Your Data for Hire and Sale:

Marketer’s and Hacker’s Perspectives

Laurel A. Egan Kenny, MSCM, MBAPresident & CEO, Turningpoint Communications

@laurelek | @laurelegankenny

Andrew Ostashen, President & CEO, Vulsec, LLC@aostashen | @vulsecllc

Poll: Have you been compromised?

• Financial Life

• Identity Theft

• Company Breach

• Ransomware / Blackmail/ Phishing

• Lost/stolen smart device

ROI – Why you should care

• Understanding your Digital Shadow

• How you contribute to it every day

• Steps you can take to reduce how much information is collected, bundled and sold

• How data is being sold and used against you on the “dark web”

“A Marketer is a Psychological Hacker”

– Andrew Ostashen, Vulsec, LLC

“If you’re not paying, you’re the product.”

– Laurel Egan Kenny

Marketers’ Motivation:

Sell more:

Attract new customers

Sell more to existing customers

Promote:

Products and Services

Brand

Differentiators

Key Messages

People

How we do it

• Product | Price | Placement | Promotion

• For me, it starts with PEOPLE!

You’ve made it easy for us

• Demographics: Age, Address, Income

• Appearance: Face (size, too!)

• Behaviors: Location, visits

• Thoughts and emotions

• Interests

• Lifestyle – Good and Bad!

• Friends

• Health (fitness, nutrition)

• Security and Safety

• Preferences!

• Purchasing Patterns!

• Political Inclination

Marketing (eh hem…Goldmine) Glossary

• Loyalty / Rewards Program

• Key FOB (gym/supermarket/pharmacy)

• App

• “Connect”

• Website Analytics

• Free WIFI

• Self Checkout

• Digital Coupons

• Retail consumer analytics• RFID• Bluetooth• Eye Tracking• WIFI

Data + Data = Better Data

Car Conversations with clients – ERP System

Clicks

Social campaigns

Payment data

Usage trends

Surveys / Reviews

SEO

Analytics

Shopping cart

Photos

Apps

Social Media

Email campaigns

Internet of Things

Web Forms

Wearable Devices

Smart Devices

Key strokes

Data + More Data = Patterns = Trends = Engagement = Better Marketing = Sales Opportunities

Chatbots

Research

Targeted Ads

Lists

Web Analytics

Cross platform: FB/Insta

Public Information

Media

Web Analytics

Google Analytics tracks just about everything about how visitors interact with a website and presents the information to customers in an easy-to-read, visual report.

What are the patterns of visitor

behavior?

Where do they come from?

What keywords did they use to

find you?

Where do they go while on the site?

How do users interact with the site and long do

they stay?

What content formats are most

popular?

Do these patterns disclose where

customers are in their buying process,

or what content is most effective at the

different stages of their buying

process?

Social Media – Facebook

“Facebook meticulously scrutinizes the minutiae of its users’ online lives, and its tracking stretches far beyond the company’s well-known targeted advertisements”*

Every bit of information your provide is collected and stored. Occasional users are not spared.

• Sign up (I want an account)

• Technology links to more data (I want to contribute, support my friends)

• Third party apps (I want to have fun. I want convenience)

Fractl found individuals’ FB data on the “dark web” for a few dollars. FB logins cost $5.20 each while credentials to PayPal accounts cost $247, reported MarketWatch.

What to do? Get over it! Or…Download your 100+ page Activity Log, delete apps – or delete your profile.

*What You Don’t Know About How Facebook Uses Your Data, Natasha Singer, New York Times, April 11, 2018This Is the Personal Data that Facebook Collects—And Sometimes Sells | KIRSTEN KOROSEC | March 21, 2018

Actual Google Terms of UseRead between the lines!

Things you do. When you use our services —Google search, Google Maps, or watch a video on YouTube — we collect data to make these services work for you:• Things you search for• Websites you visit• Videos you watch• Ads you click on or tap• Your location• Device information• IP address and

cookie data

Things you create. If you are signed in with your Google Account, we store and protect what you create using our services:

• Emails you send and receive on Gmail

• Contacts you add• Calendar events• Photos and videos

you upload• Docs, Sheets, and

Slides on Drive

Things that make you “you”. When you sign up for a Google account, we keep the basic information that you give us:

• Name• Email address

and password• Birthday• Gender• Phone number• Country

Cue Video!

Internet of Things (IoT)

• Network of smart physical devices, vehicles, home appliances, and other items embedded with electronics, software, sensors, actuators, and connectivity that enables these things to connect and exchange data, creating opportunities for more direct integration of the physical world and computer-based systems, resulting in efficiency improvements, economic benefits, and reduced human exertions = Marketing Opportunity

• 20 billion connected devices in 201730 billion devices, global market value $7.1 trillion by 2020.

• IoT extends Internet connectivity to traditionally dumb devices and everyday objects. Embedded with technology, these devices can communicate and interact over the Internet, and they can be remotely be monitored and controlled.

*Statista 2019

Smartphone Sensors

• Monitoring where you are in the world, how fast you’re moving, what you say (?), which way up you’re holding your phone, and more.

• Improved user experience, they say …

• But, the same technology that tells the phone which mobile tower to use and how the phone recognizes you is being logged and stored (used and sold?)

• How its being used and is up to the manufacturer!

• Laurel’s Phone listening example – Adobe, Bellagio

Facial Recognition

The Face ID sensors map and know

everything about your face, but that information stored

on your phone.

BUT, this data may be shared with third

party apps, which may share, store this

information (with your permission, of

course)

App + Access = “Appess!”

It’s tempting to download your favorite store apps out of loyalty and because it’s EASY, convenient, and may even save you money, BUT figuring out what data that app is collecting, and how it may be hurting you, is NOT EASY.

• Did you read the “Terms and Conditions”?

• Do you need an app when the website will do?

• Beware of FREE, seemingly innocuous apps, like your flashlight, constellation finder, games.

• Google plans to remove apps that handle personal or sensitive data from the Google Play Store if they don’t have privacy policies.

“APPathy”: App functionality that put you at risk

• GPS / Location

• Facial Recognition / Fingerprint / Biometrics

• Voice activation: “Hey Siri” “OK Google” “Alexa”

• Live photos

• Contacts

• Text: Read/Send

• Phone data permissions

• Calendar

• Camera

• Keyboard

“Appvice!” Read the Privacy Policies and Disclosures

Take control and change your settings.

•Apple iOS: Privacy | Android: Permissions

•Turn off data tracking when not in use –and save your battery

Check disclosures.

•Make sure the app has a privacy policy and read it before your download it.

•Check the app-maker’s commitment to encrypting users’ sensitive data.

Use apps that maximize your privacy.

•Look for that clearly state what information (if any) they must collect to function

•Ensure the app does not share your information with any third parties

Perform regular app maintenance.

•Update your apps to ensure the newest security features and improvements. Warning: the new app may access different data and in different ways.

•Delete unused apps.

Your Digital Shadow

“If you’re not paying, you’re the product.”

• Your age, interests, purchasing habits, frequented locations, health, and social map are all valuable pieces of information that comprise a digital shadow, which can be packaged, bundled, and sold to the highest bidder.

On the Flip Side

Do business with highly ethical companies who have processes and procedures and technology in place to appropriately handle stored data:

• Privacy Policy – clear and highly visible or mandatory

• Technology

• SSL Encryption

• Secure web forms

• Need to Know policies

• Only use data as it was intended

Hamilton, Leah: Legal requirements for collecting personal data, October 26, 2016 https://termsfeed.com/blog/legal-requirements-collect-personal-data/

Privacy: Your Right, Expectation or the Law?

• Right to privacy restrains governmental and private actions that threaten the privacy of individuals.

• Expectation of privacy determines which places and in which activities a person has a legal right to privacy.

• Privacy law refers to the laws that regulate the collection of personal information about individuals by governments and other public and private organizations, as well its storage and use.

** Poll **

Marketing Outcast or Outlaw?

• Outside of promotion, privacy is the most important component to consider in marketing these days.

• Marketers need to know how to comply with the major laws that apply to them so they don’t tarnish their own brand, get hit with a lawsuit, or worse.

• Consumers need to know their rights and how to identify offenders in order to protect their data.

Marketing-Related Laws: Missing the Mark?• CAN-SPAM

• Do Not Call

• Privacy Policies

• GDPR

• PII

• Defamation

• Intellectual Property

• Paid Reviews / Promotion / Affiliation

• HIPAA / PCI

“The Law” Realities• The law is so far behind technology they are not even in the same race!

• Companies are using laws and regulation to determine governance / policies / practices when instead, they should be build based on business realities / needs.

Check in….

Denial Apathy Surrendered Privacy Warrior

Hacker’s Motivation• Power

• Control

• Manipulation

• Black mail

• Vigilante

• Championship /Advocacy

• “First to Market”

• Financial Gain

• Prestige

• “Street cred”

• Amusement

• Competitive Advantage

“I go after the Milk”

• Supply chain

• Distributions Channels

• Business Partners and Vendors

• Customers

• Plants

Dangerous Mindset

• Power

• Money

• Control

• Shareholders (investors)

• Oversight

• Siloes

• Multitasking

• Lack of Focus

“Who would care about me?

“Too big to fail”

“I have nothing to hide”

“I know everything there is to know”

“It’s not going to happen to me”

“My employees are assets”

“Set it and forget it”

• Guides and Company Logins - $2.00

• Wi-Fi or Bluetooth hacking devices - $3.00

• Keyloggers - $<2.00

• Telecommunication interceptors - $38,000

• Bitcoin Malware - $25,000

• Hacked Servers - $6.00

Trading Platform xDedic

70,624 servers for sale

http://darkweba6le5w52w.onion/

Awareness is key

• People are the weakest link!

• How do you build protections around the people• Fresh perspective• Policies• Training• Technology • Lack of talent (skills gap)• Cross training (silos of destruction: IT as a specialization / stigma)• People don’t like to be watched

DON’T MAKE IT EASY

Protect yourself before you #rekt yourself!

• You have a digital shadow, choose how to feed it before it is packaged and sold to the highest bidder –or stolen!

• Is privacy dead?

• You don’t know what you don’t know!

• Things change every day.

• Who owns you = your data?

Check in….

Denial Apathy Surrendered Privacy Warrior

Questions – Come back for more at 4:10!

Laurel Egan Kenny

• Laurel Egan Kenny is Founder and President of Turningpoint Communications, where she leads all aspects of the national strategic content marketing, communications, business development support and education consulting firm focused on financial services. She promotes her clients’ thought leadership to engage their clients in compelling ways.

• Laurel founded Turningpoint in 2007 after spending 13 years building and leading marketing and business development teams for two large, global Fortune 100 financial services firms in wealth and treasury management servicing divisions.

• Laurel is a past president of New England Association for Financial Professionals and currently serves on the Board of Directors for Dallas Association for Financial Professionals, South Shore (MA) Young Professionals, Marshfield Chamber of Commerce (Past President).

• Laurel earned an MBA, MSCM and BA from Simmons College, Boston. She presents nationally on marketing, social media, thought leadership and business development best practices topics.

• turningpointcommunications.com | laurel@turningpointcommunications | 339.793.3485

• @laurelegankenny | @turningpointcommunications | TurningpointCommunications

Andrew Ostashen

• Andrew is President and CEO at Vulsec.

• Andrew has assessed over 250 companies including hospitals, banks, casinos to quantify their risks.

• He has been in the cryptocurrency field conducting research and trading since the inception of Bitcoin.

Vulsec.com | @aostashen | @vulsecllc |617-356-2314 | aostashen@Vulsec.com | www.linkedin.com/in/andrewostashen

Appendix

Controlling the Assault of Non-Solicited Pornography And Marketing Act of 2003

(CAN-SPAM Act)

Rules commercial email, establishes requirements for commercial messages, provides email recipients with the right to stop email, and establishes consequences for violations (penalties >$16,000 for each email).

What to look out for:

• Misleading, deceptive, or falsified information in “From,” “To,” “Reply-To,”fields or in subject line, and routing information.

• No physical postal address.

• No opt-out link, nor the ability to unsubscribe promptly.

• Sent with or without an email service provider (ESP).

Real-Life Offender: In 2004, Ncholas Tombros pled guilty to charges and became the first spammer to be convicted for "war-spamming" thousands with emails advertising pornographic websites. Tombros was sentenced to 3 years’ probation, 6 months’ house arrest, and $10000 fine

Vaughan, Pamela; The Laws Marketers Need to Know to Avoid Legal Backlash, HubSpot: 2011, 2017.

Do-Not-Call Implementation Act 200 Million U.S. consumers are registered to limit telemarketing calls, but not all calls are blocked. Calls from companies with established relationships, written permission, non-commercial calls or non-soliciting advertisements, or calls from or on behalf of tax-exempt Not for Profits. Violations cost up to $11,000.

What to look for:

• “Cold calls”

• Calls outside of 8 AM - 9 PM (local time)

Real-Life Offender: The FTC shut down two groups of Florida-based telemarketers that inundated consumers with “robocalls” in which they falsely promised to reduce consumers' credit card rates. JPM Accelerated Services-associated defendants were fined $5.9 million, and fines of $3.2 million were ordered to six other defendants who were associated with an affiliated operation, IXE Accelerated Financial Centers.

Vaughan, Pamela; The Laws Marketers Need to Know to Avoid Legal Backlash, HubSpot: 2011, 2017.

Privacy Policies and Terms of UseAlthough partial regulations exist, there is no one privacy law that singlehandedly addresses how companies acquire, store, or use personal data in the U.S. Generally, in the U.S., collectors of data own the right to store and use it.

What to look for:

• Privacy policy and terms of use clearly explained – and highly visible on the business’s website

How the company uses your personal informationWhether or not they share your data and/or use cookies or tracking software.

• Companies sharing social security numbers, credit card numbers, bank account information, criminal background, or health records.

Real-Life Offender: In 2011, Facebook agreed to settle federal charges from the FTC that it violated users' privacy "by telling them they could keep their information on Facebook private, and then repeatedly allowing it to be shared and made public." The settlement requires Facebook to allow independent auditors to review Facebook's privacy practices over the next 20 years. It also requires that Facebook get approval from users before changing how it handles their data.

Vaughan, Pamela; The Laws Marketers Need to Know to Avoid Legal Backlash, HubSpot: 2011, 2017.

General Data Protection Regulation (GDPR)

• Seeks to create a coordinated data protection law framework across the EU and aims to give back to data subjects, control of their personal data, while imposing strict rules on data hosts and processors of the data, anywhere in the world.

Personal Identifiable Information (PII)Any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means.

Any information about an individual maintained by an agency, including:

• Any information that can be used to distinguish or trace an individual’s identity, such as name, social security number, date and place of birth, mother’s maiden name, or biometric records; and,

• Any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information

Defamation LawDefamation is a false statement of fact that is harmful to someone's reputation and published out of negligence or malice. Libel is written and slander is spoken defamation.

Interestingly, Section 230 protects companies against defaming user-generated content such as blog comments

What to look for:

• Freedom of speech abuse – definitive statements that simply are not true

• Defamatory content

Real-Life Offender: $430,000 settlement that Courtney Love paid fashion designer Simorangkir for the 20 minute Twitter attack on the designer over an invoice dispute, where she informed 40,000 Twitter followers that Simorangkir a drug-dealing, prostitution-pushing thief who lost her children because of an assault and battery record.

Vaughan, Pamela; The Laws Marketers Need to Know to Avoid Legal Backlash, HubSpot: 2011, 2017.

Intellectual Property LawsCreation and enforcement of intellectual property such as copyrights, trademarks, patents, trade secret laws, etc. that grant owners specific exclusive rights to various assets, such as musical, literary, and artistic works; discoveries and inventions; and words, phrases, symbols, and designs.

• What to Look Out for:

• Plagiarism / unattributed photos, videos, images, songs, etc.

Real-Life Offender: Napster allowed users to share music files, causing thousands of people to download songs for free instead of purchasing CDs or MP3s. The problem was, Napster didn't own the rights to the music its users were uploading to Napster's servers. The Recording Industry Association of America (RIAA) sued Napster and won, forcing Napster to shut down. Napster is now owned by Rhapsody.

Vaughan, Pamela; The Laws Marketers Need to Know to Avoid Legal Backlash, HubSpot: 2011, 2017.

Disclosing Paid Reviews/Promotion/Affiliation

In 2009, the Federal Trade Commission (FTC) published revised guidelines to its FTC Guides Concerning the Use of Endorsements and Testimonials in Advertising . The guidelines explain the conditions by which the FTC would find endorsements or testimonials unfair or deceptive.

What to look out for:

• “Paid for” positive reviews

• Bloggers who favorably “review” products and services

• Undisclosed relationships with partners and co-marketing partners

Real-Life Offender: Legacy Learning Systems, a popular seller of guitar-lesson DVDs was fined $250,000 for using misleading online 'consumer' and 'independent' reviews. The FTC charged that it "deceptively advertised its products through online affiliate marketers who falsely posed as ordinary consumers or independent reviewers.

Vaughan, Pamela; The Laws Marketers Need to Know to Avoid Legal Backlash, HubSpot: 2011, 2017.