Crisis Management at the Intersection of Marketing, Privacy, Security and Reputation

Thanks, Nick, and thanks certainly to all of you who are taking the time to attend. I know this is a difficult and challenging time, so let me start off by hoping and wishing that all of you and your families are healthy and safe and staying that way. Working remotely has its challenges. So today what I'd like to do is to discuss an issue that has not been typically at the forefront of discussions other than some of the privacy and security issues, but the related issues of how one markets and protects one's reputation in this particular environment, and in some cases, the intersection of marketing and the collection of information and privacy and cybersecurity issues that kind of are on marketing practices and what you can and can't do with the information that's being collected and what this COVID-19 crisis has kind of accomplished. So with that said, you know, what we're going to do is I've broken this into kind of two sections. You'll pardon the fancy graphics. You know, the first part we'll talk a little bit about brand marketing and brand management and reputation. I'll show you some examples of, you know, some good things and also some of the, the worst things that are happening during this crisis. And then we'll move into privacy and data protection and the kind of cyber insecurity that has risen as a result of a lot of people working remotely in companies not really being ready for remote access for all of these workers. First, let's take a look at a commercial that's a little bit unusual but is quite effective from Hotels.com. And you'll notice that it's a little strange for a hotel company, booking company, to say just stay home, but that's kind of a feel-good ad that people appreciate. And so when we start to talk about these feel-good ads, You know, here's kind of a classic that was just created a few weeks ago. So that's an example of a feel-good ad that doesn't kind of really overbear you with, with the product and the brand itself, but makes people feel good and gives them something to think about as they're staying home. In general, you know, and again, from both a legal and a business point of view, brands need to let consumers know that they're up to date, that they understand the crisis, that they want to be— have people stay safe, and that they're sympathetic with people who are dealing with them. Because as you probably know, consumers are more likely to return to purchasing from your brand, or even continue it if it's, if it's related to their current situation, if they understand what you're doing to keep your employees in your store and your customers and products safe. In addition, retailers, many of which are starting to switch to online-only shopping and offer curbside pickup and, you know, encouraging to visit during senior hours or other designated sometimes they're letting healthcare workers in early. This is the time when retailers can actually ease some reluctant online shoppers by offering free shipping or other things that might make people who are traditionally reluctant to put their credit cards or personal information on the web to do so. As you can see on the lower left, a company has come out with a hand soap that literally is lasts for 20 seconds and then disappears. In Germany, McDonald's created a number of ads, actually they've created them all over, but this one is from Germany, in which there's no, you won't see a commercial for McDonald's until after the 20-second handwashing video plays. And over on the right is a mask that was created in Thailand that's certified by optometrists so that you can only read it if you are 2 meters away, which means you are too close to the person that you're reading it from. And interestingly enough, if you look at the t-shirt on the right, that t-shirt has on the inside of it instructions about social distancing, about sanitizing, and about other things that would be helpful in those situations. Clear list of instructions, which is an interesting way of kind of marketing a bunch of t-shirts and masks. In addition, here's an unlikely ad that doesn't really talk about the brand itself other than to ask you to, you know, kind of give back to the community and understand the financial crisis. Yes, you're reading correctly, 0.01%. This was, by the way, another ad in Germany, although it was done in English to be pretty universal. And it also encourages you to download the Monopoly app, which you can then use for contributing. So another example of an ad that companies are producing now to both make people feel good, contribute to kind of getting over this crisis, and helping others in need to do so. That being said, there is the bad and the ugly side of the coronavirus epidemic in the marketing and advertising world. On the right, you'll see the chemical formula for isopropyl alcohol, and on the left, you'll see a chemical formula for benzalkonium chloride. And there is a company called Recess, that was putting out a public relations pitch which patted itself on the back for not price gouging during this crisis with their bacteria-fighting face wipes, which contained the benzalkonium chloride, which the brand claims can kill the flu virus, but which experts contend is certainly not as effective as alcohol. Their release said, and I quote, "While the big companies are price gouging, we want you to have what you need to take care of yourself and your family." So we are cutting the price of our bacteria-fighting wipes for the duration of this public health issue while our supplies last. Curiously, the price for the face wipes was originally $26 for a small box, and they lowered it to $20, which I leave to your judgment whether or not that is or is not price gouging. Some claims, are not just illegal, but they can also be quite dangerous. And the Federal Trade Commission has explicitly warned companies, excuse me, about advertising. One such claim, for example, is the company Wellco, which was co-founded by the model Elle Macpherson, which has spent the last few weeks promoting its super elixir on social media and in emails. That's the lower photograph. Um, and it says, uh, at a time when confirmed corona cases is soaring in the U.S., the company was charging, uh, $80 for a sachet of the, the elixir. And an email that has been flooding the marketplace, uh, from— which is quoted as a note from Elle— um, she herself is quoted as saying, in a time like this, we appreciate the importance of our health and well-being, and goes on to refer to their super booster immune system support and other ingredients. And although the message continues to promote the purported benefits of products in the context of warding off illness, they never actually mention the coronavirus by name. And whether or not that constitutes deceptive or misleading advertising is something that the FTC is looking at. But understand that in the context of marketing and branding to consumers, these are the types of ads that will turn off consumers possibly for good, and once you cross that line, it's hard to win consumers back once the crisis is over. Another ad here, this is from a company called Ponte Investments in, based in Rhode Island, advertising a being helpful as the SBA loan program got rolled out in order to help companies apply for and get their Paycheck Protection Program disaster loans. Unfortunately, Ultimately, none of the claims in this ad are true. And the FTC— the SBA sent a cease and desist letter on April 10th, and the FTC has now filed a claim in the U.S. District Court for the District of Rhode Island indicating in the complaint claims not only that they are not affiliated with the SBA in any way, they're not an SBA-authorized lender, They made calls soliciting loan applications directly and claiming to be representing authorized banks who were lenders. And the estimates, the FTC in their complaint alleges that hundreds, if not thousands, of businesses had submitted loan applications to defendants who were charging a fee to help them process those loans. So, you know, as a general rule, you know, let me take you through some of kind of the key issues that relate to kind of promotions and advertising, and then kind of talk to you a little bit about what some of the regulators are doing in that context. Probably the most prevalent question that I get over the last few weeks has been, can I use my force majeure clause to either terminate or delay my performance under the contract. And that's whether or not you're, you know, looking at a payment obligation or a performance obligation. And I would caution you, those of you that are lawyers on the phone and those of you that are not, whether or not you're kind of going to advise a client or whether or not you're a client relying on one, these force majeure clauses generally don't excuse performance simply because fulfillment is difficult. And so courts have been very reluctant, even in situations where there have been natural disasters or other epidemics, you know, SARS being one, you know, a number of them in the past, to enforce force majeure clauses unless performance is truly, you know, impossible as a result of causes beyond the party's control. So, what you're better off doing, certainly in the context of advertising agency, media buying, supplies, and production, is looking and seeing whether or not there are termination rights, whether there are modification rights, or the ability to reschedule media buys or delay performance. And certainly in the advertising agency world, the opportunity to have make goods, especially where today many brands are pulling their advertisements that may be inappropriate at this point in time and trying to substitute them with others that are being produced to kind of refer directly to making consumers understand that they appreciate what they're going for. So, for example, advertisements that were scheduled to run during March Madness, most of those have been kind of pulled because obviously they couldn't run during the lack of a March Madness tournament. And similarly, others that kind of promote gathering together in groups or in doing activities that would today be prohibited by many government restrictions have been pulled. And so, the opportunity to do make goods, you know, is something that, you know, we typically look for in the advertising and media industry. Commercial production, It should be pretty obvious that travel restrictions and social distancing make it pretty impossible to move forward with, you know, filming talent, doing commercial production, you know, shoots. And so again, consider negotiating make-goods. You know, can the talent or you commit to kind of new service days? And again, it's very difficult in these uncertain times, so Very often companies will look for their termination rights. Sometimes the talent themselves will bow out of the contract because they are either unwilling or, you know, afraid to travel somewhere or to go to a commercial shoot, which is understandable. And so a lot of it depends on who kind of cancels first and how the termination rights in the agreement are structured. When you're filming new commercials, if you have clients that are attempting to film new commercials and agencies that are putting them together, think about what you're advertising. If products are in limited supply, it is often misleading and certainly poor judgment to be offering unlimited supplies of certain types of products when consumers simply can't get them. Similarly, doing advertisements of things that are promoting activities, these are not things that should be done, even if they can be done with CGI, with graphics, and without the use of any actual human beings involved. It's probably not a good idea to start producing content in these kind of situations. Just to kind of give you some, you know, kind of factual information about some of the guilds, the American Federation of Musicians commercial announcement agreement, you know, the AFM commercial agreement was set to expire on March 31st. Both parties have agreed to extend that until actual negotiations are able to take place. In addition, Under the SAG and AFTRA commercials contract that was recently negotiated, there is an alternate compensation structure, and a number of issues have come up regarding, you know, issues where the commercial may no longer be able to air. Again, as I said, things like March Madness or others can't air. The media buy no longer exists. Productions have been halted in midstream. And so, issues that relate to late payment penalties, cancellation fees, the maximum period of use, all of those things under the alternate compensation structure, which was kind of enacted in this last Commercials or agreed upon in this last Commercials contract and which was greatly simplified, have all now raised issues because nobody anticipated that they would have to deal with this kind of government-issued travel restrictions, you know, especially where, you know, crews are no longer comfortable with travel and with, you know, kind of gathering in groups. I mean, there have been productions that I have been involved with and been supporting from a legal point of view, both commercials and feature films that have simply shut down completely pending a time when they can kind of get back together safely. Safely and continue shooting. In some cases where there are travel restrictions, there may be alternate locations. As a general rule, most contracts for production allow you to kind of decide whether or not you, as the advertisers, want to accept the new location or say, "No, thank you." Concerts, tours, sporting events have all been canceled. And again, same rules apply. You need to look at, you know, what the termination rights are, whether there are penalties, whether or not you can kind of reschedule. In some cases, for example, some musical groups are rescheduling their concerts and performances in the virtual world and are doing this through live streaming, social distancing with each other. In some cases, there are, for example, Broadway Broadway shows are closed in New York, but many have announced that they will be live streaming some of the shows for a fee. And as you can appreciate, a lot of the streaming services have had a huge increase in services. When you talk about, and I went through this, but let me back up and mention about celebrity and expert and consumer endorsements. First of all, Influencers are much more highly valued because they can influence and film and do what they do at home. They are individuals who have huge amounts of influence, whether it's Twitter or Instagram or Facebook. And so, these people have increased significantly in value, but you need to be careful about making claims that relate to health, sanitary products, cleansing, sanitizers, soaps, laundry detergents, things of that nature. And again, the pandemic has not obviated the need to kind of comply with the FTC's guides on endorsements and testimonials that was recently revised a few years ago. And again, if anybody needs help on that, feel free to contact, you know, either me or their own lawyers if they are kind of well-versed in these kinds of substantive matters. In terms of promotions and product placement, I'll talk about a product placement that went wrong when I show you a slide in a little while, but in terms of promotions, most contests or sweepstakes have prizes. Some of them have prizes which involve travel. Most of them, if they've been drafted by a competent attorney, the official rules allow the sponsor to substitute a prize of equal or greater value. That being said, the regulators in both New York and Florida Florida, which are the two states other than Rhode Island that require bonding. In New York and Florida, if the promotion's aggregate value for prizes is $5,000 or more, there's a bond and a filing, a registration required. In Rhode Island, it's $500 for an in-store retail promotion, although they've been talking about extending it to online. But at the moment, it's still retail, which in this environment probably doesn't apply as much. So Florida has actually agreed to waive any late penalties for making revisions to the promotional rules that you may have already filed due to COVID-19. And both in New York and Florida, the regulators have announced that even if the rules don't explicitly say that, a sponsor is allowed to substitute a trip or a sports-related prize or event, you know, tickets to an event for some other prize, including, you know, cash or something that has equal or greater value. A word about counterfeits and trademark protection as well. Typically, brands will look to counterfeiting production, and some of the benchmarks that they will look at is they will scour the web for what appear to be their products, which are selling at markedly below what their normal distribution channels and authorized sellers are selling these for. What some of the brands that I've been working with lately have noticed, and which one should pay attention to, which is worth talking about, is that in today's environment, some of these counterfeiters have actually increased their prices because supplies are scarce. They know that people are shopping more online and that it is much more difficult to detect counterfeits, even for customs and border enforcement officials. Because training is difficult to conduct when you're at a distance and the trademark offices are closed and working remotely and usually trying to kind of keep up with the backlog. And so in this environment, some of your brands, especially luxury and lifestyle brands, should be careful about whether or not they are using the right metrics to continue to monitor the counterfeits and to take action against them. In terms of price gouging and pricing, I'll just give you an example. There's a gentleman in Tennessee named Matt Colvin who claims he never intended to take advantage of any state of emergency, but stockpiled about 17,000 units of hand sanitizer and antibacterial wipes, and then set up shop on Amazon and eBay. That being said, the online market platform saw his actions pretty differently and shut down his account, leaving him with a huge inventory and not to mention a public relations nightmare. While he has cleansed himself of the infamy, at least temporarily, giving up any profit and agreeing to donate his entire stockpile to the people of Tennessee, the Tennessee Attorney General's office nevertheless is still conducting an investigation into his activities. And the Tennessee action, you know, is a kind of another indication that there are limits on the ability of a seller to set their own prices, even based on supply and demand principles, when a disaster strikes. In fact, There are both federal and state laws that relate to gouging and price gouging during these times. On March 25th, there were 33 state attorneys general that issued a joint letter to Amazon, Facebook, eBay, Walmart, and Craigslist telling them that they are required to more rigorously monitor their price gouging practices, and certainly by those online sellers who are using their service. Recommends a bunch of policies in their letters to curb the deceptive and price gouging activities. Things like preventing unconscionable price increases, looking at examining historical prices and seeing whether or not those or similar products are being sold at comparable prices. Looking at triggering algorithms that notice when prices of certain things will kind of jump up, and also by implementing a special complaint portal for consumers who can report potential price gouging. So, and in general, you know, kind of going to the last point here, advertisers have to still be careful. About claims that they are making even during this pandemic. It's not an excuse. You don't kind of eliminate Section 5 of the Federal Trade Commission Act simply because there is a healthcare crisis, even one of the scope that the world and the United States is experiencing. So, claims have to be not only truthful, but you have to be able to support them with sufficient substantiation when you make them. So, retroactively finding out that something you said in the commercial was in fact accurate is still actionable by the Federal Trade Commission. And again, you know, especially with respect to any COVID-19-related or implied related kind of claims, you know, New York, the Federal Trade Commission, the federal, you know, the Food and Drug Administration, even the FCC on mobile platforms, and the attorneys general in a number of states have already indicated that they are closely monitoring any COVID-19-related claims. For example, in, in early March in Missouri, the Missouri attorney general filed a lawsuit against preacher Jim Bakker because he misrepresented the effectiveness of a product that he referred to as the Silver Solution, which would treat COVID-19. The net result of that was that, you know, the New York Attorney General, Letitia James, the FDA, the Federal Trade Commission have all issued cease and desist orders. And the, you know, another case which all of you will probably hear about if you haven't already is even back in January, the Food and Drug Administration had sent a letter to the maker of Purell the hand sanitizer, warning them about unsubstantiated effectiveness claims. They were saying that there were claims on their website that suggested that Purell could prevent the flu, norovirus, Ebola, MRSA, you know, among others. And the FDA's letter to them said that, you know, there's no— they're not aware of any adequate or well-controlled studies demonstrating that killing or decreasing the number of bacteria or viruses on your skin, produces a corresponding clinical reduction in infection or disease caused by bacteria or virus. And Purell responded to the letter and immediately changed its websites and digital promotions to kind of get rid of all that, those references. The FDA letter did not go unnoticed by plaintiffs' attorneys who've now filed 3 class action lawsuits against the company, one of them in the U.S. District Court for the Southern District of New York and two in the U.S. District Court in Ohio. And relying in large part on the statements that are in the FDA's warning letter, the lawsuits accuse the company of making misleading claims that this product can eliminate 99.9% of illness-causing germs. On March 20th, a few weeks later, a lawsuit, a class action lawsuit, was filed against a major national retailer based on the fact that its private label hand sanitizer was advertised as comparable to Purell. And although the retailer itself doesn't make any claims that its product combats COVID-19 or any other illness, the lawsuit, the class action suit, says quote, by comparing its less expensive in-house private label product to Purell, the retailer is misleading customers into thinking that its hand sanitizer is, quote, as effective as Purell and can therefore prevent disease or infection, um, you know, for example, COVID-19 and the flu. So, um, you know, as you can see, um, the lawsuit, you know, is making allegations that like Purell The retailer deceptively is claiming that, you know, the use of its hand sanitizer will eliminate germs, and citing the FDA's letter that says there's no proof that that's actually accurate. In March, the Food and Drug Administration and the Federal Trade Commission issued warning letters to 7 companies who were selling products that made deceptive or unfounded claims about the COVID about treating or preventing the COVID-19. I won't mention the names of the companies, but they all related to teas, essential oils, you know, colloidal silver, which I mentioned before, some of which claim that they can treat or even cure coronavirus. And the letters kind of order the companies to cease and desist immediately, or the FTC would go and seek an injunction. And again, it is important to understand that claims need to be substantiated. And unless a brand can support an advertising claim with what the Federal Trade Commission, the Food and Drug Administration have all said are kind of sound science, you know, well-controlled clinical studies in humans, they can't make those claims. The URL link in the middle of the page that you're looking at is a regularly updated Federal Trade Commission webpage that tracks the number of complaints that have been lodged by consumers against brand advertising. And as you can see from the categories there, the top categories, travel vacations, online shopping, mobile text messages, you know, imposters and fake businesses and governments and medical or health prescriptions and things of those natures. Those kind of top the list. And the Federal Trade Commission has in fact set up a separate website related to coronavirus scams and what consumers can do. In a few weeks ago, some of you may know the CNN show Aaron Burnett OutFront, and like many of the shows on CNN, spent an awful lot of its airtime talking about the coronavirus outbreak. And at that point in time, the thousands of people that were isolated on the Grand Princess cruise ship off the coast of California. Unfortunately, and I didn't play the whole video clip, this is just a screenshot from their the commercial. Norwegian Cruise Line had an advertisement telling people about, you know, they should feel free to continue to go cruising. And curiously, when I did some research into this, it appears that from January to March when this ad aired, Norwegian had paid about $10 million for digital in digital advertising on Facebook and Wayfair and Expedia and other sites, which compared to about $2.4 million in digital advertising for the same period last year. And there have been a number of faux pas. For example, the Sony, the James Bond film, No Time to Die, which has been delayed in its release, was promoted right near headlines about the coronavirus death toll, and obviously, you know, an unfortunate product placement or programmatic buy. So that you don't think that this is just hypothetical, you know, kind of fluff, there's been a class action lawsuit filed in the U.S. District Court for the Southern District of Florida, which claims that class members took a financial hit Remember, Norwegian Cruise Line is a publicly traded company, um, due to their false statements to passengers that coronavirus wouldn't affect their trips. Um, and apparently, um, a news outlet got hold of some emails that were leaked, uh, from Norwegian Cruise Line's office, um, in which they said that they were urging salespeople to use scripted lines to tell customers that that, you know, everything was safe, that, you know, the virus dangers were overhyped, and that the only thing, quote, the only thing you need to worry about for your cruise is do you have enough sunscreen. And so apparently they got hold of a bunch of emails and interviewed a bunch of, you know, employees. And again, when the article was first published in The Florida New Times, Norwegian stock fell about 26%, almost 27%. And when the Washington Post subsequently published another article, the shares fell another 35.8%, almost 36%. So advertising not only can create deceptive claims, goodwill or bad or ill will from consumers, but it also can have implications to investors and potential class action lawsuits from people affected by those things. So, what do you do about managing your online reputation and protecting your brand? Well, first of all, you need to be prepared, have a plan in place. Make sure that your team of representatives include legal, senior management, public relations, marketing, security, human resources, and finance. And you should not assume that normal chains, you know, channels of communication will be available. So people should have contact numbers and understand what their roles and responsibilities are. Information about viruses, travel quickly. Bad news travels more quickly. Responses need to be quick. Don't procrastinate. You need to have positioning when a crisis occurs. Investigate what happened. Understand what your options are. Evaluate the consequences, and then reach out to government, to other industries. Everybody in the same industry is probably suffering from the same problems that your clients or your, your businesses are, so don't be embarrassed to reach out to them. As quickly as you can, publish an official response. Tell people what happened, when and where it happened that might be affecting your business, who was affected, what's being done about it. Be calm, be sincere, be transparent. Tell people that you care, and then explain what you're doing. And tell people to check back frequently so that they feel that you're updating them on information that is relevant. As a matter of fact, some brands are actually including links to the CDC and FEMA and the World Health Organization with information simply to be helpful. Many companies are posting government sources and links to, you know, small business loans and other sources of aid. So bear in mind that your employees, your suppliers, your customers will appreciate you engaging in the conversation and having a social media policy that takes into account crisis communication. You know, if you're not in the conversation, you obviously can't influence it. You can't correct misstatements. You can't kind of convey the messaging that your brand wants. Monitor the posts and reviews. You know, just make sure that, you know, you know what's going on out there. And as quickly as you can, try to prevent any misinformation. You may be able to get the social media platforms to take down your, any false statements or negative reviews, but usually only if there's a court order. So, you need to be prepared. If you, I mean, you know, if your brand has never gotten a negative review, they're either lying or they're in self-denial. In a crisis, these things become exacerbated and can get out of hand quickly. So you need to have a method and a mechanism and channels of communication that will very quickly prevent misinformation from spreading. And in some cases, just giving people, including your employees and suppliers, the correct information will help to kind of mitigate the damage from that. Update your crisis management plan. If you don't learn anything from this or any other crisis, you obviously aren't paying attention. There's no crisis management plan that's perfect. In fact, there's no crisis that's actually identical to every other crisis. So, learn from it, update the plan, what went wrong, what worked well, um, you know, who else should be involved so that you can kind of make sure that you keep it up to date. And last but not least, kind of plan for restoring your reputation. Understand what is going to happen over time as normalcy returns and Obviously, try to kind of, you know, figure out what it is that you in your business or you in advising your clients will need to do to restore that reputation. So with the time remaining, let me talk about some of the issues that have come up. Obviously, as more advertisers collect information, data mining, so too have the scammers and the hackers increased their activity. Um, and so, and the Attorney General has kind of specifically said the pandemic is dangerous enough without wrongdoers seeking profit from public panic, and this sort of conduct can't be tolerated. Um, as you can see, the FBI, um, literally has issued, you know, dozens at this point of warnings and advisories, um, and kind of alerts on how to avoid. And I don't know whether or not how many of you know what a money mule scheme is, so let me just kind of tell you. I mean, I think you all know what emails and others are, and we'll talk about them, but a money mule scheme is one where somebody will contact you telling you that they are going to send you money, that they want you to transfer it to somebody else, either through a gift card or through a money transfer or by writing a check. And that you can keep part of it for your trouble. All of those are scams. You know, don't ever kind of fall for it. Tell your clients not to fall for it. Usually you will end up going to the bank and having that check that they sent you bounce after you've already sent the check to somebody else. Don't accept, you know, money. Don't send any money in order to collect the prize. That's always a scam. And, you know, when somebody sends you money, even if it's legit, and it says they want you to send money back to them or to somebody else for some other reason, those are typically the kind of what they're called money mule scams because you end up inadvertently being a carrier of a transfer agent for money that's usually stolen or illegally obtained. Um, the FBI and the Secret Service are also working together. Um, and, uh, interesting that statistic— about 32% of Americans believe they've already been targeted by fraud or scams related to COVID-19. One of the most common is the phishing scam, where somebody will send you an unsolicited email that will prompt you to click on an attachment. Um, that attachment will typically download malware onto your computer, which will either at that time or later point in time give a hacker access to information about you, or in some cases, you know, even, you know, access to your computer. Mobile malware— don't assume your telephones are immune. There were literally malicious apps, some There was one Android app that I'm aware of called COVID Lock that claimed to help users track the spread of the virus, and what it did was it locked your phone and prevented you from reopening it until you sent the ransom to the hackers. So you can set a password on your phone, download, you know, stick to the Apple Store or the Google Play Store for your coronavirus-related apps, which will give you better odds of of installing benign as opposed to malicious software. Trojan horses are not new, but lest you think that they have fallen by the wayside, there's a cybersecurity service that I work with that says it has recorded over 30,000 new coronavirus-related domain site registrations. Of those, about 131 were kind of clearly malicious, and they are currently investigating about 2,500 others that are, that look suspicious. There are apps that pose as legitimate virus-related apps that will steal your, which we call it, your sensitive data, or generate fraudulent revenue from what they call freemium services. Charities, there is a plethora of charities that are purporting to be helping healthcare workers, you know, truckers, you know, essential service personnel, food service people who are delivering. Take the time to check it out. A few extra minutes of your time will probably enable you to direct your heart and your donations to people who really need it, as opposed to, you know, some criminal's bank account. And last but not least, ransomware. And let's talk a little bit about ransomware. This is a screenshot of a computer that was infected by the Petya ransomware. However, and ransomware is essentially in technology terms called an MBR locker. It's a master boot record lock, which basically encrypts your, the partition, the table that holds the partition of your drive and prevents your computer from booting up. Normally, and what it does is you have to pay a ransom to get a code in order to be able to unlock your computer, and if you don't, it will kind of destroy and wipe out all of the data. There have been a recent scam which seems to be perpetrated by what are called, you know, script kiddies. Kids who have far too much time on their hands, and they have kind of a coronavirus, you know, it says coronavirus has infected your PC and tells you that, you know, you can't reboot your computer. There's another version of it that's called Redmist. The reason that the authorities believe that these are kids doing it is apparently they've simply taken some pre-existing master boot record locker scripts and kind of just implanted them with their own text message, and quite frankly, it's pretty easy to bypass the lock if you know what you're doing without paying a ransom. That being said, don't underestimate— there are sophisticated hackers that aren't pranksters, and quite frankly, the law enforcement authorities are looking carefully at whether or not they have to worry about, you know, computers that are in health and hospital organizations, healthcare workers, and those kind of things. Social Security, and again, I'm not going to leave the sound on for the video, but Social Security will never call and threaten your benefits or tell you to write anywhere or that you need to do something. And even the impact, the economic impact checks Don't require anyone to do anything. Similarly, the Internal Revenue Service, you know, don't respond to emails. Tell your clients not to. If you're in the security business, you know, make sure that you tell clients that they need to pay attention to these things because quite frankly they are not legitimate. There are what are called verification scams. They ask you to either sign over the check or give them information in order to verify, you know, to send you your check. Companies have been mailing out fake checks in strange amounts with a letter saying, before you cash this check, which is your stimulus check, call us so that we can kind of authorize the check for encashment. And then they ask you for personal information, which they then steal. Those checks are bogus, and they're just simply scams to try to get you to give you information. Similarly, there are retirees who don't have a requirement to even file a tax return. Some of these are being targeted by scandalous individuals who are calling them saying in order to get their check, they have to give them information. And similarly, there's the typical phishing emails which pervade. Collaboration apps, there are holes in them. Obviously Zoom being in the news most frequently and most recently, but don't underestimate some of the security holes that are in Slack and Trello and Webex and Microsoft Teams. And more importantly, you know, There's often oversharing and too much digital sharing of information and files, sometimes of sensitive information on those collaborative platforms. They are designed to be collaborative by definition, but if they are not secured, if you're not careful about who has access to which portions of your team and networks, if you allow external participants, even suppliers or trusted contractors or consultants, into your, you know, collaborative platform, you are now exposing the data, the files, the information. And bear in mind that most people at home don't have the same robust security, the same firewall protection. In fact, some of these cloud sharing, some of these sharing apps, information can be created and shared cloud to cloud without ever touching an endpoint user device, which means that there is literally no security, or you are relying on whatever cloud security, you know, that exists. Lest you think that, you know, this is all hypothetical, just a month ago there was another vulnerability that was found in Slack, which allowed session cookies to be recovered by a hacker and then used later on to take over accounts with password and login information. And in some cases, these could actually be automated so that once they were in the network, they could capture other people's login information. In addition, you know, Cisco's just recently patched two high, high severity vulnerabilities in Webex you know, which if exploited, um, could also execute code on a, on a computer system. So, um, and most people may not realize this, but you can also reconfigure apps. So for example, on Trello, if somebody sets their board to public, it means that it is also available on a Google search. And the Google search is typically called a dork search. So if you do not, if you don't configure your, your Trello app and the boards properly, um, an external hacker can get into those boards and find the information and, you know, get documents and also potentially inject malware directly into, um, into the network and into other people's computers. Um, the truth is there's no substitute for best practices. First of all, most companies, if you are advising a company, probably should go to zero trust, which means you limit access and permission to users on a need-to-know, need-to-use basis. Employees basically should be given what's called least privilege access— what they are, what they need to do to be able to access their and perform their routine activities without access to other networks, data, or even files. Similarly, Network segmentation. Somebody who's posing as a trusted employee can obviously share malicious documents or files and move laterally into other areas on the network. If you segment and sequester, you know, your networks, restricting that lateral movement even between channels or conversations on the same platform, you're now again minimizing the security risks. So you have to be careful. And, you know, as simple as it sounds, routine testing and end-user education should apply to collaborative platforms the same way that they would with emails and with mobile communications and text messages. Educating your employees, educating users, you know, if they understand the risks and they are trained to at least be alert to spotting them, you have a higher likelihood that they will avoid a problem and a risk. And by the way, I tell, you know, all of my clients, if there's a red flag, you are better off shutting down your system and patching the problem right away than you are trying to limp along and hope that you can fix it later on. It's a lot more costly to deal with regulators and deal with a data breach post-problem than it is to shut down even for an hour or two in the middle of the night if you have to and kind of prevent the problem. In that vein, you should be aware that boards are increasingly concerned about the security and data protection and are increasingly requiring their executives to provide them with detailed information about security about backups, about risk management, and what companies are doing to make sure that their employees have access to secure information in a crisis. You know, risk and audit committees are requiring detailed information about cybersecurity measures, and bear in mind that when supply chain and product shortages and logistics are challenged by crises like these, you know, board members may be increasingly willing to share data with governments and other companies if it makes their supply chain more resilient, but you also need to make sure that they are secure. Those of you who read the Wall Street Journal this morning might have noticed that Amazon employees were— the Wall Street Journal reported that they conducted interviews and read documents where employees of Amazon's private label business revealed that employees actually use data from independent sellers to develop competing products, something that Amazon stated policies and even some congressional testimony says that they haven't. So, you know, bear in mind that this is rising to the level of attention not only in regulators but boards, the Securities and Exchange Commission is looking at what companies are doing, so you have to be extraordinarily careful in advising clients about this. The last two slides relate to what is going on in the world of privacy, first in the US and then in a little bit about Europe before we end. So in the US, there's no centralized authority that deals with privacy per se, but many states and certainly the federal government have data breach regulations. California has a new Consumer Privacy Act as of January 1st. Illinois has a Biometric Information Protection Act, and so, you know, there are significant privacy and data protection implications around the sharing of healthcare data, you know, which although some regulators have indicated they would relax somewhat in order to stem the spread of the virus and deal with health-related information, you know, you need to be careful, but that's not an open kind of season on collecting information from consumers, even, you know, temperature and, you know, testing, you know, in the employment workplace, what you're allowed to use that information for is still highly restricted. Just the other day, Apple and Google announced, I think it was just this past Friday, that they are going to be in what I would consider a fairly unprecedented collaboration to take smartphone technology to trace and contain the spread of the coronavirus. They are referring to it jointly as the privacy-preserving contact tracing, and it will use Bluetooth technology in their mobile phones, which will keep track of every other person that your phone comes into contact with over the course of a day. And that way, if the person finds out that they have COVID-19, they can use that system to alert all of those people. You know, the theory is to help national governments roll out contact tracing apps. So initially they're gonna let the authorities release them directly from the healthcare, from the government, but I understand from sources within both Apple and Google that they are planning to embed them in the operating systems directly. Sometime in the near future. And last but not least, those of you that have clients or have interest in Europe, you know, while there are laws that, you know, do have some exceptions, you still have to pay attention to the GDPR requirements, and I'm just focusing right now on Europe. but there are lessons to be learned from, you know, China and South Korea and Singapore, whose flags are displayed on the left. Countries, at last time I looked, and I haven't checked just, you know, until the weekend, but Italy, Belgium, Ireland, Norway, France, Spain, and Hungary have all, their data protection authorities have all issued guidance relating to the cybersecurity threats, and many of them have relaxed the provisions, but all of them have maintained that whatever data you are collecting, it needs to either be completely anonymized or erased and removed once the pandemic is over. Italy, as a matter of fact, Just a few weeks ago, I think maybe more than a few weeks ago, I think about a month ago, the Italian government and a number of trade unions signed a protocol that established procedures in the workplace and allows their employers to kind of subject individuals to body temperature controls before entering the workplace. But there are, again, severe restrictions on how those are going to be implemented and what countries or companies are allowed to do with that information. So with that, let me thank you for your attention, let you know that if you are looking for CLE credit, you know, you don't have to stay on any longer, but if you do have any questions, I'm happy to stay on a little bit longer and respond to questions that you kind of raise. And if you would like to contact me in the future, my office number, mobile number, and my email address are right here. So let me— if anybody has any questions, now would be a good time to, you know, either, you know, raise your hand or, you know, let me know. And if not, you know, then let me say thank you again. All right, and also just a heads up, everyone keep an eye out on your email tomorrow. We'll have instructions on how to get your CLE ticket as well as the course materials itself.