00:00 - This program has been paid

00:01 - for by the sponsor and does not reflect the views of PCN.

00:05 - Welcome to PMA perspective, your weekly half hour news

00:08 - program on Pennsylvania business, government, and politics.

00:12 - I'm your host, David Taylor,

00:13 - president and CEO of the Pennsylvania Manufacturers Association.

00:17 - On this week's show, we'll discuss

00:18 - the very important issue of cyber security with our panel of experts.

00:23 - State Senator Kristin Phillips Hill, State Representative Valerie Gaydos,

00:27 - and Joe Hartford, president and founder of Reckless Beer.

00:31 - PMA perspective starts now.

00:35 - You're watching PMA perspective,

00:37 - a statewide source for business, government and policy

00:40 - news.

00:51 - Newsmaker interviews

00:52 - with your host, David and Taylor, and reports from the field

00:56 - with PMS Carl Moreira and Joy Johnson.

01:00 - Now for a special episode of PMA perspective.

01:04 - Wonderful to be here with you all.

01:05 - State Senator Kristen Phillips Hill I represent southern New York

01:08 - County, the 28th senatorial district in the Senate of Pennsylvania.

01:12 - This has been an area of interest

01:14 - that I've had for quite some time as a legislator.

01:18 - I'm looking around this room, and I think there are many of you

01:21 - who can remember the day I walked into the House Republican caucus and said,

01:26 - do we really use Kaspersky software for our caucus?

01:30 - And everybody looked at me like, what are you talking about?

01:32 - They thought I was crazy.

01:33 - And that began this journey

01:36 - of trying to improve the cyber security,

01:41 - not only the House Republican caucus, but the entire Commonwealth.

01:46 - Some things have changed dramatically.

01:49 - And that most dramatic change

01:52 - has been that more and more people

01:56 - are interacting with their government in a virtual manner.

02:01 - It used to be our offices would be so busy with,

02:04 - vehicle registrations and all kinds of PennDOT work.

02:08 - And today most people are taking care of that work online.

02:13 - So government has a lot of very important personal, private information.

02:19 - We have seen great challenges.

02:21 - Most recently we had a ransomware attack.

02:24 - And I have to give a big shout out to our attorney general, Dave Sunday.

02:29 - He didn't pay that ransom.

02:30 - And that's exactly what we need to do.

02:33 - So we need to start to stand up to the bullies.

02:36 - We need to harden our defenses.

02:38 - One of the things that has been constant throughout every major data breach,

02:44 - cybersecurity incident, is that so often

02:50 - the people with the knowledge and the expertise are buried

02:54 - in the Office of Administration, the secretary of Labor and Industry.

02:59 - Had this massive, massive breach of the unemployment compensation system.

03:04 - So remember, Governor Wolf, put all of those

03:07 - over 2 million people out of work overnight, right?

03:10 - And so you had all these people unemployment compensation.

03:13 - And so then they said, well, we have to do this better.

03:15 - They procured software, software that had a very important

03:21 - cybersecurity measure in it, and that was multi-factor authentication.

03:27 - And they decided that even though that very important security provision

03:30 - was in the software that they procured, they're going to turn it off.

03:34 - My first question was, did you talk to the CIO

03:38 - about that decision before you made it?

03:41 - And the answer was no. No.

03:44 - So the person with all the

03:45 - knowledge and the expertise is buried in the bowels

03:48 - of the office of the administration, not having these conversations with all of

03:52 - the people who are making actual decisions with regard to our cyber security.

03:56 - That has got to change.

03:58 - So I have Senate Bill 374, and I think it's interesting

04:02 - in the wake of the ransomware attack on the attorney General's office,

04:06 - the attorney General's office, and cybersecurity

04:09 - and all of their it is through the Office of Administration.

04:13 - The Shapiro administration very quietly dismissed our CIO

04:19 - and our CTO a few weeks ago, and they put the former head

04:22 - of code, PA, in charge.

04:27 - I believe that for something as important

04:31 - as all of our personal information and data that this government has,

04:36 - the Senate should be

04:38 - in the position of confirming

04:41 - whoever that individual is prior to getting elected.

04:45 - I spent a little time, being a CEO of, of a small cybersecurity company, and,

04:50 - and I got a general look into the cybersecurity space.

04:54 - Again, I'm not a technologist, but it was amazing to me,

04:58 - the things that I saw when we were meeting with this,

05:01 - it was unbelievable how we are in a precarious state.

05:05 - And I thought, wow, those are the I don't even have

05:08 - a security clearance in the stuff that I see scares me.

05:11 - I think that when I first came

05:14 - in, I started the cybersecurity caucus.

05:17 - What we did initially is we went through each of the departments

05:21 - and asked each of the departments

05:22 - to give us a rundown of what they are doing, educate us.

05:26 - What are they doing in terms of protecting their data?

05:28 - What are the things that we found is that, on a local level,

05:32 - and this is what I had decided to address, at least initially, is that

05:37 - that we have our National Guard or National Guard has the ability

05:41 - to help local municipalities, schools, because on the local level

05:46 - is where there's a lot of data and people say, well, you know,

05:48 - I don't need to worry about my, my school data.

05:51 - Like, who cares about grades?

05:53 - Or, you know, who cares about some like, local government stuff?

05:57 - But the reality is, is that cybersecurity bad actors, they attack every single,

06:02 - access for data, and then they piece it together.

06:06 - So there may be a small piece of data that the schools aren't even aware

06:10 - that is being hacked, but it provides a key or a connection

06:14 - to the five other pieces of data that that they attacked.

06:18 - And a lot of people will say, well, but, you know, our system didn't go down well.

06:22 - Just because your system didn't go down doesn't mean

06:25 - that you are not losing your data or that somebody is in there.

06:29 - What we need to do also, in terms of when we're talking about solutions,

06:33 - is to make sure that our school kids

06:37 - have a greater understanding of what they are actually doing.

06:39 - And I'm, I'm I'm afraid that the kids really don't understand the threats.

06:44 - They just see the the charm of getting on TikTok.

06:47 - They see the charm of getting on, you know, opening up their door.

06:50 - And it's it's really sad because that has to change

06:54 - in our educational system and that has to be addressed.

06:57 - And I'm afraid it's not being addressed fast enough.

07:00 - Jill Harford I'm the founder and president of reclamation.

07:02 - Next year

07:03 - we'll be celebrating 25 years in business here in the Commonwealth of Pennsylvania.

07:06 - We work with businesses and state government to prepare them

07:10 - for the eventuality of a of a security incident that may or may not

07:15 - evolve into a data breach.

07:16 - Everything that happens isn't necessarily a data breach.

07:19 - It will begin as an incident.

07:21 - And it's really important that we understand what is preparedness.

07:24 - It is different for all organizations.

07:27 - It is no different than any other domain

07:28 - of business finance, accounting, operations.

07:32 - Cybersecurity has to be that conversation in and of itself,

07:36 - outside of information technology or IT cyber security.

07:40 - Information management is a is a senior level responsibility,

07:46 - whether we're talking about private sector or our state government.

07:49 - The enormity of the potential consequences,

07:52 - I think, is one of is is one of the most critical things.

07:55 - It's underappreciated.

07:56 - There was a news report I saw where there was a small town in rural Massachusetts

08:02 - that discovered that their water system

08:06 - had been infiltrated by, spies from China

08:11 - and that, no, no harm had been done.

08:15 - But the spies had positioned themselves inside the system

08:21 - whereby if the time came that they could essentially wreck

08:25 - the system by, putting things on overload.

08:29 - Fortunately, you know, the this town figured out that this had happened.

08:33 - They, they, you know, contacted the the correct,

08:37 - federal agencies to, to help them with this and that.

08:41 - Ultimately the town had to rebuild, the entire infrastructure

08:45 - for their, you know, water purification system at the cost of,

08:49 - I think, $100,000 or more, which was a lot for this little town.

08:53 - These sorts of incidents aren't merely annoyances.

08:57 - Could you talk about what the potential dangers are and why our, authorities

09:03 - in the public sector, private sector, need to take action to address them?

09:07 - This is more frequent than, Then I think people even realize

09:11 - that there was one recently in Aliquippa, in a town next to mine.

09:15 - And they found out that it was, Russian actors.

09:19 - It's a huge problem.

09:20 - And and, you know, that's that's one of the, the things that we need to do

09:24 - with our local municipalities and these local water authorities

09:29 - is to really get them on the same page in terms of of addressing this

09:34 - and realizing how many people can get sick if their water is just

09:39 - if it's not purified the proper, proper way.

09:41 - It's huge.

09:42 - That little local water company interconnects with their municipal

09:46 - government, their municipal government connection to their county governments

09:49 - or county government connects them with the state government.

09:51 - The state government connects to the federal government.

09:53 - It is a backdoor to create chaos.

09:57 - Think about all the things that government has about you.

10:01 - Your name, your date of birth, your your home address,

10:05 - your Social Security number, all of this information.

10:08 - Piece it all together.

10:10 - And that's on a personal side.

10:12 - Now they have your water system, your electric grid,

10:16 - your bank routing numbers, and they are looking around

10:20 - and seeing what they can access and what they can do with it.

10:24 - So if we're not thinking about how to protect it,

10:29 - who is?

10:30 - And that's why what we do is so important.

10:32 - Representative Gaydos brought up a really good point,

10:36 - and I actually have a bill to address it.

10:38 - And that's a student data privacy bill, which kids are right picking.

10:42 - If you can get all that personal information

10:44 - that your school district has about your kid

10:46 - when they're about 6 or 7 years old, is probably going to be

10:49 - until they're about 18,

10:50 - when they go to apply for a car loan, or they go and apply to go to a trade school.

10:55 - Or maybe they get, a student loan

10:58 - and all of a sudden they go, Holy cow, what happened?

11:01 - We're constantly moving in in the banking system.

11:05 - Will probably figure it out sooner rather than later.

11:07 - If you go to apply for a credit card or a home loan or whatever,

11:11 - you do that much more frequently as an adult.

11:13 - But those kids,

11:14 - they have a good ten, 12 years on them that they can use those numbers

11:18 - and really wreak havoc in a young person's life.

11:22 - Threat actors want to do one of two things.

11:24 - They either want to make money or they want to create chaos and destruction.

11:29 - The reality and the work in which we do today with a number of government agencies

11:34 - is that the landscape to create chaos is ripe.

11:39 - When you think about affecting the grid, when you think

11:43 - about impacting other utilities, you create chaos.

11:48 - There's no value necessarily in trying to put troops in the United States

11:52 - or drop a bomb.

11:53 - There is a lot of value in creating chaos because we know what that will do

11:58 - to an economy when we look at Pennsylvania rural communities.

12:02 - I'm a I'm a township supervisor in a very rural part of Pennsylvania.

12:06 - And I will tell you that our rural townships struggle trying to remove snow.

12:11 - Now we start talking about we have to be able to upgrade computer systems.

12:15 - We have to make sure that those computer systems are cyber prepared.

12:19 - And oh, by the way, where does the human talent come from in order to provide that?

12:23 - I don't think that cyber security has to break the bank by any stretch

12:27 - of the imagination, but it most certainly is an investment that has to occur.

12:31 - But when you go to someone such as myself, I've got 1975 residents

12:37 - I'm responsible for, and you asked me to spend a few thousand dollars on X.

12:41 - That's a really difficult spend for me to try to make.

12:45 - So there are a number of challenges that go in, but at the end of the day,

12:48 - it is about money and it's about destruction and chaos.

12:52 - Very few issues impact, a diverse group

12:55 - of our membership quite like data privacy and data security.

13:00 - And it's a valiant effort for businesses to protect the data

13:03 - that they're collecting from consumers and something that our members want to do.

13:06 - But there's a balance with prescriptive mandates

13:09 - that policymakers put in place and punitive measures,

13:13 - for example, like lawsuits and litigation efforts, tied to data breaches.

13:18 - So as lawmakers, how do you balance protecting consumer data

13:22 - while ensuring businesses are free and able to, innovate

13:26 - and to protect themselves from hackers and bad actors that may attack their data

13:31 - despite them potentially being, doing everything they can

13:35 - to protect their consumers.

13:37 - I think everything we should do should incentivize, not penalize,

13:41 - because penalizing doesn't.

13:44 - That's that's after the fact.

13:46 - So I think that any of the things that we address, should, should not be

13:52 - a burden on business to the point where they're just checking boxes.

13:56 - And part of that is because you can't really make legislation so specific,

14:01 - because of what I talked about earlier, is the speed in which this stuff changes.

14:05 - So incentivizing is a

14:08 - is a way better approach in my opinion, than penalizing.

14:11 - I agree with that.

14:12 - But I, I think I would take it one step further, which is

14:15 - I think that government should lead by example.

14:19 - How do we make decisions in government to procure hardware and software?

14:24 - We know that there are back doors

14:27 - in everything that some of these bad guys can exploit.

14:31 - So how do we know we're buying the right hardware?

14:35 - How do we know we're procuring the best software we can look

14:38 - to the National Institute of Standards and Technology next.

14:42 - And they are the gold standard.

14:44 - We should be utilizing those gold standards

14:49 - and those best practices in everything that we do.

14:52 - And I think in that regard, we as state government can be, an example

14:57 - to be a role model as to establishing

15:01 - what those best practices are and adhering to those best practices.

15:05 - As Pennsylvania competes nationally for tech driven investment, what policies

15:09 - would you help position the Commonwealth as a leader

15:12 - in both cybersecurity innovation and secure manufacturing?

15:15 - This goes back to what I was saying about kids and the upcoming generation,

15:20 - is that they really are our future.

15:21 - And so, making sure that that students

15:25 - are aware of the careers and then in technical skills,

15:30 - partnering with private sector, getting kids on a path,

15:34 - to technical skills, understanding the computer field, cybersecurity

15:40 - and getting them in at an early age is is something that we can do

15:44 - with the private sector, but it relies on and it should rely on apprenticeships

15:49 - so that they are actually know what,

15:51 - they actually know what they are learning and could apply it to an actual job.

15:56 - And I think that's the beginning of of creating that pipeline.

16:00 - I agree with you.

16:01 - We've done that at ourselves, with many of our students,

16:06 - the need for men and women

16:09 - that have this skill set is astronomical.

16:12 - We cannot keep up with the demand in the workspace

16:16 - today for what's required over the next ten years.

16:19 - If we don't change what we're doing.

16:22 - And that simply means getting them at an earlier age, getting more access,

16:27 - and we do a horrible job of being able

16:30 - to invite women into technology.

16:33 - Absolutely horrible job.

16:35 - It's ridiculous.

16:37 - And, you know, some of the greatest engineers

16:39 - we've worked with have been females in cybersecurity.

16:43 - So at the end of the day, I agree with you.

16:45 - Whether you talk about apprenticeships

16:46 - or even what private sector is doing on their own,

16:49 - there's there's something to be said about doing that now, not in the future,

16:52 - but today, starting now.

16:54 - Completely agree. On the education front, we

16:58 - we have those challenges.

17:00 - But in a way, cybersecurity and that industry is really no different

17:03 - than any other industry that is represented here at this table

17:07 - to what can we do to help make it more attractive

17:12 - for the cybersecurity industries to be here?

17:15 - It's getting our tax structure, in the right place.

17:21 - You have a lot of small startup companies.

17:24 - We we have to get rid of, you know, the startup penalties.

17:26 - We have to get the tax structure right.

17:28 - We have to fix the permitting system.

17:30 - We took a step with Senate Bill six.

17:32 - We need our partners on the other side to to get it onto the governor's desk.

17:36 - It's about our regulatory system and overregulation.

17:40 - We need guide guardrails for a lot of policies,

17:44 - especially when we're in new and innovative technologies.

17:47 - What we what we don't want to do is stifle the innovation, the opportunity,

17:51 - the entrepreneurial spirit and the growth in that sector.

17:55 - We get those things right.

17:57 - We'll be able to roll out the red carpet to the cybersecurity industries,

18:01 - but also to every other industry that you talked about.

18:05 - Being able to incentivize, rather than, than penalize.

18:09 - Do you have any specific ideas on what that policy

18:14 - could look like in order for organizations to want to adopt

18:19 - best practices in cybersecurity in terms of incentives?

18:22 - I don't think there's any one incentive, but what we can do is create a framework

18:28 - for public private partnerships,

18:31 - or we can create a framework of trade associations

18:35 - to make sure there's like early warning signs that they can share in

18:39 - and have an exchange of information so that it's more collaborative

18:43 - with small business.

18:44 - It really is death by a thousand cuts.

18:47 - And so an incentive or a,

18:50 - you know, a penalty might seem small to a legislators

18:55 - who might not be aware of what it takes to run a small business.

18:59 - And that's why I think that exchange of ideas and,

19:01 - and, and, and creating a positive group

19:04 - of businesses with government

19:08 - is one step to having a like early warning sign.

19:13 - The biggest obstacle right now is that many organizations

19:16 - just don't know where to begin.

19:17 - What we we often say is that in order for you to even begin

19:23 - to work on some kind of cyber maturity model

19:27 - or journey, there has to be an assessment performed first.

19:31 - You have to be able

19:32 - to understand at a snapshot in time, what does your risk profile look like?

19:36 - Once you understand what that looks like?

19:39 - You now have the ability, what we would call a remediation

19:42 - roadmap, to build that plan going forward.

19:45 - It's a very powerful tool.

19:47 - It removes the fear, uncertainty and doubt.

19:49 - It makes budgeting much clearer.

19:51 - There is there's literally a roadmap on on what you can do.

19:54 - Well, and that's, that's something that we could do certainly on the state level

19:58 - is to find, grants and things like that to help these municipalities pay for this.

20:04 - What I hear from my local municipalities or even local businesses,

20:09 - it can be really scary to look into their their cybersecurity.

20:12 - So they tend to just hide their head in the ground

20:14 - because they say, well, we haven't had an outage.

20:17 - What advice would you give companies

20:20 - or municipalities to start that process, and what do they look for?

20:25 - Because there are a lot of cybersecurity companies out there.

20:29 - But how how do they vet the right ones?

20:32 - Sure, there are a few different things.

20:34 - First and foremost, for those organizations that haven't even begun

20:38 - any type of cyber journey, many will have a cyber insurance carrier.

20:43 - And so we will often say, go back to the cyber insurance carrier

20:45 - and begin to have that conversation of, okay, what do I need to be doing

20:50 - as an organization in order to improve my own cyber posture?

20:54 - And the reason why we want you to do that is because the insurance carriers

20:57 - want you to be in really good shape, because they don't want to pay claims.

21:02 - So ask those questions, and they will often literally

21:04 - have a playbook for you to adopt and at least start that conversation.

21:09 - When you start talking about how do you how do you vet the service providers?

21:12 - Because unfortunately, like in many cases in it,

21:15 - anybody can hang out a shingle and say that they're an expert.

21:18 - We look very much to as an organization.

21:20 - Soc2 type two attestation that basically as a third party auditor,

21:25 - make sure that your organization meets those standards

21:28 - that you had referred to before and then some.

21:30 - And then the other thing that you you have to get involved in is

21:33 - what does your own due diligence package look like to manage third party

21:36 - vendor risk?

21:37 - Because that's really what we're talking about.

21:38 - When you start talking about working with the service

21:41 - providers, you have to build, your own

21:45 - vendor risk policy and how you're going to work

21:48 - with organizations and qualify them as well.

21:50 - For, for municipalities, it's the same thing being able to take a look

21:53 - at those state requirements before they engage with a vendor

21:57 - to figure out, can they, in fact, help them in that journey?

22:00 - We all remember when, the former governor, in his infinite

22:05 - wisdom, said that we would do contact tracing,

22:08 - at the time chaired the Communications and Technology committee.

22:11 - It was an app that you would put on your phone

22:15 - and so was concerned.

22:19 - What's that

22:20 - third party app going to do with your information?

22:23 - The problem wasn't the third party app.

22:25 - The problem turned out to be the third party

22:29 - that the Department of Health contracted to analyze the data,

22:34 - who put it on publicly accessible Google Spreadsheets for everyone.

22:39 - So you can set all these standards for your entity.

22:44 - But then you contract with third party vendors,

22:47 - whether you were in the private sector, in the public sector,

22:49 - and how do you hold them accountable?

22:52 - But it's difficult as it is for the private sector.

22:55 - I can choose as an informed, educated consumer who I want to interact with.

23:01 - Sure, I don't have a choice.

23:03 - I have to interact with my government.

23:05 - So as important as it is, I think for the private sector to maintain

23:10 - good cyber security and protect their customers,

23:15 - I would say that it's even more incumbent

23:19 - upon government to do those very things.

23:23 - The one final question I have, and I it could probably be

23:25 - a session in of itself, and that's artificial intelligence.

23:28 - I'm not a believer in fear of artificial intelligence.

23:31 - That's just me.

23:32 - I look at artificial intelligence is just, another

23:36 - wave of change in the overall technology pathway of the world.

23:40 - I realize that there are risks associated with it.

23:43 - There were risks when we went to cloud based computing.

23:46 - There were there were risks when we went and outsourced,

23:49 - software to countries all over the world.

23:52 - There are always going to be risks.

23:53 - It's how you approach the risk, how do you manage it, had it mitigated, etc..

23:57 - What thoughts do you have in your in your particular role today about where

24:03 - legislation should be thinking, talking,

24:06 - etc., about artificial intelligence?

24:09 - It's a great question.

24:11 - It's a question that we're all grappling with.

24:13 - It has tremendous opportunity to positively impact our lives,

24:19 - and it has a tremendous opportune to really negatively impact our lives.

24:24 - We've been tinkering around the edges.

24:28 - Right. Deepfakes.

24:29 - Can you take my image? Can you take my voice?

24:32 - Can you get me to say things that I wouldn't normally say

24:35 - about taxes or regulations or anything in a political space?

24:42 - That's not good.

24:44 - Can you take my face and put it

24:48 - on, another body?

24:52 - Hopefully, if you do that, it's much younger.

24:54 - But, you know, we've had those challenges with students

24:59 - and having to change laws to meet those needs because, you know, student

25:05 - faces were put on nude images of bodies,

25:10 - and the law didn't really have a means or a way

25:15 - to actually address that because it's not technically used.

25:19 - So it's not technically a crime.

25:21 - And so we've had to fix all of those things as technology ag grows and emerges,

25:27 - it goes back to how do you harness the positive power of it?

25:31 - How do you put up guardrails without stifling the innovation

25:35 - and the opportunity?

25:37 - And I think that's kind of the lens that I look

25:40 - at any of these particular,

25:43 - policies that come down the road.

25:47 - This goes back to piecing all the data together and all these security breaches

25:51 - and cybersecurity.

25:53 - Is that all these pieces, whether it's the school, whether it's a law firm,

25:57 - whether it's an accounting firm, those are all being pieced together now.

26:02 - And that's where it ties in with AI.

26:04 - So we think you oh, we just

26:06 - you know, it's okay, but it's just a bunch of school grades that got lost.

26:10 - But it's not.

26:11 - And that's the danger of AI is,

26:14 - is that it is going to piece together all of those things.

26:18 - Now, that said, that goes back to talking about what we have to teach in schools,

26:23 - and that's critical thinking, because as Senator Phillips Hill said,

26:27 - it is all about the user and that it can enhance things.

26:32 - But the danger is, of course, it's the data in.

26:36 - And if the data goes in there and terms hallucinations

26:40 - and that that it can create.

26:42 - If you've ever done ChatGPT

26:45 - and you've looked at that and you're like, I know that's not true, well,

26:48 - but guess what?

26:48 - It's pulling from all the data that's on the internet.

26:51 - And the challenge with AI is that, okay,

26:55 - you want to then narrow down

26:59 - what you're giving it

27:01 - so that you're having to verify that data.

27:04 - But the question and the quandary is is okay, but who's verifying that data.

27:08 - That's going to be the input.

27:10 - So we go from having the challenge of having too much data,

27:14 - which is a lot of garbage that has been on the internet for several decades now

27:20 - to, okay, who is going to,

27:23 - you know, culminate the right data to put in.

27:26 - And that's where I don't think we can legislate that.

27:30 - But what we can do is teach critical thinking

27:33 - in our schools, and that's got to happen ASAP. Wow.

27:36 - That's a throwback critical thinking I love it.

27:39 - Well, I want to thank, our distinguished panels

27:43 - panelists, State Senator Christine Phillips Hill, Joe Harford

27:47 - from reclamation, and, Valerie Gatehouse,

27:50 - from the Allegheny County State Representative.

27:54 - Thanks to everyone for being here today.

27:57 - Thank you.

27:57 - Dave, thanks.

28:00 - Well, that's all the time we have for this week's program.

28:02 - PMA perspective returns next week, and until then, stay current on what's

28:06 - happening in your state government by visiting PA manufacturers.org.

28:11 - From all of us here at PMA.

28:13 - Thanks for watching and we'll see you next week.

28:35 - This program has been paid

28:37 - for by the sponsor and does not reflect the views of PCN.