefing. So on the way back, was there any issues? Was there a delay? Traveling to cross a border, Was there an issue in terms of police or anything like that? So we want to know if there was any issues. And it's a debriefing that we then forward onto to the AGSFA for them to do a full official risk assessment on. There's country threat briefings if the company is involved in dealing with other countries. There's the Australian Signals Directorate, the ACSC cyberthet briefings, those types of things. So we go from induction training, awareness briefings, and then the little R or the R is for reporting. So reporting of those changes of circumstances. So we've got about 15 to 20 different things that happen in people's lives over a course of a year. And so we double check, hey, has anything like this changed in your life? Have you got a new partner who you met online, let's say, and who lives in a high risk country? We want to know about it. Is there issues? We want to protect you as much as we want to protect the organization. So change of circumstance contact reporting. So that's a little bit more national security elements. But we're now talking espionage. We're talking people who want to become friends with you just to get information from you and try to. So we talk about super suspicious, unusual, ongoing or persistent questions about your workplace, what do you actually do there? And who's your supervisor? Tell me his name, what's his phone number, what's his email address? Those types of things are really suspicious. And so people would need to contact us and report those types of things and then incident reports. So cyber incidents or security incident, report those as a way, a mechanism to do that. So it's called the iTABr and we use kind of a, we call a Vantage point communicator, which is kind of part newsletter, part awareness, part reporting feature. That we provide our people.

Good. Sean, I know we talk a lot about trust, but I think there's confusion in terms of when we talk about zero trust. We're not talking about people, are we?

No. And I'll give an example. We all know we've all been in the airport, right? And when we come back from overseas, we can choose whether to go to the red lane or the green lane, right? And maybe there will be some that will go to the red line, but most of the people go to the green line, whether they have something to declare or they don't have something to declare, right? Hoping that nobody will catch them. It happens every day. That's human nature. Now, in the ideal world, in every workplace, in every big office building, we could have the revolving door. And then we could have multiple lanes. And each lane could symbolize something else. For example, people that looking for a job go to that lane. People that don't like to follow policies go to different lane. People that are stealing information, go to that lane. And people that love the job, follow that lane. So we had, we could have different lanes. Then we could really observe who is doing what and who is planning what. And we could obviously treat those risks independently and effectively. But we are not in the ideal world and everybody go through the same door and swipe their card and go to their office. We know, or the organization, their boss, the direct managers know what they are supposed to do. But in most cases and what we see when we help organization with insider risks incidents, those people who are trusted, they often do what they can and not what they should. And when people do what they can, that also relates to what you said, Edward, about fraud. Fraud, it's something that people can do but they're not supposed to do. And they do that only because they can. And they do it within their legit jurisdiction. So everything that they do is not flagged because they're supposed to do that. And they taking advantage of their privilege. So while it's the organization very focused in preventing and looking on external threats, assuming that all their employees are good, they focus on their systems, their data, their bank account. They don't look at their people. So how can we identify those who are planning to leave work or planning to steal information or planning to harm the organization intentionally or unintentionally, it doesn't matter. We need to look at the results of their actions. Nobody will tell I'm looking for a job, right? Nobody will come with a shirt. Seek.com today, Seek.com is my favorite website, right? But they will do actions that we will be able to. They will provide us indicators that if we are smart enough to collect those indicators and add them into a context, we can understand that this person is looking for a job or working in different hours. Look, people are operating organizations using systems. That's a fact, right? And when they interact with systems, they're taking advantage of what they can do. If we monitor the risk via their actions, by looking at their actions, we can actually extract what's called the metadata of their actions, extract their behavior, understand the behavior, and then add it into context with other elements come from different feeds, such as HR interviews or the direct manager interviews. We need to make a story to understand people behavior. And once we have it, then this is the right way to manage the risk. So we hire the right people, we have all the processes to filter and pick the right people. But then it doesn't end there. We give them the initial trust, but that trust evolve and change as they change the trust following them. And this is what the organization, I think, should do to manage the human.

Risk, not the technical risk, not the digital risk. Yes, long answer, but really one is about monitoring systems and saying the systems don't trust each other. Another equation is actually the people that utilize these systems, people, they have digital.

Footprints that these digital footprints people leave can definitely tell the story. They will not say, I'm looking for a job, but if you will see that people are accessing certain websites, doing certain actions in certain combinations in different hours, it's. We can help the organization understand these patterns using special technologies, but we can reflect and project these risks in a very unique and sophisticated way. This is pure intelligence. And this is what we do. We provide creative intelligence to identify these risks and stop them in time.

Okay, so, Edward, I want to sort of close up the discussion, but I want to ask you two questions. One is, what is the number one key takeaway that viewers can actually get from this discussion from your point of view?

Yeah. Well, just as you've heard, ongoing management of people's trust is harder than you think. So we would recommend dedicating resources towards a risk function in your organization. So sometimes it's called a risk officer, or chief risk officer, if you'd like. Or in the defense industry world, it's called the chief Security officer. So not just a chief information security officer. So this thing called the ciso. So it's sort of this, it's a little, not quite higher, but it kind of oversees and watches over not only the IT elements and information security, but over physical security as well as well as personnel risks. So it sort of does it concurrently does all of those things at one time and then looks at the governance elements to it and engaging those stakeholders that need to be involved. So consider designing or implementing what we call a trusted insider threat program. And I know you're, that's what you do, you help companies do that and it's a godsend. So if the viewers haven't got in touch with you, then I would recommend that they do it because that trust insider threat program is going to help kind of articulate and be able to put some measures in place that make sense for you and your organization.

Correct. So from your perspective, what are the services that you can offer, those that may need.

Yeah, okay. So we essentially there's a couple of different elements. So one, I would say that we offer four levels of personnel suitability, risk assessments. So this could be for pre employment, it could be to predict and detect a bad hire. So we help on those elements from the lowest level, which we would call a baseline equivalent security clearance. So a baseline level, what we call the CL0 basic assessment, all the way up to the highest security clearance essentially in the world, we can offer that as a standard and as an investigation, interview and assessment. So that's one thing that we do. The other one is a fairly new service and it's more national security clearance focused and national security focused and that's called Clear plus. And it's sort of a personnel security officer as a service. So it's sort of, we facilitate.