Det är bra att vara här med dig Peter. Thank you very much, it's great to be back in Finland.  Yes, yeah, cool. And I actually wanted to start out today with something that stuck with me from our prep call last week because I asked you how are you Peter and you said I'm living the dream so maybe we could start there with your dream actually. What is this dream that you're having and tell us a little bit about your ambition to build the world's greenest battery. So when when we started this, this, I whoops, I shouldn't call it a project anymore because it's a it's a much bigger thing than than a project. But we we basically saw that that Europe if Europe should achieve its Paris and really fulfill the requirements, basically reducing the carbon footprint with 80 percent over three decades. There is just a massive need to take oil out of of transportation to change the energy generation and all of this require energy storage and kind of having been at Tesla before being part of of developing the Gigafactory. I knew what would require it in order to scale. And this was was kind of the thesis that we looked at, you know, can we build large scale capacity in Europe in order to support this transformation? And the more we looked at it, the more we saw that specifically, there is two things. One is is that building batteries and energy storage is incredibly energy intensive to take from raw material to a finished battery. You basically consume almost a hundred times the amount of energy that you produce. So a hundred kilowatt hour to produce one one kilowatt hour. And that means that it becomes super, super important, not just that we build batteries for vehicles and for energy storage, but it becomes also super important that we do it in the right way, that we build it in grids where we have sustainable energy as a comparison. If you if you take the entire car industry, which is basically 90 million vehicles a year and you say, OK, all this industry is going to transform into electric vehicles and you do this based on batteries built in cold based grids, such as China and, you know, en number of East European countries, you will create the carbon footprint, building this battery, solving the oil problem that is the size of half Germans carbon footprint or the size of Spain's carbon footprint.  It's like not just building energy storage, but to drive this transition in a green way. So that became the big, big mission in, in, in, in the Norfolk start. And I guess that was also the reason for your choice to position this first gigafactory in the northern part of Sweden, where you actually have access to that kind of energy. Absolutely. I mean, we choose Skellefteå, where we building our first factory, and we're just basically a month away from, from starting production, where we have a huge surplus of hydropower. And it means we can get it green and we can get it continuously. But because that's also a challenge for industry is if you're dependent on solar and just wind, you will have intermittent supply, which means which doesn't work for industry. Ja, exactly. And another aspect of building a gigafactory like that, that is, of course, the people that you need. And how many people are you on board now on your team? We are roughly 2,200 or so. We're growing with about 100, 120 people per month. Wow, yeah, that's recruiting for you. Sorry. Yeah, that's recruiting for you. Absolut. Ja, vi har, du har part av, of building a company is also building an internal recruitment generator, så we have a team of 25 people who is just working on recruitment. I'm looking back at these five years and more than 2,000 people. What would you say have been the key challenges in terms of building a team this size? I mean, there is a number of different challenges in different steps. In the beginning, you know, one thing I brought with me from also from Tesla and working with Elon was, you know, if you want to build a world-class company, you can't just look at a local labor market. You really, really need to go after the best wherever in the world you will find them. If you find the best cell designers in Japan or Korea. Go for it. And if you find the best battery systems and data analysts in Silicon Valley, that's where you need to go. And when you're doing that as a startup, it's, you know, it has a number of different challenges because you don't have an organization to take care of this or, you know, you work permits. You need to help them with finding apartments and Stockholm is not an easy city. So you basically needed to over dimension this part in order to build a very attractive team from the start. Then you have the next challenge, which is, you know, up to 50 people. You can pretty much work as a group. You can solve all things pretty much directly and everybody becomes an individual contributor. But then when you get beyond 50 and you get to 100, you know, you need to start leading through leaders. And then when you get beyond 500, you need to have leaders that can lead through other leaders. And during this, this growth, there are certain people that grows with the task, but there is also certain people that just don't fit with being, you know, a strong individual contributor and then become, and this, you know, in the beginning, you're so tight, you work so hard together, so it becomes almost like emotional divorces when you have to, when you have to take these decisions during a growth pace. And we'll come back to the leadership part of this in a little while, but I also wanted to ask, as an impact investor myself, a very proud backer of NorthVolt, even though we're probably a rounding error on your cap table. But has impact made it more easy to recruit people to your team, would you say? Absolutely.  We see that when we're looking for people from all over the world that being part of this mission and kind of feeling very strongly is perhaps the most important part of attracting this talents over, you know, then other things also becomes important, like, you know, providing, you know, shareholding for all our employees, etc. But the mission is so powerful, but it also becomes super important that you, in all aspects living the mission, because your employees becomes your biggest critics. Yeah, yeah, that's great to have on board. And so this has really made you, made it able for you to attract people to join from all over the world to, to northern Sweden, basically. And you mentioned the diversity. You have how many nationalities again, like nine. We've surpassed 100 nationalities, I think a couple of months ago. And we were very, very proud of this. I mean, one, one interesting source of knowledge. It's kind of interesting in Sweden, for example, taking a PhD is, is not compared, for example, to the US or in Germany. It doesn't pay off that well. Exakt. And, and so many people, also Swedish people, don't go for, for the, for a PhD unless you're really, really want to become a professor. And so we've, and thereby there is, there's a lot of, of foreign students that join the Swedish PhD programs at KTH and Schalmers, etc. And they were really struggling. I mean, super competent people were really struggling to get, you know, good jobs in, in, in, in Swedish large corporations.  And, you know, it was, that was an opportunity. Yeah, yeah. And in addition to that, I guess you're then a very diverse company. Do you see any advantage of that kind of? Has that been important in recruiting on other aspects as well? I think, I think there is a lot of, lot of benefits in the sense, but, but, you know, diversity is also an investment long term. Because it means difference of thought. It means a bit of a longer process in order to align everybody. But it also means that there is a, you know, smaller risk that you will run off a cliff where everybody is just running the same direction. So, so that diversity is, is important. But what we do see is, is there is challenges, you know, when you are a startup, for example, you bring people from, from Asia that are used to very hierarchical structures. And then you give them a flat organization and, and you give them a lot of responsibility. And that needs retraining, reprogramming. And, and it takes, it takes a while. It's also, you know, when you're getting, because different cultures also have different approaches to problem solving. So when you have a multifaceted group that is, you know, going after a complex problem, you might have very different ways of approaching it. And, and so it becomes super, super important that you, you're, you're really working on bridging this and, and that you're starting to create your own very strong culture. This is, this is what leadership is at us. This is the way we approach, you know, problem solving. This is, this is the type of behaviors that we encourage. And speaking of culture there, because you mentioned previously that you also have a background from Tesla.  Would you mind describing the culture today?  And, and how important it is to walk the talk. I mean, you know, you could argue a lot about Elon's different ways, but, but you could never argue about his dedication to, to the mission. And, and, and that brought a lot of energy into, into, into the company. We really, really tried to embrace that with, with building the, the Norfolk's structure.  I worked with semiconductors. I worked with, with mobile phones. And in these companies, you know, when you can become a manager, director, vice president, you always work with these, these balance scorecards. You have like, you know, eight different than every month you look at it, it's like red, yellow, green. And, and then when I came to Tesla, it was like, okay, this, you know, this quarter, we have two objectives. This is our balance scorecard. And, and that's, you know, to take problem step by step and not trying to do everything in and balance the scorecard, but really focus is, is something that is, it's a little bit challenging, but it really makes a momentum in, in an organization. So we've really focused on reducing the objectives and the way that we work with kind of OQRs in, in, in our organization. Super. So really strong focus. That's an advice for, I guess, all the founders out there. And maybe if you were to share another advice on how to build a team like this, what would you share with people out there that are currently building their teams? I think one thing that is, is that I would, would very much share is obviously, you know, as, as a founder, you, you need to compliment yourself, you know, you need, you need to build a team that is complimentary, but that also means that you need to know what your weak sides are so that you can compliment, compliment these. The other one that, that I think is super important and that we focus a lot on, on now is, is, is kind of the multiplier theory that. You know, it's not just important for you as a leader to, to, to achieve your objectives, to, to, to meet, meet a performance target. But it's as important that you are a talent attractor. That people want to work with you and want to come. Because if, if you're not, we will not scale. And, and this is also when you're working with engineering organizations, these two are not always the same in the same person. And, and you, you need to be honest about that. And that's, that's a hard truth sometimes. Yeah. And I guess you, that's something you learn along, along the way. Like it is, it is. And that leads us into kind of your leadership style a little bit. And I guess that has also changed a lot during these years and as you scale the company. For sure.  You have much more kind of, you know, tomorrow we run out of funds.  And, and as you grow, as you grow bigger, you, you need to recognize that, that doing big changes needs a much more, much more communication. It needs bringing much more people on board understanding.  Yeah. And that, that requires some, some changes in the way that, that you lead. And also that you need to think a little bit more about how you communicate. I have taken it, I take it, taken an example. I mean, I was up in, in Skellefteå and every, every Wednesday. So also today I do a video streaming for all employees. And we were having this, this situation up in, in Skellefteå, where we kind of got the, at our big building site, we got the second wave of, of corona. And it was mainly driven by that a lot of, of our subcontractors were not vaccinated. And, and, you know, the first wave of corona was very disruptive for us. It was very difficult to, to run. So I went out in my, my, my, my, my stream and said, you know, we, we will give all our sub, subcontractors a certain time. Let's, I think it was like 10 days to get vaccinated, but, but after that we will not allow people that are not vaccinated on site. It's a matter of, of safety for, for, for everybody. And it took like, and this was an internal video streaming. It took like 15 minutes before we had Aftonbladet, Norran and other newspapers saying, you know, we heard you communicate this message. You, you know, are you now taking decisions over people's life? So, so, you know, these, these are realities that comes with, with a bigger company and, and also a lot of media focus. I can imagine, I can imagine.  How do you find or take rather the time to kind of recharge? I mean, a day like this, actually not booking too many meetings, but, but just being a day off, reflecting a bit is, is, I think it's, there is no way that you can run a marathon like this if you don't have a little bit of a switch off button. And, and I tried to do that, but it is hard. You know, it is also so that, that whenever there is a crisis, the organisation will always look at you, how you act in, in, in a crisis. And if you don't act with a sense of urgency, you can't expect the rest of the, the organisation. I can take another example. I am during the autumn, the school break in, in the autumn in, in Sweden, I, me and my, my kids together with my partner, we, we travelled to Uganda. And because she's running a charity there and we will, we're buying some land to build a school. And, and we were really off the grid in, in Uganda, so I, I didn't have access to internet and thereby, you know, I didn't have access to teams chats, etc. So I didn't, I couldn't see that there was a team chat around that we had, we actually had a fire in, in our plant in, in Västerås, where we have R&D.  And, and this was a fairly, you know, it's, it's a small thing. We, our employees took care of it. But part of the procedure is that they need to go to a health check afterwards because, you know, the, the fumes in a battery, specifically the electrolyte is a little bit, it could be dangerous. So they went on, on a health check, it took, took an hour and then they were back at, at, at, at work, but in media, this became, you know, free injured in, in a fire in Västerås. And I, I was down in Uganda and I started to get SMS from, from board members and, and investors asking me what about the injured people in, in Västerås. And I was totally, and then you get a buildup of, of anxiety. It was, it was a cool thing. But, but, you know, you can never be totally off grid. Exactly. Okay. So it will be some time until you go off grid next time. Exactly. Cool. I wanted to also, if we fast forward a little bit and talk about kind of future applications of the North Pole batteries, what are some of the applications that you are most excited about? I think what is interesting right now is, is, is that you're seeing everywhere where we have a combustion engine, people are thinking of, you know, how can we replace this with, with a battery? It's not just a car. And, you know, it's, it's, it's the diesel generators that we have everywhere on, on concerts, on construction sites, etc. So it's, it's super exciting to see how we reevaluate all these, these, this infrastructure. Then, you know, if you want to be a little bit more futuristic, but it's not that far away, then, you know, the way of, of using batteries for, for flying is, it's not that, that it's not that far away. We have today roughly an energy density in, in our high performing batteries that is around 700 watt hours per liter. Mm. When, and with, with that, if you build a plane, you can get roughly maybe four to five hundred kilometers on, on, on a flight. But the problem is, is also with, with, which is kind of the minimum for, for regional, regional flights, but, but you also have a, you also have a requirement that, you know, you should have 30 percent extra when you land in order so that you can hover around an airport or if, if there is a, is, is an issue, which means that that four to five hundred actually becomes, you know, 250, 300, and that's not, not sufficient. So you, you basically need to go towards 1200 watt hours per liter. We acquired a company in, in Silicon Valley in Berkeley, Kuberge earlier this year that is developing a, a next gen battery. It's a, it's a lithium metal instead of a traditional graphite anode. It's a lithium metal with, with a special type of, of electrolyte that actually brings cells up to, to a thousand watt hours and actually towards 12 and potentially 1400 watt hours. And, and I was out there when US opened up two weeks ago. I was out there with them and seeing their new facility, their building. They're a little bit there like three years where we, from, from where we were when we started to build our R&D.  If I take one example, Delta, for example, it's a, a Vermont that, that is focusing on, on cargo, flight cargo. It can lift 750 kg on, on one plane and, and DHL have done a big investment in them because they see that instead of having big airplanes that DHLs have today that goes through Memphis and these hubs, they will build in the future a mesh network. So small peer-to-peer jump that will suit e-trade much better, faster deliveries. It will start with a pilot, but you know, eventually it will be without pilots. And, and this is, you know, they will start certifying planes 2023. They might be up and running by 2025 and, and it's fairly big volumes. So it's, it's, it's, you know, five years away and, and that's nothing. So in five years we can travel here by electric aircrafts. I, I think Stockholm to Helsinki borderline five years, but for sure in 10 years. Amazing. Final question for you, Peter. Do you think Norfolk is at your last venture or is there more to come? Will you go into space like some other people?  But, but, but I do have one dream that I've been pretty outspoken with, and that is, is eventually I would like to be, also become a wine farmer. So that's, that might be my, my last venture, at least as I see it today. Sounds really nice. Thank you so much, Peter. Thank you. Thank you.


very popular song. Morning Sun and Memories. Now it gives me great pleasure to welcome these two gentlemen into the studio. The legendary Shunni Krampsey and Patsy Kavanaugh and these two guys are two of the finest songwriters that we are so lucky to have in not indeed and only our country music scene but in the music scene in Ireland and indeed further afield because their songs have been recorded by everyone from Daniel O'Donnell to Mick Flaven to Mike Denver and you name it these guys songs have been recorded and we're talking about huge hits and I suppose for me on a personal level it gives me great pleasure to welcome the two guys in because I would have grew up listening to some of their songs that they have written down through the years and it's just lovely to have the both of you in studio so you're very welcome Patsy and Shunni. David it's a real honor to be here and thanks for having us. Lovely to be on your show. Well we're delighted to have you both then and you know when you think about the songs that you guys have written down through the years you know you've homed it on EGALL the old schoolyard the hard times lovin' can bring and morning son of memories as we've just heard I wish you well and blooming over my world you know you have a serious serious catalog of songs there and Shunni I guess we will start with you you got an idea then that maybe it might be nice to go out and showcase these songs from a songwriter's perspective. Yeah the students myself and Patsy have been life-long friends and when we keep on touch and when Patsy writes something that got there sometimes we come in and we demo them and stuff like that we've been life-long friends and we have been doing this for a while every now and then we do a concert where it's exclusively songs that we write we do a sort of a two and a half hour show it's a very unique thing where people that come we don't get huge massive crowds but the people that come know exactly what they're coming to hear yeah and they hear the stories behind the songs of why we wrote the songs and you know how they all come but so it's very rewarding and it's something to do from a songwriter's point of view and as well as that we do find that the people who do come really enjoys our shows where we do this and we tell the story about the songs and we do exclusively all songs that we've written you know in a concert where people can sit and listen to the story and the lyrics and stuff. It's a very nice thing to be to be able to do and you know obviously a lot a lot of talent within the two of us to be able to do something like that because not many people can and you know Patti I was thinking about this earlier I was thinking about you know some of the the bands who I would have grew up listening to and started going to the dances to whenever I was younger maybe when I was about 13-14 and the likes of McFlaven for instance and when you tick like say three of his biggest hits Hard Times Love and Can Bring, Home to Donegal and the Old School Yard they've been written by either one of you at some point and you think about the likes of McFlaven and tick those songs away from him at the time that he was starting out maybe he mightn't have had the success that he was lucky enough to have of course he's incredibly talented but without the songs without a doubt but the truth of the matter is that they bring your songs to a much wider audience I think it's important to stress to a day that our shows our concert there's plenty of humor in it as well as the thoughtful songs you know we both would have a fairly what's the right word for it a dry sense of humor as you can see me and Patsy's a laugh a minute well we can be quite the role when we do it you know but it's the song some of our songs might you know they're fairly contemplative for whatever they're basically story songs I suppose so long but we tell plenty of stories as well to lighten the mood so yeah so it's something that is gonna be really really unique and it actually kicks off this Friday war where Patsy and Shinny ticked to the stage in the very famous McGrory's of Kildaf that's this Friday the 25th and then on Sunday on to the Austin Lock Alton and that is the 27th and 8 30 kickoff with only a tenor cover charge so a great night of music in in store for you there but Shinny I always was sort of curious about this and I never got the chance to ask you before of course you're out in the road with the bands the likes of the the Great Brian Call when did you start writing songs was that something that you know the music came first and your love for writing or when did you start writing your own songs well David the funny thing is I was writing songs from a very very age but music when I was starting out and I'm sure lots of people can see you're nearly ashamed to say you know we were going to dances and school wasn't very high on the agenda but we were chatting about who are the best track there would be a Dexter or a Massey or you know all the boys I ran about with and if you start to tell the boys I ran a bit with that you were interested in music they've been quite embarrassing you know the word is sort of but I was writing songs for a good while before I let anybody hear them you know and then I got drunk on a pub one night and I sang a song of four o'clock in the morning as you do and then they were out there that's how I got the songs out there and the first man to put me on the map was Mike Flavin when he recorded on the Traveling Night album hard times and love I can bring you know but it's difficult for anybody that's songwriting it's difficult to get your songs out there it's a lonely for all but you know but you have to keep plodding on and I remember sitting in here in this very studio with Paki Keeney years ago and I was making wee notes to see you know you know when you go on there doing the view yeah and I was writing down and it wrote down about 15 different artists that recorded me songs and you know you don't find it creeping up I'm sure Patsy you find the same you know and Shunny you you you must have been a lot more comfortable doing interviews now because I see no shade of paper sitting there the day with all your notes on it you keep me right but you know Patsy whenever you write a song I guess you look at the likes of Home to Donegal which there's not many people that don't know that song and it's so simplistic in its nature but whenever you were writing that did you ever envisage the heights that it would eventually reach no I did not it's funny Shunny mentioned the Mcflavin album there I think that's for Home to Donegal because it's first airing as well I had it recorded on a cassette myself but I think Mcflavin was the first one to cover it after that I'm sure it just took off yeah and even still I have 93 versions of it that's incredible and you know it's probably been recorded in a few different languages as well is it it's recorded in Danish and it's recorded in Dutch that's recorded in Irish that's amazing instrumental version and you know it just keeps it's great yeah there's open doors for me you know it's funny we were in England at the weekend and it's course it always be done ten times and all the shows Home to Donegal and there was young people who didn't know Patsy Kavanaugh was around they were singing away they didn't know when they were singing about the song and I said was able to tell them that it was written on the 20th of August 1988 there you go Patsy was reading it out there really made me wonder and I said that song was written on the 28th of August 1988 1988 yeah what a song it's been as well and you know the thing about it is there was a song that everybody can identify with you know you know people that are away from home and come on home for holidays you know I think that's the big point in it and and Shunni I suppose a lot of the songs that you guys have written as well have really stood the test of time and of course they're great songs but why do you think all these songs that you guys have written have really you know they're still as popular today you know if you're at a dance in hard times love and can bring comes on you know the floor fills up in morning sun and memories when you're at a concert it's just why do you think that these songs have stood the test of time as well as they have well I think songs you know a song that actually can touch on somebody's feelings or meaning you know what works its way into society sort of thing yeah and I know that morning sun and memories has actually written on two gravestones you know it's it's going to be round there for a while and around blue moons written on a gravestone and things so the the morph the way into society you know and become part of everyday life and it's a great honor for the legs of myself and Patsy you know and by the way I would like just to see when we're on here that congratulates Patsy and Daniel whose Daniel's new album has reached the British charts is number 10 Patsy is it how many years is that my 35 years or something yeah and of course the title track I wish you well is a song that Patsy wrote. It's funny it's something you know from the word go you were mentioned there about when did we start writing at all has it been an ambition to see one of your songs listed in the album and there it is now a title track of an album of probably the biggest star arguably that Ireland has ever produced so that's a great honor Patsy. They nearly left it too lit. Yeah listen lads the two shows are coming up this weekend and you know if you're a fan of music a fan of country music a fan of songs and stories and as Patsy quite rightly mentioned there'd be a lot of humor in there as well it kicks off this Friday night in Margaris of Kildaf and then on Sunday they have to take Saturday off these two men now to recover from. Yeah we'll count the money on Saturday. And you'll still do something else with the other 23 and a half hours. There are also there are more shows coming up just after that and as usual I have forgotten to take the dates with me. I think it's the 11th and the 3rd. December. Are you confident of that? There were in the beehive you'd see where they are. Yeah well one is in the beehive in Ardra and the second is in Fanavolti Hall in Fanad so if you are in those localities you'll be fit to check those dates out but the two dates this weekend are Margaris and Kildaf on Friday night at 30 kickoff and on Sunday. Actually Margaris is at 9 o'clock kickoff. 9 o'clock kickoff. And the Gortha Hark one is at 30 kickoff and they say that you can pay at the door like we put out some tickets for some people want to take us but certainly come along and you can pay at the door and you'll be more than welcome we would love to see.


Namaskar. Shiva here. I'm happy and excited to come to you today with my Monday motivation. Yesterday we all lit lamps at 9 p.m. for 9 minutes and stood in our balconies with our prayers to God, to bless us and to help us sail through this present crisis. Thank you. Thank you for your participation and for your contribution to this great effort. He will save us and we shall overcome. Let me ask you a question. Do you love? Yes. Do you love? Of course you do. After all, to love is human. It's quite natural for all of us to love. We show our love towards our parents, our children, our relatives, friends, teachers and others. But the name that love changes depending on the person we love. The love that we show towards our teachers, our gurus, is respectful love. Love with respect, Guru Prema. The one that we show towards our friends is called friendship, Sneham. And the love expressed by the parents towards the children is called affection, Vatsalyam. And that love shown towards God is called bhakti. Look at a cow. It draws its calf closer and licks its body with all the affection of a mother towards her child. It does not mind the dirt that exists on the body of the calf. Its love for its child is such that the cow does not even notice the impurities on its calf. It is because of its vatsalyam towards its child. Similar is the God's love towards his devotees who love him. Lord Krishna loved his parents Eshodama and Nanda Baba, his brother Balarama and his sister Subhadra. And all of his relatives, his citizens and the gopis of Gokul. He loved his friends as we could notice it from the example or from his friendship with Sudama. His love for his devotees is that of a parent towards a child, the Vatsalyam Prema. Take the case of Bhakta Pralada who opposed his father and rejected his orders and had his bhakti in the Lord. And Krishna loved him and protected him. Take the case of Pandavas. Were they perfect? No, they weren't. Didn't they have any deficiencies? They had. Didn't they commit any errors? They blotted their personalities? They did. But Krishna loved them and gave them a sense of security always. They helped them in the final battle of Kurukshetra to regain their kingdom. But why? Just because of their love for him and their bhakti towards him. In the entire Mahabharata, we could notice that all those who had bhakti towards Krishna experienced his Vatsalyam Prema. Irrespective of their age, whether it is Bhishma or Arjuna or Kuntidevi or Draupadeva, they all experienced his Vatsalyam Prema. That's why he is called Bhakta Vatsalaha. He shows his Vatsalyam Prema towards his devotees who have bhakti for him and who love him. It is essential for you, for me and for everyone to have bhakti towards God. It is that bhakti, that respect, that consciousness and that love for God which will stand in good state at all times and help us overcome the obstacles in life. Praise the God. Life is busy. We were all busy till recently. We were in a rush as if the earth would stop spinning if we did not do what we did. But what happened now? The earth is revolving on its own. We thought ourselves being busy. Let us take the opportunity now. Let us introspect. Let us find time at least now to take the opportunity to remember him, to sing his melodies, to dance in his tunes and to feel the bliss of taking his name and saying it louder. Praise the Lord. Praise Krishna. Praise Krishna. Praise Krishna. Praise Krishna. Praise Hare. Hare Rama. Hare Rama. Rama Rama. Hare Hare. Hare Krishna. Having bhakti towards God is loving God. That bhakti, that love for the God will in turn earn the love of God, the Vatsalyam Prema. We may have our own weaknesses but with bhakti this will soon be overcome. The blemishes will vanish. The purity will clean the impurities and the darkness will be replaced with a shining glow. God is very kind. He loves those who love him. He is Bhakti Vatsalaha. Take time to love him. He loves you. He takes good care of you. You are awesome. See you again next Monday with another motivation. Thank you.


ThinkTec Hawaii, civil engagement lives here. Welcome back to the Cyber Underground. I'm Dave the Cyber Guy. This is the Cyber Underground. I'm your host, Dave Stevens. I teach with the University of Hawaii, Kapi'olani Community College. I teach ethical hacking and IT. And I'm here with our guest from the UH System, University of Hawaii System. That's the 10 campuses of the Hawaii System. That's a public university. And this is JT Ash, HIPAA Compliance Officer. How are you? You got caught up with the question. I know. Yeah. Sorry about that. Well, welcome. And let's start talking about who you are and then what you do.  How'd you get educated? How'd you get into this business? Okay. Because this is kind of a weird business. Crazy business. Right? It's a crazy business. So where'd you start out? I always like to say that I'm in chapter four of my professional career once again. I did 20 years US Navy, retired. I retired as a senior chief IT specialist. So I started on the good side of the world. So I did IT and networking and help desk and all the rest of that stuff. You applied technology. Yes. All of that good old stuff. Retired. And then the old normal thing was to basically go into the federal government. So I did nine years in the federal government, different places, such as Veterans Administration, Army Intelligence. And I actually worked at a data center over at Pearl Harbor. So that was fun. I got a phone call one day where I had a financial institution downtown said they needed a chief information security officer. I said, okay, sure. Why not? What year was that? 2014 was actually when they called and it was one of those things where I went. It was supposed to be an interview, but I think three hours later after his wife interrupted us after the phone call going, you're going to come home for dinner type of thing. I said, well, you know, I'm comfortable where I'm at. It's been fun. Let's go have a beer one time. I was a 49er fan, so I was very happy to know the guy. And then he made me an offer that I couldn't refuse at the time.  Yeah. Then I decided to open up my own consulting business. And then I got another phone call, Garrett Yoshimi, the CIO over at the University of Hawaii, bought me a cup of coffee, which is my total weakness. You buy me a cup of coffee. Crypto night. Yeah. I usually give you anything you want. He goes, hey, we're going to start this HIPAA program. I need somebody to start it, run it, and figure it out. So let's talk about, OK, first of all, I'll get a backtrack. OK.  Right, OK. Yes. East Bay. Oh. A's Raiders Warriors. I like the A's. Bitter rivalry, right? Yes. Yeah. So the audience knows there's a chance that people break into fighting over those two teams, right? Very, very much so. That's a bitter rivalry. Just to stay off topic and all that stuff, how do you feel about the Raiders leaving and going to Vegas? You know, good for them. Good for them. So let's go to a city that really wants them and is going to pay for a great stadium. I think they're going to put that thing up in like five years, and I love staying in Vegas. Yeah. I go there every year for Def Con and Black Cats. So awesome. Awesome. I like it. What do you think about them going down there? I was a really big Raiders fan back in the early 80s when there was Kenny Stabler, Dave Kasper, and all the rest of those guys. They broke my heart when they went to LA and after that I ran across the bay to the 49ers when they had Jim Plunkett and O.J. Simpson before the days of Joe Montana. You just went with the action one. Hey, once again, when the 49ers went to my hometown of Santa Clara, California and put their business there and now there's stadiums there, I've been to Levi's Stadium, the 49ers were where my heart is. Sounds like you fell in love. I did. Joe Montana is the best. Hopefully it's going to be beautiful in Vegas. Yeah. It's going to be a great game after we do the conference or something and we'll hit it up and we'll tell our audience, hey, the Raiders are cool here. Of course. It looks like it's going to be a beautiful stadium. Yeah, let's get back on topic. So Garrett Ushimi hires you for the UH system to do HIPAA compliance. Let's talk about HIPAA, Health Insurance Portability and Accountability Act. When did it come about? Why is it important? Okay. How does it do anything with cyber? Well, actually, it came back in the mid-1990s, HIPAA came around and it was for HIPAA Insurance Portability. So a lot of people think that it's about health information and health information. It kind of morphed because the security rule for the electronic portion of it didn't come around until 2005. And breach notification, I think it was about a couple of years later, I think 2013. So once again, it was always about the privacy rule from like 1996 or 2007 to 2005. It was about protecting the rights of the patients to control their information. And if they were going to go from job to job, they were able to take their health insurance for them. So once again, a big thing about HIPAA is about insurance and insurance companies. Okay. So how does that have to do with cyber? Okay. So there's three rules when you're talking about HIPAA. There's a privacy rule. There's a security rule and there's a breach notification. Security rule is when you have electronics. And everything nowadays, you don't have paper. You have electronics. So if you're sitting there and looking about cyber, there's a certain what we call admin technical and physical safeguards that you have to do in the security rule. And once again, with the push for electronic health care and health care records, that seems to have morphed into a more important rule when it comes to HIPAA. When I read the HIPAA rules, I think it's, you know, my read is it's almost all access control. I would say yes, because once again, if you're talking about a privacy, because the privacy rule is actually about access, consent, authorization. And once again, if you're looking at that, I could understand you don't want people to see your particular health care record or anything like that. But it also has to do with access. Once again, on the black market, a social security number is about worth a dime. A credit card is worth about 25 cents. An electronic health record can be up between $300 and $1,000 per record. So two real reasons for that. One, heaven forbid you have something that's really embarrassing in your past or whatever it may be.   So once again, the black market for people taking care of benefits and getting benefits and getting medicines and whatever it may be. So consider yourself if you're sitting there and having to fight a terminal illness or whatever it may be and then actually have to fight an insurance company to get the coverage you need. I mean to me that is just overwhelming to sit there and see when you're at your weakest, I'm taking advantage of you. That's terrible. Yeah. So you came aboard as a HIPAA compliance officer for the University of Hawaii. Now let's see how HIPAA relates to the University of Hawaii. This is where, okay, HIPAA, it pertains to two basic people. You've got to either be a covered entity, covered component underneath our system or a business associate. So there's two ways you can have to get the HIPAA obligations, one by policy and one by contract. By policy, you have to be one of three things. You have to be a health care provider, a doctor, a dentist, a nurse, a chiropractor or whatever it may be, but you also have to charge. So once again, if you are a doctor or a dentist and you're not charging through HIPAA, then once again you'd still have health information, but you wouldn't be covered underneath HIPAA. Same thing for a health plan and a health clearinghouse. Well that's interesting now. So that sparks my mind. Free clinics? Yes. Don't fall under HIPAA? No, they don't. So that's scary. People go to free clinics and they do want confidential information, but they're not secured through HIPAA. But I hear you, but I understand we also have regulations here at the University of Hawaii, even though you have state privacy laws that will actually cover that. So once again, regardless of if you're covered with HIPAA, there are still data protection requirements from the University of Hawaii to protect health information that might not be covered underneath HIPAA. But statewide you're saying there's also protection, so other than the University of Hawaii, a free clinic would still be required to keep those records private. Very much so. Well thank God. 47N. There might be people that don't seek health treatment because they think their records might be shared. There's a big concern now I've read, and I'm not going to tell you where, because we read stuff that not a lot of other people read, but there's a concern out there that the health information can be used by businesses to exclude you from things, charge you more for things or to sell you things. So for instance, if you worked at, I don't know, a construction company or a bank, and the health insurance provider got a hold of all those records for all your employees while you're negotiating your medical rates, they can say, well, look, I got not only do I have all your health records, but I also have Amazon shopping records that indicates that 25% of your employees that shop on Amazon buy plus-sized clothing.  We're not going to sell you diabetes medication. Well, I hear what you're saying, but the HIPAA privacy rule does prevent you from sharing it for certain purposes, and I think that would be actually one of those purposes that they would either have to have your authorization or consent to do. So once again, just like if you're sitting there and having a fit bit or whatever, maybe if you're sitting there and getting a free fit bit to provide people your medical information, you have to sit there and do the cost-benefit analysis. If this is going to make me healthy, I'm willing to give them my medical information. Now, they can share it for research purposes, but they have to anonymize the data. Is that right? There are certain different ways that you can do it. Anonymizing, or we call it de-identifying information, which is basically, we have 18 personal identifiers that would you use in HIPAA. Oh, you know exactly how many there are. I know they are, and once again, I won't sit there. And bore you with the numbers, but once again, there's two ways to actually de-identify information and to make that available for research. But understand, people can use medical information for research if you give them consent to do it. This is basically if you de-identify information, that's basically like say if you're going to do a research with about a million patients. It might not be who of you to sit there and go and get permission from a million people. So you actually de-identify the information where you don't have to get authorization or consent to actually get the information. But there's still enough information in there to have a good population for a decent study. Of course. But no problem to identify with. Actually, I'm in favor of that because most of the research that I see, just reading, you know, just health news, I usually drill down to see what the study was like and the populations of the studies are beneath 10,000 subjects always. And I don't think that's a huge population. That's enough to justify further research, maybe, from a statistical standpoint. But some of these research projects were done with 150 to 2,500 people. That's nothing. Nothing. And so it's good to hear that we can get sample populations of one or two million people and drill down to gender, race, and other different factors without fishing out that person. Yes. And 18 different things. Can you give us an example of the name? I think email is actually one of them. Oh yeah, that would be identifiable. The vehicle ID number is one of them. Well, sure, you could cross-reference. Yes. Yeah. So that is actually one of them. I think if you have a URL to a homepage or something like that, I think that's another one of them. But name, address, date of birth, all of those particular things. Yeah. So if somebody's health profile was identifiable like in a study, but they left in the state, would that be a risk? Because that could help with the research, right? That could help with the research in a study. I think anything below this state is actually unidentifiable. But once again, you have to look at your population. If you only have one under five-foot Tongan, then once again, you could easily figure out what it was. Yes. Well, once again, I'm trying to give you an example. Right, right. I would hope that someday we'd have a way to de-anonymize the data and de-identify people so that we could study cities. For instance, the population in and around Three Mile Island would be one or in and around Baton Rouge or anywhere in Louisiana that was hit by the hurricane or Houston. How about in California when they were sitting there and doing the things with the PG&E? That would be great. Thankfully, they got a water sample from the property, though, and that's what did in PG&E. Hopefully, that's not still happening, but something tells me we're still going to deal with that in the future. There's just money talks, right? Yes, very much so. Money removes morals, unfortunately. So let's talk about, good. That's a great thing to talk about, money ethics HIPAA. Connect the dots for us in the academic world and what you deal with. The wonderful thing about HIPAA at the University of Hawaii is what is called a hybrid entity, which means that we have the College of Education, the College of Engineering. They don't have to comply to HIPAA because, once again, they don't have to deal with health information. So we actually have designated entities that are actually HIPAA-covered in that have to comply with them. We currently have about 10 of them. So once again, not everybody in the university, a couple of people in college, there are certain people over there. Oh, we have a nursing program. You have a nursing program and they might have health information, but they're not charging people for it and putting in insurance claims so they're not covered underneath HIPAA. That's not HIPAA. Yes. Okay, let's talk more about that. We're going to take a break and pick some bills. We'll be right back. Till then, stay safe. Hello, I'm Yukari Kunisue. I'm your host of New Japanese Language Show on Think Tech Hawaii, called Konnichiwa Hawaii, broadcasting live every other Monday at 2 p.m. Please join us where we discuss important and useful information for the Japanese language community in Hawaii. The show will be all in Japanese. Hope you can join us every other Monday at 2 p.m. Aloha. I'm Jay Fidel, Think Tech. Think Tech loves energy. I'm the host of Mina, Marco and Me, which is Mina Morita, former chair of the PUC, former legislator and energy dynamics, a consulting organization in energy. Marco Mangostorf is the CEO of Provision Solar in Hilo. Every two weeks, we talk about energy, everything about energy. Come around and watch us. We're on at noon on Mondays every two weeks on Think Tech. Aloha. Welcome back to the second half of the show. This is the Cyber Underground. I'm your host, Dave the Cyber Guy. And my guest is JT Ash, HIPAA Compliance Officer from the UH System or University of Hawaii System. And we were talking about Kinectodots, money, HIPAA Compliance, let's add management to this. Yes. And so you were talking about all the entities that are in your hybrid organization. Certain ones do not fall under HIPAA Compliance, right? So let's talk about the ones that do and how do you handle that? We actually have a program, we actually have HIPAA coordinators that we work with. We work with them to make sure that they have all of the compliance issues in place. We've actually gone out and bought them templates to work on their policies and procedures and try to provide as much support that we've had. We visited every nook and cranny so far in the first year I've been here. And once again, when we go out to the different clinics, the first day we don't even talk about HIPAA, we don't even talk about IT, we talk about business processes. We talk about when a new student comes in to get checked out by you, what information do you take from, how do you take the information? Where do you put it? What do you process it? Where do you store it? Well that's critical. In any security organization, it's not the encryption, it's not the VPN. It's the process by where you employed it, which might have cracks in the armor, right? You wanna look for those kinks in the armor. So the first thing you're gonna do is, how do you do business? So that's a good thing, you're going out there, just show me how you do things, right? Very much so. And once again, it's actually had a good effect on, we sit there and we look at business processes and we actually go, hmm, maybe we should do this a little better, faster or whatever it may be. So we've actually had some second order of effects out of that that have been pretty good. Well that's a great secondary effect, right? That's a side effect of more efficiency, good on ya. But that's one of the things where you're sitting there and HIPAA is an IT and business, they all have to work together. Once again, we're all here because we're trying to educate a population and do that. So once again, that's the business and the mission that we have here. So that's a tough one, isn't it? Trying to get those siloed organizations to work across boundaries and to play as a team. Did you have any difficulties with that? It's trying to have a conversation with those entities and have them understand that we're here to help them, whether it's IT, whether it's cyber. So once again, IT and cyber risk is business risk and it's all about the business and how they are supposed to do work. So once again, the IT will hopefully make their lives a little easier. Once again, cyber will make that a little more secure. So once again, you're working all together as a team to where business have different objectives in cyber.  There's a balance. Yes, yeah, there's gotta be a balance. But it's all about the risk, right? What's the acceptable level of risk? You've got laws to comply with and then after that, you've got other risks that you have to mitigate and then just stuff happens all the time. You have to adjust your scope based on to the current affairs, current political climate, what kind of a target your institution is, right? That's one of the things I tell my students frequently is when you're building a security plan, be sure you're aware of current events. You are in current events, whether you like it or not, and the bigger your organization is, the bigger footprint you have in current events. If you're a bank, North Korea is a concern, right? Because every time we put another sanction on them, they need money, what do they do?  I think it was more than that. Was it really? Yeah, I think it was about 270 million. Oh my. Before someone said, hmm, that's odd. Yep, yep, yep, I understand you. So you gotta be aware, so as an academic institution, you have a risk model based on threat modeling that you did and what's our risk analysis, right? But when you put all these pieces together, that's how you sell it, isn't it? We've got a certain amount of risk, we have to mitigate it, but we can't slow you down. Very, very much so, and the big thing that I always like to stress is, we have to get beyond fear, uncertainty, and doubt. Can you? I believe you can, I definitely believe you can. That's a noble goal. Well, let me ask you a question, have you heard of this before?  You just gotta be faster than the guy next to you, right?  And so once again, I'm gonna be fearful and all that stuff. If I only have to be faster than the slowest person with me, that's under the impression that I think we're gonna be all running in the same direction, or the bear might not be hungry or whatever it be. There's only so many things there, there's so many uncertainties and doubts that you have. But if you get beyond that and actually can provide the business folks with a business related money, dollars and cents, risk assessment, a quantitative risk assessment, I think you can get past the fear uncertainty doubt. And I think the business people are ready to have that conversation. So let's talk about quantitative versus qualitative data. And there's audience members here in the cheap seats. So let's explain, quantitative is numbers. Solid numbers that you gather, this is actual data that you can analyze, you can crunch the numbers, you can come up with statistical models, right? Qualitative, a little bit fuzzier. It's opinions, it's the feelings of the crowd. But you have to combine the two somehow into a reasonable model to assess the current situation, right? So when you go out and you say you need quantitative data, what kind of numbers do you gather and do you gather qualitative data as well? I think there's always gonna be qualitative involved, but what I can tell you this, and that's probably another show that we need to have about quantitative risk assessments. What I can tell you is that if you're not, if you're gonna go into a boardroom, if you're gonna go into the Board of Regents or whatever it may be, if you don't talk to them about dollars and cents, if you start talking to them about threats and vulnerabilities, they're not gonna hear you. If you sit there and you tell them, hey, this particular application supports this particular business process, this process brings us $250,000 a month. If we actually put in this control, which is about $20,000 a year, we will reduce the risk 78%. If you can sit there and have that conversation with them, fear, uncertainty, and doubt, go out the window. They stick to the numbers. Yes, stick to the numbers, because once again, when you walk into that boardroom, when you walk into those people who actually control the risk, control, own the risk, you usually can get what you need. You use a lot of pictures and graphics because I know the board members I talk to, three seconds in there, they're like, squirrel. Yes, definitely. I've had those people, but once again, when you start saying, hey, you have a million dollar exposure by having this out here, ears perk up. Once again, when you sit there and I've had it both ways, when you go, okay, we just got a finding on an audit and the audit committee is really upset about it, but when you actually sit there and break it down to numbers, this is only actually a $20,000 exposure. Oh, we have a cybersecurity insurance plan worth $50,000. You good with accepting it kind of thing? It's been counting at that point. It's always been counting. Everything's about being counting, you know that. Well, let's talk about, this has been your first year, right?  When you go out, say next year, you're gonna have to audit yourself. You're gonna have to perform an organizational analysis to see, did I do my job? Are there gaps? How do I fill my gaps? And when I fill my gaps, when am I gonna pay for that filling of the gap, right? Is it in this month's budget or is it next quarter? And when can I buy that firewall that I've needed for so long? First of all, how do you do the audit? Actually, the Health and Human Services and the Office of Civil Rights actually provides you an audit. So once again, you can actually read to the test type of thing. Get out of here. That's my tax dollars at work. Hey, it actually works really, really good. But if you- Good job, Hawaii. Good job. If you sit there and you think about it, we're actually going through an annual report for the first time and we're gonna actually provide this to the council of chancellors. And we're gonna sit there and have a conversation with different stuff like UH policy, where we're exactly at with the UH policy, how we are on our self-assessments and where we think we are in that particular process, how our corrective action plans are, how many incidents or breaches that we have. So once again, having that conversation to make the upper management aware that this is actually an issue here at the university. Now, you've brought up some interesting statistics that you've brought to that conversation, right? How many breaches we've had and so forth. So you do need to talk with IT and the cyber guys to find out what their IDS, IPS logs say. And you need some log analysis. You need some data analytics and all that doesn't come cheap. All that doesn't come cheap and actually that's one of the most expensive things that people have a hard time with because it is so expensive. But once again, just like the NIST cyber framework, identify, protect, detect, respond, recover, it's kind of like a rolling framework. First you have to identify, then you have to protect the protections and if you don't have any detections, once again, having zero breaches for a year doesn't mean that you're actually doing your job. If you're not looking. I've actually had conversations with health and human service auditors and they love the conversation. Oh, we haven't had a breach in three years. And their first question is, how do you know? How do you know? And the look on most people's faces. Oh, I don't know. Good question. And then we started having this conversation with, has anybody ever emailed a record to the wrong person? Has anybody faxed a record to the wrong person? Has anybody, can you show me your firewall logs to see if you had any intrusions that you're concerned about? Now this happens in software development all the time because I was in software development for 20 years. And even in the most secure situations, there's always someone that says, from another vendor, hey, via email, I need some sample data. Sure, here's a spreadsheet of some sample and it's real people and real information. And we just sent it open over the email and then you have to have the conversation and you know, it's not encrypted, it's not secured, it's over, you know, port, you know, whatever you're sending over through the firewall, but it's open. And we're not encrypting or securing that email. SMTP, port 25 probably. Is that the one that's encrypted? SMTP? Is it? Oh, okay, sure. I don't know my ports and protocols, you just caught me. Yeah, sorry. I need to go back and review, it's been a while. Shoot, yeah. And so, but that actually goes into the framework that you're talking about. Once again, and once you have the detection, breaches are gonna happen and once again, you have to understand and you have to accept that particular fact that somebody's gonna, you know, I believe that everybody goes to work every day wanting to do the right things. Sure. But as long as you have people and as long as you have processes and mistakes are gonna happen.  Yeah, you just have to have processes in place such as, okay, if I do this, what is my response? Who do I need to contact? What do I need to do? Is it like above 500 records? Cause if it's above 500 records then you're a hip-hop person. Oh, it sounds like you have to make this whole plan. There is an incident response plan and that's actually one of the safeguards that you have to put in place. But once again, if you have the detection in place and you have the response in place and you have your disaster recovery, you can actually... Follow the book. Yes. What a novel concept. This has been a great episode. Thanks for coming. We're out of time and sir, I hope to see you back. Let's have those episodes you say we need. I would love to have episodes about quantitative risk assessments. It's one of my favorite topics. How about incident response? That's another one I have out there. That'd be fantastic. Okay, thank you. You're a great guest. Thanks everybody for joining us. This is Cyber Underground. We'll be back next week with another great episode. Until then, stay safe.