IT Asset Disposition: Navigating Certifications and Battling Bad Actors

Oh my gosh. And we're live.

Yep. Wow.

Yeah, I know. It's what you would have thought that there would be some kind of like electric shock that you would have sensed when you went live on LinkedIn.

I thought you had some cool music. At one point you had some cool music or something.

I did have cool music. And then you told me that I wanted to— so there's this song by It's called Thunderstruck. Who— who—

yes, we don't— we cannot— we can't afford the digital rights.

Okay, well, get out of here. Anyway, that's— that's the song.

That's your intro music.

And then Angie gets all wound up about, oh, digital rights, and get out of here, you know what I mean? I mean, like, what is she, like, when she works at Napster? Come on. Anyway, um, I'm Joe Harford. Um, I work with Angie— actually, I work for Angie Singer Keating at Reclamere. I'm her big brother, and she and I have known our guest Kyle Marks for way too long. But recently, I had posted out on LinkedIn, a story in regard to IT asset disposition, and also IT asset management. And we're talking about free and the whole world of free, because believe it or not, in 2024, we still come across these people that say, well, I know a vendor that's going to do it for free. Oh my gosh, like, we don't really have to Okay. And Kyle was kind enough to comment with some, I think, some good information. And so I reached out to him, had a conversation, and he's decided, you know what, I'm going to take a leap of faith and I'm going to be on Data Security Over Coffee, regardless of how insane these two people may be. So IT asset disposition, navigating certifications, and battling bad actors. Ooh, you know how I got that title? Guess. That's right. ChatGPT. That's exactly right. I'm going to admit it on national television or LinkedIn Live University, whatever this thing is, because I have no fear and I don't care anyway. Kyle, if you wouldn't mind, tell all those folks out in the 227 people on LinkedIn Live. Who are you and what are you about?

Well, my name is Kyle Marks, and my entire goal is to go at least 25 minutes because that's— I want to break the record, or I don't want to break the record and get kicked off sooner. I founded Retire IT 20 years ago, July. We are no longer a teenager. We manage IT asset disposition. Probably the biggest misconception, people think we are a recycler. We're not. I don't own a truck, a shredder, a warehouse. I never have. I never will. By design, we're a fiduciary. So we sit on the same side of the table as our enterprise clients and we manage the process for them. To make sure the T's are crossed, the I's are dotted. We have a, we have a code, not like Dexter code, it's not, but it's called the Doctrine of Defensible Disposition. And there's a lot of principles that we abide by, but we're probably best known for focusing on chain of custody and making sure that no assets get left behind or get lost.

Very cool. And you were brave enough to come on today. So I appreciate that. So I guess my, my first question for you, Kyle, you know, you've seen, as we have in 24 years, the kind of the landscape of ITAD and ITAM change, certifications and good players and bad players, etc., and so forth. And so what are, what are some of the challenges that you think that customers face when they're trying to figure out IT asset disposition? What are, what are the things that they're saying, man, I gotta tell you, man, I'm still struggling?

Well, there's a number of things they should know before they even begin. You know, certification is just the starting point. It is just table stakes. It basically separates the good players from the bad players, but it doesn't do much more. I mean, it's not going to keep you out of hot water. And there's also a lot of, you know, certified vendors, in fact a number of them, you know, who have gotten in trouble, and some are behind bars right now, not for throwing something in a landfill or illegally exporting, but for fraud or tax evasion. But there's kind of been a parade of horribles and certified processors have been a part of a lot of those. So there's a number of things that I would tell people who are just starting out in the process. One, and a lot of them are not conventional, they wouldn't think about it, but ITAD is adversarial. Not that you can't partner with and work with a processor, you have to have some element of trust. But if something's found in the wrong place or found with data, it's always going to come back and haunt the owner of the asset, you know, or the generator of the information, you know. And so it, you know, if you can name an ITAD or a recycler that has raised their hand and taken a bullet for a client, I'd like to know about it. You know, so it's, it's something to think about from the get-go. Insurance is really just prepaid legal defense. That's not going to save you. Um, you know, this is one of the things we always talk about, defensible disposition. And most people, when you ask them, what are you concerned about, they can rattle off a handful of issues, you know, of incidents. Um, but it doesn't go much further than that. You know, we've been tracking this, and now that we've done about 20,000 projects, I, we've been maintaining a database of potential incidents and ones that have happened, and there's over 150 ways that a project can go sideways. And we work hard to mitigate each of those. We don't have enough time, or actually, how much time do I have to be, you know, to break the record at 25? Yeah, I can start listing 150 and we're going to get there really quickly. But You know, there's— we bring, you know, zero trust is a mantra in cybersecurity. I know this is coffee, you know, over cybersecurity. We bring zero trust to IT asset disposition, you know, so it's not trust but verify. It's never trust, always verify. We know what can go wrong, and we have, you know, controls and safeguards we put in place to prevent them.

So one of the things that actually came up yet last week with one of the folks that I work with, and that was— this was a client that was in manufacturing. Kind of large. This was going to be the very first time they've done a project in about 3 years, not with us, but just in general. And so we were kind of walking through the sales discovery process and trying to figure out, okay, what do you have and what do you want to do and why do you want to do it now and so on. And I don't know if it was kind of flippant or offhanded, but the person that said, well, you know, when I, when I talk to people out in the space, you know, if you, if you can't be at free or pretty close to free, I got to kick some tires and keep on moving. And, you know, I, as Angie knows, being the first person that sold Reclamere back in 2001 forward, hearing that back at that time frame was regular, right? 2010, that was regular. But I was shocked. Obviously, we didn't go any further in the sales discovery conversation. But, you know, to hear that today is still kind of amazing to me that people don't seem to understand that there is a value in the service that we provide. And so I don't know if you can speak to how to get people to understand better as a user of the service that, you know, this, this is a, this is a fee-based service and there's a, there's a valid reason why it's a fee-based service.

Sure. Well, I like to say if somebody tells me they have free recycling, the only thing that tells me is they don't know what they're paying. And the other expression is, you know, you can't afford free. And it's been a big disservice that even there are certified recyclers out there still talking about free recycling and promoting free. And it's disingenuous, it distorts the market. There's no other domain that you would accept something like this, something for free. You wouldn't take advice from a free attorney, you wouldn't go to a free doctor, you wouldn't. And yes, I mean, the economics are pretty straightforward. There's kind of two costs. That you have to account for primary ones, you know, what happens inside the four walls of a facility. We call those fees processing. And then how you get the equipment there, and we refer to that as logistics or the pickup or however it gets there. You know, on the other side of the coin is the value recovery, and that could come through refurbishment and reselling of assets or through scrap values. They have to be separate. You know, you wouldn't drive onto a car lot and say, I want a new car, but before you tell me this, what's this one worth? And I'm not going to— it's just, you know, you wouldn't make those sort of decisions based on just what somebody is telling you the value of their equipment is. And I'm not suggesting that ITAD is a commodity, but in general, the fees are the same. Because the activities are the same whether it's Boston or Austin, you know, inside the four walls of a good, you know, qualified facility. They're going to receive the equipment, they're going to test the equipment, they're going to sanitize it, they're going to process it, you know, de-manufacture it or refurbish, recycle. Yeah, there are some differences, but not great differences. Logistics is where there's a lot of variability, you know, who's picking up the tab of the, of the of the shipping, you know, but then you realize that a lot of the cost, the majority of it can be the origin service. You know, the stuff going dock to dock isn't, you know, that's not really real cost is if you have to be somewhere at 7:30 in the morning in downtown Manhattan at a union building, you know, the origin service is far more expensive than, uh, than, you know, getting from point A to point B. Or if you're picking up something at somebody's home in Bozeman, Montana, it's a lot different than getting something from an office park in Alpharetta, Georgia.

Sure.

You don't understand all these costs, you know, you shouldn't be entering. And, you know, anybody that has any level of maturity would not talk about free, right? And so I've always struggled to politely, you know, duck that question, um, because otherwise you can come across really, really condescending. I mean, quite frankly, they don't have— they're not qualified to, to make the purchasing decisions if they think something is free. Um, do you remember Frances O'Brien? God rest her soul. She was this fantastic—

that's very familiar. That name is very familiar to me.

She was an analyst for Gartner, and almost 20 years ago she wrote, uh, something called TCO's Last Surprise. And the data—

oh yeah, okay.

Slightly, but not directionally. It's still perfect. And, you know, the vast majority of the cost in the IT asset disposition process is, you know, incurred well before a vendor's ever involved, right? You know, and that's where, you know, if you're looking at it in a silo and you're just looking at the very, very, very end of life, you've kind of missed the point, you know. So unfortunately, I don't even think it's for sale anymore on Gartner. Maybe they should update it, you know, and push it back out there because it's sure.

Interesting. So Angie, Angie, by the way, Kyle, Angie's way smarter than I am because she's like a SME. I'm not exactly sure what it means to be a SME, but she is. And that she gets really irritated because she's like, oh my gosh, is he really going to do this? I am. So in the world of governance, risk, and compliance, what smartical questions do you have for Kyle? Now she's on the spot. She's spinning.

Oh my God. She's trying to— the only reason I accepted this was because I was hoping I could push my book.

So yes, yes, absolutely.

Let me—

we take 10 points off the top. It's cool.

Well, I, you know, it's a funny time to have this conversation because I'm still kind of stewing inside about a competitor out in Pittsburgh under a consent decree with the Pennsylvania Department of Environmental Protection. And I haven't filed a right-to-know request lately, but it is on my to-do list to see what the status of that million pounds of e-waste is that they've got stockpiled. But they're still certified by all the certifying bodies, Kyle.

Well, yeah, that's not—

am I coming off as condescending if I say WTF? To I Sigma, uh, R2, East Stewards, WTF.

Wow, she has— and you know what, Kyle, she hasn't even been drinking yet. Like, this is in a sober state of mind.

You know what, because I'm absolutely— I'm absolutely— I am— I, I have it. Let me say this, I'm not going to say I'm positive. I don't want to end up getting sued. By that idiot. The issue is that from a governance, risk, and compliance perspective, there are companies that use that vendor who don't even know that there's stockpiled e-waste that they paid to have processed sitting in a warehouse under consent decree from the Pennsylvania Department of Environmental Protection And unless you're a really intrepid Googler, you're not going to go find that anywhere. But it's, it's infuriating to me because I spent 20 years on a soapbox about certification and how valuable it is. And when you're in the industry and you know that's gone on, but then you also know that you got those dudes out in the Midwest that I think one of them sitting in jail, the two CEOs like the judge had them take turns sitting in jail for their escapades and misdeeds in IT asset management and what they did with e-waste. But this guy, it's business as usual, and he's got all his certifications and life just rolls on.

Mr. Chairman, if you please ask the gentlelady from Gettysburg to ask the question.

I just said, Where do you stand on this, Kyle? Because I'm not even sure certification is table stakes at this point.

I have a couple of comments. One is most of the companies that have gotten in trouble have been certified, right? And probably by far the most famous cybersecurity event related to our industry that happened with, you know, Morgan Stanley, you know, there were two breaches. Again, very few people really understand or have studied, you know, the whole episode. I mean, wasn't one breach, it was two. On one of the breaches, the assets, you know, passed through several vendors' hands. One of them was a certified vendor. And, you know, they, they weren't stripped, um, at least, and they weren't publicly, you know, admonished or anything. Um, you know, a lot of people say they come to vendors and they say, how will you protect me? I like to counsel enterprises to ask the question, how would you know if they don't, right? They just, they don't, they don't have a process. They're very trusting and trust is something you can't afford today. I'll go one step further and also say it's not just the certifications on the vendor side that have kind of a dubious or questionable value. Value sometimes. Um, there are a lot of people getting certified as asset managers by, you know, one of a couple different organizations or institutions. Um, but, you know, what value are those? You know, because there's always somebody who's managing it if they're certified asset managers. Have you ever heard of anybody being stripped of their certification?

No.

Right. I mean, so, you know, it's not a, it's not a profession yet, right? I mean, you know, if, if a doctor, you know, is, you know, found guilty of malpractice, they'll be stripped of their license. You know, if my accountant were to bend the rules, you know, they could, you know, lose their certification and, you know, go to jail. Uh, if, you know, and so if there's no consequences, you just keep this. You know, the question is really what value are those certifications? You know, I'm saying everybody, you know, but it would be nice if the bad actors would be stripped of their, of their, you know, paper credentials, right?

Yeah. Do you think that would help?

It happens. You have to protect yourself. And, and that's why we again have this, you know, code, the doctrine of defensible disposition, because you know, you cannot trust, you're going to be sick. Yeah.

Do you think that that type of consequence, stripping someone of their credentials, would really help?

It wouldn't hurt. I'm not saying it's— no, I mean, you know, nobody cares about a vulnerability until it's been exploited. And, you know, nobody, you know, cares about something until it hits them in the pocketbook, right? And so, and until organizations start paying the price for non-compliance, it's going to continue. I'm not, you know, naive about that. I've been, you know, talking about, you know, I kind of doodle a little bit and I, you know, my, one of my last illustrations I published was one where You know, the guy sitting there with the cardboard sign saying, you know, the end is near. You know, I've been talking about the, you know, how the next breach is right around the corner, you know, for years. You know, it's just not well recognized. There hasn't been too many, you know, exposure comes from disclosure and there hasn't been that many disclosures. Now, is that gonna change? I think so. You know, now the SEC is involved and they're, handsomely paying whistleblowers, and any organization is 2 clicks away from being exposed. You know, could be from a disgruntled asset manager, a frustrated vendor or former vendor, you know, anybody—

disgruntled employee at a vendor, disgruntled employee at an enterprise.

So I'd like to think, you know, in addition to, you know, some things, you know, if the certifications actually start meaning becoming more stringent and meaningful, but also if organizations start recognizing the risk. But unfortunately, it's going to take a few more big incidents that cause a lot of exposure that change isn't going to happen yet.

Well, and Joe, I think it definitely would help because we've done such a great job. You know, when I look at I-Sigma, getting educating customers to then getting that written into the contractual obligations. So let's say you're under a 1, 2, 3-year contract with a vendor where the vendor's contractually obligated to maintain a particular certification in the industry and it gets stripped. That's hitting them in the pocketbook. So It's incredibly frustrating because I want to have faith and confidence in institutions, especially those that I've been involved in as a professional for a really, really long time. It's just kind of heartbreaking.

So, Kyle, I think you would agree that there are probably far more good actors out there than bad actors. I think you'd probably— absolutely. Okay, so if we, if we now say, you know, we've put all of the good actors into the room and we say, okay, what advice can we give that, that ecosystem, those people that are doing the right thing for the right reason, operating ethically, um, every— they, they're doing all of the things that they need to be doing as a really good professional service provider. What can we be doing collectively to help to minimize or reduce the number of bad actors that are still out on the landscape?

There's a number of things. One is they— you need to stop misrepresenting things. I mean, in marketing terms, it's called puffery. You know, when you're claiming you provide 100% of the solution, you know, we provide unbroken chain of custody. Um, that is patently false. I mean, chain of custody is not a catchphrase, it's a process, right? You can't. And you're actually, in order to do what you kind of are claiming to do, you are now having to receive assets and then validate that you have them, or verify And that is a conflict of interest because, you know, the teacher would have to give the students the answer and ask them to grade their own test and be honest. You know, there's just so many conflicts of interest there. Um, and so advice I would have is one, you know, I would never accept an inventory from a vendor, from a client, and tell them I would reconcile it and let them know because you're kind of putting them in a bad place. It's all right, you're wildly non-compliant. You're also, um, if you miss something and fail to disclose, then you're, you're on the hook, right? Um, there is— is— so that, that's important. You know, I would— if a client wants to give you your inventory and say, that's great, you know, it's not going to change what we do, we're going to receive the equipment, we're going to tell you what we have, and it's your obligation to compare that list and make sure we have it. You know, we understand compliance and we don't want to pull you out of compliance, you know, by, you know, letting you do something, um, like, you know, giving the students the answers and having them grade their own tests, right? Um, you know, how many vendors, you know, uh, report incidents, right? How many, how many of them are telling their clients we don't have something? And if, you know, the math hasn't really changed and, you know, only let's just say mid-70s percent of serial numbers match. So unless you're using another control, which we advocate, disposal tags, because it can easily get you 99 to 100% tracking when you have, you know, a unique identifier that you put on that is conspicuous, that everybody sees it. It's a common denominator. It's not hidden on the back panel with all these other barcodes. Without tags, you're only going to get— you're not going to get 100% tracking. So you're going to be having to report to your client, we don't know where a quarter of your assets are, we can't prove it, right? We know that's not happening today. And so, you know, these vendors that you're talking about are actually putting themselves, you know, in hot water because you are part of the process. You know, under HIPAA, you know, you are a covered entity or you are a business associate, and your obligation is to notify the covered entity if you have a suspected incident, right? You know, so We could go on and on, but I definitely think there's, uh, there are some things. And again, that fits my book, you know. I'm kidding. But they should be offering to provide tags, uh, offering to do two-key tracking with a third party. They should offer to hold the equipment so it has time to be verified, because 99% of the problems, um, can be cleared up with an inventory if you get a second look at the equipment. If you've already recycled it or processed it or refurbished it and resold it and you don't have it anymore, how are you going to account for it, right? So, um, well, some of the—

I think some of the challenge also though, Kyle, is that we can, we can only protect customers from themselves to the extent to which they're willing to pay for it. So, um, if you have if you work in the SMB sector, which is where Reclamere works, not, not as much in the enterprise space, although we do have a few enterprise clients, the SMB sector doesn't have good inventories of their material to begin with. So when, you know, when, when we put our secure cages at their facility and they lock their material into those cages, unless they're going to track it or then pay us while we're on site to inventory it before we even leave, which many of them will not pay that labor charge, then the custody is— the chain of custody is unbroken as it can possibly be for the service level they're willing to pay for. The other issue, the other challenge that I— the other reason where Um, when you say, well, if it's already gone, you can't go back, um, like here at Rec Lamere, we have every single part of the building as well as the outside of the building under video surveillance, high-definition video surveillance, and that footage is maintained for a minimum of 120 days. So anytime a client reports to us a discrepancy in the certificate of destruction and what they think they sent us, and they say something is missing, every single time in the course of— since we've had the video surveillance system, which has been 15 going on 20 years, I think, um, we're able to go back and literally we will watch— we will spend hours watching footage of their assets being, uh, unloaded, segregated, processed, and able to then verify that no, you in fact did not send it. And that's either through the serial numbers, it's through the counts. But, but we've always been able to prove that no, you did not in fact send it through that, through that video surveillance. So I wish it were a perfect world where clients would be willing to pay for that level of service in the SMB space. But unfortunately, unfortunately, they're not. And they don't even, as you said, most of the work in IT asset management starts before the ITAD vendor even gets involved. If they're not doing that work up front from the moment the asset is purchased throughout its lifecycle in their organization and they don't have good records, That's really a tough spot to put us in then as the vendor.

Just as an aside, Kyle, I did want to let you know that you have passed the threshold. So you're doing really well. You're now at 28.35 minutes. You're doing great, man. You really are. And you're holding your own with Angie. That's a lot to be said for any human on the planet.

That's fantastic.

So, okay, so I get it. Certifications are starting to— are, you know, are definitely not the way to go. I think there's obviously, there's got to be a different level of due diligence. There has to be. There's got to be something more than just simply checking a box and saying, okay, I can, I can work with this vendor. And collectively, we have to figure out among the rest of the good players, how we're just going to continue to work on and educate people. Um, you know, for what it was worth, you know, we've got a document that we share with people on free isn't free. Um, and I shared that with the, with the prospect last week. I don't expect to hear back because the person's a tire kicker and they're looking for the least— they are, they're looking for the least expensive option. They don't care. They, they don't care. You know, when we start talking about the things that matter to the the people that are on this, this podcast, it didn't ring a bell. It was all about how soon you can you get here and how cheap can you do it? You know, my words, not theirs, but pretty similar, right?

Well, and when you talk about lessons learned, Joe, I would also be happy. Okay, even if you're not gonna rip away this bad actor certification for a stockpile of e-waste, Train the auditors how to find that, because we're talking £1 million in rented space. Somebody paid for that. So just some basic fundamental training on how to look at a P&L and look for a line called rental expense. And if someone is paying for rental space, what is it for? Show me the lease and have the auditor drive out there and see if in fact it is what they're storing, what they say they are. If they say they're, they're storing, you know, you know, shipping supplies and material, okay, great, but prove it. Because if I walk in and I find rows and rows and rows of Gaylords of e-waste, then I know that you've tried to circumvent the process. And that, you know, the response that I got when I made that suggestion in, in the auditor training was, Well, they're trained in security. They're not trained in looking at financials. It's like, yes, but it, it's, it's one in the same. The physical security of a building, you have to understand, do they own it? Do they rent it? Do they have other space that they're renting that you don't know about? That is part of physical security.

Well, there's been a big case. Obviously, it was a closed loop, and a lot of the people, a lot of the generators of the you know, back with CRT glass. I mean, there's still things that are getting settled today, and the landlords were, you know, left in the lurch, had to pick up the tab, and are suing to get, you know, to get compensated. Yeah, people go behind bars, but it was also the organizations that provided them these assets, you know, that didn't get properly processed. You know, they were basically found and settled, you know, claim that, you know, they, they didn't do proper due diligence. You know, I would suspect this vendor's upstream clients would care to know because they could be on the hook, uh, if something goes south.

Sure.

And I would expect the landlord would want to know because they will have a cleanup if something goes south. And so there's a lot of, you know, you know, this vendor you're talking about is playing with fire. Right. If they're— and the EPA, you know, there is— you probably know better than I do, but you know, there's— it's called speculative accumulation. You know, if you hold on to it for too long, you have to be processing a certain percentage in a certain amount of time. If you're not, then you can be found to be speculative.

This stuff went back to the 2010s.

Yeah.

So, you know, well past the speculative accumulation.

Yeah. The EPA would would like to know about that, right? So again, the guy's playing with fire. I didn't say guy, the entity is playing with fire. But I think about, I mean, my biggest concern is my clients working with a certified vendor. You kind of, there's always been sort of two primary things. If something's found in the wrong place, or found with data. And what you're talking about kind of falls in the camp of, you know, being found in the wrong place. You know, did the vendor throw it in a river or landfill it or illegally export it, or they stored it in a warehouse or on the back 40 in a truck? You know, is it something like that? You know, fortunately, I think that has become much of a thing of the past with most good vendors, right? Yeah. And if something's found with, data on it, you know, if the vendor resold it and it had data on it, you're going to trace it back to them. So yeah, there's really two other concerns that we are educating our clients about. You know, one, it's, you know, it's the asset that doesn't get to the vendor that is the problem. And so, you know, when I talk about exposure relates to disclosure, We're talking about a whistleblower. If somebody goes to the SEC and says, hey, we're playing fast and loose with our assets, we're not really tracking them, we're not considering lost assets a security incident, that could create massive exposure. The other thing is pertaining to the asset, even if it's received, if it's not properly processed, it's not the data on the device that is as much of a problem. It's also the— anything with an IP address can be a backdoor onto a network. Right. And so it could basically be a gateway to put malware, ransomware, you know, into the network, right? So asset managers need to be, you know, removing those things, you know, from the network and removing the credentials. You know, so not only is it something found in the wrong place or being found with data on it, It's the assets that, you know, the duty to disclose is important, and you could be in hot water from a compliance perspective. And you have to worry about the assets not just from a data security perspective, but also from a network perspective, being a backdoor onto the network. Yeah, there's other things that are important.

Oh yeah, we're way beyond just the, uh, just the pull a hard drive and shred it days.

Oh yeah.

So tomorrow we roll into Halloween, and unfortunately, the end of National Cybersecurity Awareness Month, which, by the way, you need to have cybersecurity awareness all year long, but that's my plug. So my question to the two of you, be mindful now. What do you see as a a trend or a prediction that you would want to make, or something to look out for as it relates to ITAD, ITAM, and cybersecurity moving into 2025? And I'll let you— I can't do that, that Jeopardy music. If I would, I— but I, you know, I'll get locked up by Angie because it's copyrighted or some stupid thing. But I would play the Jeopardy music if you wanted to have some time. But, you know, you play the jingle in your head while you're giving me an answer, but hurry up because we don't have very much time.

All right, I don't know when, but so let's just say it'll be 25. Okay, um, the next Morgan Stanley type of breach. I'm talking the, the Morgan Stanley Arrow breach, the one where there were 42 servers unaccounted for. The next one of those is going to be what I call the mother of all disclosures. Okay, it's not only gonna tank the company, because it's not just going to be about that one incident that became breach, it's going to put IT asset management on trial. And they're going to look at the entire program and they're going to discover that it's not a few assets, but it's a lot of hardware can't be accounted for.

Okay.

Um, and no company can credibly claim to protect data on devices if they don't know the whereabouts, full stop, right? And so the, the, you know, the plaintiffs aren't going to stop at a $60 million settlement. It's going to be orders of magnitude larger. Okay. The reason it's also going to be the mother of all disclosures is, as Angie mentioned, you know, auditors aren't necessarily looking at the right things. They're just checking boxes, and, and, um, a lot of them don't even recognize ITAD as cybersecurity. And so if you're giving a company a clean bill of health from a SOC 2 compliance perspective, you're, you're signing off on their their procedures, and you're not looking at this, you're not looking at basic record reconciliation exercise, which is what was discovered, you know, the 42 missing servers in the Arrow Morgan Stanley breach, you fail as an auditor. And I think, you know, I've said this before, but I'm old enough to remember when auditors failed Enron, you know, not only did Enron leave a $55 billion hole in the economy, it took out, you know, one of the big ones. You know, Arthur Andersen doesn't exist anymore, and the Big Eight became the Big Four. I would strongly encourage, you know, auditors who are tasked with cybersecurity and IT controls to look at ITAD.

Okay, so you're talking about your—

and then the third kicker is, you know, mother of all disclosures, um, the 3 or 4 things that the SEC has, you know, it was Blackbaum, R.R. Donnelly, CyberWinds, all of them related to disclosure controls, escalation procedures. Management doesn't get plausible deniability. They're expected to put, you know, controls in place so they'll know if there's a problem. And so I expect investors, when this breach happens, to also, you know, Morgan Stanley, let's say they've spent $200 million to date, you know, roughly on its problem, you know, with the OCR and the settlement of the class action and the SEC. When it becomes, you know, hundreds and hundreds of millions or billions of dollars, investors are going to go after management. So again, mother of all disclosures, the company is going to pay a big penalty, you know, the auditors could be in the tank with them. And investors are going to, you know, want a chunk of skin.

So big bill and resume generating event. Right?

It will be, it will be the mother of all disclosures.

Okay. All right, Angie, what you got?

Um, it's hard for me to say because my predictions are very heavily contingent upon the outcome of the election. Um, because I feel like if it goes one way, there's going to be much stronger regulation, and that's good for us. Um, and if it goes another way, um, there'll be a lot of deregulation, which will create and cause more data breaches, which in our other world of cybersecurity consulting, that's also good for us. So either outcome is good for us from a business perspective. But until we know what that's going to be, you know, I can't really— I can't really even— I can't really go deeper than that.

Wow.

She dodged the question.

Yeah, she did dodge the question. I mean, you would think that she was a politician and she was stumping for some particular candidate based upon that circular answer that we just got, ladies and gentlemen.

That was—

political.

I'm really sorry that you had this experience.

Didn't you give her the answers ahead of time?

That was an apolitical answer. I didn't say which way it was better. I said it's good— either way is good for us as a business.

Yeah, that's called dodging the question. Kyle, I really appreciate you coming on, being with at least with me today. I can't speak for my sister. Um, but in all seriousness, um, thanks for what you do for the industry. Um, known you for a really long time. Um, you know, we may not agree on everything, and I think that's healthy, uh, but I think we do agree on the things that matter in regard to how we care for customers, um, how we maintain professionalism in the industry, um, and how we try to partner with one another and help each other out. I think those things are, are really important. And, you know, there's always going to be bad apples. I think the only thing that, you know, your company can do and our company can do is each year get better, you know, own the good, the bad, and the ugly, right? And do the absolute best we can in how we hire, process improvement, documentation improvement. You know, having enough courage to say, hey, why don't you do me a favor? Because we do this now in unannounced audits. Why don't you come check out my business and give me some feedback? You know, I think that that's an important thing for people to do that are in the industry together, because what better eye to look at Reclamere than somebody who's in it already that can turn around and say, you know, I'm not exactly sure what I'm seeing, Joe, but I think we should probably have a conversation about it. That whole ability, I think, for an owner-operator to accept the fact that, you know, maybe somebody is going to call my baby ugly, but it's really knowing it's for downstream benefit, right? It's really to get better as an operator. So of course, I will leave the last few minutes, Kyle and Angie, if there's anything that you'd like to leave for the audience before I shut this crazy thing down. Plus the fact I really need to have a bio break. So I'm hoping you're going to wrap it up really quickly because I, you know, I've been drinking out of this bottle. So as you can imagine, I got to go, you know what I mean? So what you got? If you got anything to wrap up with?

Well, I'd like to thank you because you and Angie have consistently produced phenomenal content. You are always putting it out there. Even this, you know, this discussion is fantastic because it raises awareness. We're not going to improve our industry unless we have open dialogue and discussion and debate. I mean, I certainly, you know, put my opinion out there, um, and it's not the only one. You know, everyone has an opinion and it should be debated, you know, peer-reviewed stuff, not, you know, something that, you know, oftentimes it's just recycled, um, you like how I use that word, recycled content that, you know, somebody is putting into ChatGPT and it's just this, you know, kind of useless best practices that push this forward. And as soon as we get to the point where people recognize IT asset disposition is cybersecurity, and that, um, instead of right now bad ITAD is sort of a consequence of, of, you know, kind of sham ITAM, you know, and it's not— a bad ITAM is not necessarily a bug, it is a feature. When you realize that some companies use this opaque, you know, process that isn't showing any results as a way to sweep problems under the rug, you know, that will when people recognize that, it's going to change.

You know, I think so.

You know, people recognize that you have to have basic controls that they have in place for other cybersecurity, you know, discipline, you know, aspects, right?

Absolutely. Angie?

I just want to thank Kyle for being here today. I really enjoyed talking with him. I also enjoyed talking with him on some of the prep work we did for, you know, when we were inviting him to be on the show, and it was just just good to catch up. So thank you.

I'm gonna wrap it up, but we can still stay on chat a little bit.

All right, happy Halloween.

Happy Halloween.