 Hey, hello everybody. Welcome back to the Think Tech Hawaii Studio. This is Security Matters and today we're going to get into something that I think a lot of you may not be familiar with. You may have come across Race Secure, the company, but you may not always talk to your customers about their mailroom, their mailroom security and some of the things that they might want to consider. You've probably seen some of this stuff in the news around the White House and the Pentagon and folks like that, a lot of VIPs, but this threat's very real and we have a true expert with us today, Will Palmer, he is the CSO of Race Secure and he's got quite a bit of history with EOD and some of these types of things. I want Will to introduce himself, get you into, let you understand a little bit about his history and then we'll get into mailroom security. Will, thank you so much for joining us today. I really appreciate it. Hey, there's a hand me, Andrew. I appreciate it too, man. All right, so a lot of our audience, you may have met some of them. I don't know if you guys were at ISC West and you were starting to make the rounds, but go ahead and for those that may not know you, as much as you care to share, I know we don't give it all away on social media these days, but what we can learn about your background and then we'll get into the topic. Sure, thanks. So as Andrew mentioned, I'm the CSO for Race Secure, my background is military. I did 25 years of the Army with the bomb squad and kind of took that background and put it in corporate America where people don't necessarily, I don't know, pick up on some of the problems that they get presented with. So through my time, I was both enlisted and officer. I did 12 years as a UD team leader, running around, solving all the problems. Then I flipped over the administrative side as an officer and kind of started telling people what to do and how to handle that. So it was real fulfilling. I liked it. I got to play both sides and, you know, it kind of cheated towards the end because if you've been on the enlisted side and all of a sudden you become the guy in charge, you kind of know both sides of the game. So it helped me out quite a bit. That's awesome. Great career. Thanks so much for your service. I appreciate that. I never got out of the enlisted ranks myself in the Navy. I really wasn't smart enough, so they made a good choice keeping me there. They made a mistake and they gave me a commission. I really said that. Right. Well, let's talk about some of these threats first of all. I'm not super familiar with a lot of this type of work, but I'm aware of things like rison, right, which is this power that can come from caster beans. And I know there, I don't know if there's antidotes for it. I know it's a highly toxic substance. But talk to us a little bit about the threats that can show up in mail in a small package that people may not consider as a threat, right? A bomb doesn't have to be a huge box, right? Right. So there's a couple of things that one, for all of us older folks, bombs don't tick anymore. Well, days the Unabomber aren't there. Now it's solid state. You could do everything in really, really small amounts. Most of the threats that we see are actually less than half an inch thick and way less than 10 ounces. On top of that, most of the stuff that you look at, like you mentioned, rison is a great one. You can order every part of that through the internet. You can get it all delivered. You probably get caught if you order too much. But it doesn't take much at all to cause something that can be harmful to somebody, injects, ingests, or it hails it. Most of the time, thankfully, it's nothing. Realize that almost all these events that come through that shut down companies and corporations. It's a hoax a lot of the times. When it's not, every White House since 2003, every single administration has had a rison event mailed to the facility. That's the big end, the one that you see all the time. But then if you look at the smaller events last year, Dr. Fauci had a white powder thrown at his house. Rand Paul had one about three months ago. The Republican Party for Arizona had one the week before that. Really, these are small items that people just drop in the mail. They think anonymously and they get delivered. And when they do, you get the reaction on the other end because you have to act like it is rison or like it is anthrax because the day you don't is the day that it actually is. Wow. Yeah. And I know with the rise of these domestic violence, for a domestic, you know, what they call DV, domestic violence terrorist, this political type of activity or politically targeted activity, it could drill down into, I think there's been judges that have had stuff like this happen. So like law enforcement type folks. And obviously, if you work in the security industry, we could easily become the target of someone's angst, whether it was a, you know, a job mishap that maybe our surveillance system picked up on and someone got fired and then hates the security company. I know we used to get named in all the lawsuits. I'm sure there's enough people that hate us that as security integrators, we should, you know, if we're not talking to our clients about this, we may also should be thinking about it for our own organizations. Are the, are the, so are the types, are there a lot of these types of substances out there? So because the liquid to me seems like it'd be easy to see, but I don't know. It is. So what's interesting is people for some reason think that if they put fuel or some sort of costing material in a plastic container or like a seal of meal and they ship it, it's going to actually burst on the other end. The reality is most time it's in, it's in transit. So somebody puts pressure on the boxer package or usually it's a flat and it leaks at that point. It's either in the USPS system where it's going through a roller or it's when it gets put on site and somebody just leaves pressure on it. Liquids are not all that common. A lot of times you see liquids nowadays as drugs. The drug has, drugs have increased exponentially since the pandemic drug dealers don't stand on the corners anymore. Now they just mail it. There's a serious amount of, of possibilities. So you get everything from white powder threats like we mentioned. There's a lot of threats. There are people who are openly, like you said, politically environment. We've got, you know, people who think that they could just put whatever they want to on a piece of mail and threaten people and send it out. The judge comment is very interesting since the January 6th event. Those people across the United States came from everywhere and you're seeing threats to federal and local core houses because the judges are either going to get targeted because they're going to be one giving a verdict. The lawyers are getting targeted because they're either charging or defending people where they're involved and you end up with both sides coming at these individuals. Governments have been getting hit significantly. Be pretty good this year. Wow. Yeah, it's really, it's, it's, it's not much. There's not really a winner here, especially, you know, when there's people on both sides of an issue that are, you know, prone to violence as we've seen. So are these, are these, what's the commonality? I mean, are we, are we having tens of thousands of events a week? Is it tens of thousands a year? And did, you know, kind of just in North America, and I'm not sure, you know, I'm sure a lot of these, these events don't get released. They're probably classified types of events. But what can you share with us about what, you know, let's talk about maybe corporate America. Right. So we do track that. There's no real number out there. So the day I walked out of uniform, I'm a big numbers person. So I track open source, what happens across the United States and international now, but across the United States to corporate America. And that's when they got caught. So nobody's going to stand up for a major corporation and say, Hey, by the way, this happened in my mailroom last week, and we had to do all these things. So only when it hits the open source, we really get the full scope of it. And we're talking, you know, 40, 50, 60 events a week. So a lot of that's federal America. But for corporate America, you'll see it happen. You know, somebody got hit last year. Exxon got hit three weeks ago. It's very, very common. And when you get a first responder in that's usually when a reporter shows up, that's when we hear about it. Unfortunately, a lot of the folks that we talked to, they come to us after an event. And that's rightly so. I mean, that's response to something happening to you. But corporate America gets hit a lot. Three times a year per company per year. And so the, the, for the folks that don't, the prior everybody thinks that the mail guys USPS FedEx catch this stuff before it shows up in your mailbox. Let's talk about that problem there about, I'm sure it's a volume issue, but, but maybe it's a resource issue as well. It's threefold. So volume and resource is one those the amount of time it takes to have somebody screen that that's extra money. Two is FedEx, UPS, those corporations, they're private entities. They're there to make money. So when you start talking about adding security requirements on top of them, their logistics, which is why they make their money, doesn't want to slow anything down. And that's unfortunately what we do. A lot of times when something gets caught in FedEx or UPS, it's because the clerk behind the desk that's taking this package goes, I don't have to take this in my private carrier and something's off. And usually they'll put it aside that they'll call, you know, police officer or everything, come take a look at it. Logistically speaking, that's what stops most of the screening efforts. The amount of time it takes to slow things down and take a good solid look at it. Yeah, security and speed. We've always, always fight that battle, don't we? You know, there's a, there's the secure way and there's the fast way. It's kind of all we, you know, that reminds me of this classic access control problem. So, so you mentioned that the people are a part of the solution, you know, the guy getting the package, maybe the person that tries to submit it or have it sent seems suspicious. Is, is there training available or do you folks conduct training for these types of folks? I'm just thinking of our, like our mail pickup, you know, and I'm pretty sure Cheryl and our office hasn't received any type of training for what to look for when she's getting a package in the office. So is that, do you extend that into the mailroom staff themselves? Talk a little bit about the awareness that can help. So we absolutely do. One of the things that's interesting is a lot of corporate America doesn't have a training platform in place. So we built one. We built an LMS. So our clients can go take a look at it. Most people in that environment that are working that job, they're, most of them on the entry level, they're working their way up in the company. You end up with a high turnover rate. And with that, you have a lot of training requirements. So we built something that people can go sit down, learn a little bit, see what's going on. And then for, for us, we provide quarterly webinars where our clients can dial in and take a look and see what's going on. We talk about the threats as have happened in the last 90 to 180 days. And then there is training available from a lot of other companies and corporations. It's actually good to tap into. One thing that really works well, and we found resonates with most of corporate America is once you put a training plan in place, it doesn't take much. You get a really good trainer, trainer philosophy in, and then you, you get your company, let's say mantra on how you're going to handle things. And then once that's built, it just repeats on itself and you end up with a better prospect and better product every time. So what's the biggest problem you encounter? I'm sure it's just that nothing happens, right? The mail comes in, it gets distributed and no one cares, right? It's a speed thing. Get it to the desk or to the department it's supposed to be delivered to. Let's say that's the base, the lowest hanging fruit to. What's the, what are more advanced sort of companies? Tell us a little bit about their processes. So some of the more advanced companies have some actually really well thought out combination between logistics and security. That's the most common problem that we see is responsibility. So when you're talking to a major corporation, who owns the building? Facilities usually. Who's responsible for the function of moving mail from the time it enters to the time it gets delivered? Facilities, maybe some operational side. And then security kind of sprinkles in from the size is wait, you have to do this process, you need to do something in place. So we found the most successful companies have a really good marriage between those two entities. And oftentimes it's a third party. So if you talk to a major corporation, they're not going to have a dot my company name email address. They're going to have a dot some other third party that's under contract. So getting them to buy in it as well, there's certain things you can and can't do within that contract. And those obligations are often, you know, need to be thought ahead of time before you end up trying to execute this plan. Yeah, I was thinking of the situation of like equipment that we deploy for our customers, you know, it should be bench tested, right? It should be set up and tested in our lab before it goes out. But I know sometimes there's delivery issues, something's got to go as soon as it shows up. So here goes my guy with a box that's not been opened. He hauls it into a hospital perhaps. And is it a real box? I mean, do let me ask you a question, is there data on the amount of times that this item actually went through the mail or do we is it like faked where the person, you know, brings it themselves, you know, because they don't they're afraid it'll get caught in transit. So they actually make it look like it's a real package, but it's not actually gone through the mail just showed up in your box. That that happens more often than not. So most of the time that the change of custody, so UPS FedEx, all those companies, you have to present yourself or at least your credit card as a chain of custody immediately, immediately online. One of the things that shows up is mostly threats don't have chain of custody. So you end up with people trying to mimic interoffice mail, trying to mimic just local deliveries, and just drop something off at a desk and see if they can get it inside. There's a major corporation in California that's very well known, who has a problem because they're so well known in the city that they're in Southern California that people go to the UPS bus route, they'll drop UPS boxes with fake printed from home addresses and printed from labels. The UPS guy will pick it up go, yeah, I know where they are and will carry it directly to their facility. One of the biggest problems is people trying to send in most of the time it's audition tapes. But when it shows up, it's just been carried by a private company that knows where they are. So they just drop it off. Wow, they're like the unsuspecting agent, right? That's interesting. Sure. Yeah, it's taking spam to a whole new level there. It's physical and the threat is obviously real. This is awesome. Let's up. I tell you what, we're about halfway through. Let's, we're going to take a break. We're going to pay some bills and we'll be right back in one minute with Will Plummer. Stick around. Aloha. My name is Mark Shlove. I am the host of Think Tech Hawaii's Law Across the Sea program. My program comes on every other Monday, one o'clock, and we talk about a lot of different subjects, all of them law related in some way, either life or practice. And I try to have a diversity of guests that can talk about different topics of interest. So please join us. Think Tech Hawaii Law Across the Sea program every other Monday, one o'clock in the afternoon. Aloha. Hey, Aloha. Welcome back. Thanks for sticking around. We are talking about mailroom insecurity, I think at this point. Will Plummer is with us from Ray Secure and we're going to get into some detection stuff. And I'm sure most of everyone's familiar with going through the airport and going through detectors. And sometimes they put you in this line, sometimes they put you in the one where you stand up and raise your arms and it spins around. So there's a lot of different types of detection. Your bags are being running through a scanner that's doing some detection. So Will, talk to us a little bit about what we're looking for, how small could it be? If it's a powder, if it's a liquid, what are we doing to try to find this type of stuff in our mailroom? So most of the threats, let's break them up into two categories. So if it's going to do after a person. So what Rand Paul saw when he was hit three months ago was probably 25, or sorry, 250 milligrams to 500 milligrams, enough to where it's not going to be felt when you have physical and tactile inspection. But when you open it up, it's going to spill out on the table. Everybody gets to react and it's going to be bad. That is quite common. If you look at that amount, that's the same month they hit Dr. Fauci in the same month. It generally goes after key individuals, C-suite style stuff, that kind of stuff. If you're looking at powder, correct. Is this the powder we're talking about? Okay. Yes, sir. Yeah. If you're looking like a facility and someone's to shut them down with a powder, it's often 2,500 to 5,000 milligrams, a lot more. But both of those aren't something you're going to pick up with x-ray. There's not enough mass or material there for an x-ray to see it. In fact, most companies make this mistake when they use an x-ray to scan their mail where most of the threats lie. They'll take all 800 pieces of mail. They'll dump it into a bucket. They'll run it through and they're not really going to catch much that way. That's just not necessarily effective. I've seen that a few too many times and it's unfortunately somewhat of a standard. If you're going to go up a little bit like what we do, when you mention you raise your hands over your head, that's millimeter wave. We're working in that spectrum with our equipment and that is something that's non-ionized. You put your hands in it, you can mess with it, but it'll pick up those density changes, those 250 milligrams of powder, 5,000 milligrams of powder, things that x-rays just not going to see. Then another way that you could do it is with the hard bigger CT scan stuff. That's what you see when your bag is going to be airport. They're hitting that way. I see. Just for the audience, how much, let's just talk about ricin. How much ricin is toxic? Very, very small amounts. The second half of your question, a second ago, how much is going to hurt you? Well, if you can get an inhale, ingest, or inject, a miniscule amount is going to cause a lot of pain. The problem is the transition between the envelope itself or whatever it's packaged in to where it's going to be enough to where you interact with it and it infects you. You're not going to see many people get hurt with ricin, honestly. It's really hard to do unless you are opening it up and inhaling, injecting or ingesting it. It's not going to get to you. You do see people react though. It's interesting if you look at a lot of the reports, the open source ones, you'll see people to go to the hospital or one person go to the hospital. Some of those people are having an emotional reaction, which is understood. Some of them are reacting to what they put in, so caustic materials. People will put in leeches. I've seen several recently there was sobby powder because sobby interacts with your nasal pharynx. When your nose gets it, you get a reaction. That's why people go to the hospital. Are these just warnings? Are they pranks? How are those dealt with? Because it's still a threat. This is a felony to commit these types of acts. Unfortunately, usually it's an escalation. Things always escalate from a phone call or a threat. One thing that I should mention is a lot of these threats we're seeing nowadays are insider. As people get laid off through the pandemic and we've seen this whole thing flow out, people reacting to negative things in the press, you're not going to see the typical such a package like we all grew up thinking. They're not necessarily all going to be oil stained and misspelled. It's really easy to spell versus name nowadays. The internet exists. Word and Google will not let you misspell things. You end up with a lot of those key ID features we got used to dealing with social packages no longer applying. The screeners now have to be even twice as good at what they're looking at to identify if this is a possible threat or not. Wow. Which industries are you think most proactive in working on this? Like banks, I'm just guessing the major critical infrastructures, but where are their gaps? Maybe we don't want to talk about that. I don't know. I probably want to talk about that, but I can tell you through who we deal with, banks are pretty good. However, banks generally are slow to turn. New technology like what we present, they're oftentimes want to see a benchmark with something else. Earlier doctors for us were a significant amount in tech. A lot of the technical part of the culture reached in and said, yeah, we want to try something new. We want to catch these things that x-rays not going to catch. It's worked out well for us. That's who's been leading into it. It's been technology companies. And is commercial level x-ray for Miram? Has that been around a long time? Is this a five-figure, price point, six-figure? What's the entry level I guess maybe for a facility? Like a large x-ray scanning set up that's been around really since 2001. Since 2001, that's when it really hit. Before that, really nobody did much. Things just got delivered. That's how the Unabomber got along so long. It's not that expensive for some of this equipment. You can get x-ray systems to come in for 60, 70K if you want to be able to look at something. The downside of that is what they can actually see. Those are meant for larger, heavy items, a lot of metal in it, things that you need a lot of energy to penetrate and get a good image on. Images just like ours that come in for less than that. It really does kind of matter what you're looking for, what your threats are. I can tell you from looking at all the threats since I've been doing this for two and a half years, x-ray just doesn't necessarily pick up on it. Sure. It makes sense that you would want, I think the threat awareness, I don't know if people understand the powder type of thread. I don't know if you get a card and you open a card on your desk and it pops open like poof. All the powder is going to flop in your face. That can definitely be lethal if it's some of these types of substances. Do they also stay around? If you've had a powder, I guess you investigate what it is, but if it is a toxic substance, now you have to clean this entire area. There's a cost to decontaminating the area. Absolutely. There's two sides to that. One, yes, it's going to stay around. These are all persistent items. You're not talking about some nerve gas that's going to evaporate. You're going to end up with a significant bill because say it is something caustic or it is something toxic, you end up with not only just the room itself, but you have to clean the entire logistics train, everything that came through. The anthrax threats in 2001, that was untold millions of dollars to clean every little thing. Some of those rooms were stripped down from regular rooms down to two by fours just so they could recover the area. It is significant and the cost is a lot. Unfortunately, that cost ends up being on the individual that was targeted. There's no city or county government that's going to come in and spend their time, energy and effort to decontaminate you without you necessarily having to pay for it. I hate to say this analogy, but think of it like a murder scene. When you get your home back, you have to pay to remediate it. When you get your office back, it's the same thing and sometimes this could take days. Sure. Interesting. I hadn't considered it and I don't even know, do insurance, are there clauses for, does insurance help out with this or is this a, where you have yet, if you don't have any best practices, like if you haven't gone to actually looking and training your people, right? You're sort of negligent that it occurred to you or so maybe there's no coverage. I think it's unknown enough that I'm sure insurance probably will help in some of these events and I'm sure that's not something that any company is going to let us know openly. Hey, by the way, this is how I read it. But the flip side of that is people should be doing something about this. Yeah. It shows up on your desk as a CSO. Okay. The reality is most of the time, this is going to show up on one of your screeners' desks and in their hands. Duty of care, responsibility of care, you should care as much about what happens down in the basement as you do up in with the C-suite because those people are just as important as everybody else is and that's where the effort needs to be put in place. It's not necessarily up in the upper stacks. It's going to be where people are doing this screening and where those efforts are hopefully catching all the possible threats. Yeah. And I know that I think of a few facilities that receive their mail. It's like in a separate area like near the loading dock and it's kept that way and they're probably they are X-raying it if I think about it. But not parading it all the way through the entire office to open it up front or upstairs. Now you've contaminated potentially a much larger area. So that containment piece, I think is critical. What's the uptake on training and awareness? I would think that would lead obviously the procurement of some devices. How active are you guys seeing that space for you? It's actually increasing. So we have companies that have taken on that train a hundred people for them. I would argue that most of the screening, almost all that you need to do can be done without a lot of technology with somebody who gets shown the right way to do physical and tactile inspection, knows what they're looking for, and then can move all those things that we would be worried about. Take this is clean. Don't worry about it. So now we got to scan a very small amount of stuff. And most facilities that we talk to, we talked to companies that say have 25 facilities. They really only need equipment and say top two, three or four. The rest of them are eight people in a building in Ottawa or somewhere in Omaha. You just want to make sure those eight people are safe and know what they're doing. And you do that through training. Yeah, for sure. I mean, it tends to precede everything. This awareness campaign that you guys are obviously sharing with people. Is this going to be happening like at GSX? Are you guys going to have a booth out there? Are you doing any presentations or any talks there that we can advertise while we're on here today? We tried to get on the GSS talk circuit, but the mail is not necessarily the most inviting thing for GSX. Although maybe now they might have space. We are going to be a GSS. We do have a booth there. We do quarter the webinars. We do all sorts of stuff. If you go to our website, you can track and just we're trying to educate people. A few of our partners use the term flat on the curve where we're trying to do that. So everybody understands more or the probability of what's happening to them in their mail room and not necessarily the worst case. Don't I mean? Sure, sure. Understood. Yeah, I'll be down there. So I'll definitely swing by and chat with you guys. I'd like to take a look at some of the technology. So we've got a minute or so left. What's the one takeaway you'd like to share with the audience today from your experience with this industry? Unfortunately, a lot of people look at this like it's just mail. We'll talk to CSOs or talk to people. I had that gun in the mail three weeks ago. That was nothing. I had the hazmat team next to my desk, you know, 11 months ago, but whatever. And I don't realize that's a string of events that shows you a symptom or problem. And unfortunately, people look at mail oftentimes and go, yeah, okay, it's just the mail. Except it walks all the way up to in front of the people who you're trying to protect the most. You don't do something about before it gets there. Unfortunately, you're going to have a bad day in the long run. Yeah, I love that. Well, thank you so much. I appreciate the insight. Folks, check out your mail. Give some thought. Check out the materials they have for training. This is a serious duty of care issue. I love that term. You know, if we're taking care of our people, we need to take care of the stuff that could harm them. And this is something that's inbound. It's a wide open door for a lot of organizations. So check out Race Secure if you're down at GSX. Check out the video, but this is a threat. This is a threat that we can all work on together and make our world, make our businesses, make our communities safer. Will, I really appreciate your time today. We'll see you down at GSX. Thank you, Andrew. I'll see you there. Alrighty. Take care, everybody. Aloha.