For the time to join us, securing digital networks is one of the most important challenges all businesses face. Today's expert connect, educating for cyber mindfulness, building a community of cyber allies we hope will provide a practical approach to solving one aspect of good cyber security for any organization. And that is teaching users safe computing habits. Before we begin, a few housekeeping chores. We will try to leave 15 minutes at the end of this session for Q and A. If you have questions for our presenters, you will find a button at the bottom of your screen marked Q and A. Please post your questions there. When we're ready for your question, we will call on you. If we don't have a chance to get to your question, we will email your response at the end of this webinar. One other point too, we are recording this expert connect. It will be available on the CGE YouTube channel by end of the day tomorrow. Now to the reason we're here. We are fortunate and wanna thank the researchers and practitioners from the University of Dayton Center for Cybersecurity and Data Intelligence for sharing their strategies, tactics, and the lessons they learned developing and implementing a cyber mindfulness campaign. Universities have long been among the most vulnerable and frequent targets for cyber intrusions. They are, in a sense, the canaries and the coalmine for the latest cyber security threats. And after all, most of their customers, or students, are on the cutting edge of technology, often checking out the latest apps, tech products, and websites with hardly a thought to security. No wonder the school came up with a strategy for turning its users from security risks to allies. I'm gonna turn over the mic to Thomas Steele, Associate Provost and CIO of the University of Dayton, who will introduce the rest of the presenters and get on with explaining the cyber mindfulness program. Thank you. Great, thanks Ira, and welcome everyone. We're really thrilled to be here today. I wanna express a special thanks to CGE for inviting us to share our work today. We're gonna be sharing with you our model for developing cybersecurity awareness. We think it might be helpful as you think about ways that your organization might implement awareness training. And so what we're gonna do is, first I'm gonna start off and introduce a few of our folks here. As I said, I'm Tom Schill, I'm the Associate Provost at the University of Dayton and Chief Information Officer. With us today also is Dr. James Robinson, a professor of communication and our resident social scientist that's helped us work through a lot of the behavior issues that we are trying to grapple with. And then also with us is Kim Condi, she's our IT coordinator for communications. And Elizabeth Timmons, who serves as our web services manager. And of course, they are the co-directors of this project. So they have a very special role in helping us understand some of the tactics that we'll look at today. Not with us, but a key part of our team is Dean Halter. And Dean is our IT risk management officer and played a huge role in helping us deal with a lot of logistics around that. As we start into the next slide, what we thought we would do is start with a quick poll. And what we're sharing here is the SANS Institute Security Awareness Maturity Model, fancy words for where does your organization stand in terms of its readiness for cyber awareness training and education. And so we're gonna bring up a poll and we're gonna ask you to kind of place on that, on the poll, you know, respond, where do you see your organizational landing? This will really help us as we go through our conversation today to explain that. So we're gonna run that poll, go ahead and pick a point. I just said, just kind of a quick kind of explanation there. Obviously not, not existed means that you're not doing much at all with the, with a program at all. Compliance focuses are for those organizations that are looking at the kinds of audit requirements. Perhaps you do once a year training and you track that in kind of an ad hoc fashion. The third area would be if you're doing a much more intense promoting awareness and behavior change. And that model, of course, begins to deal with that engagement around interesting communication practices, ongoing activities, those kinds of things. And of course, if you're in the next area where you're doing long-term sustainment and culture change, that would be where you really begin to look at a role where you have strong leadership support. You're doing an ongoing engagement in very regular ways. And then finally, the metrics framework. And if anybody is in this category, you can join us up here and help us give this presentation because the metrics framework is one where you're not only using robust metrics as part of the capturing of what's happening, but you're applying those in a continuous improvement model. And there are not many organizations that have achieved that level of sophistication, but you might be among one of them. So select one of those and we will be able to get a sense and we'll share that poll back to you in just a moment. You know, one of the interesting things for us is that as we look at the kind of SANS Institute maturity model, we believe that we kind of land in that long-term sustainment category, but we also know that we have some gaps there. Like for example, we haven't quite refined our onboarding for our new users yet in a way that is systematic and sustainable. So we are still dealing with some of our gaps. So I don't know if we have those results up, but... And there we are. So this is interesting. So we have about 30% of our audience out there in the non-existing category, 15% of compliance focused, 25% are in that promoting awareness and behavior change and 35% are fitting into that long-term sustainment. So this is a great mix of folks out there and we're gonna look forward to then sharing some of the practices that we do. So thanks, Toby, for that. We can take that poll down and we'll move on to our next slide. What we're gonna do today is we're gonna give you a little bit of an insight into where we started on this and then how the research that we've looked at in the social science arena has helped guide some of the work that we've done and ultimately how that drove us in the development of our cyber-mindfulness model. And then we're gonna talk a bit about how various tactics such as fish training is being used to help us develop the awareness and sustainable practices out there. And of course, the one thing that many organizations are very concerned about is how do you measure the results of what you're doing? And finally, we're gonna share a bit about the lessons that we've learned. So as we start through this, we'll begin just at the very beginning. And in about 2015, the University of Dayton began looking at the possibility of moving towards a much more intense cybersecurity model. And that model was gonna include the implementation of two-factor authentication on most of our systems. And as we began thinking about that, the one concern that emerged for us is that our user community may very quickly assume that with the implementation of two-factor authentication, we will begin to have folks think that that's great, all security's taken care of. I don't have to worry about this anymore and they can move on. And as we began talking that through, we realized that before we go to two-factor authentication, we really needed to do something that would engage our community in much more thoughtful cybersecurity behaviors. And so we decided to build out a year what we called our year of computer awareness or a year of safe computing. And that project led us into the development of the model that we're gonna share today. One of the things that we realized as we went into this is that we had a great deal of folks on our staff who are very traditional in the way they came at, cybersecurity awareness and training. For the most part, those folks were kind of used to doing scattershot kind of approaches to cyber training and awareness. We tended to do what many IT organizations do and that's to kind of issue requirements or mandates and rules and not to really think much about how that engagement might work. And so our beginning stages there began to say, okay, what can we think about doing to change that piece of it? On the other side, with our faculty, staff and students, what we realized that most of them were relatively uninformed or misinformed about the real threats that were out there. We were at a point where we didn't pay a lot of attention to telling people about what's happening or what they might do about it. And so we began thinking that how do we transition from an organization of employees that may not be very aware of cybersecurity and know little or nothing about what they can do about it into an organization that was much more responsive and active in that area. So with that in mind, we kind of moved towards this idea of realizing that there's a group of folks within our organization that fit into this category of cyber carelessness or cyber careless. And that's the folks who kind of thought, IT is in charge of security. I don't have to worry about this or I'm much too small an organization or nobody really cares about my stuff. So there's no real need for me to worry about these kinds of problems. And that was a group that we thought we really needed to begin addressing in some meaningful ways. But on the other side of this is this other group of folks that we discovered, which are what we call our cyber cynics or our cyber fatigued group. And these are the folks that are paying a lot of attention to the media stories that are kind of told as horror stories about what's wrong with cybersecurity and how you really can't stop the bad guys. And so this group of folks feel that there's nothing they can really do to secure their data or their technology. And that's certainly that if anybody wants my stuff there's nothing I can do to stop that. And we felt that it was very important that we really balance those two perspective and moving towards a model that would help us, really address the risks that are there. So what we wanted to do is make sure that as we began our awareness training that we were sensitive to this balance that we didn't ignore those on the carelessness side and we didn't create a group of folks that felt that cybersecurity was so dangerously powerful in terms of what the bad guys could do that there's little that they could do to impact that. And so what we began doing is we began looking at social science and in that terms we wanted to know what evidence-based research can we identify that can tell us what's most effective in the ways that we would impact the behaviors of our users. And so with that we will have some comments from Danny Robinson and he's gonna talk a bit about what we've done in that arena. Thanks Tom. Today I'm gonna talk a little bit about social influence theory and how social influence theory applies to cybersecurity. There are a number of relevant social science theories that I would like to discuss but I'm gonna cover them pretty quickly because of our limited amount of time together. But if you are interested in more detail on a specific theory or all of the theories if you just let us know we'll forward you a handout that has more detailed information and it also has a reasonable bibliography at the back so you can do some deep diving into this on your own time. What these theories tell us is that communication is a complex process. For communication to occur it requires that the individuals are exposed to the message, that they attend to the message, that they comprehend or understand the message and of course that they retain the message. If any of those events don't occur there's little chance of a message being effective. Now if you keep that in mind and you think about designing a message campaign you begin to see why message campaigns are so difficult. They're difficult in large part because so many things have to happen in a particular order for there to be success. These theories also tell us that a critical element of message effectiveness has to do with the relationship between the communicants. And so when we talk about the relationship between communicants one of the things that we wanna make sure that we don't do is that we think about it in terms of everybody has to be best friends or something like that. Rather what has to happen is that people have to understand the nature of their relationship with the other person so that they can have a better understanding of how that message, whatever message that they send, how that message will be understood by their target audience. In fact the importance of this contextualization and relationship is so important that it's pretty safe to say that if you change the nature of the relationship and that's just a perceptual variable. If people perceive their relationship to be in a particular way it actually changes, it actually changes the meaning of the message. Obviously here in this theory helps us understand some important implications to the idea of staff in user relationships. So we'll talk more about that and we'll also talk about the development of a sense of agency throughout this presentation. Finally, people oftentimes think that we process information in a very, very careful way. We like to think where most social science theories predicated on the assumption that people are rational and while people are indeed at times rational there are other times when they're not rational and when they're not behaving in a particularly rational way what they do is they rely on peripheral cues. So they use things like the credibility of the speaker or the attractiveness of a speaker and they use those heuristics to decide whether they agree or they disagree with the message. And so one of our goals in this campaign is is to help people move from that peripheral kind of processing, oh I have an email, oh it says do something, I click on the link to get this out of my end basket, lo and behold I've made a tragic mistake into processing email messages like that in a careful or scrutinized those messages more carefully and so they start looking for things like is there anybody making a request of me here to perform some behavior? And if they are then I need to as a matter of practice I need to double down my efforts at being mindful. The basis of many, many, many of the theories of campaigns and health information campaigns and frankly any kind of campaign comes from this idea of the health belief model. In the 1950s the health belief model was developed to explain how public health officials could get people to engage in healthy behaviors. Things like getting people to get an X-ray or get a vaccination. Now the government was offering these programs at this time and for free and they couldn't get, they were getting very, very low turn on people actually taking advantage of these opportunities. And so these researchers came up with this model and what they found out was, was that if you want to get people to enact in a healthy behavior then one of the critical elements, the first critical element is, is that you have to make the people feel susceptible to the health risk. In addition, they also have to believe and you have to be able to demonstrate in your message strategy that the consequences are severe or that they're significant enough to merit the person's actual behavior. Get them off the side, so to speak. Third, we need to, we need in our campaigns and our message campaigns, we need to make sure that we offer people solutions that they believe will be effective. So it's critical that we can demonstrate the effectiveness of our solutions if we're gonna try to get people to adopt them. And then last but not least, and this is really important, something that we typically, one of the weaker areas in information campaigns and training is the development of that sense of efficacy. And of course by efficacy, what we mean is, is that people feel like they can successfully enact the behaviors that you're trying to promote. So if it's a fishing, an anti-fishing campaign people need to feel like they can identify fishing messages when they see them and they know appropriate behaviors to avoid those, to avoid those problems. So you can see then that the basic message strategy is kind of a rewards cost ratio examination where people need to see that the potential problems that are out there are more costly than the solutions that we offer them to avoid those problems, okay? Now a couple more things that almost sound like they're outside the campaign but they really, really strengthen the campaign and that is that we have to develop within our message strategy, within our training we have to develop reminders and cues that'll activate thoughts about cybersecurity when the people are not engaged in training. We've all been parts of training campaigns where we do something at the beginning of the year and then we probably forget about it and avoid thinking about it until the next time we have to go through that training. And so campaigns that are designed to promote behaviors that are, we could call them chronic to stay with our health belief kind of orientation things that people have to be aware of all the time it's critical that we offer them opportunities to be reminded of that on a regular basis. Finally, in terms of the health belief model one of the things that the health belief model has taught us that's really, really important is that people are not contrary to popular belief people are not particularly concerned about their health until they don't have it. You would think that everybody will tell you oh, I'm very, very concerned about my health you don't have anything if you don't have your health but the truth of the matter is is that until people don't have it they kind of take it for granted. So you have to ask yourself well why in the world would we be talking about health campaigns when we're supposed to be talking about cybersecurity? And the answer is, is because we found essentially the same thing holds true with cybersecurity safety behaviors people don't value cybersecurity very much until they lose it. So our training efforts in our campaign one of the things that we try to do then is we try to demonstrate susceptibility to attack. So we put this into action in a variety of ways one of the things that we did was we provide campus fishing exercises through a company called Know Before and what that allows people to do is it allows them to actually have the experience of being fished if they in fact fall for a fish. In addition to this, we also have newsletters that reinforce this notion of susceptibility. In those newsletters we talk about how often breaches happen, their famous breaches that have happened around the world and in a sense we provide people with that again that susceptibility information but in our newsletters we also provide people with the information about the effectiveness of that strategy by putting in things about here's an example of a person who didn't fall for a fishing exploit on our campus. So it's important that people have that experience and that they have it in under circumstances where they don't feel like that they're gonna be punished or that the consequences are gonna be punitive. We try to think of these fishing exercises like any other kind of exercise. It's important that we understand that this is something that we do to increase and improve our strength or our skills and so when we fail we try to use that failure as a way to strengthen us in the future. One of the things that we have found has been really important to communicate to people is the fact that everybody falls for fishing campaigns if the message is good enough. If a message resonates people will click or people will open files or people will provide information. That's just the nature of human behavior. You're never gonna get away with that 100% but the good news is that we can still dramatically reduce it and by providing people with not only the skills and the information that they need but the practice that they need then ideally what happens then is it becomes a more common topic of conversation on campus. People begin to generalize those principles and skills into their everyday lives and then it makes them less susceptible to new fishing or new kinds of exploits that they might be susceptible to at some point in the future that maybe we've never had an opportunity to even train them up on. So we talk about severity. We talk about susceptibility and I guess when we talk about severity we try to promote the idea that there are personal consequences to these behaviors but there's also organizational consequences and there's even a work group or more local group kinds of consequences to these problems. And so by doing that by making people feel that they're part of the organization and that they're actually the first line of defense for our networks but by trying to do that and promoting that sense of agency we have found that people feel a lot more responsibility not just to be careful with their own behavior but they feel the need and they want to remind or warn other people if they've fallen for mistakes. So we get stories all the time about people who say I fell for this or I got an email that looks like a fishing exploit and they'll crank out an email to 10 or 12 with their colleagues say hey be careful this is kind of going on. And so this is the kind of influence that is kind of hard for organizations to target sometime but it's clear evidence that we are improving people's awareness of cybersecurity on campus. It's critical and in our newsletters we do this too that we demonstrate that our solutions are effective. So we talked about that a little bit already. So what we try to do is we try to provide a few or a variety of tips and some of which that are relatively easy for the end user to an actor to engage in. And so we do that for obvious reasons so that we can have success but we also do it because when people have some experience say for example in these fishing campaigns and they gain some success oh I identified a fishing exploit then what happens is that it increases their sense of personal efficacy. And so one of the things that we know about changing people's behavior is that not only do they have to believe that the solutions or the changes that they're considering are gonna be effective but they also have to believe that they will be able to perform those behaviors effectively. And that's again that's one of those, that's one of those byproducts of a body of literature that's been done on fear appeals where we find that when we scare people or try to scare people straight or try to scare people into making sure that they don't make some kind of a mistake that what happens is that if we really, really, really truly scare them what ends up happening is as they end up feeling like there's nothing that I can do this and so they just ignore it and they try not to think about it. But when they feel efficacious, when they feel like they can do something about this and when they feel like the solution that we're offering them is something that can help them avoid this then they're more likely to enact the behaviors that we're trying to promote. Perhaps one of the most important things that we do is that we provide those cues for our end users to make sure that the computer security and cyber mindfulness is always at the front of their mind as much as possible. And we do this in a variety of way and Kim's gonna talk about more about that in a few minutes. But one of the things that we've done is we try to brand and use colors and logos and those kinds of heuristics so that people when they see, we hope that when they see an orange pylon that they think about cyber security because we used orange as one of the colors in our cyber mindfulness campaign. But you have to be careful with these strategies because anytime you try to use logos and branding and those kinds of priming tricks getting that to the front of people mind you have to be careful because those cues can lose their effectiveness over time. And so once again, it comes back to that development of a sense of relationship and that development of a sense of agency between the end users and the IT department and the organization because the same messages that can be viewed the exact same message that can be viewed as nagging by if one person does it can be viewed as somebody trying to provide me with service or help or they can even view it as contextualized caring. And so if you can get your end users to that stage where they think that the people on IT actually care about them and are trying to help them and not just trying to tell them what they're doing is wrong then I think that what you'll see is you'll see an increase in awareness. You'll see an increase in discussions about cyber security at your place of business and you'll see that people take these skills and they take them home with them and they find that they improve their personal security as well. Okay, so the last thing that I wanna talk about as a kind of summary is this idea that in general what we know from social science research is that the knowledge of the risk, a sense of efficacy and frequent cues in constructing an awareness program can help you be more effective in changing attitudes and behaviors. Particularly when those messages come from somebody that we have a positive professional relationship with and we feel like we're in a partnership to help protect everyone else's data as well as our own. So to further discuss the cyber mindfulness model, I'm gonna turn this back over to Tom Skill. Yeah, thanks, Danny. So we saw here that evidence-based social science research drove us to think differently about the ways that we train and educate for cyber security. And part of this model begins in an area that is very, very frequently used by pretty much anybody doing something in cyber security and that's the awareness stage of cyber education. And at this stage, what we're looking at is the awareness that our users have a sense of the personal and institutional risks. They're learning about the threats that are there and they're continuing to learn about them. The way that we categorize this or the way that we would capture a success in this stage is that if our users are saying, hey, I know that cyber security threats are real, persistent and dangerous. And so with that, that's a pretty standard piece. Here's where things kind of change a bit for us. So typically in those awareness programs, we jump right from awareness into the assumed stage where people will move to action. And at the action stage, you're looking at, are they actually able to enact behaviors? Are they looking at those threats and are they taking preventive actions to that? And here at that stage, people would say, hey, I will take actions to reduce risks in my organization and I have practiced them. That's what we all want to land. That's the goal there. But the struggle that we realized in this particular model, it was missing a very important middle stage. And that's the stage that Danny talked a bit about is this agency approach where people are really developing this attitude of personal responsibility and accepting that responsibility and seeing it as shared among the community that they're members with. And so success at this stage would have our users saying, hey, I believe these risks are important and meaningful and I can do something about that. So creating a sense of agency in your user community is critical to achieving sustained attention to cybersecurity. And that's what brings us into this next stage of saying, okay, so if cyber mindfulness is about awareness, agency and action, so how does this model fit in here? And this is where we see our back to our, what we call our engagement fulcrum, where we're saying that we've got to make sure that we're paying attention to the way we engage with our user community so that we're moving them from cyber carelessness to a midpoint and from cyber fatigue to a midpoint. And of course that is cyber mindfulness. So in ways of achieving this kind of outcome, Kim's gonna walk us through the tactics that will help you establish cyber mindfulness in your community. Thanks, Tom. Sure. Having identified cyber mindfulness as that quality we wanted to encourage within our user community, we wanted to build an awareness campaign that would put that social science theory into action to motivate that kind of change. And we approached this project, those communicators rather than IT technicians. We wanted to build an information security awareness program rather than kind of a traditional information security training program per se. So we started by considering the facets that most communicated communications professionals are gonna consider when they're planning a campaign like this. We're gonna spend a whole lot of time on the nuts and bolts of our planning, but just to give you an idea of how we approached this. We took some time thinking about our audience. So what did they already know about the topic? You know, as Tom mentioned earlier, we suspected this was probably all over the board. And we wanted to know too what their current attitudes were. Were they intimidated? Were they disinterested? Were they confused? So we conducted a survey at the outset and we found out that a good portion of our respondents felt that cyber security was definitely IT's job and it wasn't something they should have to deal with themselves and they didn't really have a role to play, which told us that we definitely had some room to improve with this awareness campaign. And we also thought about the messages we need to reiterate throughout the campaign to make our community more likely to think and act more cyber-mindfully. So particularly messages that concentrated on agency and efficacy. And then we came back to those messages kind of over and over and over again in the hopes that they'd really start to permeate our campus culture. For message delivery, we're thinking here about both tone and the communication channels we're using. So very intentionally we took a tone that was very casual and friendly in the language we use. So we didn't intimidate our less technical colleagues or worse bore them because we need their attention. So we tried to infuse some humor and keep things light and interesting throughout. And of course, as we know, people consume information in different ways. So we wanted to use a variety of channels to get this information out as well. Our monthly e-newsletter was kind of the primary vehicle, but we also used some face-to-face outreach and monthly fishing exercises that Danny mentioned and that we'll talk about more in a bit. And we used some giveaways. So for instance, we had pens, mugs and clips and all these kind of tangible cues. That would again, like Danny mentioned, try to remind people in a real physical way to think about safe computing. And as you can see, we use a nice bright orange. So these would be unavoidable. They would have to see these. And at the outside of this also, we worried about what kind of measurements we would do at the end and Elizabeth will talk about how we kind of measured whether this was working or not. So how did this end up being different from a kind of traditional information security training approach? You know, as I mentioned, those considerations that we just talked about are pretty standard for communication planning, but we found that this did lead us to a different kind of approach than if we'd done a compliance focus during annual training kind of model. So first, we were really intentional about inviting interaction with our campus audience. We wanted to, in our newsletters, for instance, offer opportunities for them to interact with us. So we offered to send them swag if they were applied with input or answers to a question. And a lot of these questions we'd even asked weren't related to cybersecurity, per se. So for instance, we asked them in one newsletter to send us something that was the same cyber mindful orange as the swag we sent out. And we got these kind of responses back. That data security poster you can see there at right, one of our community members actually created that. She said she spent the time cutting up all that confetti. She said it took her forever. And the bottom, if you can't read it, it says no personal or identifying information was harmed in the creation of this photograph. So you can tell people kind of enjoyed this. That car was some guy's wife's car he said that he sent in. So again, if these didn't teach people about safe computing, but they were an incentive to open and read their emails because they might find something kind of random and fun in there. And that's worked really well for us. We also offered kind of face to face opportunities. We did a secure disposal event for old equipment. We did lunchtime information sessions, those kinds of things. And also, as I mentioned earlier, we took a tone that was different from our other IT communications that we'd sent out in the past. So instead of being kind of preachy or technical, we looked for ways to put a little energy and life into our messaging because we knew that even if all the facts were there, if it was boring, no one's gonna pay attention to it. And attention is really what we were looking for. So for an example, this is just the header to one of our newsletters. You'll see that this monthly topic, Home Safe Home, is gonna focus on digital assistant devices. And we also included some enticements to engage in that cyber mindful summer camp that had a little section where they had a chance to respond to something. And then we would update on the campus fish training and that fish commission section. That was short for fishing commissioners. That was our personification of the mysterious IT staffer who ran the monthly training exercises, kind of like the banker and dealer no deal that you see up there in the, up in the heavens during that game show. So we also had Elizabeth was able to design kind of a custom image for each month's theme. And we pepper in some comics or some memes along the way to keep things interesting. So again, the goal was to kind of keep this approachable and interesting. To help build our community's confidence about their own ability to actually take the right actions to protect themselves. We provided these chances for practice through our monthly fishing exercises. And with any other skill, like any other skill we have to learn from a book or a class until we actually put it into practice, we don't really absorb that. So this was a really good hands-on way to do that. And we'd hear back again from many folks about how they caught this one or they clicked on that one. So they seem to kind of enjoy these as a chance to show off their skills. Here you'll see kind of an example of one of the landing pages they'd hit. They clicked on a message. It would give them a couple of reminders about what they could look for in the future if they received another suspicious looking message. And as I showed you earlier, we did have a batch of these low cost swag items that we could use as incentives for interaction. But we've also been really deliberate about responding to reports of potential fishing messages or questions with sincere appreciation. So for instance, during our monthly fishing exercises, all of us on the safe computing team were bound to get many emails just like this where they'd forward us something and say, hey, found this. Is this something I should worry about? I just want to let you know this, but hit my inbox and either go to our help desk or to all of us individually. And our appreciative responses to these reports really are sincere. We know that if a live fishing exploit hits our campus, these are the kinds of early reports from our most alert users that are going to be the early warning system we need to take action quickly. So we want our community to know that we recognize that they're taking time out of their day to pay attention and reach out to us to protect the whole campus. And that's a great service to the organization. And while annual compliance-based information security training certainly has a role to play in a lot of organizations, we decided early on that that's not where we wanted to start this conversation with our campus community. As Tom mentioned, we hadn't done any kind of intentional training on this topic. So we didn't want to start it with this kind of one and done approach. And we didn't think that was going to move the needle on attitude and behavior change if we had our users do kind of one training exercise and then didn't say anything about it till the next year. So we committed to a steady stream of information doled out over the course of an entire year. You'll see here, this is just kind of the way we charted out that first year's worth of information. We borrowed a lot of resources and ideas from organizations like Stop Think Connect and the Sands Institute and Stay Safe Online. They've got a treasure trove of great stuff you can borrow from. And the whole fourth quarter of our campaign though focused around the two factor authentication implementation that we were getting ready for at the time. And of course, at the end of the year, we realized that if we wanted to build on that momentum and culture change that we'd started, we were going to have to continue this. So it couldn't be even a one year and done program. It was going to be an ongoing thing. And finally, one last way we thought this was different from kind of a traditional approach was that we worked with our campus IT staff really deliberately to make sure that whenever a user reached out to ask one of these questions or check about a suspicious email that they'd receive a welcoming helpful response. And we cannot emphasize this point enough.  And if we really want to activate our community as first alert allies when that zero day exploit hits, they've got to feel comfortable coming to us. And this can be hard some days, particularly when you're busy or you know that the monthly phishing exercise just went out and you're bound to get a whole bunch of emails that day or the next few days. But we see this investment of time by our IT staff as an integral part of building those relationships with our community that are going to pay off of a social engineering attack really hits our campus. So in a nutshell, it really boils down to this. We try to give our community permission not to be the experts. Our message consistently throughout this campaign has been that everyone has a role to play in keeping our campus data and systems safe, but that role doesn't require having lots of technical know-how or knowing all the answers. We just want them to reach out to us as something seems strange and trust that their IT team will help them figure out what to do from there. And we think that that's a lot more manageable for our non-technical users especially because we're sending a reasonable expectation for how they can help to keep the campus secure that reinforces that sense of agency. It's something that's really doable to them. They can just say, well, I don't know what to do about this, but I know I can raise the alarm about it. And that, we think, makes them much more likely to engage. So important part of running this campaign is making sure that you can measure the hope for change. You want to keep those measurements so that you can justify the effort to your leadership and also so that you can learn what works and what doesn't work for your ongoing efforts. So how do you know something is working? How do you know what, if someone doesn't click a link, if they are behaving cybermindfully, how do you measure that? So it can be tricky, but there are indicators that are measurable. There are things you can track, things that will demonstrate change. And so I just want to quickly talk about some of those. An obvious one is the phishing statistics. I do want to say a little bit about how we ran our phishing campaign. As Kim already mentioned and Danny mentioned, we presented this as an exercise. And I just want to point out that this was a no shame, no singling out anyone, except for the very first test that we did as a benchmark. We always told people that we were going to do this monthly and we would report back to them how that progress was going. This shows you very briefly over time that your results are not going to be a study decline. Our certainly weren't. What we found was that it really depended on the nature of the fish exercise itself. So I want to show you just some of the kinds of fish we ran. We did phishing with inline links. And if you look at the bolded boxes, you see that we did one where it was an Amazon order or a FedEx package delivery and people were asked to click a link to track their order. But over time, so we ran this three times, we did see a decrease in the click rates responding to that Amazon order. And we also saw declines in other kinds of phishing with inline links. We did test that included an attachment. You can see an example of one of the tests we ran with a blue cross donation where we told people they had thank you for their donation. Please click the receipt. This would require them to open the attachment even enable macros. And we did have people go that far and do it. But over time again, by running those kinds of tests again, we got to see a decrease. We also ran a fish that would ask for login credentials. So open a doc and it would require your Google credentials to view that doc. So with comparative phishing exercise over time, we can gather statistics that show our messaging was having the desired impact. But other ways you can measure your success, we really relied on anecdotal evidence. This is a legitimate way of measuring effectiveness. And so we would hear stories. Tom would be out in meetings across campus and administrators, staff leadership would tell him stories about fish they got and they were so proud because they hadn't clicked the link. Even a single anecdote of success can be really powerful to share with your community or with your leadership as a demonstration of your awareness campaign taking hold. Proactive reporting is also another thing you can track. So when you get reports to your help desk or you're hearing reports of people saying, I saw a fish and I started alerting other people in my office about it. You can track that sort of reporting as another measurable indicator that the awareness campaign is effective. Also from the beginning, we decided to track that one-on-one engagement that we were really focusing on. So discreet interactions with people. If we sent them email, if we sent them swag, if they attended an event, we kept track of every single one of those people. So that we knew over time how many people we were directly impacting. Also, you can take a look at your help desk tickets or lack thereof as an indicator, maybe of a reduction in malware compromises or other reports of issues. And then finally and importantly, survey. So at the beginning we did a survey and a lot of it was focused on trying to get a sense of where our audience was with their attitudes and their sense of agency. And I do just wanna show you some of the things we asked in that survey as maybe a way to help you think about how do you survey for attitude? And so we asked people to agree or disagree with some claims. For example, everyone has a responsibility to protect their computer from hackers and to ensure that stored info is secure. Do you agree? Do you disagree? Another type of attitude question. If hackers wanna break into a computer system, there's little I can do to stop them. And we certainly had strong agreement coming from a part of our audience on that. Computer security is really a technology issue that should be handled by IT. Again, that was a question that we saw a lot more agreement with them than we wanted to. And we knew that that meant we needed to address that. And finally, I am confident that I would recognize a suspicious email message. Again, what is their knowledge? What is their confidence? What is their attitude? And so over time, we're hoping to move the needle on those attitudes and sense of agency. And so we did a follow-up survey after a year so that we could measure the change in attitude and agency. And so now I'm gonna turn it over to Tom and he's gonna talk about our lessons learned. Great, thanks Elizabeth. So you're getting a sense for some of the tactical practices and the deep evidence-based research that we've been driving a lot of our work around. One of the things that we wanted to spend a little bit of time on is talk a little about some of the lessons that we learned. And there's several. I mean, one of the advantages I'll start off with that's not on the list is that as a university campus community, we have the great challenge of having a much more open and risk-prone environment where people are doing lots of things. And that gave us some struggles. But on the other hand, we also had the opportunity to connect with our academic colleagues like we did with Danny Robinson from the Department of Communication where we were able to apply a lot of that research. So the partnering in there is something that, in organizations like higher ed, I think that that is one lesson that we learned that made this project a much more engaging and fun project for the team of folks that we did over a long bit of time. So that's a good side of the lesson there. Some of the challenges I think that you'll see out there, though, is that one thing you have to understand is that there's a very, very significant time and talent commitment that you have to make to this. This is not something that you can simply do as a one and done kind of effort. In fact, the Sons Institute reports that they see a minimum of an FPE, that full-time equivalent, of being more than just one person's effort on an ongoing basis. The other piece that we believe is the core to the success of what we were doing is the commitment level that we were able to get from our campus leadership. And I think the important piece here is that with this campaign, no one was exempt from being engaged in it. That means that the fishes went to everybody, including presidents and provosts and IT staff. And that leadership within the campus community supported us doing those kinds of things and in reaching out to the community and making this a serious endeavor for our part. But I think the primary piece that I think we wanna have you walk away with in terms of some of the lessons learned there is the importance of the relationship. I think that what we did is that we understood that this is not a campaign that comes from some anonymous unknown place. It's not the IT department that's doing this. It is our organization, it is our people by name building these closer, more significant relationships with our campus community. And one of the consequences to that is that you have a much higher rate of what we would call false positives. But in many cases, I call that an engagement opportunity, is that you have folks contacting you on a regular basis, wanting to know is this real or should I be worried about this? And what we discovered there is that we needed to spend a lot of time working with our staff to make sure that they understand the importance of preserving and building that relationship. We don't wanna walk away from any of those of those opportunities to link there. So relationships really are really one of the most important pieces that we wanna do there. I think that as we look a little bit further down the road and we're gonna jump into another poll in a second. But as we look down the road, we know that we have to work on building soft skills and our IT staffs around this. This is something that many organizations would wanna think about doing. I think the other part too is that we have to realize that as an organization ourselves, thinking about cybersecurity, that we have to develop a much, a maturing attitude towards that, much like we saw in that SONS maturity scale that we've shared earlier on. So what we have is I'm gonna jump because we have another quick poll that we wanted to share with our group out there. And this is where we wanted to kind of test the waters in terms of what are you hearing from us in terms of the biggest challenges that you feel you face in building out your security awareness program? You know, is it in the management support area? Is it in the resources area? Is it in the staff skill sets? Perhaps organizational culture is part of it that you have folks that are resistant to training and education in these areas. Or is it the fact that you may be looking at some real challenges there around employee engagement? And I think that on this poll, you can click more than one item if you feel that you have several of those that are hitting you at this point. And we're gonna just give you a second there to do that. And while we're doing that, I'm gonna look to Ira to share with us if he has any questions you might want to kick back to us to deal with. And then we can share the results of this poll in just a couple seconds here. Sure, Tom, thanks for a great presentation. It's very interesting. I do have a couple of questions. And I also wanna remind people that please, if you have questions, enter in the Q&A section you'll find at the bottom of your screen. So one thing I'm curious about, obviously this is an investment in money and time. Why did you decide or how did the university come to the decision that you wanted to invest in educating your music community as opposed to buying more armaments to protect against cyber intrusion, building up bigger firewalls, virus protection? Yeah, great question. And so I'd say that it's both and. I mean, we do spend quite a bit of money on technology to secure both the perimeter and the interior. But what we've realized over a long period of time is that no amount of technology is gonna effectively reduce our risk if we have users that aren't being thoughtful in what they're doing. And the university was really thoughtful about this. And we were lucky because we have a few board members that have a great deal of knowledge in this area. And the support we got in pushing this effort forward came not just from our senior leadership on campus but even from our board. And they began kind of discussing with us ways that we could enhance this. And so building out the smart community strategies around cyber-mindfulness was something that was mapped as a dual track of let's make sure we're giving sufficient technology strength to our infrastructure. But at the same time, there are so many things that the technology appliances can't protect you against that we really had to spend time thinking about how can we help our staff become smart and engage in this process? And I don't know if my other folks have any other comments to add on there, but do we wanna share that poll? All right, great. So here we're seeing that, and this is not a surprise, is that we're all over the map on this, but the resources is always a huge issue. And of course, culture is the other one. And so many times we think about the fact that culture is king. And therefore, if you don't have the culture with you, you're not gonna be successful. And of course, in many cases, one of the things that I shared with our leadership when we talk about the investments that we've had to make in cyber-awareness is that I said to them, if we ever had a breach, you would wish you could throw that amount of money at it to solve a breach problem. And so the context there is that the amount of money you're investing upfront in awareness is substantially less than you would spend if you had to actually address a true data breach of some type. And the consequence of a data breach, of course, is that you will lose things in terms of reputation and a data breach that you will never recapture with no matter how much money you spend on that. So I think that a lot of our organizations begin to understand that allocating those resources in those areas are important. And so I'd encourage folks out there to perhaps try to characterize the fact that, while this doesn't guarantee that we're gonna prevent all breaches, it certainly gives us, and as my colleagues in the legal community say, it gives us an opportunity to tell the right story and the fact that something does go wrong, the fact that we put that effort in. Now, I'm told that we have a couple of questions that came in, so I'm gonna kick at the camera. We have one question about how we might in the future extend some of this cyber-mindful awareness campaign to our student population. And that is something that we did dip our toe into the pool on this fall. In October, when it was National Cyber Security Awareness Month, we, with the help of a very talented GA, we're lucky to have put out a campaign to our student community to try to kind of open this topic that was a real focus for our campaign. And we're looking at ways that how we can reach out to them, they're much trickier to reach. They're all over the place, technically, and social media-wise and everything. So that's definitely something we're looking at as a next approach. And particularly because we know they're gonna be going into workplaces where they're gonna be expected to have these kinds of competencies to help out with their employer's security risks as well. So we wanna make sure we prepare our student body to be successful in that as they go forward. And Tom, I'm gonna read this question to you and have you find it's a great question. Were users introduced to a risk-based approach to cybersecurity? For example, using more resources to protect high-risk assets as compared to other low-risk assets. So that's a good question. So part of it was is we began the campaign as a broad-based, everybody is all in. But as the campaign progressed, we began to realize that we needed to focus resources around those who have the greatest privileges, the elevated privilege teams. And we'd begun, now we haven't fully enacted this yet, but it is part of what's on our planning board. And some of this has actually been done on a pilot scale, is where we now are looking at specific user communities at the university that we have judged because of what they can do or what access they have, we have judged them to be a much higher risk. And so what we're doing is that we're gonna be actually targeting those groups with a much more focused level of training and awareness. And hopefully we'll be able to learn that they've actually figured this out better than some of our average users. And that would be where you'd hope that those with elevated privileges are much more sensitive to that. But that's great because actually targeting those groups is something that's absolutely critical to do. So wonderful. So any other questions, Ira? Yes, I have one actually. I'm curious, and I think I want you to sort of elaborate on this point because I'm not sure that it is widely grasped and understood, but one of the roles of universities, obviously, is to educate young people to be successful and wonderful members of society contribute positively. What role do higher education institutions have in terms of making students, let's say cyber aware of security and taking that knowledge to their organizations as they join the workforce? Wow, that's an outstanding question. In fact, as Danny is looking at me, this has been an area where we've been spending a good bit of time on that. And we began part of this by looking at the generational differences. How are millennials and Gen Zs responding to this? We know that the perception out there is that they may not be as thoughtful or as privacy-focused. But the thing that we really believe is key is as students move through university, developing their cyber-savviness skills is absolutely an enhancement to their resume that we have discovered with the students that we've had go through some of our classes on social engineering and cybersecurity communications that in those areas, they have found that to be a really a valuable asset and many of the organizations that have interviewed them were, it was clear that that was a distinguishing value add to their repertoire of experiences. And so we've been pushing this very thoroughly across campus and have had very good response from our colleagues. All right, we've got one more question I think we'll be able to take. Did you have any legal problem regarding the implementation of the program? You know, actually, we did not. And in terms of the, our assumption there was that all the university personnel are part of our community and engaging them in this awareness campaign was part of the responsibilities employees. So we didn't have any issues there. And in terms of, we weren't really ever sharing any privacy data. So on the legal side around private data, and particularly because we do not even try to call people out if they're frequently falling for our fishes. It's really more of a proactive approach where we're trying to educate them and be positive about it. So we did not have any legal issues with that. But we are private universities, so we don't have as many constraints perhaps as some of our public colleagues. But I know that we're almost out of time, so I'm gonna kick it back to Ira. Okay, well, you know what Tom, I'm gonna take the prerogative and throw one more question to you. Okay. Great.  So I'm curious, how do you instill that kind of softer skill into the IT department so they really connect with the users? We have really spent a lot of time talking to our IT staff about the importance of these campaigns and any kind of an engagement as being our opportunity to build a positive relationship. And that to us has been the key to us having folks feel comfortable in engaging with us around real risks that are out there. So we think that the staff has been very responsive to that. I'm sure there are days when they're grumpy and things don't go as well. But I'd say that for the most part, our staff has been very responsive to that. But part of it is that, you know, we've done this as a leadership level initiative. We said, this is really important to the university. This is really important to the key directors within IT. And it's important to many of our faculty. So we find that the staff has been very responsive to that and the community feels much more comfortable in bringing any kind of a challenge to us. We don't want to appear to be the cops on the block. We wanna be their colleagues and their partners in solving these very big problems. And that's why we really define the whole idea around the phishing as an exercise for us to build up our muscles against the bad guys. And that's how we really turned our user community into our early alert allies. Great. Thank you, Tom and everyone at University of Dayton for a wonderful presentation. And for those of you that didn't get to your questions, we will respond by email. And for those of you that requested more information, we will get that to you shortly. And you can see on the screen here this contact information for University of Dayton. And as I said earlier, we will have a recording of this posted on the CGE YouTube channel at the end of day tomorrow. And again, thank you for taking the time to join us. Great. Thank you everyone. Look forward to hearing from folks. Bye-bye.


How can you work at home and school your kids at home without tearing your hair out? This is a question on everybody's lips right now, and I've been asked a lot I don't necessarily know the answers yet because I'm going to be trying to figure it out with all of the rest of you But I've put together some thoughts to guide me through this first week where we are absolutely at home Working at home the kids are here too, and I thought I'd share them with you in case they're helpful to you too Please please leave comments down below with your suggestions about how to make this work One of the great things about being at home Mork's joining us. This is Mork. She used to have a sister called Mindy. Any of you remember that show Mork and Mindy? Well, yeah, this is Mork. There's no longer in Mindy and now Mork's just a really kind of slightly cruel name, but Okay, number one this will be a compromise You're not going to be able to work in quite the same way The kids are not going to be able to do school in the same way that they used to We need to just get over that as quickly as possible and be forgiving of ourselves for not being able to be skilled teachers who had years of training and lots of expertise and Forgive ourselves for having to muddle through a little bit with the working from home during the corona virus pandemic crisis lockdown thing So I guess my top tip here. Don't try and turn your home into a school. Have a think about how you can Flexibly educate your kids in a way that works for you in a way that works for them that stops everybody getting completely stressed out with each other Compromise number two I think it's really important that we create a new normal as soon as possible and in particularly here Finding a daily routine that works for the family. That's going to be really really crucial one of the really protective factors about going out to work or out to school each day is that that sense of routine that getting up Getting dressed getting washed connecting with people having a sense of belonging and purpose That's really strong protective factors against things like low mood anxiety depression We are all more vulnerable than usual with mental health issues because this is a really challenging time Even the most chillaxed people are anxious right now. So those of us with underlying conditions related to anxiety and depression We need to be really careful So routine and new routine is going to be a really important part of this I would be thinking about making a commitment to what times you're going to get up and go to bed thinking about when you'll eat Breakfast thinking about what times are the times in the day for working? Think about when are the golden times when you're not allowed to think about coronavirus build those in please? They really matter so building work time building break time make a new routine It doesn't need to mirror your normal working day or your kids normal school day It's about what can work now so be flexible compromise, but try to find a new normal The other thing with this is you'll need to revisit it periodically because things might change or you might learn about what works better So don't feel you've got to absolutely rigidly stick with it, but create a guide Try it reflect on it as a family and then adapt it number three This is for those of you who are trying to hold down a job as well as trying to homeschool your children And this is have a think about during the day and think about the whole day Not just when your normal working day would be during the day when our moments when you could be hyper productive So many of us work better either in the morning or the evening There might be chunks of the day which are really good for you if we can schedule some really concentrated work time during those those times Then perhaps we're able to then be a bit freer for our kids for our family the rest of the time So it might be that if you've got more than one adult in the house That you have shifts and that some of you have like really productive time while the others looking after the kids And you swap over if it's just you then it might be that there are some activities that you know That your kids can get on with and be pretty self-sufficient with So that you can be working in those times either that perhaps they're able to do kind of focus school work and study Or maybe you allow them to have some screen time And that they might be quiet during that time or there might be other games or activities You feel you can set them up on but basically this is about saying you know Can I carve out 90 minutes or a couple of hours? Maybe once or twice a day when I can be really productive get as much done as I possibly can and Then be forgiving of myself the rest of the time if we don't do that I fear that what will happen is we will be trying throughout the day to be working We won't be working very well, but we also won't be looking after our children as well as we could So it's going to be this like really poor compromise So rather carve out times when your kids need to know, you know, I'm working now It's really important that I can focus if possible and then times when you're absolutely with the children and be wholeheartedly with them and guiding them There might be some times that kind of fall somewhere in the middle there But see what works for you and your family or depend a lot on you and how you work and your children and how they work and How able they are to self-sustain number four kind of build on number three really and that's don't expect your children to be entirely Self-sufficient, so I think we sometimes Can overestimate how much kids can get on with stuff on their own? So they might have been set work from school or you might set them off on other activities And we might feel like we can get them going and then that's it Actually, they are going to need some degree of interaction from us And if we don't provide some interaction and help them a little bit with their learning at various points Then things aren't going to go so well for them That's okay And there will be some tasks that they'll be able to focus on better than others But if you work on the assumption that they are going to need periodic input from you and be prepared to give that and not Be doing tasks yourself that mean that you can't take yourself away and help them You're probably going to find that things are going to work better This is what I'm going to need to really work on because I'm someone who does really really focus and when I'm focused I like to be like in the zone and not interrupt it So for me, this is going to be a bit of a learning curve Then finally and I mentioned this before When can you build in golden time for everyone now for me golden time is going to be specifically time when we Don't talk about coronavirus when we just stop and we have fun and we chill out together and Life is good for a while where we completely forget about the world and we just do our thing as a family Board games are going to play a bit an important part here I think the Frisbee is going to come out quite a bit but if dog walking if we're still allowed outside the house We shall see but golden time Non-coronavirus time How can we have fun together? What does that look like and also is there something you can get lost in? Is there a TV show or a film that you could watch together which just takes you away and helps you to laugh or? Just feel differently for a while. I'd love to hear your ideas for making this work, too We're all going to be somewhat muddling through this together But please please be kind to yourself be forgiving. This isn't going to be the easiest thing in the world We all need to be flexible in our approach Good luck stay safe and let me know what other videos would be useful if you want more coronavirus specific content Bye


The International Eel Pot Festival will remain in Walker this winter. Organizers announced this afternoon that the festival will take place February 22nd through the 25th in Walker Bay. Organizers had been considering alternative sites, including Bemidji, but a proposal by Chase on the Lake Resort in Walker helped keep the festival in the same city it has been for the past 38 years. The arrangement leverages the expertise of the resort's third-party service provider Leisure Hotels and Resorts to further improve operational management, planning, personnel and daily facilitation of the event. Leisure Hotels and Resorts will provide additional staff, operational strategies and resources for the festival. Officials say they will also continue to execute and grow the many other proactive improvements established over the past few years while attempting to create a new standard for how the festival is run. If you've enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland Public Television.


Daily Tech News show is made possible by you listening right now. Thank you so much, John Atwood, Pat, Mike Cortez, Neil Wilson, and all of you. On this episode of DTNS, why social media speech restrictions are stopping Molly Wood from doing her job. Plus, why you should care about the Supreme Court hearing about online speech this Monday and the things you need to know about Reddit's IPO. That's my little poll. This is the Daily Tech News for Friday, February 23rd, 2024. In Los Angeles, I'm Tom Merritt. And from Studio Animal House, I'm Sarah Lane. And from Oakland, I'm Molly Wood. Drawing the top tech stories in Cleveland, I'm Len Peralta. And I'm the show's producer, Roger Chang. Ah, the bad luck of the calendar, Sarah. I'm so sorry that we don't get to do a show on 224-24. I mean, we could. I mean, I guess we could. I don't want anything else to do. We make the rules. Too shay. Too shay, Sarah. Tune in and find out. Maybe we will. Yeah, I have to go to a film premiere tomorrow. Ah, well. And see life. As a friend of mine, her name's Molly. She's in a little short film in the Hollywoods. I'm in a little short film. Yeah, that's exciting. Coming in town for my screening. I thought Tom was kidding. No, it never gets less weird to say out loud or be true. But there you go. That's exciting. More on that soon. But let's start with the quick hits. Microsoft has a new tool that adds generative erasing. So you can take out that broom in the background of your engagement photo. You didn't want it to be there or unwanted objects in general with AI generated content in the windows photos app in windows 10 and later generative Erase is the successor to spot fix that helped retouch photos and remove blemishes and other flawed image regions. The new tool produces a more realistic result. That's what the company is hoping anyway, erasing objects from photos and is now rolling out to windows insiders in all channels. Did you say broom or groom?  Yeah, I mean, it depends on the engagement. Yeah. Well, we got AT&T's explanation for the widespread outage in the US Thursday. The statement says, and I quote, we believe that today's outage was caused by the application and execution of an incorrect process used as we were expanding our network, not a cyber attack. That's all in one sentence. So a lot of people were jumping to conclusions about cyber attack and never looked like a cyber attack AT&T going out of its way to confirm it was not a fact a cyber attack. It was a bad software upgrade. ABC News got a source to tell them it was a software update gone wrong. That seems to fit the facts, which depending on how you look at it is even more vague than an incorrect process. So who knows if we'll ever find out more details. Well, when it comes to social media, not that many people actually ever post a slightly larger percentage engage on posts, but the majority just consume the content and don't engage at all. A new study by Pew Research Center highlights this trend, noting that on TikTok, the top 25% of active posters make up 98% of all public videos. Around the same as Twitter where Pew previously found the top 25% of active posters wrote 97% of tweets. 48% of people who are on TikTok have never posted a video there or say they haven't. Around the same percentage that posted on Twitter, five or fewer times per month when Pew released a study back in 2021 that was similar to this. Adults between 18 and 34 were more likely to use TikTok in the first place, although 60% of 35-49 year olds have posted at least one video compared to 52% of those 18-34. Yahoo laid off Engadgets editor-in-chief Dana Wolman as well as managing editor Terrence O'Brien and eight other of their top editors and said they don't have plans to replace Wolman or O'Brien. In fact, they're splitting Engadgets editorial team into two. The new news and features team will focus on traffic growth, so think Jason SEO and clicks to drive up ad impressions, and the reviews and buying advice team will report to leaders of the commerce team at Yahoo, so likely focusing on growing referral revenue, affiliate links, things like that. Former Red Ventures VP of digital marketing operations Sarah Priestley is now listed as Engadgets general manager. Priestley wrote that collaboration with sales and SEO teams is key moving forward. After its public launch earlier this month, decentralized social network Blue Sky is opening up self-hosting of data a step towards federation. That will let anybody run their own server that connects to Blue Sky's network and host their own data and manage their own account and more or less make their own rules. The decentralized model is similar to what Mastodon is already doing using the activity pub protocol. Blue Sky uses the AT protocol, meaning that the two networks will stay separate at least for now. For the time being, interesting to be like, you can have one person on your personal server and if you prove you're responsible, we might increase it in the future, so play by the rules. This Monday the Supreme Court will hear arguments in the cases of Moody versus NetChoice and NetChoice versus Paxton. If those don't ring a bell, one is a case in Florida, the other is a case in Texas about whether a law can limit what content online content platforms can either curate or ban. In Florida, a court found that Florida's SB 7072 law was unconstitutional. In Texas, a similar law, HB 20, was upheld. Hence the Supreme Court starting to weigh in here. The court will consider two aspects of both laws. The must carry provisions around lawful speech. Basically, if it's not against the law, you can't ban it, you can't remove it. And the transparency requirements, which put rules around publishing moderation guidelines and sticking to them. Okay, so Tom, I know you've been following this closely. What arguments are we expecting to hear from these two sides? Yeah, a lot of the times when people talk about Supreme Court hearings and stuff, they talk about them as if it's somebody trying to convince the court what's right and then the court having their own opinions. And really what it comes down to are precedents. And this is a great example of why your ideology and court precedents don't necessarily match up. It's very interesting. The states are going to argue that platforms are public forums, and therefore the state may regulate them accordingly like a public square, and they've got some precedents on their side. The platforms are going to argue, no, we're more like a newspaper or a parade, and we get to decide who joins our parade or what we publish in our newsletter, and they've got precedents on their side. So let's go through some of these for the platforms. There was a 1974 case Miami Herald versus Torneo that held that you can't force a newspaper to publish a reply. It seems obvious now, right? But there was a court case that said, no, you don't have to publish a reply from somebody to one of your op-eds or anything. The more interesting precedents, 303 Creative versus Elenus is probably famous as the website designer that wanted to make sure they wouldn't be forced to make wedding websites for gay couples because of their personal religious beliefs. The court said, yeah, you're a web designer, you get to choose your clients. Hurley versus Irish American gay, lesbian and bisexual group of Boston in the 90s held that a St. Patrick's Day parade organizer was protected by the First Amendment from being required to let a gay, lesbian and bisexual group march in its event. They were like, their parade, they can decide who comes and who doesn't.  And so I can ban users and I can moderate them. The state's side of this is trying to say, it's like a public square. And there's examples of private spaces being ruled to be public interest. Prune yard shopping center in San Jose, California. Actually, I think it's in a suburb but it's right there near San Jose prune yard shopping center versus Robbins ruled that a shopping center could not prohibit students from collecting signatures from a petition. They said, you're acting very much like a public square. This is in the public interest. You have to let them do it even though it's on your private property. Holmesfeld versus forum for academic and institutional rights allowed Congress to tie education funding to a requirement to allow military recruiters on campus, even if universities were against the idea of military recruiters or or had maybe even a religious objection to military. If it was like, say a Quaker University, they said, no, the Congress can tie the tie the funding to that. It is public interest. And therefore, even in a private setting, you can have you can have public interest have sway. So those are the precedents you might not have guessed will be used by these two sides. Okay, so we're talking about moderation here but what about the question of transparency and what has to has to be done. Yeah, there will be some interesting arguments about that. It's a little more straightforward. Also, the two, the two laws are more different. In this case, Florida requires a thorough rationale for each removal or ban. That's a much more burdensome provision. Whereas the Texas law just says you have to post the reason if you remove a post you have to post why. And that seems to be a little more mechanical. It's possible that the court might rule that the Texas provision meets its standard but the Florida one goes too far. So, okay, so in Texas, you could say, yeah, we don't like it for this reason. Florida says you have to give us more than one sentence reason. Yeah, yeah. Okay, well, people in Florida or Texas probably care very much about these. Why do the rest of us care? How does it affect us? Yeah, so depending on how the court rules could affect others besides just the social media platforms that are targeted by these laws, these laws are obviously targeted at Facebook and Twitter. But Wikipedia filed a friend of the court brief because it says, look, if I have to give a thorough explanation for every edit that is proved or disapproved on Wikipedia because that's moderation, that might cause us to post less stuff. It would reduce the amount of information on Wikipedia. A lot of redditors have expressed worry that if the law saying, okay, you can't ban for viewpoint, you can't moderate for viewpoint is carried out. They might become liable if they make a mistake personally liable because Reddit doesn't provide the moderation individuals do. And if court rules against laws that reduce the ability for states to regulate the big platforms at all in either of these cases, it might reduce the ability to regulate other kinds of tech companies. It might be seen as a precedent for that. So there's a lot of different angles on this that could affect other things. All right, Molly, hearing all of this, what is your take? Oh, boy. It's a lot. It's a lot. And one sentence. You don't have to do a thorough explanation, right? Yeah, I mean, we're not in Florida. Exactly. I'm just going to give you a simple reason for, no, I mean, look, this is like, here we are this many years later, I'm going to say 25 years of just my own personal experience, right? Dealing with how the internet and online platforms are or are not different from every other sort of publishing system that has come before. This Supreme Court in particular has been a little bit all over the place on these issues and has dodged the kind of fundamental question of Section 230 altogether. So I would say like, no matter what we get here, it's not going to be comprehensive or the end of this content moderation question. Yeah, I think the court is going to feel a little more comfortable in this case because it's First Amendment stuff versus Section 230, because you're right. They basically were like, we're not, we're no good. We're no good at 230 in that Google versus Gonzalez case. But here's the thing, like it is First Amendment stuff, but it's also algorithm stuff. And so to take that, to continue to take that part out of all of these conversations and sort of behave as though it is a pure First Amendment question because they're talking about shadow banning. They're talking about algorithm, you know, deamplification. Like those are all things that are separate from the sort of overall question of speech. And until we have a way to deal with that, this sort of deal with the freedom of speech versus freedom of reach part of what actually happens on online platforms. Any solution that is billed as a purely First Amendment solution is just incomplete and it's going to be gained. It's going to be interesting where they draw the line on this. Section 230 doesn't really get affected directly by these laws because all Section 230 does is shield you from liability if you make moderation decisions. This is saying what those moderation decisions can or cannot be separate from Section 230. But that, like you say, doesn't leave the Supreme Court off the hook as far as having to draw the line in a world of technology, which they previously have shown that they are uncomfortable dealing with. Yeah. It's a mess. Well, we mentioned Reddit. Right as our show started yesterday, we mentioned Reddit filed to list its IPO on the New York Stock Exchange. We have a few more details about a day into the news. So Reddit is reporting revenue up 20% year over year to 804 million in 2023. The company also says it's losing less money each year. That's a good thing. And now claims 73 million daily active users and a $3.42 global average revenue per user. Reddit's also a big tech initial public offering, you know, certainly one of the year. And really the first social media IPO since Pinterest went public back in 2019. We had a bit of a dearth of social media IPOs for a variety of reasons over the last few years. Well, of Reddit's revenue, the vast majority came from advertising. And that's not a huge surprise, although it also noted in its filing that that average revenue per user is declining. So that makes a company have to do something. On Thursday, Google announced an expanded partnership with Reddit, giving Google access to the Reddit data API for efficient and structured access to fresher information, as well as enhanced signals that will help us better understand Reddit content. Public posts, comments being among them. That data can then train large language models more efficiently. Google says it's also developing ways to make it even easier to access information from Reddit across its products. Bloomberg reports this partnership will net Reddit about $60 million per year. So it's not a huge deal in the grand scheme of a company that just went public. But I think it does point to how Reddit might shift a little bit now that it's publicly available. Molly, you're at ground zero for these kinds of things in Silicon Valley these days. Do you have any thoughts on the Reddit IPO and the monetization strategy? I mean, there isn't one. So, you know, this is not, we have had, there have been companies that have gone public before when they were not profitable. And in fact, when they were very far from profitable, you know, probably the best known example in recent years is Uber, which went public and people bought it shares and it continued to lose like a billion dollars a quarter on its way to eventual profitability. Because people believed there was in fact a user base and a growth strategy that would make this company profitable, right? It's a long game type thing. So it is not unheard of, especially in the last decade or so for companies to go public when they have never been profitable. Now Reddit has never been profitable for 20 years and is attempting to convince sophisticated investors that there is an either an advertising or a data strategy that will make it back multiple times. It's revenue, right? And I just, I say this as someone who actually, I like, I love Reddit. I think it's gotten a huge Twitter bump from people who were sort of like, well, I used to go to Twitter to get boots on the ground understanding of things that were really happening. Now I don't go there. I go to Reddit instead. I think that Reddit can actually be a phenomenal source of information. It's ultimately an advertising based social network. And so far, only one of those is really performing monetarily. And I just don't know. This is not like, let's just say this is not a stock I would ever buy. That is not investment advice. It's a personal opinion. That's just vibes. Yeah, this is just vibes.  But what they're trying to do is raise money, right? Like as you pointed out, they need to raise money. And going to the public markets, they hope is going to be a way to do this. I don't think this is going to be the biggest pop IPO we see. Yeah, I like that analysis because I think a lot of people go, oh, another company that loses money trying to go public. And like you said, that's fine if you've got a path to profitability, right? Netflix was losing money when it IPO'd. Facebook was losing money when it IPO'd. Twitter was using money when it IPO'd and probably is still losing money. But so maybe not the best example there. But if you've got a path to profitability that's reasonable, it's fine to be losing money when you IPO because investors go, oh, well, of course you're losing money right now because that's the way business works. You have to lose money in the early days to build up the business, to make the money. And when then we all make the money back, which is what happened with Facebook. But I'm glad you brought up Twitter because that's the one-to-one comparison here. Yeah, I think the fact that Reddit has been around since 2005. And has had some iteration since. I mean, this is not just sort of like, hey, new company, hot, let's bet on the stock type thing. No, Reddit has been around for a while. People know what Reddit is. Advertising on Reddit, if there's another strategy, then okay, good for you. But I think the whole idea that other companies want to have a better treasure trove of data from Reddit, I mean, you already have that. People, Google search, Reddit specifically these days because they want actual answers. That does count for something. I don't know exactly what kinds of partnerships Reddit can make besides the Google one that I mentioned that is going to get it over the hump as far as profitability goes. But I think the Reddit strategy may change sooner than later. Yeah, I mean, I think Molly explained it really well. Like they're trying to show a path to profitability and your mileage may vary, whether you believe that path is to profitability or not. I mean, if they can license more to Google in the future, if they can license to open AI, if they can license to anthropic and all of that. There might be some revenue there, how much? The training data. Yeah, but the training data is publicly available. I mean, at some point, there's only so much you're going to be able to provide for posts that aren't right. What is likely to have, if you're going to have a path to profitability that's advertising based like a Facebook or a Meta, whatever we're calling them now, it's going to be a very different site. Reddit becomes a very different site. And the biggest problem to becoming that kind of site is all its users. Which are perfectly happy right now. Right, and they are not. Right, exactly. They're already mad. And if you try to make Reddit into Facebook or Instagram, which is heavily sanitized and algorithmically oriented and full of targeted ads, those users are going to leave. Well, you decide in March whether you want to buy some Reddit or not. Meanwhile, I got something for you right now. Tom's top five and it only takes you 60 seconds. This time I'm breaking down five ways that I fight online misinformation. A quick way to just get a few interesting things in your life if you're wanting to try to fight misinformation yourself or maybe something you can share with somebody because it's only 60 seconds. You can catch it at Daily Tech News Show on TikTok, DTNSPIX on Instagram and youtube.com slash Daily Tech News Show. All right, last week, Adam Masseri, the head of Instagram and therefore Threads said that both platforms are going to clamp down on political content, right? And added the company wants to avoid recommended political content. And we're all like, yeah, that's a good idea. I don't want to get involved in that misinformation that I was just talking about. In that episode last Thursday, Rob Dunwood brought up a very salient point. What counts as political content? Molly, you have some firsthand experience with what counts as political content, don't you? I do. Just as one example, content related to climate change has been deemed since, I think, about 2022 by Metta to be political content. So that means that it is likely one to be de-emphasized. It's going to be harder to find assuming that the Threads algorithm is de-emphasizing what it considers to be. Again, decided by the cloud here, the blob that is Metta, political content. It'll be harder to see information about climate change. They've already had policies in place and I encountered this firsthand when I tried to buy, literally just buy ads as a lady making a podcast about climate change. All my ads are rejected on Facebook. I think at some point I would just have to hire someone. You have to massage them, you have to set them up as a special interest category, and then it can only be promoted in certain ways. When they announced this, a bunch of activist groups said, you're basically just de-emphasizing messages about climate change and giving free reign to Exxon, which sponsors everything these days. The big oil companies are sponsoring everything. But it's based on this determination that this empirically scientific consensus is somehow political because there has been a concerted disinformation effort to make it political, so that we won't stop using fossil fuels. This is one example and climate scientists are very worried about it, but we're already seeing a de-emphasis on what usually happens is that when a social media platform determines something to be political, that means they think it is about LGBTQ rights, it's about climate change, it's about race. Not understanding that by preserving a status quo that doesn't let you talk about those things, you never actually have real conversations or make any progress really. Well, and there's so many, I don't know, categories like, if I want to talk about my favorite apple, and it turns into like, oh, it's a GMO thing, you know, it's like, well, that could be politicized content also. I mean, kind of anything could be. The personal is political, right? Yeah. And climate change is a political topic amongst political candidates. I think this is the problem is making topics political versus perspectives political.  So it's not even just a left-right thing anymore. This is something that has wider and wider acceptance. Whether you're talking about, as a Republican, I believe the solution to climate change should be X, that's political. If you're like Molly, who's like, I'm interviewing someone who's working on something that will remove carbon from the atmosphere, that's not political, that's just science. And business. And business, right? And science. Yeah. I mean, I think you make a really good point, which is that topic-based determination of what is and isn't. I mean, first of all, and this gets fraught so fast because I think that the conversations about free speech on social media are very often red herrings. And also, it is and always has been problematic for these platforms to be deciding what is appropriate, what is not appropriate, like the extent to which Apple has created this Disneyland-esque experience on all of its platforms, the extent to which Facebook has never shown a period, has always been problematic. Those are real issues of speech that they're now making this sort of blanket decision like, oh, our users just don't want news and politics. And so we'll just make it more pleasant for them, even though the world around them is pretty profoundly not pleasant, and it's what we're all talking about anyway. Yeah. And granted, it's their right, right? They get to do that. I think I won't speak for anyone else on the panel, but for me, it's important for us to tell you, hey, these platforms are doing this. You should know that. Maybe we can put pressure on them to change, or maybe you just use a different platform that isn't doing that, although there aren't as many choices as we would like. But it's something that I don't think a lot of people realize is happening, because when you're regulating topics as political, every topic becomes political, more now so more than ever, you know, freaking, you know, what sport you like has become political. So are we going to start removing all sports podcast advertising from Facebook? Because, you know, well, if I like NASCAR, what does that say? Because it gets ridiculous at some point. You should not be regulating political speech by topic. You should be regulating it by perspective. And if you're going to make a semantic decision anyway about topics, you can make a semantic decision about perspectives. Well, and I think sometimes people will say, this platform, everybody's just fighting about politics all day. Not the place for me. This other one, way better. I never see any of that stuff. Well, is it because of the user base or because of the platform? And in many cases, it's a combination of both. But yeah, what's going on behind the scenes to Molly's point is, yeah, if you don't see any climate change conversations on a particular platform, there's probably more to it than the fact that people just don't care about that conversation. Right. And it gets, I mean, to bring it right back to that Supreme Court conversation, right? Fundamentally, what it comes down to is that I am a user who is interested in topics and I want to choose what I see. And this just keeps coming back to, you know, implementation of algorithms that determine what I see. And that is not, we need a different framework to put that in other than speech because it's algorithmic control of information. And it's, and we're not in charge of that. And we don't have enough say over it. So to me, that's the problem. It's not a like, I just, I need a different word for it than speech. Yeah, yeah. Because it is censorship, but censorship is a tool of governments. And so it's not really censorship. And you see what I'm saying. It's problematic. Put me in charge of what I want to see. Finally. And that's what, you know, the promise of federation that we're talking about with blue sky and mastodon earlier could be. It's just not there yet. It's just not massive enough yet. Well, you know, something that is massive. The talent of Len Peralta in the artistic world. Len, what have you been drawing today? Oh, you know, you talked earlier about perspective, Tom. And I guess this is my take on it. I'm not really a big fan of election year social media. But I usually think it turns into an S show, if you get what I mean. This is called Threads S Show. This is my take on stuff. Yeah, this is how I feel about it. It's, you know, it's there are a lot of things that become political. I think this is overly political here. And on all sides. Yeah. This is how I feel about things. So yes, if you are, you know, of either persuasion, red or blue, you can get this right now at my Patreon, Patreon.com forward slash Len or my online story. You can pick it up on your own at LenPeraltaStore.com. And while you're there, you should try to commission me as well because I'm open for commissions. So he dares you. I dare you. Do it. I'm going to buy the S out of that one. Oh, God. They do. Buy all the S. Once you do that, Molly, let folks know where they can keep up with the rest of your work. Yes. Please find me at everybody in the pool.com. You can subscribe to the podcast on all your platforms and the website has a building to subscribe to the newsletter as well. This is, this is my jam and you won't find it on threads. Go, go do it. Find it now. You will find it on threads. If you've found today's topics to be a little weighty, you're probably not alone. So stick around for the extended show, Good Day Internet. We're going to lighten things up with the great GDI debates. Which streaming service would you want on a deserted island? Should you get a Disney pass or an Apple vision pro? The great debates continue. Just a reminder, you can catch our show live Monday through Friday when we do it at 4 p.m. Eastern 2100 UTC. Find out more at dailytechnewshow.com slash live. Hope you have a wonderful weekend. Everybody will be back on Monday talking about one plus's Renaissance with Ron Richards joining us. Talk to you then. This week's episodes of Daily Tech News Show were created by the following people. Host producer and writer, Tom Merritt. Host producer and writer, Sarah Lane. Executive producer and booker, Roger Chang. Producer, writer and co-host, Rob Dunwood. Video producer and Twitch producer, Joe Coots. Technical producer, Anthony Lamos. Spanish language host, writer and producer, Dan Campos. Science correspondent, Dr. Nikki Ackermanns. Social media producer and moderator, Zoe Dutterding. Mods! Beatmaster, W's Goddess One. BioCow, Captain Kipper, Steve Guadarrama, Paul Reese. Matthew J. Stevens, a.k.a. Gadget Virtuoso and J.D. Galloway. Mod and video hosting by Dan Christensen. Music and art provided by Martin Bell, Dan Looters, Mustafa A, A-Cast and Len Peralta. And live art performed by Len Peralta. A-Cast ad support from Tatiana Matias. Patreon support from Tom McNeil. Contributors for this week's shows included Lamar Wilson and Molly Wood. And our guest this week was Charlotte Henry. Thanks to all the patrons who make the show possible. This show is part of the Frog Pants Network. Get more at frogpants.com. The DTNS family of podcasts. Helping each other understand.