Cyber Risk Vs. Cybersecurity: Preparing For AI Threats With Leopold Lueddemann

Speaker A: Foreign. This is Navigating Cyber Risk podcast with me, John Riley, and George Ucy as your hosts. Join us as we explore the challenges faced by executives as they grapple with new and ever changing cybersecurity mandates. Welcome, um, to Navigating Cyber Risk with your host, John Riley, where we explore the challenges faced by executives as they grapple with new cybersecurity mandates. Today we have an awesome guest who is a passionate traveler who enjoys exploring the world with his family. He's achieved an impressive feat of visiting every continent on the globe. Recently returned from an exciting adventure in Rwanda. He embraces cultural experiences through cooking classes and volunteering during each trip. Welcome to Lee Ludeman, owner of Ludeman Law.

Speaker B: Thanks, John. Happy to be here.

Speaker A: All right, so we're just going to jump right in here. Lee, how would you explain the difference between what cybersecurity is and what cyber risk is?

Speaker B: So, cyber risk, I see one as an overall approach. The other is the actual aftermath of how that approach is implemented and put into action. So let's break that down. I see cyber risk as an analysis of, uh, threat versus vulnerability. And therefore, you get the risk. So vulnerability, how much is there? How much threat is there? And that would give a risk, then you have. Cybersecurity is the way to. Once you know the risk, mitigate the risk intelligently, especially if you have limited

Speaker A: resources and maybe even evaluate what that risk, you know, the level of risk on each one. Right, Agreed. Yeah. Uh, because, I mean, otherwise, you know, maybe there needs to be a formula, you know, for each company on. On, maybe. So, Lee, I think we got something we can work on together to make that happen.

Speaker B: I have one. I used to teach privacy in law school, and I used to teach it with the three little pigs. So everybody's familiar with the story. The big bad wolf is the actual threat. And each little pig, you have straw, sticks, and bricks. That's your vulnerability. If there's no big bad wolf, it doesn't matter if your house is made out of straw, sticks, or bricks. There's zero threat. It's not going to be blown down. When you have the big bad wolf, you have the threat. Then you have a vulnerability of straw. Very vulnerable. There's 100% risk. Sticks, very vulnerable, 100% risk. The threat is there with the brick house, but no matter how hard the wolf blew, there's no risk because he couldn't blow the house down or no vulnerability. Couldn't blow the house down there for no risk. So it's a matter of And I see it as a matricy. Uh, sorry for nerding out on you, but you have the vulnerability, the threat, and therefore the risk.

Speaker A: I don't know if it's nerding out using nursery rhymes, man. That might not be too much of a nerd thing. Right. But I get your point. And I'm not sure, uh, it's 100% on a stick, House. Yeah. You at least did something to cover it. But I agree it's still going to get blown down. If the right actor, if the right person comes with the right force, that it will fold like a cheap suit.

Speaker B: Right, Exactly.

Speaker A: So, yeah, it depends on the wolf and how they're looking, but they're getting better every day. Uh, so what would you say is the most significant cyber security threat that's facing companies today?

Speaker B: Of the ones that is most relevant to my law practice is the emerging threat of AI and AI uses. And we see this with a lot of the EU AI act and what's put into play last year and over the next few years. And also just today, I believe the White House and, uh, today being July 23rd, officially released an AI action plan. So we have a lot of people working on AI action plans, state patchwork of laws, the us, uh, Brazil, all sorts of other areas, including the eu

Speaker A: and those regulations are going to get more and more as we move forward, and I think it's going to become more complicated. I mean, you also do some privacy work, right? And so, I mean, I think there's privacy laws now in all 50 states for privacy of data, correct?

Speaker B: To some extent, yeah. There's a few stragglers, but it depends. There's also overall federal regulations in terms of privacy in certain aspects. And what I'm seeing is privacy laws are, I just want to say, in my opinion, on a collision course with artificial intelligence.

Speaker A: That's a great way of putting it. I can definitely see that. Well, then how should a CEO prioritize their cyber risk? I mean, if you were in a CEO's shoes of a medium large corporation, where does that prioritization come?

Speaker B: Well, I think this is great. Omnistruct has with regulatory compliance, you first look at. And Omnistruct can help with this identifying risk like we just talked about. And then meeting regulations, you can't always avoid a breach, but you can certainly reduce your liability. And talking to a lawyer, it's not just the action, but are you liable, are the defenses to it, et cetera. How does this all play out on the bottom line in terms of Liability, both in the public forum as well as financially and other aspects as well.

Speaker A: And do we have a leg to stand on? I mean, is there something. Did you track what you were doing, right? I mean, to prevent this or, you know, only every couple years?

Speaker B: It's certainly not something you can sweep under the rug. It's something you need to keep up with because it's changing rapidly and it seems to just speed up more and more and more. And not just speeding up, but changing too. The threats change, the means change, the bad actors change. And so it's something you constantly need to keep up with. It's not something that you can chase around the dog, can't chase the tail anymore. You need to anticipate it, prepare for

Speaker A: it, be, understand that it's coming. And you know, there is no 100% security blanket that's going to cover you even if, even if you have a brick house. I mean, I live in Florida, so I've seen brick houses underwater when it may not be a big bad wolf, but it can still go under.

Speaker B: That's right. And with your brick house, there are still glass windows.

Speaker A: That is absolutely correct. So from your perspective, what, uh, emerging trends do you see that we're going to have the most impact on cyber security in the near future?

Speaker B: The trends I think are, and uh, clearly I tie into AI, but with the global marketplace and bad actors, you've got people using AI for all sorts of things and part of the risk. And I look at liability, not just cybersecurity, but also potentially liability, for example, patent infringement, trademark infringement, copyright infringement. All these are liabilities for a company with untrained or novice AI users. And this could be buying into voice phishing or phishing schemes, all sorts of other things these people are coming up with. And for example, chatbots are a cheap and low tech way that, that bad actors are starting to exploit, I believe. And you would know just, I know you're an expert in this as well, but AI has really opened up a lot more avenues and different amounts of money that people can spend to compromise a company.

Speaker A: Uh, not only that, but I mean, when you're talking like, you know, voice phishing and that type of thing, I mean, m. I'm getting concerned about having like my voice on my recording for, you know, leave a message. Right. Because all they need is that, that little snippet for them to be able to create my voice now and do voice authentications with my bank or something. Right. And so a friend of mine actually had that happen. And so it's getting more and more protective from a personal standpoint that you've got to really, uh, try and figure out, you know, what level of risk are you personally taking. Not just from a company standpoint, but

Speaker B: it also works for the good. For example, when you look at the biometric acts like Illinois and in the eu, when they're looking at such things as not just voice, but voice inflections, facial recognition, etc. Furrowing of eyebrows, even the words you type and how you react and how long it takes you to type, I think that that can be of course used for bad, to impersonate other people and lead to scams, but also to detect if that's recorded in a bank, if somebody is committing fraud, breaking into an account that isn't the account owner, if it doesn't match those biometrics, they can potentially shut that down. And I believe that has occurred. So it's good and bad, but it's certainly evolving and a little scary.

Speaker A: Well, uh, so if you were in those shoes, right, and somebody had just hacked your business, your account, you know, if you're a CEO of a company, what's that journey look like, that feeling in the morning when you wake up and your data's ransomware and you got some message from somebody and it says opio pay and uh, I've already released the data or whatever. Tell me what you think that feels like. I'm sure you've dealt with some of the people that have had that.

Speaker B: Yeah, absolutely. Well, I know where you want to be and where you don't want to be. And this comes in with a little bit of advanced planning. An ounce of prevention is worth a pound of cure. If you have a plan set up, uh, you know who to call. You spring into action and you have a team ready to go, you know, different departments and outside people to help you with that. This certainly if you wake up to that and you find out that you being the CEO, somebody has created a deep fake of, um, your voice, may even your visual, and tried to commit a fraud. Worst case scenario, I suppose, but all sorts of other things as well. This is not the time to be calling people to figure out who do I call and making introductions. This is the time when this is what we're ready for. So, uh, you can put together a plan, you can put together an action plan, but the only thing that matters when it happens is the fact that you have planned for the event because probably it isn't going to go 100% to the scenarios and the hypotheticals you planned for, but at least you have a plan in effect and you can act and you pretty much know what to do. Yeah, there was a super wake up and cry. Or you could wake up and say, here we go. This is what I've been preparing for.

Speaker A: This is how we practiced it, right? There was a Marvel show or something where he goes, you know, prepare the plan, write the plan, and then throw the plan out because it doesn't matter anymore. You just gotta go with what's going on kind of thing. I don't remember exactly what the thing was, but it was similar. I mean, you know, when you get in that emergency situation, like your bells and whistles are going off and you just kind of make things go.

Speaker B: But.

Speaker A: But it does help to have that contact and the PR company and the lawyer and the, you know, all the deposits paid and ready to go. Because if you don't, then they don't take your call.

Speaker B: Absolutely. Especially you have, uh, a 24 or 48 hour deadline to act.

Speaker A: Yeah. Well, tell me, Liam. So, okay, let's do this. Tell me a little bit about yourself. How did you get here? You know, you like privacy, you like AI, you like, you know, you're doing trademarks. I mean, how did you end up in that situation of being a lawyer?

Speaker B: So one of my first gigs out of law school was general counsel of a pharmaceutical company. And that was in 2000. That was my introduction into privacy law. And I don't even know if it was called privacy law, but then or not. So I'm, um, a registered patent attorney, so I've always had one foot in science and technology. And as you alluded to part of my practice, patents, trademarks, copyrights and license agreements. But we had clinical trials all over the world, and so dealing with patient data, both with oncology and drugs, as well as medical devices, which our company had a few. That was my introduction into privacy when HIPAA was just three years old. And so regardless whether I've worked for the state, the federal government, or various law firms, I've always dealt with privacy in one sense or another. And in 2012, I started this practice with those two areas of law in focus. Recently, AI has become a big part of my practice, as you probably already gathered, and it's very fun for me unintentionally, but now those two continue to merge closer and closer. And those two, I mean, intellectual property, privacy, and the merger of AI is just one way they're merging into one,

Speaker A: which is going to be an interesting intersection of how those are going to come together because the AI is just sucking in any data that it can, whether it's privacy data or not. We're definitely coming into some changes that may need to be looked at. How's that?

Speaker B: Amen.

Speaker A: So tell me, and, uh, this could be life advice, right? I mean, what changes would you make?

Speaker B: So, not a lot of changes, to be honest. I think one of my strengths is to be open and try and listen to what's going on around me. Like I said, the path of my practice right now, I would, uh, have never guessed 25 years ago, when I was introduced into privacy and I started my legal career, that AI would be as it is now and privacy would be in its own right, an area of law. Clearly, patents are, uh, one of the first, I think the first specialty in law set up in the Constitution of the United States. So that was not an awakening. But where this has taken me now is certainly interesting, and I'm glad that I am open to it and try and look around for what changes. I see many good companies that get complacent and rest on their laurels and unfortunately, maybe not meet their demise, but become not as relevant as they once were. I think it's good to stay out of your comfort zone.

Speaker A: That's where growth happens, right? I mean, if you're just in life, you have to be challenged. You have to, you know, what do they say? Steel doesn't become steel by just sitting there. It has to be worked and has to be heated and, you know, to become steel. And by the way, that's for George. In case you don't know George. George is a, uh, blacksmith on the side. So there's his, uh, anvil and his, uh, steel reference for George, anybody that knows him. So tell me about your passions. Like, what do you do outside of work? I mean, we talked about travel and the volunteering and such, but I mean, what else do you do? I mean, where's your next trip to?

Speaker B: So we just, as you said, just got back from gorilla trekking in the mountains of Rwanda, which was a bucket list item for us. Very, very rewarding. Surprising. We were probably within 5 yards of a silverback and a whole gorilla family. So just getting out there, marching around in the elevations of the mountains of Rwand and in through Tanzania with some safaris and ending up on the beach in Zanzibar. We are off, uh, next to the fjords of NORWAY, Specifically because 2025, I am pretty sure is the last year that you can take an emissions vehicle into the UNESCO World Heritage Sites of Norway. After 2025, it'll be non emissions only. So we are going to go see Iceland and the fjords of Norway and a few other countries.

Speaker A: Beautiful. I love it. What else do you like to do besides travel?

Speaker B: I actually like to garden. I love my fruit trees and berry bushes.

Speaker A: I love it. I've got two apple trees, a cherry tree, a pomegranate tree, a couple citrus trees. So I'm probably not nearly as big of a garden as you have, but I'm working on it. M. I'm working my way up to it.

Speaker B: It's enjoyable to get outside, deal with something that can be very non technical and rewarding and simple. And these events, with almost immediate gratification are rare in life. And I enjoy. I don't know if I'm out mowing the lawn, picking an apple or some cherries and enjoying that right away.

Speaker A: Excellent. For me. Yeah, I just bought a tractor, so I've been playing with that and you know, digging holes and, you know, that kind of stuff. But that's. I think that might be another.

Speaker B: I'll be right over. John, that sounds like a great time.

Speaker A: Come on over. I like it. Yeah. So I've been digging holes and moving dirt around the property and playing and now don't get me wrong, I've also hit the house once or twice with the excavator kind of thing, you know, and oops. Okay, well, you know, but I, uh, think that's another podcast that we might have to do on that one. What are you currently working on that you're most excited about?

Speaker B: So this is new for me and that's exciting for me. I am helping a nonprofit museum to create an online presence. So going through and working with their engineers to protect their intellectual property through what can be somewhat novel means given, uh, technology of, uh, scraping and using their images and their text, etc. Besides just the normal legal protections, but working with engineering, creating novel ways to protect it. And that is a lot of fun for me because it's something I've not done before.

Speaker A: I, uh, mean, that would be interesting for a lot of people. I mean, you're playing with some new technologies, your education. I mean, there's lots of good features coming out of that one. Well, so Lee, how can people reach you?

Speaker B: So thankfully my contact information should be put at the bottom of the screen. If it isn't already appearing, it should be shortly appearing and that's the best way to get a hold of me.

Speaker A: All right. But, um, would you like it to be email LinkedIn. What's the best way?

Speaker B: Send me an email.

Speaker A: Send you an email. All right, Lee, I think we got it. So. All right. Well, Lee, I appreciate your time on this one and, you know, your insight into all the privacy stuff. I mean, it's not very often that we actually get a privacy expert, you know, that understands this as well as, you know, the. The learning of AI and how that's intersecting. So I really appreciate you being on and taking the time to be on here, Lee.

Speaker B: My pleasure, John. Always great to speak with you.

Speaker A: We have fun when we're together. Maybe we'll start traveling together. I kind of like your plans. All right, everybody. Uh, thank you to our audience for listening. Hope you've learned something today. Maybe pass this on to a friend. We were always looking to find more people on the podcast. And then there it is. It's been another great episode of Navigating Cyber Risk with your host, John, and we'll see you next time. Thanks, everybody. This was another amazing episode of Navigating Cyber Risk powered by Omnistruck. Show us some love by subscribing and sharing today. Reach out to us with any comments, questions, or ideas about future shows by emailing us at podcast at omnistruct. Com. Until next time. Remember, governance is not a technology.