This is Startup Storefront. Donuts are a stale, $40 billion industry, but one company is breathing new life into the vocation. Holy Grail Donuts began their pilgrimage as a burger truck in Kauai, but it wasn't long until they developed a cult following around their tarot donuts. Fast forward to today and they just raised $9 million in funding to open a bunch of shops in LA. And they've even garnished investments from Christopher Costow and Tony Hawk. Part of what makes eating their donuts a religious experience is the fact that they're freshly made with each order. And the unique flavors they offer can only come as a result of divine inspiration. Today we talk with Holy Grail Donuts co-founder, Nile, about making fresh donuts in his hotel room just before one of the most important pitches of his career, taking a leap of faith by rapidly expanding their locations and why there's nothing unique from one small donut shop to the next. All right. Welcome to the podcast. On today's show, we're talking to Holy Grail Donuts founder, Nile. Thanks for joining. Appreciate you having me. For people who don't know, what's the company? What are you guys making? So at Holy Grail, we're making a really a farm-to-table, main-to-order, Hawaii-grown tarot donut. And we're serving that locally here in Los Angeles now. Walk me from the beginning. What problem did you see in the universe? What was missing? Maybe you're just a food lover. What was the thing where you said, okay. Let's start down the road of feeding the people with this delicious thing. Absolutely. Well, if we got time, I guess the road starts way back. Oh, we got time. I mean, donuts have always been a really nostalgic product for me growing up. So that's the first. In Hawaii? Growing up in Oregon, actually. I grew up in Eugene, Oregon, and was recruited to Oregon State University for rowing and about halfway through pursuing ecological engineering at Oregon State, I helped create a donut concept there that was called a Domino's Pizza, but for donuts, kind of a main-to-order late night, super bootstrapped donut concept there. And while that was unique, and I got to explore that creatively, it really showed me the ins and outs of the more traditional donut industry, which really didn't align with the reasons why I was pursuing ecological engineering. Give me a window into that. Who's like the dominator in the donut? Is it Dunkin' Donuts? Who's the player? The players are really people behind the carton, which is the suppliers and the producers, such as Don Foods. They're like probably one of the main ones, and they are providing everything from donut mixes to glazes to frying oil to all the donut shops, or the majority of donut shops across the U.S. or globally. So Dunkin' Donuts is like a buyer of one of those products, several of those products, let's say. Yeah, and Dunkin' Donuts and Krispy Kreme are like the two exceptions that do have their own supply chain. But then these other vendors produce for all the other mom-and-pop shops. And that was kind of the wake up haul, or I guess the calling for me was that I had realized that all these donut shops that were kind of doing something creatively with a donut or advertising it, they were really masquerading as something that they're not. And that was the inspiring part. You're adding all these interesting, like we put a local blueberry glaze on our donut, and now it's a local donut. But the DNA of the donut itself is still a 28-ingredient premix bought from Don Foods that's fried in hydrogenated vegetable oils. And that's the piece that I looked to unlock. Okay, that's fascinating. How big is this industry? It's over $40 billion market size globally. That's a big market. So it's bigger than most people would think. Okay, and then what was your first step in terms of maybe like how did you stumble into the tarot? Yeah. So I had that concept in Oregon, and because of misalignment around the product and ethos, I was able to sell my ownership to my business partner there, and that allowed me to move out to Hawaii where my sister, Hannah, was actually living and working as a private chef many years before I moved there. And that's kind of where we began to kind of collaborate on this concept and begin to test it. And is she, in terms of like, is she like a pastry chef or was she, was this just like a deviation, but it's still interested, still trying to make something delicious? Yeah, neither of us have any formal training in culinary. It's always been, you know, we have always cooked at home. It's been a huge passion for both of us, but no formal training at all. And I think that's why we're able to develop something new is because we weren't lying on any existing structure. And so then you guys started with a truck? We did. I needed a way to kind of make income. I, you know, didn't really have much. So I ended up using what I had gained from the previous business, and I purchased a burger trailer in Honolay, which is the furthest north town of Kauai. And I purchased it mainly because of the location. And it was just an already existing business that was generating some revenue I could go in and flip burgers and make an income while developing this donut concept. So that allowed myself the flexibility, time, and resources to... How many years ago? How many years ago was this? 2018. So not long. Five years ago. I moved to Kauai in 2017. Okay. So it's been a fast-paced journey. Yeah, that's amazing. So you were flipping. So you had this burger truck, and you were utilizing it as a burger truck, and then later on had to convert it to a donut truck, right? How much of a difference is there in terms of, because you're not using a grill for the donuts, like how much of a buildout did you have to do to this burger truck to convert it? Quite a bit. It was a grind. So there was a six-month period where I was making burgers five days a week, and I just had one other employee working with me working the window. I was cooking everything, and I was working that job. And then on the weekend, my sister and myself, we'd come in at 4 a.m.  So the truck would actually transform every single weekend into this donut concept. Flexible real estate. Exactly. So it allowed us to spend less than $2,000 to start Holy Grail. And what would you see? So what were people lining up? What was the thing where you were like, oh, we might have something here? Honestly, it happened day one. We, through the development of the product, we worked with local farmers and artists in the area to source all the ingredients, because the vision was to create a donut product that's completely ground up by the resources of the community we're around. So, you know, the big light bulb moment was this truck is parked across the street from the largest tarot field in the state. So of course, tarot, donut. And then, of course, naturally, you probably could have found a pineapple farm, too. And that would have made sense. Yeah. And then all the garnishes, everything that went on the donut was sourced from other farms in the area as well. And there was a lot of, you know, I would say a massive psychological approach that went into developing the actual menu and the brand. In terms of care. In terms of. The rotation. Care. The collaborations, maybe. That too, but also from a consumer standpoint, our menu is developed to actually create some habitual behavior is what we're hoping to do, because it's a product that you can eat, not feel like shit afterwards. But also, we change the menu every single week. And that's kind of what allowed us. The whole thing. All of the flavors. So, no, you don't keep a single staple. So now we do. Now you do. In the storefront. Okay. And we still have what we call our tasting box, which is four donuts. So we, most donut shops have 28 flavors or so. We started with only four and we'd rotate those four every single weekend, based off of, purely based off of seasonality, which had us in this just vicious creative cycle every week. Yeah. Thinking about what. And a lot of testing. You're seeing a lot of data. What are we going to serve next week? We have to develop four new flavors. Yeah. Go visit farms. Go visit markets. Find new ingredients. How long did you do that for out of the truck? So we did that. I mean, we still do it to this day, honestly, but the truck was the burger truck and Holy Grail for a solid six months until we gained venture capital investment.  The burgers were just a stepping stone. Were people upset to lose the burgers? Some people were for sure, but the donuts definitely had developed a legitimate movement behind them. At what point do you think this is something that can be venture backed?  What's the thing that you saw? What is the thing that you felt was missing as it relates to sort of how things are today versus what the world you're trying to create? What did like a walk me through sort of like the deck, the secret sauce, I guess? Yeah. It was still at a very conceptual stage, but I had always wanted to pursue growth with this concept. So it was always supposed to grow. I didn't know how. I didn't know what a venture capitalist was at that time.  And as those conversations developed and just nothing felt right, there was a ton of interest locally from local celebrities or other business owners, but just everybody wanted too much. Locally to Hawaii. Locally to Hawaii. OK. And what happened was Kevin Rose from True Ventures, founder of Dig, he was visiting Kauai and he had like a 12 hour old donut and that sparked him requesting to have lunch with me the next day. So he loved it. He loved it. He loved the product, loved the donut. He was deep in the biohacking phase in that time. So it was honestly an honor that he even tried the donut. I think he was resistant at first. And we got sushi the next day.  And he asked if I could go pitch his partners that Friday, which was two days later on Big Island. And I didn't have anything. I mean, like no deck, nothing, just the donut, just the product and the dream. Pretty much nothing at that point. I love it. I had our donuts costed out. Are you nervous? What's going on inside of you?  It was pretty freaky. But at the same time, like, what did I have to lose? I wasn't pursuing venture capital. Did you sleep? Hardly. I wasn't sleeping much. Because every scenario was going to run through your head at that night. That's fascinating. I wasn't sleeping much back then in general, so that wasn't new. But because I didn't really have a pitch prepared, I ended up packing up a couple Costco bins and throwing fryers, taro, all the ingredients and equipment necessary to make our donuts. And I flew out to Big Island two days later with all the stuff to make the donuts in a hotel at a tech conference. And I ended up showing up to the pitch 15 minutes late. But I was frying donuts in the hotel room before the pitch. So I showed up to the pitch with three tasting boxes of fresh, crispy, beautiful donuts. And had Kevin prep his partners in any way? I'm not sure. So they see donuts show up in a room and they're probably thinking, what on earth is this? And then, are you just like, try it? Are you telling them the taro piece? What are you leading that conversation with? It was really a bit of everything. It was my experience in the donut industry prior. It was our bootstrapped approach that was purely driven towards passion for the product. And it was also the development of the concept from really an operator's perspective. Everything from the equipment to the menu had to be developed in the constraints of a 12 by 8 food truck, which there's something at scale now that we look back. That's a really beautiful thing. That allowed us to have maximum punch with the product and the menu and the experience within such a tight constraint, such minimal equipment necessary to produce this product. And that was a really big part of it. But of course, just trying the fresh donut was the main thing. And then what happened? So then, are they like, OK, we're in. Are you giving the strategy around we're going to follow a brick and mortar strategy? What does that look like? Yeah. Is that always so clear to you? Or is that something that's developed sort of? The brick and mortar was at the time that just seemed like the obvious approach. Like, OK, we started in a food truck with no investment. Now it's time to take investment and open a brick and mortar. Start up to storefront. Exactly. So that was really the main point of the pitch. Like, we need to solve some proved points. We need to see what this looks like in a storefront form. And then eventually we need to go to a larger market because you can't pour that much investment into this little concept in Kauai. Because you don't know what's going to happen when that concept hits LA or a larger market like Honolulu. So we ended up getting a term sheet that day right after on the spot of the pitch. I'm just curious in terms of valuation here. Because it's a food product, it's not really CPG, right? What does the donut company like yours fall into? So it was structured similarly to the blue bottle investment, actually. Because True Ventures was one of the leads there. And they had just come off of that deal with blue bottle. And Tony Conrad, who led the investment for Holy Grail, was the lead for blue bottle. So that was kind of our anchor point. Yeah. And so then what's your first location here in LA? So first location was Santa Monica on Main Street. We opened that, Natalia with Curato did a beautiful job building it. And we opened that this past December. And then recently, this February, we opened on Larchmont. And how's it going? What's going on? What are you learning about this market compared to LA? What are the signals telling you? Is it a smash? How's the menu doing? Going really well. I think that there's obvious alignment with the product. People care about ingredients that they're ingesting here. They care about where things come from and how they're produced. So I think the artisan aspect of our product is really being appreciated. There's, of course, like a big educational leap that needs to be made from the traditional donut industry. Just because of the taro? Or what's the taro? Most people here don't know what it is. So that's a huge, huge piece. Tell people what it is so they know if they're listening. So taro is a root crop. It's very important in Hawaiian culture. It's traditionally one of the staple foods, along with historically rice was. And taro is this just beautiful root crop that's grown in flooded fields similarly to rice. And it essentially shoots up into these multiple beautiful heart-shaped leaves. So if you go to Honolay in Kauai, you'll see this incredible landscape with just heart-shaped leaves as far as the eye can go with waterfalls and mountains surrounding. And so we use the actual root of the crop. It's similar to a potato, but it's much higher in antioxidants. It's poisonous when eaten raw, so it actually needs to be boiled. And then it needs to be traditionally it's pounded. So traditionally it's boiled, then it's hand pounded and fermented. And that's poi. So we use a form of that in our dough. And that's what gives our dough more of a savory, less sweet, slight chew to it, but also some crispiness. So it's just allowed us to develop this just completely unique product. Okay. So that's some education in the market. Is it gluten-free? Obviously it's vegan. Yes. It's all plant-based. We do have a flavor every now and then. We'll put honey on it, but we'll label that. Tarot itself is gluten-free. We are striving to have a donut that is a donut. So there is a little bit of gluten in it. There's a little bit of flour. You could make one that's gluten-free, but it wouldn't have all of those really special nostalgic textures. When it comes to scaling, and so are you still using the same supplier, the farm across the street?  Absolutely. We currently have three that we work with. So our Oahu locations use an Oahu supplier, our Hanalei location uses a Kauai farmer. And in Los Angeles, we use a multitude of both. So we really spent the past two years cracking our supply chain to alleviate any of the vulnerabilities that came up of the COVID crisis. So now we own the majority of our whole supply chain as a company, which we had to expedite. This is a very early stage to do that, and it's a large investment. Makes sense, though, for scale. And then just to go back to the original thing you mentioned, where there's one large supplier, do you envision yourselves becoming your own supplier also in the sense of you're selling the dough, or not the dough, but whatever, the box? As in wholesaling our donuts themselves? But just in the grocery store, being like, hey, have your own holy grail donuts, make a match at home type of thing. I do think that there's a CPG angle. I don't think that it's this product, though. I pulled this product sacred. We make it to order. So much training and development goes into every team member that makes it. It's a really fair comparison is blue bottle coffee, actually, or any third wave coffee shop that went from bulk drip coffee to artisan pour overs made fresh with freshly roasted coffee. That's kind of what we are in the donut industry. We're just like somebody making your pour over to order. We're making your donuts to order. And it's hard to put that level of trust even into the consumer to make the product right, or other businesses. And that doesn't mean that there won't be products down the road that are slightly adjusted for a CPG route. One of the hardest things that we had to do for this podcast is something so simple. It's to get chairs. We've been using these plastic chairs, and they just weren't cutting it. And not only were they ugly, but they were also massively uncomfortable. So when we had the founders of Sundays on the podcast, it only made sense for us to get new podcast chairs. So they shipped us a set of count on me dining chairs. So if you're interested in upgrading your chairs to whether that be in your house, office, podcast studio or anywhere in between, check out the link in the description to pick some up yourself. We can't recommend Sunday's chairs enough. You said sacred. And it reminded me like, how did you come up with the name? You know, it's so, I love the branding and the website. Everything like you have on there is just filtering down from the religious aspect of Holy Grail, the chalice, the pilgrimage to these stores. So what other names did you consider and how did you land on Holy Grail? Thank you. Yeah, we had a lot of fun with it. Still do. We didn't consider any other names. Was it divine inspiration? I mean, it was an accumulation of things. It was mostly mostly credit goes to my mom, actually, who does work within the company. And I put the E in it is kind of how we developed it. But the idea was we're going to completely flip the whole donut experience on its head. And it's the Holy Grail of donuts. And it's honestly looking back, it's really surprising that nobody has really utilized that name. You know, this is one of the most important objects in human history. And it symbolizes so much, you know, so many positive things. And nobody's really used it before. So it's just perfect for what we're trying to do. And so this year you want to open how many stores? So this year we're hoping to open one more storefront and two food trucks. However, next year we really want to get into cadence to where we can open a significant amount of stores. You can pump them out. Yeah. Yeah. What other cities are you eyeing? Right now, Los Angeles is is where our focus is. We would like to take this concept to Asia as well. Where we're in Asia. Specifically, Japan initially. Yeah, I was thinking Cambodia, just why not? Well, I know that so I worked on a documentary called The Donut King. It was about a Cambodian. Oh, you were? I love that. You know that one? OK, yeah. So I was I was a drone pilot for all of that. Amazing. And what I learned about. He gained 40 pounds on that. I bet it was a lot of donut eating. It was great. It's a beautiful film. It is. It turned out so well. But what I learned about that was that this guy, he came over from Cambodia, emigrated during the the massacre over there. And when he came over here, he found that our donut culture so closely resembled something that they had back in Cambodia. And that's why he fell in love with it. And then once he opened up his shop, he started funneling money into other Cambodian refugees to come over and open their own donut shops. And so like when I think of you trying to expand into Asia, I would think Cambodia would be a very receptive market for you. It could be super interesting to be honest. I don't know. I don't know enough about Cambodia, but I've always wanted to visit Japan. I love Japan seems to make sense to me. Their coffee culture is next level. And so when you talk about the blue bottle, the level of care Japan, Tokyo easily comes to mind. I mean, the level of care there is I would.  Absolutely. And so I've always been extremely attracted to that. And that's, you know, our packaging is just like tight and beautiful and concise. And the product is small, but satisfying. You know, and there's a lot of artistry that goes into it. We, you know, we tweezer edible flowers on our donuts. It's just I feel like the cold, the culture there would really appreciate it. 100 percent. And so you walked in here, you saw a food truck. What is your food truck going to look like? What are the trucks? What's the vibe? So we're currently going through some thoughts around how we redesign our food truck because they've kind of been a mixed match. They've just been very opportunistic as far as finding one working with the existing layout and design. Now we're in an opportunity to where we can actually design one from scratch. So that's currently on the table. You know, this our original location, which is one of our best performing units, is still a red burger trailer like with it has our old logo on it still. And it it doesn't need to be anything else. So now we're, you know, that works for Hawaii, but now we're thinking, how do we how do we educate people here? That's smart. And then you got Tony Hawk on board. Obviously, he's probably invested in a million things, but he's obviously taken a liking to you and the brand. And he's public about his interest. What has it been like working with him? What have you loved? Obviously, he was at the opening in Larchmont. Yeah, yeah. What has it been like working with Tony? Very casual. Tony is just, I guess, exactly how I hoped he would be. You know, you say, don't meet your heroes. And Tony is does does not reflect that at all. He's he's just a beautifully humble person who's very down to earth and he loves the product. He's a skateboarder. Really as simple as that. That's that's the relationship. That's great. And then when you think about sort of your journey. So five years ago, right? Roughly, you were doing this burger four a.m. Wake up transforming it to what you have today. What do you think about the next five years? How like, what do you think changes for you? Is it so at that point, you're in Asia. You're probably more markets in America. What does it look like? The CPG brand has started. How do you view that? Yeah, we want to keep growing this as long as it doesn't compromise the product or experience. I'm sure that's a cliche and many brands say it, but but it's authentic and genuine to us. And we believe we've unlocked the supply chain and team training and you to economic challenges that would prevent us from keeping this authentic. And now we feel genuinely confident in our ability to take this, you know, towards a hundred locations. So that that's what the next five hundred locations to us. That's great. How many did Blue Bottle end with before Nestle? I believe they were under a hundred. So Nestle in general loves, you know, powderizing everything. And so Blue Bottle, oddly enough, is working on like that. I almost like the iced latte, but in powder format. And I forget who their savant is in the coffee community, but he believes they've nailed it. They've hit the holy grail, so to speak. Absolutely. When you think about that angle, that vector for for what you're doing on the donut side, do you see opportunities there to to powderize things to sort of make things more efficient without compromising? I certainly do, especially when it comes to our drink program. What is your drink program today? So our drink program is honestly just as unique as the as the donuts. So my the last donut business I was involved in had a hand pull lever, like classic traditional espresso machine. And I loved it. Just personally, I would geek out about it. I would make, you know, all the lattes, but then I was the one stuck working all the shifts because training people to use the machine and training them to produce a product, you know, the quality that we would expect is, you know, it's just there's a reason why that's a whole other business on its own. So I came to the realization that we're never going to be the best coffee shop and donut shop in the world. So we need a product for beverage that complements the donuts and doesn't really add to the complexity of the unit itself. So we developed a purely tap based beverage program. So we make our own cashew coconut milk in-house and we actually K it and nitrogenate it and serve it like a Guinness out of taps. And then that's like the building block for the rest of our drinks. So you can make a draft latte, a draft matcha latte, chai latte, what we call a cow latte. That's a business line to itself. Yeah, I think so. Yeah. And so you can make them all in 15 seconds. And what milks do you use? Is it always cashew? We only have that one type of milk. You know, everything. Yeah, there's a lot of focus towards oat milk. But, you know, and we get a lot of people who ask, but then we just give them a sample of our cashew coconut milk and it's better. That's at least fault. They just did a lot of marketing. Yeah, that's all that is. There's no substance there for being honest. And how much is a donut if I go in there and get one or get a box? What are the costs? So one donut is $4 and it's made order fresh for you in under four minutes. If you get our tasting box and that's the four rotating donuts of the week, we discount a dollar. So our tasting box is $15. And then our nine pack shown here, that's choose any of the donuts you want on the menu. And that's $32, which is the equivalent of one free donut. And I know you guys do some form of collaboration sometimes. Is that a monthly basis thing? We do, yeah, it's a relatively new thing. We call it breaking bread. And that's our version. Everything just fits. Like I said, yeah, all stems from a lot of time. We should have been shocked that you thought this through, but it's always nice when someone thinks it through. And it's like, of course it's called breaking bread. It's the little touches that really make a difference. All right, so breaking bread, you're collaborating, who are you collaborating with, when, how often? Absolutely, breaking bread is a collaboration to develop a new donut flavor. And we've developed over 70 on our own just through changing the menu every week. And I think we could still get another 70 in, but it's certainly harder every time to develop more. And breaking bread is a collaboration to make a donut flavor with a chef or a personality we admire. Anybody who wants to work with us and 20% of the proceeds of that flavor for the month goes towards a charitable organization of their choice. And one of the more recent ones was one with Tony Hawk, where we developed a donut with him. I heard he made a pretty boring one though, it's a pretty boring donut. It was a, Nella, something, something. It was a classic. It was a classic. That's what I meant. It's very PC. Yeah, let me rephrase that as classic. He's a classic guy and his favorite flavor was the original sin donut, which is just the, The original sin, like I said, yeah. And what was the charity that he chose? He chose, so it's the skate park project. Oh, perfect. Oh, which is, yeah. It was phenomenal and we had a blast. I'm gonna try one.  What are they called? I'll try the other half. Give me the name. That is our Hail Mary donut. Hail Mary? Another with the name. Full of grace. And thank you. Cheers. The Hail Mary, cheers. We just donut bumped. Yeah, so. Oh, you feel that crunch? That ASMR. That ASMR. So this is just our made to order tarot donut, but it's dipped in a crushed cardamom. So it's a crushed cardamom pod. That's what I meant. With rose petal on the top. I like the crunch. Yeah, so they got, and if you, you know, this is like an hour old, this box. So if you got them directly out of the store, it's even. That's really good. I love the crunch. It's good. Yeah, so that's our original sin.  Original sin. And that is our. This is the one I had earlier. It's just classic flavor. Nick loves donuts by the way. I have a problem. So that is vanilla bean that's grown in Oahu. So all the vanilla we get is sourced locally in Hawaii. And that's also the maple I was talking about earlier. So it's just maple, vanilla bean, salt. Just everything good. This is what I love about investing in general. It's like, when you know, you know. It's like, not that hard to try it. Is it good? It's great. It's everything. Is the four minutes a big issue in terms of throughput or no? I know a lot of people have gotten a large amount. A lot of people, we get texts with pictures of the line, which is a happy problem. But do you, do you worry about it? Or is it like obviously ice cream shops have that problem too? I'm not too concerned about it. I mean, we've done massive days with the equipment we have. And there reaches a point to where, if you have a good flow of people coming in the location, you just have the donut robot kicking out donuts nonstop. And you're making them fresh.  We're not. There's a couple other companies that do it. However, those pieces of equipment are designed predominantly to work with these premixes I was talking about earlier. So, you know, you've got a team of food scientists and engineers actually developing donut mixes with nasty stuff in it, to work specifically with this equipment. So we developed our recipe, and I think we're the only company in the world who's like actually developed every ingredient specifically to work with this piece of equipment in-house. What's the maximum amount of donuts you're able to make an hour? To eat per day. That's a different number. Yeah, it's true. That's a good question. About 32 dozen. A lot. That's quite a bit. Yeah, quite a bit. And the nice thing is if we ever outgrow that number, you can get a larger piece of equipment that doubles it. So what's next? Do you guys raise in capital now? We currently are. Yes. An A round? What is it? Yeah, it's currently kind of neither. Okay. You know, we were thinking series B, but just given the market conditions and the fact that we don't need as much as we thought to get the proof points that we want to get for the next 18 months. So currently we're looking to raise an A plus at the moment. Okay. Private equity. Yes. Food groups. Yeah, I mean, you have it. You have the model. You have, let's call it the chef or the thing. Look, where can people support you? Where can they go? Obviously Santa Monica, Larchmont, online. Absolutely. Please check out our Instagram page, holy with an E, grail donuts. And you can check out where our food truck is gonna be throughout the week. We're doing a lot of events, farmers markets in the LA area, trying to build community support. And then our Larchmont and Santa Monica location here, as well as our Hawaii locations. And if you check out our app, you can skip that line. Oh, there's your app. That you were talking about. In pre-order. You can pre-order. You can get your donuts delivered to you all through our app. It's a seamless process. And what's the app called? Holy Grail. Just Holy Grail Donuts. Okay. Come up on the app store or Android store. Yeah, that's what I'd recommend. Thank you. Yeah, thanks for joining. I appreciate you having me on the show now. Thank you both for having me. It's been great. If you made it this far, I bet you loved the episode. So you should join our YouTube channel membership for only $2.99 a month. This gets you access to one, the whole unabridged conversation. Two, you get the episodes on Monday, one day earlier. Three, you get two additional entries to our giveaways. Check out our Instagram to see what we've given away. And four, you get access to seasons one through three. That's over 100 episodes of wisdom and life-changing advice. What are you waiting for? Join.


Good afternoon and thank you for joining us for Best Security Practices for Advocates Working Remotely. Today we will hear from Jasmine Amour, Satish Nori and Scott Ellis. We will start off with a fact pattern that highlights key security issues. Then we will discuss the best practices for advocates and we will wrap up with some tips for you to take with you. You are working on an important case with a pro bono attorney at a private law firm. There is suddenly an emergency that requires documents to be filed urgently. You need to get confident client information, share it with a pro bono attorney, and work to meet the deadline. This is unfolded while at the airport as you head to your cousin's wedding. You think, I've got time, six hour plane ride, I'll get it done in no time. On your personal MacBook, you log into the airport's public Wi-Fi, connect to the firm's remote terminal server, and email documents you need to your private email address to work on them from your Mac. You also text your client from your cell about documentation you need from your client. In-flight, you conduct to the free in-flight airplane wireless network, log into your 365 web mail to review the document from the pro bono attorney and save it to your laptop as well. You remote back into the terminal server and email yourself more files. You use your laptop email to save the email attachments to your laptop. Air drop client images and documents to your laptop that were sent by text MMS to your personal phone, and your client's emails more documents to your personal email. You've made it through the six hour flight into the hotel.  It won't turn on. Fortunately, your Mac syncs your documents to your Apple iCloud account.  You get some rest the next morning while getting ready you look for but can't find your USB key. You realize your USB key isn't encrypted and has client data on it. Enjoy the wedding. You can't really blame the attorney in this position, although unfortunately they took some shortcuts here and I think that's what we're going to get into as some of the red flags and like I would just say about taking those shortcuts is like we're all trying to get you know these our jobs done we care deeply about what we're doing and unfortunately like sometimes especially when you're out and about and in public in these public places you need to take an extra moment to think about what what extra steps I might need to take to protect my client data and I think you know we're going to get into some of these red flags next. So yeah the next question I guess is what what stood out what were a few a handful of things that you know just made you cringe in this box pattern? Well I I'll go really quick first that I um I would say like the one thing that you know is that this obviously it's the attorney felt like it was necessary to email documents to themselves to their personal gmail account which is a big red flag obviously um but I I also see in this that they remoted into their terminal server at work to their remote desktop at work and like presumably we're not able to do the work that they needed in that um using that system that their work had provided to them so this is I mean I think this is a scenario where like we need to look at like what the you know attorney could do better which is like not use your personal account hopefully and also you know maybe the employer needs to look at modernizing their system to using something like using a file like a cloud-based file sharing so that attorneys can get access to their files um this is something that you know we have really like pushed forward and just even in the last three years is like we've recently moved everything on premises into a share point and I'm and I don't want to be a salesperson I want to start out saying I'm not trying to be a salesperson for any platform or anything I'm just mentioned some of the things that we do and I hope in your your comments you maybe mentioned some of the things that you're doing as well and some of the tools that you're doing but we found um a share point to be great um for having a platform to share files with opposing counsel so we're not like we can maintain uh we don't have to be emailing back and forth all the time there's like we can be working on our files and and they can be working on the same files and they can have access to the same systems we do and I'll get into we're going to get that into that later but that was like one of the big things is like you know for me that stood out is like that um the personal device but the not so much the personal device but the personal account use was a big thing. Satish has a caseworker and supervisor what is your perspective about all of this and and how realistic is this fact pattern? I would say that this is very very realistic and not just because I helped come up with it but um this is something that happens for example I'm using my personal iphone for work right now and that's probably um that's not in fact what my organization recommends I'm supposed to carry a second work iphone um and I'm sure many people who are watching this right now may already have two phones and you know what a hassle that is to have to charge two devices to have to carry two devices have to check two devices all the time um that's something that I think many people deal with they face the second thing is many of us prefer to use a Mac for example and at work they make us use PCs and when we get home we open up our Macs or many new lawyers for example had Macs in law school and they continue to use them um whenever I visit a law school I'm struck by how prevalent Macs are um in contrast to their prevalence in real legal environments where no Macs are used more or less right and so many new attorneys are probably using their Macs um when they start their new jobs and they continue to use them at home maybe there are organizations where you don't get a device um budgets are tight and you're not going to get an iphone or a computer a laptop or a tablet to use at home so you have to get your own um and then um as we work remotely during the pandemic I mean how many people were given hotspots by their nonprofit organizations not many so how are you supposed to conduct work when you're sitting home because of the pandemic and it's not safe to go in um you're using your personal wi-fi or you're at Starbucks or you're at the um bus station because you're traveling somewhere or you're at the airport so I think these are things that are very very realistic and then I think the other part about this fact pattern that's really critical is we're all working with emergency issues and we don't have time to think about what could happen because as legal professionals we're worried about the legal outcome someone could get deported or evicted will not have a benefit that allows them to put food on the table or pay for necessities or pay for medicine and so if we don't get things done quickly then good things will not happen and bad things could happen to our clients so I think all of these things are things that we deal with every single day and I as I said at the top if we're going to work from home we're going to see it more and more and more yeah and I would reiterate and we we see I mean at least half of the students coming out of law school with max and they you know they want to use them and and many of them you know are very great you know of learning are very proficient um with their device and just like the flexibility of just having one device and so trying to set up a system that allows them to do that has been really I has really helped us a lot and we got it started before the pandemic but we actually like invested in Microsoft's Intune mobile device management and what that has allowed us to do is actually enroll these devices in our Active Directory and set some minimum security conditions on them so we before they can access our SharePoint sites so we're actually like know where that data is we have some oversight of that data and we know that they're like they have some minimum security standards like they have to have a pin on their device and they have to have a password so these are the kinds of things it was like realizing we're moving into a period where more and more people are going to want to be using their personal devices and it being hard right now to even get laptops like for for people it's you know it's I think it's important as we are IT professionals is to realize this and that's something like I was saying this fact pattern is employer you know it needs to catch up with the times and get on the cloud and maybe overcome some trepidation there might be to being on the cloud because there can be like in this particular instance like losing the USB you know divide thumb drive being the major incident you know is obviously something that could have happened way before we had the cloud so yeah I would say so in the event my I know not everyone agrees personal devices should be in the mix but I think like this is a reality that even if our even if our staff is using a device like our students that are volunteering for us are going to be using personal devices probably and wanting to be using personal devices certainly outside council we can't control what devices they're using volunteers other organizations that want that we want to collaborate with like we need a platform that can work with everything and like that is like what we need to look to and look to for security models that can can hold can carry that the teacher do you have any concerns around the communication with some MMS texts so picture messages and some of the document sharing details that we added to our fact pattern you know that's a great question something that's really helped us is allowing our clients to text us things or to send us photographs for example if we're working on housing cases and we want to show the judge the picture of the leak or the mold or the rat it's great that our client can just open up their device and text it to us sometimes on our personal device and so it's been really effective in getting information from our clients and then communicating that information and it's helped us win cases and really present claims in a clear way it's also helped in getting documents like leases and rent receipts social security statements letters notices from immigration people had to bring it to us in the past or they had to mail it to us and we'd have to wait for it to arrive or they'd have to go to a bodega and fax it to us and sometimes they're charged like a dollar a page to do that I know many of you have probably dealt with this kind of thing now they can just open up their phones and just text it to us so the benefits are so tremendous the questions become well like who else can get access to this type of information if it's being texted and what happens if all this data that's on your personal device what happens if you lose your phone what happens if you leave it somewhere what happens if someone steals your bag and it has your laptop or your phone and all these text messages from your client it has their documents it has their social security number maybe so I think the analogy that I would use is it's like now we have these shiny bicycles and there are bike lanes everywhere and we can ride them anywhere we want and get there quickly and cheaply but we got to wear helmets and it's not because we are not good at riding bikes because we've been riding bikes since we were kids it's because there are bad actors out there who are trying to crash into us who are trying to throw us off our bikes and take our information and and hurt us and hurt our clients and so that's the thing that's really been challenging for me to understand and I think many of you may be in that boat too it's like well I know what I'm doing I text everyone all the time nothing bad ever happens to me I text my mom and my sister and my friends and my kids so what's the difference here and I think the difference is what we want to stress to you it's that we have an obligation to our clients and the risk is that something terrible could happen to our clients and we'll talk about that and I think Scott is is an expert on some of these things so I'm really glad that he's part of our group here oh thank you thank you I'm thank you all for having me and thank you Satish um for your comments for sure um yeah I I think you know in this situation I I mean this is a perfect example I think of what we're where you have to there's a balance like because when I think you know as an IT person I'm looking at what is better but I rather have my client you know my staff emailing the client with or texting I would be like well email like encrypted email so then we're like then we can pull that back if someone loses you know gets their email hacked or we can we just have a lot more control over this but then there are certain barriers that adds to the experience and like may not make us able to do this effective and advocacy as we need to or act as quickly as we need to so you know we need to be I think it's like imperative that advocates are telling us like what they need and like these are the this is what I want to be able to do talk to you know talk to us and help us come up with solutions I one thing we are you know in the process of doing we we had SMS built into our case management system previously but we're moving to a new case management system and we do want to incorporate MMS into that to for communication with our clients and so this would be I think you know is a hopefully will be a solution to some of these things in terms of like governance I mean it's still not going to be encrypted however it'll you know at least it'll not be on your phone you know sitting like if you lose your phone or you dump it in the water or whatever so again like I don't think there's a they don't think there's perfect solutions here I don't think like we're not trying to give you a list of things that you should do it's more of like just to kind of get the get things going get some thoughts going and Scott can you talk a little bit about encryption and what that entails and it's a word we all use but what does it really mean and how do we go about it and what and if you do have some tools that you might think are helpful for the legal community of course respecting the governance and the guidelines established by individuals organizations it policies because you should always follow those first but can you give us some more insight around how we should handle encryption if we did need to share documentation with clients well in the latin I would say in the last six months it's become much more of a pressing issue because of lay advocates in our organization who told us like we really need an email encryption like we're handling you know some of them you know health information immigration like very sensitive immigration information and we we absolutely need this and and I you know frankly I was like really like there's not a way around this and the more I looked into it the more I saw the advantages with email encryption which which we use like we have gmail and g-suite and we're using virtue which is really integrates with and makes it a little bit easier for staff to use but I'm been hearing some complaints about other outside counsel who don't like the way it works and don't like the extra you know bit to it but what it does allow us to do and we've actually had this situation happen where one of our another organization our state had a manager had an email hack her email hacked and was used for phishing and was and sending out to like like many people in our organization around the state and we I was able to go in and and any email that she was on that had an encrypted message which there was only there were only a few at that point but I was able to disable her access to that so it's like I don't think we think about I mean it's something that really became clear to me is like hey with encryption it's like that email is gone but I can still lock it down after it's gone I can remove access to that email and those attachments and everything even after it's out the door so I think that's really cool and I see that as really the future of this kind of zero trust model of security that we're moving to I'm I I see also like and I've been investigating encryption in office 365 and in SharePoint and they with sensitivity labels and Microsoft is really heavily like investing in this as a future security model where we can encrypt not only were like office 365 documents but PDFs using like azures like encryption information protection and we can set limits on how long someone can you know have a document offline so we can say like every three days they need to log in and confirm their access to that file so it's like if they if so in this fact pattern I think like we're looking at like even if this attorney is using an unencrypted thumb drive which you know hopefully it or not but of course like people you know don't take the time to lock down their thumb drives I don't do it on honestly like it's not something I think about doing and I we don't not dealing with client data as much but I you know but if we had those encrypt if the if the files that we had on though there were encrypted files that they had downloaded from our SharePoint site we wouldn't have to worry about it because like anyone who got a hold of those files would not be able to authenticate in and get access to what was in there so I yeah that's great we have a question in the chat oh what about using password protected documents via email this is something that maybe we've seen so we work with a partner organization and they use encryption for every single email that they send and each recipient has to log in and create a password and of course I can never remember my password so I get these emails and they're always marked urgent and then I have to click forget password and get the new password email to me and then I log in again and then my phone rings and then I forget what I was doing and I have to go through that all again and then I get into the email and it says thanks like it's a response to a long thread and that's all it was and so I think that there is a sense that sometimes this can feel like overkill like we are just slowing down and some of this stuff isn't necessary and we need to find that balance where what is safe enough and what are the threats and I think Scott can attest to this but the threats are constantly evolving and that's one of the problems is they're getting better and better at breaking into our systems and they're phishing and phishing means that they're like looking for private information and they're looking for people to basically just give it up or allow access into a network or a system and I think sending documents that are password protected is a great way to do that. Does every single email have to require a password to be read? Probably not but I think you got to ask yourself in every situation in which you're transmitting something over online what's the worst thing that could happen here and I think what we're hearing about in many contexts is the worst thing that can happen is really really bad. Yesterday Facebook went down for six hours and if they're vulnerable with like billions of dollars in network security then everyone is vulnerable and so we've got to be looking at this in a new way. It's kind of like when people first started wearing seatbelts it seemed like such a hassle like nothing's going to happen. I've driven this road like every day to work and then it just becomes habit right? Now you can't get into a car without putting on your seatbelt and that's the kind of thing that we need to look for here. Solutions that become second nature and result in a much safer and more secure work environment. That's great advice. Thank you so much Satish and I guess I'll move on here. Are there any tips and aside from what we have on the screen now, things that we should follow, establish protocols, talking to our IT department and any tools that you guys may have in your toolkit that could be useful for the legal community? I was thinking about this and I do think that I would say for tips for IT folks out there if there are on this call is like education. It's amazing to me how much opportunities for free and low-cost education there are now and I think that that like I mean and I haven't investigated as much but for staff as well if you're interested in these things they're you know avail yourself of that. I think that the more you understand it the better you're going to say for you're going to be for yourself and for your clients. I mean I'm sorry I just one last thing sorry on the I just wanted to suggest too like you know I think we hit it before but talking to your IT staff don't just go out and like do your thing and wait to be like wait for somebody to tell you you shouldn't do it and like this is not this is not the place to be doing that I'm sorry like there's a lot at stake for the you know our clients like there I mean a data breach could cause someone the could cause them to lose their job lose public housing protracted litigation you know to be outed publicly about their you know gender sexuality like there's innumerable of bad outcomes that our clients could suffer because you decide that you can do it faster and better and so please work with your IT department. Yes and we have in the chat what tools do you have in your toolkit for the less than techy folks who work in organizations without an IT person? Well we have a very large IT department because we are like a 1500 person organization in New York City but it never seems like we have enough people and people are always complaining about the lack of IT support so at a basic level we use all of the Microsoft tools and we use SharePoint and Office 365 and all of that happened right before the pandemic or maybe during the pandemic I can't remember anymore. We also have multi-factor authentication that they just rolled out like last week for our email on personal devices so what does that mean that means if you want to check your work email on your phone you have to confirm your identity in more than one way so you could get a text message you can get a code through an app you can get an email to another account that's also yours and I think this is a really simple way to make sure you confirm your identity and that no one else can break into your accounts. In terms of like if you don't have an IT department I think that could be a real liability for your organization if you're dealing with confidential information and clients so maybe you've got to figure out within your organization and maybe within the board or hire a consultant and figure out like do an assessment of your security risks groups like JustTech do this work I'm quite sure and there are others so you would really want to make sure that you're not just a sitting duck for some kind of breach and then tools that I learned about in talking with this team and I actually downloaded a VPN platform yesterday because I learned about the importance of having something that protects your access to public Wi-Fi and your own kind of internet provider from looking at what you're doing and what data you're sending and so a VPN kind of creates like a tunnel through which you can access the internet and protects you from all the threats that might exist so maybe your office already has an account for a VPN service and you just need the credentials maybe you already have hotspots that can be deployed and they're just sitting in a drawer somewhere and nobody knows about it and you just have to ask maybe there are devices that you can get that would allow you to do your work from home and you just need to talk to somebody and figure that out so I think the first thing is find out what's already available and find out how you should be working like Scott said don't wait until there's a breach because that's going to be really bad it could be bad for your clients and then figure out like what tools and what what gaps you may have and try to fill those gaps as efficiently as you can have another question in the chat um one tip we got from a state entity was not to respond to emergency emails by forwarding requested information ASAP but to confirm with an actual person by phone or virtually what do you guys think about that yeah I I didn't I don't see that one on my chat that's interesting but um oh it might have been a direct to me oh okay yeah I I no I've had this scenario actually where like one I responded by chat like Google chat to one of my colleagues who told me he was overseas and he needed me to send him some money urgently and so IG chatted him because I got an email and then he was like yes I'm really it's really me and I'm here you know and then I was like wait a minute let me actually send him a text and he was like no no you know so yeah I mean I tell actually in our trainings we tell staff is like if you know the person if you got a sketchy email from someone that you know pick up the phone and call them call their landline like talk to them on the phone yeah I mean yeah because I mean if they hack the accounts there's like innumerable different ways that they could try to scam you that's right and I think it really goes to some of these phishing emails that we see more and more of and a lot of small organizations almost saw that they were a small fish and that they would never be targeted with this kind of you know attacks and the reality is is that more and more our staff we are personally under attack right and and so I one advice that I can give and it's the way that I try to carry on when I do see suspicious emails is really just looking for misspellings looking for you know certain little cues within the actual email itself that make you suspicious about whether or not the person who you are accustomed to communicating with probably wouldn't communicate that way another tip is definitely not forwarding that email right you can actually you know put someone else at risk what we would tell staff at my former position was take a screenshot of it once you take a screenshot of it that's a different story is no longer a risk if you are questioning it it's probably best to just throw it out put it in the trash and do not open any attachments because this is how your information can become vulnerable there is another question in the chat do you have any security suggestions for organizations that use volunteers who do not have work associated emails can we require volunteers to use certain software etc should we oh I get I we actually have that this exact thing that we're doing a lot especially during because of the eviction work that we our organization had done and during the moratorium and and rental assistance a lot of organizations that we like our partner organizations in the community are very small and not necessarily like using a lot of personal emails and things and so we actually with SharePoint we were able to set up externally facing SharePoint sites that are walled off from our main client sites that they can log into with their personal email and but it also requires multi-factor authentication on their part so it we did have that minimum security requirement but like we knew there was no way we could force them to enroll their devices and go through all this and that would just be like slow things down way too much and we did get some pushback about that but then once people started using SharePoint online I mean that was the other thing is like some of them didn't have word on their devices but with with Office 365 online in the cloud it's just totally free you you can edit files there I mean the same thing with I think you know Google Gmail would work as well but unfortunately you know in Google Drive but unfortunately in that situation you have to have a Gmail account so there may be other options but that has really been a game changer for us to me I think that's a really good example of creating low barriers we don't want to discourage volunteers from joining us and helping us help clients and if we set up but you know something that's too onerous and too strict and too invasive we risk turning volunteers off and making it difficult for people to be engaged with the organization but at the same time we have to convince volunteers that this is important why are we doing this and I think there is a dearth of information from IT departments to the frontline staff about the why why is this important and I think some of us just think they're doing it because this is what they think but they don't know what it's like for us on the front lines or they're doing this because they like such and such company and they want our organization to buy their product or they're doing this because whatever right and I think we need our IT folks and others to talk and that's why we're having this event it's like we need to all talk and say why is this important what are the risks and what's the lowest kind of friction way to achieve all our goals right a related question on the chat should we require volunteers to use multi-factor authentication for logging into case management software we already spent lots of admin time resetting legal server passwords well I think so yeah I think multi-factor authentication absolutely if they're touching confidential information like I don't think that's you know I think they should I mean but I'm also a supporter of like self-service email or or password changing you know so like people should be able to forget their password set their own password encourage people to use password managers and rotate their passwords and and require multi-factor authentication absolutely I have another question here we have a single sign-on system with our case management software and email behind that wall with multi-factor authentication do you have concerns about using public Wi-Fi such as a hotel with that setup I mean I think there is I don't think that I think it was in the past vpns were like more essential because the traffic before we had encrypted traffic like SSL encryption for most websites almost all websites now that we interact with so the traffic is encrypted but I mean that said like if you're just doing your own thing and you're like browsing websites I think that's fine but if you're dealing with client data here it's as important you and the vpns are not hard to use so I think do it you know like it should be even though you're using single sign-on I mean there it actually is a known there is a known risk to even in that scenario to using a public Wi-Fi that's great thank you both if there are more questions please drop them in the chat do you guys have any additional advice around this topic um I know Scott touched on this very briefly but we have on the screen avoid shadow it what does that mean so yeah this is a term I learned recently in the last couple of years but um basically the shadow it is like when when you like in this scenario in our fact pattern you're saving files to your gmail your your like google drive maybe you set up your own dropbox with another organization where you're going to share files like with opposing you know or or not like a pro bono attorney or whatever it's like basically anything you're not telling your IT department about but where you're like doing work organizational work so that's kind of the idea behind shadow ID it's like we ideally and it kind of it goes along with this idea of like information governance like we want to know where our information is and we want to be able to and when if we know where it is then we have a better chance to be able to control it know when it's being accessed getting it back if there's a data breach just you know investigating problems with if you you know you might have the created the best system for yourself but if it's like one that your IT department doesn't know about and can't access and has no governance over then that's going it very likely is going to not end well unfortunately okay so we've talked a lot about risk we've talked a lot about tips and what we can do what what's this overlining i'm a little stressed out i feel like i don't have control over you know my tech setup i was confident before and now i'm questioning am i doing it the right way is there a silver lining behind this conversation i think and then scott obviously you can weigh in on this too if we do this right we open up the door to a new way of working we don't need to go to offices and sit at our desks and stare at a you know beige box all day long um we can work from anywhere we can really be free we can work like flexible hours we can take emails from like soccer practice or waiting for the dentist or you know at a guitar lesson or whatever you want to do like this can really open up you know a universe of possibilities for the way we work but on the other hand this could really backfire if we see like a series of breaches um somebody's in trouble um if we see a series of breaches then you know these freedoms that we've been accustomed to during the pandemic are going to be taken away like we are going to build a case against this new model of working and so if we all participate now we can build a safe way to work and really benefit from it in the future yeah absolutely i i agree and i i mean i think there's a lot of trepidation in our organization about the use of personal devices and i i think that some of that has gone away and some of it but you know certain we've had a couple of bad incidents with it too so it's like that's that's the other thing about being when you're using your personal device for work like be be you know conscientious about it don't try to be like downloading torrent movies and you know like you know don't just you know try to think about like what what could go wrong like okay you know what malicious software might accidentally get installed on my you know while i'm you know checking out you know whatever like application i think it looks good or whatever like and if i've got client if i've got access to client data on my computer if i've got like it in one drive and it's opened up and i accidentally share that what if you accidentally share that on a peer-to-peer network you know and you're connected to literally like your organization's SharePoint site i mean it's frightening like some of these things that's like that could go wrong so you know we all have a part to play in making for sure we can get to this future and and you know so and i and and it it's there's no there's just no easy answers so hope i'm not leaving you all this doesn't sound like a silver lining i'm sorry i'm but i think the silver lining is like yeah i think we can get to this place but like we it's still in process like we you know i think big encryption is a big going to be a big part of this where we can even if even if bad actors got these files like they couldn't do anything with them because they can't log in and they can't authenticate and encrypt and see that see them so like i i mean but this is going to take a lot more development of the technology microsoft is still working on it it's still buggy you know there's still got a lot of stuff in preview so it's like we're we're getting there you know but it's it's gonna still take a few more years have one well it looks like two questions that i'm going to try to address very quickly as we come up on the hour so what alternatives to having a text sent to your personal say uh cell phone for two-factor authentication can be used when the company does not provide phones or they're not available i mean i i'm thinking just for myself a couple of i want to say one or two years back i started to switch even my personal devices on to authenticator apps instead of receiving a text message to alter to authenticate myself i think it's so scary a couple of months ago t-mobile got hacked you know some of our clients might have gotten hacked and their information might be up there and up in the car um and now you know the fear is some people can take control of even our cell phone accounts and call and and act as if they are us with the information that they have obtained and get access to some of those codes that are sent to our phones and so i think that as scott and satish have mentioned we have to continue to read about educate ourselves around security and what are the the best steps i think authenticator apps could be something that you can talk to your it department about and whether that is suggestion or an alternative to getting text messages uh scott satish do you have anything to add with regard to that no i mean i i don't think there is anything else i would add other than um echoing that you know this is a new frontier and we have to be thinking about this stuff more than ever and it's going to really pave the road ahead and allow us to do a lot more allow us to help a lot more people i mean fundamentally we are here because we want to serve people um and help them with their legal needs and we're going to be able to do more of that if we do this all in the right way so you have any written best practices or models for a clean desk policy for remote workers that you can share or maybe quick tips maybe that that'll be a to-do for a toolkit i mean i we just finished just gonna say really quick quick plug at the end of the security series um what should be at the end of this year in december we will be um combining all of these recordings and um excuse me compiling best practices um like the one that was just asked for um so just stay tuned for that in the toolkit that'll be coming out um at the end of the year thank you leticia that's perfect and uh i have one more comment we recently implemented multi-factor authentication for some staff um they were using personal phones um so they're offering a phob device um that can be synced with specific user accounts do you all have any thoughts about that setup so yeah i mean i think that probably what you're talking about like is a ubt which is like usb security device which is basically like stores kind of like a long very very long unhackable password on the on the hardware device so you just you can use that as a means of multi-factor authentication and it is actually considered the most secure way to um use multi-factor in fact because it's not it doesn't come over any cell network it's like something you carry around and you hold in your hand and so and we because we use g-suite that we i've locked my account down they require two hardware keys in case you lose one to to enter into their uh i forget what they call but they're super security like unhackable account status or whatever so they it is a it's a great idea i also i wanted to say before about like i think using phone apps is like the way to go i mean if you've listened to any like no before no before we which we don't use but i listen to their your uh webinars all the time about you know is like you can you know unfortunately people's multi-factor is hacked like regularly through sms it's like it's becoming more as it becomes more and more common for people to be on multi-factor they're going to go after it with sms and so if you're using you know apps or ub keys you're going to be much safer thank you scott let's see i think i um says what we are using is different than a usb device it is a safe id oath compliant hardware token device yeah it sounds i mean it sounds like a similar you know uh type of yeah device yes thank you all for all the great questions and comments um we asked you all to participate in our poll and i'm so curious to see what we have all answered i did participate myself let me try do you think you can give us uh the results of our poll number one can you see them yeah okay yes thank you so much so to use a personal device for any work purposes and i think most of us do sometimes right we're all being honest here um we do have 28 percent that never uses a personal device and that's super commendable i applaud you all and 26 that use a personal device all the time so i think it's it's just very clear to us that use it sometimes or use personal device all the times to really consider best practices while using personal devices have you ever used a personal account for work purposes uh 69 say no and 31 say yes our next question do you ever use public wi-fi when working 78 percent of uh of our audience said no and only 22 percent said yes so you follow your organization's policy to securely share sensitive confidential information with clients and i think there's a winner here 76 uh percent said yes my organization does not have a sharing policy um or i do not know my organization share uh sharing policy so we had a few that fall into that population as well so for those that do not know of the data sharing on policy please go back to your organization to have those conversations with it they are the key members to you know give you insight on best practices um our last question when was the last time you attended a cyber security training and it looks like 60 percent have attended uh cyber security training within the last three to six months i think that's awesome um and definitely our recommendation uh here uh over a year ago at i don't know scott satisha if you have you know best practices i'd like to keep on the up and up with my cyber security personally but um i think the usual is once a year but more is never bad so it seems like we've been preaching to the choir today because many of the attendees here um the majority have been engaging in very very good practices um it's the challenge of of you know all of us to convey this to everyone else who didn't attend today um and probably it's a self-selected group right um the average person who works within our organizations isn't going to be necessarily interested in attending this but those of us who already know about it and are and are aware of its importance are here obviously so we need to spread this information and the urgency of this issue um throughout our organizations great and scott any last words before and if anyone else has any questions please please please share through chat um any last words around this topic uh no no thank you all for you know um listening to to us and like you know i you it sounds like you're our ambassadors and like in arming you with this you know these thoughts i hope you know of how we can you know move move better you know move better in the world and do our work and live our personal lives and get it done you know because i mean we got a lot of work to do i think we all know that definitely well thank you scott and satish for all of your amazing advice and tips and for taking the time to speak to us um and for all of our uh attendees thank you for attending uh best security practices for advocates working remotely i want to remind you to join us lsn tab uh october 19 there is a 3 p.m. session on security assessments for legal aid you can register at www.lsntab.org forward slash thanks you again you guys have a great day thank you